[Bug 1740] New: hashlimit limit: reduction to lowest terms in the output is confusing

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1740

            Bug ID: 1740
           Summary: hashlimit limit: reduction to lowest terms in the
                    output is confusing
           Product: iptables
           Version: 1.8.x
          Hardware: x86_64
                OS: Debian GNU/Linux
            Status: NEW
          Severity: minor
          Priority: P5
         Component: iptables
          Assignee: netfilter-buglog at lists.netfilter.org
          Reporter: pedretti.fabio at gmail.com

>From the man page:
--hashlimit-above amount[/second|/minute|/hour|/day]
  Match if the rate is above amount/quantum.

This:

iptables -F OUTPUT
iptables -A OUTPUT -m hashlimit --hashlimit-name foo --hashlimit-above 59/m
iptables -A OUTPUT -m hashlimit --hashlimit-name foo --hashlimit-above 60/m
iptables -A OUTPUT -m hashlimit --hashlimit-name foo --hashlimit-above 61/m
iptables -A OUTPUT -m hashlimit --hashlimit-name foo --hashlimit-above 59/h
iptables -A OUTPUT -m hashlimit --hashlimit-name foo --hashlimit-above 60/h
iptables -A OUTPUT -m hashlimit --hashlimit-name foo --hashlimit-above 61/h
iptables -A OUTPUT -m hashlimit --hashlimit-name foo --hashlimit-above 23/d
iptables -A OUTPUT -m hashlimit --hashlimit-name foo --hashlimit-above 24/d
iptables -A OUTPUT -m hashlimit --hashlimit-name foo --hashlimit-above 25/d
iptables -A OUTPUT -m hashlimit --hashlimit-name foo --hashlimit-above 86399/d
iptables -A OUTPUT -m hashlimit --hashlimit-name foo --hashlimit-above 86400/d
iptables -A OUTPUT -m hashlimit --hashlimit-name foo --hashlimit-above 86401/d
iptables -L OUTPUT -v -n

gives:

Chain OUTPUT (policy ACCEPT 3566 packets, 3016K bytes)
 pkts bytes target     prot opt in     out     source               destination 
    0     0            0    --  *      *       0.0.0.0/0            0.0.0.0/0  
         limit: above 59/min burst 5
    0     0            0    --  *      *       0.0.0.0/0            0.0.0.0/0  
         limit: above 1/sec burst 5 htable-expire 60000
    0     0            0    --  *      *       0.0.0.0/0            0.0.0.0/0  
         limit: above 61/min burst 5
    0     0            0    --  *      *       0.0.0.0/0            0.0.0.0/0  
         limit: above 59/hour burst 5
    0     0            0    --  *      *       0.0.0.0/0            0.0.0.0/0  
         limit: above 1/min burst 5 htable-expire 3600000
    0     0            0    --  *      *       0.0.0.0/0            0.0.0.0/0  
         limit: above 61/hour burst 5
    0     0            0    --  *      *       0.0.0.0/0            0.0.0.0/0  
         limit: above 23/day burst 5
    0     0            0    --  *      *       0.0.0.0/0            0.0.0.0/0  
         limit: above 1/hour burst 5 htable-expire 86400000
    0     0            0    --  *      *       0.0.0.0/0            0.0.0.0/0  
         limit: above 25/day burst 5
    0     0            0    --  *      *       0.0.0.0/0            0.0.0.0/0  
         limit: above 86399/day burst 5
    0     0            0    --  *      *       0.0.0.0/0            0.0.0.0/0  
         limit: above 1/sec burst 5 htable-expire 86400000
    0     0            0    --  *      *       0.0.0.0/0            0.0.0.0/0  
         limit: above 86401/day burst 5

It's a bit strange to have a different output when the requested amount/quantum
can be reduced to lowest terms. This also requires showing the proper
htable-expire time and may be a bit cumbersome to read.

I would expect:
limit: above 1/sec burst 5 htable-expire 60000
would rather be shown as
limit: above 60/min burst 5
as well as the other occurrences.

Thanks.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20240324/9f9986a5/attachment.html>