linux-kernel - Re: [RFC PATCH v2] bridge: make it possible for packets to traverse the bridge without hitting netfilter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150306163700.GC20382@breakpoint.cc>
Date:	Fri, 6 Mar 2015 17:37:00 +0100
From:	Florian Westphal <fw@...len.de>
To:	Pablo Neira Ayuso <pablo@...filter.org>
Cc:	Imre Palik <imrep.amz@...il.com>,
	David Miller <davem@...emloft.net>, imrep@...zon.de,
	fw@...len.de, bridge@...ts.linux-foundation.org,
	stephen@...workplumber.org, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org, aliguori@...zon.com, nbd@...nwrt.org
Subject: Re: [RFC PATCH v2] bridge: make it possible for packets to traverse
 the bridge without hitting netfilter

Pablo Neira Ayuso <pablo@...filter.org> wrote:
> On Fri, Mar 06, 2015 at 11:34:29AM +0100, Imre Palik wrote:
> > On 02/26/15 17:34, David Miller wrote:
> > > From: Imre Palik <imrep@...zon.de>
> > > Date: Thu, 26 Feb 2015 11:19:25 +0100
> > > 
> > >> If you are looking for peculiarities in my setup then here they are:
> > >> I am on 4k pages, and perf is not working :-(
> > >> (I am trying to fix those too, but that is far from being a low hanging fruit.)
> > >> So my guess would be that the packet pipeline doesn't fit in the cache/tlb
> > > 
> > > Pure specualtion until you can actually use perf to measure these
> > > things.
> > > 
> > > And I don't want to apply patches which were designed based upon
> > > pure speculation.
> > > 
> > 
> > I did performance measurements in the following way:
> > 
> > Removed those pieces of the packet pipeline that I don't necessarily
> > need one-by-one.  Then measured their effect on small packet
> > performance.
> > 
> > This was the only part that produced considerable effect.
> > 
> > The pure speculation was about why the effect is more than 15%
> > increase in packet throughput, although the code path avoided
> > contains way less code than 15% of the packet pipeline.  It seems,
> > Felix Fietkau profiled similar changes, and found my guess well
> > founded.
> > 
> > Now could anybody explain me what else is wrong with my patch?
> 
> We have to come up with a more generic solution for this.

Jiri Benc suggested to allowing to attach netfilter hooks e.g. via tc
action, maybe that would be an option worth investigating.

Then you could for instance add filtering rules only to the bridge port
that needs it.

> These sysfs tweaks you're proposing look to me like an obscure way to
> tune this.

I agree, adding more tunables isn't all that helpful, in the past this
only helped to prolong the problem.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/