diff mbox series

[nft] parser_bison: allow 0 burst in limit rate byte mode

Message ID 20240815121611.1281572-1-pablo@netfilter.org
State Accepted
Headers show
Series [nft] parser_bison: allow 0 burst in limit rate byte mode | expand

Commit Message

Pablo Neira Ayuso Aug. 15, 2024, 12:16 p.m. UTC 
Unbreak restoring elements in set with rate limit that fail with:

> /dev/stdin:3618:61-61: Error: limit burst must be > 0
>                  elements = { 1.2.3.4 limit rate over 1000 kbytes/second timeout 1s,

no need for burst != 0 for limit rate byte mode.

Add tests/shell too.

Fixes: 702eff5b5b74 ("src: allow burst 0 for byte ratelimit and use it as default")
Fixes: 285baccfea46 ("src: disallow burst 0 in ratelimits")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/parser_bison.y                              |  5 -----
 .../shell/testcases/sets/dumps/elem_limit_0.nft |  7 +++++++
 tests/shell/testcases/sets/elem_limit_0         | 17 +++++++++++++++++
 3 files changed, 24 insertions(+), 5 deletions(-)
 create mode 100644 tests/shell/testcases/sets/dumps/elem_limit_0.nft
 create mode 100755 tests/shell/testcases/sets/elem_limit_0
diff mbox series

Patch

diff --git a/src/parser_bison.y b/src/parser_bison.y
index 10105f153aa0..f3368dd3e922 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -4609,11 +4609,6 @@  set_elem_stmt		:	COUNTER	close_scope_counter
 			}
 			|       LIMIT   RATE    limit_mode      limit_rate_bytes  limit_burst_bytes	close_scope_limit
 			{
-				if ($5 == 0) {
-					erec_queue(error(&@6, "limit burst must be > 0"),
-						   state->msgs);
-					YYERROR;
-				}
 				$$ = limit_stmt_alloc(&@$);
 				$$->limit.rate  = $4.rate;
 				$$->limit.unit  = $4.unit;
diff --git a/tests/shell/testcases/sets/dumps/elem_limit_0.nft b/tests/shell/testcases/sets/dumps/elem_limit_0.nft
new file mode 100644
index 000000000000..ca5b2b54e579
--- /dev/null
+++ b/tests/shell/testcases/sets/dumps/elem_limit_0.nft
@@ -0,0 +1,7 @@ 
+table netdev filter {
+	set test123 {
+		typeof ip saddr
+		limit rate over 1 mbytes/second
+		elements = { 1.2.3.4 limit rate over 1 mbytes/second }
+	}
+}
diff --git a/tests/shell/testcases/sets/elem_limit_0 b/tests/shell/testcases/sets/elem_limit_0
new file mode 100755
index 000000000000..b57f9274bcd0
--- /dev/null
+++ b/tests/shell/testcases/sets/elem_limit_0
@@ -0,0 +1,17 @@ 
+#!/bin/bash
+
+## requires EXPR
+
+set -e
+
+RULESET="table netdev filter {
+	set test123 {
+		typeof ip saddr
+		limit rate over 1024 kbytes/second
+		elements = { 1.2.3.4 limit rate over 1024 kbytes/second }
+	}
+}"
+
+$NFT -f - <<< $RULESET
+
+(echo "flush ruleset netdev"; $NFT --stateless list ruleset netdev) | $NFT -f -