netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH nf-next 0/6] conntrack: get rid of per-object timer
@ 2016-08-19 11:36 Florian Westphal
  2016-08-19 11:36 ` [PATCH nf-next 1/6] netfilter: don't rely on DYING bit to detect when destroy event was sent Florian Westphal
                   ` (5 more replies)
  0 siblings, 6 replies; 15+ messages in thread
From: Florian Westphal @ 2016-08-19 11:36 UTC (permalink / raw)
  To: netfilter-devel

During NFWS 2016 it was mentioned that per-conntrack timers have
two drawbacks:
 - the 5-day default established timeout is very large and brings
   extra constraints for the timer subsystem.
 - most distros enable timer stats so timer struct eats 80 bytes
   in each conntrack object.

This series replaces the per-object struct timer with a u32 jiffie
stamp and one global delayed work queue for conntrack eviction.
Size of nf_conn struct is reduced to 256 bytes on x86_64.

Eviction is performed from the packet path when doing
table lookup, for cases where we have idle periods the work
queue is used.

Tested with following script, conntrackd running in 'relible
event mode' and httpterm running on other host:

-----------------------------------------------------------
random_resize() {
        while true; do
                RND=$RANDOM%256000
                RND=$((RND+8192))
                sysctl net.netfilter.nf_conntrack_buckets=$RND
                sleep $((RANDOM % 120))
        done
}

random_flush() {
        while true; do
                sleep $((RANDOM % 120))
                conntrack -F
        done
}

random_startstop() {
        while true; do
                sleep $((RANDOM % 120))
                pkill -STOP conntrackd
                sleep $((RANDOM % 10))
                pkill -CONT conntrackd
        done
}

http-client -u 1000 -t 3 -F 192.168.10.50 -G 192.168.10.17:8001 &
http-client -u 1000 -t 3 -F 192.168.10.51 -G 192.168.10.17:8001 &
http-client -u 1000 -t 3 -F 192.168.10.52 -G 192.168.10.17:8001 &

random_resize &
random_flush &
random_startstop &

wait
-----------------------------------------------------------

 include/net/netfilter/nf_conntrack.h        |   36 +++--
 include/net/netfilter/nf_conntrack_ecache.h |   17 +-
 net/netfilter/nf_conntrack_core.c           |  186 ++++++++++++++++++++--------
 net/netfilter/nf_conntrack_ecache.c         |   22 ++-
 net/netfilter/nf_conntrack_netlink.c        |   39 ++++-
 net/netfilter/nf_conntrack_pptp.c           |    3 
 net/netfilter/nf_nat_core.c                 |    6 
 7 files changed, 215 insertions(+), 94 deletions(-)

^ permalink raw reply	[flat|nested] 15+ messages in thread
end of thread, other threads:[~2016-08-22  8:53 UTC | newest]

Thread overview: 15+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-08-19 11:36 [PATCH nf-next 0/6] conntrack: get rid of per-object timer Florian Westphal
2016-08-19 11:36 ` [PATCH nf-next 1/6] netfilter: don't rely on DYING bit to detect when destroy event was sent Florian Westphal
2016-08-19 11:36 ` [PATCH nf-next 2/6] netfilter: conntrack: get rid of conntrack timer Florian Westphal
2016-08-19 14:37   ` Eric Dumazet
2016-08-19 15:16     ` Florian Westphal
2016-08-19 15:24       ` Eric Dumazet
2016-08-19 16:04         ` Florian Westphal
2016-08-22  4:13           ` Eric Dumazet
2016-08-22  8:53             ` Florian Westphal
2016-08-19 11:36 ` [PATCH nf-next 3/6] netfilter: evict stale entries on netlink dumps Florian Westphal
2016-08-19 11:36 ` [PATCH nf-next 4/6] netfilter: conntrack: add gc worker to remove timed-out entries Florian Westphal
2016-08-19 14:41   ` Eric Dumazet
2016-08-19 15:22     ` Florian Westphal
2016-08-19 11:36 ` [PATCH nf-next 5/6] netfilter: conntrack: resched gc again if eviction rate is high Florian Westphal
2016-08-19 11:36 ` [PATCH nf-next 6/6] netfilter: remove __nf_ct_kill_acct helper Florian Westphal

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).