On Fri, Apr 10, 2015 at 02:21:20PM +0100, Thomas Graf wrote: > On 04/10/15 at 02:15pm, Pablo Neira Ayuso wrote: > > static int __netif_receive_skb_ingress(struct sk_buff *skb, bool pfmemalloc, > > struct net_device *orig_dev) > > { > > @@ -3772,6 +3800,8 @@ skip_taps: > > if (!skb) > > return NET_RX_DROP; > > #endif > > + if (nf_hook_ingress_active(skb)) > > + return nf_hook_ingress(skb, pt_prev, orig_dev, pfmemalloc); > > > > return __netif_receive_skb_finish(skb, pfmemalloc, pt_prev, orig_dev); > > } > > I would favour if we avoid for every subsystem to manage its ingress > filter pointers in net_device. From a net_device perspective, all it > takes is a single pointer which points to a single linked list of > filters which need to be run through. These entries could represent > an ingress qdisc or a netfilter chain or something else (L2 ingress > qdisc?). > > I know it's only 24 bytes but I'm trying hard to keep net_device below > 2K. Then it would be probably good to investigate if we can come up with some extension infrastructure for net_device (I think Patrick already suggested this during netdev0.1), so things are allocated based on available features. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html