archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 03:04:51 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

netfilter: nf_conncount: fix tracking of connections from localhost

Browse source 
Since commit be102eb6a0 ("netfilter: nf_conncount: rework API to use
sk_buff directly"), we skip the adding and trigger a GC when the ct is
confirmed. For connections originated from local to local it doesn't
work because the connection is confirmed on POSTROUTING, therefore
tracking on the INPUT hook is always skipped.

In order to fix this, we check whether skb input ifindex is set to
loopback ifindex. If it is then we fallback on a GC plus track operation
skipping the optimization. This fallback is necessary to avoid
duplicated tracking of a packet train e.g 10 UDP datagrams sent on a
burst when initiating the connection.

Tested with xt_connlimit/nft_connlimit and OVS limit and with a HTTP
server and iperf3 on UDP mode.

Fixes: be102eb6a0 ("netfilter: nf_conncount: rework API to use sk_buff directly")
Reported-by: Michal Slabihoudek <michal.slabihoudek@gooddata.com>
Closes: https://lore.kernel.org/netfilter/6989BD9F-8C24-4397-9AD7-4613B28BF0DB@gooddata.com/
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Florian Westphal <fw@strlen.de>
This commit is contained in:
Fernando Fernandez Mancera 2026-01-19 21:35:46 +01:00 • committed by Florian Westphal
parent cda26c6459
commit de8a70cefc
1 changed files with 13 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

15
net/netfilter/nf_conncount.c
View file

@ -179,14 +179,25 @@ static int __nf_conncount_add(struct net *net,
return -ENOENT;
if (ct && nf_ct_is_confirmed(ct)) {
err = -EEXIST;
goto out_put;
/* local connections are confirmed in postrouting so confirmation
* might have happened before hitting connlimit
*/
if (skb->skb_iif != LOOPBACK_IFINDEX) {
err = -EEXIST;
goto out_put;
}
/* this is likely a local connection, skip optimization to avoid
* adding duplicates from a 'packet train'
*/
goto check_connections;
}
if ((u32)jiffies == list->last_gc &&
(list->count - list->last_gc_count) < CONNCOUNT_GC_MAX_COLLECT)
goto add_new_node;
check_connections:
/* check the saved connections */
list_for_each_entry_safe(conn, conn_n, &list->head, node) {
if (collect > CONNCOUNT_GC_MAX_COLLECT)