increasing ip_list_tot in net/netfilter/xt_recent.c for a non-modular kernel

increasing ip_list_tot in net/netfilter/xt_recent.c for a non-modular kernel

[Toralf Förster]

I'm curious if there's a better solution than local patching like:

diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 0446307516cd..e482d4a3fadf 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -40,7 +40,7 @@ MODULE_LICENSE("GPL");
  MODULE_ALIAS("ipt_recent");
  MODULE_ALIAS("ip6t_recent");

-static unsigned int ip_list_tot __read_mostly = 100;
+static unsigned int ip_list_tot __read_mostly = 10000;
  static unsigned int ip_list_hash_size __read_mostly;
  static unsigned int ip_list_perms __read_mostly = 0644;
  static unsigned int ip_list_uid __read_mostly;

here under a hardened Gentoo Linux using iptables ?

--
Toralf

Re: increasing ip_list_tot in net/netfilter/xt_recent.c for a non-modular kernel

[Jozsef Kadlecsik]

[-- Attachment #1: Type: text/plain, Size: 426 bytes --]

On Mon, 22 Feb 2021, Toralf Förster wrote:

> I'm curious if there's a better solution than local patching like:

See "modinfo xt_recent": you can tune it via a module parameter.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.hu
PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: increasing ip_list_tot in net/netfilter/xt_recent.c for a non-modular kernel

[Toralf Förster]

On 2/22/21 10:44 PM, Jozsef Kadlecsik wrote:
> On Mon, 22 Feb 2021, Toralf Förster wrote:
>
>> I'm curious if there's a better solution than local patching like:
>
> See "modinfo xt_recent": you can tune it via a module parameter.
>
> Best regards,
> Jozsef

It is a non-modular kernel.

--
Toralf

Re: increasing ip_list_tot in net/netfilter/xt_recent.c for a non-modular kernel

[Jozsef Kadlecsik]

[-- Attachment #1: Type: text/plain, Size: 554 bytes --]

On Tue, 23 Feb 2021, Toralf Förster wrote:

> > > I'm curious if there's a better solution than local patching like:
> > 
> > See "modinfo xt_recent": you can tune it via a module parameter.
> 
> It is a non-modular kernel.

Then you can specify it as a kernel boot parameter: 
xt_recent.ip_list_tot=N

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.hu
PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: increasing ip_list_tot in net/netfilter/xt_recent.c for a non-modular kernel

[Toralf Förster]

On 2/23/21 9:34 AM, Jozsef Kadlecsik wrote:
> On Tue, 23 Feb 2021, Toralf Förster wrote:
>
>>>> I'm curious if there's a better solution than local patching like:
>>> See "modinfo xt_recent": you can tune it via a module parameter.
>> It is a non-modular kernel.
> Then you can specify it as a kernel boot parameter:
> xt_recent.ip_list_tot=N
>
> Best regards,
> Jozsef
Ah - good advice, thx !

--
Toralf