#
# Copyright (C) 2026 Teltonika
#
# Connection policer: port security policy surface (connection rate limiting,
# session limit, inbound bandwidth policer) built on nftables.
#

include $(TOPDIR)/rules.mk

PKG_NAME:=conn-limits
PKG_VERSION:=1.0.0
PKG_RELEASE:=1
PKG_LICENSE:=GPL-2.0

include $(INCLUDE_DIR)/package.mk

define Package/conn-limits
	SECTION:=net
	CATEGORY:=Network
	SUBMENU:=Firewall
	TITLE:=Connection policer (rate/session/bandwidth, nftables)
	DEPENDS:=@DSA_SUPPORT +nftables +kmod-nft-core +kmod-nft-netdev +kmod-nft-connlimit
	USERID:=conn_limits=661:conn_limits=661
endef

define Package/conn-limits/description
	Configurable port security policies enforced with nftables:
	  - connection rate limiting (new connections/sec per source IP)
	  - concurrent session limit per source IP (ct count / connlimit)
	  - inbound bandwidth policer (drop-on-exceed, per physical port)
	Driven by /etc/config/conn_limits, coexists with the fw3 firewall.
	Note: the inbound bandwidth policer requires flow offloading (both
	software and hardware) to be disabled - offloaded flows bypass the
	ingress hook the policer counts on. Connection rate and session
	limits work regardless of offloading.
endef

define Package/conn-limits/conffiles
/etc/config/conn_limits
endef

define Build/Compile
endef

define Package/conn-limits/install
	$(INSTALL_DIR) $(1)/etc/config $(1)/etc/init.d $(1)/usr/sbin \
		$(1)/etc/permtab.d
	$(INSTALL_CONF) ./files/etc/config/conn_limits $(1)/etc/config/conn_limits
	$(INSTALL_BIN) ./files/etc/init.d/conn_limits $(1)/etc/init.d/conn_limits
	$(INSTALL_BIN) ./files/usr/sbin/conn-limits-gen $(1)/usr/sbin/conn-limits-gen
	$(INSTALL_DATA) ./files/conn_limits.permtab $(1)/etc/permtab.d/conn_limits
endef

$(eval $(call BuildPackage,conn-limits))
