netdev - Re: [patch net-next 0/9] net: sched: introduce chain templates support with offloading to mlxsw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAM_iQpUiod0iG=h8STfkKEPQoJUe==B0Q3oPj3kR5Wy7+5FBqA@mail.gmail.com>
Date:   Wed, 27 Jun 2018 10:04:32 -0700
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     sridhar.samudrala@...el.com
Cc:     Jiri Pirko <jiri@...nulli.us>,
        Jakub Kicinski <jakub.kicinski@...ronome.com>,
        Linux Kernel Network Developers <netdev@...r.kernel.org>,
        David Miller <davem@...emloft.net>,
        Jamal Hadi Salim <jhs@...atatu.com>,
        Simon Horman <simon.horman@...ronome.com>,
        john.hurley@...ronome.com, David Ahern <dsahern@...il.com>,
        mlxsw@...lanox.com
Subject: Re: [patch net-next 0/9] net: sched: introduce chain templates
 support with offloading to mlxsw

On Wed, Jun 27, 2018 at 9:46 AM Samudrala, Sridhar
<sridhar.samudrala@...el.com> wrote:
>
> On 6/27/2018 12:50 AM, Jiri Pirko wrote:
> > if you don't like "tc filter template add dev dummy0 ingress", how
> > about:
> > "tc template add dev dummy0 ingress ..."
> > "tc template add dev dummy0 ingress chain 22 ..."
> > that makes more sense I think.

Better than 'tc filter template', but this doesn't reflect 'template'
is a template of tc filter, it could be an action etc., since it is in the
same position with 'tc action/filter/qdisc'.


>
> Isn't it possible to avoid introducing another keyword 'template',
>
> Can't we just do
>        tc chain add dev dummy0 ingress flower chain_index 0
> to create a chain that takes any types of flower rules with index 0
> and
>       tc chain add dev dummy0 ingress flower chain_index 22
>              dst_mac 00:00:00:00:00:00/00:00:00:00:FF:FF
>       tc chain add dev dummy0 ingress flower chain_index 23
>              dst_ip 192.168.0.0/16
> to create 2 chains 22 and 23 that allow rules with specific fields.

Sounds good too. Since filter chain can be shared by qdiscs,
a 'tc chain' sub-command makes sense, and would probably make
it easier to be shared.