[pve-devel] [PATCH firewall] make nfct_catch non-blocking

[David Limbeck]

Do you have any additional information as to why it stopped?

Maybe we could increase the buffer size via nfnl_set_rcv_buffer_size by 
default and continue to ignore ENOBUFS?

On 1/10/19 4:32 PM, Alexandre DERUMIER wrote:
> Just tested, no difference. (but I don't see ENOBUFS since I have increase net.ipv4.tcp_rmem)
>
> But I have reproduce my new hang,
> and it seem that the pvefw-logger process was not running anymore. (seem to be a crash, I don't seen any out of memory).
>
>
> ----- Mail original -----
> De: "Thomas Lamprecht" <t.lamprecht at proxmox.com>
> À: "pve-devel" <pve-devel at pve.proxmox.com>, "David Limbeck" <d.limbeck at proxmox.com>, "Wolfgang Bumiller" <w.bumiller at proxmox.com>
> Envoyé: Jeudi 10 Janvier 2019 14:53:11
> Objet: Re: [pve-devel] [PATCH firewall] make nfct_catch non-blocking
>
> On 1/10/19 1:51 PM, David Limbeck wrote:
>> On 1/10/19 1:49 PM, Wolfgang Bumiller wrote:
>>> On Thu, Jan 10, 2019 at 12:08:28PM +0100, David Limbeck wrote:
>>>> nfct_catch blocks if the callback always returns NFCT_CB_CONTINUE. this
>>>> works around the problem by setting the underlying file descriptor to
>>>> O_NONBLOCK. this should allow the callback to run multiple times and
>>>> catch as many events as possible before nfct_catch returns.
>>>>
>>>> Signed-off-by: David Limbeck <d.limbeck at proxmox.com>
>>>> ---
>>>> maybe this improves the ENOBUFS situation? it should result in equal or
>>>> more messages though as the callback is run multiple times before
>>>> nfct_catch returns.
>>> I wouldn't expect a change in the ENOBUFS situation but rather just more
>>> output happening which may have previously been lost from already-read
>>> packet parts.
>>>
>>> @Alexandre, could you give this a try?
>> For ENOBUFS we could try setting NETLINK_NO_ENOBUFS with setsockopt as mentioned by @Thomas.
> together with NETLINK_BROADCAST_SEND_ERROR[0], ulogd uses this[1] too.
>
> [0]: https://patchwork.ozlabs.org/patch/24919/ (second b) bullet point)
> [1]: https://git.netfilter.org/ulogd2/tree/input/flow/ulogd_inpflow_NFCT.c#n1322
>
>
> _______________________________________________
> pve-devel mailing list
> pve-devel at pve.proxmox.com
> https://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>
>