[PATCH net] netfilter: conntrack:

[PATCH net] netfilter: conntrack:

[Eric Dumazet]

Customers using GKE 1.25 and 1.26 are facing conntrack issues
root caused to commit c9c3b6811f74 ("netfilter: conntrack: make
max chain length random").

Even if we assume Uniform Hashing, a bucket often reachs 8 chained
items while the load factor of the hash table is smaller than 0.5

With a limit of 16, we reach load factors of 3.
With a limit of 32, we reach load factors of 11.
With a limit of 40, we reach load factors of 15.
With a limit of 50, we reach load factors of 24.

This patch changes MIN_CHAINLEN to 50, to minimize risks.

Ideally, we could in the future add a cushion based on expected
load factor (2 * nf_conntrack_max / nf_conntrack_buckets),
because some setups might expect unusual values.

Fixes: c9c3b6811f74 ("netfilter: conntrack: make max chain length random")
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/netfilter/nf_conntrack_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 7250082e7de56c77298b0d3b62c4f0dff95b77cc..c6a6a6099b4e2200951367ccd90c12c0ac800a6a 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -96,8 +96,8 @@ static DEFINE_MUTEX(nf_conntrack_mutex);
 #define GC_SCAN_MAX_DURATION	msecs_to_jiffies(10)
 #define GC_SCAN_EXPIRED_MAX	(64000u / HZ)
 
-#define MIN_CHAINLEN	8u
-#define MAX_CHAINLEN	(32u - MIN_CHAINLEN)
+#define MIN_CHAINLEN	50u
+#define MAX_CHAINLEN	(80u - MIN_CHAINLEN)
 
 static struct conntrack_gc_work conntrack_gc_work;
 
-- 
2.40.0.rc0.216.gc4246ad0f0-goog

Re: [PATCH net] netfilter: conntrack:

[Eric Dumazet]

On Tue, Mar 7, 2023 at 6:22 AM Eric Dumazet <edumazet@google.com> wrote:
>
> Customers using GKE 1.25 and 1.26 are facing conntrack issues
> root caused to commit c9c3b6811f74 ("netfilter: conntrack: make
> max chain length random").
>
> Even if we assume Uniform Hashing, a bucket often reachs 8 chained
> items while the load factor of the hash table is smaller than 0.5
>

Sorry for the messed patch title.

This should have been:

netfilter: conntrack: adopt safer max chain length

Florian, Pablo, let me know if you want me to send a v2, thanks !

Re: [PATCH net] netfilter: conntrack:

[Pablo Neira Ayuso]

On Tue, Mar 07, 2023 at 06:27:37AM +0100, Eric Dumazet wrote:
> On Tue, Mar 7, 2023 at 6:22 AM Eric Dumazet <edumazet@google.com> wrote:
> >
> > Customers using GKE 1.25 and 1.26 are facing conntrack issues
> > root caused to commit c9c3b6811f74 ("netfilter: conntrack: make
> > max chain length random").
> >
> > Even if we assume Uniform Hashing, a bucket often reachs 8 chained
> > items while the load factor of the hash table is smaller than 0.5
> >
> 
> Sorry for the messed patch title.
> 
> This should have been:
> 
> netfilter: conntrack: adopt safer max chain length
> 
> Florian, Pablo, let me know if you want me to send a v2, thanks !

Applied, thanks