On Sun, Oct 30, 2016 at 5:29 AM, Daniel Borkmann <daniel@xxxxxxxxxxxxx> wrote: > Fwiw, not sure if swapping brings much, even after netfilter there could > be complex processing that would potentially drop, mangle, redirect, etc > from tc layer (egress or from qdisc itself). But also at even lower layers I agree lots of stuff can still happen after the netfilter hooks have finished. But it seems to me that netfilter hooks are more flexible and have more access to more data (L2 headers, output devices, conntrack state entries, etc. etc.) than this hook. So it seems to me that this hook would be more useful if it ran after netfilter on egress. That way, if you want to modify the packet or do something sophisticated in netfilter, you can still use the eBPF hook on the results of that operation, and if you don't want to run netfilter, you can write netfilter rules to skip the packet (and maybe still fix it up later, perhaps in another netfilter chain). -- To unsubscribe from this list: send the line "unsubscribe cgroups" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
