diff options
Diffstat (limited to 'net/netfilter/xt_connlimit.c')
| -rw-r--r-- | net/netfilter/xt_connlimit.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c index e029c4807404..82ce7c5fbbc2 100644 --- a/net/netfilter/xt_connlimit.c +++ b/net/netfilter/xt_connlimit.c @@ -97,7 +97,8 @@ static int count_them(struct net *net, const struct nf_conntrack_tuple *tuple, const union nf_inet_addr *addr, const union nf_inet_addr *mask, - u_int8_t family) + u_int8_t family, + unsigned int threshold) { const struct nf_conntrack_tuple_hash *found; struct xt_connlimit_conn *conn; @@ -151,9 +152,14 @@ static int count_them(struct net *net, continue; } - if (same_source_net(addr, mask, &conn->tuple.src.u3, family)) + if (same_source_net(addr, mask, &conn->tuple.src.u3, family)) { /* same source network -> be counted! */ ++matches; + if (matches > threshold) { + nf_ct_put(found_ct); + break; + } + } nf_ct_put(found_ct); } @@ -207,7 +213,8 @@ connlimit_mt(const struct sk_buff *skb, struct xt_action_param *par) spin_lock_bh(&info->data->lock); connections = count_them(net, info->data, tuple_ptr, &addr, - &info->mask, par->family); + &info->mask, par->family, + info->limit); spin_unlock_bh(&info->data->lock); if (connections < 0) |