Re: [PATCH nf] netfilter: nf_conncount: fix zone comparison in tuple dedup

Hi Florian,

On Jul 7, 2026, at 22:58, Florian Westphal [off-list ref] wrote:

Yizhou Zhao [off-list ref] wrote:

quoted

The "already exists" dedup logic in __nf_conncount_add() decides
whether a connection has already been counted and can be skipped instead
of incrementing the connlimit count.  It compares the conntrack zone of a
list entry with the zone of the connection being added using
nf_ct_zone_id() and nf_ct_zone_equal(), passing conn->zone.dir or
zone->dir as the direction argument.

Right, thats bogus.

quoted

@@ -211,8 +220,10 @@ static int __nf_conncount_add(struct net *net,

/* Not found, but might be about to be confirmed */
if (PTR_ERR(found) == -EAGAIN) {
if (nf_ct_tuple_equal(&conn->tuple, &tuple) &&
-    nf_ct_zone_id(&conn->zone, conn->zone.dir) ==
-    nf_ct_zone_id(zone, zone->dir))
+    nf_ct_zone_id(&conn->zone,
+  nf_conncount_zone_dir(&conn->zone)) ==
+    nf_ct_zone_id(zone,
+  nf_conncount_zone_dir(zone)))

Should this be a simpler:

                               if (nf_ct_tuple_equal(&conn->tuple, &tuple) &&
-                                   nf_ct_zone_id(&conn->zone, conn->zone.dir) ==
-                                   nf_ct_zone_id(zone, zone->dir))
+                                   nf_ct_zone_equal(&conn->zone, &zone), IP_CT_DIR_ORIGINAL)

?

The tuple is always the 'original' direction, so it would follow that
we should not care about reply zone dir.

Also see:
https://sashiko.dev/#/patchset/20260706114820.74006-1-zhaoyz24%40mails.tsinghua.edu.cn

Thank you for pointing out this.

We have published a v2 patch following your suggestions:

https://lore.kernel.org/netfilter-devel/20260708052730.18354-1-zhaoyz24@mails.tsinghua.edu.cn/ (local)


Thanks,
Yizhou