[PATCH] Fix connlimit bug when receive RST packet in ESTABLISHED state

["Dong Wei" <dwei.zh@xxxxxxxxx>]

Hi, all
  In xt_connlimit match module, the counter of an IP is decreased when
the TCP packet is go through the chain with ip_conntrack state TW.
Well, it's very natural that the server and client close the socket
with FIN packet. But when the client/server close the socket with RST
packet(using so_linger), the counter for this connection still exsit.
The following patch can fix it which is based on linux-2.6.25.4

diff -ruN a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
--- a/net/netfilter/xt_connlimit.c      2008-06-02 18:48:38.000000000 +0800
+++ b/net/netfilter/xt_connlimit.c      2008-06-02 18:50:40.000000000 +0800
@@ -75,7 +75,8 @@
        u_int16_t proto = conn->tuplehash[0].tuple.dst.protonum;

        if (proto == IPPROTO_TCP)
-               return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT;
+               return (conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT
+                       || conn->proto.tcp.state == TCP_CONNTRACK_CLOSE);
        else
                return 0;
 }

diff -ruN a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
--- a/net/netfilter/xt_connlimit.c	2008-06-02 18:48:38.000000000 +0800
+++ b/net/netfilter/xt_connlimit.c	2008-06-02 18:50:40.000000000 +0800
@@ -75,7 +75,8 @@
 	u_int16_t proto = conn->tuplehash[0].tuple.dst.protonum;
 
 	if (proto == IPPROTO_TCP)
-		return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT;
+		return (conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT
+		        || conn->proto.tcp.state == TCP_CONNTRACK_CLOSE);
 	else
 		return 0;
 }