ipvs: add conn_max sysctl to limit connections

Browse source

Currently, we are using atomic_t to track the number of
connections. On 64-bit setups with large memory there is
a risk this counter to overflow. Also, setups with many
containers may need to tune the limit for connections.

Add sysctl control to limit the number of connections to
1,073,741,824 (64-bit) and 16,777,216 (32-bit).
Depending on the admin's privilege, the value is
used to change a soft or hard limit allowing
unprivileged admins to change the soft limit in
range determined by privileged admins.

Link: https://sashiko.dev/#/patchset/20260523172715.94795-1-ja%40ssi.bg
Link: https://sashiko.dev/#/patchset/20260430074420.26697-7-ja%40ssi.bg
Link: https://sashiko.dev/#/patchset/20260522105546.13732-1-ja%40ssi.bg
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Julian Anastasov 2026-05-25 06:54:39 +03:00 • committed by Pablo Neira Ayuso

parent bfa3d89cc1

commit 4a15044a2b

4 changed files with 119 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

35

Documentation/networking/ipvs-sysctl.rst

View file

22

include/net/ip_vs.h

View file

10

net/netfilter/ipvs/ip_vs_conn.c

View file

53

net/netfilter/ipvs/ip_vs_ctl.c

View file