lkml.org 
[lkml]   [2010]   [Mar]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[100/156] netfilter: xt_recent: fix regression in rules using a zero hit_count
    2.6.33-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Patrick McHardy <kaber@trash.net>

    commit ef1691504c83ba3eb636c0cfd3ed33f7a6d0b4ee upstream.

    Commit 8ccb92ad (netfilter: xt_recent: fix false match) fixed supposedly
    false matches in rules using a zero hit_count. As it turns out there is
    nothing false about these matches and people are actually using entries
    with a hit_count of zero to make rules dependant on addresses inserted
    manually through /proc.

    Since this slipped past the eyes of three reviewers, instead of
    reverting the commit in question, this patch explicitly checks
    for a hit_count of zero to make the intentions more clear.

    Reported-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
    Tested-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    net/netfilter/xt_recent.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/netfilter/xt_recent.c
    +++ b/net/netfilter/xt_recent.c
    @@ -260,7 +260,7 @@ recent_mt(const struct sk_buff *skb, con
    for (i = 0; i < e->nstamps; i++) {
    if (info->seconds && time_after(time, e->stamps[i]))
    continue;
    - if (info->hit_count && ++hits >= info->hit_count) {
    + if (!info->hit_count || ++hits >= info->hit_count) {
    ret = !ret;
    break;
    }



    \
     
     \ /
      Last update: 2010-03-31 01:39    [W:4.121 / U:0.212 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site