Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1764688AbYFGB0d (ORCPT ); Fri, 6 Jun 2008 21:26:33 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1756092AbYFGBJu (ORCPT ); Fri, 6 Jun 2008 21:09:50 -0400 Received: from sous-sol.org ([216.99.217.87]:42573 "EHLO sous-sol.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1760742AbYFGBJe (ORCPT ); Fri, 6 Jun 2008 21:09:34 -0400 Message-Id: <20080607010627.675115155@sous-sol.org> References: <20080607010215.358296706@sous-sol.org> User-Agent: quilt/0.46-1 Date: Fri, 06 Jun 2008 18:02:53 -0700 From: Chris Wright To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Patrick McHardy , netfilter-devel@vger.kernel.org, davem@davemloft.net, Dong Wei , Jan Engelhardt Subject: [patch 38/50] netfilter: xt_connlimit: fix accouning when receive RST packet in ESTABLISHED state Content-Disposition: inline; filename=netfilter-xt_connlimit-fix-accouning-when-receive-rst-packet-in-established-state.patch Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1558 Lines: 42 -stable review patch. If anyone has any objections, please let us know. --------------------- From: Patrick McHardy upstream commit: d2ee3f2c4b1db1320c1efb4dcaceeaf6c7e6c2d3 In xt_connlimit match module, the counter of an IP is decreased when the TCP packet is go through the chain with ip_conntrack state TW. Well, it's very natural that the server and client close the socket with FIN packet. But when the client/server close the socket with RST packet(using so_linger), the counter for this connection still exsit. The following patch can fix it which is based on linux-2.6.25.4 Signed-off-by: Dong Wei Acked-by: Jan Engelhardt Signed-off-by: Patrick McHardy Signed-off-by: Chris Wright --- net/netfilter/xt_connlimit.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/netfilter/xt_connlimit.c +++ b/net/netfilter/xt_connlimit.c @@ -75,7 +75,8 @@ static inline bool already_closed(const u_int16_t proto = conn->tuplehash[0].tuple.dst.protonum; if (proto == IPPROTO_TCP) - return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT; + return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT || + conn->proto.tcp.state == TCP_CONNTRACK_CLOSE; else return 0; } -- -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/