Uploaded image for project: 'Fast Datapath Product'
  1. Fast Datapath Product
  2. FDP-122

Userspace conntrack uses default zone limit as a global limit and also admits connections into "default limit zone"

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Major Major
    • FDP-25.C
    • None
    • openvswitch3.2
    • None
    • 5
    • False
    • Hide

      None

      Show
      None
    • False
    • openvswitch3.5-3.5.0-17.el9fdp
    • rhel-9
    • None
    • rhel-net-ovs-dpdk
    • ssg_networking
    • OVS/DPDK - FDP-25.C
    • 1
    • Important

      Noticed while reading the code that userspace conntrack implementation does this:

      static struct conn *                                     
      conn_not_found(...)
      {
          if (commit) {
              struct conn_key_node *fwd_key_node, *rev_key_node;
              struct zone_limit *zl = zone_limit_lookup_or_default(ct,
                                                                   ctx->key.zone);
              if (zl && atomic_count_get(&zl->czl.count) >= zl->czl.limit) {
                  return nc;
              }
              ...
              if (zl) {
                  nc->admit_zone = zl->czl.zone;
                  nc->zone_limit_seq = zl->czl.zone_limit_seq;
                  atomic_count_inc(&zl->czl.count);
              } else {
                  nc->admit_zone = INVALID_ZONE;
              }
      }
      

      If zone_limit_lookup_or_default returns a default zone, the new connection will be counted and admitted into that default zone, not in the zone it should be. And the default zone limit will be applied to all connections for which there is no zone configuration in hash map.

      Instead each connection should be counted into the zone they are committed to and the default limit should be applied to the number of connection in that specific zone.

              pvalerio@redhat.com Paolo Valerio
              imaximet@redhat.com Ilya Maximets
              Hekai Wang Hekai Wang
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: