{"id":74338,"date":"2020-03-16T20:42:15","date_gmt":"2020-03-16T17:42:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-yadre-linux-5-7-budut-uskoreny-slozhnye-sopostavleniya-po-spiskam-v-netfilter"},"modified":"2020-03-16T20:42:15","modified_gmt":"2020-03-16T17:42:15","slug":"v-yadre-linux-5-7-budut-uskoreny-slozhnye-sopostavleniya-po-spiskam-v-netfilter","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-yadre-linux-5-7-budut-uskoreny-slozhnye-sopostavleniya-po-spiskam-v-netfilter","title":{"rendered":"Linux kernel 5.7 will accelerate complex list matching in NetFilter","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Developers of the Netfilter packet filtering and modification subsystem have published<\/a><\/noindex> have released a set of patches that significantly accelerate the processing of large matching lists (nftables set), where checks for subnet combinations, network ports, protocol, and MAC addresses are required. The patches have already been accepted into the branch nf-next<\/a><\/noindex>, which will be proposed for inclusion in the Linux 5.7 kernel. The most notable acceleration has been achieved due to the utilization of<\/a><\/noindex> AVX2 instructions (similar optimizations based on NEON instructions for ARM are planned for future publication).<\/p>\n

Optimizations have been made in the module nft_set_pipapo<\/a><\/noindex> (PIle PAcket POlicies), which addresses the task of matching packet content with arbitrary value ranges defined in filtering rules, such as ranges of IP and network ports (nft_set_rbtree and nft_set_hash handle interval matching and direct value mirroring). The vectorized version of pipapo using 256-bit AVX2 instructions on an AMD Epyc 7402 processor showed a performance increase of 420% when parsing 30,000 entries that included port-protocol pairs. The increase for matching subnet-port pairs when parsing 1,000 entries was 87% for IPv4 and 128% for IPv6.
\n

\"Linux<\/center><\/p>\n

Another optimization that allows using 8-bit matching groups instead of 4-bit ones also showed a significant performance increase: 66% when parsing 30,000 records of port-protocol, 43% for subnet_IPv4-port, and 61% for subnet_IPv6-port. In total, considering the AVX2 optimizations, pipapo performance increased in the specified tests by 766%, 168%, and 269%, respectively. The characteristics obtained for complex matches surpass those of single field checks. rbtree<\/a><\/noindex> (except for the port+protocol pair test), but still lag behind direct checks using hashes<\/a><\/noindex> and drop handlers based on netdev.<\/p>\n

\"Linux<\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Source: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Netfilter \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439, \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0443\u0441\u043a\u043e\u0440\u044f\u044e\u0449\u0438\u0445 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u0431\u043e\u043b\u044c\u0448\u0438\u0445 \u0441\u043f\u0438\u0441\u043a\u043e\u0432 \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f (nftables set), \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0441\u0435\u0442\u0435\u0439, \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u043e\u0440\u0442\u043e\u0432, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u0438 MAC-\u0430\u0434\u0440\u0435\u0441\u043e\u0432. \u041f\u0430\u0442\u0447\u0438 \u0443\u0436\u0435 \u043f\u0440\u0438\u043d\u044f\u0442\u044b \u0432 \u0432\u0435\u0442\u043a\u0443 nf-next, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0430 \u0434\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux 5.7. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0437\u0430\u043c\u0435\u0442\u043d\u043e\u0433\u043e \u0443\u0441\u043a\u043e\u0440\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044e \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439 AVX2 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74339,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74338","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Complex matches by lists in NetFilter will be accelerated in Linux kernel 5.7 | ProHoster","description":"Developers of the Netfilter packet filtering and modification subsystem have published a set of patches.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/v-yadre-linux-5-7-budut-uskoreny-slozhnye-sopostavleniya-po-spiskam-v-netfilter","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u044f\u0434\u0440\u0435 Linux 5.7 \u0431\u0443\u0434\u0443\u0442 \u0443\u0441\u043a\u043e\u0440\u0435\u043d\u044b \u0441\u043b\u043e\u0436\u043d\u044b\u0435 \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e \u0441\u043f\u0438\u0441\u043a\u0430\u043c \u0432 NetFilter | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Netfilter \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/v-yadre-linux-5-7-budut-uskoreny-slozhnye-sopostavleniya-po-spiskam-v-netfilter","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-16T17:42:15+00:00","article:modified_time":"2020-03-16T17:42:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74338","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:16:23","updated":"2022-10-05 03:20:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/74338","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=74338"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/74338\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/74339"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=74338"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=74338"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=74338"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}