tree 37bb0881783e73de096c415561cef9324d071f20
parent d8613391b2d6407a7b69a7c5a46024fc078b5ba5
author Eric Dumazet <edumazet@google.com> 1678166574 +0000
committer COS Cherry Picker <cloud-image-release@prod.google.com> 1678240905 -0800

netfilter: conntrack: adopt safer max chain length

Customers using GKE 1.25 and 1.26 are facing conntrack issues
root caused to commit c9c3b6811f74 ("netfilter: conntrack: make
max chain length random").

Even if we assume Uniform Hashing, a bucket often reachs 8 chained
items while the load factor of the hash table is smaller than 0.5

With a limit of 16, we reach load factors of 3.
With a limit of 32, we reach load factors of 11.
With a limit of 40, we reach load factors of 15.
With a limit of 50, we reach load factors of 24.

This patch changes MIN_CHAINLEN to 50, to minimize risks.

Ideally, we could in the future add a cushion based on expected
load factor (2 * nf_conntrack_max / nf_conntrack_buckets),
because some setups might expect unusual values.

BUG=b/272085010
TEST=presubmit
RELEASE_NOTE=Fixed conntrack issue with random timeouts.

Fixes: c9c3b6811f74 ("netfilter: conntrack: make max chain length random")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

cos-patch: bug
Change-Id: Ia7013d75021aea1f2172f270c6e315000b490099
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/44609
Reviewed-by: Robert Kolchmeyer <rkolchmeyer@google.com>
Main-Branch-Verified: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>