Linux协议栈优化之Netfilter分类conntrack

版权声明:本文为博主原创,无版权,未经博主允许可以随意转载,无需注明出处,随意修改或保持可作为原创! https://blog.csdn.net/dog250/article/details/41175615
首先,如果你不同意我以下的观点,本文就不必看了:如今内存不值钱,空间换时间很划算,要知道,一万年前的1秒和一万年后1秒是一样的,你要是觉得人们做的事情可能不同,但是请记住,永远都会发生“安迪给你的被比尔拿走”之类的事情,对于你而言,什么都没有改变!
       虽然空间可以被拓展,但是要讲技巧。以下是一张截图,测试的是http服务器的常规性能,我依然使用相对值比较,因为我的电脑压不出真实性能,另外,为了将网络影响降低,我使用了本地环回地址,我的目的是测试conntrack对新建连接数的影响,截图如下:

如果你稍微明白一些conntrack的原理,就会明白它的开销主要集中在两个方面,一个是查找开销,在内存不值钱的年代,可以通过设置很大的hash bucket来缓解,另外一个开销就是分配conn结构体内存的开销。如果在一台压力很大的设备上,短连接特别多,所有的conntrack将会在一张hash表内,我们所能指望的就是针对一个五元组计算的hash值足够散列了,如果对于一些攻击流量,特别是当他研究了Linux计算conntrack hash值的算法后,他会构造很多hash一致的不同五元组的数据包,这会使得hash表的冲突链表过长,遍历开销过大,在当前的内核conntrack模块实现中,这是无法避免的,因为所有鸡蛋都在一个篮子里面。现在换一个思路。
       将不同类的数据流分到不同的hash表中如何?也就是说将一张大表拆分成几张小表,或者说如果你真的不在乎内存的话,设置多张大表也行!那么剩下的问题就是将数据包进行分类了。可以有两种实现:
1.在RAW表中做一个模块
根据skb的特征设置其conntrack表索引,值得注意的是,为了避免同一个流分配到不同的hash表,match项必须是计算hash的元素,比如源/目标IP,源/目标端口,协议等。对于IP分片直接通过,不予考虑。
2.在MANGLE表中做一个优先级大于conntrack小于defrag的模块
这个就不多说了,和1一样,就是解决了IP分片的问题。
iptables规则如下:
iptables -t mangle -A PREROUTING -s 1.1.1.0/24 -j CONNMAP 2
以上规则将源IP为1.1.1.0/24段的数据包的conntrack设置在表2中。你也可以区分TCP协议和UDP协议,每一个协议一张表,这样就可以避免恶意UDP流量攻击问题。在加载模块的时候,你需要设置一个参数,即hash表的数量。
       为了快速测试效果,我依然是先将代码写死,设置了3张hash表,基于内核3.2.5,两个patch如下:
C文件patch:

diff -uNr linux-source-3.2/net/ipv4/netfilter/ipt_MASQUERADE.c linux-source-3.2.new/net/ipv4/netfilter/ipt_MASQUERADE.c
--- linux-source-3.2/net/ipv4/netfilter/ipt_MASQUERADE.c        2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/ipv4/netfilter/ipt_MASQUERADE.c    2014-07-11 10:32:57.736666273 +0800
@@ -85,7 +85,7 @@
                  mr->range[0].min, mr->range[0].max });
 
        /* Hand modified range to generic setup. */
-       return nf_nat_setup_info(ct, &newrange, IP_NAT_MANIP_SRC);
+       return nf_nat_setup_info(ct, &newrange, IP_NAT_MANIP_SRC, 0);
 }
 
 static int
diff -uNr linux-source-3.2/net/ipv4/netfilter/ipt_NETMAP.c linux-source-3.2.new/net/ipv4/netfilter/ipt_NETMAP.c
--- linux-source-3.2/net/ipv4/netfilter/ipt_NETMAP.c    2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/ipv4/netfilter/ipt_NETMAP.c        2014-07-11 10:35:14.976667434 +0800
@@ -67,7 +67,7 @@
                  mr->range[0].min, mr->range[0].max });
 
        /* Hand modified range to generic setup. */
-       return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(par->hooknum));
+       return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(par->hooknum), 0);
 }
 
 static struct xt_target netmap_tg_reg __read_mostly = {
diff -uNr linux-source-3.2/net/ipv4/netfilter/ipt_REDIRECT.c linux-source-3.2.new/net/ipv4/netfilter/ipt_REDIRECT.c
--- linux-source-3.2/net/ipv4/netfilter/ipt_REDIRECT.c  2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/ipv4/netfilter/ipt_REDIRECT.c      2014-07-11 10:36:45.760668202 +0800
@@ -82,7 +82,7 @@
                  mr->range[0].min, mr->range[0].max });
 
        /* Hand modified range to generic setup. */
-       return nf_nat_setup_info(ct, &newrange, IP_NAT_MANIP_DST);
+       return nf_nat_setup_info(ct, &newrange, IP_NAT_MANIP_DST, 0);
 }
 
 static struct xt_target redirect_tg_reg __read_mostly = {
diff -uNr linux-source-3.2/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c linux-source-3.2.new/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
--- linux-source-3.2/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c     2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c 2014-07-11 15:03:50.596093049 +0800
@@ -151,6 +151,12 @@
                                      const struct net_device *out,
                                      int (*okfn)(struct sk_buff *))
 {
+       struct iphdr *hdr = ip_hdr(skb);
+       if (ipv4_is_loopback(hdr->saddr)||ipv4_is_loopback(hdr->daddr)) {
+               skb->ij = 1;
+       } else {
+               skb->ij = 0;
+       }
        return nf_conntrack_in(dev_net(in), PF_INET, hooknum, skb);
 }
 
@@ -160,6 +166,12 @@
                                         const struct net_device *out,
                                         int (*okfn)(struct sk_buff *))
 {
+       struct iphdr *hdr = ip_hdr(skb);
+       if (ipv4_is_loopback(hdr->saddr)||ipv4_is_loopback(hdr->daddr)) {
+               skb->ij = 1;
+       } else {
+               skb->ij = 0;
+       }
        /* root is playing with raw sockets. */
        if (skb->len < sizeof(struct iphdr) ||
            ip_hdrlen(skb) < sizeof(struct iphdr))
@@ -254,7 +266,7 @@
 getorigdst(struct sock *sk, int optval, void __user *user, int *len)
 {
        const struct inet_sock *inet = inet_sk(sk);
-       const struct nf_conntrack_tuple_hash *h;
+       /*const struct nf_conntrack_tuple_hash *h;*/
        struct nf_conntrack_tuple tuple;
 
        memset(&tuple, 0, sizeof(tuple));
@@ -276,7 +288,7 @@
                         *len, sizeof(struct sockaddr_in));
                return -EINVAL;
        }
-
+/*
        h = nf_conntrack_find_get(sock_net(sk), NF_CT_DEFAULT_ZONE, &tuple);
        if (h) {
                struct sockaddr_in sin;
@@ -297,6 +309,7 @@
                else
                        return 0;
        }
+*/
        pr_debug("SO_ORIGINAL_DST: Can't find %pI4/%u-%pI4/%u.\n",
                 &tuple.src.u3.ip, ntohs(tuple.src.u.tcp.port),
                 &tuple.dst.u3.ip, ntohs(tuple.dst.u.tcp.port));
diff -uNr linux-source-3.2/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c linux-source-3.2.new/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
--- linux-source-3.2/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c      2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c  2014-07-11 09:11:02.144624681 +0800
@@ -38,7 +38,7 @@
             st->bucket < net->ct.htable_size;
             st->bucket++) {
                n = rcu_dereference(
-                       hlist_nulls_first_rcu(&net->ct.hash[st->bucket]));
+                       hlist_nulls_first_rcu(&net->ct.hash[0][st->bucket]));
                if (!is_a_nulls(n))
                        return n;
        }
@@ -58,7 +58,7 @@
                                return NULL;
                }
                head = rcu_dereference(
-                       hlist_nulls_first_rcu(&net->ct.hash[st->bucket]));
+                       hlist_nulls_first_rcu(&net->ct.hash[0][st->bucket]));
        }
        return head;
 }
diff -uNr linux-source-3.2/net/ipv4/netfilter/nf_conntrack_proto_icmp.c linux-source-3.2.new/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
--- linux-source-3.2/net/ipv4/netfilter/nf_conntrack_proto_icmp.c       2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/ipv4/netfilter/nf_conntrack_proto_icmp.c   2014-07-11 09:55:31.704647269 +0800
@@ -148,7 +148,7 @@
 
        *ctinfo = IP_CT_RELATED;
 
-       h = nf_conntrack_find_get(net, zone, &innertuple);
+       h = nf_conntrack_find_get(net, zone, &innertuple, skb->ij);
        if (!h) {
                pr_debug("icmp_error_message: no match\n");
                return -NF_ACCEPT;
diff -uNr linux-source-3.2/net/ipv4/netfilter/nf_nat_core.c linux-source-3.2.new/net/ipv4/netfilter/nf_nat_core.c
--- linux-source-3.2/net/ipv4/netfilter/nf_nat_core.c   2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/ipv4/netfilter/nf_nat_core.c       2014-07-11 10:24:16.544661863 +0800
@@ -74,7 +74,7 @@
        struct nf_conntrack_tuple reply;
 
        nf_ct_invert_tuplepr(&reply, tuple);
-       return nf_conntrack_tuple_taken(&reply, ignored_conntrack);
+       return nf_conntrack_tuple_taken(&reply, ignored_conntrack, 0);
 }
 EXPORT_SYMBOL(nf_nat_used_tuple);
 
@@ -206,7 +206,7 @@
                 const struct nf_conntrack_tuple *orig_tuple,
                 const struct nf_nat_range *range,
                 struct nf_conn *ct,
-                enum nf_nat_manip_type maniptype)
+                enum nf_nat_manip_type maniptype, int ij)
 {
        struct net *net = nf_ct_net(ct);
        const struct nf_nat_protocol *proto;
@@ -268,7 +268,7 @@
 unsigned int
 nf_nat_setup_info(struct nf_conn *ct,
                  const struct nf_nat_range *range,
-                 enum nf_nat_manip_type maniptype)
+                 enum nf_nat_manip_type maniptype, int ij)
 {
        struct net *net = nf_ct_net(ct);
        struct nf_conntrack_tuple curr_tuple, new_tuple;
@@ -296,7 +296,7 @@
        nf_ct_invert_tuplepr(&curr_tuple,
                             &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 
-       get_unique_tuple(&new_tuple, &curr_tuple, range, ct, maniptype);
+       get_unique_tuple(&new_tuple, &curr_tuple, range, ct, maniptype, ij);
 
        if (!nf_ct_tuple_equal(&new_tuple, &curr_tuple)) {
                struct nf_conntrack_tuple reply;
@@ -670,7 +670,7 @@
        if (nf_nat_initialized(ct, manip))
                return -EEXIST;
 
-       return nf_nat_setup_info(ct, &range, manip);
+       return nf_nat_setup_info(ct, &range, manip, 0);
 }
 #else
 static int
diff -uNr linux-source-3.2/net/ipv4/netfilter/nf_nat_h323.c linux-source-3.2.new/net/ipv4/netfilter/nf_nat_h323.c
--- linux-source-3.2/net/ipv4/netfilter/nf_nat_h323.c   2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/ipv4/netfilter/nf_nat_h323.c       2014-07-11 10:08:16.712653742 +0800
@@ -411,14 +411,14 @@
        /* Change src to where master sends to */
        range.flags = IP_NAT_RANGE_MAP_IPS;
        range.min_ip = range.max_ip = new->tuplehash[!this->dir].tuple.src.u3.ip;
-       nf_nat_setup_info(new, &range, IP_NAT_MANIP_SRC);
+       nf_nat_setup_info(new, &range, IP_NAT_MANIP_SRC, 0);
 
        /* For DST manip, map port here to where it's expected. */
        range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED);
        range.min = range.max = this->saved_proto;
        range.min_ip = range.max_ip =
            new->master->tuplehash[!this->dir].tuple.src.u3.ip;
-       nf_nat_setup_info(new, &range, IP_NAT_MANIP_DST);
+       nf_nat_setup_info(new, &range, IP_NAT_MANIP_DST, 0);
 }
 
 /****************************************************************************/
@@ -504,13 +504,13 @@
        /* Change src to where master sends to */
        range.flags = IP_NAT_RANGE_MAP_IPS;
        range.min_ip = range.max_ip = new->tuplehash[!this->dir].tuple.src.u3.ip;
-       nf_nat_setup_info(new, &range, IP_NAT_MANIP_SRC);
+       nf_nat_setup_info(new, &range, IP_NAT_MANIP_SRC, 0);
 
        /* For DST manip, map port here to where it's expected. */
        range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED);
        range.min = range.max = this->saved_proto;
        range.min_ip = range.max_ip = this->saved_ip;
-       nf_nat_setup_info(new, &range, IP_NAT_MANIP_DST);
+       nf_nat_setup_info(new, &range, IP_NAT_MANIP_DST, 0);
 }
 
 /****************************************************************************/
diff -uNr linux-source-3.2/net/ipv4/netfilter/nf_nat_helper.c linux-source-3.2.new/net/ipv4/netfilter/nf_nat_helper.c
--- linux-source-3.2/net/ipv4/netfilter/nf_nat_helper.c 2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/ipv4/netfilter/nf_nat_helper.c     2014-07-11 10:08:55.008654066 +0800
@@ -439,13 +439,13 @@
        range.flags = IP_NAT_RANGE_MAP_IPS;
        range.min_ip = range.max_ip
                = ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip;
-       nf_nat_setup_info(ct, &range, IP_NAT_MANIP_SRC);
+       nf_nat_setup_info(ct, &range, IP_NAT_MANIP_SRC, 0);
 
        /* For DST manip, map port here to where it's expected. */
        range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED);
        range.min = range.max = exp->saved_proto;
        range.min_ip = range.max_ip
                = ct->master->tuplehash[!exp->dir].tuple.src.u3.ip;
-       nf_nat_setup_info(ct, &range, IP_NAT_MANIP_DST);
+       nf_nat_setup_info(ct, &range, IP_NAT_MANIP_DST, 0);
 }
 EXPORT_SYMBOL(nf_nat_follow_master);
diff -uNr linux-source-3.2/net/ipv4/netfilter/nf_nat_pptp.c linux-source-3.2.new/net/ipv4/netfilter/nf_nat_pptp.c
--- linux-source-3.2/net/ipv4/netfilter/nf_nat_pptp.c   2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/ipv4/netfilter/nf_nat_pptp.c       2014-07-11 10:08:35.424653900 +0800
@@ -95,7 +95,7 @@
                range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
                range.min = range.max = exp->saved_proto;
        }
-       nf_nat_setup_info(ct, &range, IP_NAT_MANIP_SRC);
+       nf_nat_setup_info(ct, &range, IP_NAT_MANIP_SRC, 0);
 
        /* For DST manip, map port here to where it's expected. */
        range.flags = IP_NAT_RANGE_MAP_IPS;
@@ -105,7 +105,7 @@
                range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
                range.min = range.max = exp->saved_proto;
        }
-       nf_nat_setup_info(ct, &range, IP_NAT_MANIP_DST);
+       nf_nat_setup_info(ct, &range, IP_NAT_MANIP_DST, 0);
 }
 
 /* outbound packets == from PNS to PAC */
diff -uNr linux-source-3.2/net/ipv4/netfilter/nf_nat_rule.c linux-source-3.2.new/net/ipv4/netfilter/nf_nat_rule.c
--- linux-source-3.2/net/ipv4/netfilter/nf_nat_rule.c   2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/ipv4/netfilter/nf_nat_rule.c       2014-07-11 10:09:31.024654370 +0800
@@ -56,7 +56,7 @@
                            ctinfo == IP_CT_RELATED_REPLY));
        NF_CT_ASSERT(par->out != NULL);
 
-       return nf_nat_setup_info(ct, &mr->range[0], IP_NAT_MANIP_SRC);
+       return nf_nat_setup_info(ct, &mr->range[0], IP_NAT_MANIP_SRC, 0);
 }
 
 static unsigned int
@@ -74,7 +74,7 @@
        /* Connection must be valid and new. */
        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
 
-       return nf_nat_setup_info(ct, &mr->range[0], IP_NAT_MANIP_DST);
+       return nf_nat_setup_info(ct, &mr->range[0], IP_NAT_MANIP_DST, 0);
 }
 
 static int ipt_snat_checkentry(const struct xt_tgchk_param *par)
@@ -115,7 +115,7 @@
                 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip :
                 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip);
 
-       return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum));
+       return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum), 0);
 }
 
 int nf_nat_rule_find(struct sk_buff *skb,
diff -uNr linux-source-3.2/net/ipv4/netfilter/nf_nat_sip.c linux-source-3.2.new/net/ipv4/netfilter/nf_nat_sip.c
--- linux-source-3.2/net/ipv4/netfilter/nf_nat_sip.c    2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/ipv4/netfilter/nf_nat_sip.c        2014-07-11 10:07:40.744653437 +0800
@@ -259,7 +259,7 @@
        range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED);
        range.min = range.max = exp->saved_proto;
        range.min_ip = range.max_ip = exp->saved_ip;
-       nf_nat_setup_info(ct, &range, IP_NAT_MANIP_DST);
+       nf_nat_setup_info(ct, &range, IP_NAT_MANIP_DST, 0);
 
        /* Change src to where master sends to, but only if the connection
         * actually came from the same source. */
@@ -268,7 +268,7 @@
                range.flags = IP_NAT_RANGE_MAP_IPS;
                range.min_ip = range.max_ip
                        = ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip;
-               nf_nat_setup_info(ct, &range, IP_NAT_MANIP_SRC);
+               nf_nat_setup_info(ct, &range, IP_NAT_MANIP_SRC, 0);
        }
 }
 
diff -uNr linux-source-3.2/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c linux-source-3.2.new/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
--- linux-source-3.2/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c     2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c 2014-07-11 09:12:04.320625207 +0800
@@ -165,7 +165,7 @@
 
        *ctinfo = IP_CT_RELATED;
 
-       h = nf_conntrack_find_get(net, zone, &intuple);
+       h = nf_conntrack_find_get(net, zone, &intuple, skb->ij);
        if (!h) {
                pr_debug("icmpv6_error: no match\n");
                return -NF_ACCEPT;
diff -uNr linux-source-3.2/net/netfilter/ipvs/ip_vs_nfct.c linux-source-3.2.new/net/netfilter/ipvs/ip_vs_nfct.c
--- linux-source-3.2/net/netfilter/ipvs/ip_vs_nfct.c    2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/netfilter/ipvs/ip_vs_nfct.c        2014-07-11 11:10:42.224685433 +0800
@@ -270,7 +270,7 @@
                __func__, ARG_TUPLE(&tuple), ARG_CONN(cp));
 
        h = nf_conntrack_find_get(ip_vs_conn_net(cp), NF_CT_DEFAULT_ZONE,
-                                 &tuple);
+                                 &tuple, 0);
        if (h) {
                ct = nf_ct_tuplehash_to_ctrack(h);
                /* Show what happens instead of calling nf_ct_kill() */
diff -uNr linux-source-3.2/net/netfilter/nf_conntrack_core.c linux-source-3.2.new/net/netfilter/nf_conntrack_core.c
--- linux-source-3.2/net/netfilter/nf_conntrack_core.c  2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/netfilter/nf_conntrack_core.c      2014-07-11 10:48:19.948674076 +0800
@@ -316,7 +316,7 @@
  */
 static struct nf_conntrack_tuple_hash *
 ____nf_conntrack_find(struct net *net, u16 zone,
-                     const struct nf_conntrack_tuple *tuple, u32 hash)
+                     const struct nf_conntrack_tuple *tuple, u32 hash, int ij)
 {
        struct nf_conntrack_tuple_hash *h;
        struct hlist_nulls_node *n;
@@ -327,7 +327,7 @@
         */
        local_bh_disable();
 begin:
-       hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[bucket], hnnode) {
+       hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[ij][bucket], hnnode) {
                if (nf_ct_tuple_equal(tuple, &h->tuple) &&
                    nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)) == zone) {
                        NF_CT_STAT_INC(net, found);
@@ -352,24 +352,24 @@
 
 struct nf_conntrack_tuple_hash *
 __nf_conntrack_find(struct net *net, u16 zone,
-                   const struct nf_conntrack_tuple *tuple)
+                   const struct nf_conntrack_tuple *tuple, int ij)
 {
        return ____nf_conntrack_find(net, zone, tuple,
-                                    hash_conntrack_raw(tuple, zone));
+                                    hash_conntrack_raw(tuple, zone), ij);
 }
 EXPORT_SYMBOL_GPL(__nf_conntrack_find);
 
 /* Find a connection corresponding to a tuple. */
 static struct nf_conntrack_tuple_hash *
 __nf_conntrack_find_get(struct net *net, u16 zone,
-                       const struct nf_conntrack_tuple *tuple, u32 hash)
+                       const struct nf_conntrack_tuple *tuple, u32 hash, int ij)
 {
        struct nf_conntrack_tuple_hash *h;
        struct nf_conn *ct;
 
        rcu_read_lock();
 begin:
-       h = ____nf_conntrack_find(net, zone, tuple, hash);
+       h = ____nf_conntrack_find(net, zone, tuple, hash, ij);
        if (h) {
                ct = nf_ct_tuplehash_to_ctrack(h);
                if (unlikely(nf_ct_is_dying(ct) ||
@@ -390,26 +390,27 @@
 
 struct nf_conntrack_tuple_hash *
 nf_conntrack_find_get(struct net *net, u16 zone,
-                     const struct nf_conntrack_tuple *tuple)
+                     const struct nf_conntrack_tuple *tuple, int ij)
 {
        return __nf_conntrack_find_get(net, zone, tuple,
-                                      hash_conntrack_raw(tuple, zone));
+                                      hash_conntrack_raw(tuple, zone), ij);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_find_get);
 
 static void __nf_conntrack_hash_insert(struct nf_conn *ct,
                                       unsigned int hash,
-                                      unsigned int repl_hash)
+                                      unsigned int repl_hash,
+                                       int ij)
 {
        struct net *net = nf_ct_net(ct);
 
        hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
-                          &net->ct.hash[hash]);
+                          &net->ct.hash[ij][hash]);
        hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode,
-                          &net->ct.hash[repl_hash]);
+                          &net->ct.hash[ij][repl_hash]);
 }
 
-void nf_conntrack_hash_insert(struct nf_conn *ct)
+void nf_conntrack_hash_insert(struct nf_conn *ct, int ij)
 {
        struct net *net = nf_ct_net(ct);
        unsigned int hash, repl_hash;
@@ -419,7 +420,7 @@
        hash = hash_conntrack(net, zone, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
        repl_hash = hash_conntrack(net, zone, &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 
-       __nf_conntrack_hash_insert(ct, hash, repl_hash);
+       __nf_conntrack_hash_insert(ct, hash, repl_hash, ij);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
 
@@ -479,12 +480,12 @@
        /* See if there's one in the list already, including reverse:
           NAT could have grabbed it without realizing, since we're
           not in the hash.  If there is, we lost race. */
-       hlist_nulls_for_each_entry(h, n, &net->ct.hash[hash], hnnode)
+       hlist_nulls_for_each_entry(h, n, &net->ct.hash[skb->ij][hash], hnnode)
                if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
                                      &h->tuple) &&
                    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
                        goto out;
-       hlist_nulls_for_each_entry(h, n, &net->ct.hash[repl_hash], hnnode)
+       hlist_nulls_for_each_entry(h, n, &net->ct.hash[skb->ij][repl_hash], hnnode)
                if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
                                      &h->tuple) &&
                    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
@@ -514,7 +515,7 @@
         * guarantee that no other CPU can find the conntrack before the above
         * stores are visible.
         */
-       __nf_conntrack_hash_insert(ct, hash, repl_hash);
+       __nf_conntrack_hash_insert(ct, hash, repl_hash, skb->ij);
        NF_CT_STAT_INC(net, insert);
        spin_unlock_bh(&nf_conntrack_lock);
 
@@ -537,7 +538,7 @@
    for NAT). */
 int
 nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
-                        const struct nf_conn *ignored_conntrack)
+                        const struct nf_conn *ignored_conntrack, int ij)
 {
        struct net *net = nf_ct_net(ignored_conntrack);
        struct nf_conntrack_tuple_hash *h;
@@ -550,7 +551,7 @@
         * least once for the stats anyway.
         */
        rcu_read_lock_bh();
-       hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[hash], hnnode) {
+       hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[ij][hash], hnnode) {
                ct = nf_ct_tuplehash_to_ctrack(h);
                if (ct != ignored_conntrack &&
                    nf_ct_tuple_equal(tuple, &h->tuple) &&
@@ -571,7 +572,7 @@
 
 /* There's a small race here where we may free a just-assured
    connection.  Too bad: we're in trouble anyway. */
-static noinline int early_drop(struct net *net, unsigned int hash)
+static noinline int early_drop(struct net *net, unsigned int hash, int ij)
 {
        /* Use oldest entry, which is roughly LRU */
        struct nf_conntrack_tuple_hash *h;
@@ -582,7 +583,7 @@
 
        rcu_read_lock();
        for (i = 0; i < net->ct.htable_size; i++) {
-               hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[hash],
+               hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[ij][hash],
                                         hnnode) {
                        tmp = nf_ct_tuplehash_to_ctrack(h);
                        if (!test_bit(IPS_ASSURED_BIT, &tmp->status))
@@ -636,7 +637,7 @@
 __nf_conntrack_alloc(struct net *net, u16 zone,
                     const struct nf_conntrack_tuple *orig,
                     const struct nf_conntrack_tuple *repl,
-                    gfp_t gfp, u32 hash)
+                    gfp_t gfp, u32 hash, int ij)
 {
        struct nf_conn *ct;
 
@@ -651,7 +652,7 @@
 
        if (nf_conntrack_max &&
            unlikely(atomic_read(&net->ct.count) > nf_conntrack_max)) {
-               if (!early_drop(net, hash_bucket(hash, net))) {
+               if (!early_drop(net, hash_bucket(hash, net), ij)) {
                        atomic_dec(&net->ct.count);
                        if (net_ratelimit())
                                printk(KERN_WARNING
@@ -713,9 +714,9 @@
 struct nf_conn *nf_conntrack_alloc(struct net *net, u16 zone,
                                   const struct nf_conntrack_tuple *orig,
                                   const struct nf_conntrack_tuple *repl,
-                                  gfp_t gfp)
+                                  gfp_t gfp, int ij)
 {
-       return __nf_conntrack_alloc(net, zone, orig, repl, gfp, 0);
+       return __nf_conntrack_alloc(net, zone, orig, repl, gfp, 0, ij);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_alloc);
 
@@ -753,7 +754,7 @@
        }
 
        ct = __nf_conntrack_alloc(net, zone, tuple, &repl_tuple, GFP_ATOMIC,
-                                 hash);
+                                 hash, skb->ij);
        if (IS_ERR(ct))
                return (struct nf_conntrack_tuple_hash *)ct;
 
@@ -840,7 +841,7 @@
 
        /* look for tuple match */
        hash = hash_conntrack_raw(&tuple, zone);
-       h = __nf_conntrack_find_get(net, zone, &tuple, hash);
+       h = __nf_conntrack_find_get(net, zone, &tuple, hash, skb->ij);
        if (!h) {
                h = init_conntrack(net, tmpl, &tuple, l3proto, l4proto,
                                   skb, dataoff, hash);
@@ -1170,7 +1171,7 @@
 
        spin_lock_bh(&nf_conntrack_lock);
        for (; *bucket < net->ct.htable_size; (*bucket)++) {
-               hlist_nulls_for_each_entry(h, n, &net->ct.hash[*bucket], hnnode) {
+               hlist_nulls_for_each_entry(h, n, &net->ct.hash[0][*bucket], hnnode) {
                        ct = nf_ct_tuplehash_to_ctrack(h);
                        if (iter(ct, data))
                                goto found;
@@ -1297,6 +1298,7 @@
 
 static void nf_conntrack_cleanup_net(struct net *net)
 {
+       int i = 0;
  i_see_dead_people:
        nf_ct_iterate_cleanup(net, kill_all, NULL);
        nf_ct_release_dying_list(net);
@@ -1305,7 +1307,9 @@
                goto i_see_dead_people;
        }
 
-       nf_ct_free_hashtable(net->ct.hash, net->ct.htable_size);
+       for (i = 0; i < 3; i++) {
+               nf_ct_free_hashtable(net->ct.hash[i], net->ct.htable_size);
+       }
        nf_conntrack_ecache_fini(net);
        nf_conntrack_tstamp_fini(net);
        nf_conntrack_acct_fini(net);
@@ -1364,7 +1368,7 @@
 {
        int i, bucket;
        unsigned int hashsize, old_size;
-       struct hlist_nulls_head *hash, *old_hash;
+       struct hlist_nulls_head *hash[3], *old_hash[3];
        struct nf_conntrack_tuple_hash *h;
        struct nf_conn *ct;
 
@@ -1378,10 +1382,19 @@
        hashsize = simple_strtoul(val, NULL, 0);
        if (!hashsize)
                return -EINVAL;
-
-       hash = nf_ct_alloc_hashtable(&hashsize, 1);
-       if (!hash)
-               return -ENOMEM;
+       {
+               int k = 0;
+               for (k = 0; k < 3; k++) {
+                       hash[k] = nf_ct_alloc_hashtable(&hashsize, 1);
+                       if (!hash[k]) {
+                               int j = 0;
+                               for (j = 0; j < k; j++) {
+                                       //free hash[j];
+                               }
+                               return -ENOMEM;
+                       }
+               }
+       }
 
        /* Lookups in the old hash might happen in parallel, which means we
         * might get false negatives during connection lookup. New connections
@@ -1390,24 +1403,38 @@
         */
        spin_lock_bh(&nf_conntrack_lock);
        for (i = 0; i < init_net.ct.htable_size; i++) {
-               while (!hlist_nulls_empty(&init_net.ct.hash[i])) {
-                       h = hlist_nulls_entry(init_net.ct.hash[i].first,
+               int k = 0;
+               for (k = 0; k < 3; k++) {
+               while (!hlist_nulls_empty(&init_net.ct.hash[k][i])) {
+                       h = hlist_nulls_entry(init_net.ct.hash[k][i].first,
                                        struct nf_conntrack_tuple_hash, hnnode);
                        ct = nf_ct_tuplehash_to_ctrack(h);
                        hlist_nulls_del_rcu(&h->hnnode);
                        bucket = __hash_conntrack(&h->tuple, nf_ct_zone(ct),
                                                  hashsize);
-                       hlist_nulls_add_head_rcu(&h->hnnode, &hash[bucket]);
+                       hlist_nulls_add_head_rcu(&h->hnnode, &hash[k][bucket]);
+               }
                }
        }
        old_size = init_net.ct.htable_size;
-       old_hash = init_net.ct.hash;
+       old_hash[0] = init_net.ct.hash[0];
+       old_hash[1] = init_net.ct.hash[1];
+       old_hash[2] = init_net.ct.hash[2];
 
        init_net.ct.htable_size = nf_conntrack_htable_size = hashsize;
-       init_net.ct.hash = hash;
+       {
+               int k = 0;
+               for (k = 0; k < 3; k++) {
+                       init_net.ct.hash[k] = hash[k];
+               }
+       }
        spin_unlock_bh(&nf_conntrack_lock);
-
-       nf_ct_free_hashtable(old_hash, old_size);
+       {
+               int k = 0;
+               for (k = 0; k < 3; k++) {
+                       nf_ct_free_hashtable(old_hash[k], old_size);
+               }
+       }
        return 0;
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_set_hashsize);
@@ -1494,6 +1521,7 @@
 static int nf_conntrack_init_net(struct net *net)
 {
        int ret;
+       int i = 0;
 
        atomic_set(&net->ct.count, 0);
        INIT_HLIST_NULLS_HEAD(&net->ct.unconfirmed, UNCONFIRMED_NULLS_VAL);
@@ -1520,11 +1548,13 @@
        }
 
        net->ct.htable_size = nf_conntrack_htable_size;
-       net->ct.hash = nf_ct_alloc_hashtable(&net->ct.htable_size, 1);
-       if (!net->ct.hash) {
-               ret = -ENOMEM;
-               printk(KERN_ERR "Unable to create nf_conntrack_hash\n");
-               goto err_hash;
+       for (i = 0; i < 3; i++) {
+               net->ct.hash[i] = nf_ct_alloc_hashtable(&net->ct.htable_size, 1);
+               if (!net->ct.hash[i]) {
+                       ret = -ENOMEM;
+                       printk(KERN_ERR "Unable to create nf_conntrack_hash\n");
+                       goto err_hash;
+               }
        }
        ret = nf_conntrack_expect_init(net);
        if (ret < 0)
@@ -1548,7 +1578,9 @@
 err_acct:
        nf_conntrack_expect_fini(net);
 err_expect:
-       nf_ct_free_hashtable(net->ct.hash, net->ct.htable_size);
+       for (i = 0; i < 3; i++) {
+               nf_ct_free_hashtable(net->ct.hash[i], net->ct.htable_size);
+       }
 err_hash:
        kmem_cache_destroy(net->ct.nf_conntrack_cachep);
 err_cache:
diff -uNr linux-source-3.2/net/netfilter/nf_conntrack_helper.c linux-source-3.2.new/net/netfilter/nf_conntrack_helper.c
--- linux-source-3.2/net/netfilter/nf_conntrack_helper.c        2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/netfilter/nf_conntrack_helper.c    2014-07-11 10:57:25.424678691 +0800
@@ -227,7 +227,7 @@
        hlist_nulls_for_each_entry(h, nn, &net->ct.unconfirmed, hnnode)
                unhelp(h, me);
        for (i = 0; i < net->ct.htable_size; i++) {
-               hlist_nulls_for_each_entry(h, nn, &net->ct.hash[i], hnnode)
+               hlist_nulls_for_each_entry(h, nn, &net->ct.hash[0][i], hnnode)
                        unhelp(h, me);
        }
 }
diff -uNr linux-source-3.2/net/netfilter/nf_conntrack_netlink.c linux-source-3.2.new/net/netfilter/nf_conntrack_netlink.c
--- linux-source-3.2/net/netfilter/nf_conntrack_netlink.c       2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/netfilter/nf_conntrack_netlink.c   2014-07-11 11:02:54.168681473 +0800
@@ -692,7 +692,7 @@
        last = (struct nf_conn *)cb->args[1];
        for (; cb->args[0] < net->ct.htable_size; cb->args[0]++) {
 restart:
-               hlist_nulls_for_each_entry(h, n, &net->ct.hash[cb->args[0]],
+               hlist_nulls_for_each_entry(h, n, &net->ct.hash[0][cb->args[0]],
                                         hnnode) {
                        if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
                                continue;
@@ -920,7 +920,7 @@
        if (err < 0)
                return err;
 
-       h = nf_conntrack_find_get(net, zone, &tuple);
+       h = nf_conntrack_find_get(net, zone, &tuple, 0);
        if (!h)
                return -ENOENT;
 
@@ -986,7 +986,7 @@
        if (err < 0)
                return err;
 
-       h = nf_conntrack_find_get(net, zone, &tuple);
+       h = nf_conntrack_find_get(net, zone, &tuple, skb->ij);
        if (!h)
                return -ENOENT;
 
@@ -1336,7 +1336,7 @@
        struct nf_conntrack_helper *helper;
        struct nf_conn_tstamp *tstamp;
 
-       ct = nf_conntrack_alloc(net, zone, otuple, rtuple, GFP_ATOMIC);
+       ct = nf_conntrack_alloc(net, zone, otuple, rtuple, GFP_ATOMIC, 0);
        if (IS_ERR(ct))
                return ERR_PTR(-ENOMEM);
 
@@ -1446,7 +1446,7 @@
                if (err < 0)
                        goto err2;
 
-               master_h = nf_conntrack_find_get(net, zone, &master);
+               master_h = nf_conntrack_find_get(net, zone, &master, 0);
                if (master_h == NULL) {
                        err = -ENOENT;
                        goto err2;
@@ -1460,7 +1460,7 @@
                tstamp->start = ktime_to_ns(ktime_get_real());
 
        add_timer(&ct->timeout);
-       nf_conntrack_hash_insert(ct);
+       nf_conntrack_hash_insert(ct, 0);
        rcu_read_unlock();
 
        return ct;
@@ -1503,9 +1503,9 @@
 
        spin_lock_bh(&nf_conntrack_lock);
        if (cda[CTA_TUPLE_ORIG])
-               h = __nf_conntrack_find(net, zone, &otuple);
+               h = __nf_conntrack_find(net, zone, &otuple, 0);
        else if (cda[CTA_TUPLE_REPLY])
-               h = __nf_conntrack_find(net, zone, &rtuple);
+               h = __nf_conntrack_find(net, zone, &rtuple, 0);
 
        if (h == NULL) {
                err = -ENOENT;
@@ -2020,7 +2020,7 @@
                return err;
 
        /* Look for master conntrack of this expectation */
-       h = nf_conntrack_find_get(net, zone, &master_tuple);
+       h = nf_conntrack_find_get(net, zone, &master_tuple, 0);
        if (!h)
                return -ENOENT;
        ct = nf_ct_tuplehash_to_ctrack(h);
diff -uNr linux-source-3.2/net/netfilter/nf_conntrack_pptp.c linux-source-3.2.new/net/netfilter/nf_conntrack_pptp.c
--- linux-source-3.2/net/netfilter/nf_conntrack_pptp.c  2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/netfilter/nf_conntrack_pptp.c      2014-07-11 11:04:11.824682130 +0800
@@ -148,7 +148,7 @@
        pr_debug("trying to timeout ct or exp for tuple ");
        nf_ct_dump_tuple(t);
 
-       h = nf_conntrack_find_get(net, zone, t);
+       h = nf_conntrack_find_get(net, zone, t, 0);
        if (h)  {
                sibling = nf_ct_tuplehash_to_ctrack(h);
                pr_debug("setting timeout of conntrack %p to 0\n", sibling);
diff -uNr linux-source-3.2/net/netfilter/nf_conntrack_standalone.c linux-source-3.2.new/net/netfilter/nf_conntrack_standalone.c
--- linux-source-3.2/net/netfilter/nf_conntrack_standalone.c    2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/netfilter/nf_conntrack_standalone.c        2014-07-11 10:56:08.276678039 +0800
@@ -59,7 +59,7 @@
        for (st->bucket = 0;
             st->bucket < net->ct.htable_size;
             st->bucket++) {
-               n = rcu_dereference(hlist_nulls_first_rcu(&net->ct.hash[st->bucket]));
+               n = rcu_dereference(hlist_nulls_first_rcu(&net->ct.hash[0][st->bucket]));
                if (!is_a_nulls(n))
                        return n;
        }
@@ -80,7 +80,7 @@
                }
                head = rcu_dereference(
                                hlist_nulls_first_rcu(
-                                       &net->ct.hash[st->bucket]));
+                                       &net->ct.hash[0][st->bucket]));
        }
        return head;
 }
diff -uNr linux-source-3.2/net/netfilter/xt_connlimit.c linux-source-3.2.new/net/netfilter/xt_connlimit.c
--- linux-source-3.2/net/netfilter/xt_connlimit.c       2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/netfilter/xt_connlimit.c   2014-07-11 11:07:55.712684024 +0800
@@ -117,7 +117,7 @@
        /* check the saved connections */
        hlist_for_each_entry_safe(conn, pos, n, hash, node) {
                found    = nf_conntrack_find_get(net, NF_CT_DEFAULT_ZONE,
-                                                &conn->tuple);
+                                                &conn->tuple, 0);
                found_ct = NULL;
 
                if (found != NULL)
diff -uNr linux-source-3.2/net/netfilter/xt_CT.c linux-source-3.2.new/net/netfilter/xt_CT.c
--- linux-source-3.2/net/netfilter/xt_CT.c      2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/net/netfilter/xt_CT.c  2014-07-11 11:06:38.648683372 +0800
@@ -81,7 +81,7 @@
                goto err1;
 
        memset(&t, 0, sizeof(t));
-       ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
+       ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL, 0);
        ret = PTR_ERR(ct);
        if (IS_ERR(ct))
                goto err2;



H文件patch:


diff -uNr linux-source-3.2/include/linux/skbuff.h linux-source-3.2.new/include/linux/skbuff.h
--- linux-source-3.2/include/linux/skbuff.h     2014-02-01 21:18:39.000000000 +0800
+++ linux-source-3.2.new/include/linux/skbuff.h 2014-07-11 07:00:38.696558485 +0800
@@ -474,6 +474,7 @@
        unsigned char           *head,
                                *data;
        unsigned int            truesize;
+       int                     ij;
        atomic_t                users;
 };
 
diff -uNr linux-source-3.2/include/linux/version.h linux-source-3.2.new/include/linux/version.h
--- linux-source-3.2/include/linux/version.h    1970-01-01 08:00:00.000000000 +0800
+++ linux-source-3.2.new/include/linux/version.h        2014-07-11 07:01:03.972558699 +0800
@@ -0,0 +1,2 @@
+#define LINUX_VERSION_CODE 197174
+#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))
diff -uNr linux-source-3.2/include/net/netfilter/nf_conntrack_core.h linux-source-3.2.new/include/net/netfilter/nf_conntrack_core.h
--- linux-source-3.2/include/net/netfilter/nf_conntrack_core.h  2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/include/net/netfilter/nf_conntrack_core.h      2014-07-11 08:59:04.872618612 +0800
@@ -50,7 +50,7 @@
 /* Find a connection corresponding to a tuple. */
 extern struct nf_conntrack_tuple_hash *
 nf_conntrack_find_get(struct net *net, u16 zone,
-                     const struct nf_conntrack_tuple *tuple);
+                     const struct nf_conntrack_tuple *tuple, int ij);
 
 extern int __nf_conntrack_confirm(struct sk_buff *skb);
 
diff -uNr linux-source-3.2/include/net/netfilter/nf_conntrack.h linux-source-3.2.new/include/net/netfilter/nf_conntrack.h
--- linux-source-3.2/include/net/netfilter/nf_conntrack.h       2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/include/net/netfilter/nf_conntrack.h   2014-07-11 09:05:35.412621916 +0800
@@ -176,7 +176,7 @@
    conntrack). */
 extern int
 nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
-                        const struct nf_conn *ignored_conntrack);
+                        const struct nf_conn *ignored_conntrack, int ij);
 
 /* Return conntrack_info and tuple hash for given skb. */
 static inline struct nf_conn *
@@ -207,9 +207,9 @@
 
 extern struct nf_conntrack_tuple_hash *
 __nf_conntrack_find(struct net *net, u16 zone,
-                   const struct nf_conntrack_tuple *tuple);
+                   const struct nf_conntrack_tuple *tuple, int ij);
 
-extern void nf_conntrack_hash_insert(struct nf_conn *ct);
+extern void nf_conntrack_hash_insert(struct nf_conn *ct, int ij);
 extern void nf_ct_delete_from_lists(struct nf_conn *ct);
 extern void nf_ct_insert_dying_list(struct nf_conn *ct);
 
@@ -284,7 +284,7 @@
 nf_conntrack_alloc(struct net *net, u16 zone,
                   const struct nf_conntrack_tuple *orig,
                   const struct nf_conntrack_tuple *repl,
-                  gfp_t gfp);
+                  gfp_t gfp, int ij);
 
 static inline int nf_ct_is_template(const struct nf_conn *ct)
 {
diff -uNr linux-source-3.2/include/net/netfilter/nf_nat.h linux-source-3.2.new/include/net/netfilter/nf_nat.h
--- linux-source-3.2/include/net/netfilter/nf_nat.h     2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/include/net/netfilter/nf_nat.h 2014-07-11 10:05:22.568652268 +0800
@@ -53,7 +53,7 @@
 /* Set up the info structure to map into this range. */
 extern unsigned int nf_nat_setup_info(struct nf_conn *ct,
                                      const struct nf_nat_range *range,
-                                     enum nf_nat_manip_type maniptype);
+                                     enum nf_nat_manip_type maniptype, int ij);
 
 /* Is this tuple already taken? (not by us)*/
 extern int nf_nat_used_tuple(const struct nf_conntrack_tuple *tuple,
diff -uNr linux-source-3.2/include/net/netns/conntrack.h linux-source-3.2.new/include/net/netns/conntrack.h
--- linux-source-3.2/include/net/netns/conntrack.h      2014-01-03 12:33:36.000000000 +0800
+++ linux-source-3.2.new/include/net/netns/conntrack.h  2014-07-11 08:56:06.816617105 +0800
@@ -13,7 +13,7 @@
        unsigned int            expect_count;
        unsigned int            htable_size;
        struct kmem_cache       *nf_conntrack_cachep;
-       struct hlist_nulls_head *hash;
+       struct hlist_nulls_head *hash[3];
        struct hlist_head       *expect_hash;
        struct hlist_nulls_head unconfirmed;
        struct hlist_nulls_head dying;



重新编译内核之后,效果十分可观,按照下面的脚本加入巨量的conntrack也丝毫不会影响最大连接数:
for((i=1;i<220;i++));do for((j=1;j<254;j++));do \
conntrack -I conntrack -s 172.129.$j.$i -d $j.$i.192.$j -p udp -t 4000  --sport 245 --dport 2001;\
conntrack -I conntrack -s 192.13.$i.$j -d $i.$j.24.19 -p tcp --state ESTABLISHED -t 4000  --sport 67 --dport 505;\
conntrack -I conntrack -s 172.129.$j.$i -d $j.$i.192.$j -p icmp -t 4000;\
done;done >/dev/null 2>&1

除了分了多张hash之外,另外的好处在于锁的粒度变细了,每次在操作conntrack的时候只需要锁住和自己相关的hash表的锁即可,当然,在本次的优化中没有涉及这一点。和ipset结合起来就更猛了,本身ipset就可以定义一个集合,而该集合则可以用来计算conntrack的hash值,多表版本的conntrack和ipset结合,这在效果上不就是多级hash表吗?而且表面上还是iptables配置的。
阅读更多

没有更多推荐了,返回首页