From: Florian Westphal <fw@strlen.de>
To: Laura Garcia <nevola@gmail.com>
Cc: Florian Westphal <fw@strlen.de>, Liping Zhang <zlpnobody@163.com>,
pablo@netfilter.org, netfilter-devel@vger.kernel.org,
Liping Zhang <liping.zhang@spreadtrum.com>
Subject: Re: [PATCH nf-next] netfilter: nft_queue: add _SREG_FROM and _SRGE_TO to select the queue numbers
Date: Mon, 12 Sep 2016 14:28:49 +0200 [thread overview]
Message-ID: <20160912122849.GD27566@breakpoint.cc> (raw)
In-Reply-To: <20160912105313.GB6772@sonyv>
Laura Garcia <nevola@gmail.com> wrote:
> On Sun, Sep 11, 2016 at 11:12:26PM +0200, Florian Westphal wrote:
> > Liping Zhang <zlpnobody@163.com> wrote:
> > > From: Liping Zhang <liping.zhang@spreadtrum.com>
> > >
> > > Currently, the user can specify the queue numbers by _QUEUE_NUM and
> > > _QUEUE_TOTAL attributes, this is enough in most situations.
> > >
> > > But acctually, it is not very flexible, for example:
> > > tcp dport 80 mapped to queue0
> > > tcp dport 81 mapped to queue1
> > > tcp dport 82 mapped to queue2
> > > In order to do this thing, we must add 3 nft rules, and more
> > > mapping means more rules ...
> > >
> > > So similer to nft_nat, take two registers to select the queue numbers,
> > > then we can add one simple rule to mapping queues, maybe like this:
> > > queue num tcp dport map { 80:0, 81:1, 82:2 ... }
> >
> > I like this.
> >
> > My first thought was that it would be better to just support one single
> > sreg (the queue number) and eventually externalize the hashing/queue
> > selection:
> >
> > queue num jhash ip saddr . ip daddr mod ...
> >
> > Problem is that with plain jhash we won't get a symmetric hash
> > for origin and reply, so for this we would need a new expression/hash
> > mode.
> >
> > We would also need another expression to allow distribution
> > starting with a queue other than 0.
>
> For such feature, I've already sent a patch "netfilter: nft_hash: Add
> hash offset value" in order to set an initial value for the hash
> expression. I think it'll be available in the tree soon.
Yes, but that means one would always need to use hash.
Maybe thats indeed sufficient since it already provides a modulo
functionality.
I was thinking
nfqueue num meta cpu ...
nfqueue num meta hash ... [ i.e. use skb->hash, not supported right now ]
nfqueue num meta mark
nfqueue num ct mark
etc. so we would have no control over start qnum (something like
'nfqueue num (meta cpu + 10000)' ...
Admittingly, I do not see a big drawback if we'd always have to
feed it to jhash first.
next prev parent reply other threads:[~2016-09-12 12:28 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-11 14:05 [PATCH nf-next] netfilter: nf_queue: get rid of dependency on IP6_NF_IPTABLES Liping Zhang
2016-09-11 14:05 ` [PATCH nf-next] netfilter: nft_queue: add _SREG_FROM and _SRGE_TO to select the queue numbers Liping Zhang
2016-09-11 21:12 ` Florian Westphal
2016-09-12 2:19 ` Liping Zhang
2016-09-12 10:53 ` Laura Garcia
2016-09-12 12:28 ` Florian Westphal [this message]
2016-09-12 12:39 ` Pablo Neira Ayuso
2016-09-12 12:09 ` Pablo Neira Ayuso
2016-09-12 12:22 ` Florian Westphal
2016-09-12 12:32 ` Pablo Neira Ayuso
2016-09-12 13:18 ` Florian Westphal
2016-09-13 9:19 ` Pablo Neira Ayuso
2016-09-13 12:19 ` Liping Zhang
2016-09-12 17:50 ` [PATCH nf-next] netfilter: nf_queue: get rid of dependency on IP6_NF_IPTABLES Pablo Neira Ayuso
2016-09-13 5:45 ` Liping Zhang
2016-09-13 9:10 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160912122849.GD27566@breakpoint.cc \
--to=fw@strlen.de \
--cc=liping.zhang@spreadtrum.com \
--cc=netfilter-devel@vger.kernel.org \
--cc=nevola@gmail.com \
--cc=pablo@netfilter.org \
--cc=zlpnobody@163.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.