| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
commit r30917 ("kernel: bypass all netfilter hooks if the sysctls for that
functionality have been disabled - eliminates the overhead of enabling
CONFIG_BRIDGE_NETFILTER in the kernel config") introduced an optimization
which should reduce/eliminate the overhead for traffic send over bridges on
kernels compiled with CONFIG_BRIDGE_NETFILTER=y. But this optimization
breaks the nf_call_iptables per bridge setting which is more fine grained
than the global sysctl net.bridge.bridge-nf-call-iptables setting.
A test reflecting a real world setup was created to identify if this really
eliminates the overhead and if per-bridge nf_call_iptables could be used in
some setups to increase the throughput. A Qualcomm Atheros QCA9558 based
system with one ethernet and an ath9k wifi 3x3 in HT40 mode was used.
Cables from the AP to the wifi station were used to reduce interference
problems during the tests.
The wlan interface was put in one bridge interface called br-wlan. This
bridge usually contains some more wlan interfaces. The eth0 was put in a
second bridge called br-lan. This usually contains some other privileged
wlan or mesh interfaces. Routing was added between br-lan and br-wlan.
Three kernels were tested:
* (default) OpenWrt kernel for this device
* (brfilter-global) OpenWrt kernel with CONFIG_BRIDGE_NETFILTER=y
* (brfilter-local) OpenWrt kernel with CONFIG_BRIDGE_NETFILTER=y and
without 644-bridge_optimize_netfilter_hooks.patch
The changes to the the netfilter settings of the bridge were done via:
* (brfilter-global) /sbin/sysctl -w net.bridge.bridge-nf-call-iptables=1
* (brfilter-lobal) echo 1 > /sys/class/net/br-lan/bridge/nf_call_iptables
and/or echo 1 > /sys/class/net/br-wan/bridge/nf_call_iptables
A station connected to the wlan0 (AP) interface was used to send traffic to
a PC connected via ethernet. iperf with 3 concurrent transmissions was used
to generate the traffic.
| kernel | br-nf-* global | nf-call* iface | download | upload |
|-----------------|----------------|----------------|----------|----------|
| default | 0 | - | 209 | 268 |
| brfilter-global | 0 | - | 185 | 243 |
| brfilter-local | 0 | - | 187 | 243 |
| brfilter-local | 0 | br-lan | 157 | 226 |
| brfilter-local | 0 | br-lan br-wlan | 139 | 161 |
| brfilter-global | 1 | - | 136 | 162 |
Download/upload results in Mibit/s
It can be seen that the patch doesn't eliminate the overhead. It can also
be seen that the throughput of brfilter-global and brfilter-local with
disabled filtering is the roughly the same. Also the throughput for
brfilter-global and brfilter-local for enabled filtering on all bridges is
roughly the same.
But also the brfilter-local throughput is higher when only br-lan requires
the filtering. This setting would not be possible with
644-bridge_optimize_netfilter_hooks.patch applied and thus can only be
compared with brfilter-global and filtering enabled for all interfaces.
Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
SVN-Revision: 46835
|
| |
|
|
|
|
| |
It was initially added in r30917 by nbd.
SVN-Revision: 46827
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch introduces some code that is compiled in whenever
CONFIG_BRIDGE_NETFILTER is built, with the code called from code compiled under
CONFIG_BRIDGE, CONFIG_BRIDGE_IGMP_SNOOPING or CONFIG_BRIDGE_NF_EBTABLES.
Unfortunately, these options aren't setting explicitly the dependency they now
have on CONFIG_BRIDGE_NETFILTER, for obvious reasons for CONFIG_BRIDGE.
However, this is not working really well when CONFIG_BRIDGE_NETFILTER is built
as a module, since code statically compiled will now use a function that is not
in the kernel image, which makes the linker grumpy.
Solve this by removing the option to build CONFIG_BRIDGE_NETFILTER as a module,
and protect our function definition by an IS_BUILTIN instead of a IS_ENABLED
macro. This fixes the issue for CONFIG_BRIDGE and CONFIG_BRIDGE_IGMP_SNOOPING.
Fixing CONFIG_BRIDGE_NF_EBTABLES has to be handled a bit differently, since it
directly references a variable that will not be declared if
CONFIG_BRIDGE_NETFILTER is not set. Protect the variable affectations by an
ifdef to make sure this doesn't happen.
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Florian Fainelli <florian@openwrt.org>
SVN-Revision: 43419
|
| |
|
|
|
|
| |
Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
SVN-Revision: 43357
|
| |
|
|
|
|
| |
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 43095
|
|
|
This commit:
1) Copies 3.14 patches
2) Drops mainlined stuff
3) Modifies some patches to apply
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 43093
|
