On Mon, Feb 06, 2017 at 11:50:33PM +0100, Alban Browaeys wrote: > Diving the divider by the multiplier before applying to the input. > When this would "divide by zero", divide the multiplier by the divider > first then multiply the input by this value. > > Currently user2creds outputs zero when input value is bigger than the > number of slices and lower than scale. > This as then user input is applied an integer divide operation to > a number greater than itself (scale). > That rounds up to zero, then we mulitply zero by the credits slice size. > iptables -t filter -I INPUT --protocol tcp --match hashlimit > --hashlimit 40/second --hashlimit-burst 20 --hashlimit-mode srcip > --hashlimit-name syn-flood --jump RETURN > thus trigger the overflow detection code: > xt_hashlimit: overflow, try lower: 25000/20 > (25000 as hashlimit avd and 20 the burst) > Here: > 134217 slices of (HZ * CREDITS_PER_JIFFY) size. > 500000 is user input value > 1000000 is XT_HASHLIMIT_SCALE_v2 > gives: 0 as user2creds output > Setting burst to "1" typically solve the issue ... > but setting it to "40" does too ! > > This is on 32bit arch calling into revision 2 of hashlimit. Applied to nf.git, thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
