Re: [PATCH 6/6] net: move qdisc ingress filtering on top of netfilter ingress hooks

Daniel Borkmann
2015-04-30T00:10:40Z

On 04/30/2015 01:32 AM, Pablo Neira Ayuso wrote:
...
> Actually, the extra cost is roughly (getting inlined stuff away and
> other non-relevant stuff):
>
> `-> nf_hook_slow()
> `-> [for each entry in hook list]
> `-> nf_iterate()
> `-> (*elemp)->hook()

Yep, agreed.

> as part of the generic hook infrastructure, which comes with extra
> flexibility in return. I think the main concern so far was not to harm
> the critical netif_receive_core() path, and this patchset proves not
> to affect this.

Correct, as you use the static key and hide everything behind it.