Merge remote-tracking branch 'amarx/BUG10615' into next

[people/trikolon/ipfire-2.x.git] / config / firewall / rules.pl

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index 887c0526575ed9713a9f399ad623cfcee611ec8d..eb75a242a85e68e95033f8c0c4ac24df6f82f5af 100755 (executable)
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -268,6 +268,33 @@ sub buildrules {
                        }
                }
 
+               # Concurrent connection limit
+               my @ratelimit_options = ();
+               if ($$hash{$key}[32] eq 'ON') {
+                       my $conn_limit = $$hash{$key}[33];
+
+                       if ($conn_limit ge 1) {
+                               push(@ratelimit_options, ("-m", "connlimit"));
+
+                               # Use the the entire source IP address
+                               push(@ratelimit_options, "--connlimit-saddr");
+                               push(@ratelimit_options, ("--connlimit-mask", "32"));
+
+                               # Apply the limit
+                               push(@ratelimit_options, ("--connlimit-upto", $conn_limit));
+                       }
+               }
+
+               # Ratelimit
+               if ($$hash{$key}[34] eq 'ON') {
+                       my $rate_limit = "$$hash{$key}[35]/$$hash{$key}[36]";
+
+                               if ($rate_limit) {
+                                       push(@ratelimit_options, ("-m", "limit"));
+                                       push(@ratelimit_options, ("--limit", $rate_limit));
+                               }
+               }
+
                # Check which protocols are used in this rule and so that we can
                # later group rules by protocols.
                my @protocols = &get_protocols($hash, $key);
@@ -291,7 +318,8 @@ sub buildrules {
 
                        foreach my $src (@sources) {
                                # Skip invalid source.
-                               next unless (@$src[0]);
+                               next unless (defined $src);
+                               next unless ($src);
 
                                # Sanitize source.
                                my $source = @$src[0];
@@ -303,7 +331,8 @@ sub buildrules {
 
                                foreach my $dst (@destinations) {
                                        # Skip invalid rules.
-                                       next if (!@$dst[0] || (@$dst[0] eq "none"));
+                                       next unless (defined $dst);
+                                       next if (!$dst || ($dst eq "none"));
 
                                        # Sanitize destination.
                                        my $destination = @$dst[0];
@@ -346,6 +375,9 @@ sub buildrules {
                                        # Add time constraint options.
                                        push(@options, @time_options);
 
+                                       # Add ratelimiting option
+                                       push(@options, @ratelimit_options);
+
                                        my $firewall_is_in_source_subnet = 1;
                                        if ($source) {
                                                $firewall_is_in_source_subnet = &firewall_is_in_subnet($source);