{"id":74338,"date":"2020-03-16T20:42:15","date_gmt":"2020-03-16T17:42:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-yadre-linux-5-7-budut-uskoreny-slozhnye-sopostavleniya-po-spiskam-v-netfilter"},"modified":"2020-03-16T20:42:15","modified_gmt":"2020-03-16T17:42:15","slug":"v-yadre-linux-5-7-budut-uskoreny-slozhnye-sopostavleniya-po-spiskam-v-netfilter","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/news\/v-yadre-linux-5-7-budut-uskoreny-slozhnye-sopostavleniya-po-spiskam-v-netfilter","title":{"rendered":"En el n\u00facleo de Linux 5.7 se acelerar\u00e1n las coincidencias complejas en listas en NetFilter.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Los desarrolladores del subsistema de filtrado y modificaci\u00f3n de paquetes de red Netfilter publicaron<\/a><\/noindex> han lanzado un conjunto de parches que aceleran significativamente el procesamiento de grandes listas de coincidencias (nftables set), donde se requiere la verificaci\u00f3n de combinaciones de subredes, puertos de red, protocolos y direcciones MAC. Los parches ya han sido aceptados en la rama nf-next<\/a><\/noindex>, que se propondr\u00e1 para su inclusi\u00f3n en el n\u00facleo de Linux 5.7. Se logr\u00f3 la mayor aceleraci\u00f3n gracias a la utilizaci\u00f3n de<\/a><\/noindex> instrucciones AVX2 (se planea publicar optimizaciones similares basadas en instrucciones NEON para ARM en el futuro).<\/p>\n

Las optimizaciones se han incorporado en el m\u00f3dulo nft_set_pipapo<\/a><\/noindex> (PIle PAcket POlicies), que resuelve la tarea de coincidir el contenido del paquete con rangos de estado arbitrarios establecidos en las reglas de filtrado, como rangos de IP y puertos de red (nft_set_rbtree y nft_set_hash manipulan la coincidencia de intervalos y el reflejo directo de valores). La versi\u00f3n de pipapo vectorizada con instrucciones AVX2 de 256 bits en un sistema con un procesador AMD Epyc 7402 mostr\u00f3 un aumento de rendimiento del 420% al analizar 30.000 entradas que incluyen combinaciones puerto-protocolo. El aumento en la coincidencia de combinaciones de subred y n\u00famero de puerto al analizar 1.000 entradas fue del 87% para IPv4 y del 128% para IPv6.
\n

\"En<\/center><\/p>\n

Otra optimizaci\u00f3n, que permite usar grupos de coincidencia de 8 bits en lugar de grupos de 4 bits, tambi\u00e9n mostr\u00f3 un aumento significativo en el rendimiento: 66% al analizar 30,000 registros de puerto-protocolo, 43% \u2014 subred_IPv4-puerto y 61% \u2014 subred_IPv6-puerto. En total, considerando las optimizaciones AVX2, el rendimiento de pipapo aument\u00f3 en los tests mencionados en un 766%, 168% y 269% respectivamente. Las caracter\u00edsticas obtenidas para coincidencias complejas superan las verificaciones de campos individuales en rbtree<\/a><\/noindex> (excepto en la prueba de la combinaci\u00f3n puerto+protocolo), aunque todav\u00eda se quedan atr\u00e1s en comparaci\u00f3n con las verificaciones directas utilizando hashes<\/a><\/noindex> y drop-handlers basados en netdev.<\/p>\n

\"En<\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Fuente: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Netfilter \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439, \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0443\u0441\u043a\u043e\u0440\u044f\u044e\u0449\u0438\u0445 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u0431\u043e\u043b\u044c\u0448\u0438\u0445 \u0441\u043f\u0438\u0441\u043a\u043e\u0432 \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f (nftables set), \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0441\u0435\u0442\u0435\u0439, \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u043e\u0440\u0442\u043e\u0432, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u0438 MAC-\u0430\u0434\u0440\u0435\u0441\u043e\u0432. \u041f\u0430\u0442\u0447\u0438 \u0443\u0436\u0435 \u043f\u0440\u0438\u043d\u044f\u0442\u044b \u0432 \u0432\u0435\u0442\u043a\u0443 nf-next, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0430 \u0434\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux 5.7. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0437\u0430\u043c\u0435\u0442\u043d\u043e\u0433\u043e \u0443\u0441\u043a\u043e\u0440\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044e \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439 AVX2 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74339,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74338","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Las coincidencias complejas en listas en NetFilter ser\u00e1n aceleradas en el n\u00facleo de Linux 5.7 | ProHoster","description":"Los desarrolladores del subsistema de filtrado y modificaci\u00f3n de paquetes de red Netfilter han publicado un conjunto de parches.","canonical_url":"https:\/\/prohoster.info\/es\/blog\/news\/v-yadre-linux-5-7-budut-uskoreny-slozhnye-sopostavleniya-po-spiskam-v-netfilter","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u044f\u0434\u0440\u0435 Linux 5.7 \u0431\u0443\u0434\u0443\u0442 \u0443\u0441\u043a\u043e\u0440\u0435\u043d\u044b \u0441\u043b\u043e\u0436\u043d\u044b\u0435 \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e \u0441\u043f\u0438\u0441\u043a\u0430\u043c \u0432 NetFilter | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Netfilter \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439.","og:url":"https:\/\/prohoster.info\/es\/blog\/news\/v-yadre-linux-5-7-budut-uskoreny-slozhnye-sopostavleniya-po-spiskam-v-netfilter","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-16T17:42:15+00:00","article:modified_time":"2020-03-16T17:42:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74338","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:16:23","updated":"2022-10-05 03:20:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/74338","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=74338"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/74338\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media\/74339"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=74338"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=74338"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=74338"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}