Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754816AbbBLDPd (ORCPT ); Wed, 11 Feb 2015 22:15:33 -0500 Received: from mail-pd0-f172.google.com ([209.85.192.172]:36789 "EHLO mail-pd0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754745AbbBLDPa (ORCPT ); Wed, 11 Feb 2015 22:15:30 -0500 MIME-Version: 1.0 In-Reply-To: <20150211183121.6688aec8@bother.homenet> References: <20150211092834.65f8ae80@bother.homenet> <20150211183121.6688aec8@bother.homenet> Date: Wed, 11 Feb 2015 19:15:29 -0800 Message-ID: Subject: Re: xt_recent broken in kernel 3.19.0 + PATCH From: Cong Wang To: Chris Vine Cc: Linux Kernel Mailing List , netfilter-devel@vger.kernel.org, Linux Kernel Network Developers Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2331 Lines: 54 (Cc'ing netdev and netfilter-devel lists) On Wed, Feb 11, 2015 at 10:31 AM, Chris Vine wrote: > On Wed, 11 Feb 2015 09:28:34 +0000 > Chris Vine wrote: >> With kernel 3.19.0, the following iptables rule, where SSH_TRIES is >> set to 4: >> >> iptables -D SSH_CHAIN -m conntrack --ctstate NEW \ >> -m recent --update --seconds $SSH_LOGIN_PERIOD --hitcount >> $SSH_TRIES -j DROP >> >> generates this error message in syslog: >> >> kernel: xt_recent: hitcount (4) is larger than packets to be >> remembered (4) for table DEFAULT >> >> and the rule fails to install in the table. No error is generated >> with kernel 3.18.6. > > The rule provoking this should of course have been the one appending > the rule, which is: > > iptables -A SSH_CHAIN -m conntrack --ctstate NEW \ > -m recent --update --seconds $SSH_LOGIN_PERIOD --hitcount $SSH_TRIES -j DROP > > On looking at the code, the changes in the 3.19 kernel seem not to have > been tested and there is an off-by-one error. The patch below restores > behaviour to be identical to that found in the 3.18 kernel. > > Chris > > --- linux-3.19.0/net/netfilter/xt_recent.c~ 2015-02-10 09:18:44.657376355 +0000 > +++ linux-3.19.0/net/netfilter/xt_recent.c 2015-02-11 17:58:33.311608835 +0000 > @@ -378,7 +378,7 @@ > mutex_lock(&recent_mutex); > t = recent_table_lookup(recent_net, info->name); > if (t != NULL) { > - if (info->hit_count > t->nstamps_max_mask) { > + if (info->hit_count > t->nstamps_max_mask + 1) { > pr_info("hitcount (%u) is larger than packets to be remembered (%u) for table %s\n", > info->hit_count, t->nstamps_max_mask + 1, > info->name); > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/