d0ebf13359
If a rule using ipt_recent is created with a hit count greater than
ip_pkt_list_tot, the rule will never match as it cannot keep track
of enough timestamps. This patch makes ipt_recent refuse to create such
rules.
With ip_pkt_list_tot's default value of 20, the following can be used
to reproduce the problem.
nc -u -l 0.0.0.0 1234 &
for i in `seq 1 100`; do echo $i | nc -w 1 -u 127.0.0.1 1234; done
This limits it to 20 packets:
iptables -A OUTPUT -p udp --dport 1234 -m recent --set --name test \
--rsource
iptables -A OUTPUT -p udp --dport 1234 -m recent --update --seconds \
60 --hitcount 20 --name test --rsource -j DROP
While this is unlimited:
iptables -A OUTPUT -p udp --dport 1234 -m recent --set --name test \
--rsource
iptables -A OUTPUT -p udp --dport 1234 -m recent --update --seconds \
60 --hitcount 21 --name test --rsource -j DROP
With the patch the second rule-set will throw an EINVAL.
Reported-by: Sean Kennedy <skennedy@vcn.com>
Signed-off-by: Daniel Hokka Zakrisson <daniel@hozac.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||
|---|---|---|
| .. | ||
| arp_tables.c | ||
| arpt_mangle.c | ||
| arptable_filter.c | ||
| ip_queue.c | ||
| ip_tables.c | ||
| ipt_addrtype.c | ||
| ipt_ah.c | ||
| ipt_CLUSTERIP.c | ||
| ipt_ecn.c | ||
| ipt_ECN.c | ||
| ipt_LOG.c | ||
| ipt_MASQUERADE.c | ||
| ipt_NETMAP.c | ||
| ipt_recent.c | ||
| ipt_REDIRECT.c | ||
| ipt_REJECT.c | ||
| ipt_TTL.c | ||
| ipt_ttl.c | ||
| ipt_ULOG.c | ||
| iptable_filter.c | ||
| iptable_mangle.c | ||
| iptable_raw.c | ||
| Kconfig | ||
| Makefile | ||
| nf_conntrack_l3proto_ipv4.c | ||
| nf_conntrack_l3proto_ipv4_compat.c | ||
| nf_conntrack_proto_icmp.c | ||
| nf_nat_amanda.c | ||
| nf_nat_core.c | ||
| nf_nat_ftp.c | ||
| nf_nat_h323.c | ||
| nf_nat_helper.c | ||
| nf_nat_irc.c | ||
| nf_nat_pptp.c | ||
| nf_nat_proto_gre.c | ||
| nf_nat_proto_icmp.c | ||
| nf_nat_proto_tcp.c | ||
| nf_nat_proto_udp.c | ||
| nf_nat_proto_unknown.c | ||
| nf_nat_rule.c | ||
| nf_nat_sip.c | ||
| nf_nat_snmp_basic.c | ||
| nf_nat_standalone.c | ||
| nf_nat_tftp.c | ||