[PATCH nf 0/3] netfilter: conntrack: switch to siphash

[Florian Westphal <fw@strlen.de>]

Two recent commits switched inet rt and nexthop exception
hashes from jhash to siphash.

If those two spots are problematic then conntrack is affected
as well, so switch voer to siphash too.

While at it, add a hard upper limit on chain lengths and reject
insertion if this is hit.

Florian Westphal (3):
  netfilter: conntrack: sanitize table size default settings
  netfilter: conntrack: switch to siphash
  netfilter: conntrack: refuse insertion if chain has grown too large

 .../networking/nf_conntrack-sysctl.rst        |  13 ++-
 include/linux/netfilter/nf_conntrack_common.h |   1 +
 .../linux/netfilter/nfnetlink_conntrack.h     |   1 +
 net/netfilter/nf_conntrack_core.c             | 103 ++++++++++++------
 net/netfilter/nf_conntrack_expect.c           |  25 +++--
 net/netfilter/nf_conntrack_netlink.c          |   4 +-
 net/netfilter/nf_conntrack_standalone.c       |   4 +-
 net/netfilter/nf_nat_core.c                   |  18 ++-
 8 files changed, 114 insertions(+), 55 deletions(-)

-- 
2.31.1