From bd5aaaac7f48e6788999d3c291f566933dc9daa6 Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Fri, 21 May 2021 11:14:50 +0200 Subject: tcp: Actually enforce MAX_CONNS limit and, given that the connection table is indexed by socket number, we also need to increase MAX_CONNS now as the ICMP implementation needs 2^17 sockets, that will be opened before TCP connections are accepted. This needs to be changed later: the connection table should be indexed by a translated number -- we're wasting 2^17 table entries otherwise. Move initialisation of TCP listening sockets as last per-protocol initialisation, this will make it easier. Signed-off-by: Stefano Brivio --- tcp.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'tcp.c') diff --git a/tcp.c b/tcp.c index bab07ab..d70267b 100644 --- a/tcp.c +++ b/tcp.c @@ -319,7 +319,7 @@ #include "siphash.h" /* Approximately maximum number of open descriptors per process */ -#define MAX_CONNS (256 * 1024) +#define MAX_CONNS (1024 * 1024) #define TCP_HASH_TABLE_LOAD 70 /* % */ #define TCP_HASH_TABLE_SIZE (MAX_CONNS * 100 / TCP_HASH_TABLE_LOAD) @@ -924,6 +924,11 @@ static void tcp_conn_from_tap(struct ctx *c, int af, void *addr, if (s < 0) return; + if (s >= MAX_CONNS) { + close(s); + return; + } + tc[s].mss_guest = tcp_opt_get(th, len, OPT_MSS, NULL, NULL); if (tc[s].mss_guest < 0) tc[s].mss_guest = MSS_DEFAULT; @@ -1003,6 +1008,11 @@ static void tcp_conn_from_sock(struct ctx *c, int fd, struct timespec *now) if (s == -1) return; + if (s >= MAX_CONNS) { + close(s); + return; + } + CHECK_SET_MIN_MAX(c->tcp.fd_, s); CHECK_SET_MIN_MAX(c->tcp.fd_conn_, s); -- cgit v1.2.3