Re: [PATCH v2] extensions: libxt_hashlimit: Do not print default timeout and burst

[Duncan Roe <duncan_roe@optusnet.com.au>]

On Thu, Dec 28, 2017 at 11:52:36AM +0100, Pablo Neira Ayuso wrote:
> Cc'ing Duncan.

No need - I'm on netfilter-devel ;)
>
> On Thu, Dec 28, 2017 at 12:58:33PM +0530, Harsha Sharma wrote:
> > Do not print timeout and burst in case default values are used.
> > For e.g.
> > iptables-translate -A INPUT -m tcp -p tcp --dport 80 -m hashlimit
> > --hashlimit-above 200/sec --hashlimit-mode srcip,dstport
> > --hashlimit-name http1 -j DROP
> >
> > nft add rule ip filter INPUT tcp dport 80 flow table http1 { tcp dport .
> > ip saddr limit rate over 200/second } counter drop
>
> This is what I was asking for.
>
> Applied, thanks Harsha.
>
> @Duncan: I think you can update the wiki again after this, given that
> now those values should not be printed.

I tested after applying the patch and now the second example is broken:

> iptables-translate -A INPUT -m tcp -p tcp --dport 80 -m hashlimit --hashlimit-above 200kb/s --hashlimit-burst 1mb --hashlimit-mode srcip,dstport --hashlimit-name http2 --hashlimit-htable-expire 3000 -j DROP
> nft add rule ip filter INPUT tcp dport 80 flow table http2 { tcp dport . ip saddr timeout 3s limit rate over 200 kbytes/second burst 1 mbytes burst 6 packets} counter drop

The traling "burst 6 packets" should not be there.

I propose to leave the wiki until this is fixed.

Cheers ... Duncan.