Subject: Re: [patch net-next 2/3] netfilter: ip6_tables: use reasm skb for matching

From: Florian Westphal <[email-masked]>
Date: Tue, 5 Nov 2013 16:39:21 +0100

Jiri Pirko <[email-masked]> wrote:
> Tue, Nov 05, 2013 at 02:41:19PM CET, [email-masked] wrote:
> >executing the rules on the reassembled packet multiple times, one
> >for each fragment.
> 
[..]
> End even though, the matching is now done for each fragment skb anyway. The
> change is only to do it on different skb. I see no erformance or any
> other problem in that.

One problem that comes to mind is that nfacct or quota match will
now account num_of_fragments * length_of_reassemled_skb bytes.