Connlimit expression can be used for all kind of packets and not only for packets with connection state new. See this ruleset as example: table ip filter { chain input { type filter hook input priority filter; policy accept; tcp dport 22 ct count over 4 counter } } Currently, if the connection count goes over the limit the counter will count the packets. When a connection is closed, the connection count won't decrement as it should because it is only updated for new connections due to an optimization on __nf_conncount_add() that prevents updating the list if the connection is duplicated. In addition, since commit d265929930e2 ("netfilter: nf_conncount: reduce unnecessary GC") there can be situations where a duplicated connection is added to the list. This is caused by two packets from the same connection being processed during the same jiffy. To solve these problems, check whether this is a new connection and only add the connection to the list if that is the case during connlimit evaluation. Otherwise run a GC to update the count. This doesn't yield a performance degradation. Fixes: d265929930e2 ("netfilter: nf_conncount: reduce unnecessary GC") Fixes: 976afca1ceba ("netfilter: nf_conncount: Early exit in nf_conncount_lookup() and cleanup") Closes: https://lore.kernel.org/netfilter/trinity-85c72a88-d762-46c3-be97-36f10e5d9796-1761173693813@3c-app-mailcom-bs12/ Signed-off-by: Fernando Fernandez Mancera --- net/netfilter/nft_connlimit.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/netfilter/nft_connlimit.c b/net/netfilter/nft_connlimit.c index fc35a11cdca2..19c8b5377e35 100644 --- a/net/netfilter/nft_connlimit.c +++ b/net/netfilter/nft_connlimit.c @@ -43,9 +43,15 @@ static inline void nft_connlimit_do_eval(struct nft_connlimit *priv, return; } - if (nf_conncount_add(nft_net(pkt), priv->list, tuple_ptr, zone)) { - regs->verdict.code = NF_DROP; - return; + if (ctinfo == IP_CT_NEW) { + if (nf_conncount_add(nft_net(pkt), priv->list, tuple_ptr, zone)) { + regs->verdict.code = NF_DROP; + return; + } + } else { + local_bh_disable(); + nf_conncount_gc_list(nft_net(pkt), priv->list); + local_bh_enable(); } count = READ_ONCE(priv->list->count); -- 2.51.0