diff options
| author | Phil Sutter <phil@nwl.cc> | 2022-11-25 04:35:35 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2022-11-29 13:25:26 +0100 |
| commit | 116848ea1e5d8d02fd766356a642bd81574e2723 (patch) | |
| tree | a6fa347f703b8ad60a1a94554c1fd734357ee851 /extensions/libxt_hashlimit.txlate | |
| parent | 7533e96dadfcecbb49f819976ffc986a67920545 (diff) | |
extensions: libxt_conntrack: Drop extra whitespace in xlate
No point in having this. Interestingly, other test cases even made up
for it.
Fixes: 0afd957f6bc03 ("extensions: libxt_state: add translation to nft")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'extensions/libxt_hashlimit.txlate')
| -rw-r--r-- | extensions/libxt_hashlimit.txlate | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/extensions/libxt_hashlimit.txlate b/extensions/libxt_hashlimit.txlate index 251a30d3..4cc26868 100644 --- a/extensions/libxt_hashlimit.txlate +++ b/extensions/libxt_hashlimit.txlate @@ -1,5 +1,5 @@ iptables-translate -A OUTPUT -m tcp -p tcp --dport 443 -m hashlimit --hashlimit-above 20kb/s --hashlimit-burst 1mb --hashlimit-mode dstip --hashlimit-name https --hashlimit-dstmask 24 -m state --state NEW -j DROP -nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr and 255.255.255.0 timeout 60s limit rate over 20 kbytes/second burst 1 mbytes } ct state new counter drop +nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr and 255.255.255.0 timeout 60s limit rate over 20 kbytes/second burst 1 mbytes } ct state new counter drop iptables-translate -A OUTPUT -m tcp -p tcp --dport 443 -m hashlimit --hashlimit-upto 300 --hashlimit-burst 15 --hashlimit-mode srcip,dstip --hashlimit-name https --hashlimit-htable-expire 300000 -m state --state NEW -j DROP -nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr . ip saddr timeout 300s limit rate 300/second burst 15 packets } ct state new counter drop +nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr . ip saddr timeout 300s limit rate 300/second burst 15 packets } ct state new counter drop |