Re: About matching

[Wang Jian <lark@linux.net.cn>]

Hi Jonas Berlin,

I have an idea before, that looks like the following

1. A match is marked as dup when insert into chain if it has the same
match rule with previous;
2. When a match gets deleted followed by match marked as dup , do
housekeeping to make sure the dup relation is correct;
3. When a match is hit, if non-return, the following match marked as dup
is evaluated immediately as hit.

This can be achieved with a little code. But the problem here is when
used in mangle table, the target action may make the matching rule false.

--previous is an indication that the previous matching is used anyway
even if the target action changes the evaluation result. You may use the
same algorithm above and save a lot trouble :)


On Wed, 06 Apr 2005 21:47:22 +0300, Jonas Berlin <xkr47@outerspace.dyndns.org> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Wang Jian wrote:
> 
> | iptables <match rule 1> -j CONNMARK --set-mark value/mask
> | iptables <match rule 1> -j RETURN
> |
> | How many times the match rule 1 is evaluated when matched? If two, then
> | the second time is waste of CPU cycle.
> 
> It evaluates twice. I have made a "previous" match which I haven't finished
> into a patch yet (some cleanup, documentation and iptables-save & -restore
> support). It lets you do the above like this:
> 
> iptables <match rule 1> -j CONNMARK --set-mark value/mask
> iptables --previous -j RETURN
> 
> | Then think these three
> |
> | iptables <match rule 1> -j CONNMARK --set-mark value/mask
> | iptables <match rule 1> -j CONNMARK --restore --mask mask
> | iptables <match rule 1> -j RETURN
> |
> | Are there any optimization for such case?
> 
> I would guess mask restoring is usually done globally without matching some
> specific criteria.. but nevertheless, the --previous could be used here if
> wanted, it can be used many times in a row.
> 
> I'll try to finish off the patch tomorrow.
> 
> - --
> - - xkr47
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.1 (GNU/Linux)
> 
> iD8DBQFCVC64xyF48ZTvn+4RAi8pAJ4sjXT1KZf5Ora6S0Rr5dCXmcGj9gCgzKQi
> OUx6jdlw3FvPEtVuWgZ2/j8=
> =bp5F
> -----END PGP SIGNATURE-----



-- 
  lark