diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2009-01-15 23:19:35 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2009-01-15 23:19:35 +0100 |
| commit | b28224b0326636ff5832b38817b7720f48070ee7 (patch) | |
| tree | e1b6856b8c852d9c672af2559e17ecab78355246 /src | |
| parent | 4556b3fb39dd80e958ff70f3496d06ec04f3839d (diff) | |
run: limit the number of iterations over the event handling
Currently, the event handling can starve other event file
descriptors. This patch limits the number of event handling
iterations. The parameter is tunable via configuration file.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/read_config_lex.l | 1 | ||||
| -rw-r--r-- | src/read_config_yy.y | 11 | ||||
| -rw-r--r-- | src/run.c | 11 |
3 files changed, 19 insertions, 4 deletions
diff --git a/src/read_config_lex.l b/src/read_config_lex.l index 67c95d3..f8b0ba1 100644 --- a/src/read_config_lex.l +++ b/src/read_config_lex.l @@ -117,6 +117,7 @@ notrack [N|n][O|o][T|t][R|r][A|a][C|c][K|k] "From" { return T_FROM; } "Userspace" { return T_USERSPACE; } "Kernelspace" { return T_KERNELSPACE; } +"EventIterationLimit" { return T_EVENT_ITER_LIMIT; } {is_on} { return T_ON; } {is_off} { return T_OFF; } diff --git a/src/read_config_yy.y b/src/read_config_yy.y index 69a7eff..274bfc3 100644 --- a/src/read_config_yy.y +++ b/src/read_config_yy.y @@ -59,7 +59,7 @@ static void __kernel_filter_add_state(int value); %token T_SYSLOG T_WRITE_THROUGH T_STAT_BUFFER_SIZE T_DESTROY_TIMEOUT %token T_MCAST_RCVBUFF T_MCAST_SNDBUFF T_NOTRACK %token T_FILTER T_ADDRESS T_PROTOCOL T_STATE T_ACCEPT T_IGNORE -%token T_FROM T_USERSPACE T_KERNELSPACE +%token T_FROM T_USERSPACE T_KERNELSPACE T_EVENT_ITER_LIMIT %token <string> T_IP T_PATH_VAL %token <val> T_NUMBER @@ -681,6 +681,7 @@ general_line: hashsize | netlink_buffer_size | netlink_buffer_size_max_grown | family + | event_iterations_limit | filter ; @@ -702,6 +703,11 @@ family : T_FAMILY T_STRING conf.family = AF_INET; }; +event_iterations_limit : T_EVENT_ITER_LIMIT T_NUMBER +{ + CONFIG(event_iterations_limit) = $2; +}; + filter : T_FILTER '{' filter_list '}' { CONFIG(filter_from_kernelspace) = 0; @@ -1096,5 +1102,8 @@ init_config(char *filename) if (conf.flags & CTD_SYNC_FTFW && CONFIG(del_timeout) == 0) CONFIG(del_timeout) = 240; + if (CONFIG(event_iterations_limit) == 0) + CONFIG(event_iterations_limit) = 100; + return 0; } @@ -219,7 +219,7 @@ static int event_handler(enum nf_conntrack_msg_type type, /* skip user-space filtering if already do it in the kernel */ if (ct_filter_conntrack(ct, !CONFIG(filter_from_kernelspace))) { STATE(stats).nl_events_filtered++; - return NFCT_CB_STOP; + goto out; } switch(type) { @@ -238,7 +238,12 @@ static int event_handler(enum nf_conntrack_msg_type type, break; } - return NFCT_CB_CONTINUE; +out: + if (STATE(event_iterations_limit)-- <= 0) { + STATE(event_iterations_limit) = CONFIG(event_iterations_limit); + return NFCT_CB_STOP; + } else + return NFCT_CB_CONTINUE; } static int dump_handler(enum nf_conntrack_msg_type type, @@ -397,7 +402,7 @@ static void __run(struct timeval *next_alarm) /* conntrack event has happened */ if (FD_ISSET(nfct_fd(STATE(event)), &readfds)) { - while ((ret = nfct_catch(STATE(event))) != -1); + ret = nfct_catch(STATE(event)); if (ret == -1) { switch(errno) { case ENOBUFS: |