[Bug 1127] running nft command creates lag for forwarded packets

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1127

--- Comment #7 from Pablo Neira Ayuso <pablo at netfilter.org> ---
(In reply to Karel Rericha from comment #6)
> Patch didnt help Pablo. Listing this small set each second from patched box:
> 
> testbox ~ # nft list set filter private
> table ip filter {
>         set private {
>                 type ipv4_addr
>                 flags interval
>                 elements = { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12,
> 192.168.0.0/16}
>         }
> }
> 
> testbox ~ # watch -n 1 nft list set filter private > /dev/null

I guess you don't hit this problem if you just use non-interval sets.

The good solution is to provide a replacement for the interval set
implementation that we have now, which doesn't scale up as you're noticing.

I can workaround this by providing a lockless path to list. Still if you have
dynamic insertions on that interval tree, you would hit problems.

So the definitive solution is to provide a replacement implementation for
interval sets.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20170309/0d52f8a3/attachment.html>