Reorder early state dispatch for quicker outcome #22
Conversation
locate offload at the end of slowpath ... use builtin tcpudp filter in place of extra filter ... and directly yield to offload-add kworker drop invalid asap and avoid further activity on useless packets ... which accidentally simplifies main state dispatch ... so make use of optimized dispatch alternatives depending on global settings Thanks-to: @CallMeR for tcpudp filter avoidance idea Discussed: openwrt#20 Signed-Off-By: Andris PE <neandris@hmail.com>
|
Dropping invalid packets over localhost would be swapping iif lo and ct state in output along removing iif != in new prerouting. I dont feel either way, so I maintained behaviour exactly. |
As in old days, guilty not having idea on splitting state handling earlier.
No need to consume CPU in default case for unrealistic corner case. loopback invalid thus better dropped at ease. Signed-off-by: Andris PE <neandris@gmail.com>
|
@jow- this alters semantics for improved safety discarding invalid (out of state and bad checksum) packets before nat alg helpers. |
firstly netfilter doc now has only vmap-y dispatch examples secondly vmap includes "immediate" action in itself, as opposed to setting bool in lookup and in separate bytecode insnis doing immediate or full action.
|
@jow- made it vmap, netfilters own examples now has vmaps everywhere....
|
Additionally since jump target is terminal no need to preserve callaback and use goto in place of jump.
Suggested by forum user kvic at https://forum.openwrt.org/t/first-rule-in-chain-input-output-for-firewall4/204723 Average latency is same, the jitter/distribution is halved, also max latency conclusively reduced.
Suggested at https://forum.openwrt.org/t/first-rule-in-chain-input-output-for-firewall4/204723 Formally speeds up "default" nat function over loopback ipc.
|
@jow- hi, got nice pro feedback at https://forum.openwrt.org/t/first-rule-in-chain-input-output-for-firewall4/204723 and implemented best parts, 1 cosmetic 2 improves NAT performance by dozen hairs |
|
Also discovered that this adds easy flowtable exception via /e/n.d/ for more fifo-ish behaviour (still to dig up test case) |
|
No, it should sray like this short simple. |
|
Yes, default configuration is revert (2 rules swapped tough) |
locate offload at the end of slowpath
... use builtin tcpudp filter in place of extra filter ... and directly yield to offload-add kworker
drop invalid asap and avoid further activity on useless packets ... which accidentally simplifies main state dispatch ... so make use of optimized output chain dispatch alternatives depending on global setting
Thanks-to: @CallMeR for tcpudp filter avoidance idea
Thanks-to: forum user kvic for detailed review and suggestions
Discussed: #20
Part-reverts: 19a8caf
Signed-Off-By: Andris PE neandris@gmail.com