Date: Wed, 6 Jun 2001 14:51:31 -0400 (EDT) From: Rob Simmons <rsimmons@wumpus.wlcg.com> To: FreeBSD-gnats-submit@freebsd.org Subject: kern/27912: ipfilter state table limits are too small Message-ID: <200106061851.f56IpVE11245@wumpus.wlcg.com>
next in thread | raw e-mail | index | archive | help
>Number: 27912
>Category: kern
>Synopsis: ipfilter state table limits are too small
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: change-request
>Submitter-Id: current-users
>Arrival-Date: Wed Jun 06 12:00:04 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator: Rob Simmons
>Release: FreeBSD 4.3-STABLE i386
>Organization:
>Environment:
System: FreeBSD wumpus 4.3-STABLE FreeBSD 4.3-STABLE #0: Fri May 11 09:42:50 EDT 2001 root@wumpus:/usr/obj/usr/src/sys/WUMPUS i386
>Description:
The ipfilter state table limits are too small. Ideally there should be
a sysctl knob for changing these limits on the fly. The second most ideal
solution is to have a kernel configuration file knob. The last solution
which is less than ideal, but would work for most people is to apply the
patch supplied below.
>How-To-Repeat:
The state tables right now have the following values:
#define IPSTATE_SIZE 5737
#define IPSTATE_MAX 4013
>Fix:
*** /tmp/ip_state.h Wed Jun 6 14:55:56 2001
--- sys/netinet/ip_state.h Wed Jun 6 14:56:21 2001
***************
*** 18,25 ****
# define SIOCDELST _IOW(r, 61, struct ipstate *)
#endif
! #define IPSTATE_SIZE 5737
! #define IPSTATE_MAX 4013 /* Maximum number of states held */
#define PAIRS(s1,d1,s2,d2) ((((s1) == (s2)) && ((d1) == (d2))) ||\
(((s1) == (d2)) && ((d1) == (s2))))
--- 18,25 ----
# define SIOCDELST _IOW(r, 61, struct ipstate *)
#endif
! #define IPSTATE_SIZE 64747
! #define IPSTATE_MAX 45322 /* Maximum number of states held */
#define PAIRS(s1,d1,s2,d2) ((((s1) == (s2)) && ((d1) == (d2))) ||\
(((s1) == (d2)) && ((d1) == (s2))))
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200106061851.f56IpVE11245>