openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

Revert "netfilter: xt_connlimit: connlimit-above early loop termination" 

This reverts commit 44bd4de9c2.

I have to revert the early loop termination in connlimit since it generates
problems when an iptables statement does not use -m state --state NEW before
the connlimit match extension.

Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
Stefan Berger 2011-02-14 16:54:33 +01:00 committed by Patrick McHardy
parent d846f71195
commit 20b7975e5a
1 changed files with 3 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
net/netfilter/xt_connlimit.c
View File

@ -97,8 +97,7 @@ static int count_them(struct net *net,
const struct nf_conntrack_tuple *tuple, const struct nf_conntrack_tuple *tuple,
const union nf_inet_addr *addr, const union nf_inet_addr *addr,
const union nf_inet_addr *mask, const union nf_inet_addr *mask,
u_int8_t family, u_int8_t family)
unsigned int threshold)
{ {
const struct nf_conntrack_tuple_hash *found; const struct nf_conntrack_tuple_hash *found;
struct xt_connlimit_conn *conn; struct xt_connlimit_conn *conn;
@ -152,14 +151,9 @@ static int count_them(struct net *net,
continue; continue;
} }
if (same_source_net(addr, mask, &conn->tuple.src.u3, family)) { if (same_source_net(addr, mask, &conn->tuple.src.u3, family))
/* same source network -> be counted! */ /* same source network -> be counted! */
++matches; ++matches;
if (matches > threshold) {
nf_ct_put(found_ct);
break;
}
}
nf_ct_put(found_ct); nf_ct_put(found_ct);
} }
@ -213,8 +207,7 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
spin_lock_bh(&info->data->lock); spin_lock_bh(&info->data->lock);
connections = count_them(net, info->data, tuple_ptr, &addr, connections = count_them(net, info->data, tuple_ptr, &addr,
&info->mask, par->family, &info->mask, par->family);
info->limit);
spin_unlock_bh(&info->data->lock); spin_unlock_bh(&info->data->lock);
if (connections < 0) if (connections < 0)