On Wed, Jan 03, 2018 at 09:47:46AM +1100, Duncan Roe wrote:
> Hi Pablo,
>
> On Sun, Dec 31, 2017 at 12:16:30AM +0100, Pablo Neira Ayuso wrote:
> > Hi Harsha,
> >
> > On Sun, Dec 31, 2017 at 09:51:10AM +1100, Duncan Roe wrote:
> > > On Thu, Dec 28, 2017 at 11:52:36AM +0100, Pablo Neira Ayuso wrote:
> > > > Cc'ing Duncan.
> > >
> > > No need - I'm on netfilter-devel ;)
> > > >
> > > > On Thu, Dec 28, 2017 at 12:58:33PM +0530, Harsha Sharma wrote:
> > > > > Do not print timeout and burst in case default values are used.
> > > > > For e.g.
> > > > > iptables-translate -A INPUT -m tcp -p tcp --dport 80 -m hashlimit
> > > > > --hashlimit-above 200/sec --hashlimit-mode srcip,dstport
> > > > > --hashlimit-name http1 -j DROP
> > > > >
> > > > > nft add rule ip filter INPUT tcp dport 80 flow table http1 { tcp
> > > > > dport .
> > > > > ip saddr limit rate over 200/second } counter drop
> > > >
> > > > This is what I was asking for.
> > > >
> > > > Applied, thanks Harsha.
> > > >
> > > > @Duncan: I think you can update the wiki again after this, given that
> > > > now those values should not be printed.
> > >
> > > I tested after applying the patch and now the second example is broken:
> > >
> > > > iptables-translate -A INPUT -m tcp -p tcp --dport 80 -m hashlimit
> > > > --hashlimit-above 200kb/s --hashlimit-burst 1mb --hashlimit-mode
> > > > srcip,dstport --hashlimit-name http2 --hashlimit-htable-expire 3000 -j
> > > > DROP
> > > > nft add rule ip filter INPUT tcp dport 80 flow table http2 { tcp dport
> > > > . ip saddr timeout 3s limit rate over 200 kbytes/second burst 1 mbytes
> > > > burst 6 packets} counter drop
> > >
> > > The traling "burst 6 packets" should not be there.
> >
> It gets worse. Substitute 1000 for 3000 in the above:
>
> > $ iptables-translate -A INPUT -m tcp -p tcp --dport 80 -m hashlimit
> > --hashlimit-above 200kb/s --hashlimit-burst 1mb --hashlimit-mode
> > srcip,dstport --hashlimit-name http2 --hashlimit-htable-expire 1000 -j DROP
> > nft add rule ip filter INPUT tcp dport 80 flow table http2 { tcp dport . ip
> > saddr limit rate over 200 kbytes/second burst 1 mbytes burst 6 packets}
> > counter drop
OK, so the problem is the extra "burst 6 packets".
This patch should fix this.
diff --git a/extensions/libxt_hashlimit.c b/extensions/libxt_hashlimit.c
index 472d8e7f6cc2..3fa5719127db 100644
--- a/extensions/libxt_hashlimit.c
+++ b/extensions/libxt_hashlimit.c
@@ -1350,10 +1350,12 @@ static int hashlimit_mt_xlate(struct xt_xlate *xl, const char *name,
if (cfg->mode & XT_HASHLIMIT_BYTES)
print_bytes_rate_xlate(xl, cfg);
- else
+ else {
print_packets_rate_xlate(xl, cfg->avg, revision);
- if (cfg->burst != 5)
- xt_xlate_add(xl, " burst %lu packets", cfg->burst);
+ if (cfg->burst != XT_HASHLIMIT_BURST)
+ xt_xlate_add(xl, " burst %lu packets", cfg->burst);
+
+ }
xt_xlate_add(xl, "}");
return ret;
