[R1s3n214]

Add a new dropRate action parameter. This can be used to specify the probability that subsequent TCP packets in a matched flow are dropped.

Example

- name: drop bilibili
  action: drop
  actionParams:
    dropRate: 20  # drop 20% packets after matched
  expr: geosite(string(tls?.req?.sni), "bilibili")

Behavior

For rates between 1 and 99, once the rule matches, subsequent TCP packets in the flow are independently dropped with the configured probability. A dropped packet uses the packet-level VerdictDrop rather than VerdictDropStream.

Existing full-drop(block) behavior is preserved for 100% rate. dropRate has its default value 100 when not specified.

TCP drop remains a terminal action, consistent with allow and block: once an allow, block, or drop rule matches a TCP flow, the remaining analyzers for that flow are closed and no later rules are evaluated for that flow.

UDP drop behavior is unchanged because it already has separate packet-level semantics, extending it with the same flow-level dropRate behavior would change its existing behavior.