From a825c288665556013a51a7efba2e07bc16ee4ee8 Mon Sep 17 00:00:00 2001 From: Mark Reynolds Date: Fri, 5 Apr 2019 09:16:02 -0400 Subject: [PATCH] Ticket 49990 - Increase the default FD limits Description: As discussed in the ticket, this fix sets the maxdescriptors to the maximum allowed by the OS/systemd. If this limit can not be obtained then we fall back to 8192 as the limit https://pagure.io/389-ds-base/issue/49990 Reviewed by: tbordaz & firstyear(Thanks!!) (cherry picked from commit 8ca142034a051122b78bdaa3a948d3c50d4cca7e) (cherry picked from commit 2c583a97cffa54a7da9922215ae37156174a37c5) --- .../suites/resource_limits/fdlimits_test.py | 63 +++++++++++++++++++ ldap/servers/slapd/libglobs.c | 26 +++++--- ldap/servers/slapd/main.c | 5 +- ldap/servers/slapd/proto-slap.h | 4 +- ldap/servers/slapd/slap.h | 6 +- wrappers/systemd.template.service.in | 1 - wrappers/systemd.template.sysconfig | 3 +- 7 files changed, 90 insertions(+), 18 deletions(-) create mode 100644 dirsrvtests/tests/suites/resource_limits/fdlimits_test.py diff --git a/dirsrvtests/tests/suites/resource_limits/fdlimits_test.py b/dirsrvtests/tests/suites/resource_limits/fdlimits_test.py new file mode 100644 index 000000000..e5b14a747 --- /dev/null +++ b/dirsrvtests/tests/suites/resource_limits/fdlimits_test.py @@ -0,0 +1,63 @@ +import logging +import pytest +import os +import ldap +from lib389._constants import * +from lib389.topologies import topology_st + +logging.getLogger(__name__).setLevel(logging.INFO) +log = logging.getLogger(__name__) + +FD_ATTR = "nsslapd-maxdescriptors" +SYSTEMD_VAL = "16384" +CUSTOM_VAL = "9000" +TOO_HIGH_VAL = "65536" +TOO_LOW_VAL = "0" + + +def test_fd_limits(topology_st): + """Test the default limits, and custom limits + + :id: fa0a5106-612f-428f-84c0-9c85c34d0433 + :setup: Standalone Instance + :steps: + 1. Check default limit + 2. Change default limit + 3. Check invalid/too high limit is rejected + 4. Check invalid/too low limit is rejected + :expectedresults: + 1. Success + 2. Success + 3. Success + 4 Success + """ + + # Check systemd default + max_fd = topology_st.standalone.config.get_attr_val_utf8(FD_ATTR) + assert max_fd == SYSTEMD_VAL + + # Check custom value is applied + topology_st.standalone.config.set(FD_ATTR, CUSTOM_VAL) + max_fd = topology_st.standalone.config.get_attr_val_utf8(FD_ATTR) + assert max_fd == CUSTOM_VAL + + # Attempt to use val that is too high + with pytest.raises(ldap.UNWILLING_TO_PERFORM): + topology_st.standalone.config.set(FD_ATTR, TOO_HIGH_VAL) + max_fd = topology_st.standalone.config.get_attr_val_utf8(FD_ATTR) + assert max_fd == CUSTOM_VAL + + # Attempt to use val that is too low + with pytest.raises(ldap.OPERATIONS_ERROR): + topology_st.standalone.config.set(FD_ATTR, TOO_LOW_VAL) + max_fd = topology_st.standalone.config.get_attr_val_utf8(FD_ATTR) + assert max_fd == CUSTOM_VAL + + log.info("Test PASSED") + + +if __name__ == '__main__': + # Run isolated + # -s for DEBUG mode + CURRENT_FILE = os.path.realpath(__file__) + pytest.main(["-s", CURRENT_FILE]) diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c index 59f8d06d5..91c3a4a89 100644 --- a/ldap/servers/slapd/libglobs.c +++ b/ldap/servers/slapd/libglobs.c @@ -131,6 +131,7 @@ #if defined(LINUX) #include #endif +#include #define REMOVE_CHANGELOG_CMD "remove" @@ -1465,6 +1466,8 @@ void FrontendConfig_init(void) { slapdFrontendConfig_t *cfg = getFrontendConfig(); + struct rlimit rlp; + int64_t maxdescriptors = SLAPD_DEFAULT_MAXDESCRIPTORS; #if SLAPI_CFG_USE_RWLOCK == 1 /* initialize the read/write configuration lock */ @@ -1480,6 +1483,11 @@ FrontendConfig_init(void) exit(-1); } #endif + /* Default the maximum fd's to the maximum allowed */ + if (getrlimit(RLIMIT_NOFILE, &rlp) == 0) { + maxdescriptors = (int64_t)rlp.rlim_max; + } + /* Take the lock to make sure we barrier correctly. */ CFG_LOCK_WRITE(cfg); @@ -1514,7 +1522,7 @@ FrontendConfig_init(void) /* minssf is applied to rootdse, by default */ init_minssf_exclude_rootdse = cfg->minssf_exclude_rootdse = LDAP_OFF; cfg->validate_cert = SLAPD_DEFAULT_VALIDATE_CERT; - cfg->maxdescriptors = SLAPD_DEFAULT_MAXDESCRIPTORS; + cfg->maxdescriptors = maxdescriptors; cfg->groupevalnestlevel = SLAPD_DEFAULT_GROUPEVALNESTLEVEL; cfg->snmp_index = SLAPD_DEFAULT_SNMP_INDEX; cfg->SSLclientAuth = SLAPD_DEFAULT_SSLCLIENTAUTH; @@ -1665,8 +1673,7 @@ FrontendConfig_init(void) init_ndn_cache_enabled = cfg->ndn_cache_enabled = LDAP_ON; cfg->ndn_cache_max_size = SLAPD_DEFAULT_NDN_SIZE; init_sasl_mapping_fallback = cfg->sasl_mapping_fallback = LDAP_OFF; - init_ignore_vattrs = - cfg->ignore_vattrs = LDAP_OFF; + init_ignore_vattrs = cfg->ignore_vattrs = LDAP_OFF; cfg->sasl_max_bufsize = SLAPD_DEFAULT_SASL_MAXBUFSIZE; cfg->unhashed_pw_switch = SLAPD_DEFAULT_UNHASHED_PW_SWITCH; init_return_orig_type = cfg->return_orig_type = LDAP_OFF; @@ -4011,13 +4018,12 @@ config_set_maxthreadsperconn(const char *attrname, char *value, char *errorbuf, return retVal; } -#include -int +int32_t config_set_maxdescriptors(const char *attrname, char *value, char *errorbuf, int apply) { - int retVal = LDAP_SUCCESS; - long nValue = 0; - int maxVal = 65535; + int32_t retVal = LDAP_SUCCESS; + int64_t nValue = 0; + int64_t maxVal = 65535; struct rlimit rlp; char *endp = NULL; @@ -5493,11 +5499,11 @@ config_get_maxthreadsperconn() return slapi_atomic_load_32(&(slapdFrontendConfig->maxthreadsperconn), __ATOMIC_ACQUIRE); } -int +int64_t config_get_maxdescriptors(void) { slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig(); - int retVal; + int64_t retVal; CFG_LOCK_READ(slapdFrontendConfig); retVal = slapdFrontendConfig->maxdescriptors; diff --git a/ldap/servers/slapd/main.c b/ldap/servers/slapd/main.c index 219c91294..5e24b3b5f 100644 --- a/ldap/servers/slapd/main.c +++ b/ldap/servers/slapd/main.c @@ -1074,7 +1074,10 @@ main(int argc, char **argv) slapi_ch_free((void **)&versionstring); } - /* -sduloutre: compute_init() and entry_computed_attr_init() moved up */ + /* log the max fd limit as it is typically set in env/systemd */ + slapi_log_err(SLAPI_LOG_INFO, "main", + "Setting the maximum file descriptor limit to: %ld\n", + config_get_maxdescriptors()); if (mcfg.slapd_exemode != SLAPD_EXEMODE_REFERRAL) { int rc; diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h index 79017e68d..a0648ca3c 100644 --- a/ldap/servers/slapd/proto-slap.h +++ b/ldap/servers/slapd/proto-slap.h @@ -383,7 +383,7 @@ int config_set_malloc_mxfast(const char *attrname, char *value, char *errorbuf, int config_set_malloc_trim_threshold(const char *attrname, char *value, char *errorbuf, int apply); int config_set_malloc_mmap_threshold(const char *attrname, char *value, char *errorbuf, int apply); #endif -int config_set_maxdescriptors(const char *attrname, char *value, char *errorbuf, int apply); +int32_t config_set_maxdescriptors(const char *attrname, char *value, char *errorbuf, int apply); int config_set_localuser(const char *attrname, char *value, char *errorbuf, int apply); int config_set_maxsimplepaged_per_conn(const char *attrname, char *value, char *errorbuf, int apply); @@ -465,7 +465,7 @@ char *config_get_workingdir(void); char *config_get_encryptionalias(void); int32_t config_get_threadnumber(void); int config_get_maxthreadsperconn(void); -int config_get_maxdescriptors(void); +int64_t config_get_maxdescriptors(void); int config_get_reservedescriptors(void); int config_get_ioblocktimeout(void); int config_get_idletimeout(void); diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index 618e245b6..bce720974 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -351,8 +351,8 @@ typedef void (*VFPV)(); /* takes undefined arguments */ #define SLAPD_DEFAULT_PAGEDSIZELIMIT 0 #define SLAPD_DEFAULT_PAGEDSIZELIMIT_STR "0" -#define SLAPD_DEFAULT_MAXDESCRIPTORS 1024 -#define SLAPD_DEFAULT_MAXDESCRIPTORS_STR "1024" +#define SLAPD_DEFAULT_MAXDESCRIPTORS 8192 +#define SLAPD_DEFAULT_MAXDESCRIPTORS_STR "8192" #define SLAPD_DEFAULT_MAX_FILTER_NEST_LEVEL 40 #define SLAPD_DEFAULT_MAX_FILTER_NEST_LEVEL_STR "40" #define SLAPD_DEFAULT_GROUPEVALNESTLEVEL 0 @@ -2254,7 +2254,7 @@ typedef struct _slapdFrontendConfig int idletimeout; slapi_int_t ioblocktimeout; slapi_onoff_t lastmod; - int maxdescriptors; + int64_t maxdescriptors; int conntablesize; slapi_int_t maxthreadsperconn; int outbound_ldap_io_timeout; diff --git a/wrappers/systemd.template.service.in b/wrappers/systemd.template.service.in index 0d88900b6..4c1b13d98 100644 --- a/wrappers/systemd.template.service.in +++ b/wrappers/systemd.template.service.in @@ -28,7 +28,6 @@ EnvironmentFile=@initconfigdir@/@package_name@-%i PIDFile=@localstatedir@/run/@package_name@/slapd-%i.pid ExecStartPre=@sbindir@/ds_systemd_ask_password_acl @instconfigdir@/slapd-%i/dse.ldif ExecStart=@sbindir@/ns-slapd -D @instconfigdir@/slapd-%i -i @localstatedir@/run/@package_name@/slapd-%i.pid - # Hardening options: # PrivateDevices=true # ProtectSystem=true diff --git a/wrappers/systemd.template.sysconfig b/wrappers/systemd.template.sysconfig index 903876b17..76c004d40 100644 --- a/wrappers/systemd.template.sysconfig +++ b/wrappers/systemd.template.sysconfig @@ -7,7 +7,8 @@ # This controls the number of file handles avaliable. File handles # correlate to sockets for the process, and our access to logs and -# databases. +# databases. Note, the configuration setting in Directory Server, +# "nsslapd-maxdescriptors", can override this limit. LimitNOFILE=16384 # You can limit the memory in the cgroup with these, and ns-slapd -- 2.17.2