From: "Марк Коренберг" <socketpair@gmail.com>
To: Fatih USTA <fatihusta86@gmail.com>
Cc: Jozsef Kadlecsik <kadlec@netfilter.org>,
Netfilter Users Mailing list <netfilter@vger.kernel.org>,
netfilter-devel@vger.kernel.org
Subject: Re: ipset hash:net,iface - can not add more than 64 interfaces
Date: Tue, 28 Nov 2023 13:09:04 +0200 [thread overview]
Message-ID: <CAEmTpZHY61sOq+kmOwPb_kaN5_XpsCMxGeP2uzh=oPi0FaASSA@mail.gmail.com> (raw)
In-Reply-To: <CAN_K0LQJfH9D9TBMWBxnbUbgWrG5C9YYENU4tkP=WfxRGyAUMA@mail.gmail.com>
Thank you for the suggestion. Will benchmark in my conditions.
вт, 28 нояб. 2023 г. в 12:06, Fatih USTA <fatihusta86@gmail.com>:
>
> You can use type of list. Separate 64 elements per set. After that append into list.
>
> ipset create dummy_ifaces list:set
>
> ipset create dummy0_0 hash:net,iface
> ipset create dummy0_1 hash:net,iface
> ipset create dummy0_2 hash:net,iface
>
> ipset add dummy_ifaces dummy0_0
> ipset add dummy_ifaces dummy0_1
> ipset add dummy_ifaces dummy0_2
>
>
> On Tue, Nov 28, 2023, 12:34 Jozsef Kadlecsik <kadlec@netfilter.org> wrote:
>>
>> On Tue, 28 Nov 2023, Марк Коренберг wrote:
>>
>> > Actually, I need an ipset that matches against list of interfaces
>> > (without networks associated). Are there any ways ?
>>
>> No, that's not possible in ipset either.
>>
>> However, I'd suggest you to explore nftables where there are no such
>> internal limitation than in ipset, supports matching interface indices or
>> names and can store just interface names/indices in an nftables set too.
>>
>> Best regards,
>> Jozsef
>> > вт, 28 нояб. 2023 г. в 09:48, Jozsef Kadlecsik <kadlec@netfilter.org>:
>> > >
>> > > Hi,
>> > >
>> > > On Tue, 28 Nov 2023, Марк Коренберг wrote:
>> > >
>> > > > for i in `seq 0 70`; do ip link del dummy$i; done;
>> > > > for i in `seq 0 70`; do ip link add type dummy; done;
>> > > > for i in `seq 0 70`; do ipset add qwe 0.0.0.0/0,dummy$i; done;
>> > > >
>> > > > Reveals the problem. Only 64 records can be added, but there are no
>> > > > obvious restrictions on that. I s it possible to increase the limit ?
>> > >
>> > > It is intentional. Such elements can be stored in the same hash bucket
>> > > only and 64 is the max size I'm willing to sacrifice for that. Please
>> > > note, that's a huge number and means linear evaluation, i.e. loosing
>> > > performance.
>> > >
>> > > Best regards,
>> > > Jozsef
>> > > --
>> > > E-mail : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.hu
>> > > PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt
>> > > Address : Wigner Research Centre for Physics
>> > > H-1525 Budapest 114, POB. 49, Hungary
>> >
>> >
>> >
>> > --
>> > Segmentation fault
>> >
>>
>> --
>> E-mail : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.hu
>> PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt
>> Address : Wigner Research Centre for Physics
>> H-1525 Budapest 114, POB. 49, Hungary
--
Segmentation fault
prev parent reply other threads:[~2023-11-28 11:09 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-28 4:29 ipset hash:net,iface - can not add more than 64 interfaces Марк Коренберг
2023-11-28 7:48 ` Jozsef Kadlecsik
2023-11-28 9:17 ` Марк Коренберг
2023-11-28 9:29 ` Jozsef Kadlecsik
2023-11-28 9:18 ` Марк Коренберг
2023-11-28 9:34 ` Jozsef Kadlecsik
[not found] ` <CAN_K0LQJfH9D9TBMWBxnbUbgWrG5C9YYENU4tkP=WfxRGyAUMA@mail.gmail.com>
2023-11-28 11:09 ` Марк Коренберг [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAEmTpZHY61sOq+kmOwPb_kaN5_XpsCMxGeP2uzh=oPi0FaASSA@mail.gmail.com' \
--to=socketpair@gmail.com \
--cc=fatihusta86@gmail.com \
--cc=kadlec@netfilter.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).