• Phil Oester's avatar
    [NETFILTER]: Fix recent match jiffies wrap mismatches · 2a43c4af
    Phil Oester authored
    Around jiffies wrap time (i.e. within first 5 mins after boot), recent
    match rules which contain both --seconds and --hitcount arguments
    experience false matches.
    This is because the last_pkts array is filled with zeros on creation, and
    when comparing 'now' to 0 (+ --seconds argument), time_before_eq thinks it
    has found a hit.
    Below patch adds a break if the packet value is zero.  This has the
    unfortunate side effect of causing mismatches if a packet was received
    when jiffies really was equal to zero.  The odds of that happening are
    slim compared to the problems caused by not adding the break however.
    Plus, the author used this same method just below, so it is "good enough".
    This fixes netfilter bugs #383 and #395.
    Signed-off-by: default avatarPhil Oester <kernel@linuxace.com>
    Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>