[lkml]   [2008]   [Jun]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[patch 38/50] netfilter: xt_connlimit: fix accouning when receive RST packet in ESTABLISHED state
    -stable review patch.  If anyone has any objections, please let us know.

    From: Patrick McHardy <>

    upstream commit: d2ee3f2c4b1db1320c1efb4dcaceeaf6c7e6c2d3

    In xt_connlimit match module, the counter of an IP is decreased when
    the TCP packet is go through the chain with ip_conntrack state TW.
    Well, it's very natural that the server and client close the socket
    with FIN packet. But when the client/server close the socket with RST
    packet(using so_linger), the counter for this connection still exsit.
    The following patch can fix it which is based on linux-

    Signed-off-by: Dong Wei <>
    Acked-by: Jan Engelhardt <>
    Signed-off-by: Patrick McHardy <>
    Signed-off-by: Chris Wright <>

    net/netfilter/xt_connlimit.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/net/netfilter/xt_connlimit.c
    +++ b/net/netfilter/xt_connlimit.c
    @@ -75,7 +75,8 @@ static inline bool already_closed(const
    u_int16_t proto = conn->tuplehash[0].tuple.dst.protonum;

    if (proto == IPPROTO_TCP)
    - return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT;
    + return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT ||
    + conn->proto.tcp.state == TCP_CONNTRACK_CLOSE;
    return 0;

     \ /
      Last update: 2008-06-07 03:29    [W:0.020 / U:33.592 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site