Control: forwarded -1 https://lore.kernel.org/regressions/[email protected] Control: tags -1 + upstream
Hi In Debian, in https://bugs.debian.org/1130336, Alejandro reported that after updates including 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add was skipped"), when the following rule is set iptables -A INPUT -p tcp -m connlimit --connlimit-above 111 -j REJECT --reject-with tcp-reset connections get stuck accordingly, it can be easily reproduced by: # iptables -A INPUT -p tcp -m connlimit --connlimit-above 111 -j REJECT --reject-with tcp-reset # nft list ruleset # Warning: table ip filter is managed by iptables-nft, do not touch! table ip filter { chain INPUT { type filter hook input priority filter; policy accept; ip protocol tcp xt match "connlimit" counter packets 0 bytes 0 reject with tcp reset } } # wget -O /dev/null https://git.kernel.org/torvalds/t/linux-7.0-rc3.tar.gz --2026-03-14 14:53:51-- https://git.kernel.org/torvalds/t/linux-7.0-rc3.tar.gz Resolving git.kernel.org (git.kernel.org)... 172.105.64.184, 2a01:7e01:e001:937:0:1991:8:25 Connecting to git.kernel.org (git.kernel.org)|172.105.64.184|:443... connected. HTTP request sent, awaiting response... 301 Moved Permanently Location: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/snapshot/linux-7.0-rc3.tar.gz [following] --2026-03-14 14:53:51-- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/snapshot/linux-7.0-rc3.tar.gz Reusing existing connection to git.kernel.org:443. HTTP request sent, awaiting response... 200 OK Length: unspecified [application/x-gzip] Saving to: ‘/dev/null’ /dev/null [ <=> ] 248.03M 51.9MB/s in 5.0s 2026-03-14 14:53:56 (49.3 MB/s) - ‘/dev/null’ saved [260080129] # wget -O /dev/null https://git.kernel.org/torvalds/t/linux-7.0-rc3.tar.gz --2026-03-14 14:53:58-- https://git.kernel.org/torvalds/t/linux-7.0-rc3.tar.gz Resolving git.kernel.org (git.kernel.org)... 172.105.64.184, 2a01:7e01:e001:937:0:1991:8:25 Connecting to git.kernel.org (git.kernel.org)|172.105.64.184|:443... failed: Connection timed out. Connecting to git.kernel.org (git.kernel.org)|2a01:7e01:e001:937:0:1991:8:25|:443... failed: Network is unreachable. Before the 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add was skipped") commit this worked. #regzbot introduced: 69894e5b4c5e28cda5f32af33d4a92b7a4b93b0e #regzbot link: https://bugs.debian.org/1130336 Regards, Salvatore
