Rules run top to bottom, first verdict wins.

rule NAME { when CONDITION then ACTIONS }

Rules run top to bottom:

• pass and drop end evaluation.
• add does not: evaluation continues with the next rule unless a verdict follows it in the same rule.
• limit lets the packet continue to the next rule while it is under the rate. Above the rate it runs its on exceed actions, or drops the packet when there are none.

Formatting

moat fmt prints the canonical form: one declaration per line, single blank lines kept where the source had any, rules on one line when they fit in 80 columns and otherwise split into when and then lines indented by four spaces. Comments are kept; a comment written inside a rule moves to the line above it.

$ moat fmt rules.moat
$ moat fmt --write *.moat
$ moat fmt --check *.moat

--write (or -w) rewrites the files in place. --check changes nothing: like gofmt -l, it prints the path of every file that is not in canonical form, one per line, and exits with 1 if there are any and 0 if all are clean, so in CI it fails when a file is not formatted. --check and --write together are a usage error, exit 2.

Counters

A rule's counter counts the packets its actions applied to: for a limit rule, the packets above the rate. A rule with only add actions counts every packet it matched and lets it continue.