From mboxrd@z Thu Jan 1 00:00:00 1970 From: Lorenzo Colitti Subject: Re: [PATCH v7 0/6] Add eBPF hooks for cgroups Date: Sat, 29 Oct 2016 12:51:37 +0900 Message-ID: References: <1477390454-12553-1-git-send-email-daniel@zonque.org> <20161026195933.GA2031@salvia> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Cc: Pablo Neira Ayuso , htejun-b10kYP2dOMg@public.gmane.org, Daniel Borkmann , ast-b10kYP2dOMg@public.gmane.org, David Miller , kafai-b10kYP2dOMg@public.gmane.org, Florian Westphal , harald-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, "netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , sargun-GaZTRHToo+CzQB+pC5nmwQ@public.gmane.org, cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Daniel Mack Return-path: In-Reply-To: Sender: cgroups-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: netdev.vger.kernel.org On Thu, Oct 27, 2016 at 5:40 PM, Daniel Mack wrote: > It's not anything new. These hooks live on the very same level as > SO_ATTACH_FILTER. The only differences are that the BPF programs are > stored in the cgroup, and not in the socket, and that they exist for > egress as well. What's the use case for egress? We (android networking) are currently looking at implementing network accounting via eBPF in order to replace the out-of-tree xt_qtaguid code. A per-cgroup eBPF program run on all traffic would be great. But when we looked at this patchset we realized it would not be useful for accounting purposes because even if a packet is counted here, it might still be dropped by netfilter hooks. It seems like it would be much more useful to be able to do this in an iptables rule.