kevin/linux
1
Fork 0
Code
8a455b087c
linux/net/ipv4
History
Daniel Hokka Zakrisson d0ebf13359 [NETFILTER]: ipt_recent: sanity check hit count 
If a rule using ipt_recent is created with a hit count greater than
ip_pkt_list_tot, the rule will never match as it cannot keep track
of enough timestamps. This patch makes ipt_recent refuse to create such
rules.

With ip_pkt_list_tot's default value of 20, the following can be used
to reproduce the problem.

nc -u -l 0.0.0.0 1234 &
for i in `seq 1 100`; do echo $i | nc -w 1 -u 127.0.0.1 1234; done

This limits it to 20 packets:
iptables -A OUTPUT -p udp --dport 1234 -m recent --set --name test \
         --rsource
iptables -A OUTPUT -p udp --dport 1234 -m recent --update --seconds \
         60 --hitcount 20 --name test --rsource -j DROP

While this is unlimited:
iptables -A OUTPUT -p udp --dport 1234 -m recent --set --name test \
         --rsource
iptables -A OUTPUT -p udp --dport 1234 -m recent --update --seconds \
         60 --hitcount 21 --name test --rsource -j DROP

With the patch the second rule-set will throw an EINVAL.

Reported-by: Sean Kennedy <skennedy@vcn.com>
Signed-off-by: Daniel Hokka Zakrisson <daniel@hozac.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-03-20 15:07:10 -07:00
..
ipvs ipvs: Make wrr "no available servers" error message rate-limited 2008-02-05 20:00:10 -08:00
netfilter [NETFILTER]: ipt_recent: sanity check hit count 2008-03-20 15:07:10 -07:00
af_inet.c [NET] endianness noise: INADDR_ANY 2008-03-17 22:44:53 -07:00
ah4.c [IPSEC]: Fix bogus usage of u64 on input sequence number 2008-02-12 22:50:35 -08:00
arp.c Revert "[NDISC]: Fix race in generic address resolution" 2008-02-17 18:39:54 -08:00
cipso_ipv4.c NetLabel: introduce a new kernel configuration API for NetLabel 2008-02-05 09:44:20 -08:00
datagram.c [IPV4] net/ipv4: Use ipv4_is_<type> 2008-01-28 14:58:15 -08:00
devinet.c [IPV4]: Reset scope when changing address 2008-02-26 18:42:41 -08:00
esp4.c [IPV4]: esp_output() misannotations 2008-03-17 22:50:23 -07:00
fib_frontend.c [NETNS]: Lookup in FIB semantic hashes taking into account the namespace. 2008-01-31 19:28:41 -08:00
fib_hash.c ipv4/fib_hash.c: fix NULL dereference 2008-02-19 16:28:54 -08:00
fib_lookup.h [IPV4] FIB_HASH: Reduce memory needs and speedup lookups 2008-01-28 15:02:46 -08:00
fib_rules.c [IPV4]: Consolidate fib_select_default. 2008-01-28 15:11:02 -08:00
fib_semantics.c [NETNS]: Lookup in FIB semantic hashes taking into account the namespace. 2008-01-31 19:28:41 -08:00
fib_trie.c fib_trie: /proc/net/route performance improvement 2008-02-12 17:53:31 -08:00
icmp.c [ICMP]: Restore pskb_pull calls in receive function 2008-02-05 03:15:50 -08:00
igmp.c [IGMP]: Optimize kfree_skb in igmp_rcv. 2008-02-09 23:22:26 -08:00
inet_connection_sock.c [SOCK] proto: Add hashinfo member to struct proto 2008-02-03 04:28:52 -08:00
inet_diag.c [NETNS]: Tcp-v6 sockets per-net lookup. 2008-01-31 19:28:20 -08:00
inet_fragment.c [NETNS][FRAGS]: Make the pernet subsystem for fragments. 2008-01-28 15:10:40 -08:00
inet_hashtables.c [INET]: Unexport inet_listen_wlock 2008-02-13 17:40:25 -08:00
inet_lro.c [LRO] Fix lro_mgr->features checks 2008-01-08 23:30:18 -08:00
inet_timewait_sock.c [NET]: prot_inuse cleanups and optimizations 2008-01-28 15:00:36 -08:00
inetpeer.c [INET]: Use list_head-s in inetpeer.c 2007-11-12 21:27:28 -08:00
ip_forward.c [NETFILTER]: Introduce NF_INET_ hook values 2008-01-28 14:53:55 -08:00
ip_fragment.c [NETNS][FRAGS]: Make the pernet subsystem for fragments. 2008-01-28 15:10:40 -08:00
ip_gre.c [INET]: Don't create tunnels with '%' in name. 2008-02-26 23:51:04 -08:00
ip_input.c [IPv4] RAW: Compact the API for the kernel 2008-01-28 14:54:28 -08:00
ip_options.c [NETNS]: Add netns parameter to inet_(dev_)add_type. 2008-01-28 15:01:27 -08:00
ip_output.c [NET]: Introducing socket mark socket option. 2008-01-31 19:27:19 -08:00
ip_sockglue.c [NET] endianness noise: INADDR_ANY 2008-03-17 22:44:53 -07:00
ipcomp.c [IPCOMP]: Disable BH on output when using shared tfm 2008-02-28 11:23:17 -08:00
ipconfig.c [NET] endianness noise: INADDR_ANY 2008-03-17 22:44:53 -07:00
ipip.c [INET]: Don't create tunnels with '%' in name. 2008-02-26 23:51:04 -08:00
ipmr.c [NETNS]: Add namespace parameter to ip_route_output_key. 2008-01-28 15:11:07 -08:00
Kconfig [ESP]: Add select on AUTHENC 2008-03-04 14:29:21 -08:00
Makefile [IPV4]: Cleanup the sysctl_net_ipv4.c file 2008-01-28 14:56:27 -08:00
netfilter.c [NETNS]: Add namespace parameter to ip_route_output_key. 2008-01-28 15:11:07 -08:00
proc.c [NETNS][FRAGS]: Make the mem counter per-namespace. 2008-01-28 15:10:36 -08:00
protocol.c
raw.c [RAW]: Wrong content of the /proc/net/raw6. 2008-01-31 19:27:26 -08:00
route.c [IPV4]: Use proc_create() to setup ->proc_fops first 2008-02-28 14:14:25 -08:00
syncookies.c [NETNS]: Add namespace parameter to ip_route_output_key. 2008-01-28 15:11:07 -08:00
sysctl_net_ipv4.c [TCP]: Fix a bug in strategy_allowed_congestion_control 2008-01-31 19:28:23 -08:00
tcp_bic.c [TCP]: BIC web page link is corrected. 2008-02-28 22:14:32 -08:00
tcp_cong.c [TCP]: Uninline tcp_is_cwnd_limited 2008-01-28 15:01:48 -08:00
tcp_cubic.c [TCP]: Cong.ctrl modules: remove unused good_ack from cong_avoid 2008-01-28 14:55:41 -08:00
tcp_diag.c [INET]: Let inet_diag and friends autoload 2007-10-22 02:59:54 -07:00
tcp_highspeed.c [TCP]: Cong.ctrl modules: remove unused good_ack from cong_avoid 2008-01-28 14:55:41 -08:00
tcp_htcp.c [TCP]: Cong.ctrl modules: remove unused good_ack from cong_avoid 2008-01-28 14:55:41 -08:00
tcp_hybla.c [TCP]: Cong.ctrl modules: remove unused good_ack from cong_avoid 2008-01-28 14:55:41 -08:00
tcp_illinois.c [TCP]: Cong.ctrl modules: remove unused good_ack from cong_avoid 2008-01-28 14:55:41 -08:00
tcp_input.c [TCP]: Must count fack_count also when skipping 2008-03-03 12:10:16 -08:00
tcp_ipv4.c [TCP]: Fix tcp_v4_send_synack() comment 2008-02-17 22:29:19 -08:00
tcp_lp.c [TCP]: Cong.ctrl modules: remove unused good_ack from cong_avoid 2008-01-28 14:55:41 -08:00
tcp_minisocks.c
tcp_output.c [TCP]: Prevent sending past receiver window with TSO (at last skb) 2008-03-11 17:55:27 -07:00
tcp_probe.c
tcp_scalable.c [TCP]: Cong.ctrl modules: remove unused good_ack from cong_avoid 2008-01-28 14:55:41 -08:00
tcp_timer.c [TCP]: Do not purge sk_forward_alloc entirely in tcp_delack_timer(). 2008-01-28 15:01:42 -08:00
tcp_vegas.c [TCP]: Cong.ctrl modules: remove unused good_ack from cong_avoid 2008-01-28 14:55:41 -08:00
tcp_vegas.h
tcp_veno.c [TCP]: Cong.ctrl modules: remove unused good_ack from cong_avoid 2008-01-28 14:55:41 -08:00
tcp_westwood.c
tcp_yeah.c [TCP]: Cong.ctrl modules: remove unused good_ack from cong_avoid 2008-01-28 14:55:41 -08:00
tcp.c [SOCK] proto: Add hashinfo member to struct proto 2008-02-03 04:28:52 -08:00
tunnel4.c [INET]: Cleanup the xfrm4_tunnel_(un)register 2007-11-10 21:48:54 -08:00
udp_impl.h
udp.c [NETNS]: Udp sockets per-net lookup. 2008-01-31 19:28:21 -08:00
udplite.c [IPV4] UDP,UDPLITE: Sparse: {__udp4_lib,udp,udplite}_err() are of void. 2008-01-28 15:10:24 -08:00
xfrm4_input.c [IPSEC]: Fix transport-mode async resume on intput without netfilter 2008-01-28 15:00:10 -08:00
xfrm4_mode_beet.c [IPSEC] xfrm4_beet_input(): fix an if() 2008-02-05 02:51:39 -08:00
xfrm4_mode_transport.c [IPSEC]: Use IPv6 calling convention as the convention for x->mode->output 2007-10-10 16:55:54 -07:00
xfrm4_mode_tunnel.c [IPSEC]: Rename tunnel-mode functions to avoid collisions with tunnels 2008-01-28 14:59:18 -08:00
xfrm4_output.c [NETFILTER]: Introduce NF_INET_ hook values 2008-01-28 14:53:55 -08:00
xfrm4_policy.c [NET]: should explicitely initialize atomic_t field in struct dst_ops 2008-01-31 19:27:23 -08:00
xfrm4_state.c [IPSEC]: Kill afinfo->nf_post_routing 2008-01-28 14:53:55 -08:00
xfrm4_tunnel.c [IPCOMP]: Fix reception of incompressible packets 2008-01-31 19:27:24 -08:00