From af378ec5dd50699d63bedf11f57b6239fb70896b Mon Sep 17 00:00:00 2001
From: Rainer Gerhards <rgerhards@adiscon.com>
Date: Mon, 15 Oct 2012 17:12:47 +0200
Subject: imudp: support for Linux-like ratelimiting added

---
 ChangeLog             |  4 +++-
 doc/imudp.html        |  7 +++++++
 plugins/imudp/imudp.c | 16 ++++++++++++++--
 3 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index a3ab3f71..aeefee6c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,9 @@
 ---------------------------------------------------------------------------
 Version 7.3.1  [devel] 2012-10-??
 - imptcp: support for Linux-Type ratelimiting added
-- imudp: support for input batching added (performance improvement)
+- imudp enhancements:
+  * support for input batching added (performance improvement)
+  * support for Linux-Type ratelimiting added
 - change lumberjack cookie to "@cee:" from "@cee: "
   CEE originally specified the cookie with SP, whereas other lumberjack
   tools used it without space. In order to keep interop with lumberjack,
diff --git a/doc/imudp.html b/doc/imudp.html
index b1a3ecc9..e32f9ecf 100644
--- a/doc/imudp.html
+++ b/doc/imudp.html
@@ -47,6 +47,13 @@ default 514, start UDP server on this port. Either a single port can be specifie
 <br>Array of ports: Port=["514","515","10514","..."]</li>
 <li><b>Ruleset</b> &lt;ruleset&gt;<br>
 Binds the listener to a specific <a href="multi_ruleset.html">ruleset</a>.</li>
+<li><b>RateLimit.Interval</b> [number] - (available since 7.3.1) specifies the rate-limiting
+interval in seconds.  Default value is 0, which turns off rate limiting. Set it to a number
+of seconds (5 recommended) to activate rate-limiting.
+</li>
+<li><b>RateLimit.Burst</b> [number] - (available since 7.3.1) specifies the rate-limiting
+burst in number of messages. Default is 10,000.
+</li>
 </ul>
 <b>Caveats/Known Bugs:</b>
 <ul>
diff --git a/plugins/imudp/imudp.c b/plugins/imudp/imudp.c
index aba7d69d..3b140847 100644
--- a/plugins/imudp/imudp.c
+++ b/plugins/imudp/imudp.c
@@ -109,6 +109,8 @@ struct instanceConf_s {
 	uchar *pszBindPort;		/* Port to bind socket to */
 	uchar *pszBindRuleset;		/* name of ruleset to bind to */
 	ruleset_t *pBindRuleset;	/* ruleset to bind listener to (use system default if unspecified) */
+	int ratelimitInterval;
+	int ratelimitBurst;
 	struct instanceConf_s *next;
 };
 
@@ -140,7 +142,9 @@ static struct cnfparamblk modpblk =
 static struct cnfparamdescr inppdescr[] = {
 	{ "port", eCmdHdlrArray, CNFPARAM_REQUIRED }, /* legacy: InputTCPServerRun */
 	{ "address", eCmdHdlrString, 0 },
-	{ "ruleset", eCmdHdlrString, 0 }
+	{ "ruleset", eCmdHdlrString, 0 },
+	{ "ratelimit.interval", eCmdHdlrInt, 0 },
+	{ "ratelimit.burst", eCmdHdlrInt, 0 }
 };
 static struct cnfparamblk inppblk =
 	{ CNFPARAMBLK_VERSION,
@@ -165,6 +169,8 @@ createInstance(instanceConf_t **pinst)
 	inst->pszBindPort = NULL;
 	inst->pszBindAddr = NULL;
 	inst->pszBindRuleset = NULL;
+	inst->ratelimitBurst = 10000; /* arbitrary high limit */
+	inst->ratelimitInterval = 0; /* off */
 
 	/* node created, let's add to config */
 	if(loadModConf->tail == NULL) {
@@ -250,7 +256,9 @@ addListner(instanceConf_t *inst)
 			newlcnfinfo->pRuleset = inst->pBindRuleset;
 			snprintf((char*)dispname, sizeof(dispname), "imudp(%s:%s)", bindName, port);
 			dispname[sizeof(dispname)-1] = '\0'; /* just to be on the save side... */
-			CHKiRet(ratelimitNew(&newlcnfinfo->ratelimiter, dispname, NULL));
+			CHKiRet(ratelimitNew(&newlcnfinfo->ratelimiter, (char*)dispname, NULL));
+			ratelimitSetLinuxLike(newlcnfinfo->ratelimiter, inst->ratelimitInterval,
+					      inst->ratelimitBurst);
 			/* support statistics gathering */
 			CHKiRet(statsobj.Construct(&(newlcnfinfo->stats)));
 			CHKiRet(statsobj.SetName(newlcnfinfo->stats, dispname));
@@ -691,6 +699,10 @@ createListner(es_str_t *port, struct cnfparamvals *pvals)
 			inst->pszBindAddr = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
 		} else if(!strcmp(inppblk.descr[i].name, "ruleset")) {
 			inst->pszBindRuleset = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
+		} else if(!strcmp(inppblk.descr[i].name, "ratelimit.burst")) {
+			inst->ratelimitBurst = (int) pvals[i].val.d.n;
+		} else if(!strcmp(inppblk.descr[i].name, "ratelimit.interval")) {
+			inst->ratelimitInterval = (int) pvals[i].val.d.n;
 		} else {
 			dbgprintf("imudp: program error, non-handled "
 			  "param '%s'\n", inppblk.descr[i].name);
-- 
cgit v1.2.3