netdev - 6.1: possible bug with netfilter conntrack?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y8CR3CvOIAa6QIZ4@shell.armlinux.org.uk>
Date:   Thu, 12 Jan 2023 23:03:56 +0000
From:   "Russell King (Oracle)" <linux@...linux.org.uk>
To:     netdev@...r.kernel.org, netfilter-devel@...r.kernel.org,
        coreteam@...filter.org
Subject: 6.1: possible bug with netfilter conntrack?

Hi,

I've noticed that my network at home is rather struggling, and having
done some investigation, I find that the router VM is dropping packets
due to lots of:

nf_conntrack: nf_conntrack: table full, dropping packet

I find that there are about 2380 established and assured connections
with a destination of my incoming mail server with destination port 25,
and 2 packets. In the reverse direction, apparently only one packet was
sent according to conntrack. E.g.:

tcp      6 340593 ESTABLISHED src=180.173.2.183 dst=78.32.30.218
sport=49694 dport=25 packets=2 bytes=92 src=78.32.30.218
dst=180.173.2.183 sport=25 dport=49694 packets=1 bytes=44 [ASSURED]
use=1

However, if I look at the incoming mail server, its kernel believes
there are no incoming port 25 connetions, which matches exim.

I hadn't noticed any issues prior to upgrading from 5.16 to 6.1 on the
router VM, and the firewall rules have been the same for much of
2021/2022.

Is this is known issue? Something changed between 5.16 and 6.1 in the
way conntrack works?

I'm going to be manually clearing the conntrack table so stuff works
again without lots of packet loss on my home network...

Thanks.

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 40Mbps down 10Mbps up. Decent connectivity at last!