[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20221227182242.ozkc6u2lbwneoi4r@macbook-pro-6.dhcp.thefacebook.com>
Date: Tue, 27 Dec 2022 10:22:42 -0800
From: Alexei Starovoitov <alexei.starovoitov@...il.com>
To: Quentin Deslandes <qde@...cy.de>
Cc: Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>,
Andrii Nakryiko <andrii@...nel.org>,
Martin KaFai Lau <martin.lau@...ux.dev>,
Song Liu <song@...nel.org>, Yonghong Song <yhs@...com>,
John Fastabend <john.fastabend@...il.com>,
KP Singh <kpsingh@...nel.org>,
Stanislav Fomichev <sdf@...gle.com>,
Hao Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>,
"David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>,
Paolo Abeni <pabeni@...hat.com>,
Mykola Lysenko <mykolal@...com>, Shuah Khan <shuah@...nel.org>,
Dmitrii Banshchikov <me@...que.spb.ru>,
linux-kernel@...r.kernel.org, bpf@...r.kernel.org,
linux-kselftest@...r.kernel.org, netdev@...r.kernel.org,
Kernel Team <kernel-team@...a.com>, fw@...len.de
Subject: Re: [PATCH bpf-next v3 00/16] bpfilter
On Sat, Dec 24, 2022 at 01:03:46AM +0100, Quentin Deslandes wrote:
>
> Due to poor hardware availability on my side, I've not been able to
> benchmark those changes. I plan to get some numbers for the next iteration.
Yeah. Performance numbers would be my main question :)
> FORWARD filter chain is now supported, however, it's attached to
> TC INGRESS along with INPUT filter chain. This is due to XDP not supporting
> multiple programs to be attached. I could generate a single program
> out of both INPUT and FORWARD chains, but that would prevent another
> BPF program to be attached to the interface anyway. If a solution
> exists to attach both those programs to XDP while allowing for other
> programs to be attached, it requires more investigation. In the meantime,
> INPUT and FORWARD filtering is supported using TC.
I think we can ignore XDP chaining for now assuming that Daniel's bpf_link-tc work
will be applicable to XDP as well, so we'll have a simple chaining
for XDP eventually.
As far as attaching to TC... I think it would be great to combine bpfilter
codegen and attach to Florian's bpf hooks exactly at netfilter.
See
https://git.breakpoint.cc/cgit/fw/nf-next.git/commit/?h=nf_hook_jit_bpf_29&id=0c1ec06503cb8a142d3ad9f760b72d94ea0091fa
With nf_hook_ingress() calling either into classic iptable or into bpf_prog_run_nf
which is either generated by Florian's optimizer of nf chains or into
bpfilter generated code would be ideal.
Powered by blists - more mailing lists