* Re: conntrack events over netlink flood
[not found] <069917f11e06f3cf2e1ce9715f435b61@visp.net.lb>
@ 2011-09-30 12:59 ` Florian Westphal
2011-09-30 13:46 ` Denys Fedoryshchenko
0 siblings, 1 reply; 2+ messages in thread
From: Florian Westphal @ 2011-09-30 12:59 UTC (permalink / raw)
To: Denys Fedoryshchenko; +Cc: netdev, netfilter-devel
Denys Fedoryshchenko <denys@visp.net.lb> wrote:
[ cc: netfilter-devel ]
> After enabling events and running conntrack -E i notice flood in output
> of server that have PPPoE and PPTP connections. Here is the output:
>
> OfficeNAT ~ # conntrack -E
> [UPDATE] gre 47 17999 src=192.168.0.140 dst=192.168.0.1
> srckey=0x0 dstkey=0x3 src=192.168.0.1 dst=192.168.0.140 srckey=0x3
> dstkey=0x0 [ASSURED]
> [UPDATE] gre 47 17999 src=192.168.0.140 dst=192.168.0.1
> srckey=0x0 dstkey=0x3 src=192.168.0.1 dst=192.168.0.140 srckey=0x3
> dstkey=0x0 [ASSURED]
[..]
> Is it considered as a bug? I think it should not send on each packet
> conntrack event.
Bug. Update events should only be generated when something in the
conntrack has changed (e.g. the connmark).
Could you please try this patch (untested)?
Subject: [PATCH] netfilter: conntrack_gre: only create ct assured event once
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -241,8 +241,8 @@ static int gre_packet(struct nf_conn *ct,
nf_ct_refresh_acct(ct, ctinfo, skb,
ct->proto.gre.stream_timeout);
/* Also, more likely to be important, and not a probe. */
- set_bit(IPS_ASSURED_BIT, &ct->status);
- nf_conntrack_event_cache(IPCT_ASSURED, ct);
+ if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
+ nf_conntrack_event_cache(IPCT_ASSURED, ct);
} else
nf_ct_refresh_acct(ct, ctinfo, skb,
ct->proto.gre.timeout);
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: conntrack events over netlink flood
2011-09-30 12:59 ` conntrack events over netlink flood Florian Westphal
@ 2011-09-30 13:46 ` Denys Fedoryshchenko
0 siblings, 0 replies; 2+ messages in thread
From: Denys Fedoryshchenko @ 2011-09-30 13:46 UTC (permalink / raw)
To: Florian Westphal; +Cc: netdev, netfilter-devel
On Fri, 30 Sep 2011 14:59:56 +0200, Florian Westphal wrote:
> Denys Fedoryshchenko <denys@visp.net.lb> wrote:
>
> [ cc: netfilter-devel ]
>
>> After enabling events and running conntrack -E i notice flood in
>> output
>> of server that have PPPoE and PPTP connections. Here is the output:
>>
>> OfficeNAT ~ # conntrack -E
>> [UPDATE] gre 47 17999 src=192.168.0.140 dst=192.168.0.1
>> srckey=0x0 dstkey=0x3 src=192.168.0.1 dst=192.168.0.140 srckey=0x3
>> dstkey=0x0 [ASSURED]
>> [UPDATE] gre 47 17999 src=192.168.0.140 dst=192.168.0.1
>> srckey=0x0 dstkey=0x3 src=192.168.0.1 dst=192.168.0.140 srckey=0x3
>> dstkey=0x0 [ASSURED]
>
> [..]
>
>> Is it considered as a bug? I think it should not send on each
>> packet
>> conntrack event.
>
> Bug. Update events should only be generated when something in the
> conntrack has changed (e.g. the connmark).
>
> Could you please try this patch (untested)?
>
> Subject: [PATCH] netfilter: conntrack_gre: only create ct assured
> event once
>
> diff --git a/net/netfilter/nf_conntrack_proto_gre.c
> b/net/netfilter/nf_conntrack_proto_gre.c
> --- a/net/netfilter/nf_conntrack_proto_gre.c
> +++ b/net/netfilter/nf_conntrack_proto_gre.c
> @@ -241,8 +241,8 @@ static int gre_packet(struct nf_conn *ct,
> nf_ct_refresh_acct(ct, ctinfo, skb,
> ct->proto.gre.stream_timeout);
> /* Also, more likely to be important, and not a probe. */
> - set_bit(IPS_ASSURED_BIT, &ct->status);
> - nf_conntrack_event_cache(IPCT_ASSURED, ct);
> + if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
> + nf_conntrack_event_cache(IPCT_ASSURED, ct);
> } else
> nf_ct_refresh_acct(ct, ctinfo, skb,
> ct->proto.gre.timeout);
Fine now, patch fixed this bug.
Tested-by: Denys Fedoryshchenko <denys@visp.net.lb>
---
System administrator
Denys Fedoryshchenko
Virtual ISP S.A.L.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-09-30 13:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <069917f11e06f3cf2e1ce9715f435b61@visp.net.lb>
2011-09-30 12:59 ` conntrack events over netlink flood Florian Westphal
2011-09-30 13:46 ` Denys Fedoryshchenko
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).