NFQUEUE parallelization

NFQUEUE parallelization

[Eugene Strulyov]

Hi,

I am implementing a custom filter using the libnetfilter_queue
library. Performance is important, so I am looking at ways to
parallelize it. The options I see are as follows:

- single queue, multiple threads
- multiple queues, multiple threads
- multiple queues, multiple processes (1 per queue)

Which of these options would be most effective?

The guide I found here
https://home.regit.org/netfilter-en/using-nfqueue-and-libnetfilter_queue/
says "the nfq_set_verdict2 and nfq_handle_packet function needs to be
protected by lock mechanism." Does that mean that there can be at most
2 threads per queue?

When using multiple queues, is it valid to call nfq_open() multiple
times in the same process? When I do that I get negative numbers for
peer portid. Is this normal?

$ sudo cat /proc/net/netfilter/nfnetlink_queue
  100  27790     0 2 65531     0     0        0  1
  101  -4585     0 2 65531     0     0        0  1
  102  -4586     0 2 65531     0     0        0  1
  103  -4587     0 2 65531     0     0        0  1

Also, how exactly does --queue-balance work? All packets seem to be
directed to one particular queue.

thanks,

Eugene

Re: NFQUEUE parallelization

[Florian Westphal]

Eugene Strulyov <eugene.strulyov@gmail.com> wrote:
> When using multiple queues, is it valid to call nfq_open() multiple
> times in the same process?

Yes.

> When I do that I get negative numbers for
> peer portid. Is this normal?

> $ sudo cat /proc/net/netfilter/nfnetlink_queue
>   100  27790     0 2 65531     0     0        0  1
>   101  -4585     0 2 65531     0     0        0  1

The proc formatter in nfnetlink_queue uses %d instead of %u.
It was fixed a few months back.

> Also, how exactly does --queue-balance work? All packets seem to be
> directed to one particular queue.

Hash over ipv4/ipv6 source & dst addresses.

Re: NFQUEUE parallelization

[Eugene Strulyov]

Thanks for your reply.

So with regards to parallelization, I need to use multiple queues, correct?

Also, with --queue-balance, will the same (src_ip, dst_ip) pair always
map to the same queue? If yes, I can make each queue handler a
separate process.

thanks,

Eugene



On Thu, Sep 24, 2015 at 1:48 PM, Florian Westphal <fw@strlen.de> wrote:
> Eugene Strulyov <eugene.strulyov@gmail.com> wrote:
>> When using multiple queues, is it valid to call nfq_open() multiple
>> times in the same process?
>
> Yes.
>
>> When I do that I get negative numbers for
>> peer portid. Is this normal?
>
>> $ sudo cat /proc/net/netfilter/nfnetlink_queue
>>   100  27790     0 2 65531     0     0        0  1
>>   101  -4585     0 2 65531     0     0        0  1
>
> The proc formatter in nfnetlink_queue uses %d instead of %u.
> It was fixed a few months back.
>
>> Also, how exactly does --queue-balance work? All packets seem to be
>> directed to one particular queue.
>
> Hash over ipv4/ipv6 source & dst addresses.

Re: NFQUEUE parallelization

[Florian Westphal]

Eugene Strulyov <eugene.strulyov@gmail.com> wrote:

Please don't top post.

> Thanks for your reply.
> 
> So with regards to parallelization, I need to use multiple queues, correct?

Not necessarily, but it avoids contention for a (single) queue.

> Also, with --queue-balance, will the same (src_ip, dst_ip) pair always
> map to the same queue?

Yes, all saddr,daddr [and replies] get into same queue.