diff mbox series

[ovs-dev,v4,3/3] conntrack: limit port clash resolution attempts

Message ID 1631156814-12127-3-git-send-email-wenxu@ucloud.cn
State Superseded
Headers show
Series [ovs-dev,v4,1/3] conntrack: restore the origin sport for each round with new address | expand

Checks

Context Check Description
ovsrobot/apply-robot success apply and check: success
ovsrobot/github-robot-_Build_and_Test success github build: passed

Commit Message

wenxu Sept. 9, 2021, 3:06 a.m. UTC 
From: wenxu <wenxu@ucloud.cn>

In case almost or all available ports are taken, clash resolution can
take a very long time, resulting in pmd hang in conntrack.

This can happen when many to-be-natted hosts connect to same
destination:port (e.g. a proxy) and all connections pass the same SNAT.

Pick a random offset in the acceptable range, then try ever smaller
number of adjacent port numbers, until either the limit is reached or a
useable port was found.  This results in at most 248 attempts
(128 + 64 + 32 + 16 + 8, i.e. 4 restarts with new search offset)
instead of 64000+.

Signed-off-by: wenxu <wenxu@ucloud.cn>
---
 lib/conntrack.c | 47 +++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 43 insertions(+), 4 deletions(-)
diff mbox series

Patch

diff --git a/lib/conntrack.c b/lib/conntrack.c
index f95532c..485b31c 100644
--- a/lib/conntrack.c
+++ b/lib/conntrack.c
@@ -2421,7 +2421,11 @@  nat_get_unique_tuple(struct conntrack *ct, const struct conn *conn,
     uint32_t hash = nat_range_hash(conn, ct->hash_basis);
     bool pat_proto = conn->key.nw_proto == IPPROTO_TCP ||
                      conn->key.nw_proto == IPPROTO_UDP;
+    unsigned int attempts, max_attempts, min_attempts;
     uint16_t min_dport, max_dport, curr_dport;
+    uint16_t range_src, range_dst, range_max;
+    uint32_t range_addr;
+    unsigned int i;
 
     min_addr = conn->nat_info->min_addr;
     max_addr = conn->nat_info->max_addr;
@@ -2438,6 +2442,19 @@  nat_get_unique_tuple(struct conntrack *ct, const struct conn *conn,
     set_dport_range(conn->nat_info, &conn->key, hash, &curr_dport,
                     &min_dport, &max_dport);
 
+    range_src = max_sport - min_sport + 1;
+    range_dst = max_dport - min_dport + 1;
+    range_max = range_src > range_dst ? range_src : range_dst;
+    range_addr = ntohl(max_addr.ipv4) - ntohl(min_addr.ipv4) + 1;
+    max_attempts = 128 / range_addr;
+    if (max_attempts < 1) {
+        max_attempts = 1;
+    }
+    min_attempts = 16 / range_addr;
+    if (min_attempts < 2) {
+        min_attempts = 2;
+    }
+
 another_round:
     store_addr_to_key(&curr_addr, &nat_conn->rev_key,
                       conn->nat_info->nat_action);
@@ -2453,17 +2470,39 @@  another_round:
 
     curr_sport = orig_sport;
 
+    attempts = range_max;
+    if (attempts > max_attempts) {
+        attempts = max_attempts;
+    }
+
+another_port_round:
+    i = 0;
     FOR_EACH_PORT_IN_RANGE(curr_dport, min_dport, max_dport) {
         nat_conn->rev_key.src.port = htons(curr_dport);
         FOR_EACH_PORT_IN_RANGE(curr_sport, min_sport, max_sport) {
-            nat_conn->rev_key.dst.port = htons(curr_sport);
-            if (!conn_lookup(ct, &nat_conn->rev_key,
-                             time_msec(), NULL, NULL)) {
-                return true;
+            if (i++ < attempts) {
+                nat_conn->rev_key.dst.port = htons(curr_sport);
+                if (!conn_lookup(ct, &nat_conn->rev_key,
+                                 time_msec(), NULL, NULL)) {
+                    return true;
+                }
+            } else {
+                goto next_attempts;
             }
         }
     }
 
+next_attempts:
+    if (attempts >= range_max || attempts < min_attempts) {
+        goto next_addr;
+    }
+
+    attempts /= 2;
+    curr_dport = min_dport + (random_uint32() % range_dst);
+    curr_sport = min_sport + (random_uint32() % range_src);
+
+    goto another_port_round;
+
     /* Check if next IP is in range and respin. Otherwise, notify
      * exhaustion to the caller. */
 next_addr: