netfilter: refuse insertion if chain has grown too large

Also add a stat counter for this that gets exported both via old /proc
interface and ctnetlink.

Assuming the old default size of 16536 buckets and max hash occupancy of
64k, this results in 128k insertions (origin+reply), so ~8 entries per
chain on average.

The revised settings in this series will result in about two entries per
bucket on average.

This allows a hard-limit ceiling of 64.

This is not tunable at the moment, but its possible to either increase
nf_conntrack_buckets or decrease nf_conntrack_max to reduce average
lengths.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

This commit is contained in:

Florian Westphal

2021-08-26 15:54:22 +02:00

committed by

Pablo Neira Ayuso

parent dd6d2910c5

commit d7e7747ac5

5 changed files with 42 additions and 10 deletions

									
										include/linux/netfilter/nf_conntrack_common.h
									
		+1
		
												View File
												
				@@ -18,6 +18,7 @@ struct ip_conntrack_stat {

					unsigned int expect_create;

					unsigned int expect_delete;

					unsigned int search_restart;

					unsigned int chaintoolong;

				};

				#define NFCT_INFOMASK	7UL