def serve(cfg, sockl, threadmax): global totloops, totconns # Our expiry timers. ttick = 0 if 'dropipafter' not in cfg: expireevery = -1 elif 'expireevery' in cfg: expireevery = cfg['expireevery'] else: # Pick a default. expireevery = 60 # Set up our thread configuration object. tcfg = ThreadConf(cfg, threadmax) # Do we want to drop a file on error? droponerr = 0 if 'onfileerror' in cfg and cfg['onfileerror'] == 'drop': droponerr = 1 # Set up the objects through which we will obtain the roots of # the rules and actions evaluators. loadRules = Reloader(cfg['rulefile'], rules.parsefile, rules.BadInput, "rules", droponerr) loadActs = Reloader(cfg['actionfile'], actions.parsefile, actions.BadAction, "actions", droponerr) # We attempt our first load now, rather than waiting for our # first connection, so that we produce feedback on program # startup about broken configuration files. rroot = loadRules.curroot() aroot = loadActs.curroot() # Having acquired our initial setup, start running forever. while 1: # We are now done. Perform periodic sweep actions. # Note that 'expireevery' of 0 means 'on every connection'; # use a negative number to turn it off. if expireevery >= 0 and time.time() - ttick >= expireevery: log.debug(3, "Expiring the IP times info") ttick = time.time() hinfo.expireiptimes() # (we do these at the bottom, because they may take some # time, and we want to service our active connection first.) # Yes, yes, this is the top. Relative to getting a new # socket to deal with, it's the bottom. newsocks = proc.nextconnection(sockl, reaper) # Immediately attempt reload; god knows how long we've # been asleep. rroot = loadRules.curroot() aroot = loadActs.curroot() # We may have rules that have completed evaluations # waiting for us to turn them into actual actions. dispatchaction(aroot) # Dispatch does all the work of handling a new connection. # newsocks is [] if we were just being signalled that # there was work waiting for dispatchaction(). # dispatch() will thread or not thread things as # appropriate. if newsocks: totloops += 1; totconns += len(newsocks) for newsock in newsocks: dispatch(newsock, rroot, aroot, tcfg) # Make sure we are disassociating ourselves from the new # sockets to encourage their deallocation & cleanup, if any # is necessary. newsocks = None