netdev - Re: [patch net-next 0/9] net: sched: introduce chain templates support with offloading to mlxsw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 28 Jun 2018 08:18:17 +0200
From:   Jiri Pirko <jiri@...nulli.us>
To:     Cong Wang <xiyou.wangcong@...il.com>
Cc:     sridhar.samudrala@...el.com,
        Jakub Kicinski <jakub.kicinski@...ronome.com>,
        Linux Kernel Network Developers <netdev@...r.kernel.org>,
        David Miller <davem@...emloft.net>,
        Jamal Hadi Salim <jhs@...atatu.com>,
        Simon Horman <simon.horman@...ronome.com>,
        john.hurley@...ronome.com, David Ahern <dsahern@...il.com>,
        mlxsw@...lanox.com
Subject: Re: [patch net-next 0/9] net: sched: introduce chain templates
 support with offloading to mlxsw

Wed, Jun 27, 2018 at 07:04:32PM CEST, xiyou.wangcong@...il.com wrote:
>On Wed, Jun 27, 2018 at 9:46 AM Samudrala, Sridhar
><sridhar.samudrala@...el.com> wrote:
>>
>> On 6/27/2018 12:50 AM, Jiri Pirko wrote:
>> > if you don't like "tc filter template add dev dummy0 ingress", how
>> > about:
>> > "tc template add dev dummy0 ingress ..."
>> > "tc template add dev dummy0 ingress chain 22 ..."
>> > that makes more sense I think.
>
>Better than 'tc filter template', but this doesn't reflect 'template'
>is a template of tc filter, it could be an action etc., since it is in the

It's a template of filter per chain. I don't understand how it could be
an action...


>same position with 'tc action/filter/qdisc'.
>
>
>>
>> Isn't it possible to avoid introducing another keyword 'template',
>>
>> Can't we just do
>>        tc chain add dev dummy0 ingress flower chain_index 0
>> to create a chain that takes any types of flower rules with index 0
>> and
>>       tc chain add dev dummy0 ingress flower chain_index 22
>>              dst_mac 00:00:00:00:00:00/00:00:00:00:FF:FF
>>       tc chain add dev dummy0 ingress flower chain_index 23
>>              dst_ip 192.168.0.0/16
>> to create 2 chains 22 and 23 that allow rules with specific fields.
>
>Sounds good too. Since filter chain can be shared by qdiscs,
>a 'tc chain' sub-command makes sense, and would probably make
>it easier to be shared.

We don't have such specific object. It is implicit. We create it
whenever someone users it. Either filter of chain. I don't like new "tc
chain" object in cmdline. It really isn't.