banip: Split log and drop into different rules #27994
Open
+58
−20
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Rules that log with limits and drop are not working as expected because the limits are also affecting the action, causing the packets over the limit to skip the drop. Fix this by splitting log (with limit) and drop into separate rules. For the flood rules that use "limit rate over", create separate chains to log and drop. Fixes openwrt#27990 Signed-off-by: Juan Orti Alcaine <[email protected]>
Only create the flood chains when the respective option is enabled. Signed-off-by: Juan Orti Alcaine <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Rules that log with limits and drop are not working as expected because the limits are also affecting the action, causing the packets over the limit to skip the drop.
Fix this by splitting log (with limit) and drop into separate rules.
For the flood rules that use "limit rate over", create separate chains to log and drop.
Fixes #27990
📦 Package Details
Maintainer: @dibdot
(You can find this by checking the history of the package
Makefile.)Description:
Split nft rules that log and drop into 2 different rules so that the
limitoption doesn't affect the drop.🧪 Run Testing Details
✅ Formalities
If your PR contains a patch:
git am(e.g., subject line, commit description, etc.)
We must try to upstream patches to reduce maintenance burden.