From: Florian Westphal <fw@strlen.de>
To: Fernando Fernandez Mancera <fmancera@suse.de>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>,
netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
louis.t42@caramail.com
Subject: Re: [PATCH nf] netfilter: nft_connlimit: fix duplicated tracking of a connection
Date: Tue, 28 Oct 2025 21:54:29 +0100 [thread overview]
Message-ID: <aQEthU7pgdNm9a18@strlen.de> (raw)
In-Reply-To: <9d1bb390-0f79-405e-8f28-6c7143a2e6b5@suse.de>
Fernando Fernandez Mancera <fmancera@suse.de> wrote:
> The use-case I have on mind (which is similar to what user described,
> but he uses a counter which I guess is just for debugging):
>
> ip saddr 192.168.1.100 tcp dport 22 ct counter over 4 mark set 0x1
>
> later, the mark can be used for tc or policy-based routing - e.g
> limiting bandwidth if the ip address has too many connections open.
>
> To me this seems a valid use case..
It is. Please add a comment as to why the extra gc is needed.
Its not needed for the 'limit this address/network to only have
x concurrent connections'.
But it is for 'softlimit-like' things as you explained above
(which I failed to consider). Thanks Fernando.
next prev parent reply other threads:[~2025-10-28 20:54 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-10-27 12:57 [PATCH nf] netfilter: nft_connlimit: fix duplicated tracking of a connection Fernando Fernandez Mancera
2025-10-27 13:47 ` Florian Westphal
2025-10-27 13:54 ` Fernando Fernandez Mancera
2025-10-28 16:58 ` Pablo Neira Ayuso
2025-10-28 17:06 ` Florian Westphal
2025-10-28 17:11 ` Pablo Neira Ayuso
2025-10-28 17:26 ` Florian Westphal
2025-10-28 18:23 ` Fernando Fernandez Mancera
2025-10-28 18:33 ` Florian Westphal
2025-10-28 18:36 ` Fernando Fernandez Mancera
2025-10-28 19:10 ` Florian Westphal
2025-10-28 20:48 ` Fernando Fernandez Mancera
2025-10-28 20:54 ` Florian Westphal [this message]
2025-10-29 8:03 ` Fernando Fernandez Mancera
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aQEthU7pgdNm9a18@strlen.de \
--to=fw@strlen.de \
--cc=coreteam@netfilter.org \
--cc=fmancera@suse.de \
--cc=louis.t42@caramail.com \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.