Re: [PATCH] netfilter: unfold two critical loops in ip_packet_match()

[Patrick McHardy <kaber@trash.net>]

Eric Dumazet wrote:
> Patrick McHardy a écrit :
>> The interface name matching has shown up in profiles forever
>> though and we've actually already tried to optimize it IIRC.
>>
>> Eric, I'm trying to keep all the *tables files synchronized,
>> could you send me a patch updating the other ones as well
>> please?
> 
> While doing this, I found arp_tables is still using loop using
> byte operations.
> 
> Also, I could not find how iniface_mask[], outiface_mask[], iniface[]
> and outiface[] were forced to long word alignment ... 
> 
> (in struct ipt_ip, struct ip6t_ip6, struct arpt_arp)

In case of IPv4 and IPv6 they are already suitable aligned, it
simply performing the comparison in unsigned long quantities.
struct arpt_arp unfortunately doesn't properly align the interface
names, so we need to continue to do byte-wise comparisons.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html