target/linux/generic/backport-5.10/612-v5.15-netfilter-conntrack-sanitize-table-size-default-sett.patch

   1 From d532bcd0b2699d84d71a0c71d37157ac6eb3be25 Mon Sep 17 00:00:00 2001
   2 Message-Id: <d532bcd0b2699d84d71a0c71d37157ac6eb3be25.1645246598.git.plr.vincent@gmail.com>
   3 From: Florian Westphal <fw@strlen.de>
   4 Date: Thu, 26 Aug 2021 15:54:19 +0200
   5 Subject: [PATCH] netfilter: conntrack: sanitize table size default settings
   6
   7 conntrack has two distinct table size settings:
   8 nf_conntrack_max and nf_conntrack_buckets.
   9
  10 The former limits how many conntrack objects are allowed to exist
  11 in each namespace.
  12
  13 The second sets the size of the hashtable.
  14
  15 As all entries are inserted twice (once for original direction, once for
  16 reply), there should be at least twice as many buckets in the table than
  17 the maximum number of conntrack objects that can exist at the same time.
  18
  19 Change the default multiplier to 1 and increase the chosen bucket sizes.
  20 This results in the same nf_conntrack_max settings as before but reduces
  21 the average bucket list length.
  22
  23 Signed-off-by: Florian Westphal <fw@strlen.de>
  24 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  25 ---
  26  .../networking/nf_conntrack-sysctl.rst        | 13 ++++----
  27  net/netfilter/nf_conntrack_core.c             | 30 +++++++++----------
  28  2 files changed, 22 insertions(+), 21 deletions(-)
  29
  30 --- a/Documentation/networking/nf_conntrack-sysctl.rst
  31 +++ b/Documentation/networking/nf_conntrack-sysctl.rst
  32 @@ -17,9 +17,8 @@ nf_conntrack_acct - BOOLEAN
  33  nf_conntrack_buckets - INTEGER
  34         Size of hash table. If not specified as parameter during module
  35         loading, the default size is calculated by dividing total memory
  36 -       by 16384 to determine the number of buckets but the hash table will
  37 -       never have fewer than 32 and limited to 16384 buckets. For systems
  38 -       with more than 4GB of memory it will be 65536 buckets.
  39 +       by 16384 to determine the number of buckets. The hash table will
  40 +       never have fewer than 1024 and never more than 262144 buckets.
  41         This sysctl is only writeable in the initial net namespace.
  42
  43  nf_conntrack_checksum - BOOLEAN
  44 @@ -100,8 +99,12 @@ nf_conntrack_log_invalid - INTEGER
  45         Log invalid packets of a type specified by value.
  46
  47  nf_conntrack_max - INTEGER
  48 -       Size of connection tracking table.  Default value is
  49 -       nf_conntrack_buckets value * 4.
  50 +        Maximum number of allowed connection tracking entries. This value is set
  51 +        to nf_conntrack_buckets by default.
  52 +        Note that connection tracking entries are added to the table twice -- once
  53 +        for the original direction and once for the reply direction (i.e., with
  54 +        the reversed address). This means that with default settings a maxed-out
  55 +        table will have a average hash chain length of 2, not 1.
  56
  57  nf_conntrack_tcp_be_liberal - BOOLEAN
  58         - 0 - disabled (default)
  59 --- a/net/netfilter/nf_conntrack_core.c
  60 +++ b/net/netfilter/nf_conntrack_core.c
  61 @@ -2575,26 +2575,24 @@ int nf_conntrack_init_start(void)
  62                 spin_lock_init(&nf_conntrack_locks[i]);
  63
  64         if (!nf_conntrack_htable_size) {
  65 -               /* Idea from tcp.c: use 1/16384 of memory.
  66 -                * On i386: 32MB machine has 512 buckets.
  67 -                * >= 1GB machines have 16384 buckets.
  68 -                * >= 4GB machines have 65536 buckets.
  69 -                */
  70                 nf_conntrack_htable_size
  71                         = (((nr_pages << PAGE_SHIFT) / 16384)
  72                            / sizeof(struct hlist_head));
  73 -               if (nr_pages > (4 * (1024 * 1024 * 1024 / PAGE_SIZE)))
  74 -                       nf_conntrack_htable_size = 65536;
  75 +               if (BITS_PER_LONG >= 64 &&
  76 +                   nr_pages > (4 * (1024 * 1024 * 1024 / PAGE_SIZE)))
  77 +                       nf_conntrack_htable_size = 262144;
  78                 else if (nr_pages > (1024 * 1024 * 1024 / PAGE_SIZE))
  79 -                       nf_conntrack_htable_size = 16384;
  80 -               if (nf_conntrack_htable_size < 32)
  81 -                       nf_conntrack_htable_size = 32;
  82 +                       nf_conntrack_htable_size = 65536;
  83
  84 -               /* Use a max. factor of four by default to get the same max as
  85 -                * with the old struct list_heads. When a table size is given
  86 -                * we use the old value of 8 to avoid reducing the max.
  87 -                * entries. */
  88 -               max_factor = 4;
  89 +               if (nf_conntrack_htable_size < 1024)
  90 +                       nf_conntrack_htable_size = 1024;
  91 +               /* Use a max. factor of one by default to keep the average
  92 +                * hash chain length at 2 entries.  Each entry has to be added
  93 +                * twice (once for original direction, once for reply).
  94 +                * When a table size is given we use the old value of 8 to
  95 +                * avoid implicit reduction of the max entries setting.
  96 +                */
  97 +               max_factor = 1;
  98         }
  99
 100         nf_conntrack_hash = nf_ct_alloc_hashtable(&nf_conntrack_htable_size, 1);