On Mon, 24 Sep 2012, Pablo Neira Ayuso wrote: > On Tue, Sep 18, 2012 at 11:01:34PM +0200, Jozsef Kadlecsik wrote: > > > > I propose a small cache for inter-match communication purpose: > > > > diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h > > index 8d674a7..f07eab2 100644 > > --- a/include/linux/netfilter/x_tables.h > > +++ b/include/linux/netfilter/x_tables.h > > @@ -216,6 +216,9 @@ struct xt_action_param { > > const void *matchinfo, *targinfo; > > }; > > const struct net_device *in, *out; > > +#ifdef CONFIG_NETFILTER_XTABLES_CACHE > > + u_int32_t cache; > > +#endif > > I think you can implement this by means of one per-CPU cache inside > the xt_set match. > > Check the old per-CPU event cache in net/netfilter/nf_conntrack_ecache.c. > We used to have something similar. That's a good idea! I'd prefer something encapsulated inside xt_set as well, I'm going to check this possibility. Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html