From: Toke Høiland-Jørgensen <toke@xxxxxxx> Date: Tue, 22 May 2018 15:57:38 +0200 > When CAKE is deployed on a gateway that also performs NAT (which is a > common deployment mode), the host fairness mechanism cannot distinguish > internal hosts from each other, and so fails to work correctly. > > To fix this, we add an optional NAT awareness mode, which will query the > kernel conntrack mechanism to obtain the pre-NAT addresses for each packet > and use that in the flow and host hashing. > > When the shaper is enabled and the host is already performing NAT, the cost > of this lookup is negligible. However, in unlimited mode with no NAT being > performed, there is a significant CPU cost at higher bandwidths. For this > reason, the feature is turned off by default. > > Cc: netfilter-devel@xxxxxxxxxxxxxxx > Signed-off-by: Toke Høiland-Jørgensen <toke@xxxxxxx> This is really pushing the limits of what a packet scheduler can require for correct operation. And this creates an incredibly ugly dependency. I'd much rather you do something NAT method agnostic, like save or compute the necessary information on ingress and then later use it on egress. Because what you have here will completely break when someone does NAT using eBPF, act_nat, or similar. There is even skb->rxhash, be creative :-) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
