On Mon, Nov 23, 2020 at 07:34:22PM -0800, Alexei Starovoitov wrote: > It's a missing hook for out-of-tree module. That's why it stinks so much. As I've said before, the motivation for these patches has pivoted away from the original use case (which was indeed an out-of-tree module by a company for which I no longer work): https://lore.kernel.org/netdev/20200905052403.GA10306@xxxxxxxxx/ When first submitting this series I also posted a patch to use the nft egress hook from userspace for filtering and mangling. It seems Zevenet is actively using that: https://lore.kernel.org/netdev/CAF90-Wi4W1U4FSYqyBTqe7sANbdO6=zgr-u+YY+X-gvNmOgc6A@xxxxxxxxxxxxxx/ > So please consider augmenting your nft k8s solution with a tiny bit of bpf. > bpf can add a new helper to call into nf_hook_slow(). The out-of-tree module had nothing to do with k8s, it was for industrial fieldbus communication. But again, I no longer work for that company. We're talking about a hook that's used by userspace, not by an out-of-tree module. > If it was not driven by > out-of-tree kernel module I wouldn't have any problem with it. Good! Thank you. Let me update and repost the patches then. Lukas
