mirage / qubes-mirage-firewall

A Mirage firewall VM for QubesOS
208 stars 28 forks source link

remove frameQ #150

Closed palainp closed 1 year ago

palainp commented 1 year ago

This update mainly removes code that is no longer needed:

hannesm commented 1 year ago

In my_nat.ml, should we as well apply the diff:

diff --git a/my_nat.ml b/my_nat.ml
index 2652ff5..94cf790 100644
--- a/my_nat.ml
+++ b/my_nat.ml
@@ -64,15 +64,7 @@ let remove_connections t ports ip =
   ports.nat_icmp := Ports.diff !(ports.nat_icmp) (Ports.of_list freed_ports.Mirage_nat.icmp)

 let add_nat_rule_and_translate t ports ~xl_host action packet =
-  let apply_action xl_port =
-    Lwt.catch (fun () ->
-        Nat.add t.table packet (xl_host, xl_port) action
-      )
-      (function
-        | Out_of_memory -> Lwt.return (Error `Out_of_memory)
-        | x -> Lwt.fail x
-      )
-  in
+  let apply_action xl_port = Nat.add t.table packet (xl_host, xl_port) action in
   let rec aux ~retries =
     let nat_ports, dns_ports =
       match packet with
@@ -82,12 +74,6 @@ let add_nat_rule_and_translate t ports ~xl_host action packet =
     in
     let xl_port = pick_free_port ~nat_ports ~dns_ports in
     apply_action xl_port >>= function
-    | Error `Out_of_memory ->
-      (* Because hash tables resize in big steps, this can happen even if we have a fair
-         chunk of free memory. *)
-      Log.warn (fun f -> f "Out_of_memory adding NAT rule. Dropping NAT table...");
-      reset t ports >>= fun () ->
-      aux ~retries:(retries - 1)
     | Error `Overlap when retries < 0 -> Lwt.return (Error "Too many retries")
     | Error `Overlap ->
       if retries = 0 then (
hannesm commented 1 year ago

the proposed my_nat changes above are done in #151

hannesm commented 1 year ago

thanks, merged via #152