netdev - [PATCH net-next 0/5] netfilter: add indr block setup in nf_flow_table

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1577267303-24780-1-git-send-email-wenxu@ucloud.cn>
Date:   Wed, 25 Dec 2019 17:48:18 +0800
From:   wenxu@...oud.cn
To:     pablo@...filter.org, paulb@...lanox.com, netdev@...r.kernel.org
Cc:     netfilter-devel@...r.kernel.org, jiri@...lanox.com
Subject: [PATCH net-next 0/5] netfilter: add indr block setup in nf_flow_table_offload

From: wenxu <wenxu@...oud.cn>

This patch provide tunnel offload in nf_flow_table_offload based on
route lwtunnel. 
The first patch add TC_SETP_FT type in flow_indr_block_call.
The next two patches add support indr callback setup in flowtable offload.
The last two patches add tunnel match and action offload.

Test with mlx driver as following:

ip link add user1 type vrf table 1
ip l set user1 up 
ip l set dev mlx_pf0vf0 down
ip l set dev mlx_pf0vf0 master user1
ifconfig mlx_pf0vf0 10.0.0.1/24 up

ifconfig mlx_p0 172.168.152.75/24 up

ip l add dev tun1 type gretap key 1000
ip l set dev tun1 master user1
ifconfig tun1 10.0.1.1/24 up

ip r r 10.0.1.241 encap ip id 1000 dst 172.168.152.241 key dev tun1 table 1

nft add table firewall
nft add chain firewall zones { type filter hook prerouting priority - 300 \; }
nft add rule firewall zones counter ct zone set iif map { "tun1" : 1, "mlx_pf0vf0" : 1 }
nft add chain firewall rule-1000-ingress
nft add rule firewall rule-1000-ingress ct zone 1 ct state established,related counter accept
nft add rule firewall rule-1000-ingress ct zone 1 ct state invalid counter drop
nft add rule firewall rule-1000-ingress ct zone 1 tcp dport 5001 ct state new counter accept
nft add rule firewall rule-1000-ingress ct zone 1 udp dport 5001 ct state new counter accept
nft add rule firewall rule-1000-ingress ct zone 1 tcp dport 22 ct state new counter accept
nft add rule firewall rule-1000-ingress ct zone 1 ip protocol icmp ct state new counter accept
nft add rule firewall rule-1000-ingress counter drop
nft add chain firewall rules-all { type filter hook prerouting priority - 150 \; }
nft add rule firewall rules-all meta iifkind "vrf" counter accept
nft add rule firewall rules-all iif vmap { "tun1" : jump rule-1000-ingress }

nft add flowtable firewall fb1 { hook ingress priority 2 \; devices = { tun1, mlx_pf0vf0 } \; }
nft add chain firewall ftb-all {type filter hook forward priority 0 \; policy accept \; }
nft add rule firewall ftb-all ct zone 1 ip protocol tcp flow offload @fb1
nft add rule firewall ftb-all ct zone 1 ip protocol udp flow offload @fb1


wenxu (5):
  flow_offload: add TC_SETP_FT type in flow_indr_block_call
  netfilter: nf_flow_table_offload: refactor nf_flow_table_offload_setup
    to support indir setup
  netfilter: nf_flow_table_offload: add indr block setup support
  netfilter: nf_flow_table_offload: add tunnel match offload support
  netfilter: nf_flow_table_offload: add tunnel encap/decap action
    offload support

 include/net/flow_offload.h            |   3 +-
 net/core/flow_offload.c               |   6 +-
 net/netfilter/nf_flow_table_offload.c | 253 +++++++++++++++++++++++++++++++---
 net/netfilter/nf_tables_offload.c     |   2 +-
 net/sched/cls_api.c                   |   2 +-
 5 files changed, 243 insertions(+), 23 deletions(-)

-- 
1.8.3.1