Re: Conntrack offload questions

Re: Conntrack offload questions

[Pablo Neira Ayuso]

Hi Ed,

On Tue, Oct 29, 2019 at 06:02:57PM +0000, Edward Cree wrote:
> Hi Pablo,
> 
> I've been trying to figure out how the kernel API is going to look for
>  offloading conntrack entries into hardware (for ct_state matches in flower
>  rules to match on), as we're developing some hardware that intends to
>  support that.  AFAICT such an API does not yet exist in nf-next.
> 
> Back in 2017 you added some relevant-looking nf code [1] "Flow offload
>  infrastructure", including an RFC patch [2] which you said you would "keep
>  back until there's a driver".  Is the API added in that patch (i.e.
>  ndo_flow_offload()) still the current plan, or has the design changed at
>  all over the course of the last two years?
> 
> If you have some more up-to-date strawman/RFC code, that'd be really useful
>  for me to develop a prototype against.

The most up to date code is available here:

https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/log/?h=flow-offload-hw-v3

> I am assuming that the first actual upstream driver supporting conntrack
>  offload will be something from Mellanox (they seem to have been driving
>  this process) and that the offload API will be submitted along with that;
>  is that assumption accurate?

I don't work for Mellanox, I have absolutely no idea what the plans
are. I received a few emails about how they might use the
infrastructure I made, to consolidate common infrastructure. So I'm
very much looking for to seeing patches like you are.

> The information contained in this message is confidential and is
> intended for the addressee(s) only. If you have received this
> message in error, please notify the sender immediately and delete
> the message. Unless you are an addressee (or authorized to receive
> for an addressee), you may not use, copy or disclose to anyone this
> message or any information contained in this message. The
> unauthorized use, disclosure, copying or alteration of this message
> is strictly prohibited.

Don't worry, I'll keep this confidential :-)