From patchwork Thu Mar 10 18:01:38 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Miller X-Patchwork-Id: 595893 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id D608714090B for ; Fri, 11 Mar 2016 05:01:43 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753373AbcCJSBm (ORCPT ); Thu, 10 Mar 2016 13:01:42 -0500 Received: from shards.monkeyblade.net ([149.20.54.216]:49618 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752455AbcCJSBl (ORCPT ); Thu, 10 Mar 2016 13:01:41 -0500 Received: from localhost (cpe-24-193-244-122.nyc.res.rr.com [24.193.244.122]) (Authenticated sender: davem-davemloft) by shards.monkeyblade.net (Postfix) with ESMTPSA id F36A65AC2CD; Thu, 10 Mar 2016 10:01:39 -0800 (PST) Date: Thu, 10 Mar 2016 13:01:38 -0500 (EST) Message-Id: <20160310.130138.1302349043066531127.davem@davemloft.net> To: gorcunov@gmail.com Cc: alexei.starovoitov@gmail.com, eric.dumazet@gmail.com, netdev@vger.kernel.org, solar@openwall.com, vvs@virtuozzo.com, avagin@virtuozzo.com, xemul@virtuozzo.com, vdavydov@virtuozzo.com, khorenko@virtuozzo.com, pablo@netfilter.org, netfilter-devel@vger.kernel.org Subject: Re: [RFC] net: ipv4 -- Introduce ifa limit per net From: David Miller In-Reply-To: <20160310150920.GC21154@uranus.lan> References: <20160310102018.GA21154@uranus.lan> <20160310110324.GB21154@uranus.lan> <20160310150920.GC21154@uranus.lan> X-Mailer: Mew version 6.7 on Emacs 24.5 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Thu, 10 Mar 2016 10:01:41 -0800 (PST) Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org From: Cyrill Gorcunov Date: Thu, 10 Mar 2016 18:09:20 +0300 > On Thu, Mar 10, 2016 at 02:03:24PM +0300, Cyrill Gorcunov wrote: >> On Thu, Mar 10, 2016 at 01:20:18PM +0300, Cyrill Gorcunov wrote: >> > On Thu, Mar 10, 2016 at 12:16:29AM +0300, Cyrill Gorcunov wrote: >> > > >> > > Thanks for explanation, Dave! I'll continue on this task tomorrow >> > > tryin to implement optimization you proposed. >> > >> > OK, here are the results for the preliminary patch with conntrack running >> ... >> > net/ipv4/devinet.c | 13 ++++++++++++- >> > 1 file changed, 12 insertions(+), 1 deletion(-) >> > >> > Index: linux-ml.git/net/ipv4/devinet.c >> > =================================================================== >> > --- linux-ml.git.orig/net/ipv4/devinet.c >> > +++ linux-ml.git/net/ipv4/devinet.c >> > @@ -403,7 +403,18 @@ no_promotions: >> > So that, this order is correct. >> > */ >> >> This patch is wrong, so drop it please. I'll do another. > > Here I think is a better variant. The resulst are good > enough -- 1 sec for cleanup. Does the patch look sane? I'm tempted to say that we should provide these notifier handlers with the information they need, explicitly, to handle this case. Most intdev notifiers actually want to know the individual addresses that get removed, one by one. That's handled by the existing NETDEV_DOWN event and the ifa we pass to that. But some, like this netfilter masq case, would be satisfied with a single event that tells them the whole inetdev instance is being torn down. Which is the case we care about here. We currently don't use NETDEV_UNREGISTER for inetdev notifiers, so maybe we could use that. And that is consistent with the core netdev notifier that triggers this call chain in the first place. Roughly, something like this: --- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 8c3df2c..6eee5cb 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -292,6 +292,11 @@ static void inetdev_destroy(struct in_device *in_dev) in_dev->dead = 1; + if (in_dev->ifa_list) + blocking_notifier_call_chain(&inetaddr_chain, + NETDEV_UNREGISTER, + in_dev->ifa_list); + ip_mc_destroy_dev(in_dev); while ((ifa = in_dev->ifa_list) != NULL) { diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c index c6eb421..1bb8026 100644 --- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c +++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c @@ -111,6 +111,10 @@ static int masq_inet_event(struct notifier_block *this, struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev; struct netdev_notifier_info info; + if (event != NETDEV_UNREGISTER) + return NOTIFY_DONE; + event = NETDEV_DOWN; + netdev_notifier_info_init(&info, dev); return masq_device_event(this, event, &info); }