* [PATCH conntrack-tools] conntrackd: set default hashtable buckets and max entries if not specified
@ 2021-03-08 15:32 Pablo Neira Ayuso
2021-03-09 9:51 ` Arturo Borrero Gonzalez
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2021-03-08 15:32 UTC (permalink / raw)
To: netfilter-devel
Fall back to 65536 buckets and 262144 entries.
It would be probably good to add code to autoadjust by reading
/proc/sys/net/netfilter/nf_conntrack_buckets and
/proc/sys/net/nf_conntrack_max.
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1491
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
src/read_config_yy.y | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/read_config_yy.y b/src/read_config_yy.y
index 31109c4de042..b215a729b716 100644
--- a/src/read_config_yy.y
+++ b/src/read_config_yy.y
@@ -1780,5 +1780,11 @@ init_config(char *filename)
NF_NETLINK_CONNTRACK_DESTROY;
}
+ /* default hashtable buckets and maximum number of entries */
+ if (!CONFIG(hashsize))
+ CONFIG(hashsize) = 65536;
+ if (!CONFIG(limit))
+ CONFIG(limit) = 262144;
+
return 0;
}
--
2.20.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH conntrack-tools] conntrackd: set default hashtable buckets and max entries if not specified
2021-03-08 15:32 [PATCH conntrack-tools] conntrackd: set default hashtable buckets and max entries if not specified Pablo Neira Ayuso
@ 2021-03-09 9:51 ` Arturo Borrero Gonzalez
2021-03-09 10:05 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Arturo Borrero Gonzalez @ 2021-03-09 9:51 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel
On 3/8/21 4:32 PM, Pablo Neira Ayuso wrote:
> Fall back to 65536 buckets and 262144 entries.
>
> It would be probably good to add code to autoadjust by reading
> /proc/sys/net/netfilter/nf_conntrack_buckets and
> /proc/sys/net/nf_conntrack_max.
>
> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1491
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
> src/read_config_yy.y | 6 ++++++
> 1 file changed, 6 insertions(+)
>
Thanks for the patch!
Would it make sense to have all this logic in evaluate() in src/run.c?
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH conntrack-tools] conntrackd: set default hashtable buckets and max entries if not specified
2021-03-09 9:51 ` Arturo Borrero Gonzalez
@ 2021-03-09 10:05 ` Pablo Neira Ayuso
0 siblings, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2021-03-09 10:05 UTC (permalink / raw)
To: Arturo Borrero Gonzalez; +Cc: netfilter-devel
On Tue, Mar 09, 2021 at 10:51:20AM +0100, Arturo Borrero Gonzalez wrote:
> On 3/8/21 4:32 PM, Pablo Neira Ayuso wrote:
> > Fall back to 65536 buckets and 262144 entries.
> >
> > It would be probably good to add code to autoadjust by reading
> > /proc/sys/net/netfilter/nf_conntrack_buckets and
> > /proc/sys/net/nf_conntrack_max.
> >
> > Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1491
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > ---
> > src/read_config_yy.y | 6 ++++++
> > 1 file changed, 6 insertions(+)
> >
>
> Thanks for the patch!
>
> Would it make sense to have all this logic in evaluate() in src/run.c?
I think so. A patch to move it there would be fine.
I suspect there might more missing sanity checks in the configuration
file parser (options that are not set to default value, like hashsize
and hashlimit).
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-03-09 10:06 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-03-08 15:32 [PATCH conntrack-tools] conntrackd: set default hashtable buckets and max entries if not specified Pablo Neira Ayuso
2021-03-09 9:51 ` Arturo Borrero Gonzalez
2021-03-09 10:05 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).