Add delta threshold configuration option

This was in the tweakables wishlist. Previously hardcoded as 64.

It had to skip the line because it's needed by the upcoming session
desync commit.

diff --git a/man/fort.8 b/man/fort.8
index bac02f984c524b8843f126c4fc64a3b3dd9f53ef..0eed73e382596bc2d3dbfe78f96ff4b9c478033a 100644 (file)
--- a/man/fort.8
+++ b/man/fort.8
@@ -862,6 +862,15 @@ By default, the path has a NULL value.
 .RE
 .P
 
+.B \-\-rrdp.delta-threshold=\fIUNSIGNED_INTEGER\fR
+.RS 4
+Maximum deltas to explode per RRDP session, per iteration.
+.P
+(If the RRDP notification lists more than this amount of unprocessed deltas,
+Fort will reset the session, exploding the snapshot instead.)
+.RE
+.P
+
 .B \-\-rsync.enabled=\fItrue\fR|\fIfalse\fR
 .RS 4
 Enables RSYNC requests.

diff --git a/src/config.c b/src/config.c
index de54d9086e000f9a36f2f8f612d95baa35227659..f2203c979356a2f552e95b7781195d9866705461 100644 (file)
--- a/src/config.c
+++ b/src/config.c
@@ -127,6 +127,17 @@ struct rpki_config {
                char *ca_path;
        } http;
 
+       struct {
+               /*
+                * Maximum deltas to explode per RRDP session, per iteration.
+                *
+                * (If the RRDP notification lists more than this amount of
+                * unprocessed deltas, Fort will reset the session, exploding
+                * the snapshot instead.)
+                */
+               unsigned int delta_threshold;
+       } rrdp;
+
        struct {
                /** Enables operation logs **/
                bool enabled;
@@ -582,6 +593,18 @@ static const struct option_field options[] = {
                .json_null_allowed = false,
        },
 
+       /* RRDP */
+       {
+               .id = 10000,
+               .name = "rrdp.delta-threshold",
+               .type = &gt_uint,
+               .offset = offsetof(struct rpki_config, rrdp.delta_threshold),
+               .doc = "Maximum deltas to explode per RRDP session, per iteration. "
+                      "(Fall back to snapshot if threshold exceeded.)",
+               .min = 1,
+               .max = 128,
+       },
+
        /* Logging fields */
        {
                .id = 4000,
@@ -950,6 +973,9 @@ set_default_values(void)
        rpki_config.http.max_file_size = 1000000000;
        rpki_config.http.ca_path = NULL; /* Use system default */
 
+       /* TODO (fine) 64 may be too much; optimize it. */
+       rpki_config.rrdp.delta_threshold = 64;
+
        rpki_config.log.enabled = true;
        rpki_config.log.tag = NULL;
        rpki_config.log.color = false;
@@ -1423,6 +1449,12 @@ config_get_http_ca_path(void)
        return rpki_config.http.ca_path;
 }
 
+unsigned int
+config_get_rrdp_delta_threshold(void)
+{
+       return rpki_config.rrdp.delta_threshold;
+}
+
 char const *
 config_get_output_roa(void)
 {

diff --git a/src/config.h b/src/config.h
index 8f9738145f6a99ecbfb3e0a763c27355b604bd43..09e68f5f99024401807bdedd04b2d39cdca029bb 100644 (file)
--- a/src/config.h
+++ b/src/config.h
@@ -40,6 +40,7 @@ long config_get_http_low_speed_limit(void);
 long config_get_http_low_speed_time(void);
 long config_get_http_max_file_size(void);
 char const *config_get_http_ca_path(void);
+unsigned int config_get_rrdp_delta_threshold(void);
 bool config_get_rsync_enabled(void);
 unsigned int config_get_rsync_priority(void);
 unsigned int config_get_rsync_retry_count(void);

diff --git a/src/rrdp.c b/src/rrdp.c
index 6f60a9edfb9e0c9f98891a4567bd0544b4f3a052..d0a306afb7508b4c5b3d0b3650b22c9cbe8f3ea9 100644 (file)
--- a/src/rrdp.c
+++ b/src/rrdp.c
@@ -6,6 +6,7 @@
 
 #include "alloc.h"
 #include "common.h"
+#include "config.h"
 #include "file.h"
 #include "log.h"
 #include "thread_var.h"
@@ -893,8 +894,7 @@ handle_deltas(struct update_notification *notif, struct rrdp_serial *serial)
        }
        diff = BN_get_word(diff_bn);
        BN_free(diff_bn);
-       /* TODO (fine) 64 may be too much; optimize it. */
-       if (diff > 64ul || diff > notif->deltas.len)
+       if (diff > config_get_rrdp_delta_threshold() || diff > notif->deltas.len)
                return pr_val_err("Cached RPP is too old. (Cached serial: %s; current serial: %s)",
                    serial->str, notif->session.serial.str);
 

diff --git a/test/rrdp_test.c b/test/rrdp_test.c
index cf67f788890aa3d470352a62a244fd9ca02f99ed..ba6385ec5f2dceac9097495c10d5ce7f9fc7831c 100644 (file)
--- a/test/rrdp_test.c
+++ b/test/rrdp_test.c
@@ -39,6 +39,7 @@ MOCK_ABORT_PTR(validation_cache, rpki_cache, struct validation *state)
 MOCK(state_retrieve, struct validation *, NULL, void)
 MOCK(validation_tal, struct tal *, NULL, struct validation *state)
 MOCK(tal_get_file_name, char const *, "", struct tal *tal)
+MOCK_UINT(config_get_rrdp_delta_threshold, 64, void)
 
 /* Mocks end */