On Mon, Nov 23, 2020 at 11:31 PM Lukas Wunner <lukas@xxxxxxxxx> wrote: > > On Mon, Nov 23, 2020 at 07:34:22PM -0800, Alexei Starovoitov wrote: > > It's a missing hook for out-of-tree module. That's why it stinks so much. > > As I've said before, the motivation for these patches has pivoted away > from the original use case (which was indeed an out-of-tree module by > a company for which I no longer work): > > https://lore.kernel.org/netdev/20200905052403.GA10306@xxxxxxxxx/ > > When first submitting this series I also posted a patch to use the nft > egress hook from userspace for filtering and mangling. It seems Zevenet > is actively using that: > > https://lore.kernel.org/netdev/CAF90-Wi4W1U4FSYqyBTqe7sANbdO6=zgr-u+YY+X-gvNmOgc6A@xxxxxxxxxxxxxx/ > > > > So please consider augmenting your nft k8s solution with a tiny bit of bpf. > > bpf can add a new helper to call into nf_hook_slow(). > > The out-of-tree module had nothing to do with k8s, it was for industrial > fieldbus communication. But again, I no longer work for that company. > We're talking about a hook that's used by userspace, not by an out-of-tree > module. > > > > If it was not driven by > > out-of-tree kernel module I wouldn't have any problem with it. > > Good! Thank you. Let me update and repost the patches then. That's not what I said.
