banip: fix cpu core calculation

- only cap the cpu core count by available memory if it was auto-detected,
  a manually set 'ban_cores' is now authoritative and no longer lowered
- readme update: clarify that the auto-cap does not apply to a manually
  set core count

Signed-off-by: Dirk Brenken <redacted>

diff --git a/net/banip/Makefile b/net/banip/Makefile
index 3f00079143cbc7dbb70c6c3f829c9f16c3d616bf..ea7f46089384b66f26f21f19b0dec6102b3f3723 100644 (file)
--- a/net/banip/Makefile
+++ b/net/banip/Makefile
@@ -6,7 +6,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=banip
 PKG_VERSION:=1.8.11
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 PKG_LICENSE:=GPL-3.0-or-later
 PKG_MAINTAINER:=Dirk Brenken <dev@brenken.org>
 

diff --git a/net/banip/files/README.md b/net/banip/files/README.md
index 2c955cd3acbf33dd52db2385dd62a8c39b91fc45..0cbc43d802e9995a6298207bc13c5e1ab84cb94c 100644 (file)
--- a/net/banip/files/README.md
+++ b/net/banip/files/README.md
@@ -189,7 +189,7 @@ The `report` sub-command accepts an output mode: `text` (default, human-readable
 | ban_loglimit            | option | 100                           | scan only the last n log entries permanently. A value of `0` disables the monitor                                 |
 | ban_logcount            | option | 1                             | how many times the IP must appear in the log per blocking cycle to trigger auto-blocking                          |
 | ban_logterm             | list   | regex                         | various regex for logfile parsing (default: dropbear, sshd, luci, asterisk and cgi-remote events)                 |
-| ban_logreadfile         | option | - / logread                   | parse this log file via tail instead of the default logread; if left empty (default) banIP reads the system log via logread |
+| ban_logreadfile         | option | - / logread                   | parse this log file via tail instead of the default logread; by default banIP reads the system log via logread    |
 | ban_autodetect          | option | 1                             | auto-detect wan interfaces, devices and subnets                                                                   |
 | ban_debug               | option | 0                             | enable banIP related debug logging                                                                                |
 | ban_icmplimit           | option | 25                            | threshold in number of packets to detect icmp DoS in prerouting chain. A value of `0` disables this safeguard     |
@@ -222,7 +222,7 @@ The `report` sub-command accepts an output mode: `text` (default, human-readable
 | ban_triggerdelay        | option | 20                            | trigger timeout during interface reload and boot                                                                  |
 | ban_deduplicate         | option | 1                             | deduplicate IP addresses across all active Sets (see optional feed flag `dup` below)                              |
 | ban_splitsize           | option | 0                             | split the processing/loading of Sets in chunks of n lines/members (saves RAM)                                     |
-| ban_cores               | option | - / autodetect                | limit the cpu cores used by banIP (saves RAM)                                                                     |
+| ban_cores               | option | - / autodetect                | limit the cpu cores used by banIP; only auto-detection is memory-capped                                           |
 | ban_nftloglevel         | option | warn                          | nft loglevel, values: emerg, alert, crit, err, warn, notice, info, debug                                          |
 | ban_nftpriority         | option | -100                          | nft priority for the banIP table (the prerouting table is fixed to priority -150)                                 |
 | ban_nftpolicy           | option | memory                        | nft policy for banIP-related Sets, values: memory, performance                                                    |
@@ -381,7 +381,7 @@ List only elements with hits of a given Set with hit counters, e.g.:
 nftables supports the atomic loading of firewall rules (incl. elements), which is cool but unfortunately is also very memory intensive. To reduce the memory pressure on low memory systems (i.e. those with 256-512MB RAM), you should optimize your configuration with the following options:
 
 * point `ban_basedir`, `ban_reportdir`, `ban_backupdir` and `ban_errordir` to an external usb drive or ssd
-* set `ban_cores` to `1` (only useful on a multicore system) to force sequential feed processing
+* set `ban_cores` to `1` (only useful on a multicore system) to force sequential feed processing. The autodetected value is additionally capped to the available memory; a manually set value is always used as-is and is never lowered
 * set `ban_splitsize` e.g. to `1024` to split the load of an external Set after every 1024 lines/elements
 * set `ban_nftcount` to `0` to deactivate the CPU- and memory-intensive creation of counter elements at chain / Set level. With this setting, all packet counters are disabled, the Set Reporting will show zero values for these even when the protection rules are actively dropping traffic. Only the DoS protection counters (`syn-flood`, `udp-flood`, `icmp-flood`, etc.) are always enabled.
 

diff --git a/net/banip/files/banip-functions.sh b/net/banip/files/banip-functions.sh
index 982e0621bd3b210d9f39d124e7279bec10d1b789..a14fa1f371c7178a8c9cfe85b713038bbc19bd24 100644 (file)
--- a/net/banip/files/banip-functions.sh
+++ b/net/banip/files/banip-functions.sh
@@ -175,16 +175,17 @@ f_system() {
        ban_sysver="$("${ban_ubuscmd}" -S call system board 2>>"${ban_errorlog}" | "${ban_jsoncmd}" -ql1 -e '@.model' -e '@.release.target' -e '@.release.distribution' -e '@.release.version' -e '@.release.revision' |
                "${ban_awkcmd}" 'BEGIN{RS="";FS="\n"}{printf "%s, %s, %s %s (%s)",$1,$2,$3,$4,$5}')"
 
-       # detect cpu cores and cap them by available memory for memory-aware
-       # parallel processing (>= 48 MiB per job, floored to 1 core); a user-set
-       # ban_cores is only ever lowered by the cap, never raised
+       # detect cpu cores and available memory for memory-aware parallel processing
+       # 'mem_cores' is only calculated for auto-detected cores, a manually set 'ban_cores' is never capped
        #
-       [ -z "${ban_cores}" ] && ban_cores="$("${ban_grepcmd}" -cm16 '^processor' /proc/cpuinfo 2>>"${ban_errorlog}")"
-       case "${ban_cores}" in "" | 0 | *[!0-9]*) ban_cores="1" ;; esac
        free_mem="$(f_mem)"
-       mem_cores="$((free_mem / 48))"
-       [ "${mem_cores}" -lt "1" ] && mem_cores="1"
-       [ "${ban_cores}" -gt "1" ] && [ "${mem_cores}" -lt "${ban_cores}" ] && ban_cores="${mem_cores}"
+       if [ -z "${ban_cores}" ]; then
+               ban_cores="$("${ban_grepcmd}" -cm16 '^processor' /proc/cpuinfo 2>>"${ban_errorlog}")"
+               mem_cores="$((free_mem / 48))"
+               [ "${mem_cores}" -lt "1" ] && mem_cores="1"
+       fi
+       case "${ban_cores}" in "" | 0 | *[!0-9]*) ban_cores="1" ;; esac
+       [ -n "${mem_cores}" ] && [ "${mem_cores}" -lt "${ban_cores}" ] && ban_cores="${mem_cores}"
 
        # derive the GNU sort buffer from available memory (>= 8 MiB per core);
        # only applied when a coreutils sort is present (busybox sort has no --buffer-size)