Florian Westphal d7e7747ac5 netfilter: refuse insertion if chain has grown too large
Also add a stat counter for this that gets exported both via old /proc
interface and ctnetlink.

Assuming the old default size of 16536 buckets and max hash occupancy of
64k, this results in 128k insertions (origin+reply), so ~8 entries per
chain on average.

The revised settings in this series will result in about two entries per
bucket on average.

This allows a hard-limit ceiling of 64.

This is not tunable at the moment, but its possible to either increase
nf_conntrack_buckets or decrease nf_conntrack_max to reduce average
lengths.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2021-08-30 11:52:21 +02:00
..
2021-06-02 14:01:55 -07:00
2021-03-30 16:54:50 -07:00
2021-06-30 15:51:09 -07:00
2021-06-29 11:28:21 -07:00
2021-05-26 07:03:39 +02:00
2021-06-07 14:08:30 -07:00
2021-07-27 13:05:56 +01:00
2021-07-05 14:08:24 -07:00
2021-06-30 15:51:09 -07:00
2021-08-03 11:14:03 +01:00
2021-06-30 15:51:09 -07:00
2021-06-30 15:51:09 -07:00
2021-07-09 09:43:57 -07:00
2021-06-03 15:13:56 -07:00