Re[2]: [v2 PATCH 1/2] NETFILTER module xt_hmark new target for HASH based fw

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



>
>On Tue, Nov 08, 2011 at 12:29:53AM +0100, Hans Schillstrom wrote:
>> >We prefer skb_header_pointer instead. If conntrack is enabled, we can
>> >benefit from defragmention. 
>> 
>> In  our case conntrack will not be there
>
>Yes, but if conntrack is there, we benefit from fragment reassembly if
>you use skb_header_pointer.
>
>> >Please, replace all pskb_may_pull by skb_header_pointer in this code.
>> >
>> >We can assume that the IP header is linear (not fragmented).
>> 
>> I ran in to this issue in IPv6 testing so I got a little bit "paranoid".
>> Are you sure that the embedded IP and L4 header in the ICMP msg also is unfragmented.  
>> Is this true for both IPv6 & IPv4 ?
>
>No sorry. I was refering to normal IP header in one packet.
>
>> From what I remember  when I was testing IPv6  icmp and digged into the original header (on a 2.6.32 kernel)  
>> pskb_may_pull was needed.
>
>Yes, it is indeed needed.
>
>> [snip]

[snip]


>
>Welcome, let's see if we can get this into 3.3 since we cannot make it
>for 3.2.
>
>BTW, do you have some number of this running with and without
>conntrack? It would be interesting to have.

I didn't save them,  but I can make a new benchmark later on.

Regards
Hans




--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux