Skip to contentSkip to conversation

Revert 44bd4de9

PATCH In review Stefan Berger 3 participants 4 messages Feb 14, 2011

Subsystems (2)
Networking netfilter
lore
Share & tools
lore

Stefan Berger

author
#0 lore raw

PATCH 1/1 Revert 44bd4de9

I have to revert the early loop termination in connlimit since it generates problems when an iptables statement does not use -m state --state NEW before the connlimit match extension.

Signed-off-by Stefan Berger <[email protected]>
---
 net/netfilter/xt_connlimit.c |   13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)
net/netfilter/xt_connlimit.c +3 -10
Index: nf-next-2.6/net/netfilter/xt_connlimit.c
===================================================================
@@ -97,8 +97,7 @@ static int count_them(struct net *net,
               const struct nf_conntrack_tuple *tuple,
               const union nf_inet_addr *addr,
               const union nf_inet_addr *mask,
-              u_int8_t family,
-              unsigned int threshold)
+              u_int8_t family)
 {
     const struct nf_conntrack_tuple_hash *found;
     struct xt_connlimit_conn *conn;

@@ -152,14 +151,9 @@ static int count_them(struct net *net,
             continue;
         }
 
-        if (same_source_net(addr, mask, &conn->tuple.src.u3, family)) {
+        if (same_source_net(addr, mask, &conn->tuple.src.u3, family))
             /* same source network -> be counted! */
             ++matches;
-            if (matches > threshold) {
-                nf_ct_put(found_ct);
-                break;
-            }
-        }
         nf_ct_put(found_ct);
     }
 

@@ -213,8 +207,7 @@ connlimit_mt(const struct sk_buff *skb,
 
     spin_lock_bh(&info->data->lock);
     connections = count_them(net, info->data, tuple_ptr, &addr,
- &info->mask, par->family,
-                             info->limit);
+ &info->mask, par->family);
     spin_unlock_bh(&info->data->lock);
 
     if (connections < 0)
#1 lore raw
Quoted 3 lines · Stefan Berger

I have to revert the early loop termination in connlimit since it generates problems when an iptables statement does not use -m state --state NEW before the connlimit match extension.

What problems? Why would xt_connlimit care about what other extensions have been used before it?

#2 lore raw

Am 14.02.2011 16:45, schrieb Jan Engelhardt:

Quoted 9 lines · Stefan Berger
Quoted 4 lines

I have to revert the early loop termination in connlimit since it generates problems when an iptables statement does not use -m state --state NEW before the connlimit match extension.

What problems? Why would xt_connlimit care about what other extensions have been used before it?

Because we abort once the threshold has been reached, which might be before we found the matching connection and set addit to false.

#3 lore raw
In reply to Stefan Berger

Am 14.02.2011 16:30, schrieb Stefan Berger:

Quoted 5 lines

I have to revert the early loop termination in connlimit since it generates problems when an iptables statement does not use -m state --state NEW before the connlimit match extension.

Signed-off-by Stefan Berger <[email protected]>

Your patch didn't apply. I did a manual revert and added your changelog, thanks.