From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Jeremy Sowden <jeremy@azazel.net>
Cc: Netfilter Devel <netfilter-devel@vger.kernel.org>
Subject: Re: [nft PATCH] parser: extend limit statement syntax.
Date: Wed, 27 Oct 2021 11:31:19 +0200 [thread overview]
Message-ID: <YXkcZzCwBufryOqc@salvia> (raw)
In-Reply-To: <YXkaInao+hLzLkR7@salvia>
On Wed, Oct 27, 2021 at 11:21:42AM +0200, Pablo Neira Ayuso wrote:
> On Sun, Oct 03, 2021 at 03:58:32PM +0100, Jeremy Sowden wrote:
> > On 2021-10-02, at 16:22:30 +0100, Jeremy Sowden wrote:
> > > The documentation describes the syntax of limit statements thus:
> > >
> > > limit rate [over] packet_number / TIME_UNIT [burst packet_number packets]
> > > limit rate [over] byte_number BYTE_UNIT / TIME_UNIT [burst byte_number BYTE_UNIT]
> > >
> > > TIME_UNIT := second | minute | hour | day
> > > BYTE_UNIT := bytes | kbytes | mbytes
> > >
> > > This implies that one may specify a limit as either of the following:
> > >
> > > limit rate 1048576 / second
> > > limit rate 1048576 mbytes / second
> > >
> > > However, the latter currently does not parse:
> > >
> > > $ sudo /usr/sbin/nft add filter input limit rate 1048576 mbytes / second
> > > Error: wrong rate format
> > > add filter input limit rate 1048576 mbytes / second
> > > ^^^^^^^^^^^^^^^^^^^^^^^^^
> > >
> > > Extend the parser to support it.
> > >
> > > Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
> > > ---
> > >
> > > I can't help thinking that it ought to be possible to fold the two
> > >
> > > limit rate [over] byte_number BYTE_UNIT / TIME_UNIT [burst byte_number BYTE_UNIT]
> > >
> > > rules into one. However, my attempts to get the scanner to tokenize
> > > "bytes/second" as "bytes" "/" "second" (for example) failed.
> >
> > Having reread the Flex manual, I've changed my mind. While it would be
> > possible, it would be rather fiddly and require more effort than it
> > would be worth.
>
> I can apply this workaround meanwhile we have a better solution for
> this if this is an issue on your side.
>
> Did you get any bug report regarding this?
Another possibility is to remove the existing call to rate_parse().
the bison parser accepts both:
add filter input limit rate 1048576 mbytes / second
add filter input limit rate 1048576 mbytes/second
after your update, right? I'm missing a few deletions in this previous
(the existing rules). I think there's a way to consolidate this bison
rule.
next prev parent reply other threads:[~2021-10-27 9:31 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-02 15:22 [nft PATCH] parser: extend limit statement syntax Jeremy Sowden
2021-10-03 14:58 ` Jeremy Sowden
2021-10-27 9:21 ` Pablo Neira Ayuso
2021-10-27 9:31 ` Pablo Neira Ayuso [this message]
2021-10-28 8:06 ` Jeremy Sowden
2021-10-27 20:02 ` Jeremy Sowden
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YXkcZzCwBufryOqc@salvia \
--to=pablo@netfilter.org \
--cc=jeremy@azazel.net \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).