From: Evgeniy Polyakov <johnpol@2ka•mipt.ru>
To: Herbert Xu <herbert@gondor•apana.org.au>
Cc: "David S. Miller" <davem@davemloft•net>,
netdev@vger•kernel.org, Alexey Kuznetsov <kuznet@ms2•inr.ac.ru>,
jamal <hadi@cyberus•ca>
Subject: Re: [PKT_SCHED]: Add stateless NAT
Date: Thu, 27 Sep 2007 14:07:53 +0400 [thread overview]
Message-ID: <20070927100753.GA22323@2ka.mipt.ru> (raw)
In-Reply-To: <20070927093358.GA15357@gondor.apana.org.au>
On Thu, Sep 27, 2007 at 05:33:58PM +0800, Herbert Xu (herbert@gondor•apana.org.au) wrote:
> > > +config NET_ACT_NAT
> > > + tristate "Stateless NAT"
> > > + depends on NET_CLS_ACT
> > > + select NETFILTER
> >
> > Argh... People usually do not understand such jokes :)
> > What about not using netfilter helpers and just move them to the
> > accessible header so that no additional slow path would ever be enabled?
>
> Sure. However, as it is it's just including the netfilter core
> which does not mean the inclusion of connection trakcing. It's
> only connection tracking that *may* (so don't flame me for this :)
> pose a scalability problem.
It forces all inpuit/pre/post/forward hooks to be enbled not as a direct
function call, but as additional lookups. And unability to remove
netfilter from config. And just because of couple of checksum helpers...
> > > +++ b/net/sched/act_nat.c
> > ...
> > > +#define NAT_TAB_MASK 15
> >
> > This really wants to be configurable at least via module parameter.
> >
> > > +static struct tcf_common *tcf_nat_ht[NAT_TAB_MASK + 1];
> > > +static u32 nat_idx_gen;
> > > +static DEFINE_RWLOCK(nat_lock);
> >
> > > +static struct tcf_hashinfo nat_hash_info = {
> > > + .htab = tcf_nat_ht,
> > > + .hmask = NAT_TAB_MASK,
> > > + .lock = &nat_lock,
> > > +};
> >
> > When I read this I swear I heard 'I want to be RCU'.
> > But that is another task.
>
> Yes there are a lot of clean-up's that can be done for all
> actions. You're most welcome to send patches in this area.
>
> > > + tcph = (void *)(skb_network_header(skb) + ihl);
> >
> > Were you too lazy to write struct tcphdr here and in other places? :)
>
> Unfortunately it doesn't work. For prerouting, we've not
> entered the IP stack yet so the transport header isn't set.
I meant instead of dereferencing to void * it should be struct tcphdr *.
--
Evgeniy Polyakov
next prev parent reply other threads:[~2007-09-27 10:08 UTC|newest]
Thread overview: 80+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-09-27 7:34 [PKT_SCHED]: Add stateless NAT Herbert Xu
2007-09-27 9:25 ` Evgeniy Polyakov
2007-09-27 9:33 ` Herbert Xu
2007-09-27 10:07 ` Evgeniy Polyakov [this message]
2007-09-27 10:29 ` Herbert Xu
2007-09-27 12:41 ` Evgeniy Polyakov
2007-09-27 12:45 ` Herbert Xu
2007-09-27 13:10 ` Evgeniy Polyakov
2007-09-27 13:16 ` Patrick McHardy
2007-09-27 13:25 ` Evgeniy Polyakov
2007-09-27 13:30 ` Patrick McHardy
2007-09-27 13:33 ` Evgeniy Polyakov
2007-09-27 13:34 ` jamal
2007-09-27 13:20 ` Herbert Xu
2007-09-27 13:29 ` Evgeniy Polyakov
2007-09-27 13:39 ` Patrick McHardy
2007-09-27 19:52 ` David Miller
2007-09-28 8:19 ` Evgeniy Polyakov
2007-09-28 9:16 ` Evgeniy Polyakov
2007-09-28 16:31 ` Patrick McHardy
2007-09-27 12:52 ` jamal
2007-09-27 13:06 ` Evgeniy Polyakov
2007-09-27 12:27 ` Herbert Xu
2007-09-27 12:46 ` jamal
2007-09-27 12:39 ` jamal
2007-09-27 12:58 ` Herbert Xu
2007-09-27 19:48 ` David Miller
2007-09-27 13:01 ` Herbert Xu
2007-09-27 13:16 ` jamal
2007-09-27 19:08 ` David Miller
2007-09-28 16:55 ` Patrick McHardy
2007-09-29 0:51 ` Herbert Xu
2007-09-29 3:37 ` Herbert Xu
2007-09-29 15:21 ` Patrick McHardy
2007-09-29 23:36 ` Herbert Xu
2007-09-30 0:13 ` David Miller
2007-09-30 0:26 ` Herbert Xu
2007-09-30 0:43 ` Herbert Xu
2007-09-30 15:38 ` Patrick McHardy
2007-10-14 4:26 ` [0/10] Remove sk_buff ** from netfilter API Herbert Xu
2007-10-14 4:27 ` [PATCH 1/10] [SKBUFF]: Merge common code between copy_skb_header and skb_clone Herbert Xu
2007-10-14 10:36 ` jamal
2007-10-14 4:27 ` [PATCH 2/10] [SKBUFF]: Add skb_morph Herbert Xu
2007-11-26 6:50 ` Yasuyuki KOZAKAI
[not found] ` <200711260650.lAQ6oOL9006774@toshiba.co.jp>
2007-11-26 15:10 ` Herbert Xu
2007-11-27 6:50 ` Yasuyuki KOZAKAI
2007-10-14 4:27 ` [PATCH 3/10] [IPV4]: Make ip_defrag return the same packet Herbert Xu
2007-10-14 4:27 ` [PATCH 4/10] [IPV4]: Change ip_defrag to return an integer Herbert Xu
2007-10-14 4:27 ` [PATCH 5/10] [NET]: Avoid unnecessary cloning for ingress filtering Herbert Xu
2007-10-14 10:49 ` jamal
2007-10-15 13:57 ` jamal
2007-10-15 14:28 ` Patrick McHardy
2007-10-15 14:55 ` Alexey Kuznetsov
2007-10-16 10:28 ` jamal
2007-10-14 4:27 ` [PATCH 6/10] [BRIDGE]: Unshare skb upon entry Herbert Xu
2007-10-15 7:20 ` Patrick McHardy
2007-10-15 8:04 ` Herbert Xu
2007-10-15 8:50 ` David Miller
2007-10-14 4:27 ` [PATCH 7/10] [NETFILTER]: Do not copy skb in skb_make_writable Herbert Xu
2007-10-14 4:27 ` [PATCH 8/10] [IPVS]: Replace local version of skb_make_writable Herbert Xu
2007-10-14 4:27 ` [PATCH 9/10] [NETFILTER]: Avoid skb_copy/pskb_copy/skb_realloc_headroom Herbert Xu
2007-10-14 4:27 ` [PATCH 10/10] [NETFILTER]: Replace sk_buff ** with sk_buff * Herbert Xu
2007-10-14 9:55 ` Herbert Xu
2007-10-14 14:46 ` [0/3] [IPV6]: Kill sk_buff ** usage on input path Herbert Xu
2007-10-14 14:49 ` [PATCH 1/3] [IPV6]: Make ipv6_frag_rcv return the same packet Herbert Xu
2007-10-15 8:28 ` David Miller
2007-10-14 14:49 ` [PATCH 2/3] [IPV6]: Avoid skb_copy/pskb_copy/skb_realloc_headroom on input Herbert Xu
2007-10-15 8:29 ` David Miller
2007-10-14 14:49 ` [PATCH 3/3] [IPV6]: Replace sk_buff ** with sk_buff * in input handlers Herbert Xu
2007-10-14 15:43 ` YOSHIFUJI Hideaki / 吉藤英明
2007-10-15 8:30 ` David Miller
2007-10-15 8:29 ` David Miller
2007-10-15 14:21 ` Herbert Xu
2007-10-15 8:27 ` [PATCH 10/10] [NETFILTER]: Replace sk_buff ** with sk_buff * David Miller
2007-10-15 6:25 ` [0/10] Remove sk_buff ** from netfilter API Patrick McHardy
2007-10-15 7:57 ` [IPV4]: Uninline netfilter okfns Patrick McHardy
2007-10-15 8:05 ` Herbert Xu
2007-10-15 8:30 ` [IPV6]: " Patrick McHardy
2007-10-15 8:51 ` David Miller
2007-10-15 8:49 ` [IPV4]: " David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20070927100753.GA22323@2ka.mipt.ru \
--to=johnpol@2ka$(echo .)mipt.ru \
--cc=davem@davemloft$(echo .)net \
--cc=hadi@cyberus$(echo .)ca \
--cc=herbert@gondor$(echo .)apana.org.au \
--cc=kuznet@ms2$(echo .)inr.ac.ru \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox