lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 25 Nov 2017 08:44:18 +0100 From: Linus Lüssing <linus.luessing@...3.blue> To: netfilter-devel@...r.kernel.org Cc: Pablo Neira Ayuso <pablo@...filter.org>, Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu>, Florian Westphal <fw@...len.de>, Stephen Hemminger <stephen@...workplumber.org>, "David S . Miller" <davem@...emloft.net>, coreteam@...filter.org, bridge@...ts.linux-foundation.org, netdev@...r.kernel.org, linux-kernel@...r.kernel.org, Linus Lüssing <linus.luessing@...3.blue> Subject: [PATCH net-next] bridge: ebtables: Avoid resetting limit rule state So far any changes with ebtables will reset the state of limit rules, leading to spikes in traffic. This is especially noticeable if changes are done frequently, for instance via a daemon. This patch fixes this by bailing out from (re)setting if the limit rule was initialized before. When sending packets every 250ms for 600s, with a "--limit 1/sec --limit-burst 50" rule and a command like this in the background: $ ebtables -N VOIDCHAIN $ while true; do ebtables -F VOIDCHAIN; sleep 30; done The results are: Before: ~1600 packets After: 650 packets Signed-off-by: Linus Lüssing <linus.luessing@...3.blue> --- net/bridge/netfilter/ebt_limit.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/bridge/netfilter/ebt_limit.c b/net/bridge/netfilter/ebt_limit.c index 61a9f1be1263..f74b48633feb 100644 --- a/net/bridge/netfilter/ebt_limit.c +++ b/net/bridge/netfilter/ebt_limit.c @@ -69,6 +69,10 @@ static int ebt_limit_mt_check(const struct xt_mtchk_param *par) { struct ebt_limit_info *info = par->matchinfo; + /* Do not reset state on unrelated table changes */ + if (info->prev) + return 0; + /* Check for overflow. */ if (info->burst == 0 || user2credits(info->avg * info->burst) < user2credits(info->avg)) { -- 2.11.0
Powered by blists - more mailing lists