From: wenxu@ucloud.cn
To: pablo@netfilter.org
Cc: netfilter-devel@vger.kernel.org
Subject: [PATCH nf-next v3 0/4] netfilter: nf_flow_table_offload: support tunnel offload
Date: Tue, 10 Dec 2019 15:26:21 +0800 [thread overview]
Message-ID: <1575962785-14812-1-git-send-email-wenxu@ucloud.cn> (raw)
From: wenxu <wenxu@ucloud.cn>
This patch provide tunnel offload based on route lwtunnel.
The first two patches support indr callback setup
Then add tunnel match and action offload
Test with mlx driver as following:
ip link add user1 type vrf table 1
ip l set user1 up
ip l set dev mlx_pf0vf0 down
ip l set dev mlx_pf0vf0 master user1
ifconfig mlx_pf0vf0 10.0.0.1/24 up
ifconfig mlx_p0 172.168.152.75/24 up
ip l add dev tun1 type gretap key 1000
ip l set dev tun1 master user1
ifconfig tun1 10.0.1.1/24 up
ip r r 10.0.1.241 encap ip id 1000 dst 172.168.152.241 key dev tun1 table 1
nft add table firewall
nft add chain firewall zones { type filter hook prerouting priority - 300 \; }
nft add rule firewall zones counter ct zone set iif map { "tun1" : 1, "mlx_pf0vf0" : 1 }
nft add chain firewall rule-1000-ingress
nft add rule firewall rule-1000-ingress ct zone 1 ct state established,related counter accept
nft add rule firewall rule-1000-ingress ct zone 1 ct state invalid counter drop
nft add rule firewall rule-1000-ingress ct zone 1 tcp dport 5001 ct state new counter accept
nft add rule firewall rule-1000-ingress ct zone 1 udp dport 5001 ct state new counter accept
nft add rule firewall rule-1000-ingress ct zone 1 tcp dport 22 ct state new counter accept
nft add rule firewall rule-1000-ingress ct zone 1 ip protocol icmp ct state new counter accept
nft add rule firewall rule-1000-ingress counter drop
nft add chain firewall rules-all { type filter hook prerouting priority - 150 \; }
nft add rule firewall rules-all meta iifkind "vrf" counter accept
nft add rule firewall rules-all iif vmap { "tun1" : jump rule-1000-ingress }
nft add flowtable firewall fb1 { hook ingress priority 2 \; devices = { tun1, mlx_pf0vf0 } \; }
nft add chain firewall ftb-all {type filter hook forward priority 0 \; policy accept \; }
nft add rule firewall ftb-all ct zone 1 ip protocol tcp flow offload @fb1
nft add rule firewall ftb-all ct zone 1 ip protocol udp flow offload @fb1
This version rebase on the following upstream fixes:
netfilter: nf_flow_table_offload: Fix block setup as TC_SETUP_FT cmd
netfilter: nf_flow_table_offload: Fix block_cb tc_setup_type as TC_SETUP_CLSFLOWER
netfilter: nf_flow_table_offload: Don't use offset uninitialized in flow_offload_port_{d,s}nat
netfilter: nf_flow_table_offload: add IPv6 match description
netfilter: nf_flow_table_offload: Correct memcpy size for flow_overload_mangle()
wenxu (4):
netfilter: nf_flow_table_offload: refactor nf_flow_table_offload_setup
to support indir setup
netfilter: nf_flow_table_offload: add indr block setup support
netfilter: nf_flow_table_offload: add tunnel match offload support
netfilter: nf_flow_table_offload: add tunnel encap/decap action
offload support
net/netfilter/nf_flow_table_offload.c | 253 +++++++++++++++++++++++++++++++---
1 file changed, 236 insertions(+), 17 deletions(-)
--
1.8.3.1
next reply other threads:[~2019-12-10 7:26 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-10 7:26 wenxu [this message]
2019-12-10 7:26 ` [PATCH nf-next v3 1/4] netfilter: nf_flow_table_offload: refactor nf_flow_table_offload_setup to support indir setup wenxu
2019-12-10 7:26 ` [PATCH nf-next v3 2/4] netfilter: nf_flow_table_offload: add indr block setup support wenxu
2019-12-10 7:26 ` [PATCH nf-next v3 3/4] netfilter: nf_flow_table_offload: add tunnel match offload support wenxu
2019-12-10 7:26 ` [PATCH nf-next v3 4/4] netfilter: nf_flow_table_offload: add tunnel encap/decap action " wenxu
2019-12-25 9:50 ` [PATCH nf-next v3 0/4] netfilter: nf_flow_table_offload: support tunnel offload wenxu
2019-12-26 8:31 ` wenxu
2020-01-02 3:32 ` wenxu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1575962785-14812-1-git-send-email-wenxu@ucloud.cn \
--to=wenxu@ucloud.cn \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.