Crash on multiple IPFW rules

[chocosnat]

I use the latest (dev) branch f-stack, 1.21. I've configured f-stack with IPFW support. Nginx supports 32 worker_processes on 32-kernel host. System is configured with 13968 huge pages:
cat /proc/meminfo | grep Huge
AnonHugePages: 1724416 kB
ShmemHugePages: 0 kB
HugePages_Total: 13968
HugePages_Free: 12330
HugePages_Rsvd: 0
HugePages_Surp: 0
Hugepagesize: 2048 kB
Hugetlb: 28606464 kB

With a short IPFW rules list everything works fine. But if I add more than 400 IPFW rules per each nginx process, ipfw will hang up, EAL allocation errors will be logged and traffic will not be handled. What is wrong? How can I fix this problem?

[jfb8856606]

Root cause identified: the IPC message buffer size MAX_MSG_BUF_SIZE in lib/ff_msg.h is only 10240 bytes (10KB). When the total IPFW rules data exceeds this limit, the ff_ipfw tool returns EINVAL at tools/ipfw/compat.c:60 (len > msg->buf_len), and the operation fails silently or causes EAL allocation errors.

With 400+ IPFW rules, a getsockopt(IP_FW3) call to retrieve all rules can easily exceed the 10KB buffer. The fix would be to either:

1. Increase MAX_MSG_BUF_SIZE to accommodate more rules
2. Implement dynamic buffer allocation for IPC messages based on actual data size

Keeping this issue open until the buffer size limitation is addressed.