Re: [rfc] ipt_owner.c improvements

[Patrick McHardy <kaber@trash.net>]

Juha Heljoranta wrote:
> I'd like to make few improvements to ipt_owner.c or perhaps to create 
> something new that is like owner match.
> 
> First I'd like to improve performance for incoming packet matches. The 
> next thing is to reliably identify sending/receiving process. Last 
> proposal is to improve performance when matching is done several times 
> per packet.

As Dave Miller pointed out, the only sensible thing to do is add new
hooks to the protocols themselves, anything else is racy. The main
challenges are making sure incoming connections using protocols that
support sockets aren't confirmed before they survived the socket
hooks, with all possible module combinations, and possibly hooks for
outgoing packets, I haven't thought about that very much.

Regards
Patrick