Limit module accept negation?

Limit module accept negation?

[Jorge Agrelo]

Can I replace this two rules

iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 4 -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP

For only this one? (Using negation)

iptables -A INPUT -p tcp --syn -m limit ! --limit 1/s --limit-burst 4 -j DROP

Thanks in advanced
**********************************
CTO: Eng. Jorge Agrelo O.
WEb: www.novadevices.com
E-Mail: jagrelo@novadevices.com
Phone: (593-2) 225-7711 ext. 105
Av. Brasil N45-08 y Condor, Quito Ecuador
**********************************

Re: Limit module accept negation?

[Samuel Jean]

On Mon, January 10, 2005 8:08 pm, Jorge Agrelo said:
> Can I replace this two rules
>
> iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 4 -j
> ACCEPT
> iptables -A INPUT -p tcp --syn -j DROP
>
> For only this one? (Using negation)
>
> iptables -A INPUT -p tcp --syn -m limit ! --limit 1/s --limit-burst 4 -j
> DROP

Unfortunately, you can't without a bit of hacking.
If it happens you would, just grab ipt_limit.c and search for:

/* We're underlimit */

Change the return codes so it returns 0 when 'underlimit', otherwise, 1.
Am sorry if this is straigh, I am at work.
Note that this won't add '!' support but just doesn't match unless it
bursts the limit.

By the way, do you want to limit as soon as you receive more than 1/s packet
regardless of the source address?

>
> Thanks in advanced

HTH,

Samuel

Re: Limit module accept negation?

[Jorge Agrelo]

Hi Samuel

Yes, I want to limit (drop) as soon as we receive more than 1/s packet
regardless of the source address?, Is there any other way to do that without using
limit match with negation?

Regards
 
On 12 Jan 2005 at 9:20, Samuel Jean wrote:

> On Mon, January 10, 2005 8:08 pm, Jorge Agrelo said:
> > Can I replace this two rules
> >
> > iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 4 -j
> > ACCEPT
> > iptables -A INPUT -p tcp --syn -j DROP
> >
> > For only this one? (Using negation)
> >
> > iptables -A INPUT -p tcp --syn -m limit ! --limit 1/s --limit-burst 4 -j
> > DROP
> 
> Unfortunately, you can't without a bit of hacking.
> If it happens you would, just grab ipt_limit.c and search for:
> 
> /* We're underlimit */
> 
> Change the return codes so it returns 0 when 'underlimit', otherwise, 1.
> Am sorry if this is straigh, I am at work.
> Note that this won't add '!' support but just doesn't match unless it
> bursts the limit.
> 
> By the way, do you want to limit as soon as you receive more than 1/s packet
> regardless of the source address?
> 
> >
> > Thanks in advanced
> 
> HTH,
> 
> Samuel
> 
> 

Re: Limit module accept negation?

[Samuel Jean]

[-- Attachment #1: Type: text/plain, Size: 504 bytes --]

Jorge Agrelo wrote:

> Yes, I want to limit (drop) as soon as we receive more than 1/s packet
> regardless of the source address?, Is there any other way to do that without using
> limit match with negation?

AFAIK, there isn't.

> 
> Regards
>  

The patch below is against ipt_limit.c from 2.6.10. It's *untested* but 
reflects what I told you. It's just an exemple of how you can make
this module behaving the other way arround.

(NOTE: ipt_limit.c was written to avoid flooding -j LOG)

HTH,

Samuel

[-- Attachment #2: ipt_limit.patch --]
[-- Type: text/x-patch, Size: 337 bytes --]

--- ipt_limit.c	2005-01-13 20:14:10.000000000 -0500
+++ ipt_limit.c.orig	2005-01-13 20:13:19.000000000 -0500
@@ -82,11 +82,11 @@
 		/* We're not limited. */
 		r->credit -= r->cost;
 		spin_unlock_bh(&limit_lock);
-		return 0;
+		return 1;
 	}
 
        	spin_unlock_bh(&limit_lock);
-	return 1;
+	return 0;
 }
 
 /* Precision saver. */

Re: Limit module accept negation?

[Samuel Jean]

[-- Attachment #1: Type: text/plain, Size: 258 bytes --]

Samuel Jean wrote:
> The patch below is against ipt_limit.c from 2.6.10. It's *untested* but 
> reflects what I told you. It's just an exemple of how you can make
> this module behaving the other way arround.
> 

Doh! crapy patch. Attached good one. I hope.

[-- Attachment #2: ipt_limit.patch --]
[-- Type: text/x-patch, Size: 337 bytes --]

--- ipt_limit.c.orig	2005-01-13 20:13:19.000000000 -0500
+++ ipt_limit.c	2005-01-13 20:14:10.000000000 -0500
@@ -82,11 +82,11 @@
 		/* We're not limited. */
 		r->credit -= r->cost;
 		spin_unlock_bh(&limit_lock);
-		return 1;
+		return 0;
 	}
 
        	spin_unlock_bh(&limit_lock);
-	return 0;
+	return 1;
 }
 
 /* Precision saver. */

Re: Limit module accept negation?

[Jorge Agrelo]

Thanks Samuel, after I apply the patch, How look like the rule with 
limit to drop packets flowing above 1p/s

Regards

On 13 Jan 2005 at 20:24, Samuel Jean wrote:

> Samuel Jean wrote:
> > The patch below is against ipt_limit.c from 2.6.10. It's *untested* but 
> > reflects what I told you. It's just an exemple of how you can make
> > this module behaving the other way arround.
> > 
> 
> Doh! crapy patch. Attached good one. I hope.
> 

Re: Limit module accept negation?

[Samuel Jean]

On Fri, January 14, 2005 9:36 am, Jorge Agrelo said:
> Thanks Samuel, after I apply the patch, How look like the rule with
> limit to drop packets flowing above 1p/s

iptables -I INPUT -m limit --limit 1/s -j DROP

Let me know if that didn't work.

> Regards

Cheers,

Samuel