1. 02 12月, 2005 2 次提交
    • P
      [NETFILTER]: Fix recent match jiffies wrap mismatches · 2a43c4af
      Phil Oester 提交于
      Around jiffies wrap time (i.e. within first 5 mins after boot), recent
      match rules which contain both --seconds and --hitcount arguments
      experience false matches.
      
      This is because the last_pkts array is filled with zeros on creation, and
      when comparing 'now' to 0 (+ --seconds argument), time_before_eq thinks it
      has found a hit.
      
      Below patch adds a break if the packet value is zero.  This has the
      unfortunate side effect of causing mismatches if a packet was received
      when jiffies really was equal to zero.  The odds of that happening are
      slim compared to the problems caused by not adding the break however.
      Plus, the author used this same method just below, so it is "good enough".
      
      This fixes netfilter bugs #383 and #395.
      Signed-off-by: NPhil Oester <kernel@linuxace.com>
      Signed-off-by: NPatrick McHardy <kaber@trash.net>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      2a43c4af
    • J
      [NETFILTER]: Ignore ACKs ACKs on half open connections in TCP conntrack · 73f30602
      Jozsef Kadlecsik 提交于
      Mounting NFS file systems after a (warm) reboot could take a long time if
      firewalling and connection tracking was enabled.
      
      The reason is that the NFS clients tends to use the same ports (800 and
      counting down). Now on reboot, the server would still have a TCB for an
      existing TCP connection client:800 -> server:2049. The client sends a
      SYN from port 800 to server:2049, which elicits an ACK from the server.
      The firewall on the client drops the ACK because (from its point of
      view) the connection is still in half-open state, and it expects to see
      a SYNACK.
      
      The client will eventually time out after several minutes.
      
      The following patch corrects this, by accepting ACKs on half open
      connections as well.
      Signed-off-by: NJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
      Signed-off-by: NPatrick McHardy <kaber@trash.net>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      73f30602
  2. 01 12月, 2005 6 次提交
  3. 30 11月, 2005 32 次提交