Netdev Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Lukas Wunner <lukas@wunner.de>
To: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Cc: "Pablo Neira Ayuso" <pablo@netfilter.org>,
	"Daniel Borkmann" <daniel@iogearbox.net>,
	"Laura García Liébana" <nevola@gmail.com>,
	"John Fastabend" <john.fastabend@gmail.com>,
	"Jozsef Kadlecsik" <kadlec@netfilter.org>,
	"Florian Westphal" <fw@strlen.de>,
	"Netfilter Development Mailing list"
	<netfilter-devel@vger.kernel.org>,
	coreteam@netfilter.org,
	"Network Development" <netdev@vger.kernel.org>,
	"Alexei Starovoitov" <ast@kernel.org>,
	"Eric Dumazet" <edumazet@google.com>,
	"Thomas Graf" <tgraf@suug.ch>,
	"David Miller" <davem@davemloft.net>
Subject: Re: [PATCH nf-next v3 3/3] netfilter: Introduce egress hook
Date: Tue, 24 Nov 2020 08:31:26 +0100	[thread overview]
Message-ID: <20201124073126.GA4856@wunner.de> (raw)
In-Reply-To: <20201124033422.gvwhvsjmwt3b3irx@ast-mbp>

On Mon, Nov 23, 2020 at 07:34:22PM -0800, Alexei Starovoitov wrote:
> It's a missing hook for out-of-tree module. That's why it stinks so much.

As I've said before, the motivation for these patches has pivoted away
from the original use case (which was indeed an out-of-tree module by
a company for which I no longer work):

https://lore.kernel.org/netdev/20200905052403.GA10306@wunner.de/

When first submitting this series I also posted a patch to use the nft
egress hook from userspace for filtering and mangling.  It seems Zevenet
is actively using that:

https://lore.kernel.org/netdev/CAF90-Wi4W1U4FSYqyBTqe7sANbdO6=zgr-u+YY+X-gvNmOgc6A@mail.gmail.com/


> So please consider augmenting your nft k8s solution with a tiny bit of bpf.
> bpf can add a new helper to call into nf_hook_slow().

The out-of-tree module had nothing to do with k8s, it was for industrial
fieldbus communication.  But again, I no longer work for that company.
We're talking about a hook that's used by userspace, not by an out-of-tree
module.


> If it was not driven by
> out-of-tree kernel module I wouldn't have any problem with it.

Good!  Thank you.  Let me update and repost the patches then.

Lukas

  reply	other threads:[~2020-11-24  7:39 UTC|newest]

Thread overview: 40+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-08-27  8:55 [PATCH nf-next v3 0/3] Netfilter egress hook Lukas Wunner
2020-08-27  8:55 ` [PATCH nf-next v3 1/3] netfilter: Rename ingress hook include file Lukas Wunner
2020-08-27  8:55 ` [PATCH nf-next v3 2/3] netfilter: Generalize ingress hook Lukas Wunner
2020-08-27  8:55 ` [PATCH nf-next v3 3/3] netfilter: Introduce egress hook Lukas Wunner
2020-08-28 18:52   ` John Fastabend
2020-09-03  5:00     ` John Fastabend
2020-09-04  8:54       ` Laura García Liébana
2020-09-04 15:46         ` John Fastabend
2020-09-05 11:13           ` Laura García Liébana
2020-09-04 16:21       ` Lukas Wunner
2020-09-04 21:14         ` Daniel Borkmann
2020-09-05  5:24           ` Lukas Wunner
2020-09-08 12:55             ` Daniel Borkmann
2020-09-11  7:42               ` Laura García Liébana
2020-09-11 16:27                 ` Daniel Borkmann
2020-09-14 11:29                   ` Laura García Liébana
2020-09-14 22:02                     ` Daniel Borkmann
2020-09-17 10:28                       ` Laura García Liébana
2020-09-18 20:31                         ` Daniel Borkmann
2020-09-19 15:52                           ` Pablo Neira Ayuso
2020-09-21  7:07                           ` Laura García Liébana
2020-10-11  8:26                       ` Lukas Wunner
2020-11-21 18:59                         ` Pablo Neira Ayuso
2020-11-22  3:24                           ` Alexei Starovoitov
2020-11-22 11:01                             ` Pablo Neira Ayuso
2020-11-24  3:34                               ` Alexei Starovoitov
2020-11-24  7:31                                 ` Lukas Wunner [this message]
2020-11-24 22:55                                   ` Alexei Starovoitov
2020-10-11  7:59               ` Lukas Wunner
2020-09-05 11:18           ` Laura García Liébana
2020-09-07 22:11             ` Daniel Borkmann
2020-09-08  6:19               ` Laura García Liébana
2020-09-08 11:46           ` Arturo Borrero Gonzalez
2020-09-08 13:27             ` Daniel Borkmann
2020-09-08 18:58         ` John Fastabend
2020-09-19 15:54   ` Pablo Neira Ayuso
2020-09-28 12:20     ` Lukas Wunner
2020-08-27 10:36 ` [PATCH nf-next v3 0/3] Netfilter " Laura García Liébana
2020-08-28  7:14 ` Daniel Borkmann
2020-08-28  9:14   ` Eric Dumazet

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201124073126.GA4856@wunner.de \
    --to=lukas@wunner.de \
    --cc=alexei.starovoitov@gmail.com \
    --cc=ast@kernel.org \
    --cc=coreteam@netfilter.org \
    --cc=daniel@iogearbox.net \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=fw@strlen.de \
    --cc=john.fastabend@gmail.com \
    --cc=kadlec@netfilter.org \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=nevola@gmail.com \
    --cc=pablo@netfilter.org \
    --cc=tgraf@suug.ch \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).