netdev - Re: [PATCH 6/6] net: move qdisc ingress filtering on top of netfilter ingress hooks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 30 Apr 2015 12:12:04 +0200
From:	Pablo Neira Ayuso <pablo@...filter.org>
To:	Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc:	Patrick McHardy <kaber@...sh.net>,
	Daniel Borkmann <daniel@...earbox.net>,
	netfilter-devel@...r.kernel.org, davem@...emloft.net,
	netdev@...r.kernel.org, jhs@...atatu.com
Subject: Re: [PATCH 6/6] net: move qdisc ingress filtering on top of
 netfilter ingress hooks

On Wed, Apr 29, 2015 at 06:16:35PM -0700, Alexei Starovoitov wrote:
> On Thu, Apr 30, 2015 at 02:48:39AM +0200, Patrick McHardy wrote:
> > Netfilter is based on hook chains. The cost when only using a single hook
> > is minimal (as Pablo showed in his numbers), but even if only using
> > TC and a single netfilter classifier chain, there has to be some relative
> > ordering and the hooks provide this in a generic way.
>
> Unfortunately the numbers that Pablo shown are not measuring
> the right thing.

The numbers I've shown were measuring the critical ingress path. I
never posted numbers on generic hook infrastructure.

> > 840203pps 403Mb/sec
>
> this is 20 times less than what they should be.

It's ~10% less, because obviously we run more code in the generic hook
infrastructure, as they provide more features. So far it was only
possible to register one single chain at ingress. Eric Dumazet already
indicated that this benchmark only measures *one single CPU* and
icache is fully populated. The numbers with smp will go worse because
of the central lock contention.

These are the numbers I got banging *one single CPU*:

* Without patches + qdisc ingress:

Result: OK: 16298126(c16298125+d0) usec, 10000000 (60byte,0frags)
  613567pps 294Mb/sec (294512160bps) errors: 10000000

* With patches + qdisc ingress on top of hooks:

Result: OK: 18339281(c18339280+d0) usec, 10000000 (60byte,0frags)
  545277pps 261Mb/sec (261732960bps) errors: 10000000

* With patches + nftables ingress chain:

Result: OK: 17118167(c17118167+d0) usec, 10000000 (60byte,0frags)

  584174pps 280Mb/sec (280403520bps) errors: 10000000
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html