Re: [PATCH nf-next v2 3/3] netfilter: nf_conntrack: add efficient mark to zone mapping

[Daniel Borkmann <daniel@iogearbox.net>]

On 07/15/2015 07:50 PM, Pablo Neira Ayuso wrote:
> On Sat, Jul 11, 2015 at 03:14:07AM +0200, Daniel Borkmann wrote:
>> This work adds the possibility of deriving the zone id from the skb->mark
>> field in a scalable manner. This allows for having only a single template
>> serving 100s .. 1000s of different zones, for example, instead of needing
>> to have one match for each zone as an extra CT jump target. Note that we'd
>> need to have this information attached to the template as at the time when
>> we're trying to lookup a possible ct object, we already need to know zone
>> information for a possible match when going into __nf_conntrack_find_get().
>> This work provides a minimal implementation for a possible mapping.
>
> I think connmark is a better place for this feature, given that the
> zone is a ct extension. Moreover, I guess it will not take long until
> someone sends us a patch to perform some bitwise operation to only
> fetch some of the skb->mark bits into the zone.

Hm, we do need the zoning information *before* we do the actual lookup for
a ct object (non-template I mean), otherwise we don't know in which zone to
find it. When I looked into this, the connmark target is applied afterwards
on the actual ct object.

So you mean to add this to the raw table, so that someone could for each skb
assign ct->mark := skb->mark on the template and then have zone := ct->mark,
so we can use it for looking up? I would also need more than a single template
for that, right, as otherwise if I'd have arbitrary ct->mark := skb->mark
assignments in parallel, then we'd race. The current seems rather simple.

Thanks,
Daniel