Files
linux/include/net
Fernando Fernandez Mancera da9f247fb5 netfilter: nf_conncount: rework API to use sk_buff directly
[ Upstream commit be102eb6a0e7c03db00e50540622f4e43b2d2844 ]

When using nf_conncount infrastructure for non-confirmed connections a
duplicated track is possible due to an optimization introduced since
commit d265929930 ("netfilter: nf_conncount: reduce unnecessary GC").

In order to fix this introduce a new conncount API that receives
directly an sk_buff struct.  It fetches the tuple and zone and the
corresponding ct from it. It comes with both existing conncount variants
nf_conncount_count_skb() and nf_conncount_add_skb(). In addition remove
the old API and adjust all the users to use the new one.

This way, for each sk_buff struct it is possible to check if there is a
ct present and already confirmed. If so, skip the add operation.

Fixes: d265929930 ("netfilter: nf_conncount: reduce unnecessary GC")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2026-01-11 15:21:34 +01:00
..
2025-07-17 18:35:09 +02:00
2025-02-08 09:51:55 +01:00
2022-08-09 22:14:02 -07:00
2021-12-16 07:18:35 -08:00
2023-11-20 11:59:34 +01:00
2021-10-15 11:33:08 +01:00
2024-01-31 16:19:01 -08:00
2023-04-22 01:39:41 +02:00
2025-03-07 16:45:39 +01:00
2024-12-19 18:11:28 +01:00
2021-10-13 09:40:46 -07:00
2023-08-22 17:31:18 -07:00
2023-05-11 18:07:05 -07:00
2023-07-14 20:39:30 -07:00
2019-04-22 21:47:25 -07:00
2019-10-05 16:29:00 -07:00
2025-02-27 04:10:50 -08:00
2023-02-16 09:27:07 +01:00
2025-02-27 04:10:50 -08:00
2024-07-18 13:21:12 +02:00
2023-07-28 14:07:59 -07:00
2022-12-12 15:04:39 -08:00
2023-11-20 11:58:56 +01:00
2023-08-02 10:58:26 +01:00
2023-07-19 09:56:49 -07:00