[NETFILTER]: xt_limit: don't reset state on unrelated rule updates

The limit match reinitializes its state whenever the ruleset changes,
which means it will forget about previously used credits.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 8 insertions, 8 deletions

diff --git a/net/netfilter/xt_limit.c b/net/netfilter/xt_limit.c
index b9c9ff3a06e..8bfcbdfa878 100644
--- a/net/netfilter/xt_limit.c
+++ b/net/netfilter/xt_limit.c
@@ -122,16 +122,16 @@ ipt_limit_checkentry(const char *tablename,
                 return 0;
         }
 
-        /* User avg in seconds * XT_LIMIT_SCALE: convert to jiffies *
-           128. */
-        r->prev = jiffies;
-        r->credit = user2credits(r->avg * r->burst);     /* Credits full. */
-        r->credit_cap = user2credits(r->avg * r->burst); /* Credits full. */
-        r->cost = user2credits(r->avg);
-
         /* For SMP, we only want to use one set of counters. */
         r->master = r;
-
+        if (r->cost == 0) {
+                /* User avg in seconds * XT_LIMIT_SCALE: convert to jiffies *
+                   128. */
+                r->prev = jiffies;
+                r->credit = user2credits(r->avg * r->burst);     /* Credits full. */
+                r->credit_cap = user2credits(r->avg * r->burst); /* Credits full. */
+                r->cost = user2credits(r->avg);
+        }
         return 1;
 }