{"id":74338,"date":"2020-03-16T20:42:15","date_gmt":"2020-03-16T17:42:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-yadre-linux-5-7-budut-uskoreny-slozhnye-sopostavleniya-po-spiskam-v-netfilter"},"modified":"2020-03-16T20:42:15","modified_gmt":"2020-03-16T17:42:15","slug":"v-yadre-linux-5-7-budut-uskoreny-slozhnye-sopostavleniya-po-spiskam-v-netfilter","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/v-yadre-linux-5-7-budut-uskoreny-slozhnye-sopostavleniya-po-spiskam-v-netfilter","title":{"rendered":"Le noyau Linux 5.7 va acc\u00e9l\u00e9rer les correspondances complexes dans les listes de NetFilter","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Les d\u00e9veloppeurs du sous-syst\u00e8me de filtrage et de modification des paquets r\u00e9seau Netfilter ont publi\u00e9<\/a><\/noindex> ont mis en place un ensemble de correctifs qui acc\u00e9l\u00e8rent consid\u00e9rablement le traitement de grands ensembles de correspondance (nftables set), n\u00e9cessitant une v\u00e9rification de la combinaison de sous-r\u00e9seaux, de ports r\u00e9seau, de protocoles et d'adresses MAC. Les correctifs ont d\u00e9j\u00e0 \u00e9t\u00e9 accept\u00e9s dans la branche nf-next<\/a><\/noindex>, qui sera propos\u00e9e pour inclure dans le noyau Linux 5.7. L'acc\u00e9l\u00e9ration la plus significative a \u00e9t\u00e9 obtenue gr\u00e2ce \u00e0 l'utilisation<\/a><\/noindex> des instructions AVX2 (des optimisations similaires bas\u00e9es sur les instructions NEON pour ARM devraient \u00eatre publi\u00e9es ult\u00e9rieurement).<\/p>\n

Les optimisations ont \u00e9t\u00e9 int\u00e9gr\u00e9es dans le module nft_set_pipapo<\/a><\/noindex> (PIle PAcket POlicies), qui r\u00e9sout le probl\u00e8me de la correspondance du contenu du paquet avec des plages d'\u00e9tat des champs utilis\u00e9es dans les r\u00e8gles de filtrage, telles que les plages IP et les ports r\u00e9seau (nft_set_rbtree et nft_set_hash manipulent la correspondance des intervalles et le reflet direct des valeurs). La version pipapo vectoris\u00e9e avec des instructions AVX2 \u00e0 256 bits sur un syst\u00e8me avec un processeur AMD Epyc 7402 a montr\u00e9 un gain de performance de 420 % lors de l'analyse de 30 000 enregistrements, comprenant des paires port-protocole. Le gain pour la correspondance d'une paire sous-r\u00e9seau et num\u00e9ro de port pendant l'analyse de 1 000 enregistrements \u00e9tait de 87 % pour IPv4 et de 128 % pour IPv6.
\n

\"Le<\/center><\/p>\n

Une autre optimisation permettant d'utiliser des groupes de correspondance de 8 bits au lieu de 4 bits a \u00e9galement montr\u00e9 une am\u00e9lioration significative des performances : 66 % lors de l'analyse de 30 000 enregistrements port-protocole, 43 % \u2014 sous-r\u00e9seau_IPv4-port et 61 % \u2014 sous-r\u00e9seau_IPv6-port. Au total, en tenant compte des optimisations AVX2, la performance de pipapo a augment\u00e9 dans les tests sp\u00e9cifi\u00e9s de 766 %, 168 % et 269 % respectivement. Les caract\u00e9ristiques obtenues pour des correspondances complexes surpassent les v\u00e9rifications des champs uniques dans rbtree<\/a><\/noindex> (\u00e0 l'exception du test de la paire port+protocole), mais sont encore inf\u00e9rieures aux v\u00e9rifications directes utilisant des hachages<\/a><\/noindex> et des gestionnaires de drop bas\u00e9s sur netdev.<\/p>\n

\"Le<\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Netfilter \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439, \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0443\u0441\u043a\u043e\u0440\u044f\u044e\u0449\u0438\u0445 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u0431\u043e\u043b\u044c\u0448\u0438\u0445 \u0441\u043f\u0438\u0441\u043a\u043e\u0432 \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f (nftables set), \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0441\u0435\u0442\u0435\u0439, \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u043e\u0440\u0442\u043e\u0432, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u0438 MAC-\u0430\u0434\u0440\u0435\u0441\u043e\u0432. \u041f\u0430\u0442\u0447\u0438 \u0443\u0436\u0435 \u043f\u0440\u0438\u043d\u044f\u0442\u044b \u0432 \u0432\u0435\u0442\u043a\u0443 nf-next, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0430 \u0434\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux 5.7. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0437\u0430\u043c\u0435\u0442\u043d\u043e\u0433\u043e \u0443\u0441\u043a\u043e\u0440\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044e \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439 AVX2 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74339,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-74338","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Le noyau Linux 5.7 acc\u00e9l\u00e9rera les correspondances complexes par listes dans NetFilter | ProHoster","description":"Les d\u00e9veloppeurs du sous-syst\u00e8me de filtrage et de modification des paquets r\u00e9seau Netfilter ont publi\u00e9 un ensemble de correctifs.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-yadre-linux-5-7-budut-uskoreny-slozhnye-sopostavleniya-po-spiskam-v-netfilter","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u044f\u0434\u0440\u0435 Linux 5.7 \u0431\u0443\u0434\u0443\u0442 \u0443\u0441\u043a\u043e\u0440\u0435\u043d\u044b \u0441\u043b\u043e\u0436\u043d\u044b\u0435 \u0441\u043e\u043f\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e \u0441\u043f\u0438\u0441\u043a\u0430\u043c \u0432 NetFilter | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Netfilter \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u0430\u0431\u043e\u0440 \u043f\u0430\u0442\u0447\u0435\u0439.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-yadre-linux-5-7-budut-uskoreny-slozhnye-sopostavleniya-po-spiskam-v-netfilter","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-16T17:42:15+00:00","article:modified_time":"2020-03-16T17:42:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74338","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:16:23","updated":"2022-10-05 03:20:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/74338","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=74338"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/74338\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media\/74339"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=74338"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=74338"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=74338"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}