• Eric Dumazet's avatar
    netfilter: conntrack: adopt safer max chain length · c77737b7
    Eric Dumazet authored
    Customers using GKE 1.25 and 1.26 are facing conntrack issues
    root caused to commit c9c3b681 ("netfilter: conntrack: make
    max chain length random").
    
    Even if we assume Uniform Hashing, a bucket often reachs 8 chained
    items while the load factor of the hash table is smaller than 0.5
    
    With a limit of 16, we reach load factors of 3.
    With a limit of 32, we reach load factors of 11.
    With a limit of 40, we reach load factors of 15.
    With a limit of 50, we reach load factors of 24.
    
    This patch changes MIN_CHAINLEN to 50, to minimize risks.
    
    Ideally, we could in the future add a cushion based on expected
    load factor (2 * nf_conntrack_max / nf_conntrack_buckets),
    because some setups might expect unusual values.
    
    Fixes: c9c3b681 ("netfilter: conntrack: make max chain length random")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    c77737b7
nf_conntrack_core.c 74.1 KB