Re: [PATCH nf-next] netfilter: nf_conncount: fix tracking of connections from localhost

[Florian Westphal <fw@strlen.de>]

Fernando Fernandez Mancera <fmancera@suse.de> wrote:
> After a quick test, it works for local connections. Although it doesn't 
> work for reverse-connlimit on INPUT. Consider the following ruleset:
> 
> iptables -I INPUT -p tcp --sport 80 --tcp-flags FIN,SYN,RST,ACK SYN -m 
> connlimit --connlimit-above 100 -j LOG --log-prefix "Exceeded limit 
> established connections to 443"

Mhh, what is that supposed to do?

'sport 80' meaning that we're client and we're receiving back a syn/ack?
The rule only matches syn packets.

I'm confused what this should accomplish.

> To clarify this is the diff:
> 
> diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
> index 5588cd0fcd9a..339aaf5e3393 100644
> --- a/net/netfilter/nf_conncount.c
> +++ b/net/netfilter/nf_conncount.c
> @@ -182,7 +182,7 @@ static int __nf_conncount_add(struct net *net,
>                  /* connections from localhost are confirmed almost 
> instantly,
>                   * check if there has been a reply
>                   */
> -               if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
> +               if (skb->skb_iif != 1) {
>                          err = -EEXIST;
>                          goto out_put;
>                  }
> 
> I will send a V2 and ask for testing from Michal if possible.

Thanks!  connlimit is very old and there is no formal spec as
to what its supposed to do, so I supsect we should try to at least
fix the reported regression.   I'm fine with both approaches
(REPLY and iif test), but the iif one would be 'better' in the sense
that its a clear workaround for the more shady corner case :-)

Would you mind updating the comment was well to explain that
this is related to loopback traffic, with conncount sitting
in prerouting and thus after conntrack confirmation?

Thanks!