netdev - Re: [PATCH net-next v8 0/2] net/mlx5e: add indr block support in the FT mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 26 Mar 2020 03:52:57 +0000
From:   Saeed Mahameed <saeedm@...lanox.com>
To:     "wenxu@...oud.cn" <wenxu@...oud.cn>
CC:     Paul Blakey <paulb@...lanox.com>,
        Vlad Buslov <vladbu@...lanox.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: [PATCH net-next v8 0/2] net/mlx5e: add indr block support in the
 FT mode

On Wed, 2020-03-25 at 20:18 +0800, wenxu@...oud.cn wrote:
> From: wenxu <wenxu@...oud.cn>
> 
> Indr block supported in FT mode can offload the tunnel device in the
> flowtables of nftable.
> 

applied to net-next-mlx5

Thanks !


> The netfilter patches:
> http://patchwork.ozlabs.org/cover/1242812/
> 
> Test with mlx driver as following with nft:
> 
> ip link add user1 type vrf table 1
> ip l set user1 up 
> ip l set dev mlx_pf0vf0 down
> ip l set dev mlx_pf0vf0 master user1
> ifconfig mlx_pf0vf0 10.0.0.1/24 up
> 
> ifconfig mlx_p0 172.168.152.75/24 up
> 
> ip l add dev tun1 type gretap key 1000
> ip l set dev tun1 master user1
> ifconfig tun1 10.0.1.1/24 up
> 
> ip r r 10.0.1.241 encap ip id 1000 dst 172.168.152.241 key dev tun1
> table 1
> 
> nft add table firewall
> nft add chain firewall zones { type filter hook prerouting priority -
> 300 \; }
> nft add rule firewall zones counter ct zone set iif map { "tun1" : 1,
> "mlx_pf0vf0" : 1 }
> nft add chain firewall rule-1000-ingress
> nft add rule firewall rule-1000-ingress ct zone 1 ct state
> established,related counter accept
> nft add rule firewall rule-1000-ingress ct zone 1 ct state invalid
> counter drop
> nft add rule firewall rule-1000-ingress ct zone 1 tcp dport 5001 ct
> state new counter accept
> nft add rule firewall rule-1000-ingress ct zone 1 udp dport 5001 ct
> state new counter accept
> nft add rule firewall rule-1000-ingress ct zone 1 tcp dport 22 ct
> state new counter accept
> nft add rule firewall rule-1000-ingress ct zone 1 ip protocol icmp ct
> state new counter accept
> nft add rule firewall rule-1000-ingress counter drop
> nft add chain firewall rules-all { type filter hook prerouting
> priority - 150 \; }
> nft add rule firewall rules-all meta iifkind "vrf" counter accept
> nft add rule firewall rules-all iif vmap { "tun1" : jump rule-1000-
> ingress }
> 
> nft add flowtable firewall fb1 { hook ingress priority 2 \; devices =
> { tun1, mlx_pf0vf0 } \; }
> nft add chain firewall ftb-all {type filter hook forward priority 0
> \; policy accept \; }
> nft add rule firewall ftb-all ct zone 1 ip protocol tcp flow offload
> @fb1
> nft add rule firewall ftb-all ct zone 1 ip protocol udp flow offload
> @fb1
> 
> 
> wenxu (2):
>   net/mlx5e: refactor indr setup block
>   net/mlx5e: add mlx5e_rep_indr_setup_ft_cb support
> 
>  drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 94
> ++++++++++++++++++------
>  1 file changed, 73 insertions(+), 21 deletions(-)
>