From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: netfilter-devel@vger.kernel.org, eric.dumazet@gmail.com
Subject: Re: [PATCH -next v2 0/6] netfilter: xtables: improve jumpstack handling
Date: Wed, 15 Jul 2015 19:17:49 +0200 [thread overview]
Message-ID: <20150715171749.GA4707@salvia> (raw)
In-Reply-To: <1436889071-3637-1-git-send-email-fw@strlen.de>
On Tue, Jul 14, 2015 at 05:51:05PM +0200, Florian Westphal wrote:
> During NFWS 2015 Eric Dumazet suggested various ideas to make
> the xtables table traverser function setup less expensive.
>
> In particular, the *_do_table functions keep track of the current
> stack pointer.
>
> It appears that we can simplify this to always start from 0
> (therefore allowing us to avoid the save/restore) provided we make sure
> that we use an alternate jump stack when we enter the traverser recursively
> via TEE target.
>
> This implements some of Erics ideas.
Series from 1 to 5 applied.
> NOTE1: The last patch may break valid iptables rulesets.
> Its the clasic question wheter we're willing to reject bizarre ruleset
> or not. If this patch is acceptable, we can avoid one more dereference
> by using percpu allocation for the jumpstack as follow work.
If we take this patch into the tree, I'd wait for quite some time to
make sure nobody barfs to us with problems, so we can revert it.
Otherwise, the (unlikely) scenario would require several reverts in a
row, starting from this to further suggested enhancements, right?
next prev parent reply other threads:[~2015-07-15 17:12 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-07-14 15:51 [PATCH -next v2 0/6] netfilter: xtables: improve jumpstack handling Florian Westphal
2015-07-14 15:51 ` [PATCH -next v2 1/6] netfilter: xtables: compute exact size needed for jumpstack Florian Westphal
2015-07-14 15:51 ` [PATCH -next v2 2/6] netfilter: move tee_active to core Florian Westphal
2015-07-14 15:51 ` [PATCH -next v2 3/6] netfilter: xtables: don't save/restore jumpstack offset Florian Westphal
2015-07-14 15:51 ` [PATCH -next 4/6] netfilter: add and use jump label for xt_tee Florian Westphal
2015-07-14 15:51 ` [PATCH -next 5/6] netfilter: xtables: remove __pure annotation Florian Westphal
2015-07-14 15:51 ` [PATCH -next v2 6/6] netfilter: xtables: add upper limit on call chain depth Florian Westphal
2015-07-15 17:17 ` Pablo Neira Ayuso [this message]
2015-07-15 18:52 ` [PATCH -next v2 0/6] netfilter: xtables: improve jumpstack handling Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150715171749.GA4707@salvia \
--to=pablo@netfilter.org \
--cc=eric.dumazet@gmail.com \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).