# Re: \[PATCH RFC 0/9\] sk\_buff: optimize layout for GRO

- From: Florian Westphal \<fw@strlen.de\>
- Date: 2021-07-25 16:25:49 
- List: linux-security-module
- Page: https://ratatoskr.run/linux-security-module/2021/07/11208024
- Thread: https://ratatoskr.run/netdev/2021/07/11207803/t.md

```text
Paul Moore [ref] wrote:
> > There is the skb extension infra, does that work for you?
> 
> I was hopeful that when the skb_ext capability was introduced we might
> be able to use it for the LSM(s), but when I asked netdev if they
> would be willing to accept patches to leverage the skb_ext
> infrastructure I was told "no".

I found

https://lore.kernel.org/netdev/CAHC9VhSz1_KA1tCJtNjwK26BOkGhKGbPT7v1O82mWPduvWwd4A@mail.gmail.com/#r

and from what I gather from your comments and that of Casey
I think skb extensions is the correct thing for this (i.e., needs
netlabel/secid config/enablement so typically won't be active on
a distro kernel by default).

It certainly makes more sense to me than doing lookups
in a hashtable based on a ID (I tried to do that to get rid of skb->nf_bridge
pointer years ago and it I could not figure out how to invalidate an entry
without adding a new skb destructor callback).
```