Re: Query: status of ipt_recent?

[Patrick McHardy <kaber@trash.net>]

Grant Coady wrote:
> On Sun, 28 May 2006 14:05:11 +0200, Patrick McHardy <kaber@trash.net> wrote:
> 
>>The problem with the recent match is mostly that its an offence
>>to the eyes and very hard to maintain, even small and simple patches
>>are hard to review. As far as I know it works fine if you forget
>>about a few corner cases, so I don't really see a reason for a
>>backport. Shouldn't be very hard though.
> 
> 
> I use 2.4.latest on firewall box and was using iptables --recent 
> for web server traffic calming (on tiny pipe to 'net) by src_ip 
> to prevent DoS by some users.  I hadn't noticed memory leak, 
> perhaps 'cos uptime max is in weeks, and I unload/reload ipt_recent 
> 'cos firewall sets parameters (more entries, less history):
> 
>         report "    reload --recent (250 x 2)"
>         rmmod ipt_recent
>         # see man iptables for this:
>         modprobe ipt_recent ip_list_tot=250 ip_pkt_list_tot=2
> 
> each time I fiddle with the iptables ruleset.

The leak only happens on an error path under very unlikely
circumstances.

> If the author has abandoned the thing I could reformat it, throw 
> in some function calls to convert the spaghetti code to functions, 
> make it easier to see the obfuscated control flow, and throw in 
> some goto targets as well ;)  (CodingStyle single exit)
> 
> I'd hate to duplicate a work in progress.  

Well, for 2.6 we have a replacement now. For 2.4 such a patch would
be too intrusive, so you would have to maintain it yourself out of
tree.