diff --git a/Shorewall/changelog.txt b/Shorewall/changelog.txt index ff7354a42..3c342acc2 100755 --- a/Shorewall/changelog.txt +++ b/Shorewall/changelog.txt @@ -45,3 +45,5 @@ Changes since 1.4.6 20) Bridge interfaces (br[0-9]) can now be used in /etc/shorewall/maclist. 21) Rate-limited rules added. + +22) Make burst optional in rate limited rules and policies. diff --git a/Shorewall/firewall b/Shorewall/firewall index 6b406c85c..4bb5cce78 100755 --- a/Shorewall/firewall +++ b/Shorewall/firewall @@ -1466,13 +1466,18 @@ setup_syn_flood_chain () # $2 = synparams { local chain=$1 - local limit=${2%:*} - local limit_burst=${2#*:} + local limit=$2 + local limit_burst= + + case $limit in + *:*) + limit_burst="--limit-burst ${limit#*:}" + limit=${limit%:*} + ;; + esac run_iptables -N @$chain - run_iptables -A @$chain \ - -m limit --limit $limit --limit-burst $limit_burst \ - -j RETURN + run_iptables -A @$chain -m limit --limit $limit $limit_burst -j RETURN run_iptables -A @$chain -j DROP } @@ -2454,7 +2459,14 @@ process_rule() # $1 = target ratelimit="${ratelimit%>*}" target="${target%<*}${target#*>}" expandv ratelimit - ratelimit="-m limit --limit ${ratelimit%:*} --limit-burst ${ratelimit#*:}" + case $ratelimit in + *:*) + ratelimit="-m limit --limit ${ratelimit%:*} --limit-burst ${ratelimit#*:}" + ;; + *) + ratelimit="-m limit --limit $ratelimit" + ;; + esac fi # Isolate log level diff --git a/Shorewall/releasenotes.txt b/Shorewall/releasenotes.txt index f1a76c889..eacc1f7c7 100755 --- a/Shorewall/releasenotes.txt +++ b/Shorewall/releasenotes.txt @@ -261,13 +261,14 @@ New Features: To specify a rate limit, follow ACCEPT, DNAT[-], REDIRECT[-] or LOG with - < /: > + < /[:] > where is the sustained rate per is "sec" or "min" - is the largest burst accepted within an + is the largest burst accepted within an . If + not given, the default of 5 is assumed. There may be no white space between the ACTION and "<" nor there may be any white space within the burst specification. If you want to @@ -292,4 +293,5 @@ New Features: zones individually rather than as a single limit for all pairs of zones covered by the rule. +