Re: [PATCH nf] netfilter: nf_conncount: prevent connlimit drops for early confirmed ct

[Florian Westphal <fw@strlen.de>]

Fernando Fernandez Mancera <fmancera@suse.de> wrote:
> About IP_CT_ESTABLISHED, I added it because it was not clear to me that 
> IPS_ASSURED_BIT is always set. I guess yes for TCP/UDP but what about 
> other protocols? (Are we supporting other protocols???) Anyway, I have 
> tested it and confirmed that for TCP/UDP it is safe to drop it.

SCTP is the only other relevant one for this use-case, I think.

> And please note that the idea is to be cautious when returning --EXIST. 
> If IPS_ASSURED_BIT is set we can for sure skip the tracking BUT if not, 
> we run a GC skipping the skip optimization..

6 months from now I will no longer know wtf this assured check is
doing.  Please consider rewriting the existing comments so that this
makes some sense.

> Is it that bad? I mean, it has some back and forth and I apologize for 
> that but overall this is fixing some real use cases.

I know, this isn't your fault. Conncount is used in all kinds of cases
that it wasn't designed for and thus we have this esoteric breakage in
first place.

No way we can avoid it.  I think your patch is the best we can do here.