nat: limit resource consumption when out of ports
Type: improvement
#include <nat/nat44/ed_inlines.h>
#include <nat/lib/nat_inlines.h>
+/* number of attempts to get a port for ED overloading algorithm, if rolling
+ * a dice this many times doesn't produce a free port, it's treated
+ * as if there were no free ports available to conserve resources */
+#define ED_PORT_ALLOC_ATTEMPTS (10)
+
static char *nat_in2out_ed_error_strings[] = {
#define _(sym,string) string,
foreach_nat_in2out_ed_error
@@ -227,7 +232,7 @@ nat_ed_alloc_addr_and_port (snat_main_t * sm, u32 rx_fib_index,
port_offset = snat_random_port (0, port_per_thread - 1); \
port = port_thread_offset + port_offset; \
} \
- u16 attempts = port_per_thread; \
+ u16 attempts = ED_PORT_ALLOC_ATTEMPTS; \
do \
{ \
init_ed_kv (out2in_ed_kv, a->addr, clib_host_to_net_u16 (port), \
@@ -244,7 +249,7 @@ nat_ed_alloc_addr_and_port (snat_main_t * sm, u32 rx_fib_index,
*outside_port = clib_host_to_net_u16 (port); \
return 0; \
} \
- port_offset = (port_offset + 1) % port_per_thread; \
+ port_offset = snat_random_port (0, port_per_thread - 1); \
port = port_thread_offset + port_offset; \
--attempts; \
} \
