Commit ef169150 authored Mar 22, 2010 by Patrick McHardy

netfilter: xt_recent: fix regression in rules using a zero hit_count



Commit 8ccb92ad (netfilter: xt_recent: fix false match) fixed supposedly
false matches in rules using a zero hit_count. As it turns out there is
nothing false about these matches and people are actually using entries
with a hit_count of zero to make rules dependant on addresses inserted
manually through /proc.

Since this slipped past the eyes of three reviewers, instead of
reverting the commit in question, this patch explicitly checks
for a hit_count of zero to make the intentions more clear.

Reported-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Tested-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Cc: stable@kernel.org
Signed-off-by: Patrick McHardy <kaber@trash.net>

parent 220bf991

net/netfilter/xt_recent.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -267,7 +267,7 @@ recent_mt(const struct sk_buff skb, const struct xt_match_param par)
		for (i = 0; i < e->nstamps; i++) {
		if (info->seconds && time_after(time, e->stamps[i]))
		continue;
		if (info->hit_count && ++hits >= info->hit_count) {
		if (!info->hit_count \|\| ++hits >= info->hit_count) {
		ret = !ret;
		break;
		}