From: Lukas Wunner <lukas@wunner.de>
To: Jakub Kicinski <kuba@kernel.org>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>,
Daniel Borkmann <daniel@iogearbox.net>,
netfilter-devel@vger.kernel.org, davem@davemloft.net,
netdev@vger.kernel.org, kadlec@netfilter.org, fw@strlen.de,
ast@kernel.org, edumazet@google.com, tgraf@suug.ch,
nevola@gmail.com, john.fastabend@gmail.com, willemb@google.com
Subject: Re: [PATCH nf-next v5 0/6] Netfilter egress hook
Date: Thu, 30 Sep 2021 19:36:11 +0200 [thread overview]
Message-ID: <20210930173611.GA16428@wunner.de> (raw)
In-Reply-To: <20210930101920.06bb40b9@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
On Thu, Sep 30, 2021 at 10:19:20AM -0700, Jakub Kicinski wrote:
> On Thu, 30 Sep 2021 19:12:53 +0200 Lukas Wunner wrote:
> > On Thu, Sep 30, 2021 at 07:28:35AM -0700, Jakub Kicinski wrote:
> > > On Thu, 30 Sep 2021 11:21:42 +0200 Pablo Neira Ayuso wrote:
> > > > this is stuffing one more bit into the skbuff
> > >
> > > The lifetime of this information is constrained, can't it be a percpu
> > > flag, like xmit_more?
> >
> > Hm, can't an skb be queued and processed later on a different cpu?
> > E.g. what about fragments?
> >
> > That would rule out a percpu flag, leaving a flag in struct sk_buff
> > as the only option.
>
> What queuing do you have in mind? Qdisc is after the egress hook.
Ingress queueing. E.g. a packet may be redirected or mirrored by tc
on ingress to another interface, resulting in a recursive call to
netif_receive_skb() or dev_queue_xmit(). The packet may be bounced
around an arbitrary number of times this way. Forwarding like that
can happen both at the tc and the netfilter "layer".
I'm concerned that a packet may be handled by different cpus along the way
and queueing might be one possibility how this could happen.
Thanks,
Lukas
prev parent reply other threads:[~2021-09-30 17:36 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-28 9:55 [PATCH nf-next v5 0/6] Netfilter egress hook Pablo Neira Ayuso
2021-09-28 9:55 ` [PATCH nf-next v5 1/6] netfilter: Rename ingress hook include file Pablo Neira Ayuso
2021-09-28 9:55 ` [PATCH nf-next v5 2/6] netfilter: Generalize " Pablo Neira Ayuso
2021-09-28 9:55 ` [PATCH nf-next v5 3/6] netfilter: nf_tables: move netdev ingress filter chain to nf_tables_netdev.c Pablo Neira Ayuso
2021-09-28 9:55 ` [PATCH nf-next v5 4/6] netfilter: Introduce egress hook Pablo Neira Ayuso
2021-09-28 9:55 ` [PATCH nf-next v5 5/6] af_packet: " Pablo Neira Ayuso
2021-09-28 9:55 ` [PATCH nf-next v5 6/6] netfilter: nf_tables: add egress support Pablo Neira Ayuso
2021-09-30 6:08 ` [PATCH nf-next v5 0/6] Netfilter egress hook Daniel Borkmann
2021-09-30 6:52 ` Lukas Wunner
2021-09-30 7:10 ` Daniel Borkmann
2021-09-30 7:21 ` Pablo Neira Ayuso
2021-09-30 7:19 ` Pablo Neira Ayuso
2021-09-30 7:33 ` Daniel Borkmann
2021-09-30 9:21 ` Pablo Neira Ayuso
2021-09-30 14:28 ` Jakub Kicinski
2021-09-30 15:13 ` Pablo Neira Ayuso
2021-09-30 16:06 ` Jakub Kicinski
2021-09-30 18:00 ` Pablo Neira Ayuso
2021-09-30 19:17 ` Jakub Kicinski
2021-09-30 17:12 ` Lukas Wunner
2021-09-30 17:19 ` Jakub Kicinski
2021-09-30 17:36 ` Lukas Wunner [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210930173611.GA16428@wunner.de \
--to=lukas@wunner.de \
--cc=ast@kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=john.fastabend@gmail.com \
--cc=kadlec@netfilter.org \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=nevola@gmail.com \
--cc=pablo@netfilter.org \
--cc=tgraf@suug.ch \
--cc=willemb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.