Florian Westphal <fw@xxxxxxxxx> writes: > Kumar Kartikeya Dwivedi <memxor@xxxxxxxxx> wrote: >> On Tue, Oct 19, 2021 at 08:16:52PM IST, Maxim Mikityanskiy wrote: >> > The new helpers (bpf_ct_lookup_tcp and bpf_ct_lookup_udp) allow to query >> > connection tracking information of TCP and UDP connections based on >> > source and destination IP address and port. The helper returns a pointer >> > to struct nf_conn (if the conntrack entry was found), which needs to be >> > released with bpf_ct_release. >> > >> > Signed-off-by: Maxim Mikityanskiy <maximmi@xxxxxxxxxx> >> > Reviewed-by: Tariq Toukan <tariqt@xxxxxxxxxx> >> >> The last discussion on this [0] suggested that stable BPF helpers for conntrack >> were not desired, hence the recent series [1] to extend kfunc support to modules >> and base the conntrack work on top of it, which I'm working on now (supporting >> both CT lookup and insert). > > This will sabotage netfilter pipeline and the way things work more and > more 8-( Why? > If you want to use netfilter with ebpf, please have a look at the RFC > I posted and lets work on adding a netfilter specific program type > that can run ebpf programs directly from any of the existing netfilter > hook points. Accelerating netfilter using BPF is a worthy goal in itself, but I also think having the ability to lookup into conntrack from XDP is useful for cases where someone wants to bypass the stack entirely (for accelerating packet forwarding, say). I don't think these goals are in conflict either, what makes you say they are? -Toke
