netdev - Re: [PATCH] skbuff: Add new tc classify variable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120207134553.220a1da5@nehalam.linuxnetplumber.net>
Date:	Tue, 7 Feb 2012 13:45:53 -0800
From:	Stephen Hemminger <shemminger@...tta.com>
To:	Simon Wunderlich <simon.wunderlich@...03.tu-chemnitz.de>
Cc:	netdev@...r.kernel.org
Subject: Re: [PATCH] skbuff: Add new tc classify variable

On Tue, 7 Feb 2012 20:57:29 +0100
Simon Wunderlich <simon.wunderlich@...03.tu-chemnitz.de> wrote:

> On Tue, Feb 07, 2012 at 11:05:22AM -0800, Stephen Hemminger wrote:
> > On Tue,  7 Feb 2012 19:39:08 +0100
> > Simon Wunderlich <simon.wunderlich@...03.tu-chemnitz.de> wrote:
> > 
> > I don't understand why this is better, we already have mark to do this.
> > Your method saves adding a tc filter to map mark to classid, but that is hardly
> > a huge burden.
> 
> Unfortunately, it is. We have previously built our trees by setting marks with iptables
> and matching the masks with tc and the u32 matcher, but we got a rather big performance
> impact as soon as the number of users grow. The target platform are WiFi access points.
> By using the proposed patch, the performance stays nearly constant at a growing number
> of users.

The problem then is not the use of marks but having to add a filter rule for
each mark. We need something like u32 hash but for marks to build a table
of mark -> class id.  The current method uses a linear list of filter rules,
which is an obvious bottleneck with lots of classes.

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)