Bug 202065
| Summary: | connlimit is broken in whole 4.19.x series and 4.20.0 | ||
|---|---|---|---|
| Product: | Networking | Reporter: | Reindl Harald (harry) |
| Component: | Netfilter/Iptables | Assignee: | networking_netfilter-iptables (networking_netfilter-iptables) |
| Status: | NEW --- | ||
| Severity: | high | CC: | balazs, con.stan.to.ver.ride+kernel.bugzilla, greg, kernel.org, pablo, steffen.weber |
| Priority: | P1 | ||
| Hardware: | x86-64 | ||
| OS: | Linux | ||
| Kernel Version: | 4.19.x-4.20.x | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
| Attachments: | iptables-script | ||
|
Description
Reindl Harald
2018-12-25 19:07:34 UTC
Duplicate of Bug 202013 Patches for 4.20 has been posted: https://patchwork.ozlabs.org/project/netfilter-devel/list/?series=83718 If you use the above url from Comment 2, you have to click the minus sign on the right of: Archived = No State = Action Required otherwise you won't see any patches. Or just use this url, which already done so: https://patchwork.ozlabs.org/project/netfilter-devel/list/?series=83718&archive=both&state=* Note: patches are already part of v5.0-rc1 kernel. ok the bugzilla comment system took away the "=*" from the above url, so you either have to manually add it, or just don't forget to click the minus sign on the right of "State = Action Required" hopefully there is soon a 4.19 update, given that the kernel don#t show anything when you are running KDE it was impossible to guess where the random freezes are coming from and on firewall devices you need to stick with a no longer supported 4.18.20 for way too long which is a really bad kernel because it was a mistake to backport the spectre regressions and then switch to EOL while there was also the filesystem corruption problem known :-( changelog of 4.20.1 don't look like this is fixed and my hope for 4.19.14 which isexpected some is hence not very high - terrible https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.1 WTF - still not fixed in any stable kernel? https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.16 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.3 Also following this. This is impacting my ability to run 4.19.x or newer kernels with connection rate limiting on my webservers. Absolutely a P1 bug for me. well, Fedora 4.19.16 build done, first it look despite to the changelog from kernel.org not mention it that it's no longer a problem in my nested VM setup which means not more than "no stacktrace after one connection and calling iptable.sh) on the host machine removed the comment from this two lines # $IPTABLES -t filter -A RATELIMIT -p tcp -m connlimit --connlimit-above 50 --connlimit-mask 32 -j DROP # $IPTABLES -t filter -A RATELIMIT -p tcp -m connlimit --connlimit-above 150 --connlimit-mask 24 -j DROP it took a few hours and the machine freezed again as it did from the first moment i tried a 4.19.2 kernel months ago https://patchwork.ozlabs.org/project/netfilter-devel/list/?state=* there is a patchset with state "Accepted" from 2018-12-29 are you frankly kidding that combined with the filesystem corruption bug which is in the meantime fixed qualifies 4.19 as LTS kernel? this by far the worst kernel over the last 5 years where a RAID10 scrub again and again randomly freezed machines terrible when you have to stick on 4.18.20 in such setups which also got the in the meantime replaced spectre fixes backported before 4.18 went EOL which was also a bad idea [root@firewall:~]$ firewall_status | grep conn 1 298K 15M RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/24 > 15 1 0 0 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 104 5376 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 4508 229K LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 226 11780 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 0 0 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 5 300 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 11 660 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 1706 89668 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 55164 4292K LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 0 0 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 0 0 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 0 0 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 0 0 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 0 0 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 6 360 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 25 1500 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 0 0 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 11 660 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 0 0 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 1 0 0 LD_C_HST all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 50 4 369 22140 LD_C_32 all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/32 > 120 5 196K 9465K LD_C_24 all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/24 > 250 6 3807 194K LD_C_16 all -- * * 0.0.0.0/0 0.0.0.0/0 #conn src/16 > 500 1 910 58240 LD_C_MAIL tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 25,465,587,110,143,993,995 #conn src/32 > 75 1 2603 133K LD_C_MX tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 #conn src/32 > 10 Looks to be in 4.20.5 and 4.19.18 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/log/?h=v4.20.5&qt=grep&q=conncount https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/log/?h=v4.19.18&qt=grep&q=conncount Will begin a download, test and run now. No issues so far with 4.20.5 after 8 days. Issue resolved for me. |