run: limit the number of iterations over the event handling

Currently, the event handling can starve other event file
descriptors. This patch limits the number of event handling
iterations. The parameter is tunable via configuration file.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 8 insertions, 3 deletions

diff --git a/src/run.c b/src/run.c
index 7958665..caf0b38 100644
--- a/src/run.c
+++ b/src/run.c
@@ -219,7 +219,7 @@ static int event_handler(enum nf_conntrack_msg_type type,
 	/* skip user-space filtering if already do it in the kernel */
 	if (ct_filter_conntrack(ct, !CONFIG(filter_from_kernelspace))) {
 		STATE(stats).nl_events_filtered++;
-		return NFCT_CB_STOP;
+		goto out;
 	}
 
 	switch(type) {
@@ -238,7 +238,12 @@ static int event_handler(enum nf_conntrack_msg_type type,
 		break;
 	}
 
-	return NFCT_CB_CONTINUE;
+out:
+	if (STATE(event_iterations_limit)-- <= 0) {
+		STATE(event_iterations_limit) = CONFIG(event_iterations_limit);
+		return NFCT_CB_STOP;
+	} else
+		return NFCT_CB_CONTINUE;
 }
 
 static int dump_handler(enum nf_conntrack_msg_type type,
@@ -397,7 +402,7 @@ static void __run(struct timeval *next_alarm)
 
 	/* conntrack event has happened */
 	if (FD_ISSET(nfct_fd(STATE(event)), &readfds)) {
-		while ((ret = nfct_catch(STATE(event))) != -1);
+		ret = nfct_catch(STATE(event));
 		if (ret == -1) {
 			switch(errno) {
 			case ENOBUFS: