This patch set makes the zone id part of the conntrack hash again. First patch is a followup to d7e7747ac5c2496c9, "netfilter: refuse insertion if chain has grown too large". Instead of a fixed-size limit, allow for some slack in the drop limit. This makes it harder to extract information about hash table collisions/bucket overflows. Second patch makes the zone id part of the tuple hash again. This was removed six years ago to allow split-zone support. Last two patches add test cases for zone support with colliding tuples. First test case emulates split zones, where NAT is responsible to expose the overlapping networks and provide unique source ports via nat port translation. Second test case exercises overlapping tuples in distinct zones. Expectation is that all connection succeed (first self test) and that all insertions work (second self test). Florian Westphal (5): netfilter: conntrack: make connection tracking table less predictable netfilter: conntrack: include zone id in tuple hash again netfilter: nat: include zone id in nat table hash again selftests: netfilter: add selftest for directional zone support selftests: netfilter: add zone stress test with colliding tuples net/netfilter/nf_conntrack_core.c | 84 +++-- net/netfilter/nf_nat_core.c | 17 +- .../selftests/netfilter/nft_nat_zones.sh | 309 ++++++++++++++++++ .../selftests/netfilter/nft_zones_many.sh | 156 +++++++++ 4 files changed, 540 insertions(+), 26 deletions(-) create mode 100755 tools/testing/selftests/netfilter/nft_nat_zones.sh create mode 100755 tools/testing/selftests/netfilter/nft_zones_many.sh -- 2.32.0
