Date: Mon, 18 Feb 2019 10:07:29 -0800 From: Gleb Smirnoff <glebius@freebsd.org> To: Andreas Longwitz <longwitz@incore.de> Cc: Konstantin Belousov <kib@freebsd.org>, freebsd-pf@freebsd.org, Kristof Provost <kristof@sigsegv.be> Subject: Re: rdr pass for proto tcp sometimes creates states with expire time zero and so breaking connections Message-ID: <20190218180729.GP83215@FreeBSD.org> In-Reply-To: <5C6AEBB8.2030305@incore.de> References: <D5EEA773-1F0F-4FA0-A39A-486EE323907D@sigsegv.be> <5BEB3B9A.9080402@incore.de> <20181113222533.GJ9744@FreeBSD.org> <5C49ECAA.7060505@incore.de> <20190124203802.GU24863@kib.kiev.ua> <5C4A37A1.80206@incore.de> <20190125131409.GZ24863@kib.kiev.ua> <5C557065.10600@incore.de> <20190202184208.GG24863@kib.kiev.ua> <5C6AEBB8.2030305@incore.de>
next in thread | previous in thread | raw e-mail | index | archive | help
Thanks, Andreas!
Kristof, will you handle that? If you are busy, I can try to refresh
my memory.
On Mon, Feb 18, 2019 at 06:30:32PM +0100, Andreas Longwitz wrote:
A> Hello,
A>
A> > Ok, thanks, I will commit the patch shortly. I do not see a point in waiting
A> > for two more weeks, sure report me if anything goes wrong.
A>
A> your patch for counter(9) on i386 definitely solves my problem discussed
A> in this thread.
A>
A> Because fetching a counter is a rather expansive function we should use
A> counter_u64_fetch() in pf_state_expires() only when necessary. A "rdr
A> pass" rule should not cause more effort than separate "rdr" and "pass"
A> rules. For rules with adaptive timeout values the call of
A> counter_u64_fetch() should be accepted, but otherwise not.
A>
A> For a small gain in performance especially for "rdr pass" rules I
A> suggest something like
A>
A> --- pf.c.orig 2019-02-18 17:49:22.944751000 +0100
A> +++ pf.c 2019-02-18 17:55:07.396163000 +0100
A> @@ -1558,7 +1558,7 @@
A> if (!timeout)
A> timeout = V_pf_default_rule.timeout[state->timeout];
A> start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START];
A> - if (start) {
A> + if (start && state->rule.ptr != &V_pf_default_rule) {
A> end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END];
A> states = counter_u64_fetch(state->rule.ptr->states_cur);
A> } else {
A>
A> --
A> Andreas
A>
--
Gleb Smirnoff
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20190218180729.GP83215>