netfilter: nft_limit: reject configurations that cause integer overflow

Browse source

[ Upstream commit c9d9eb9c53 ]

Reject bogus configs where internal token counter wraps around.
This only occurs with very very large requests, such as 17gbyte/s.

Its better to reject this rather than having incorrect ratelimit.

Fixes: d2168e849e ("netfilter: nft_limit: add per-byte limiting")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Florian Westphal 2024-01-19 13:11:32 +01:00 • committed by Greg Kroah-Hartman

parent c817f5c016

commit bc6e242bb7

1 changed files with 16 additions and 7 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

23

net/netfilter/nft_limit.c

View file