[nftables] icmp type rate limiting - cumulative for the daddr or selectively per saddr?

[nftables] icmp type rate limiting - cumulative for the daddr or selectively per saddr?

[ѽ҉ᶬḳ℠]

https://wiki.nftables.org/wiki-nftables/index.php/Rate_limiting_matchings 
is not clear whether the 'limit rate' stanza applies as:

* cummulutive limit (from any/all saddr) for the daddr within the given 
period

or

* assumes/implies limit selectively for each saddr within the given period

If it is a cummulutive limit how to go about a limit per saddr? For example:

icmpv6 type 128 ip6 saddr limit rate over 15/second burst 3 packets drop

or

icmpv6 type 128 { ip6 saddr limit rate over 15/second burst 3 packets } drop

producing:

Error: syntax error, unexpected saddr, expecting comma or '}'

Re: [nftables] icmp type rate limiting - cumulative for the daddr or selectively per saddr?

[Florian Westphal]

ѽ҉ᶬḳ℠ <vtol@gmx.net> wrote:
> https://wiki.nftables.org/wiki-nftables/index.php/Rate_limiting_matchings is
> not clear whether the 'limit rate' stanza applies as:
> 
> * cummulutive limit (from any/all saddr) for the daddr within the given
> period

Its always the same, limit has no internal state other than the rate
bucket.

In all these examples the limit applies for every packet that makes
it to the limit expression.

So, f.e.:
nft add rule filter input icmp type echo-request limit rate 10/second
accept

applies the limit to each icmp echo request.

> If it is a cummulutive limit how to go about a limit per saddr? For example:
> 
> icmpv6 type 128 ip6 saddr limit rate over 15/second burst 3 packets drop
> 
> or
> 
> icmpv6 type 128 { ip6 saddr limit rate over 15/second burst 3 packets } drop
> 
> producing:
> 
> Error: syntax error, unexpected saddr, expecting comma or '}'

Yes, you need to use a dynamic set for this, because the 'limit'
expression has the be kept per set entry.

Example (using older meter syntax):
nft add rule ip6 filter input icmpv6 type 128 meter icmp6limit '{ ip6 saddr limit rate over 15/second burst 3 packets } drop'

This adds a set, adds a 'limit rate' object for every ip6 saddr that
gets added to the set.

Since this needs to insert new entries, you might want to limit size and
forget old entries:

nft add rule ip6 filter input icmpv6 type 128 meter icmp6limit size 8192 '{ ip6 saddr timeout 1m limit rate over 15/second burst 3 packets } drop'

Re: [nftables] icmp type rate limiting - cumulative for the daddr or selectively per saddr?

[ѽ҉ᶬḳ℠]

On 29/09/2020 16:46, Florian Westphal wrote:
> ѽ҉ᶬḳ℠ <vtol@gmx.net> wrote:
>> https://wiki.nftables.org/wiki-nftables/index.php/Rate_limiting_matchings is
>> not clear whether the 'limit rate' stanza applies as:
>>
>> * cummulutive limit (from any/all saddr) for the daddr within the given
>> period
> Its always the same, limit has no internal state other than the rate
> bucket.
>
> In all these examples the limit applies for every packet that makes
> it to the limit expression.
>
> So, f.e.:
> nft add rule filter input icmp type echo-request limit rate 10/second
> accept
>
> applies the limit to each icmp echo request.
>
Thank you for the clarification.

Re: [nftables] icmp type rate limiting - cumulative for the daddr or selectively per saddr?

[Pablo Neira Ayuso]

On Tue, Sep 29, 2020 at 01:39:00PM +0000, ѽ҉ᶬḳ℠ wrote:
> https://wiki.nftables.org/wiki-nftables/index.php/Rate_limiting_matchings is
> not clear whether the 'limit rate' stanza applies as:
>
> * cummulutive limit (from any/all saddr) for the daddr within the given
> period
> 
> or
> 
> * assumes/implies limit selectively for each saddr within the given period
> 
> If it is a cummulutive limit how to go about a limit per saddr? For example:
> 
> icmpv6 type 128 ip6 saddr limit rate over 15/second burst 3 packets drop
> 
> or
> 
> icmpv6 type 128 { ip6 saddr limit rate over 15/second burst 3 packets } drop

This syntax is not correct.

Yesterday, you posted an example to combine limit rate with dynamic
sets which might be what you need.

Additionally, if you know how to use iptables, please have a look at
iptables -m limit, it's equivalent.