On Thu, 04 Nov 2004, Patrick McHardy wrote: > - data = amp; > - data_limit = amp + skb->len - dataoff; > + skb_copy_bits(skb, dataoff, amanda_buffer, skb->len - dataoff); > + data = amanda_buffer; > + data_limit = amanda_buffer + skb->len - dataoff; Does this mean the whole buffer is still copied? If so: Making a local copy of the packet just to be able to stuff NUL bytes to suit or "optimize" strstr functions is plain nonsense - amanda pipes several GByte through the kernel at each run, and copying gazillions of bits around, wasting millions of CPU cycles, just because someone is too lazy to spell a more decent search function, is bad design. Same consideration applies to FTP connection tracking. I wrote a memstr function for bogofilter (GPL v2) that we could use inside the kernel, as a length-limited strstr replacement, as in "search the first buffer_size bytes starting with buffer_base for the first occurrence of const char *needle". That avoids all buffer modifications in ip_conntrack_amanda.c AFAICS. It's also slow because it does a linear search and not an optimized search as the sophisticated KMP and other search algorithms would be able to do, but then again the generic strstr inside the kernel is linear, too. -- Matthias Andree - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html