On Wed, Jun 14, 2017 at 07:13:12PM +0200, Pablo Neira Ayuso wrote: > On Wed, Jun 14, 2017 at 01:53:38PM +0200, Florian Westphal wrote: > > Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > > > > The extra hook has a performance impact though, is it something that > > > would just go away one x_tables is gone? What is your plan on this? > > > > Once we do it we can't remove it again, because you can have multiple > > nat base chains after this change, and removing hook and merging it back > > into the l3 nat code means first chain attaches a null binding again. > > With multiple nat chains, in case of overlap, we would just take the > last coming in the pipeline. Just like several chains several times > the same packet from a filter chain, right? I meant: just like marking the packet several times from different chains. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
