Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.200.110.1.12\))
Subject: Re: [PATCH] Periodically flow expire from flow offload tables
From:   Michael Lilja <michael.lilja@gmail.com>
In-Reply-To: <Y1fd+DEPZ8xM2x5B@salvia>
Date:   Tue, 25 Oct 2022 15:32:51 +0200
Cc:     "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>,
        Jonathan Corbet <corbet@lwn.net>,
        Jozsef Kadlecsik <kadlec@netfilter.org>,
        Florian Westphal <fw@strlen.de>, netdev@vger.kernel.org,
        linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
        netfilter-devel@vger.kernel.org, coreteam@netfilter.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <F754AC3A-D89A-4CF7-97AE-CA59B18A758E@gmail.com>
References: <20221023171658.69761-1-michael.lilja@gmail.com>
 <Y1fC5K0EalIYuB7Y@salvia> <381FF5B6-4FEF-45E9-92D6-6FE927A5CC2D@gmail.com>
 <Y1fd+DEPZ8xM2x5B@salvia>
To:     Pablo Neira Ayuso <pablo@netfilter.org>
Precedence: bulk

Hi,=20

Thanks for the optimisation suggestions, my nft is a rough conversion =
from iptables, I will look into using maps.

The ingress chain will work fine for SW OFFLOAD but HW OFFLOAD is not =
solved by this, at least what I see is that once a flow is offloaded to =
HW the driver doesn=E2=80=99t see the packets?

If I use the ingress chain I guess I don=E2=80=99t have access to =E2=80=98=
ct mark=E2=80=99 yet? I could think of a use-case where schedules should =
only some =E2=80=98flow type=E2=80=99:
 meta mask !=3D 0x12340000/16 meta day =E2=80=9CTuesday" meta hour >=3D =
"06:00" meta hour < "07:00" drop=20

I have more advanced rules that check the ct mark and will need to drop =
if mark =3D=3D something. These mark =3D=3D something rules are applied =
=E2=80=98runtime=E2=80=99 and flowables doesn=E2=80=99t seem to be =
flushed on nft load, which is also a reason for my =E2=80=98flow =
retire=E2=80=99 from the tables.

So my overall goal is to receive packets, mark them with a value =
depending on 'flow type' and then for the flows that are allowed to be =
forwarded offload them to the ingress flow table for either HW or SW =
offload. Once in a while I will change the verdict of a =E2=80=98flow =
type=E2=80=99 and will need that to apply for all existing flows and =
future flows, besides the fixed schedules, and it should work both for =
SW OFFLOAD and HW OFFLOAD.

I only have the M7621 device to play with for HW OFFLOAD, but it works =
fine with my patch.


Thanks

>=20
>=20
> I suggest to move your 'forward' chain to netdev/ingress using =
priority
>=20
>      filter - 1
>=20
> so the time schedule evaluation is always done before the flowtable
> lookup, that is, schedules rules will be always evaluated.
>=20
> In your example, you are using a linear ruleset, which might defeat
> the purpose of the flowtable. So I'm attaching a new ruleset
> transformed to use maps and the ingress chain as suggested.
> <schedules.nft>