Skip to content

netfilter: conntrack: route cache for forwarded connections

Florian Westphal netdev netfilter-devel 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest2 patches 4 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/2netfilter: conntrack: cache route for forwarded connectionsinclude/net/netfilter/nf_conntrack_extend.h include/net/netfilter/nf_conntrack_rtcache.h net/netfilter/Kconfig +2 more+440 -02 replies
2/2netfilter: use conntrack rtcache if availableinclude/net/netfilter/nf_conntrack_rtcache.h net/ipv4/netfilter/ipt_rpfilter.c net/ipv6/netfilter/ip6t_rpfilter.c +1 more+48 -20 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.

Read the v1 thread

Cover letter [PATCH nf-next 0/2] netfilter: conntrack: route cache for forwarded connections

[ Pablo, in case you deem this too late for -next just let me know and I will resend once its open again ]

This adds an optional forward routing cache extension for netfilter connection tracking.

The memory cost is an additional 32 bytes per conntrack entry on x86_64.

Unlike any other currently implemented connection tracking extension the rtcache has no run-time tunables, it is always active.

Also, unlike other conntrack extensions, it can be built as a module, in this case modprobe/rmmod are used to enable/disable the cache.

Forward test using netperf UDP_STREAM between two network namespaces (connected via veth devices), tput:

With conntrack + reverse path filtering (rp_filter sysctl=1):
MIGRATED UDP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.1.12.2 () port 0 AF_INET
Socket Message Elapsed Messages

 Size    Size     Time         Okay Errors   Throughput
 bytes   bytes    secs            #      #   10^6bits/sec
  212992      64   120.00    26333996      0     112.36
  212992           120.00    26279399            112.13

same, but with rtcache (this patch series):

  212992      64   120.00    34508693      0     147.24
  212992           120.00    34507838            147.23

same but with rp_filter=0 and no conntrack modules active:

  212992      64   120.00    42288748      0     180.43
  212992           120.00    42283439            180.41

IOW, this is only useful if conntrack is used anyway.

Read the cover letter in its thread