Re: limited number if iptable rules on 64bit hosts

[Olaf Hering <olh@suse.de>]

 On Wed, Feb 02, Olaf Hering wrote:

> 
> What buffer or sysctrl value has to change to allow more than 3445 rules
> like this (on a 64bit host with 64bit iptables)?
> 
> iptables -A FORWARD -j ACCEPT
> 
> setsockopt(3, SOL_IP, 0x40 /* IP_??? */,
> "filter\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 524368) =
> -1 ENOMEM (Cannot allocate memory)

it triggers the first -ENOMEM in
net/ipv4/netfilter/ip_tables.c:do_replace

sizeof(struct ipt_table_info)+SMP_ALIGN(tmp.size)*NR_CPUS == 67108992 bytes

128+524288*128==67108992

(sizeof(struct ipt_table_info) + (((tmp.size) + (1 << 7)-1) & ~((1 << 7)-1)) * 128)

hmm, no braces missing.