Eric Dumazet wrote:
> Le dimanche 28 février 2010 à 16:12 -0700, Tim Gardner a écrit :
> 
>> You are right about the reaper pointer. I'd forgotten that the LRU list
>> was already sorted oldest to newest. Doh! I've cleaned that up some.
>>
>> This version adds the '--reap' flag and only looks at the head of the
>> LRU list once per ip_reaper_freq packets.
>>
>> I also added a check that makes sure --rttl and --reap modify only the
>> --rcheck and --update options.
>>
>> rtg
> 
> @@ -272,6 +295,16 @@ recent_mt(const struct sk_buff *skb, const struct
> xt_match_param *par)
>                                 break;
>                         }
>                 }
> +
> +               /*
> +                * Run the reaper every ip_reaper_freq packets.
> +                */
> +               if ((info->check_set & XT_RECENT_REAP) &&
> +                   info->seconds &&
> 
> This (info->seconds) test is redundant, if you test it _once_ in
> recent_mt_check()
> 
> +                   (++t->reaper_cnt >= ip_reaper_freq)) {
> +                       t->reaper_cnt = 0;
> +                       recent_entry_reap(t, time);
> +               }
>         }
> 
> 
> ie :
> 
> diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
> index fc70a49..66d68f3 100644
> --- a/net/netfilter/xt_recent.c
> +++ b/net/netfilter/xt_recent.c
> @@ -294,6 +294,8 @@ static bool recent_mt_check(const struct
> xt_mtchk_param *par)
>         if ((info->check_set & (XT_RECENT_SET | XT_RECENT_REMOVE)) &&
>             (info->seconds || info->hit_count))
>                 return false;
> +       if ((info->check_set & XT_RECENT_REAP) && !info->seconds)
> +               return false;
>         if (info->hit_count > ip_pkt_list_tot)
>                 return false;
>         if (info->name[0] == '\0' ||
> 
> 
> 
> Then, now that reaping is done as a rule option only, I am not sure we
> still need the reaper_cnt logic, since you probably want ip_reaper_freq
> = 1, or else table size will probably grow at its limit, even in non DOS
> situation.
> 
> 
> 

Agreed, see attached.

-- 
Tim Gardner timg@tpi.com www.tpi.com
OR 503-601-0234 x102 MT 406-443-5357