From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jiri Pirko Subject: Re: [RFC net-next] net: sch_clsact: add support for global per-netns classifier mode Date: Tue, 5 Sep 2017 16:23:30 +0200 Message-ID: <20170905142330.GC7936@nanopsycho> References: <1504615701-20912-1-git-send-email-nikolay@cumulusnetworks.com> <20170905140750.GB7936@nanopsycho> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: netdev@vger.kernel.org, roopa@cumulusnetworks.com, dsa@cumulusnetworks.com, xiyou.wangcong@gmail.com, jhs@mojatatu.com To: Nikolay Aleksandrov Return-path: Received: from mail-wm0-f46.google.com ([74.125.82.46]:35545 "EHLO mail-wm0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751845AbdIEOXd (ORCPT ); Tue, 5 Sep 2017 10:23:33 -0400 Received: by mail-wm0-f46.google.com with SMTP id f199so49438wme.0 for ; Tue, 05 Sep 2017 07:23:32 -0700 (PDT) Content-Disposition: inline In-Reply-To: <20170905140750.GB7936@nanopsycho> Sender: netdev-owner@vger.kernel.org List-ID: Tue, Sep 05, 2017 at 04:07:51PM CEST, jiri@resnulli.us wrote: >Tue, Sep 05, 2017 at 02:48:21PM CEST, nikolay@cumulusnetworks.com wrote: >>Hi all, >>This RFC adds a new mode for clsact which designates a device's egress >>classifier as global per netns. The packets that are not classified for >>a particular device will be classified using the global classifier. >>We have needed a global classifier for some time now for various >>purposes and setting the single bridge or loopback/vrf device as the >>global classifier device is acceptable for us. Doing it this way avoids >>the act/cls device and queue dependencies. >> >>This is strictly an RFC patch just to show the intent, if we agree on >>the details the proposed patch will have support for both ingress and >>egress, and will be using a static key to avoid the fast path test when no >>global classifier has been configured. >> >>Example (need a modified tc that adds TCA_OPTIONS when using q_clsact): >>$ tc qdisc add dev lo clsact global >>$ tc filter add dev lo egress protocol ip u32 match ip dst 4.3.2.1/32 action drop >> >>the last filter will be global for all devices that don't have a >>specific egress_cl_list (i.e. have clsact configured). >> >>Any comments and thoughts would be greatly appreciated. For the record, I think this "global" thing is a hack similar to cls_u32 shared hashlists. > >Did you see my shared blocks work? I believe that it should resolve your >usecase, in a generic way. You just have to bind the devices you need to >the shared block. Please see the RFC: > >https://www.spinics.net/lists/netdev/msg444067.html