On 05/04/15 12:19, Florian Westphal wrote:
Alexei Starovoitov <alexei.starovoitov@xxxxxxxxx> wrote:
wow, I have to say I'm impressed. That's the most genius way to
really kill TC.
Patch 1 looks good, patch 2,3,4 are nicely building on top...
until somebody starts asking how patch 5 will look.
In the future netfilter ingress module will be loaded along with
other iptables modules just like conntrack is today and users
who would want to use ingress tc would have to _unload_
netfilter_ingress module, but if it has interesting dependencies
it may mean to unload iptables and the rest.
FWIW while I think this is a valid concern, I believe its unfounded.
netfilter_ingress must not force run-time
dependencies like 'oh, you want tc, too bad, no conntrack for you)'.
(and i don't see any need for such a dependency).
It is an either-or choice. You cant have both. The _evil genius_ part i
think is that distros which ship with iptables rules and conntracking
on are going to not even turn on tc and my scripts now have to go
unload one.
But even if the scripts worked (perhaps there are plans to make sure
all scripts continue to work transparently), i care about performance
and youve suddenly taken that away from me.
So i would agree with adding the two hooks. Priority should be given
to tc in the code path.
cheers,
jamal
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
