Filter: named limits

3 files changed, 38 insertions, 1 deletions

diff --git a/README.md b/README.md
index 3c3dd10..776ec90 100644
--- a/README.md
+++ b/README.md
@@ -221,6 +221,19 @@ the enclosing object. For [filters](#filter), the default behavior is
 to apply the limit for each source address separately. For [logging
 classes](#log), the limit is considered absolute by default.
 
+The packet rates contributing to the limit may be summed over multiple
+[filters](#filter). This can be achieved by setting the optional
+**name** attribute to equal values among the related limits. Named
+limits may be specific only to fixed-size blocks of either the source
+or the destination address, not both. However, the address to be
+considered may vary among the rules using the limit and may be
+selected by setting an attribute named **addr** to either **src**
+(default) or **dest**. By default, all bits of the selected address
+are taken into account, but address family–specific prefix
+lengths can be set via the top-level **limit** dictionary, where the
+keys correspond to limit names and values follow the syntax of
+**src-mask** and **dest-mask**.
+
 ### <a name="log"></a>Logging Classes
 
 A *logging class* specifies how packets matching certain rules are
diff --git a/awall/model.lua b/awall/model.lua
index 79460d8..783ad7f 100644
--- a/awall/model.lua
+++ b/awall/model.lua
@@ -707,6 +707,10 @@ function M.Limit:init(...)
       end
    end
 
+   self:initmask()
+end
+
+function M.Limit:initmask()
    setdefault(self, 'src-mask', not self['dest-mask'])
    setdefault(self, 'dest-mask', false)
 
diff --git a/awall/modules/filter.lua b/awall/modules/filter.lua
index 531d776..34ac6cf 100644
--- a/awall/modules/filter.lua
+++ b/awall/modules/filter.lua
@@ -24,6 +24,25 @@ local RECENT_MAX_COUNT = 20
 
 local FilterLimit = class(model.Limit)
 
+function FilterLimit:initmask()
+   if self.name then
+      for _, attr in ipairs{'src-mask', 'dest-mask'} do
+        if self[attr] then
+           self:error('Attribute not allowed with a named limit: '..attr)
+        end
+      end
+
+      local limits = self.root.limit
+      self[(self.addr or 'src')..'-mask'] = limits and limits[self.name] or true
+   end
+
+   FilterLimit.super(self):initmask()
+
+   if self.name and not self:recentofrags() then
+      self:error('Attribute allowed only with low-rate limits: name')
+   end
+end
+
 function FilterLimit:recentofrags(name)
    local count = self.count
    local interval = self.interval
@@ -66,7 +85,8 @@ function FilterLimit:recentofrags(name)
       local rec = {
 	 {
 	    family=family,
-	    match='-m recent --name '..name..' --r'..
+	    match='-m recent --name '..
+	       (self.name and 'user:'..self.name or name)..' --r'..
 	       ({src='source', dest='dest'})[attr]..' --mask '..mask
 	 }
       }