[Snort-devel] [PATCH 2/2] daq_nfq: avoid uneeded -ENOBUFS on queue overrun

Florian Westphal fwestphal at ...2119...
Fri Apr 29 08:36:05 EDT 2011


netlink signals event queue overflows by returning -ENOBUFS to
userspace.

daq_nfq does not need to care about this, so ignore ENOBUFS and tell
the kernel to not notify us in the first place.
---
 os-daq-modules/daq_nfq.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/os-daq-modules/daq_nfq.c b/os-daq-modules/daq_nfq.c
index d55e9d6..55ac811 100644
--- a/os-daq-modules/daq_nfq.c
+++ b/os-daq-modules/daq_nfq.c
@@ -338,6 +338,11 @@ static int nfq_daq_initialize (
         }
     }
 
+    // tell kernel that we do not need to know about queue overflows.
+    // Without this, read operations on the netlink socket will fail
+    // with ENOBUFS on queue overrun.
+    setsockopt(impl->sock, SOL_NETLINK, NETLINK_NO_ENOBUFS, &(int){1},
+                                                         sizeof(int));
     impl->state = DAQ_STATE_INITIALIZED;
 
     *handle = impl;
-- 
1.7.3.4





More information about the Snort-devel mailing list