Alexei Starovoitov <alexei.starovoitov@xxxxxxxxx> wrote: > > See my reply to Alexey, immediate goal was to get rid of the indirect > > calls by providing a tailored/jitted equivalent of nf_hook_slow(). > > > > The next step could be to allow implementation of netfilter hooks > > (i.e., kernel modules that call nf_register_net_hook()) in bpf > > but AFAIU it requires addition of BPF_PROG_TYPE_NETFILTER etc. > > We were adding new prog and maps types in the past. > Now new features are being added differently. > All of the networking either works with sk_buff-s or xdp frames. > We try hard not to add any new uapi helpers. > Everything is moving to kfuncs. > Other sub-systems should be able to use bpf without touching > the bpf core. See hid-bpf as an example. > It needs several verifier improvements, but doesn't need > new prog types, helpers, etc. I don't see how it can be done without a new prog type, the bpf progs would need access to "nf_hook_state" struct, passed as argument to nf_hook_slow() (and down to the individual xt_foo modules...). We can't change the existing netfilter hook prototype to go by sk_buff * as that doesn't have all information, most prominent are the input and output net_device, but also okfn is needed for async reinject (nf_queue), the hook location and so on. > > After that, yes, one could think about how to jit nft_do_chain() and > > all the rest of the nft machinery. > > Sounds like a ton of work. All that just to accelerate nft a bit? > I think there are more impactful projects to work on. > For example, accelerating classic iptables with bpf would immediately > help a bunch of users. Maybe, but from the problem points and the required effort it doesn't matter if the chosen target is iptables or nftables; as far as the time/effort needed I'd say they are identical. The hard issues that need to be solved first are the same; they reside in the netfilter core and not in the specific interpreter (nft_do_chain vs. ipt_do_table and friends). nf_tables might be *slightly* easier once that point would be reached because the core functionality is more integrated with nf_tables whereas in iptables there is more copypastry (ipt_do_table, ip6t_do_table, ebt_do_table, ...).
