From: ebiederm@xmission.com (Eric W. Biederman)
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: netfilter-devel@vger.kernel.org, aschultz@warp10.net, kaber@trash.net
Subject: Re: [PATCH RFC 04/15] netfilter: add pernet hook support
Date: Mon, 15 Jun 2015 20:01:21 -0500 [thread overview]
Message-ID: <87fv5slb4u.fsf@x220.int.ebiederm.org> (raw)
In-Reply-To: <1434383217-13732-5-git-send-email-pablo@netfilter.org> (Pablo Neira Ayuso's message of "Mon, 15 Jun 2015 17:46:46 +0200")
Pablo Neira Ayuso <pablo@netfilter.org> writes:
> This patch modifies the nf_register_hook() and nf_register_hooks() interfaces
> to allow to register hooks at a pernet level.
>
> This starts using init_net for all the existing callers though, so the full
> conversion of existing netfilter hook clients to comes in follow up
> patches.
There is one issue with the approach this takes to per net network
namespace hooks.
nf_unregister_hook calls syncrhonize_net().
Which depending on which netfilter modules are loaded is going
to result in a nasty reduction in connections per second of vsftp,
because of the serialized nature of network namespace cleanup.
That should be something we can solve on top of the patches,
but I want to bring it up now so that other people are aware of it.
Eric
next prev parent reply other threads:[~2015-06-16 1:06 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-06-15 15:46 [PATCH RFC 00/15] Netfilter pernet hook support Pablo Neira Ayuso
2015-06-15 15:46 ` [PATCH RFC 01/15] net: include missing headers in net/net_namespace.h Pablo Neira Ayuso
2015-06-15 15:46 ` [PATCH RFC 02/15] netfilter: use forward declaration instead of including linux/proc_fs.h Pablo Neira Ayuso
2015-06-15 15:46 ` [PATCH RFC 03/15] netfilter: don't pull include/linux/netfilter.h from netns headers Pablo Neira Ayuso
2015-06-15 15:46 ` [PATCH RFC 04/15] netfilter: add pernet hook support Pablo Neira Ayuso
2015-06-16 1:01 ` Eric W. Biederman [this message]
2015-06-15 15:46 ` [PATCH RFC 05/15] netfilter: ipt_CLUSTERIP: adapt it to support pernet hooks Pablo Neira Ayuso
2015-06-15 15:46 ` [PATCH RFC 06/15] netfilter: x_tables: adapt xt_hook_link() " Pablo Neira Ayuso
2015-06-15 15:46 ` [PATCH RFC 07/15] netfilter: x_tables: adapt tables to " Pablo Neira Ayuso
2015-06-15 15:46 ` [PATCH RFC 08/15] netfilter: nf_conntrack: adapt IPv4 and IPv6 trackers " Pablo Neira Ayuso
2015-06-15 15:46 ` [PATCH RFC 09/15] netfilter: synproxy: adapt IPv4 and IPv6 targets " Pablo Neira Ayuso
2015-06-15 15:46 ` [PATCH RFC 10/15] netfilter: defrag: add pernet hook support Pablo Neira Ayuso
2015-06-15 15:46 ` [PATCH RFC 11/15] ipvs: adapt it to pernet hooks Pablo Neira Ayuso
2015-06-15 15:46 ` [PATCH RFC 12/15] netfilter: ebtables: adapt the filter and nat table " Pablo Neira Ayuso
2015-06-15 15:46 ` [PATCH RFC 13/15] netfilter: nf_tables: adapt it " Pablo Neira Ayuso
2015-06-15 15:46 ` [PATCH RFC 14/15] security: " Pablo Neira Ayuso
2015-06-15 15:46 ` [PATCH RFC 15/15] netfilter: bridge: " Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87fv5slb4u.fsf@x220.int.ebiederm.org \
--to=ebiederm@xmission.com \
--cc=aschultz@warp10.net \
--cc=kaber@trash.net \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).