[lathiat]

While I don't knwo the actual answer, a good place to look may be one of the eBPF load balancers like "Katran" from Facebook. I imagine it's needing to do that sort of thing. But no idea if it's attaching at the same level. I haven't really explained eBPF outside of tracing.

https://github.com/facebookincubator/katran

[tptacek]

Katran is XDP. The XDP eBPF hooks get packets before they hit the TCP/IP stack --- you can use XDP to route packets without ever creating skbuffs for them. The previous commenter is explicitly trying to use socket eBPF code, because they don't want their code to have to run as root. Katran won't be helpful for them.