On 07/15/2015 07:50 PM, Pablo Neira Ayuso wrote:
On Sat, Jul 11, 2015 at 03:14:07AM +0200, Daniel Borkmann wrote:
This work adds the possibility of deriving the zone id from the skb->mark
field in a scalable manner. This allows for having only a single template
serving 100s .. 1000s of different zones, for example, instead of needing
to have one match for each zone as an extra CT jump target. Note that we'd
need to have this information attached to the template as at the time when
we're trying to lookup a possible ct object, we already need to know zone
information for a possible match when going into __nf_conntrack_find_get().
This work provides a minimal implementation for a possible mapping.
I think connmark is a better place for this feature, given that the
zone is a ct extension. Moreover, I guess it will not take long until
someone sends us a patch to perform some bitwise operation to only
fetch some of the skb->mark bits into the zone.
Hm, we do need the zoning information *before* we do the actual lookup for
a ct object (non-template I mean), otherwise we don't know in which zone to
find it. When I looked into this, the connmark target is applied afterwards
on the actual ct object.
So you mean to add this to the raw table, so that someone could for each skb
assign ct->mark := skb->mark on the template and then have zone := ct->mark,
so we can use it for looking up? I would also need more than a single template
for that, right, as otherwise if I'd have arbitrary ct->mark := skb->mark
assignments in parallel, then we'd race. The current seems rather simple.
Thanks,
Daniel
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
