Re: ebtables: load-on-demand extensions

[Eugene Crosser <crosser@average.org>]

[-- Attachment #1.1: Type: text/plain, Size: 1490 bytes --]

On 6/16/20 6:33 PM, Jan Engelhardt wrote:

>>> Why not make a patch to publicly expose the skb's data via nft_meta?
>>> No more custom modules, no more userspace modifications [..]
>>
>> For our particular use case, we are running the skb through the kernel
>> function `skb_validate_network_len()` with custom mtu size [..]
> 
> I find no such function in the current or past kernels. Perhaps you could post
> the code of the module(s) you already have, and we can assess if it, or the
> upstream ideals, can be massaged to make the code stick.

I really really don't see our module being useful for anyone else! Even
for us, it's just a stopgap measure, hopefully to be dropped after a few
months. That said, I believe that the company will have no objections
against publishing it. I've uploaded initial (untested) code on github
here https://github.com/crosser/ebt-pmtud, in case anyone is interested.

On the other hand, in my opinion there will always be a use case for
custom kernel modules acting as extensions to netfilter. Alternative, in
most cases, would be a standalone kernel module, not using netfilter
infrastructure. But netfilter infrastructure is so useful and
convenient, it would be a shame to lose it!

Anyway, I would like to suggest a patch to `ebtables-nft` that
introduces `-m` option like in `iptables`. Turns out that it's only a
few lines, including manpage update! I will send the patch in a separate
email.

Regards,

Eugene


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]