extensions: hashlimit: fix incorrect burst in translations

iptables-translate -A INPUT -m tcp -p tcp --dport 80 -m hashlimit --hashlimit-above 200kb/s --hashlimit-burst 1mb --hashlimit-mode srcip,dstport --hashlimit-name http2 --hashlimit-htable-expire 3000 -j DROP

shows:

nft add rule ip filter INPUT tcp dport 80 flow table http2 { tcp dport . ip saddr timeout 3s limit rate over 200 kbytes/second burst 1 mbytes burst 6 packets} counter drop

which prints burst twice, this is not correct.

Reported-by: Duncan Roe <duncan_roe@optusnet.com.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/extensions/libxt_hashlimit.c b/extensions/libxt_hashlimit.c
index 472d8e7f6cc2ddfd953a942dbf9711b66d125e59..3fa5719127db9d15828bfe72085d20bfa4210f7a 100644 (file)
--- a/extensions/libxt_hashlimit.c
+++ b/extensions/libxt_hashlimit.c
@@ -1350,10 +1350,12 @@ static int hashlimit_mt_xlate(struct xt_xlate *xl, const char *name,
 
        if (cfg->mode & XT_HASHLIMIT_BYTES)
                print_bytes_rate_xlate(xl, cfg);
-       else
+       else {
                print_packets_rate_xlate(xl, cfg->avg, revision);
-       if (cfg->burst != 5)
-               xt_xlate_add(xl, " burst %lu packets", cfg->burst);
+               if (cfg->burst != XT_HASHLIMIT_BURST)
+                       xt_xlate_add(xl, " burst %lu packets", cfg->burst);
+
+       }
        xt_xlate_add(xl, "}");
 
        return ret;