From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Subject: [PATCH nft 6/6] doc: nft: document flowtable
Date: Tue, 23 Jan 2018 13:16:22 +0100 [thread overview]
Message-ID: <20180123121622.16287-6-pablo@netfilter.org> (raw)
In-Reply-To: <20180123121622.16287-1-pablo@netfilter.org>
Document the new flowtable objects available since Linux kernel 4.16-rc.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
doc/nft.xml | 103 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 103 insertions(+)
diff --git a/doc/nft.xml b/doc/nft.xml
index 9e979af3c280..1b901c17b5a0 100644
--- a/doc/nft.xml
+++ b/doc/nft.xml
@@ -1160,6 +1160,91 @@ filter input iif $int_ifs accept
</refsect1>
<refsect1>
+ <title>Flowtables</title>
+ <para>
+ <cmdsynopsis>
+ <group choice="req">
+ <arg>add</arg>
+ <arg>create</arg>
+ </group>
+ <command>flowtable</command>
+ <arg choice="opt"><replaceable>family</replaceable></arg>
+ <arg choice="plain"><replaceable>table</replaceable></arg>
+ <arg choice="plain"><replaceable>flowtable</replaceable></arg>
+ <arg choice="req">
+ hook <replaceable>hook</replaceable>
+ priority <replaceable>priority</replaceable> ;
+ devices = { <replaceable>device</replaceable>[,...] } ;
+ </arg>
+ </cmdsynopsis>
+ <cmdsynopsis>
+ <group choice="req">
+ <arg>delete</arg>
+ <arg>list</arg>
+ </group>
+ <command>flowtable</command>
+ <arg choice="opt"><replaceable>family</replaceable></arg>
+ <replaceable>table</replaceable>
+ <replaceable>flowtable</replaceable>
+ </cmdsynopsis>
+ </para>
+
+ <para>
+ Flowtables allow you to accelerate packet forwarding in software.
+ Flowtables entries are represented through a tuple that is composed of the
+ input interface, source and destination address, source and destination
+ port; and layer 3/4 protocols. Each entry also caches the destination
+ interface and the gateway address - to update the destination link-layer
+ address - to forward packets. The ttl and hoplimit fields are also
+ decremented. Hence, flowtables provides an alternative path that allow
+ packets to bypass the classic forwarding path. Flowtables reside in the
+ ingress hook, that is located before the prerouting hook. You can select
+ what flows you want to offload through the <literal>flow offload</literal>
+ expression from the <literal>forward</literal> chain. Flowtables are
+ identified by their address family and their name. The address family
+ must be one of
+
+ <simplelist type="inline">
+ <member><literal>ip</literal></member>
+ <member><literal>ip6</literal></member>
+ <member><literal>inet</literal></member>
+ </simplelist>.
+
+ The <literal>inet</literal> address family is a dummy family which is used to create
+ hybrid IPv4/IPv6 tables.
+
+ When no address family is specified, <literal>ip</literal> is used by default.
+ </para>
+
+ <variablelist>
+ <varlistentry>
+ <term><option>add</option></term>
+ <listitem>
+ <para>
+ Add a new flowtable for the given family with the given name.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>delete</option></term>
+ <listitem>
+ <para>
+ Delete the specified flowtable.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>list</option></term>
+ <listitem>
+ <para>
+ List all flowtables.
+ </para>
+ </listitem>
+ </varlistentry>
+ </variablelist>
+ </refsect1>
+
+ <refsect1>
<title>Stateful objects</title>
<para>
<cmdsynopsis>
@@ -4917,6 +5002,24 @@ add rule nat prerouting tcp dport 22 redirect to :2222
</example>
</para>
</refsect2>
+
+ <refsect2>
+ <title>Flow offload statement</title>
+ <para>
+ A flow offload statement allows us to select what flows
+ you want to accelerate forwarding through layer 3 network
+ stack bypass. You have to specify the flowtable name where
+ you want to offload this flow.
+ </para>
+ <para>
+ <cmdsynopsis>
+ <command>flow offload</command>
+ <literal>@flowtable</literal>
+ </cmdsynopsis>
+ </para>
+
+ </refsect2>
+
<refsect2>
<title>Queue statement</title>
<para>
--
2.11.0
prev parent reply other threads:[~2018-01-23 12:16 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-23 12:16 [PATCH nft 1/6] src: support for flowtable listing Pablo Neira Ayuso
2018-01-23 12:16 ` [PATCH nft 2/6] src: add support to add flowtables Pablo Neira Ayuso
2018-01-23 12:16 ` [PATCH nft 3/6] src: delete flowtable Pablo Neira Ayuso
2018-01-23 12:16 ` [PATCH nft 4/6] src: flow offload support Pablo Neira Ayuso
2018-01-23 12:16 ` [PATCH nft 5/6] tests: shell: add flowtable tests Pablo Neira Ayuso
2018-01-23 12:16 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180123121622.16287-6-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).