Re: [PATCH nf,v3] netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
Talha Berk Arslan <[email protected]> Wed, 22 Jul 2026 08:56:54 +0300
| Newsgroups | gmane.comp.security.firewalls.netfilter.devel |
|---|---|
| Message-ID | <[email protected]> |
On Tue, Jul 21, 2026 at 10:52:56PM +0200, Pablo Neira Ayuso wrote: > [PATCH nf,v3] netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH Hi Pablo, Sorry for the delayed reply, I am based in Turkey (UTC+3) and saw your v3 this morning. I tested v3 on Debian 12 (kernel 6.1.0-50-amd64) by building the patched module against the 6.1.176 headers. Before patch: both a rule without XT_HASHLIMIT_RATE_MATCH and a second rule with XT_HASHLIMIT_RATE_MATCH sharing the same table name were accepted silently (exit 0), leaving rateinfo.burst uninitialized. After patch: the conflicting rule is correctly rejected at .checkentry: iptables v1.8.9 (nf_tables): RULE_APPEND failed (Invalid argument): rule in chain INPUT Tested-by: Talha Berk Arslan <[email protected]> Thanks, Talha Berk Arslan Artfical Security Intelligence