From owner-svn-src-stable-11@freebsd.org Sun Mar 25 03:50:39 2018 Return-Path: Delivered-To: svn-src-stable-11@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 3D483F69D96; Sun, 25 Mar 2018 03:50:39 +0000 (UTC) (envelope-from ae@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id DC823710E3; Sun, 25 Mar 2018 03:50:38 +0000 (UTC) (envelope-from ae@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id D73AE18D23; Sun, 25 Mar 2018 03:50:38 +0000 (UTC) (envelope-from ae@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w2P3ocnK067061; Sun, 25 Mar 2018 03:50:38 GMT (envelope-from ae@FreeBSD.org) Received: (from ae@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w2P3och2067060; Sun, 25 Mar 2018 03:50:38 GMT (envelope-from ae@FreeBSD.org) Message-Id: <201803250350.w2P3och2067060@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: ae set sender to ae@FreeBSD.org using -f From: "Andrey V. Elsukov" Date: Sun, 25 Mar 2018 03:50:38 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r331527 - stable/11/lib/libipsec X-SVN-Group: stable-11 X-SVN-Commit-Author: ae X-SVN-Commit-Paths: stable/11/lib/libipsec X-SVN-Commit-Revision: 331527 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-11@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: SVN commit messages for only the 11-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 25 Mar 2018 03:50:39 -0000 Author: ae Date: Sun Mar 25 03:50:38 2018 New Revision: 331527 URL: https://svnweb.freebsd.org/changeset/base/331527 Log: MFC r330781: Update pfkey_open() function to set socket's write buffer size to 128k and receive buffer size to 2MB. In case if system has bigger default values, do not lower them. This should partially solve the problem, when setkey(8) returns EAGAIN error on systems with many SAs or SPs. PR: 88336 Obtained from: NetBSD/ipsec-tools Modified: stable/11/lib/libipsec/pfkey.c Directory Properties: stable/11/ (props changed) Modified: stable/11/lib/libipsec/pfkey.c ============================================================================== --- stable/11/lib/libipsec/pfkey.c Sun Mar 25 03:45:02 2018 (r331526) +++ stable/11/lib/libipsec/pfkey.c Sun Mar 25 03:50:38 2018 (r331527) @@ -1595,10 +1595,12 @@ pfkey_send_x5(so, type, spid) * others : success and return value of socket. */ int -pfkey_open() +pfkey_open(void) { int so; - const int bufsiz = 128 * 1024; /*is 128K enough?*/ + int bufsiz_current, bufsiz_wanted; + int ret; + socklen_t len; if ((so = socket(PF_KEY, SOCK_RAW, PF_KEY_V2)) < 0) { __ipsec_set_strerror(strerror(errno)); @@ -1609,8 +1611,28 @@ pfkey_open() * This is a temporary workaround for KAME PR 154. * Don't really care even if it fails. */ - (void)setsockopt(so, SOL_SOCKET, SO_SNDBUF, &bufsiz, sizeof(bufsiz)); - (void)setsockopt(so, SOL_SOCKET, SO_RCVBUF, &bufsiz, sizeof(bufsiz)); + /* Try to have 128k. If we have more, do not lower it. */ + bufsiz_wanted = 128 * 1024; + len = sizeof(bufsiz_current); + ret = getsockopt(so, SOL_SOCKET, SO_SNDBUF, + &bufsiz_current, &len); + if ((ret < 0) || (bufsiz_current < bufsiz_wanted)) + (void)setsockopt(so, SOL_SOCKET, SO_SNDBUF, + &bufsiz_wanted, sizeof(bufsiz_wanted)); + + /* Try to have have at least 2MB. If we have more, do not lower it. */ + bufsiz_wanted = 2 * 1024 * 1024; + len = sizeof(bufsiz_current); + ret = getsockopt(so, SOL_SOCKET, SO_RCVBUF, + &bufsiz_current, &len); + if (ret < 0) + bufsiz_current = 128 * 1024; + + for (; bufsiz_wanted > bufsiz_current; bufsiz_wanted /= 2) { + if (setsockopt(so, SOL_SOCKET, SO_RCVBUF, + &bufsiz_wanted, sizeof(bufsiz_wanted)) == 0) + break; + } __ipsec_errcode = EIPSEC_NO_ERROR; return so;