On Tue, Sep 02, 2014 at 06:45:32AM -0500, Noel Jones wrote: > To answer your question above about 1000 entries in the main.cf > parameter, that sounds like a bad idea. It probably wouldn't give > an error, but would likely make smtpd slow to start, maybe > significantly so. I doubt it's ever been tested with that many entries.
The parsing of CIDR tables is done when at startup when the file is opened, so the CPU cost is comparable to that of parsing the same data directly out of main.cf. Postgres can perform CIDR lookups, so for very large CIDR datasets, one can switch to Postgres. To reduce the start-up cost overhead, one case raise $max_use from the default value of 100 to 1000 or more, which works provided the system is not mostly idle. With modern CPUs processing a few kBytes of CIDR specs is not a significant burden. On my circa 2009 laptop, parsing a 10000 entry CIDR table takes 10ms. > The SASL_README is an overview. The complete docs for that > parameter can be found in > http://www.postfix.org/postconf.5.html#smtpd_sasl_exceptions_networks > which does indeed list type:table as valid. > > A cidr: table with 1000 entries should work as expected, with > acceptable performance. Probably about the same as stuffing all the data into main.cf, but with some additional overhead for daemons other than smtpd(8) to load the extra text (without interpreting it as CIDR data). So the CIDR table is better, but not by much. Mostly, it is easier to maintain. -- Viktor.
