netdev - Re: [PATCH 6/6] net: move qdisc ingress filtering on top of netfilter ingress hooks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5542D3B7.1060307@mojatatu.com>
Date:	Thu, 30 Apr 2015 21:15:35 -0400
From:	Jamal Hadi Salim <jhs@...atatu.com>
To:	Pablo Neira Ayuso <pablo@...filter.org>
CC:	Patrick McHardy <kaber@...sh.net>,
	Alexei Starovoitov <alexei.starovoitov@...il.com>,
	Daniel Borkmann <daniel@...earbox.net>,
	netfilter-devel@...r.kernel.org, davem@...emloft.net,
	netdev@...r.kernel.org
Subject: Re: [PATCH 6/6] net: move qdisc ingress filtering on top of netfilter
 ingress hooks

Pablo,

On 04/30/15 11:33, Pablo Neira Ayuso wrote:

>
> You keep saying that qdisc ingress outperforms, that's only right for
> just a very slight difference when comparing it with no rules on
> single CPU (when ported to the common playground of the generic hook
> infrastructure). On SMP nftables will outperform, even more if the
> ruleset is arranged in a non-linear list fashion, with all the new
> tricks that we got.
>

I am interested to see the numbers. I think this would be a great paper;
it is extremely tempting to spend time on it.

> Anyway, let's take this "nftables vs. qdisc ingress" discussion to an
> end. I think the main point of this discussion is to provide a generic
> entry point to ingress filtering (for both qdisc ingress and nftables)
> that, if unused, doesn't harm performance of the critical path
> netif_receive_core() path at all. Thus, users can choose what they
> want, I have heard you saying several times: "To each their poison"
> and I like that.
>

Yes - but my good friend Patrick is not saying that.
I dont want to turn on netfilter in order to get tc actions on ingress.
And i dont want to be slowed down because now the code path has become
longer. We are trying to prune the code path. If somehow you can work to
not affect performance then we can live well together.

cheers,
jamal
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html