<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - hashlimit never appears to fail to match under 4.9.x"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1273">1273</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>hashlimit never appears to fail to match under 4.9.x
</td>
</tr>
<tr>
<th>Product</th>
<td>netfilter/iptables
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>major
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>ip_tables (kernel)
</td>
</tr>
<tr>
<th>Assignee</th>
<td>netfilter-buglog@lists.netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>bugzilla-nf20180726@ta.grue.cc
</td>
</tr></table>
<p>
<div>
<pre>I have the same rules under both 4.9.111 and 4.8.3. The 4.8.3 kernel works as
expected but not under 4.9.111. The rules are as follows:
4.8.3:
[825033:522252112] -A m.voip.asterisk.reg -m hashlimit --hashlimit-upto 100/min
--hashlimit-burst 70 --hashlimit-mode srcip,dstport --hashlimit-name
m.voip.sip_r_li -j ACCEPT
[366031:149053285] -A m.voip.asterisk.reg -m limit --limit 5/sec -j LOG
--log-prefix "FW: SIP.REG LIMIT IN: " --log-level 6
[49357657:18457587442] -A m.voip.asterisk.reg -j DROP
4.9.111:
[44798:20928681] -A m.voip.asterisk.reg -m hashlimit --hashlimit-upto 100/min
--hashlimit-burst 70 --hashlimit-mode srcip,dstport --hashlimit-name
m.voip.sip_r_limit -j ACCEPT
[0:0] -A m.voip.asterisk.reg -m limit --limit 5/sec -j LOG --log-prefix "FW:
SIP.REG LIMIT IN: " --log-level 6
[0:0] -A m.voip.asterisk.reg -j DROP
Sample of the content of /proc/net/ipt_hashlimit/m.voip.sip_r_li* is as
follows:
4.8.3:
...
60 37.49.231.72:0->0.0.0.0:5060 3328 1344000 19200
59 37.49.231.70:0->0.0.0.0:5060 2048 1344000 19200
60 37.49.231.86:0->0.0.0.0:5060 17920 1344000 19200
...
4.9.111:
...
59 37.49.231.117:0->0.0.0.0:5060 5772436045824000 5772436045824000 0
44 37.49.231.72:0->0.0.0.0:5060 5772436045824000 5772436045824000 0
56 37.49.231.103:0->0.0.0.0:5060 5772436045824000 5772436045824000 0
53 37.49.231.70:0->0.0.0.0:5060 5772436045824000 5772436045824000 0
...
End result is that under 4.8.3 attacks on the sip service don't get far whereas
under 4.9.111 they can go full throttle, completely unhindered.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>