svn commit: r273588 - head/sys/netpfil/ipfw

[Alexander V. Chernikov]

Author: melifaro
Date: Fri Oct 24 13:57:15 2014
New Revision: 273588
URL: https://svnweb.freebsd.org/changeset/base/273588

Log:
  Bump default dynamic limit to 16k entries.
  Print better log message when limit is hit.
  
  PR:		193300
  Submitted by:	me at nileshgr.com

Modified:
  head/sys/netpfil/ipfw/ip_fw_dynamic.c

Modified: head/sys/netpfil/ipfw/ip_fw_dynamic.c
==============================================================================
--- head/sys/netpfil/ipfw/ip_fw_dynamic.c	Fri Oct 24 13:34:22 2014	(r273587)
+++ head/sys/netpfil/ipfw/ip_fw_dynamic.c	Fri Oct 24 13:57:15 2014	(r273588)
@@ -592,8 +592,9 @@ add_dyn_rule(struct ipfw_flow_id *id, in
 	if (r == NULL) {
 		if (last_log != time_uptime) {
 			last_log = time_uptime;
-			log(LOG_DEBUG, "ipfw: %s: Cannot allocate rule\n",
-			    __func__);
+			log(LOG_DEBUG,
+			    "ipfw: Cannot allocate dynamic state, "
+			    "consider increasing net.inet.ip.fw.dyn_max\n");
 		}
 		return NULL;
 	}
@@ -1385,7 +1386,7 @@ ipfw_dyn_init(struct ip_fw_chain *chain)
         V_dyn_keepalive = 1;    /* do send keepalives */
 	V_dyn_keepalive_last = time_uptime;
         
-        V_dyn_max = 4096;       /* max # of dynamic rules */
+        V_dyn_max = 16384; /* max # of dynamic rules */
 
 	V_ipfw_dyn_rule_zone = uma_zcreate("IPFW dynamic rule",
 	    sizeof(ipfw_dyn_rule), NULL, NULL, NULL, NULL,