From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753209AbbEKKKf (ORCPT ); Mon, 11 May 2015 06:10:35 -0400 Received: from tschil.ethgen.ch ([5.9.7.51]:56507 "EHLO tschil.ethgen.ch" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752102AbbEKKKe (ORCPT ); Mon, 11 May 2015 06:10:34 -0400 X-Greylist: delayed 2450 seconds by postgrey-1.27 at vger.kernel.org; Mon, 11 May 2015 06:10:33 EDT Date: Mon, 11 May 2015 10:29:41 +0100 From: Klaus Ethgen To: linux-kernel@vger.kernel.org Subject: Probably bug in netfilter hashlimit extension Message-ID: <20150511092941.GA8739@ikki.ethgen.ch> Reply-To: Klaus+lkml@ethgen.de MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1; x-action=pgp-signed OpenPGP: id=79D0B06F4E20AF1C; url=http://www.ethgen.ch/~klaus/79D0B06F4E20AF1C.txt; preference=signencrypt User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Recently I tried to mitigate some slow attacks via netfilter rule utilizing hashlimit target. I used the following specification: -A DETECT_INVALID -m hashlimit --hashlimit-upto 10/hour --hashlimit-mode srcip --hashlimit-name attack_invalid -j RETURN Now I seen some strange stuff. The counter in /proc/net/ipt_hashlimit/attack_invalid only counts from 60 back to 0 and then the entry disappears. Than means that a rate of 10/hour will never ever be detected at all. On that box I use kernel 3.16.0 from debian backport to oldstable Which seems to be somewhat equal to 3.16.7. So maybe that bug has beed find earlier or is even fixed upstream. I have no easy way to upgrade that kernel short term as the box is productive. Shorter times like 30/hour with a slightly bigger burst (10 instead of the default 5) seems to work as expected but is not able to detect the attacks due to the slow rate. Am I the only who seen that behaviour or is that a known limitation? I find no such notes anywhere that there is a limit here. (Although I would believe that there is a high limit somewhere. But then I would expect them to be returend with some errno when trying to set a to high value.) Please keep me in Cc as I do not monitor this List that often. Regards Klaus - -- Klaus Ethgen http://www.ethgen.ch/ pub 4096R/4E20AF1C 2011-05-16 Klaus Ethgen Fingerprint: 85D4 CA42 952C 949B 1753 62B3 79D0 B06F 4E20 AF1C -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQGcBAEBCgAGBQJVUHZ/AAoJEKZ8CrGAGfasiOQMAJC5FATdWhstS+60vIwn+Iyp 6/dprBI9zppfS9FtKvjCEYbrzmDKpTCfST5jtC7F6VRdfMeqgfFZ9wpdOk4VGJ6c PgpUTGN8tUrD3oLlWtd+uPIeQ5U02h2Y6Lh5YNc+iAd2fExCqixM6vExdD+5ayWy jcG/h7rC3rm332VTQNbAso7XLeMqiUVLwGn5CpbvW+A5kyePlVfjrONQ+fgBME7v xlEH4GbLgr/K2GYrJLbGcXbIAXuYHi1NyykKE3YkJIptIdTHLZmJXA79h4gGpvNj JoatHhMi3WpjxHNFSc8NXnmszJd+60PSNRu3hgGW5nkJQh6tFArGOsru2gIYLKt0 HJcO0H+gHi3sYgXRl4MxzN7GxrQjJcEL/wg+kNH8MUXZVhy4wprZoxsDiSEsmyFa il9ZSbzbDX9ipCqeLb6fq+5XmQ+KkzGnzV0RZAbV372kDL+r2ck4K1tI+plDch/y 3ivFycT6NDtmPyPW1bJ2whHsLaRG1uu9VgWcEnLoFg== =SvVH -----END PGP SIGNATURE-----