From mboxrd@z Thu Jan 1 00:00:00 1970 From: Willem de Bruijn Subject: [PATCH rfc] netfilter: two xtables matches Date: Wed, 5 Dec 2012 14:22:17 -0500 Message-ID: <1354735339-13402-1-git-send-email-willemb@google.com> To: netfilter-devel@vger.kernel.org, netdev@vger.kernel.org, edumazet@google.com, davem@davemloft.net, kaber@trash.net, pablo@netfilter.org Return-path: Received: from mail-gg0-f202.google.com ([209.85.161.202]:41485 "EHLO mail-gg0-f202.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752205Ab2LETWY (ORCPT ); Wed, 5 Dec 2012 14:22:24 -0500 Received: by mail-gg0-f202.google.com with SMTP id k1so659945ggn.1 for ; Wed, 05 Dec 2012 11:22:23 -0800 (PST) Sender: netfilter-devel-owner@vger.kernel.org List-ID: The second patch is more speculative and aims to be a more general workaround, as well as a performance optimization: support (preferably JIT compiled) BPF programs as iptables match rules. Potentially, the skb->priority match can be implemented by applying only the second patch and adding a new BPF_S_ANC ancillary field to Linux Socket Filters. I also wrote corresponding userspace patches to iptables. The process for submitting both kernel and user patches is not 100% clear to me. Sending the kernel bits to both netdev and netfilter-devel for initial feedback. Please correct me if you want it another way. The patches apply to net-next.