On 6/16/20 6:33 PM, Jan Engelhardt wrote: >>> Why not make a patch to publicly expose the skb's data via nft_meta? >>> No more custom modules, no more userspace modifications [..] >> >> For our particular use case, we are running the skb through the kernel >> function `skb_validate_network_len()` with custom mtu size [..] > > I find no such function in the current or past kernels. Perhaps you could post > the code of the module(s) you already have, and we can assess if it, or the > upstream ideals, can be massaged to make the code stick. I really really don't see our module being useful for anyone else! Even for us, it's just a stopgap measure, hopefully to be dropped after a few months. That said, I believe that the company will have no objections against publishing it. I've uploaded initial (untested) code on github here https://github.com/crosser/ebt-pmtud, in case anyone is interested. On the other hand, in my opinion there will always be a use case for custom kernel modules acting as extensions to netfilter. Alternative, in most cases, would be a standalone kernel module, not using netfilter infrastructure. But netfilter infrastructure is so useful and convenient, it would be a shame to lose it! Anyway, I would like to suggest a patch to `ebtables-nft` that introduces `-m` option like in `iptables`. Turns out that it's only a few lines, including manpage update! I will send the patch in a separate email. Regards, Eugene
Attachment:
signature.asc
Description: OpenPGP digital signature
