On Mon, May 20, 2019 at 04:37:10PM +0100, Edward Cree wrote: > On 19/05/2019 01:22, Pablo Neira Ayuso wrote: > > On Fri, May 17, 2019 at 04:27:29PM +0100, Edward Cree wrote: > >> On 15/05/2019 20:39, Edward Cree wrote: > > [...] > >> Pablo, how do the two options interact with your netfilter offload? I'm > >> guessing it's easier for you to find a unique pointer than to generate > >> a unique u32 action_index for each action. I'm also assuming that > >> netfilter doesn't have a notion of shared actions. > > It has that shared actions concept, see: > > > > https://netfilter.org/projects/nfacct/ > > > > Have a look at 'nfacct' in iptables-extensions(8) manpage. > > Thanks. Looking at net/netfilter/nfnetlink_acct.c, it looks as though you > don't have a u32 index in there; for the cookie approach, would the > address of the struct nf_acct (casted to unsigned long) work to uniquely > identify actions that should be shared? > I'm not 100% sure how nf (or nfacct) offload is going to look, so I might > be barking up the wrong tree here. But it seems like the cookie method > should work better for you — even if you did have an index, how would you > avoid collisions with TC actions using the same indices if both are in > use on a box? Cookies OTOH are pointers, so guaranteed unique :)
The cookie approach per-action looks fine to me, there's already a cookie to identify the rule, so this looks natural to me.
