From: Patrick McHardy Date: Mon, 22 Mar 2010 17:25:20 +0000 (+0100) Subject: netfilter: xt_recent: fix regression in rules using a zero hit_count X-Git-Tag: v2.6.32.11~24 X-Git-Url: https://git.fsl.cs.sunysb.edu/?a=commitdiff_plain;h=5a32ab6f23dd07b97a6095d6ddbfa79c47cf3bbd;p=unionfs-2.6.39.y.git netfilter: xt_recent: fix regression in rules using a zero hit_count commit ef1691504c83ba3eb636c0cfd3ed33f7a6d0b4ee upstream. Commit 8ccb92ad (netfilter: xt_recent: fix false match) fixed supposedly false matches in rules using a zero hit_count. As it turns out there is nothing false about these matches and people are actually using entries with a hit_count of zero to make rules dependant on addresses inserted manually through /proc. Since this slipped past the eyes of three reviewers, instead of reverting the commit in question, this patch explicitly checks for a hit_count of zero to make the intentions more clear. Reported-by: Thomas Jarosch Tested-by: Thomas Jarosch Signed-off-by: Patrick McHardy Signed-off-by: Greg Kroah-Hartman --- diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c index 1a3b6508060..2f181aa07b0 100644 --- a/net/netfilter/xt_recent.c +++ b/net/netfilter/xt_recent.c @@ -260,7 +260,7 @@ recent_mt(const struct sk_buff *skb, const struct xt_match_param *par) for (i = 0; i < e->nstamps; i++) { if (info->seconds && time_after(time, e->stamps[i])) continue; - if (info->hit_count && ++hits >= info->hit_count) { + if (!info->hit_count || ++hits >= info->hit_count) { ret = !ret; break; }