Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753975AbbBKSbV (ORCPT ); Wed, 11 Feb 2015 13:31:21 -0500 Received: from sidious.london.02.net ([82.132.130.152]:50824 "EHLO mail.o2.co.uk" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752429AbbBKSbT (ORCPT ); Wed, 11 Feb 2015 13:31:19 -0500 Date: Wed, 11 Feb 2015 18:31:21 +0000 From: Chris Vine To: Linux Kernel Mailing List Subject: Re: xt_recent broken in kernel 3.19.0 + PATCH Message-ID: <20150211183121.6688aec8@bother.homenet> In-Reply-To: <20150211092834.65f8ae80@bother.homenet> References: <20150211092834.65f8ae80@bother.homenet> X-Mailer: Claws Mail 3.11.1 (GTK+ 2.24.25; i686-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1767 Lines: 45 On Wed, 11 Feb 2015 09:28:34 +0000 Chris Vine wrote: > With kernel 3.19.0, the following iptables rule, where SSH_TRIES is > set to 4: > > iptables -D SSH_CHAIN -m conntrack --ctstate NEW \ > -m recent --update --seconds $SSH_LOGIN_PERIOD --hitcount > $SSH_TRIES -j DROP > > generates this error message in syslog: > > kernel: xt_recent: hitcount (4) is larger than packets to be > remembered (4) for table DEFAULT > > and the rule fails to install in the table. No error is generated > with kernel 3.18.6. The rule provoking this should of course have been the one appending the rule, which is: iptables -A SSH_CHAIN -m conntrack --ctstate NEW \ -m recent --update --seconds $SSH_LOGIN_PERIOD --hitcount $SSH_TRIES -j DROP On looking at the code, the changes in the 3.19 kernel seem not to have been tested and there is an off-by-one error. The patch below restores behaviour to be identical to that found in the 3.18 kernel. Chris --- linux-3.19.0/net/netfilter/xt_recent.c~ 2015-02-10 09:18:44.657376355 +0000 +++ linux-3.19.0/net/netfilter/xt_recent.c 2015-02-11 17:58:33.311608835 +0000 @@ -378,7 +378,7 @@ mutex_lock(&recent_mutex); t = recent_table_lookup(recent_net, info->name); if (t != NULL) { - if (info->hit_count > t->nstamps_max_mask) { + if (info->hit_count > t->nstamps_max_mask + 1) { pr_info("hitcount (%u) is larger than packets to be remembered (%u) for table %s\n", info->hit_count, t->nstamps_max_mask + 1, info->name); -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/