[PATCH net-next 0/2] netfilter: payload mangling offload support

[PATCH net-next 0/2] netfilter: payload mangling offload support

[Pablo Neira Ayuso]

Hi,

This patchset adds payload mangling offload support for Netfilter:

1) Adapt existing drivers to allow for mangling up to four 32-bit words
   with one single flow_rule action. Hence, once single action can be
   used to mangle an IPv6 address.

2) Add support for netfilter packet mangling.

Please, apply.

Pablo Neira Ayuso (2):
  net: flow_offload: mangle 128-bit packet field with one action
  netfilter: nft_payload: packet mangling offload support

 .../net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c   | 44 ++++++++----
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c    | 50 +++++++++----
 drivers/net/ethernet/netronome/nfp/flower/action.c | 69 ++++++++++++------
 include/net/flow_offload.h                         |  9 ++-
 net/netfilter/nft_payload.c                        | 82 ++++++++++++++++++++++
 net/sched/cls_api.c                                |  7 +-
 6 files changed, 207 insertions(+), 54 deletions(-)

-- 
2.11.0

Re: [PATCH net-next 0/2] netfilter: payload mangling offload support

[Jakub Kicinski]

On Tue, 20 Aug 2019 12:48:05 +0200, Pablo Neira Ayuso wrote:
> Hi,
> 
> This patchset adds payload mangling offload support for Netfilter:
> 
> 1) Adapt existing drivers to allow for mangling up to four 32-bit words
>    with one single flow_rule action. Hence, once single action can be
>    used to mangle an IPv6 address.
> 
> 2) Add support for netfilter packet mangling.

Why pick 128b as a unit, because that's nftables' word size? :/

Reality is unless core coalesces _all_ consecutive rewrites drivers 
will have to do their own coalescing, anyway.

We suffered through enough haphazard "updates", I don't like this either.