Netfilter-Devel Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH nf-next 0/7] dynamic device updates for flowtables
@ 2020-05-20 18:16 Pablo Neira Ayuso
  2020-05-20 18:16 ` [PATCH nf-next 1/7] netfilter: nf_tables: generalise flowtable hook parsing Pablo Neira Ayuso
                   ` (6 more replies)
  0 siblings, 7 replies; 8+ messages in thread
From: Pablo Neira Ayuso @ 2020-05-20 18:16 UTC (permalink / raw)
  To: netfilter-devel

Hi,

Flowtable allows you to enable a fast forwarding path (packets bypass
the classic forwarding path), eg.

table inet filter {
        flowtable fastpath {
                hook ingress priority 0
                devices = { eth0, eth1 }
        }

        chain forward {
                type filter hook forward priority 0; policy accept;
                ip protocol { tcp , udp } flow offload @fastpath;
        }
}

This ruleset above places TCP and UDP flows in the "fastpath" flowtable.
Flowtables integrate nicely with NAT and lightweight tunnels.

This patchset implements dynamic device updates for flowtables:

Patch #1 generalises the flowtable hook parser to take a hook list.
Patch #2 passes a hook list to the flowtable hook registration/unregistration.
Patch #3 adds a helper function to release the flowtable hook list.
Patch #4 updates the flowtable event notifier to pass a flowtable hook list.
Patch #5 allows users to add new devices to an existing flowtables.
Patch #6 allows users to remove devices to an existing flowtables.
Patch #7 allows to register a flowtable with no initial devices.

This allows users to register a flowtable with no devices:

	nft add flowtable x y { hook ingress priority 0\; }

then, add dynamic devices as they show up:

	nft add flowtable x y { devices = { ppp0, eth1 } \; }

Devices that go away are automagically removed from the flowtable.

Pablo Neira Ayuso (7):
  netfilter: nf_tables: generalise flowtable hook parsing
  netfilter: nf_tables: pass hook list to nft_{un,}register_flowtable_net_hooks()
  netfilter: nf_tables: add nft_flowtable_hooks_destroy()
  netfilter: nf_tables: pass hook list to flowtable event notifier
  netfilter: nf_tables: add devices to existing flowtable
  netfilter: nf_tables: delete devices from flowtable
  netfilter: nf_tables: allow to register flowtable with no devices

 include/net/netfilter/nf_tables.h |   7 +
 net/netfilter/nf_tables_api.c     | 304 ++++++++++++++++++++++++------
 2 files changed, 253 insertions(+), 58 deletions(-)

-- 
2.20.1


^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, back to index

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-20 18:16 [PATCH nf-next 0/7] dynamic device updates for flowtables Pablo Neira Ayuso
2020-05-20 18:16 ` [PATCH nf-next 1/7] netfilter: nf_tables: generalise flowtable hook parsing Pablo Neira Ayuso
2020-05-20 18:16 ` [PATCH nf-next 2/7] netfilter: nf_tables: pass hook list to nft_{un,}register_flowtable_net_hooks() Pablo Neira Ayuso
2020-05-20 18:16 ` [PATCH nf-next 3/7] netfilter: nf_tables: add nft_flowtable_hooks_destroy() Pablo Neira Ayuso
2020-05-20 18:16 ` [PATCH nf-next 4/7] netfilter: nf_tables: pass hook list to flowtable event notifier Pablo Neira Ayuso
2020-05-20 18:16 ` [PATCH nf-next 5/7] netfilter: nf_tables: add devices to existing flowtable Pablo Neira Ayuso
2020-05-20 18:16 ` [PATCH nf-next 6/7] netfilter: nf_tables: delete devices from flowtable Pablo Neira Ayuso
2020-05-20 18:16 ` [PATCH nf-next 7/7] netfilter: nf_tables: allow to register flowtable with no devices Pablo Neira Ayuso

Netfilter-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netfilter-devel/0 netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ https://lore.kernel.org/netfilter-devel \
		netfilter-devel@vger.kernel.org
	public-inbox-index netfilter-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netfilter-devel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git