Re: [RFC][PATCH] optimise iptables interface matching

[Philip Craig <philipc@snapgear.com>]

Henrik Nordstrom wrote:
> But I am a little curious.. how much difference would it yield if simply
> the loop was instead changed to terminate on string end instead of
> always iterating over the max interface name length..
> 
>         for (i = 0, ret = 0; ((const unsigned long *)ipinfo->outiface_mask)[i] && i < IFNAMSIZ/sizeof(unsigned long); i++) {
> 		...
>         }
> 
> instead of
> 
>         for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
> 		...
> 	}
> 
> plus a small change to the userspace to zero the mask after the first \0
> in the interface name on exact matches.
> 
> The userspace only allow exact or prefix matching, so it should be ok to
> restrict the compare function to this I think..

I'll try that, but that will also prevent loop unrolling if you're
using -funroll-loops.  Not sure if any builds use this, but the
comment in the code implies some do.