netdev - Re: [PATCH 1/4] netns: Tag the network flow with the network namespace it is in (v2)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 05 Dec 2007 02:10:36 -0800 (PST)
From:	David Miller <davem@...emloft.net>
To:	den@...ru
Cc:	shemminger@...ux-foundation.org, den@...nvz.org, devel@...nvz.org,
	netdev@...r.kernel.org, containers@...ts.osdl.org
Subject: Re: [PATCH 1/4] netns: Tag the network flow with the network
 namespace it is in (v2)

From: "Denis V. Lunev" <den@...ru>
Date: Tue, 04 Dec 2007 21:42:49 +0300

> Stephen Hemminger wrote:
> > Can this be made conditional on network namespaces being configured on?
> > That way the flow structure won't have to grow taking more space.
> > It matters in DoS attacks where flow cache becomes a critical resource.
> 
> could you exactly point me out the flow cache your are talking about.
> Is this dst entry cache or struct flow_cache described in the
> net/core/flow.c
> 
> For the latter case, there is completely no difference in the size on my
> x86_64 host with SLAB allocator, i.e. there are 30 objects per slab
> with/without fl_net (objsize = 128).

This may be true, but another thing to consider is that flow
objects sit on the stack in many call sites.

I won't let this block your patch, but I want you to be cognizant
of this issue in the future, it's not all about SLAB.

You should also BTW consider how this change will effect D-cache
access patterns and L2 cache utilization.  Some object access
patterns may not fit in the cache, which did beforehand, which
can kill performance.  We're talking about something which gets
touched multiple times per packet at routing rates in the
million packet per second range.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html