Re: [RFC] Inter-match communication cache

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Jozsef,

On Tue, Sep 18, 2012 at 11:01:34PM +0200, Jozsef Kadlecsik wrote:
> Hi,
> 
> I propose a small cache for inter-match communication purpose:
> 
> diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
> index 8d674a7..f07eab2 100644
> --- a/include/linux/netfilter/x_tables.h
> +++ b/include/linux/netfilter/x_tables.h
> @@ -216,6 +216,9 @@ struct xt_action_param {
>  		const void *matchinfo, *targinfo;
>  	};
>  	const struct net_device *in, *out;
> +#ifdef CONFIG_NETFILTER_XTABLES_CACHE
> +	u_int32_t cache;
> +#endif

I think you can implement this by means of one per-CPU cache inside
the xt_set match.

Check the old per-CPU event cache in net/netfilter/nf_conntrack_ecache.c.
We used to have something similar.

I'd prefer this approach rather than one change in xtables for this.
It still seems to me too specific of your xt_set extensions.

It will remain internal of xt_set match, but we can revisit this later
on to generalize it if it becomes interesting for more matches.