diff options
| author | Patrick McHardy <kaber@trash.net> | 2008-06-06 19:16:05 +0200 |
|---|---|---|
| committer | Chris Wright <chrisw@sous-sol.org> | 2008-06-09 11:27:04 -0700 |
| commit | 28bd0ee9df114ed78c82135b55669bb6459e7bda (patch) | |
| tree | 841749a0f439da63f1b0b281ca81f1a7f24b2198 /net | |
| parent | 502f9661c07490f7691962b5956267c0bb01c601 (diff) | |
| download | lwn-28bd0ee9df114ed78c82135b55669bb6459e7bda.tar.gz lwn-28bd0ee9df114ed78c82135b55669bb6459e7bda.zip | |
netfilter: xt_connlimit: fix accouning when receive RST packet in ESTABLISHED state
upstream commit: d2ee3f2c4b1db1320c1efb4dcaceeaf6c7e6c2d3
In xt_connlimit match module, the counter of an IP is decreased when
the TCP packet is go through the chain with ip_conntrack state TW.
Well, it's very natural that the server and client close the socket
with FIN packet. But when the client/server close the socket with RST
packet(using so_linger), the counter for this connection still exsit.
The following patch can fix it which is based on linux-2.6.25.4
Signed-off-by: Dong Wei <dwei.zh@gmail.com>
Acked-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/xt_connlimit.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c index 3b0111933f60..169233867537 100644 --- a/net/netfilter/xt_connlimit.c +++ b/net/netfilter/xt_connlimit.c @@ -75,7 +75,8 @@ static inline bool already_closed(const struct nf_conn *conn) u_int16_t proto = conn->tuplehash[0].tuple.dst.protonum; if (proto == IPPROTO_TCP) - return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT; + return conn->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT || + conn->proto.tcp.state == TCP_CONNTRACK_CLOSE; else return 0; } |