Hi Harsha,
On Sun, Dec 31, 2017 at 09:51:10AM +1100, Duncan Roe wrote:
> On Thu, Dec 28, 2017 at 11:52:36AM +0100, Pablo Neira Ayuso wrote:
> > Cc'ing Duncan.
>
> No need - I'm on netfilter-devel ;)
> >
> > On Thu, Dec 28, 2017 at 12:58:33PM +0530, Harsha Sharma wrote:
> > > Do not print timeout and burst in case default values are used.
> > > For e.g.
> > > iptables-translate -A INPUT -m tcp -p tcp --dport 80 -m hashlimit
> > > --hashlimit-above 200/sec --hashlimit-mode srcip,dstport
> > > --hashlimit-name http1 -j DROP
> > >
> > > nft add rule ip filter INPUT tcp dport 80 flow table http1 { tcp dport .
> > > ip saddr limit rate over 200/second } counter drop
> >
> > This is what I was asking for.
> >
> > Applied, thanks Harsha.
> >
> > @Duncan: I think you can update the wiki again after this, given that
> > now those values should not be printed.
>
> I tested after applying the patch and now the second example is broken:
>
> > iptables-translate -A INPUT -m tcp -p tcp --dport 80 -m hashlimit
> > --hashlimit-above 200kb/s --hashlimit-burst 1mb --hashlimit-mode
> > srcip,dstport --hashlimit-name http2 --hashlimit-htable-expire 3000 -j DROP
> > nft add rule ip filter INPUT tcp dport 80 flow table http2 { tcp dport . ip
> > saddr timeout 3s limit rate over 200 kbytes/second burst 1 mbytes burst 6
> > packets} counter drop
>
> The traling "burst 6 packets" should not be there.
Please, send a new patch to fix this as Duncan spots.
Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
