Re: [PATCH 0/7 RFC] Netfilter/nf_tables ingress support

[David Miller <davem@davemloft.net>]

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 10 Apr 2015 22:09:01 +0200

> On Fri, Apr 10, 2015 at 02:22:05PM +0100, Thomas Graf wrote:
>> On 04/10/15 at 02:15pm, Pablo Neira Ayuso wrote:
>> > This patchset adds the Netfilter hook at the ingress path, in a per-device
>> > fashion. This also comes with the new nf_tables 'netdev' family support to
>> > provide access to users to the existing nf_tables features. This includes the
>> > transactional netlink API and the enhanced set infrastructure.  Several patches
>> > come in first place to prepare this support, including the refactoring of
>> > __netif_receive_skb_core() to accomodate the new hook.
>> 
>> Is the goal to eventually replace ebtables with this?
> 
> No, nftables comes with a bridge family that will eventually replace
> ebtables.

It's always been the case that if you want to do L2 or lower level
stuff, you use the ingress classifier, packet actions, and qdiscs.

If you want to do higher level things, NF hooks provide that facility.

The only example I've seen is packet counting, and one could do that
just as easily with the ingress qdisc.

So given what I've been shown so far I'm very far from convinced that
this new hook in an already over polluted, most critical of all
critical code paths, is justified at all.