webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-27 19:23:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'amarx/BUG10615' into next

Browse Source
This commit is contained in:
Michael Tremer
2014-09-26 13:02:28 +02:00
parent 2acc3cd9e7 5751876534
commit 60bce6ba6a
4 changed files with 152 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
config/firewall/rules.pl
View File

@@ -268,6 +268,33 @@ sub buildrules {
}
}
# Concurrent connection limit
my @ratelimit_options = ();
if ($$hash{$key}[32] eq 'ON') {
my $conn_limit = $$hash{$key}[33];
if ($conn_limit ge 1) {
push(@ratelimit_options, ("-m", "connlimit"));
# Use the the entire source IP address
push(@ratelimit_options, "--connlimit-saddr");
push(@ratelimit_options, ("--connlimit-mask", "32"));
# Apply the limit
push(@ratelimit_options, ("--connlimit-upto", $conn_limit));
}
}
# Ratelimit
if ($$hash{$key}[34] eq 'ON') {
my $rate_limit = "$$hash{$key}[35]/$$hash{$key}[36]";
if ($rate_limit) {
push(@ratelimit_options, ("-m", "limit"));
push(@ratelimit_options, ("--limit", $rate_limit));
}
}
# Check which protocols are used in this rule and so that we can
# later group rules by protocols.
my @protocols = &get_protocols($hash, $key);
@@ -348,6 +375,9 @@ sub buildrules {
# Add time constraint options.
push(@options, @time_options);
# Add ratelimiting option
push(@options, @ratelimit_options);
my $firewall_is_in_source_subnet = 1;
if ($source) {
$firewall_is_in_source_subnet = &firewall_is_in_subnet($source);