Re: [PATCH bpf-next 07/10] bpf: Add helpers to query conntrack info

Florian Westphal [off-list ref] writes:

Kumar Kartikeya Dwivedi [off-list ref] wrote:

quoted

On Tue, Oct 19, 2021 at 08:16:52PM IST, Maxim Mikityanskiy wrote:

quoted

The new helpers (bpf_ct_lookup_tcp and bpf_ct_lookup_udp) allow to query
connection tracking information of TCP and UDP connections based on
source and destination IP address and port. The helper returns a pointer
to struct nf_conn (if the conntrack entry was found), which needs to be
released with bpf_ct_release.

Signed-off-by: Maxim Mikityanskiy <redacted>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>

The last discussion on this [0] suggested that stable BPF helpers for conntrack
were not desired, hence the recent series [1] to extend kfunc support to modules
and base the conntrack work on top of it, which I'm working on now (supporting
both CT lookup and insert).

This will sabotage netfilter pipeline and the way things work more and
more 8-(

Why?

If you want to use netfilter with ebpf, please have a look at the RFC
I posted and lets work on adding a netfilter specific program type
that can run ebpf programs directly from any of the existing netfilter
hook points.

Accelerating netfilter using BPF is a worthy goal in itself, but I also
think having the ability to lookup into conntrack from XDP is useful for
cases where someone wants to bypass the stack entirely (for accelerating
packet forwarding, say). I don't think these goals are in conflict
either, what makes you say they are?

-Toke