Re: [RFC][PATCH] optimise iptables interface matching

[Patrick McHardy <kaber@trash.net>]

Philip Craig wrote:
> Patrick McHardy wrote:
> 
>>I don't like the kernel-internal fiddling with the flags too
>>much, but I don't see a way around it.
> 
> 
> The other idea I had was moving the interface matching into
> an internal match that would be checked by IPT_MATCH_ITERATE().
> Not sure if this is feasible yet.

Mhh .. probably not since you would have to put it somewhere
in the blob.

>>userspace should just ignore unknown flags.
> 
> 
> I was trying to completely hide them from userspace so that we
> still have the option to use them for something else later on.
> If we ever send them to userspace, then they are taken forever,
> otherwise a newer iptables userspace may not work with an older
> kernel.


We could do that, but we would need some other place to store them
since once we want to use them for something new we can't put them
in ->flags anymore.