diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2015-12-09 22:55:30 +0100 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-01-14 18:54:39 +0100 |
commit | 3f5ef7d63f9ef70855dedd9b5aa7eba2f63a1ec7 (patch) | |
tree | f4defb46c5fd28345ebb21c0c3828e1eb0cd23b4 /src/statement.c | |
parent | 510e800e72e177a9070129b63fa232f065f54c02 (diff) |
src: support limit rate over value
So far it was only possible to match packet under a rate limit, this
patch allows you to explicitly indicate if you want to match packets
that goes over or until the rate limit, eg.
... limit rate over 3/second counter log prefix "OVERLIMIT: " drop
... limit rate over 3 mbytes/second counter log prefix "OVERLIMIT: " drop
... ct state invalid limit rate until 1/second counter log prefix "INVALID: "
When listing rate limit until, this shows:
... ct state invalid limit rate 1/second counter log prefix "INVALID: "
thus, the existing syntax is still valid (i.e. default to rate limit until).
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/statement.c')
-rw-r--r-- | src/statement.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/src/statement.c b/src/statement.c index 2d1a3e6b..153e93be 100644 --- a/src/statement.c +++ b/src/statement.c @@ -213,21 +213,24 @@ static const char *get_rate(uint64_t byte_rate, uint64_t *rate) static void limit_stmt_print(const struct stmt *stmt) { + bool inv = stmt->limit.flags & NFT_LIMIT_F_INV; const char *data_unit; uint64_t rate; switch (stmt->limit.type) { case NFT_LIMIT_PKTS: - printf("limit rate %" PRIu64 "/%s", - stmt->limit.rate, get_unit(stmt->limit.unit)); + printf("limit rate %s%" PRIu64 "/%s", + inv ? "over " : "", stmt->limit.rate, + get_unit(stmt->limit.unit)); if (stmt->limit.burst > 0) printf(" burst %u packets", stmt->limit.burst); break; case NFT_LIMIT_PKT_BYTES: data_unit = get_rate(stmt->limit.rate, &rate); - printf("limit rate %" PRIu64 " %s/%s", - rate, data_unit, get_unit(stmt->limit.unit)); + printf("limit rate %s%" PRIu64 " %s/%s", + inv ? "over " : "", rate, data_unit, + get_unit(stmt->limit.unit)); if (stmt->limit.burst > 0) { uint64_t burst; |