Commit 1c7628bd authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller

[NETFILTER]: xt_hashlimit: fix limit off-by-one

Hashlimit doesn't account for the first packet, which is inconsistent
with the limit match.

Reported by ryan.castellucci@gmail.com, netfilter bugzilla #500.
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 97c802a1
...@@ -454,15 +454,12 @@ hashlimit_match(const struct sk_buff *skb, ...@@ -454,15 +454,12 @@ hashlimit_match(const struct sk_buff *skb,
dh->rateinfo.credit_cap = user2credits(hinfo->cfg.avg * dh->rateinfo.credit_cap = user2credits(hinfo->cfg.avg *
hinfo->cfg.burst); hinfo->cfg.burst);
dh->rateinfo.cost = user2credits(hinfo->cfg.avg); dh->rateinfo.cost = user2credits(hinfo->cfg.avg);
} else {
spin_unlock_bh(&hinfo->lock); /* update expiration timeout */
return 1; dh->expires = now + msecs_to_jiffies(hinfo->cfg.expire);
rateinfo_recalc(dh, now);
} }
/* update expiration timeout */
dh->expires = now + msecs_to_jiffies(hinfo->cfg.expire);
rateinfo_recalc(dh, now);
if (dh->rateinfo.credit >= dh->rateinfo.cost) { if (dh->rateinfo.credit >= dh->rateinfo.cost) {
/* We're underlimit. */ /* We're underlimit. */
dh->rateinfo.credit -= dh->rateinfo.cost; dh->rateinfo.credit -= dh->rateinfo.cost;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment