Re: [PATCH]: 1st step to remove skb_linearize() in ip6_tables.c and optimization

[Patrick McHardy <kaber@trash.net>]

Yasuyuki Kozakai wrote:
> Hi, folks,
> 
> In the current kernel, skb is linearized by skb_linearize() in ip6_tables.c.
> I suggest removing this, and this patch is the 1st step to do it.
> 
> To remove skb_linearize(), this patch changes the API of match() like
> ip_tables.h

I'm not sure the way iptables does it is really the right way. We call
skb_copy_bits for anything that needs to be matched after the ip_header.
Think of 100 rules matching "-p tcp --dport X". We copy the tcp header
100 times, for a total of 2000 bytes. One call to skb_linearize would
most likely be less expensive. I'm thinking about putting the copied
protocol header in the control buffer, this would reduce this extensive
copying a lot. We could also do some common preprocessing steps in one
place, like converting things to host byte order.

Comments anyone ?

Regards
Patrick