Re: [stable] regression in iptables: recent filter

From: Alexey Dobriyan
Date: Thu Sep 11 2008 - 23:09:54 EST

On Fri, Sep 12, 2008 at 11:53:35AM +1000, Grant Coady wrote:
> Last known good kernel:
> # iptables -N calmrate
> # iptables -A calmrate -p tcp -m state --state NEW \
> -m recent --name listrate --update --rttl \
> --seconds 60 --hitcount 60 -j DROP
> iptables: Unknown error 4294967295
> Fails for and
> dmesg + config:

You were einvaled by the following commit:

Reloading module with ip_pkt_list_tot=60 should fix it.

commit d0ebf133590abdc035af6e19a6568667af0ab3b0
Author: Daniel Hokka Zakrisson <daniel@xxxxxxxxx>
Date: Thu Mar 20 15:07:10 2008 -0700

[NETFILTER]: ipt_recent: sanity check hit count

If a rule using ipt_recent is created with a hit count greater than
ip_pkt_list_tot, the rule will never match as it cannot keep track
of enough timestamps. This patch makes ipt_recent refuse to create such

With ip_pkt_list_tot's default value of 20, the following can be used
to reproduce the problem.

nc -u -l 1234 &
for i in `seq 1 100`; do echo $i | nc -w 1 -u 1234; done

This limits it to 20 packets:
iptables -A OUTPUT -p udp --dport 1234 -m recent --set --name test \
iptables -A OUTPUT -p udp --dport 1234 -m recent --update --seconds \
60 --hitcount 20 --name test --rsource -j DROP

While this is unlimited:
iptables -A OUTPUT -p udp --dport 1234 -m recent --set --name test \
iptables -A OUTPUT -p udp --dport 1234 -m recent --update --seconds \
60 --hitcount 21 --name test --rsource -j DROP

With the patch the second rule-set will throw an EINVAL.

Reported-by: Sean Kennedy <skennedy@xxxxxxx>
Signed-off-by: Daniel Hokka Zakrisson <daniel@xxxxxxxxx>
Signed-off-by: Patrick McHardy <kaber@xxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>

diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c
index 68cbe3c..8e8f042 100644
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/ipv4/netfilter/ipt_recent.c
@@ -252,6 +252,8 @@ recent_mt_check(const char *tablename, const void *ip,
if ((info->check_set & (IPT_RECENT_SET | IPT_RECENT_REMOVE)) &&
(info->seconds || info->hit_count))
return false;
+ if (info->hit_count > ip_pkt_list_tot)
+ return false;
if (info->name[0] == '\0' ||
strnlen(info->name, IPT_RECENT_NAME_LEN) == IPT_RECENT_NAME_LEN)
return false;
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at