target/linux/generic/patches-2.6.30/120-netfilter_recent_reap.patch

   1 --- a/include/linux/netfilter/xt_recent.h
   2 +++ b/include/linux/netfilter/xt_recent.h
   3 @@ -9,6 +9,7 @@ enum {
   4         XT_RECENT_UPDATE   = 1 << 2,
   5         XT_RECENT_REMOVE   = 1 << 3,
   6         XT_RECENT_TTL      = 1 << 4,
   7 +       XT_RECENT_REAP     = 1 << 5,
   8
   9         XT_RECENT_SOURCE   = 0,
  10         XT_RECENT_DEST     = 1,
  11 @@ -16,6 +17,9 @@ enum {
  12         XT_RECENT_NAME_LEN = 200,
  13  };
  14
  15 +/* Only allowed with --rcheck and --update */
  16 +#define XT_RECENT_MODIFIERS (XT_RECENT_TTL|XT_RECENT_REAP)
  17 +
  18  struct xt_recent_mtinfo {
  19         __u32 seconds;
  20         __u32 hit_count;
  21 --- a/net/netfilter/xt_recent.c
  22 +++ b/net/netfilter/xt_recent.c
  23 @@ -142,6 +142,25 @@ static void recent_entry_remove(struct r
  24         t->entries--;
  25  }
  26
  27 +/*
  28 + * Drop entries with timestamps older then 'time'.
  29 + */
  30 +static void recent_entry_reap(struct recent_table *t, unsigned long time)
  31 +{
  32 +       struct recent_entry *e;
  33 +
  34 +       /*
  35 +        * The head of the LRU list is always the oldest entry.
  36 +        */
  37 +       e = list_entry(t->lru_list.next, struct recent_entry, lru_list);
  38 +
  39 +       /*
  40 +        * The last time stamp is the most recent.
  41 +        */
  42 +       if (time_after(time, e->stamps[e->index-1]))
  43 +               recent_entry_remove(t, e);
  44 +}
  45 +
  46  static struct recent_entry *
  47  recent_entry_init(struct recent_table *t, const union nf_inet_addr *addr,
  48                   u_int16_t family, u_int8_t ttl)
  49 @@ -265,6 +284,10 @@ recent_mt(const struct sk_buff *skb, con
  50                                 break;
  51                         }
  52                 }
  53 +
  54 +               /* info->seconds must be non-zero */
  55 +               if (info->check_set & XT_RECENT_REAP)
  56 +                       recent_entry_reap(t, time);
  57         }
  58
  59         if (info->check_set & XT_RECENT_SET ||
  60 @@ -292,7 +315,10 @@ static bool recent_mt_check(const struct
  61                       XT_RECENT_CHECK | XT_RECENT_UPDATE)) != 1)
  62                 return false;
  63         if ((info->check_set & (XT_RECENT_SET | XT_RECENT_REMOVE)) &&
  64 -           (info->seconds || info->hit_count))
  65 +           (info->seconds || info->hit_count ||
  66 +           (info->check_set & XT_RECENT_MODIFIERS)))
  67 +               return false;
  68 +       if ((info->check_set & XT_RECENT_REAP) && !info->seconds)
  69                 return false;
  70         if (info->hit_count > ip_pkt_list_tot)
  71                 return false;