On 19/05/2019 01:22, Pablo Neira Ayuso wrote: > On Fri, May 17, 2019 at 04:27:29PM +0100, Edward Cree wrote: >> On 15/05/2019 20:39, Edward Cree wrote: > [...] >> Pablo, how do the two options interact with your netfilter offload? I'm >> guessing it's easier for you to find a unique pointer than to generate >> a unique u32 action_index for each action. I'm also assuming that >> netfilter doesn't have a notion of shared actions. > It has that shared actions concept, see: > > https://netfilter.org/projects/nfacct/ > > Have a look at 'nfacct' in iptables-extensions(8) manpage. Thanks. Looking at net/netfilter/nfnetlink_acct.c, it looks as though you don't have a u32 index in there; for the cookie approach, would the address of the struct nf_acct (casted to unsigned long) work to uniquely identify actions that should be shared? I'm not 100% sure how nf (or nfacct) offload is going to look, so I might be barking up the wrong tree here. But it seems like the cookie method should work better for you — even if you did have an index, how would you avoid collisions with TC actions using the same indices if both are in use on a box? Cookies OTOH are pointers, so guaranteed unique :)
-Ed
