Re: [PATCH] entry_data

[Patrick McHardy <kaber@trash.net>]

Pablo Neira Ayuso wrote:
> Massimiliano Hofer wrote:
> 
>> You're right, but I modified the kernel side of a union and I was
>> careful not to change the total size. This union is never really used
>> by both sides simultaneously.
> 
> 
> Indeed, you're right, I can't see any problem with your patch at this
> moment. Although apart from the out of tree xt_condition match, there is
> no other clients for entry_data. I'd like to know what Patrick thinks
> about this.

Actually there are quite a few things that can benefit from this
(see also my other mail to netfilter-devel). Stateful matches like
limit, quota, statistic can store their state in externally allocated
memory and remove all the state and the pointers from the structure
shared with userspace. hashlimit, recent and other matches that lookup
global state can just keep a reference to it without affecting
userspace visible structures. Besides it is in my opinion a major
limitation of the iptables API that it doesn't cleanly support
per-instance state, so I'm quite supportive of this patch :)