[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <cover.1719698275.git.lorenzo@kernel.org>
Date: Sun, 30 Jun 2024 00:26:47 +0200
From: Lorenzo Bianconi <lorenzo@...nel.org>
To: bpf@...r.kernel.org
Cc: pablo@...filter.org,
kadlec@...filter.org,
davem@...emloft.net,
edumazet@...gle.com,
kuba@...nel.org,
pabeni@...hat.com,
netfilter-devel@...r.kernel.org,
netdev@...r.kernel.org,
ast@...nel.org,
daniel@...earbox.net,
andrii@...nel.org,
martin.lau@...ux.dev,
eddyz87@...il.com,
lorenzo.bianconi@...hat.com,
toke@...hat.com,
fw@...len.de,
hawk@...nel.org,
horms@...nel.org,
donhunte@...hat.com,
memxor@...il.com
Subject: [PATCH v6 bpf-next 0/3] netfilter: Add the capability to offload flowtable in XDP layer
Introduce bpf_xdp_flow_lookup kfunc in order to perform the lookup of
a given flowtable entry based on the fib tuple of incoming traffic.
bpf_xdp_flow_lookup can be used as building block to offload in XDP
the sw flowtable processing when the hw support is not available.
This series has been tested running the xdp_flowtable_offload eBPF program
on an ixgbe 10Gbps NIC (eno2) in order to XDP_REDIRECT the TCP traffic to
a veth pair (veth0-veth1) based on the content of the nf_flowtable as soon
as the TCP connection is in the established state:
[tcp client] (eno1) == LAN == (eno2) xdp_flowtable_offload [XDP_REDIRECT] --> veth0 == veth1 [tcp server]
table inet filter {
flowtable ft {
hook ingress priority filter
devices = { eno2, veth0 }
}
chain forward {
type filter hook forward priority filter
meta l4proto { tcp, udp } flow add @ft
}
}
- sw flowtable [1 TCP stream, T = 300s]: ~ 6.2 Gbps
- xdp flowtable [1 TCP stream, T = 300s]: ~ 7.6 Gbps
- sw flowtable [3 TCP stream, T = 300s]: ~ 7.7 Gbps
- xdp flowtable [3 TCP stream, T = 300s]: ~ 8.8 Gbps
Changes since v5:
- remove unused nf_flow_offload_xdp_cancel routine
- add missing __bpf_kfunc_start_defs()/__bpf_kfunc_end_defs()
- remove unused definition
Changes since v4:
- add missing BPF_NO_KFUNC_PROTOTYPES macro to selftest
Changes since v3:
- move flowtable map utilities in nf_flow_table_xdp.c
Changes since v2:
- introduce bpf_flowtable_opts struct in bpf_xdp_flow_lookup signature
- get rid of xdp_flowtable_offload bpf sample
- get rid of test_xdp_flowtable.sh for selftest and rely on prog_tests instead
- rename bpf_xdp_flow_offload_lookup in bpf_xdp_flow_lookup
Changes since v1:
- return NULL in bpf_xdp_flow_offload_lookup kfunc in case of error
- take into account kfunc registration possible failures
Changes since RFC:
- fix compilation error if BTF is not enabled
Florian Westphal (1):
netfilter: nf_tables: add flowtable map for xdp offload
Lorenzo Bianconi (2):
netfilter: add bpf_xdp_flow_lookup kfunc
selftests/bpf: Add selftest for bpf_xdp_flow_lookup kfunc
include/net/netfilter/nf_flow_table.h | 15 ++
net/netfilter/Makefile | 7 +-
net/netfilter/nf_flow_table_bpf.c | 121 +++++++++++++
net/netfilter/nf_flow_table_inet.c | 2 +-
net/netfilter/nf_flow_table_offload.c | 2 +-
net/netfilter/nf_flow_table_xdp.c | 147 +++++++++++++++
tools/testing/selftests/bpf/config | 13 ++
.../selftests/bpf/prog_tests/xdp_flowtable.c | 168 ++++++++++++++++++
.../selftests/bpf/progs/xdp_flowtable.c | 144 +++++++++++++++
9 files changed, 616 insertions(+), 3 deletions(-)
create mode 100644 net/netfilter/nf_flow_table_bpf.c
create mode 100644 net/netfilter/nf_flow_table_xdp.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/xdp_flowtable.c
create mode 100644 tools/testing/selftests/bpf/progs/xdp_flowtable.c
--
2.45.2
Powered by blists - more mailing lists