limit match does not support invert

PATCH New Phil Oester 1 participant 1 message Sep 20, 2004 netfilter

Share & tools

Phil Oester

author

2004-09-20 23:32 UTC #0 lore raw

PATCH 1/1 limit match does not support invert

Limit match does not support invert, and without loss of backwards compatibility, it won't anytime soon. It doesn't help that the iptables tutorial claims it does.

The userspace code tries to warn users it won't work, but only correctly deals with one of the two possible invert cases:

# iptables -A foo -m limit --limit ! 1/sec
iptables v1.2.11: Unexpected `!' after --limit
Try `iptables -h' or 'iptables --help' for more information.

but not this one:

# iptables -A foo -m limit ! --limit 1/sec

The below patch fixes this up, closing bugzilla #95, perhaps to the chagrin of those who would like to see limit support invert.

Phil

extensions/libipt_limit.c +6 -7

diff -ru ipt-orig/extensions/libipt_limit.c ipt-new/extensions/libipt_limit.c
@@ -104,19 +104,14 @@
 
 	switch(c) {
 	case '%':
-		if (check_inverse(optarg, &invert, NULL, 0))
-			exit_error(PARAMETER_PROBLEM,
-				   "Unexpected `!' after --limit");
+		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
 		if (!parse_rate(optarg, &r->avg))
 			exit_error(PARAMETER_PROBLEM,
 				   "bad rate `%s'", optarg);
 		break;
 
 	case '$':
-		if (check_inverse(optarg, &invert, NULL, 0))
-			exit_error(PARAMETER_PROBLEM,
-				   "Unexpected `!' after --limit-burst");
-
+		if (check_inverse(argv[optind-1], &invert, &optind, 0)) break;
 		if (string_to_number(optarg, 0, 10000, &num) == -1)
 			exit_error(PARAMETER_PROBLEM,
 				   "bad --limit-burst `%s'", optarg);

@@ -127,6 +122,10 @@
 		return 0;
 	}
 
+	if (invert)
+		exit_error(PARAMETER_PROBLEM,
+			   "limit does not support invert");
+
 	return 1;
 }