netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: <abirvalg@lavabit.com>
To: netfilter-devel@vger.kernel.org
Subject: EILSEQ with libnetfilter_conntrack on multi-threaded app
Date: Wed, 8 Feb 2012 13:27:36 +0000	[thread overview]
Message-ID: <20120208132736.0f893b57@wwwwww-701SD> (raw)

My multi-threaded app makes heavy use of libnetfilter_conntrack.
After running properly for a number of hours, at a certain point which I am not able to reproduce a call to conntrack function does not return for good 10 secs, CPU usage of my process spikes to 80% and running conntrack -L from terminal freezes. When the conntrack function returns with retval EILSEQ,  CPU usage drops, conntrack -L unfreezes an dumps the output.

The code in question does:

nfct_query(setmark_handle_out, NFCT_Q_GET, ct_out_udp)

where setmark_handle_out was previously linked to this function

int setmark_out (enum nf_conntrack_msg_type type, struct nf_conntrack *mct,void *data)
{
  nfct_set_attr_u32(mct, ATTR_MARK, nfmark_to_set_out);
  nfct_query(setmark_handle_out, NFCT_Q_UPDATE, mct);  ***
  return NFCT_CB_CONTINUE;
}
 
nfmark_to_set_out is a global variable

***Could this line be the offending one? As I understand, when issuing NFCT_Q_UPDATE, indicating an nfct_handle is just a formality - any handle can be given as an argument, so I'm simply reusing an existing handle.

I really want to get to the bottom of this issue. Please let me know what other actions I can perform to produce some valuable debuginfo.
I'm actually right now keeping the process suspended in gdb, because the issue takes many hours to reproduce.

Here's the link to the offending line 3514 in my project's webgit:
http://leopardflower.git.sourceforge.net/git/gitweb.cgi?p=leopardflower/leopardflower;a=blob;f=lpfw.c;h=c7af69c1def30d1a18e1bf839acbb60064ee3ba2;hb=709b1e87cf17e6e6e9d8a908ad8a6b77359f1d69#l3514

Thanks.

P.S.
Please CC me when responding to this

P.P.S.
I already posted a similar issue on this mailing list
http://marc.info/?t=131827063700008&r=1&w=2	

Back then Pablo responded with:
/quote
Regarding the EILSEQ error:

The second parameter of nfct_open must be 0. However, if you use the
same socket for sending commands and receiving events, then you have
to disable sequence tracking, there is a function in libnfnetlink to
do that.
/unquote

My code does call nfct_open with 0.
Is the note above that I marked with *** a case of using the same socket for sending commands and receiving events?


             reply	other threads:[~2012-02-08 11:28 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-02-08 13:27 abirvalg [this message]
2012-02-09 15:54 ` EILSEQ with libnetfilter_conntrack on multi-threaded app Pablo Neira Ayuso

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20120208132736.0f893b57@wwwwww-701SD \
    --to=abirvalg@lavabit.com \
    --cc=netfilter-devel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).