Hi Pablo,
On Sun, Dec 31, 2017 at 12:16:30AM +0100, Pablo Neira Ayuso wrote:
> Hi Harsha,
>
> On Sun, Dec 31, 2017 at 09:51:10AM +1100, Duncan Roe wrote:
> > On Thu, Dec 28, 2017 at 11:52:36AM +0100, Pablo Neira Ayuso wrote:
> > > Cc'ing Duncan.
> >
> > No need - I'm on netfilter-devel ;)
> > >
> > > On Thu, Dec 28, 2017 at 12:58:33PM +0530, Harsha Sharma wrote:
> > > > Do not print timeout and burst in case default values are used.
> > > > For e.g.
> > > > iptables-translate -A INPUT -m tcp -p tcp --dport 80 -m hashlimit
> > > > --hashlimit-above 200/sec --hashlimit-mode srcip,dstport
> > > > --hashlimit-name http1 -j DROP
> > > >
> > > > nft add rule ip filter INPUT tcp dport 80 flow table http1 { tcp dport .
> > > > ip saddr limit rate over 200/second } counter drop
> > >
> > > This is what I was asking for.
> > >
> > > Applied, thanks Harsha.
> > >
> > > @Duncan: I think you can update the wiki again after this, given that
> > > now those values should not be printed.
> >
> > I tested after applying the patch and now the second example is broken:
> >
> > > iptables-translate -A INPUT -m tcp -p tcp --dport 80 -m hashlimit --hashlimit-above 200kb/s --hashlimit-burst 1mb --hashlimit-mode srcip,dstport --hashlimit-name http2 --hashlimit-htable-expire 3000 -j DROP
> > > nft add rule ip filter INPUT tcp dport 80 flow table http2 { tcp dport . ip saddr timeout 3s limit rate over 200 kbytes/second burst 1 mbytes burst 6 packets} counter drop
> >
> > The traling "burst 6 packets" should not be there.
>
It gets worse. Substitute 1000 for 3000 in the above:
> $ iptables-translate -A INPUT -m tcp -p tcp --dport 80 -m hashlimit --hashlimit-above 200kb/s --hashlimit-burst 1mb --hashlimit-mode srcip,dstport --hashlimit-name http2 --hashlimit-htable-expire 1000 -j DROP
> nft add rule ip filter INPUT tcp dport 80 flow table http2 { tcp dport . ip saddr limit rate over 200 kbytes/second burst 1 mbytes burst 6 packets} counter drop
Because I happened to specify the arbitrary default in my iptables command, it
did not propogate to nft at all.
I am working on a patch,
Cheers ... Duncan.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
