diff options
| author | Ryan Thomas McBride <mcbride@cvs.openbsd.org> | 2006-05-28 02:45:46 +0000 |
|---|---|---|
| committer | Ryan Thomas McBride <mcbride@cvs.openbsd.org> | 2006-05-28 02:45:46 +0000 |
| commit | cc38e7cc37c6ca84a3c4f5751fe61c8543ae7558 (patch) | |
| tree | 770d3b9835427b46c6dacfdfd69fc1f88c9bba2f /sbin/pfctl/pfctl.c | |
| parent | 18e4cb29682e760ec4f3759132bdfea5316fd39d (diff) | |
Enable adaptive timeouts by default, with adaptive.start of 60% of the
state limit and adaptive.end of 120% of the state limit.
Explicitly setting the adaptive timeouts will override the default,
and it can be disabled by setting both adaptive.start and adaptive.end to 0.
ok henning@
Diffstat (limited to 'sbin/pfctl/pfctl.c')
| -rw-r--r-- | sbin/pfctl/pfctl.c | 19 |
1 files changed, 18 insertions, 1 deletions
diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index 285d7c31b57..d3665a787c4 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pfctl.c,v 1.245 2006/04/24 06:10:54 dhartmei Exp $ */ +/* $OpenBSD: pfctl.c,v 1.246 2006/05/28 02:45:45 mcbride Exp $ */ /* * Copyright (c) 2001 Daniel Hartmeier @@ -1218,6 +1218,8 @@ pfctl_init_options(struct pfctl *pf) pf->timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL; pf->timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL; pf->timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL; + pf->timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START; + pf->timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END; pf->limit[PF_LIMIT_STATES] = PFSTATE_HIWAT; pf->limit[PF_LIMIT_FRAGS] = PFFRAG_FRENT_HIWAT; @@ -1244,6 +1246,21 @@ pfctl_load_options(struct pfctl *pf) error = 1; } + /* + * If we've set the limit, but havn't explicitly set adaptive + * timeouts, do it now with a start of 60% and end of 120%. + */ + if (pf->limit_set[PF_LIMIT_STATES] && + !pf->timeout_set[PFTM_ADAPTIVE_START] && + !pf->timeout_set[PFTM_ADAPTIVE_END]) { + pf->timeout[PFTM_ADAPTIVE_START] = + (pf->limit[PF_LIMIT_STATES] / 10) * 6; + pf->timeout_set[PFTM_ADAPTIVE_START] = 1; + pf->timeout[PFTM_ADAPTIVE_END] = + (pf->limit[PF_LIMIT_STATES] / 10) * 12; + pf->timeout_set[PFTM_ADAPTIVE_END] = 1; + } + /* load timeouts */ for (i = 0; i < PFTM_MAX; i++) { if ((pf->opts & PF_OPT_MERGE) && !pf->timeout_set[i]) |