lkml.org 
[lkml]   [2023]   [Jan]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH bpf-next v3 00/16] bpfilter
From
Le 27/12/2022 à 19:22, Alexei Starovoitov a écrit :
> On Sat, Dec 24, 2022 at 01:03:46AM +0100, Quentin Deslandes wrote:
>>
>> Due to poor hardware availability on my side, I've not been able to
>> benchmark those changes. I plan to get some numbers for the next iteration.
>
> Yeah. Performance numbers would be my main question :)

Hardware is on the way! :)

>> FORWARD filter chain is now supported, however, it's attached to
>> TC INGRESS along with INPUT filter chain. This is due to XDP not supporting
>> multiple programs to be attached. I could generate a single program
>> out of both INPUT and FORWARD chains, but that would prevent another
>> BPF program to be attached to the interface anyway. If a solution
>> exists to attach both those programs to XDP while allowing for other
>> programs to be attached, it requires more investigation. In the meantime,
>> INPUT and FORWARD filtering is supported using TC.
>
> I think we can ignore XDP chaining for now assuming that Daniel's bpf_link-tc work
> will be applicable to XDP as well, so we'll have a simple chaining
> for XDP eventually.
>
> As far as attaching to TC... I think it would be great to combine bpfilter
> codegen and attach to Florian's bpf hooks exactly at netfilter.
> See
> https://git.breakpoint.cc/cgit/fw/nf-next.git/commit/?h=nf_hook_jit_bpf_29&id=0c1ec06503cb8a142d3ad9f760b72d94ea0091fa
> With nf_hook_ingress() calling either into classic iptable or into bpf_prog_run_nf
> which is either generated by Florian's optimizer of nf chains or into
> bpfilter generated code would be ideal.

That sounds interesting. If my understanding is correct, Florian's
work doesn't yet allow for userspace-generated programs to be attached,
which will be required for bpfilter.

\
 
 \ /
  Last update: 2023-03-26 23:31    [W:0.143 / U:0.456 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site