Add limit option to tcclasses

Shorewall/Perl/Shorewall/Tc.pm

@@ -713,6 +713,7 @@ sub validate_tc_class( ) {
 			       parent    => $parentclass,
 			       leaf      => 1,
 			       guarantee => 0,
+			       limit     => 127,
 			     };
 
     $tcref = $tcref->{$classnumber};
@@ -761,6 +762,10 @@ sub validate_tc_class( ) {
 
 		$tcref->{occurs} = $occurs;
 		$devref->{occurs} = 1;
+	    } elsif ( $option =~ /^limit=(\d+)$/ ) {
+		warning_message "limit ignore with pfifo queuing" if $tcref->{pfifo};
+		fatal_error "Invalid limit ($1)" if $1 < 3 || $1 > 127;
+		$tcref->{limit} = $1;
 	    } else {
 		fatal_error "Unknown option ($option)";
 	    }
@@ -1153,7 +1158,7 @@ sub setup_traffic_shaping() {
 	    }
 	}
 
-	emit( "run_tc qdisc add dev $device parent $classid handle ${classnum}: sfq quantum \$quantum limit 127 perturb 10" ) if $tcref->{leaf} && ! $tcref->{pfifo};
+	emit( "run_tc qdisc add dev $device parent $classid handle ${classnum}: sfq quantum \$quantum limit $tcref->{limit} perturb 10" ) if $tcref->{leaf} && ! $tcref->{pfifo};
 	#
 	# add filters
 	#

Shorewall/changelog.txt

@@ -28,6 +28,8 @@ Changes in Shorewall 4.4.3
 
 14)  Fix optional interfaces.
 
+15)  Add 'limit' option to tcclasses.
+
 Changes in Shorewall 4.4.2
 
 1)  BUGFIX: Correct detection of Persistent SNAT support

Shorewall/releasenotes.txt

@@ -242,6 +242,13 @@ None.
     The value of this option becomes the default for the 'track'
     provider option in /etc/shorewall/providers.
 
+3)  A new 'limit' option has been added to
+    /etc/shorewall/tcclasses. This option specifies the number of
+    packets that are allowed to be queued within the class. Packets
+    exceeding this limit are dropped. The default value is 127 which is
+    the value that earlier versions of Shorewall used.  The option is
+    ignored with a warning if the 'pfifo' option has been specified.
+
 ----------------------------------------------------------------------------
                 N E W   F E A T U R E S   I N   4 . 4 . 0
 ----------------------------------------------------------------------------

docs/traffic_shaping.xml

@@ -645,6 +645,20 @@ ppp0           6000kbit         500kbit</programlisting>
               that means that we want to use the source IP address
               <emphasis>before SNAT</emphasis> as the key.</para>
             </listitem>
+
+            <listitem>
+              <para>pfifo - When specified for a leaf class, the pfifo queing
+              discipline is applied to the class rather than the sfq queuing
+              discipline.</para>
+            </listitem>
+
+            <listitem>
+              <para>limit=<emphasis>number</emphasis> - Added in Shorewall
+              4.4.3. When specified for a leaf class, specifies the maximum
+              number of packets that may be queued within the class. The
+              <emphasis>number</emphasis> must be &gt; 2 and less than 128. If
+              not specified, the value 127 is assumed</para>
+            </listitem>
           </itemizedlist>
         </listitem>
       </itemizedlist>

manpages/shorewall-tcclasses.xml

@@ -407,6 +407,28 @@
                 <emphasis>before NAT</emphasis> as the key.</para>
               </listitem>
             </varlistentry>
+
+            <varlistentry>
+              <term>pfifo</term>
+
+              <listitem>
+                <para>When specified for a leaf class, the pfifo queing
+                discipline is applied to the class rather than the sfq queuing
+                discipline.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>limit=<emphasis>number</emphasis></term>
+
+              <listitem>
+                <para>Added in Shorewall 4.4.3. When specified for a leaf
+                class, specifies the maximum number of packets that may be
+                queued within the class. The <emphasis>number</emphasis> must
+                be &gt; 2 and less than 128. If not specified, the value 127
+                is assumed. </para>
+              </listitem>
+            </varlistentry>
           </variablelist>
         </listitem>
       </varlistentry>

manpages6/shorewall6-tcclasses.xml

@@ -358,6 +358,28 @@
                 <emphasis>before NAT</emphasis> as the key.</para>
               </listitem>
             </varlistentry>
+
+            <varlistentry>
+              <term>pfifo</term>
+
+              <listitem>
+                <para>When specified for a leaf class, the pfifo queing
+                discipline is applied to the class rather than the sfq queuing
+                discipline.</para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term>limit=<emphasis>number</emphasis></term>
+
+              <listitem>
+                <para>Added in Shorewall 4.4.3. When specified for a leaf
+                class, specifies the maximum number of packets that may be
+                queued within the class. The <emphasis>number</emphasis> must
+                be &gt; 2 and less than 128. If not specified, the value 127
+                is assumed.</para>
+              </listitem>
+            </varlistentry>
           </variablelist>
         </listitem>
       </varlistentry>