holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Allow connlimit by destination

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2015-07-26 14:26:58 -07:00
parent 6e0fb1ab88
commit 0a7c65ae0d
3 changed files with 38 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -4981,13 +4981,15 @@ sub do_connlimit( $ ) {
require_capability 'CONNLIMIT_MATCH', 'A non-empty CONNLIMIT', 's';
my $destination = $limit =~ s/^d:// ? '--connlimit-daddr ' : '';
my $invert = $limit =~ s/^!// ? '' : '! '; # Note Carefully -- we actually do 'connlimit-at-or-below'
if ( $limit =~ /^(\d+):(\d+)$/ ) {
fatal_error "Invalid Mask ($2)" unless $2 > 0 || $2 < 31;
"-m connlimit ${invert}--connlimit-above $1 --connlimit-mask $2 ";
"-m connlimit ${invert}--connlimit-above $1 --connlimit-mask $2 $destination";
} elsif ( $limit =~ /^(\d+)$/ ) {
"-m connlimit ${invert}--connlimit-above $limit ";
"-m connlimit ${invert}--connlimit-above $limit $destination";
} else {
fatal_error "Invalid connlimit ($limit)";
}

28
Shorewall/manpages/shorewall-rules.xml
View File

@ -1522,21 +1522,27 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">CONNLIMIT</emphasis> - [<emphasis
<term><emphasis role="bold">CONNLIMIT</emphasis> - [d:][<emphasis
role="bold">!</emphasis>]<emphasis>limit</emphasis>[:<emphasis>mask</emphasis>]</term>
<listitem>
<para>May be used to limit the number of simultaneous connections
from each individual host to <replaceable>limit</replaceable>
connections. Requires connlimit match in your kernel and iptables.
While the limit is only checked on rules specifying CONNLIMIT, the
number of current connections is calculated over all current
connections from the SOURCE host. By default, the limit is applied
to each host but can be made to apply to networks of hosts by
specifying a <replaceable>mask</replaceable>. The
<replaceable>mask</replaceable> specifies the width of a VLSM mask
to be applied to the source address; the number of current
connections is then taken over all hosts in the subnet
to/from each individual host or network to
<replaceable>limit</replaceable> connections. Requires connlimit
match in your kernel and iptables. While the limit is only checked
on rules specifying CONNLIMIT, the number of current connections is
calculated over all current connections from the SOURCE or
DESTINATION host. By default, limiting is done by SOURCE host or
net, but if the specification begins with <emphasis
role="bold">d:</emphasis>, then limiting will be donw by destination
host or net.</para>
<para>By default, the limit is applied to each host but can be made
to apply to networks of hosts by specifying a
<replaceable>mask</replaceable>. The <replaceable>mask</replaceable>
specifies the width of a VLSM mask to be applied to the source
address; the number of current connections is then taken over all
hosts in the subnet
<replaceable>source-address</replaceable>/<replaceable>mask</replaceable>.
When<option> !</option> is specified, the rule matches when the
number of connection exceeds the

28
Shorewall6/manpages/shorewall6-rules.xml
View File

@ -1385,21 +1385,27 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">CONNLIMIT</emphasis> - [<emphasis
<term><emphasis role="bold">CONNLIMIT</emphasis> - [d:][<emphasis
role="bold">!</emphasis>]<emphasis>limit</emphasis>[:<emphasis>mask</emphasis>]</term>
<listitem>
<para>May be used to limit the number of simultaneous connections
from each individual host to <replaceable>limit</replaceable>
connections. Requires connlimit match in your kernel and ip6tables.
While the limit is only checked on rules specifying CONNLIMIT, the
number of current connections is calculated over all current
connections from the SOURCE host. By default, the limit is applied
to each host but can be made to apply to networks of hosts by
specifying a <replaceable>mask</replaceable>. The
<replaceable>mask</replaceable> specifies the width of a VLSM mask
to be applied to the source address; the number of current
connections is then taken over all hosts in the subnet
to/from each individual host or network to
<replaceable>limit</replaceable> connections. Requires connlimit
match in your kernel and iptables. While the limit is only checked
on rules specifying CONNLIMIT, the number of current connections is
calculated over all current connections from the SOURCE or
DESTINATION host. By default, limiting is done by SOURCE host or
net, but if the specification begins with <emphasis
role="bold">d:</emphasis>, then limiting will be donw by destination
host or net.</para>
<para>By default, the limit is applied to each host but can be made
to apply to networks of hosts by specifying a
<replaceable>mask</replaceable>. The <replaceable>mask</replaceable>
specifies the width of a VLSM mask to be applied to the source
address; the number of current connections is then taken over all
hosts in the subnet
<replaceable>source-address</replaceable>/<replaceable>mask</replaceable>.
When<option> !</option> is specified, the rule matches when the
number of connection exceeds the