-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Pablo Neira Ayuso says: ==================== Netfilter ingress support (v4) This is the v4 round of patches to add the Netfilter ingress hook, it basically comes in two steps: 1) Add the CONFIG_NET_INGRESS switch to wrap the ingress static key around it. The idea is to use the same global static key to avoid adding more code to the hot path. 2) Add the Netfilter ingress hook after the tc ingress hook, under the global ingress_needed static key. As I said, the netfilter ingress hook also has its own static key, that is nested under the global static key. Please, see patch 5/5 for performance numbers and more information. I originally started this next round, as it was suggested, exploring the independent static key for netfilter ingress just after tc ingress, but the results that I gathered from that patch are not good for non-users: Result: OK: 6425927(c6425843+d83) usec, 100000000 (60byte,0frags) 15561955pps 7469Mb/sec (7469738400bps) errors: 100000000 this roughly means 500Kpps less performance wrt. the base numbers, so that's the reason why I discarded that approach and I focused on this. The idea of this patchset is to open the window to nf_tables, which comes with features that will work out-of-the-box (once the boiler plate code to support the 'netdev' table family is in place), to avoid repeating myself [1], the most relevant features are: 1) Multi-dimensional key dictionary lookups. 2) Arbitrary stateful flow tables. 3) Transactions and good support for dynamic updates. But there are also interest aspects to consider from userspace, such as the ability to support new layer 2 protocols without kernel updates, a well-defined netlink interface, userspace libraries and utilities for third party applications, among others. I hope we can be happy with this approach. Please, apply. Thanks. [1] http://marc.info/?l=netfilter-devel&m=143033337020328&w=2 ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
- Loading branch information
Showing
10 changed files
with
159 additions
and
23 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,41 @@ | ||
#ifndef _NETFILTER_INGRESS_H_ | ||
#define _NETFILTER_INGRESS_H_ | ||
|
||
#include <linux/netfilter.h> | ||
#include <linux/netdevice.h> | ||
|
||
#ifdef CONFIG_NETFILTER_INGRESS | ||
static inline int nf_hook_ingress_active(struct sk_buff *skb) | ||
{ | ||
return nf_hook_list_active(&skb->dev->nf_hooks_ingress, | ||
NFPROTO_NETDEV, NF_NETDEV_INGRESS); | ||
} | ||
|
||
static inline int nf_hook_ingress(struct sk_buff *skb) | ||
{ | ||
struct nf_hook_state state; | ||
|
||
nf_hook_state_init(&state, &skb->dev->nf_hooks_ingress, | ||
NF_NETDEV_INGRESS, INT_MIN, NFPROTO_NETDEV, NULL, | ||
skb->dev, NULL, NULL); | ||
return nf_hook_slow(skb, &state); | ||
} | ||
|
||
static inline void nf_hook_ingress_init(struct net_device *dev) | ||
{ | ||
INIT_LIST_HEAD(&dev->nf_hooks_ingress); | ||
} | ||
#else /* CONFIG_NETFILTER_INGRESS */ | ||
static inline int nf_hook_ingress_active(struct sk_buff *skb) | ||
{ | ||
return 0; | ||
} | ||
|
||
static inline int nf_hook_ingress(struct sk_buff *skb) | ||
{ | ||
return 0; | ||
} | ||
|
||
static inline void nf_hook_ingress_init(struct net_device *dev) {} | ||
#endif /* CONFIG_NETFILTER_INGRESS */ | ||
#endif /* _NETFILTER_INGRESS_H_ */ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters