• Pablo Neira Ayuso's avatar
    netfilter: nf_tables: coalesce multiple notifications into one skbuff · 67cc570e
    Pablo Neira Ayuso authored
    On x86_64, each notification results in one skbuff allocation which
    consumes at least 768 bytes due to the skbuff overhead.
    
    This patch coalesces several notifications into one single skbuff, so
    each notification consumes at least ~211 bytes, that ~3.5 times less
    memory consumption. As a result, this is reducing the chances to exhaust
    the netlink socket receive buffer.
    
    Rule of thumb is that each notification batch only contains netlink
    messages whose report flag is the same, nfnetlink_send() requires this
    to do appropriate delivery to userspace, either via unicast (echo
    mode) or multicast (monitor mode).
    
    The skbuff control buffer is used to annotate the report flag for later
    handling at the new coalescing routine.
    
    The batch skbuff notification size is NLMSG_GOODSIZE, using a larger
    skbuff would allow for more socket receiver buffer savings (to amortize
    the cost of the skbuff even more), however, going over that size might
    break userspace applications, so let's be conservative and stick to
    NLMSG_GOODSIZE.
    Reported-by: default avatarPhil Sutter <phil@nwl.cc>
    Acked-by: default avatarPhil Sutter <phil@nwl.cc>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    67cc570e
nftables.h 366 Bytes