On Thu, Sep 27, 2007 at 05:33:58PM +0800, Herbert Xu ([EMAIL PROTECTED]) wrote:
> > > +config NET_ACT_NAT
> > > + tristate "Stateless NAT"
> > > + depends on NET_CLS_ACT
> > > + select NETFILTER
> >
> > Argh... People usually do not understand such jokes :)
> > What about not using netfilter helpers and just move them to the
> > accessible header so that no additional slow path would ever be enabled?
>
> Sure. However, as it is it's just including the netfilter core
> which does not mean the inclusion of connection trakcing. It's
> only connection tracking that *may* (so don't flame me for this :)
> pose a scalability problem.
It forces all inpuit/pre/post/forward hooks to be enbled not as a direct
function call, but as additional lookups. And unability to remove
netfilter from config. And just because of couple of checksum helpers...
> > > +++ b/net/sched/act_nat.c
> > ...
> > > +#define NAT_TAB_MASK 15
> >
> > This really wants to be configurable at least via module parameter.
> >
> > > +static struct tcf_common *tcf_nat_ht[NAT_TAB_MASK + 1];
> > > +static u32 nat_idx_gen;
> > > +static DEFINE_RWLOCK(nat_lock);
> >
> > > +static struct tcf_hashinfo nat_hash_info = {
> > > + .htab = tcf_nat_ht,
> > > + .hmask = NAT_TAB_MASK,
> > > + .lock = &nat_lock,
> > > +};
> >
> > When I read this I swear I heard 'I want to be RCU'.
> > But that is another task.
>
> Yes there are a lot of clean-up's that can be done for all
> actions. You're most welcome to send patches in this area.
>
> > > + tcph = (void *)(skb_network_header(skb) + ihl);
> >
> > Were you too lazy to write struct tcphdr here and in other places? :)
>
> Unfortunately it doesn't work. For prerouting, we've not
> entered the IP stack yet so the transport header isn't set.
I meant instead of dereferencing to void * it should be struct tcphdr *.
--
Evgeniy Polyakov
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
