rate limit not working ?

rate limit not working ?

[Christophe Leroy]

Hi

I tried to limit ping flooding by setting the following rule:

nft add rule filter input icmp type echo-request limit rate 10/second accept

But it doesn't work, I can still ping flood the target.
What I see is that nft_limit_pkts_eval() is called only once at the 
begining of the flood.
After, during do_nft_chain(), regs.verdict.code is changed from -1 to 1 
by a call to nft_immediate_eval() earlier in the loop.

How can I investigate that issue ?

Using linux kernel 4.4.21

Christophe

Re: rate limit not working ?

[Pablo Neira Ayuso]

On Fri, Sep 16, 2016 at 06:50:22PM +0200, Christophe Leroy wrote:
> Hi
> 
> I tried to limit ping flooding by setting the following rule:
> 
> nft add rule filter input icmp type echo-request limit rate 10/second accept

This is matching packets under the rate, so packets under the rate are
accepted.

Your next rule, or default policy, should drop, so packets over the
rate are dropped.

You can invert this logic via:

 # nft add rule filter input icmp type echo-request limit rate over 10/second drop

Does this work for you?

Thanks.

Re: rate limit not working ?

[Christophe Leroy]

Le 20/09/2016 à 10:13, Pablo Neira Ayuso a écrit :
> On Fri, Sep 16, 2016 at 06:50:22PM +0200, Christophe Leroy wrote:
>> Hi
>>
>> I tried to limit ping flooding by setting the following rule:
>>
>> nft add rule filter input icmp type echo-request limit rate 10/second accept
>
> This is matching packets under the rate, so packets under the rate are
> accepted.
>
> Your next rule, or default policy, should drop, so packets over the
> rate are dropped.
>
> You can invert this logic via:
>
>  # nft add rule filter input icmp type echo-request limit rate over 10/second drop
>

That didn't work either, but in fact I found the issue: I have a rule 
'ct state established, related accept' earlier in the ruleset, so only 
the first ping packet reached the rate limitation rule.

Putting the rate limitation rules before that ct state rule, it works as 
expected.

Thanks for your help

Christophe