Re: [RFC][PATCH] optimise iptables interface matching

[Patrick McHardy <kaber@trash.net>]

Henrik Nordstrom wrote:
> lör 2007-05-26 klockan 11:20 +0200 skrev Patrick McHardy:
> 
> 
>>We can add flags for new features, but not flags that are required to
>>be set to behave compatible since that would break iptables userspace
>>for old kernels.
> 
> 
> But the proposed change is completely transparent to userspace... the
> use of the new flags is purely kernel-only and not visible to
> userspace..


Yes, certainly, that statement was not specific to this patch.

> The drawback is that it reduces the possible new flags which might be
> added by two bits, or if put another way reduces the flags field from 8
> to 6 bits, leaving only 3 unused flag bits for future flag type
> expansions.
>
> 
> But I am a little curious.. how much difference would it yield if simply
> the loop was instead changed to terminate on string end instead of
> always iterating over the max interface name length..
> 
>         for (i = 0, ret = 0; ((const unsigned long *)ipinfo->outiface_mask)[i] && i < IFNAMSIZ/sizeof(unsigned long); i++) {
> 		...
>         }
> 
> instead of
> 
>         for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
> 		...
> 	}
> 
> plus a small change to the userspace to zero the mask after the first \0
> in the interface name on exact matches.


It already does that I think. This sounds like a good alternative,
I'd be interested to see how much improvement it yields.