• Pablo Neira Ayuso's avatar
    netfilter: nf_tables: add hardware offload support · c9626a2c
    Pablo Neira Ayuso authored
    This patch adds hardware offload support for nftables through the
    existing netdev_ops->ndo_setup_tc() interface, the TC_SETUP_CLSFLOWER
    classifier and the flow rule API. This hardware offload support is
    available for the NFPROTO_NETDEV family and the ingress hook.
    
    Each nftables expression has a new ->offload interface, that is used to
    populate the flow rule object that is attached to the transaction
    object.
    
    There is a new per-table NFT_TABLE_F_HW flag, that is set on to offload
    an entire table, including all of its chains.
    
    This patch supports for basic metadata (layer 3 and 4 protocol numbers),
    5-tuple payload matching and the accept/drop actions; this also includes
    basechain hardware offload only.
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    c9626a2c
Makefile 8.89 KB