Re: [PATCH nf-next v3 3/3] netfilter: Introduce egress hook

[Alexei Starovoitov <alexei.starovoitov@gmail.com>]

On Mon, Nov 23, 2020 at 11:31 PM Lukas Wunner <lukas@wunner.de> wrote:
>
> On Mon, Nov 23, 2020 at 07:34:22PM -0800, Alexei Starovoitov wrote:
> > It's a missing hook for out-of-tree module. That's why it stinks so much.
>
> As I've said before, the motivation for these patches has pivoted away
> from the original use case (which was indeed an out-of-tree module by
> a company for which I no longer work):
>
> https://lore.kernel.org/netdev/20200905052403.GA10306@wunner.de/
>
> When first submitting this series I also posted a patch to use the nft
> egress hook from userspace for filtering and mangling.  It seems Zevenet
> is actively using that:
>
> https://lore.kernel.org/netdev/CAF90-Wi4W1U4FSYqyBTqe7sANbdO6=zgr-u+YY+X-gvNmOgc6A@mail.gmail.com/
>
>
> > So please consider augmenting your nft k8s solution with a tiny bit of bpf.
> > bpf can add a new helper to call into nf_hook_slow().
>
> The out-of-tree module had nothing to do with k8s, it was for industrial
> fieldbus communication.  But again, I no longer work for that company.
> We're talking about a hook that's used by userspace, not by an out-of-tree
> module.
>
>
> > If it was not driven by
> > out-of-tree kernel module I wouldn't have any problem with it.
>
> Good!  Thank you.  Let me update and repost the patches then.

That's not what I said.