search for: limit_close

This is a second version of the limit filter. v1 was posted here: https://www.redhat.com/archives/libguestfs/2020-March/msg00015.html I didn't bother to repost the other three patches because they are the same. The difference is this version of the filter takes security more seriously. It shouldn't be possible for malicious clients to connect more than limit=N times to the plugin now,

...use clients can artificially slow down + * the NBD negotiation in order to bypass the limit otherwise. + */ + if (limit > 0 && connections >= limit) { + too_many_clients_error (); + return NULL; + } + + connections++; + return NBDKIT_HANDLE_NOT_NEEDED; +} + +static void +limit_close (void *handle) +{ + ACQUIRE_LOCK_FOR_CURRENT_SCOPE (&lock); + connections--; +} + +static struct nbdkit_filter filter = { + .name = "limit", + .longname = "nbdkit limit filter", + .config = limit_config, + .preconnect = limit_pre...

...tion in order to bypass the limit otherwise. > + */ > + if (limit > 0 && connections >= limit) { > + too_many_clients_error (); > + return NULL; > + } > + > + connections++; > + return NBDKIT_HANDLE_NOT_NEEDED; > +} > + > +static void > +limit_close (void *handle) > +{ > + ACQUIRE_LOCK_FOR_CURRENT_SCOPE (&lock); > + connections--; > +} Overall looks good. As you say, we may want to enhance nbdkit with a way to enforce that a client complete handshake within a given time limit rather than dragging their feet, but that is s...

This adds a new nbdkit_shutdown() API whereby plugins and filters can request that the server shuts down (asynchronously) during the serving phase. Two new filters are added, one of which depends on this feature and the other not needing it but being somewhat related. Rich.