Re: [PATCH nf v2] netfilter: nf_conncount: prevent connlimit drops for early confirmed ct

[Florian Westphal <fw@strlen.de>]

Fernando Fernandez Mancera <fmancera@suse.de> wrote:
> Commit 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add
> was skipped") introduced a regression where packets for valid
> connections are dropped when using connlimit for soft-limiting
> scenarios.
> 
> The issue occurs when a new connection reuses a socket currently in
> the TIME_WAIT state. In this scenario, the connection tracking entry
> is evaluated as already confirmed. Previously, __nf_conncount_add()
> assumed that if a connection was confirmed and did not originate from
> the loopback interface, it should skip the addition and return -EEXIST.
> 
> Skipping the addition triggers a garbage collection run that cleans up
> the TIME_WAIT connection. Consequently, the active connection count
> drops to 0, which xt_connlimit mishandles, leading to the false rejection
> of the perfectly valid new connection.

What do you make of https://sashiko.dev/#/patchset/20260514141628.4636-1-fmancera%40suse.de

Is there a way to handle this with a different solution?
I don't see a good solution.   What about making
__nf_conncount_gc_list() return the number of removed elements and allow
a single re-add attempt if we released some entries?

(Note that I don't think that conncount with unidirectional traffic
 is a sensible thing to configure, but I can't say "not supported"
 either...)