Home » Mailing lists » Devel » [PATCH 2.6.21-rc6] [netfilter] early_drop imrovement
[PATCH 2.6.21-rc6] [netfilter] early_drop imrovement [message #11780] |
Fri, 06 April 2007 08:00 |
vaverin
Messages: 708 Registered: September 2005
|
Senior Member |
|
|
When the number of conntracks is reached ip_conntrack_max limit, early_drop() is
called and tries to free one of already used conntracks in one of the hash
buckets. If it does not find any conntracks that may be freed, it
leads to transmission errors.
However it is not fair because of current hash bucket may be empty but the
neighbour ones can have the number of conntracks that can be freed. With the
following patch early_drop() will search conntracks in all hash buckets.
Signed-off-by: Vasily Averin <vvs@sw.ru>
--- 2.6.21-rc6/net/ipv4/netfilter/ip_conntrack_core.c.erdrp
+++ 2.6.21-rc6/net/ipv4/netfilter/ip_conntrack_core.c
@@ -517,7 +517,7 @@ ip_conntrack_tuple_taken(const struct ip
/* There's a small race here where we may free a just-assured
connection. Too bad: we're in trouble anyway. */
-static int early_drop(struct list_head *chain)
+static int __early_drop(struct list_head *chain)
{
/* Traverse backwards: gives us oldest, which is roughly LRU */
struct ip_conntrack_tuple_hash *h;
@@ -547,6 +547,20 @@ static int early_drop(struct list_head *
return dropped;
}
+static int early_drop(const struct ip_conntrack_tuple *orig)
+{
+ unsigned int i, hash;
+ int ret = 0;
+
+ hash = hash_conntrack(orig);
+
+ for (i = 0;
+ !ret && i < ip_conntrack_htable_size;
+ ++i, hash = ++hash % ip_conntrack_htable_size)
+ ret = __early_drop(&ip_conntrack_hash[hash]);
+ return ret;
+}
+
static struct ip_conntrack_helper *
__ip_conntrack_helper_find( const struct ip_conntrack_tuple *tuple)
{
@@ -631,9 +645,7 @@ struct ip_conntrack *ip_conntrack_alloc(
if (ip_conntrack_max
&& atomic_read(&ip_conntrack_count) > ip_conntrack_max) {
- unsigned int hash = hash_conntrack(orig);
- /* Try dropping from this hash chain. */
- if (!early_drop(&ip_conntrack_hash[hash])) {
+ if (!early_drop(orig)) {
atomic_dec(&ip_conntrack_count);
if (net_ratelimit())
printk(KERN_WARNING
--- 2.6.21-rc6/net/netfilter/nf_conntrack_core.c.erdrp
+++ 2.6.21-rc6/net/netfilter/nf_conntrack_core.c
@@ -542,7 +542,7 @@ EXPORT_SYMBOL_GPL(nf_conntrack_tuple_tak
/* There's a small race here where we may free a just-assured
connection. Too bad: we're in trouble anyway. */
-static int early_drop(struct list_head *chain)
+static int __early_drop(struct list_head *chain)
{
/* Traverse backwards: gives us oldest, which is roughly LRU */
struct nf_conntrack_tuple_hash *h;
@@ -572,6 +572,20 @@ static int early_drop(struct list_head *
return dropped;
}
+static int early_drop(const struct nf_conntrack_tuple *orig)
+{
+ unsigned int i, hash;
+ int ret = 0;
+
+ hash = hash_conntrack(orig);
+
+ for (i = 0;
+ !ret && i < nf_conntrack_htable_size;
+ ++i, hash = ++hash % nf_conntrack_htable_size)
+ ret = __early_drop(&nf_conntrack_hash[hash]);
+ return ret;
+}
+
static struct nf_conn *
__nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
const struct nf_conntrack_tuple *repl,
@@ -591,9 +605,7 @@ __nf_conntrack_alloc(const struct nf_con
if (nf_conntrack_max
&& atomic_read(&nf_conntrack_count) > nf_conntrack_max) {
- unsigned int hash = hash_conntrack(orig);
- /* Try dropping from this hash chain. */
- if (!early_drop(&nf_conntrack_hash[hash])) {
+ if (!early_drop(orig)) {
atomic_dec(&nf_conntrack_count);
if (net_ratelimit())
printk(KERN_WARNING
|
|
|
|
|
[PATCH 2.6.21-rc6] [netfilter] early_drop imrovement
By: vaverin on Fri, 06 April 2007 08:00
|
|
|
Re: [PATCH 2.6.21-rc6] [netfilter] early_drop imrovement
|
|
|
Re: [PATCH 2.6.21-rc6] [netfilter] early_drop imrovement
By: vaverin on Fri, 06 April 2007 10:26
|
|
|
Re: [PATCH 2.6.21-rc6] [netfilter] early_drop imrovement
|
|
|
[PATCH nf-2.6.22] [netfilter] early_drop imrovement
By: vaverin on Sat, 07 April 2007 11:45
|
|
|
Re: [PATCH nf-2.6.22] [netfilter] early_drop imrovement
|
|
|
Re: [PATCH nf-2.6.22] [netfilter] early_drop imrovement
By: vaverin on Sun, 08 April 2007 05:02
|
|
|
[NETFILTER] early_drop() imrovement (v3)
By: vaverin on Wed, 09 May 2007 06:59
|
|
|
Re: [NETFILTER] early_drop() imrovement (v3)
|
|
|
Re: [NETFILTER] early_drop() imrovement (v3)
By: vaverin on Tue, 26 June 2007 13:20
|
|
|
Re: [NETFILTER] early_drop() imrovement (v3)
|
|
|
[NETFILTER] early_drop() imrovement (v4)
By: vaverin on Wed, 27 June 2007 08:46
|
|
|
Re: [NETFILTER] early_drop() imrovement (v4)
|
|
|
Re: [NETFILTER] early_drop() imrovement (v4)
|
|
|
Re: [NETFILTER] early_drop() imrovement (v4)
By: vaverin on Wed, 27 June 2007 12:29
|
|
|
Re: [NETFILTER] early_drop() imrovement (v4)
|
|
|
Re: [NETFILTER] early_drop() imrovement (v4)
By: vaverin on Wed, 27 June 2007 13:02
|
|
|
Re: [NETFILTER] early_drop() imrovement (v4)
|
|
|
Re: [NETFILTER] early_drop() imrovement (v4)
|
|
|
Re: [NETFILTER] early_drop() imrovement (v4)
By: vaverin on Wed, 27 June 2007 13:25
|
|
|
Re: [NETFILTER] early_drop() imrovement (v4)
|
|
|
Re: [NETFILTER] early_drop() imrovement (v4)
|
|
|
Re: [NETFILTER] early_drop() imrovement (v4)
|
|
|
Re: [NETFILTER] early_drop() imrovement (v4)
|
|
|
Re: [NETFILTER] early_drop() imrovement (v4)
|
|
|
Re: [NETFILTER] early_drop() imrovement (v4)
|
|
|
Re: [NETFILTER] early_drop() imrovement (v3)
|
Goto Forum:
Current Time: Fri Oct 18 19:06:18 GMT 2024
Total time taken to generate the page: 0.05074 seconds
|