netfilter: nf_tables_offload: support indr block call

Browse source

nftable support indr-block call. It makes nftable an offload vlan
and tunnel device.

nft add table netdev firewall
nft add chain netdev firewall aclout { type filter hook ingress offload device mlx_pf0vf0 priority - 300 \; }
nft add rule netdev firewall aclout ip daddr 10.0.0.1 fwd to vlan0
nft add chain netdev firewall aclin { type filter hook ingress device vlan0 priority - 300 \; }
nft add rule netdev firewall aclin ip daddr 10.0.0.7 fwd to mlx_pf0vf0

Signed-off-by: wenxu <wenxu@ucloud.cn>
Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

...

This commit is contained in:

wenxu 2019-08-07 09:13:54 +08:00 • committed by David S. Miller

parent 1150ab0f1b

commit 9a32669fec

3 changed files with 135 additions and 24 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

4

include/net/netfilter/nf_tables_offload.h

View file

7

net/netfilter/nf_tables_api.c

View file

148

net/netfilter/nf_tables_offload.c

View file