Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 18 Mar 2008 10:43:31 +0300
From:      "Andrey V. Elsukov" <>
To:        Paolo Pisati <>
Cc:        Vadim Goncharov <>,
Subject:   Re: kern/80642: [ipfw] [patch] ipfw small patch - new RULE OPTION
Message-ID:  <>
In-Reply-To: <>
References:  <> <> <>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
Paolo Pisati wrote:
> On Thu, Mar 13, 2008 at 09:21:11AM +0000, Vadim Goncharov wrote:
>> Yes, this is useful, but some minor changes are needed, I think. First, rename
>> it to "bytelimit" or somewhat. Second, allow this to use tablearg and possibly
>> ability to reference a counter to corresponding dynamic rule, to allow this to
>> act for a specific IP or connection without need to write many rules. Third,
>> add packet counter as well. That's all possible with one opcode, though...
> if anyone post an updated patch, i'll commit it.

So, updated patch is here:

Now this option divided into two "counterlimit-bytes" and
Rules example:
add allow ip from any to counterlimit-bytes 100M \
	in recv external_if
add allow ip from any to counterlimit-pakets 50 \
	in recv external_if

About Vadim's prepositions:
1. tablearg: it's possible, but now we use u32 argument in
tables, but counterlimits are 64-bits values. First of we
should extend our current table argument to 64 bit.

2. dynamic rules: i think it should be implemented as extension
to current O_LIMIT opcode or something similar.

Also i have question about my current implementation. Does it
needed to have ability of "humanized" printing of limits, which
was implemented before?

WBR, Andrey V. Elsukov

Want to link to this message? Use this URL: <>