Remove conntrack lookups #67
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
I'm 👍 to deprecating support for pre-4.4 kernels, and generally getting to a place where conntrack isn't a requirement would be great. Did you end up managing to track down the few increments you saw in #50 (comment) ?
Mostly a curiosity though, it seems pretty clear that the |
|
I've not managed to verify it, but I think they are due to a buggy
conntrack set up on our side. We have a fair amount of NOTRACK for
historical / performance reasons, and I think that makes CT miss outbound
RST sometimes. This way we get into the state where the socket lookup
fails, but CT believes the tuple is valid.
After finding that the hit % is so low plus a better understanding of the
TCP stack I stopped investigating TBH :)
|
|
I found the same conntrack counters in our setup, so used a bcc+scapy script to sniff the packets that were getting picked up by conntrack: The corresponding full tcpdump: It seems at the point of the |
|
Very interesting! The From some digging, this happens in At this point, If I understand correctly there is not much to do here, besides documenting it in the code. |
|
Updated the branch with a comment based on our investigation. |
When a SYN packet is received, Linux creates a so called request socket. This is smaller than a full socket, and helps conserve resources. Request sockets (aka reqsk) always have sk_state equal to TCP_NEW_SYN_RECV, and are part of the inet hash tables. This means they are returned by a call to inet_lookup_established and friends. This is true as of v4.4, and was introduced by commit torvalds/linux@079096f Fixes #50
v4.4 changed the way TCP connection requests are handled, which means that conntrack lookups are not required anymore. Make sure we are building against at least 4.4, and remove obsolete compile time guards.
|
Ping @theojulienne |
theojulienne
approved these changes
Jul 22, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When a SYN packet is received, Linux creates a so called request socket.
This is smaller than a full socket, and helps conserve resources. Request
sockets (aka reqsk) always have sk_state equal to TCP_NEW_SYN_RECV, and
are part of the inet hash tables. This means they are returned by a call
to inet_lookup_established and friends.
This is true as of v4.4, and was introduced by commit torvalds/linux@079096f
Fixes #50