Dong Wei wrote:
Hi, all
In xt_connlimit match module, the counter of an IP is decreased when
the TCP packet is go through the chain with ip_conntrack state TW.
Well, it's very natural that the server and client close the socket
with FIN packet. But when the client/server close the socket with RST
packet(using so_linger), the counter for this connection still exsit.
The following patch can fix it which is based on linux-2.6.25.4
diff -ruN a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
--- a/net/netfilter/xt_connlimit.c 2008-06-02 18:48:38.000000000 +0800
+++ b/net/netfilter/xt_connlimit.c 2008-06-02 18:50:40.000000000 +0800
@@ -75,7 +75,8 @@
u_int16_t proto = conn->tuplehash[0].tuple.dst.protonum;
if (proto == IPPROTO_TCP)
- return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT;
+ return (conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT
+ || conn->proto.tcp.state == TCP_CONNTRACK_CLOSE);
Looks fine to me. Jan?
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
