Introduce a netfilter egress hook to complement the existing ingress hook.
User space support for nft will be submitted separately in a minute.
I'm re-submitting this as non-RFC per Pablo's request. Compared to the
RFC, I've changed the order in patch [3/3] to perform netfilter first,
then tc (instead of the other way round). The rationale is provided in
the commit message. I've also extended the commit message with performance
measurements.
To reproduce the performance measurements in patch [3/3], you'll need
net-next commit 1e09e5818b3a ("pktgen: Allow on loopback device").
Link to the RFC version:
https://lore.kernel.org/netdev/cover.1572528496.git.lukas@xxxxxxxxx/
Thanks!
Lukas Wunner (3):
netfilter: Rename ingress hook include file
netfilter: Generalize ingress hook
netfilter: Introduce egress hook
include/linux/netdevice.h | 4 ++
include/linux/netfilter_ingress.h | 58 -----------------
include/linux/netfilter_netdev.h | 102 ++++++++++++++++++++++++++++++
include/uapi/linux/netfilter.h | 1 +
net/core/dev.c | 27 ++++++--
net/netfilter/Kconfig | 8 +++
net/netfilter/core.c | 24 +++++--
net/netfilter/nft_chain_filter.c | 4 +-
8 files changed, 160 insertions(+), 68 deletions(-)
delete mode 100644 include/linux/netfilter_ingress.h
create mode 100644 include/linux/netfilter_netdev.h
--
2.25.0
