Re: [PATCH 0/4] Netfilter ingress support (v3)

[Jamal Hadi Salim <jhs@mojatatu.com>]

On 05/04/15 12:19, Florian Westphal wrote:
> Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:

>> wow, I have to say I'm impressed. That's the most genius way to
>> really kill TC.
>> Patch 1 looks good, patch 2,3,4 are nicely building on top...
>> until somebody starts asking how patch 5 will look.
>> In the future netfilter ingress module will be loaded along with
>> other iptables modules just like conntrack is today and users
>> who would want to use ingress tc would have to _unload_
>> netfilter_ingress module, but if it has interesting dependencies
>> it may mean to unload iptables and the rest.
>
> FWIW while I think this is a valid concern, I believe its unfounded.
>
> netfilter_ingress must not force run-time
> dependencies like 'oh, you want tc, too bad, no conntrack for you)'.
>
> (and i don't see any need for such a dependency).
>

It is an either-or choice. You cant have both. The _evil genius_ part i
think is that distros which ship with iptables rules and conntracking
on are going to not even turn on tc and my scripts now have to go
unload one.
But even if the scripts worked (perhaps there are plans to make sure
all scripts continue to work transparently), i care about performance
and  youve suddenly taken that away from me.

So i would agree with adding the two hooks. Priority should be given
to tc in the code path.

cheers,
jamal