From mboxrd@z Thu Jan 1 00:00:00 1970 From: Florian Westphal Subject: Re: [PATCH] netfilter: xt_hashlimit: handle iptables-restore of hash with same name Date: Thu, 24 Jul 2014 13:48:46 +0200 Message-ID: <20140724114846.GE18404@breakpoint.cc> References: <1406004850-31336-1-git-send-email-johunt@akamai.com> <20140724084927.GB18404@breakpoint.cc> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Florian Westphal , Josh Hunt , Pablo Neira Ayuso , Jozsef Kadlecsik , netfilter-devel@vger.kernel.org, coreteam@netfilter.org, Harald Welte , Jan Engelhardt To: Patrick McHardy Return-path: Received: from Chamillionaire.breakpoint.cc ([80.244.247.6]:34564 "EHLO Chamillionaire.breakpoint.cc" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750771AbaGXLsx (ORCPT ); Thu, 24 Jul 2014 07:48:53 -0400 Content-Disposition: inline In-Reply-To: Sender: netfilter-devel-owner@vger.kernel.org List-ID: Patrick McHardy wrote: > On 24. Juli 2014 09:49:27 GMT+01:00, Florian Westphal wrote: > >Josh Hunt wrote: > >> Currently when we do do this the new parameters are not enforced. > > > >Note that: > > > >-A INPUT -m hashlimit --hashlimit-upto 10/sec --hashlimit-burst 10 > >--hashlimit-name test > >-A INPUT -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 10 > >--hashlimit-name test > > > >doesn't work as expected either (rule #2 uses config options of #1). > > > >I think is behaviour is so unexpected that I would consider this a > >bug... > > True, but it's a bug that has existed forever and I've seen scripts that actually rely on this. Too bad. In that case it seems like we really cannot fix this 8-(