Julian Anastasov 4a15044a2b ipvs: add conn_max sysctl to limit connections ...

Currently, we are using atomic_t to track the number of
connections. On 64-bit setups with large memory there is
a risk this counter to overflow. Also, setups with many
containers may need to tune the limit for connections.

Add sysctl control to limit the number of connections to
1,073,741,824 (64-bit) and 16,777,216 (32-bit).
Depending on the admin's privilege, the value is
used to change a soft or hard limit allowing
unprivileged admins to change the soft limit in
range determined by privileged admins.

Link: https://sashiko.dev/#/patchset/20260523172715.94795-1-ja%40ssi.bg
Link: https://sashiko.dev/#/patchset/20260430074420.26697-7-ja%40ssi.bg
Link: https://sashiko.dev/#/patchset/20260522105546.13732-1-ja%40ssi.bg
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

2026-06-05 13:11:54 +02:00

..

ip_vs_app.c

net: Remove KMSG_COMPONENT macro

2025-11-28 19:20:27 -08:00

ip_vs_conn.c

ipvs: add conn_max sysctl to limit connections

2026-06-05 13:11:54 +02:00

ip_vs_core.c

ipvs: fix shift-out-of-bounds in ip_vs_rht_desired_size

2026-05-05 01:52:55 +02:00

ip_vs_ctl.c

ipvs: add conn_max sysctl to limit connections

2026-06-05 13:11:54 +02:00

ip_vs_dh.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ip_vs_est.c

ipvs: fix races around est_mutex and est_cpulist

2026-05-05 01:52:55 +02:00

ip_vs_fo.c

net: Remove KMSG_COMPONENT macro

2025-11-28 19:20:27 -08:00

ip_vs_ftp.c

net: Remove KMSG_COMPONENT macro

2025-11-28 19:20:27 -08:00

ip_vs_lblc.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ip_vs_lblcr.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ip_vs_lc.c

net: Remove KMSG_COMPONENT macro

2025-11-28 19:20:27 -08:00

ip_vs_mh.c

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

ip_vs_nfct.c

net: Remove KMSG_COMPONENT macro

2025-11-28 19:20:27 -08:00

ip_vs_nq.c

net: Remove KMSG_COMPONENT macro

2025-11-28 19:20:27 -08:00

ip_vs_ovf.c

net: Remove KMSG_COMPONENT macro

2025-11-28 19:20:27 -08:00

ip_vs_pe_sip.c

ipvs: switch to per-net connection table

2026-03-04 11:45:45 +01:00

ip_vs_pe.c

net: Remove KMSG_COMPONENT macro

2025-11-28 19:20:27 -08:00

ip_vs_proto_ah_esp.c

net: Remove KMSG_COMPONENT macro

2025-11-28 19:20:27 -08:00

ip_vs_proto_sctp.c

ipvs: skip ipv6 extension headers for csum checks

2026-02-17 15:04:20 +01:00

ip_vs_proto_tcp.c

ipvs: skip ipv6 extension headers for csum checks

2026-02-17 15:04:20 +01:00

ip_vs_proto_udp.c

ipvs: skip ipv6 extension headers for csum checks

2026-02-17 15:04:20 +01:00

ip_vs_proto.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ip_vs_rr.c

net: Remove KMSG_COMPONENT macro

2025-11-28 19:20:27 -08:00

ip_vs_sched.c

ipvs: clear the svc scheduler ptr early on edit

2026-06-01 13:43:52 +02:00

ip_vs_sed.c

net: Remove KMSG_COMPONENT macro

2025-11-28 19:20:27 -08:00

ip_vs_sh.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ip_vs_sync.c

ipvs: switch to per-net connection table

2026-03-04 11:45:45 +01:00

ip_vs_twos.c

net: Remove KMSG_COMPONENT macro

2025-11-28 19:20:27 -08:00

ip_vs_wlc.c

net: Remove KMSG_COMPONENT macro

2025-11-28 19:20:27 -08:00

ip_vs_wrr.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

ip_vs_xmit.c

ipvs: fix MTU check for GSO packets in tunnel mode

2026-04-20 23:45:43 +02:00

Kconfig

netfilter: add option for GCOV profiling

2026-05-24 22:55:47 +02:00

Makefile

netfilter: add option for GCOV profiling

2026-05-24 22:55:47 +02:00