Re: [nftables] icmp type rate limiting - cumulative for the daddr or selectively per saddr?

[Florian Westphal <fw@strlen.de>]

ѽ҉ᶬḳ℠ <vtol@gmx.net> wrote:
> https://wiki.nftables.org/wiki-nftables/index.php/Rate_limiting_matchings is
> not clear whether the 'limit rate' stanza applies as:
> 
> * cummulutive limit (from any/all saddr) for the daddr within the given
> period

Its always the same, limit has no internal state other than the rate
bucket.

In all these examples the limit applies for every packet that makes
it to the limit expression.

So, f.e.:
nft add rule filter input icmp type echo-request limit rate 10/second
accept

applies the limit to each icmp echo request.

> If it is a cummulutive limit how to go about a limit per saddr? For example:
> 
> icmpv6 type 128 ip6 saddr limit rate over 15/second burst 3 packets drop
> 
> or
> 
> icmpv6 type 128 { ip6 saddr limit rate over 15/second burst 3 packets } drop
> 
> producing:
> 
> Error: syntax error, unexpected saddr, expecting comma or '}'

Yes, you need to use a dynamic set for this, because the 'limit'
expression has the be kept per set entry.

Example (using older meter syntax):
nft add rule ip6 filter input icmpv6 type 128 meter icmp6limit '{ ip6 saddr limit rate over 15/second burst 3 packets } drop'

This adds a set, adds a 'limit rate' object for every ip6 saddr that
gets added to the set.

Since this needs to insert new entries, you might want to limit size and
forget old entries:

nft add rule ip6 filter input icmpv6 type 128 meter icmp6limit size 8192 '{ ip6 saddr timeout 1m limit rate over 15/second burst 3 packets } drop'