linux/net/netfilter/ipvs
Julian Anastasov 4a15044a2b ipvs: add conn_max sysctl to limit connections
Currently, we are using atomic_t to track the number of
connections. On 64-bit setups with large memory there is
a risk this counter to overflow. Also, setups with many
containers may need to tune the limit for connections.

Add sysctl control to limit the number of connections to
1,073,741,824 (64-bit) and 16,777,216 (32-bit).
Depending on the admin's privilege, the value is
used to change a soft or hard limit allowing
unprivileged admins to change the soft limit in
range determined by privileged admins.

Link: https://sashiko.dev/#/patchset/20260523172715.94795-1-ja%40ssi.bg
Link: https://sashiko.dev/#/patchset/20260430074420.26697-7-ja%40ssi.bg
Link: https://sashiko.dev/#/patchset/20260522105546.13732-1-ja%40ssi.bg
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
History 2026-06-05 13:11:54 +02:00
..
ip_vs_app.c net: Remove KMSG_COMPONENT macro 2025-11-28 19:20:27 -08:00
ip_vs_conn.c ipvs: add conn_max sysctl to limit connections 2026-06-05 13:11:54 +02:00
ip_vs_core.c ipvs: fix shift-out-of-bounds in ip_vs_rht_desired_size 2026-05-05 01:52:55 +02:00
ip_vs_ctl.c ipvs: add conn_max sysctl to limit connections 2026-06-05 13:11:54 +02:00
ip_vs_dh.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ip_vs_est.c ipvs: fix races around est_mutex and est_cpulist 2026-05-05 01:52:55 +02:00
ip_vs_fo.c net: Remove KMSG_COMPONENT macro 2025-11-28 19:20:27 -08:00
ip_vs_ftp.c net: Remove KMSG_COMPONENT macro 2025-11-28 19:20:27 -08:00
ip_vs_lblc.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ip_vs_lblcr.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ip_vs_lc.c net: Remove KMSG_COMPONENT macro 2025-11-28 19:20:27 -08:00
ip_vs_mh.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
ip_vs_nfct.c net: Remove KMSG_COMPONENT macro 2025-11-28 19:20:27 -08:00
ip_vs_nq.c net: Remove KMSG_COMPONENT macro 2025-11-28 19:20:27 -08:00
ip_vs_ovf.c net: Remove KMSG_COMPONENT macro 2025-11-28 19:20:27 -08:00
ip_vs_pe.c net: Remove KMSG_COMPONENT macro 2025-11-28 19:20:27 -08:00
ip_vs_pe_sip.c ipvs: switch to per-net connection table 2026-03-04 11:45:45 +01:00
ip_vs_proto.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ip_vs_proto_ah_esp.c net: Remove KMSG_COMPONENT macro 2025-11-28 19:20:27 -08:00
ip_vs_proto_sctp.c ipvs: skip ipv6 extension headers for csum checks 2026-02-17 15:04:20 +01:00
ip_vs_proto_tcp.c ipvs: skip ipv6 extension headers for csum checks 2026-02-17 15:04:20 +01:00
ip_vs_proto_udp.c ipvs: skip ipv6 extension headers for csum checks 2026-02-17 15:04:20 +01:00
ip_vs_rr.c net: Remove KMSG_COMPONENT macro 2025-11-28 19:20:27 -08:00
ip_vs_sched.c ipvs: clear the svc scheduler ptr early on edit 2026-06-01 13:43:52 +02:00
ip_vs_sed.c net: Remove KMSG_COMPONENT macro 2025-11-28 19:20:27 -08:00
ip_vs_sh.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ip_vs_sync.c ipvs: switch to per-net connection table 2026-03-04 11:45:45 +01:00
ip_vs_twos.c net: Remove KMSG_COMPONENT macro 2025-11-28 19:20:27 -08:00
ip_vs_wlc.c net: Remove KMSG_COMPONENT macro 2025-11-28 19:20:27 -08:00
ip_vs_wrr.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ip_vs_xmit.c ipvs: fix MTU check for GSO packets in tunnel mode 2026-04-20 23:45:43 +02:00
Kconfig netfilter: add option for GCOV profiling 2026-05-24 22:55:47 +02:00
Makefile netfilter: add option for GCOV profiling 2026-05-24 22:55:47 +02:00