On Mon, 24 Sep 2012, Pablo Neira Ayuso wrote:
> On Tue, Sep 18, 2012 at 11:01:34PM +0200, Jozsef Kadlecsik wrote:
> >
> > I propose a small cache for inter-match communication purpose:
> >
> > diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
> > index 8d674a7..f07eab2 100644
> > --- a/include/linux/netfilter/x_tables.h
> > +++ b/include/linux/netfilter/x_tables.h
> > @@ -216,6 +216,9 @@ struct xt_action_param {
> > const void *matchinfo, *targinfo;
> > };
> > const struct net_device *in, *out;
> > +#ifdef CONFIG_NETFILTER_XTABLES_CACHE
> > + u_int32_t cache;
> > +#endif
>
> I think you can implement this by means of one per-CPU cache inside
> the xt_set match.
>
> Check the old per-CPU event cache in net/netfilter/nf_conntrack_ecache.c.
> We used to have something similar.
That's a good idea! I'd prefer something encapsulated inside xt_set as
well, I'm going to check this possibility.
Best regards,
Jozsef
-
E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxxxxxx
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
H-1525 Budapest 114, POB. 49, Hungary
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
