netfilter: nf_conncount: fix tracking of connections from localhost

Since commit be102eb6a0e7 ("netfilter: nf_conncount: rework API to use
sk_buff directly"), we skip the adding and trigger a GC when the ct is
confirmed. For connections originated from local to local it doesn't
work because the connection is confirmed on POSTROUTING, therefore
tracking on the INPUT hook is always skipped.

In order to fix this, we check whether skb input ifindex is set to
loopback ifindex. If it is then we fallback on a GC plus track operation
skipping the optimization. This fallback is necessary to avoid
duplicated tracking of a packet train e.g 10 UDP datagrams sent on a
burst when initiating the connection.

Tested with xt_connlimit/nft_connlimit and OVS limit and with a HTTP
server and iperf3 on UDP mode.

Fixes: be102eb6a0e7 ("netfilter: nf_conncount: rework API to use sk_buff directly")
Reported-by: Michal Slabihoudek <michal.slabihoudek@gooddata.com>
Closes: https://lore.kernel.org/netfilter/6989BD9F-8C24-4397-9AD7-4613B28BF0DB@gooddata.com/
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
index 288936f5c1bf927aa566db961cff2886469aab98..14e62b3263cd94ff7c4c4b930a8a6a7c580b1466 100644 (file)
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -179,14 +179,25 @@ static int __nf_conncount_add(struct net *net,
                return -ENOENT;
 
        if (ct && nf_ct_is_confirmed(ct)) {
-               err = -EEXIST;
-               goto out_put;
+               /* local connections are confirmed in postrouting so confirmation
+                * might have happened before hitting connlimit
+                */
+               if (skb->skb_iif != LOOPBACK_IFINDEX) {
+                       err = -EEXIST;
+                       goto out_put;
+               }
+
+               /* this is likely a local connection, skip optimization to avoid
+                * adding duplicates from a 'packet train'
+                */
+               goto check_connections;
        }
 
        if ((u32)jiffies == list->last_gc &&
            (list->count - list->last_gc_count) < CONNCOUNT_GC_MAX_COLLECT)
                goto add_new_node;
 
+check_connections:
        /* check the saved connections */
        list_for_each_entry_safe(conn, conn_n, &list->head, node) {
                if (collect > CONNCOUNT_GC_MAX_COLLECT)