From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: Liping Zhang <zlpnobody@163.com>,
netfilter-devel@vger.kernel.org,
Liping Zhang <liping.zhang@spreadtrum.com>,
nevola@gmail.com
Subject: Re: [PATCH nf-next] netfilter: nft_queue: add _SREG_FROM and _SRGE_TO to select the queue numbers
Date: Mon, 12 Sep 2016 14:32:53 +0200 [thread overview]
Message-ID: <20160912123253.GA9791@salvia> (raw)
In-Reply-To: <20160912122257.GC27566@breakpoint.cc>
On Mon, Sep 12, 2016 at 02:22:57PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Sun, Sep 11, 2016 at 11:12:26PM +0200, Florian Westphal wrote:
> > > My first thought was that it would be better to just support one single
> > > sreg (the queue number) and eventually externalize the hashing/queue
> > > selection:
> > >
> > > queue num jhash ip saddr . ip daddr mod ...
> > >
> > > Problem is that with plain jhash we won't get a symmetric hash
> > > for origin and reply, so for this we would need a new expression/hash
> > > mode.
> >
> > Are you think of xor hashing to provide the symmetry? Downside is that
> > bad tuple selection may result in poor distribution, but this is
> > something we can document.
>
> No, I was thinking of a new hash mode to do this, e.g. just do same
> what current nfqueue selection does: hash lower address first.
Currently we have one single register pointing to the entire tuple
concatenation that we hash, we would need to support multiple
registers as input, check that they are consecutive. Then, the logic
to compare the data. And a way to express this in syntax.
next prev parent reply other threads:[~2016-09-12 12:32 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-11 14:05 [PATCH nf-next] netfilter: nf_queue: get rid of dependency on IP6_NF_IPTABLES Liping Zhang
2016-09-11 14:05 ` [PATCH nf-next] netfilter: nft_queue: add _SREG_FROM and _SRGE_TO to select the queue numbers Liping Zhang
2016-09-11 21:12 ` Florian Westphal
2016-09-12 2:19 ` Liping Zhang
2016-09-12 10:53 ` Laura Garcia
2016-09-12 12:28 ` Florian Westphal
2016-09-12 12:39 ` Pablo Neira Ayuso
2016-09-12 12:09 ` Pablo Neira Ayuso
2016-09-12 12:22 ` Florian Westphal
2016-09-12 12:32 ` Pablo Neira Ayuso [this message]
2016-09-12 13:18 ` Florian Westphal
2016-09-13 9:19 ` Pablo Neira Ayuso
2016-09-13 12:19 ` Liping Zhang
2016-09-12 17:50 ` [PATCH nf-next] netfilter: nf_queue: get rid of dependency on IP6_NF_IPTABLES Pablo Neira Ayuso
2016-09-13 5:45 ` Liping Zhang
2016-09-13 9:10 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160912123253.GA9791@salvia \
--to=pablo@netfilter.org \
--cc=fw@strlen.de \
--cc=liping.zhang@spreadtrum.com \
--cc=netfilter-devel@vger.kernel.org \
--cc=nevola@gmail.com \
--cc=zlpnobody@163.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).