netfilter: nf_tables: add hardware offload support

Browse source

This patch adds hardware offload support for nftables through the
existing netdev_ops->ndo_setup_tc() interface, the TC_SETUP_CLSFLOWER
classifier and the flow rule API. This hardware offload support is
available for the NFPROTO_NETDEV family and the ingress hook.

Each nftables expression has a new ->offload interface, that is used to
populate the flow rule object that is attached to the transaction
object.

There is a new per-table NFT_TABLE_F_HW flag, that is set on to offload
an entire table, including all of its chains.

This patch supports for basic metadata (layer 3 and 4 protocol numbers),
5-tuple payload matching and the accept/drop actions; this also includes
basechain hardware offload only.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

...

This commit is contained in:

Pablo Neira Ayuso 2019-07-09 23:00:43 +02:00 • committed by David S. Miller

parent f9e30088d2

commit c9626a2cbd

10 changed files with 691 additions and 7 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

14

include/net/netfilter/nf_tables.h

View file

76

include/net/netfilter/nf_tables_offload.h

View file

2

include/uapi/linux/netfilter/nf_tables.h

View file

2

net/netfilter/Makefile

View file

39

net/netfilter/nf_tables_api.c

View file

267

net/netfilter/nf_tables_offload.c

View file

53

net/netfilter/nft_cmp.c

View file

31

net/netfilter/nft_immediate.c

View file

27

net/netfilter/nft_meta.c

View file

187

net/netfilter/nft_payload.c

View file