netfilter: nf_conncount: rework API to use sk_buff directly

Browse source

When using nf_conncount infrastructure for non-confirmed connections a
duplicated track is possible due to an optimization introduced since
commit d265929930 ("netfilter: nf_conncount: reduce unnecessary GC").

In order to fix this introduce a new conncount API that receives
directly an sk_buff struct.  It fetches the tuple and zone and the
corresponding ct from it. It comes with both existing conncount variants
nf_conncount_count_skb() and nf_conncount_add_skb(). In addition remove
the old API and adjust all the users to use the new one.

This way, for each sk_buff struct it is possible to check if there is a
ct present and already confirmed. If so, skip the add operation.

Fixes: d265929930 ("netfilter: nf_conncount: reduce unnecessary GC")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Fernando Fernandez Mancera 2025-11-21 01:14:30 +01:00 • committed by Pablo Neira Ayuso

parent fe8313316e

commit be102eb6a0

5 changed files with 142 additions and 103 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

15

include/net/netfilter/nf_conntrack_count.h

View file

185

net/netfilter/nf_conncount.c

View file

21

net/netfilter/nft_connlimit.c

View file

14

net/netfilter/xt_connlimit.c

View file

16

net/openvswitch/conntrack.c

View file