Files
linux-stable-mirror/include/net
Fernando Fernandez Mancera 3558faee8a netfilter: nf_conncount: rework API to use sk_buff directly
[ Upstream commit be102eb6a0 ]

When using nf_conncount infrastructure for non-confirmed connections a
duplicated track is possible due to an optimization introduced since
commit d265929930 ("netfilter: nf_conncount: reduce unnecessary GC").

In order to fix this introduce a new conncount API that receives
directly an sk_buff struct.  It fetches the tuple and zone and the
corresponding ct from it. It comes with both existing conncount variants
nf_conncount_count_skb() and nf_conncount_add_skb(). In addition remove
the old API and adjust all the users to use the new one.

This way, for each sk_buff struct it is possible to check if there is a
ct present and already confirmed. If so, skip the add operation.

Fixes: d265929930 ("netfilter: nf_conncount: reduce unnecessary GC")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-12-18 13:55:12 +01:00
..
2024-08-26 09:37:23 -07:00
2024-08-26 09:37:23 -07:00
2024-06-25 11:10:18 +02:00
2025-07-17 18:37:05 +02:00
2025-02-08 09:57:10 +01:00
2024-05-08 10:35:09 +01:00
2024-08-26 09:37:23 -07:00
2024-03-05 19:21:17 -08:00
2024-08-26 09:37:23 -07:00
2024-05-07 01:35:55 +02:00
2024-08-26 09:37:23 -07:00
2024-02-28 11:19:41 +00:00
2024-12-19 18:13:13 +01:00
2024-08-26 09:37:23 -07:00
2024-08-12 17:23:57 -07:00
2024-08-26 09:37:23 -07:00
2024-09-11 20:44:31 -07:00
2024-08-12 17:50:34 -07:00
2024-04-01 10:49:28 +01:00
2024-08-26 09:37:23 -07:00
2024-08-26 09:37:23 -07:00
2024-05-30 18:29:38 -07:00
2024-05-30 18:29:38 -07:00
2025-02-27 04:30:19 -08:00
2025-02-27 04:30:19 -08:00
2024-07-08 14:07:31 -07:00
2024-05-09 20:25:55 -07:00
2024-08-26 09:37:23 -07:00