On Monday 2008-06-02 14:20, Patrick McHardy wrote: > Dong Wei wrote: >> Hi, all >> In xt_connlimit match module, the counter of an IP is decreased when >> the TCP packet is go through the chain with ip_conntrack state TW. >> Well, it's very natural that the server and client close the socket >> with FIN packet. But when the client/server close the socket with RST >> packet(using so_linger), the counter for this connection still exsit. >> The following patch can fix it which is based on linux-2.6.25.4 >> >> diff -ruN a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c >> --- a/net/netfilter/xt_connlimit.c 2008-06-02 18:48:38.000000000 +0800 >> +++ b/net/netfilter/xt_connlimit.c 2008-06-02 18:50:40.000000000 +0800 >> @@ -75,7 +75,8 @@ >> u_int16_t proto = conn->tuplehash[0].tuple.dst.protonum; >> >> if (proto == IPPROTO_TCP) >> - return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT; >> + return (conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT >> + || conn->proto.tcp.state == TCP_CONNTRACK_CLOSE); > > Looks fine to me. Jan? The check for TCP_CONNTRACK_TIME_WAIT was introduced since there is the 2*MSL delay before the TIME_WAIT->CLOSED transition, and not counting a connection beginning with TIME_WAIT is common sense/what people expect. Though the cleanup delay between TCP_CONNTRACK_CLOSE and (deallocated state) is much less than 2*MSL, it makes sense to also add this case per common sense. Patch is fine, yes, but you do not need the redundant ( ) that were introduced. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
