Subject: Re: cgroup matches in INPUT chain

From: Florian Westphal <[email-masked]>
Date: Thu, 19 Mar 2015 19:58:07 +0100

Daniel Mack <[email-masked]> wrote:
> In my tests, however, NF_INET_LOCAL_IN is iterated before early_demux()
> is called,

Early demux occurs after PRE_ROUTING but before LOCAL_IN.

Otherwise edemux would make little sense since its used to avoid the
routing lookup that decides wheter skb has to be locally delivered or
forwarded. IOW, in NF_INET_LOCAL_IN we've already decided on local
delivery and would not need a 'early' socket lookup any more.