Hi, I'm working on a nf_queue based HTTP filter. Sometimes I want to NF_ACCEPT X bytes of a connection. In a HTTP connection its part of the Content-Length. Being able to directly NF_ACCEPT large parts of a connection is a 2X to 3X speedup, by not queuing these packets to user-space. I've tested this patchset only with HTTP on IPv4, and it makes a large difference in page load times (lower latency), max bandwidth utilization, and CPU utilization (lower utilization). This is something like connbytes, but with TCP look at the sequence number to handle out of order and duplicate packets. I'm thinking about changing the code to a always queue if the TCP flags SYN, FIN, or RST are set. Besides HTTP I could imagine other L7 protocol filters using nf_queue could this feature. Bad points: * making nfnetlink_queue depend on conntrack and on on L3 (TCP). This patchset is also at: git://github.com/karlhiramoto/linux-2.6.git nfq libnl patches to send NFQA_ACCEPT_CONNBYTES are at: git://github.com/karlhiramoto/libnl.git Karl Hiramoto (4): netfilter/Kconfig: NF_QUEUE_CONNBYTES_BYPASS nf_conntrack_queue: define struct that will be stored in nf_ct_extend nf_conntrack: add nf_queue extension nfnetlink_queue: allow part of a connection to bypass the queue include/linux/netfilter/nfnetlink_queue.h | 1 + include/net/netfilter/nf_conntrack_extend.h | 2 + include/net/netfilter/nf_conntrack_queue.h | 17 ++++ net/netfilter/Kconfig | 13 +++- net/netfilter/nf_conntrack_core.c | 37 +++++++++- net/netfilter/nfnetlink_queue.c | 112 ++++++++++++++++++++++++++- 6 files changed, 179 insertions(+), 3 deletions(-) create mode 100644 include/net/netfilter/nf_conntrack_queue.h -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
