From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [nf-next/nf_tables-experiments - PATCH 1/2] nf_tables: Add support for changing users chain's name
Date: Wed, 31 Oct 2012 16:38:15 +0100 [thread overview]
Message-ID: <20121031153815.GA9558@1984> (raw)
In-Reply-To: <509135AD.4070007@linux.intel.com>
On Wed, Oct 31, 2012 at 04:29:01PM +0200, Tomasz Bursztyka wrote:
> Hi,
> >> From net/netfilter/nf_tables_core.c:
> >
> > case NFT_GOTO:
> > chain = data[NFT_REG_VERDICT].chain;
> >
> >In the GOTO case, we already point to the chain object. That chain
> >object is loaded in nft_immediate.c _eval(). However, the private data
> >of immediate is initialized in the _init() path. That means we would
> >need to refresh the entire rule-set to point to the correct new chain
> >object, otherwise we would crash.
>
> Missed that one completely...
>
> >I'd follow a simpler solution to avoid issues. Use a fixed chain name
> >length (the same length as iptables does, or just 32 bytes).
> >
> >We can revisit this later to see if we can support renaming and
> >dynamically allocated chain objects at the same time.
>
> First solution is easy to implement, and do not imply any
> performance drop, only a bit of memory loss for short names.
>
> Second one, I cannot see anything but a 2 pass system (a hash table
> handling unique handle related to a chain pointer).
> But then the gain of bytes - with variable name size - versus the
> size of the hash table etc... might be pointless.
> Maybe I am just wrong. Is there any other solution?
I don't see any at this moment.
> >Would you resend a new version of this patch?
>
> Ok, I will go with first solution, unless you or someone else comes
> up with a better proposition.
Agreed. It's simple and we can still revisit this later.
next prev parent reply other threads:[~2012-10-31 15:38 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-31 9:28 [nf-next/nf_tables-experiments - PATCH 0/2] chain rename and rule replacement Tomasz Bursztyka
2012-10-31 9:28 ` [nf-next/nf_tables-experiments - PATCH 1/2] nf_tables: Add support for changing users chain's name Tomasz Bursztyka
2012-10-31 13:49 ` Pablo Neira Ayuso
2012-10-31 14:29 ` Tomasz Bursztyka
2012-10-31 15:38 ` Pablo Neira Ayuso [this message]
2012-10-31 9:28 ` [nf-next/nf_tables-experiments - PATCH 2/2] nf_tables: Add support for replacing a rule by another one Tomasz Bursztyka
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121031153815.GA9558@1984 \
--to=pablo@netfilter.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=tomasz.bursztyka@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).