From: Patrick McHardy Date: Fri, 6 Jun 2008 17:16:05 +0000 (+0200) Subject: netfilter: xt_connlimit: fix accouning when receive RST packet in ESTABLISHED state X-Git-Tag: v2.6.25.6~14 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=28bd0ee9df114ed78c82135b55669bb6459e7bda;p=thirdparty%2Fkernel%2Fstable.git netfilter: xt_connlimit: fix accouning when receive RST packet in ESTABLISHED state upstream commit: d2ee3f2c4b1db1320c1efb4dcaceeaf6c7e6c2d3 In xt_connlimit match module, the counter of an IP is decreased when the TCP packet is go through the chain with ip_conntrack state TW. Well, it's very natural that the server and client close the socket with FIN packet. But when the client/server close the socket with RST packet(using so_linger), the counter for this connection still exsit. The following patch can fix it which is based on linux-2.6.25.4 Signed-off-by: Dong Wei Acked-by: Jan Engelhardt Signed-off-by: Patrick McHardy Signed-off-by: Chris Wright --- diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c index 3b0111933f601..1692338675373 100644 --- a/net/netfilter/xt_connlimit.c +++ b/net/netfilter/xt_connlimit.c @@ -75,7 +75,8 @@ static inline bool already_closed(const struct nf_conn *conn) u_int16_t proto = conn->tuplehash[0].tuple.dst.protonum; if (proto == IPPROTO_TCP) - return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT; + return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT || + conn->proto.tcp.state == TCP_CONNTRACK_CLOSE; else return 0; }