[PATCH] [connlimit] Revert 44bd4de9

[PATCH] [connlimit] Revert 44bd4de9

[Stefan Berger]

I have to revert the early loop termination in connlimit since it 
generates problems when an iptables statement does not use -m state 
--state NEW before the connlimit match extension.

Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>

---
  net/netfilter/xt_connlimit.c |   13 +++----------
  1 file changed, 3 insertions(+), 10 deletions(-)

Index: nf-next-2.6/net/netfilter/xt_connlimit.c
===================================================================
--- nf-next-2.6.orig/net/netfilter/xt_connlimit.c
+++ nf-next-2.6/net/netfilter/xt_connlimit.c
@@ -97,8 +97,7 @@ static int count_them(struct net *net,
                const struct nf_conntrack_tuple *tuple,
                const union nf_inet_addr *addr,
                const union nf_inet_addr *mask,
-              u_int8_t family,
-              unsigned int threshold)
+              u_int8_t family)
  {
      const struct nf_conntrack_tuple_hash *found;
      struct xt_connlimit_conn *conn;
@@ -152,14 +151,9 @@ static int count_them(struct net *net,
              continue;
          }

-        if (same_source_net(addr, mask, &conn->tuple.src.u3, family)) {
+        if (same_source_net(addr, mask, &conn->tuple.src.u3, family))
              /* same source network -> be counted! */
              ++matches;
-            if (matches > threshold) {
-                nf_ct_put(found_ct);
-                break;
-            }
-        }
          nf_ct_put(found_ct);
      }

@@ -213,8 +207,7 @@ connlimit_mt(const struct sk_buff *skb,

      spin_lock_bh(&info->data->lock);
      connections = count_them(net, info->data, tuple_ptr, &addr,
- &info->mask, par->family,
-                             info->limit);
+ &info->mask, par->family);
      spin_unlock_bh(&info->data->lock);

      if (connections < 0)

Re: [PATCH] [connlimit] Revert 44bd4de9

[Jan Engelhardt]

On Monday 2011-02-14 16:30, Stefan Berger wrote:

> I have to revert the early loop termination in connlimit since it generates
> problems when an iptables statement does not use -m state --state NEW before
> the connlimit match extension.

What problems? Why would xt_connlimit care about what other extensions 
have been used before it?

Re: [PATCH] [connlimit] Revert 44bd4de9

[Patrick McHardy]

Am 14.02.2011 16:30, schrieb Stefan Berger:
> I have to revert the early loop termination in connlimit since it
> generates problems when an iptables statement does not use -m state
> --state NEW before the connlimit match extension.
> 
> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>

Your patch didn't apply. I did a manual revert and added your
changelog, thanks.

Re: [PATCH] [connlimit] Revert 44bd4de9

[Patrick McHardy]

Am 14.02.2011 16:45, schrieb Jan Engelhardt:
> On Monday 2011-02-14 16:30, Stefan Berger wrote:
> 
>> I have to revert the early loop termination in connlimit since it generates
>> problems when an iptables statement does not use -m state --state NEW before
>> the connlimit match extension.
> 
> What problems? Why would xt_connlimit care about what other extensions 
> have been used before it?
> 

Because we abort once the threshold has been reached, which might be
before we found the matching connection and set addit to false.