Re: [PATCH 1/2] xt_connlimit (kernel) - connection limiting

[Patrick McHardy <kaber@trash.net>]

Jan Engelhardt wrote:
> Hi,
> 
> 
> On Jun 3 2007 19:34, Patrick McHardy wrote:
> 
>>Jan Engelhardt wrote:
>>
>>>Adds the connlimit match that has been in POM-NG for a long time.
>>
>>This has about half the points I mentioned last time unfixed,
>>starting with proper use of list.h.
> 
> 
> #include <linux/list.h>
> ...
> struct xt_connlimit_conn {
> 	struct list_head list;
> 	struct nf_conntrack_tuple tuple;
> };
> struct xt_connlimit_data {
> 	struct list_head iphash[256];
> 	spinlock_t lock;
> };
> 
> That looks like lists to me. Please enlighten me where you think
> lists were missing.

+	for (lh = hash->next; lh != hash; lh = lh->next) {

+	for (i = 0; i < 256; ++i) {
+		hash = &info->data->iphash[i];
+		while (hash != hash->next) {
+			conn = list_entry(hash->next,
+			       struct xt_connlimit_conn, list);

> 
> I remember "last time" as
> http://lists.netfilter.org/pipermail/netfilter-devel/2006-December/026341.html
> http://lists.netfilter.org/pipermail/netfilter-devel/2007-January/026577.html
> where you did not thought negatively about connlimit. Please let me know of the
> post you were referring to. Thanks!

This one:

http://lists.netfilter.org/pipermail/netfilter/2007-April/068411.html