netdev - Re: [PATCH net-next] netfilter: nf_conntrack: introduce conntrack limit per-zone

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 23 Oct 2019 12:31:17 +0200
From:   Florian Westphal <fw@...len.de>
To:     xiangxia.m.yue@...il.com
Cc:     pablo@...filter.org, netfilter-devel@...r.kernel.org,
        netdev@...r.kernel.org
Subject: Re: [PATCH net-next] netfilter: nf_conntrack: introduce conntrack
 limit per-zone

xiangxia.m.yue@...il.com <xiangxia.m.yue@...il.com> wrote:
> nf_conntrack_max is used to limit the maximum number of
> conntrack entries in the conntrack table for every network
> namespace. For the containers that reside in the same namespace,
> they share the same conntrack table, and the total # of conntrack
> entries for all containers are limited by nf_conntrack_max.
> In this case, if one of the container abuses the usage the
> conntrack entries, it blocks the others from committing valid
> conntrack entries into the conntrack table.
> 
> To address the issue, this patch adds conntrack counter for zones
> and max count which zone wanted, So that any zone can't consume
> all conntrack entries in the conntrack table.
>
> This feature can be used for openvswitch or iptables.

Your approach adds cost for everyone, plus a 256kbyte 'struct net'
increase.

openvswitch supports per zone limits already, using nf_conncount
infrastructure.

nftables supports it using ruleset (via 'ct count').

If you need support for iptables, consider extending xt_connlimit.c
instead -- looking at the code it might already do all that is needed
if userspace passes a 0-length mask for the ip address, i.e.

iptables -t mangle -A PREROUTING -m conntrack --ctstate NEW -m connlimit \
   --connlimit-above 1000 --connlimit-mask 0 -j REJECT