Re: [PATCH 2.6 0/12]: netfilter update

[Patrick McHardy <kaber@trash.net>]

David S. Miller wrote:

>Thanks, two problems:
>
>1) Please layout the new skbuff.h structure changes more
>   intelligently.  Currently the netfilter stuff is:
>
>	pointer
>	u32
>	pointer
>	u32
>
>   and this wastes a lot of space on 64-bitters.
>
Oops. That wasn't very smart of me.

>2) There is no way I'm amicable to exporting __tcp_v4_lookup()
>   and friends to modules.
>
>   Are you absolutely sure that the existing scheme cannot
>   work properly?  I'm talking about relying upon skb->sk
>   being sane.
>  
>
The existing scheme has one problem, it takes files->file_lock
in a BH, but the patch doesn't mean to fix this. Besides
this, it works fine. The patch extends the owner match so it
can also be used in the input path, where skb->sk isn't set.
This is quite useful for filtering input traffic based on user
etc., unfortunately it can't be done without exporting
{tcp,udp}_v4_lookup. Do you see an alternative to dropping the
patch ?

>So what I think I'll do is merge in all the changes other
>than the ipt_owner.c change by hand into a tree I'll push
>to Linus, I'll also fix the layout ordering problem which
>I mentioned above in #1
>  
>
Thanks.

Regards
Patrick