Re: [PATCH nf] netfilter: nft_connlimit: fix duplicated tracking of a connection

[Florian Westphal <fw@strlen.de>]

Fernando Fernandez Mancera <fmancera@suse.de> wrote:
> We need this gc call, it is what fixes the use-case reported by the 
> user. If the user is using this expression without a ct state new check, 
> we must check if some connection closed already and update the 
> connection count properly, then evaluate if the connection count greater 
> than the limit for all the packets.

I don't think so.  AFAICS the NEW/!confirmed check is enough, a
midstream packet (established connection) isn't added anymore so 'ct
count' can't go over the budget.

If last real-add brought us over the budget, then it wasn't added
(we were over budget), so next packet of existing flow will still be
within budget.

Does that make sense to you?

> Otherwise, this change will introduce a change in behavior.. AFAICT

Yes, the existing behaviour is random?  (Due to multiple re-adds).
With NEW/!confirmed check: no multiadd possible, so no need to ad-hoc
gc.

Did I miss anything?