From 0f387b070ae7630c47bd3daeb395d27a1214d4e9 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 3 Jan 2018 15:36:14 +0100 Subject: extensions: hashlimit: fix incorrect burst in translations iptables-translate -A INPUT -m tcp -p tcp --dport 80 -m hashlimit --hashlimit-above 200kb/s --hashlimit-burst 1mb --hashlimit-mode srcip,dstport --hashlimit-name http2 --hashlimit-htable-expire 3000 -j DROP shows: nft add rule ip filter INPUT tcp dport 80 flow table http2 { tcp dport . ip saddr timeout 3s limit rate over 200 kbytes/second burst 1 mbytes burst 6 packets} counter drop which prints burst twice, this is not correct. Reported-by: Duncan Roe Signed-off-by: Pablo Neira Ayuso --- extensions/libxt_hashlimit.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/extensions/libxt_hashlimit.c b/extensions/libxt_hashlimit.c index 472d8e7f..3fa57191 100644 --- a/extensions/libxt_hashlimit.c +++ b/extensions/libxt_hashlimit.c @@ -1350,10 +1350,12 @@ static int hashlimit_mt_xlate(struct xt_xlate *xl, const char *name, if (cfg->mode & XT_HASHLIMIT_BYTES) print_bytes_rate_xlate(xl, cfg); - else + else { print_packets_rate_xlate(xl, cfg->avg, revision); - if (cfg->burst != 5) - xt_xlate_add(xl, " burst %lu packets", cfg->burst); + if (cfg->burst != XT_HASHLIMIT_BURST) + xt_xlate_add(xl, " burst %lu packets", cfg->burst); + + } xt_xlate_add(xl, "}"); return ret; -- cgit v1.2.3