Messages in this thread Patch in this message | | | Date | Fri, 06 Jun 2008 18:02:53 -0700 | From | Chris Wright <> | Subject | [patch 38/50] netfilter: xt_connlimit: fix accouning when receive RST packet in ESTABLISHED state |
| |
-stable review patch. If anyone has any objections, please let us know. ---------------------
From: Patrick McHardy <kaber@trash.net>
upstream commit: d2ee3f2c4b1db1320c1efb4dcaceeaf6c7e6c2d3
In xt_connlimit match module, the counter of an IP is decreased when the TCP packet is go through the chain with ip_conntrack state TW. Well, it's very natural that the server and client close the socket with FIN packet. But when the client/server close the socket with RST packet(using so_linger), the counter for this connection still exsit. The following patch can fix it which is based on linux-2.6.25.4
Signed-off-by: Dong Wei <dwei.zh@gmail.com> Acked-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Chris Wright <chrisw@sous-sol.org> ---
net/netfilter/xt_connlimit.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/netfilter/xt_connlimit.c +++ b/net/netfilter/xt_connlimit.c @@ -75,7 +75,8 @@ static inline bool already_closed(const u_int16_t proto = conn->tuplehash[0].tuple.dst.protonum; if (proto == IPPROTO_TCP) - return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT; + return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT || + conn->proto.tcp.state == TCP_CONNTRACK_CLOSE; else return 0; } --
| |