On 09/22/16 at 11:21am, Pablo Neira Ayuso wrote: > I have a hard time to buy this new specific hook, I think we should > shift focus of this debate, this is my proposal to untangle this: > > You add a net/netfilter/nft_bpf.c expression that allows you to run > bpf programs from nf_tables. This expression can either run bpf > programs in a similar fashion to tc+bpf or run the bpf program that > you have attached to the cgroup. So for every packet processed, you want to require the user to load and run a (unJITed) nft program acting as a wrapper to run a JITed BPF program? What it the benefit of this model compared to what Daniel is proposing? The hooking point is the same. This only introduces additional per packet overhead in the fast path. Am I missing something? -- To unsubscribe from this list: send the line "unsubscribe cgroups" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
