Vagadziri veNetfilter kusefa uye gadziriso subsystem yemapaketi etiweki seti yezvigamba zvinomhanyisa zvakanyanya kugadziridzwa kweakakura match lists (nftables set), izvo zvinoda kutarisa musanganiswa we subnets, network ports, protocol uye MAC kero. Zvimedu zvakatogamuchirwa mubazi , iyo ichatsanangurwa kuti ibatanidzwe muLinux 5.7 kernel. Iyo yakanyanya kukurumidza kukurumidza yakaitwa nekuda kwe AVX2 mirairo (mune ramangwana rakarongwa kushambadza zvakafanana optimizations zvichibva pane NEON mirairo yeARM).
Optimizations inosanganisirwa mune module (PIle PAcket POlicies), iyo inogadzirisa dambudziko rekufananidza zviri mukati mepaketi ine arbitral field state ranges inoshandiswa mukusefa mitemo, yakadai seIP uye network port ranges (nft_set_rbtree uye nft_set_hash manipulate interval matching uye kuratidzwa kwakananga kwezvikoshi). Iyo vhezheni yepipapo vectorized ichishandisa 256-bit AVX2 mirairo pane system ine AMD Epyc 7402 processor yakaratidza kuwedzera kwe420% kuita kwekuwedzera pakudhirowa zviuru makumi matatu zvinyorwa zvinosanganisira port-protocol musanganiswa. Kuwedzera pakuenzanisa musanganiswa we subnet uye nhamba yechiteshi pakuparadzanisa 30 rekodhi yaive 1000% yeIPv87 uye 4% yeIPv128.
Imwe optimization, inobvumira kushandiswa kwe8-bit machisi mapoka panzvimbo ye 4-bit, yakaratidzawo zvakakosha maitiro ekubudirira: 66% paisarura zviuru makumi matatu zvechiteshi-protocol zvinyorwa, 30% ye subnet_IPv43-port, uye 4% ye subnet_IPv61-port. Pakazara, tichifunga nezve AVX6 optimizations, kuita kwepipapo kwakawedzera mune idzi bvunzo ne2%, 766% uye 168%, zvichiteerana. Hunhu hwakawanikwa hwekufananidza hwakaoma huri pamberi peimwe munda cheki mukati (kunze kweiyo port + protocol test), asi kusvika pari zvino ivo vanosara kumashure kwekutarisa zvakananga vachishandisa uye kudonhedza zvibatiso zvichibva pane netdev.
Source: opennet.ru