Hello, On Sun, 2016-09-18 at 14:02 +0200, Eric Leblond wrote: > Hello, > > I'm currently testing a code implementing AF_PACKET bypass for > Suricata. The idea is that Suricata is updating a hash table > containing > a list of flows it does not want to see anymore. > > I want to check flow timeout from the userspace, so my current > algorithm is doing: > > while (bpf_get_next_key(mapfd, &key, &next_key) == 0) { > bpf_lookup_elem(mapfd, &next_key, &value); > FlowCallback(mapfd, &next_key, &value, data); > key = next_key; > } > > In the FlowCallback, I check the timing in the flow entry and I > remove > the key if the flow is timeout. > > This is currently working well when there is only a few flows but on > a > real system with log of insertion in the table, the loop is never > returning because we dequeue slower than we enqueue. > > Is there a better algorithm or an other way to do it ?
It seems I missed an obvious race condition in my existing code. I'll continue to test and relive this thread if necessary. BR, -- Eric Leblond <e...@regit.org>