High memory consumption for UDP associations on Linux (OpenWRT)

[f4nff]

Test equipment: r4s
Test system: openwrt

https://github.com/shadowsocks/shadowsocks-rust/suites/4952439929/artifacts/143776137
download:https://github.com/shadowsocks/shadowsocks-rust/actions/runs/1703977841

/etc/sysctl.d/11-nf-conntrack.conf

# Do not edit, changes to this file will be lost on upgrades
# /etc/sysctl.conf can be used to customize sysctl settings

net.netfilter.nf_conntrack_acct=1
net.netfilter.nf_conntrack_checksum=0
net.netfilter.nf_conntrack_max=1020000
net.netfilter.nf_conntrack_tcp_timeout_established=7440
net.netfilter.nf_conntrack_udp_timeout=60
net.netfilter.nf_conntrack_udp_timeout_stream=180

/root/socks/sslocal --protocol tun -s "[::1]:8388" -m "aes-256-gcm" -k "hello-kitty" --outbound-bind-interface lo --tun-interface-name tun1 -U --udp-timeout 60 --udp-max-associations 65535

dns.exe -sr gddx.txt -at google.com -sl 6

dns-test.zip

Start dns to test for 30 seconds, then shut down.

Then wait for 5 minutes, after the number of connections drops,

Then it can be seen that sslocal occupies more than 400M of memory and will not continue to release,

[zonyitoo]

I ran the test tools nearly 15 minutes and didn't see memory was occupied more than 7MiB. 400MiB is just impossible.

[f4nff]

The reason why you did not exceed 7M is because you did not turn on UDP forwarding.

-U --udp-timeout 60 --udp-max-associations 65535

You turn on udp forwarding, use the udp test tool I gave, and try it.

[zonyitoo]

Of course I do enable the UDP relay. Just read the code I just provided and I have only sent UDP DNS queries.

[f4nff]

That is, the mode in which your test tool sends data is too simple and not easy to trigger. I have given you the source code of my test tool. You can compile it yourself and try it.

[f4nff]

Did you not see my screenshot? Am I cheating?

[zonyitoo]

The dns.exe is not for OpenWRT, right? It is a NT32 program. The dns.go is the source code right?

[f4nff]

dns.go is the source code！

[f4nff]

openwrt is used as a router, dns.exe is running under my windows 11 host,

[zonyitoo]

My test code is exactly the same as yours. You didn't bind the outbound interface, which means that you will have to add route entries for your test name servers to make this test working.

I didn't see any difference between dns.go and dns_pressure.rs.

So instead of modifying your dns.go, I will run dns_pressure on my R4S with your provided sysctl configuration and see what would happened.

[zonyitoo]

BTW, your dns.go will only open UDP sockets for sending queries, why there are so many TCP connections in your screenshots?

[f4nff]

The tcp connection is my other web browsing, I forward all the lan port connections.
When you request dns, request 208.67.222.222:443, not 208.67.222.222:53

I can't understand the code, but I have provided you with a way to trigger,

[zonyitoo]

Since we are talking about memory leak, it should be happening no matter what destination or what port you are using but just creating UDP associations rapidly in a short time.

Your dns.go is nothing just open a UDP socket to 208.67.222.222:443 and then send a DNS query message in plain (without any encryption). So it is just completely the same as dns_pressure.rs.

You cannot test it without a clean environment, may be the problem that you are facing is just completely unrelated to UDP, which is just wasting our time.

I am now going to run dns_pressure with nameserver 208.67.222.222:443. The sslocal is running just like yours.

[f4nff]

config interface 'tun1'
	option proto 'static'
	option ipaddr '10.255.0.1'
	option netmask '255.255.255.0'
	option device 'tun1'

config route
	option interface 'tun1'
	option target '0.0.0.0'
	option netmask '0.0.0.0'
	option gateway '10.255.0.1'
	option table '10'

config rule
	option in 'lan'
	option lookup '10'
	option priority '0'

/etc/config/network

/root/socks/sslocal --protocol tun -s "[::1]:8388" -m "aes-256-gcm" -k "hello-kitty" --outbound-bind-interface lo --tun-interface-name tun1 -U --udp-timeout 60 --udp-max-associations 65535

lan----windows

dns.exe -sr gddx.txt -at google.com -sl 6

[f4nff]

I have told you the test environment, and even the source code of the trigger. If you don't do it, you still question me.

If you follow your own logic, you will not find the problem.

Are the screenshots I gave you fake?

I can trigger, but you can't trigger, is this my problem or your problem?

[f4nff]

I have reported several bugs to you, which one was not confirmed in the end?