git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From stable-bounces@linux.kernel.org  Fri Jun  6 10:21:20 2008
   2 From: Patrick McHardy <kaber@trash.net>
   3 To: stable@kernel.org
   4 Message-Id: <20080606171604.28057.17617.sendpatchset@localhost.localdomain>
   5 Date: Fri,  6 Jun 2008 19:16:05 +0200 (MEST)
   6 Cc: netfilter-devel@vger.kernel.org, Patrick McHardy <kaber@trash.net>, davem@davemloft.net
   7 Subject: netfilter: xt_connlimit: fix accouning when receive RST packet in ESTABLISHED state
   8
   9 upstream commit: d2ee3f2c4b1db1320c1efb4dcaceeaf6c7e6c2d3
  10
  11 In xt_connlimit match module, the counter of an IP is decreased when
  12 the TCP packet is go through the chain with ip_conntrack state TW.
  13 Well, it's very natural that the server and client close the socket
  14 with FIN packet. But when the client/server close the socket with RST
  15 packet(using so_linger), the counter for this connection still exsit.
  16 The following patch can fix it which is based on linux-2.6.25.4
  17
  18 Signed-off-by: Dong Wei <dwei.zh@gmail.com>
  19 Acked-by: Jan Engelhardt <jengelh@medozas.de>
  20 Signed-off-by: Patrick McHardy <kaber@trash.net>
  21 Signed-off-by: Chris Wright <chrisw@sous-sol.org>
  22 ---
  23
  24  net/netfilter/xt_connlimit.c |    3 ++-
  25  1 file changed, 2 insertions(+), 1 deletion(-)
  26
  27 --- a/net/netfilter/xt_connlimit.c
  28 +++ b/net/netfilter/xt_connlimit.c
  29 @@ -75,7 +75,8 @@ static inline bool already_closed(const
  30         u_int16_t proto = conn->tuplehash[0].tuple.dst.protonum;
  31
  32         if (proto == IPPROTO_TCP)
  33 -               return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT;
  34 +               return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT ||
  35 +                      conn->proto.tcp.state == TCP_CONNTRACK_CLOSE;
  36         else
  37                 return 0;
  38  }