Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7ae7730fd6d98be1afe8ad9ea77813de607ec970
Commit:     7ae7730fd6d98be1afe8ad9ea77813de607ec970
Parent:     ec59a1110aee6846adada8979915cacae64042ce
Author:     Patrick McHardy <[EMAIL PROTECTED]>
AuthorDate: Sat Jul 7 22:37:38 2007 -0700
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Tue Jul 10 22:18:15 2007 -0700

    [NETFILTER]: nf_conntrack: early_drop improvement
    
    When the maximum number of conntrack entries is reached and a new
    one needs to be allocated, conntrack tries to drop an unassured
    connection from the same hash bucket the new conntrack would hash
    to. Since with a properly sized hash the average number of entries
    per bucket is 1, the chances of actually finding one are not very
    good. This patch makes it walk the hash until a minimum number of
    8 entries are checked.
    
    Based on patch by Vasily Averin <[EMAIL PROTECTED]>.
    
    Signed-off-by: Patrick McHardy <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
---
 net/netfilter/nf_conntrack_core.c |   22 +++++++++++++++-------
 1 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/net/netfilter/nf_conntrack_core.c 
b/net/netfilter/nf_conntrack_core.c
index d1fc019..472396d 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -377,21 +377,30 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple 
*tuple,
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_tuple_taken);
 
+#define NF_CT_EVICTION_RANGE   8
+
 /* There's a small race here where we may free a just-assured
    connection.  Too bad: we're in trouble anyway. */
-static int early_drop(struct hlist_head *chain)
+static int early_drop(unsigned int hash)
 {
        /* Use oldest entry, which is roughly LRU */
        struct nf_conntrack_tuple_hash *h;
        struct nf_conn *ct = NULL, *tmp;
        struct hlist_node *n;
+       unsigned int i, cnt = 0;
        int dropped = 0;
 
        read_lock_bh(&nf_conntrack_lock);
-       hlist_for_each_entry(h, n, chain, hnode) {
-               tmp = nf_ct_tuplehash_to_ctrack(h);
-               if (!test_bit(IPS_ASSURED_BIT, &tmp->status))
-                       ct = tmp;
+       for (i = 0; i < nf_conntrack_htable_size; i++) {
+               hlist_for_each_entry(h, n, &nf_conntrack_hash[hash], hnode) {
+                       tmp = nf_ct_tuplehash_to_ctrack(h);
+                       if (!test_bit(IPS_ASSURED_BIT, &tmp->status))
+                               ct = tmp;
+                       cnt++;
+               }
+               if (ct || cnt >= NF_CT_EVICTION_RANGE)
+                       break;
+               hash = (hash + 1) % nf_conntrack_htable_size;
        }
        if (ct)
                atomic_inc(&ct->ct_general.use);
@@ -425,8 +434,7 @@ struct nf_conn *nf_conntrack_alloc(const struct 
nf_conntrack_tuple *orig,
        if (nf_conntrack_max
            && atomic_read(&nf_conntrack_count) > nf_conntrack_max) {
                unsigned int hash = hash_conntrack(orig);
-               /* Try dropping from this hash chain. */
-               if (!early_drop(&nf_conntrack_hash[hash])) {
+               if (!early_drop(hash)) {
                        atomic_dec(&nf_conntrack_count);
                        if (net_ratelimit())
                                printk(KERN_WARNING
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to