Re: Cannot delete hashlimit match entries

[Samuel Jean <sj-netfilter@cookinglinux.org>]

Phil Oester wrote:
> As noted by a bugzilla reporter, 
> 
> iptables -A foo -m hashlimit --hashlimit 5/s --hashlimit-mode srcip --hashlimit-name foo
> iptables -D foo -m hashlimit --hashlimit 5/s --hashlimit-mode srcip --hashlimit-name foo
> iptables: Bad rule (does a matching rule exist in that chain?)
> 
> In reviewing this, I think the fact that *hinfo is initialized by the kernel
> will make this a tough problem to fix.  The unitialized match is:
> 

Yes. The only way am aware of to fix it is sizing the matching part with offsetof().
Fortunately, in this case, all modified member are at end so we can use this hack without
breaking any compatibility.

> Ideas?

Index: extensions/libipt_hashlimit.c
===================================================================
--- extensions/libipt_hashlimit.c       (revision 3525)
+++ extensions/libipt_hashlimit.c       (working copy)
@@ -351,8 +351,7 @@
         .name           = "hashlimit",
         .version        = IPTABLES_VERSION,
         .size           = IPT_ALIGN(sizeof(struct ipt_hashlimit_info)),
-       .userspacesize  = IPT_ALIGN(sizeof(struct ipt_hashlimit_info)),
-       //offsetof(struct ipt_hashlimit_info, prev),
+       .userspacesize  = offsetof(struct ipt_hashlimit_info, hinfo),
         .help           = &help,
         .init           = &init,
         .parse          = &parse,

By now, SVN is crush. 8( I can't tell wheter this patch applies or not. but at least, you got the idea.


> 
> Phil
> 

Cheers,
Samuel