From: Florian Westphal <fw@strlen.de>
To: Phil Sutter <phil@nwl.cc>,
Pablo Neira Ayuso <pablo@netfilter.org>,
Florian Westphal <fw@strlen.de>,
netfilter-devel@vger.kernel.org
Subject: Re: iptables-nft fails to restore huge rulesets
Date: Wed, 31 Mar 2021 15:35:10 +0200 [thread overview]
Message-ID: <20210331133510.GF17285@breakpoint.cc> (raw)
In-Reply-To: <20210331091331.GE7863@orbyte.nwl.cc>
Phil Sutter <phil@nwl.cc> wrote:
> Hi,
>
> I'm currently trying to fix for an issue in Kubernetes realm[1]:
> Baseline is they are trying to restore a ruleset with ~700k lines and it
> fails. Needless to say, legacy iptables handles it just fine.
>
> Meanwhile I found out there's a limit of 1024 iovecs when submitting the
> batch to kernel, and this is what they're hitting.
>
> I can work around that limit by increasing each iovec (via
> BATCH_PAGE_SIZE) but keeping pace with legacy seems ridiculous:
>
> With a scripted binary-search I checked the maximum working number of
> restore items of:
>
> (1) User-defined chains
> (2) rules with merely comment match present
> (3) rules matching on saddr, daddr, iniface and outiface
>
> Here's legacy compared to nft with different factors in BATCH_PAGE_SIZE:
>
> legacy 32 (stock) 64 128 256
> ----------------------------------------------------------------------
> 1'636'799 1'602'202 - NC - - NC - - NC -
> 1'220'159 302'079 604'160 1'208'320 - NC -
> 3'532'040 242'688 485'376 971'776 1'944'576
Can you explain that table? What does 1'636'799 mean? NC?
next prev parent reply other threads:[~2021-03-31 13:36 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-31 9:13 iptables-nft fails to restore huge rulesets Phil Sutter
2021-03-31 13:35 ` Florian Westphal [this message]
2021-03-31 14:41 ` Phil Sutter
2021-03-31 20:51 ` Pablo Neira Ayuso
2021-04-01 10:30 ` Phil Sutter
2021-04-01 11:44 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210331133510.GF17285@breakpoint.cc \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=phil@nwl.cc \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.