Re: [RFC net-next 0/2] net/sched: cls_flower, act_mirred: VXLAN redirect using TC

Mon, Aug 15, 2016 at 11:08:04AM CEST, amir@vadai.me wrote:

On Mon, Aug 15, 2016 at 11:17:40AM +0300, Amir Vadai wrote:

quoted

On Mon, Aug 15, 2016 at 09:11:22AM +0200, Jiri Pirko wrote:

quoted

Sun, Aug 14, 2016 at 07:53:30PM CEST, xiyou.wangcong@gmail.com wrote:

quoted

On Sun, Aug 14, 2016 at 7:06 AM, Amir Vadai [off-list ref] wrote:

quoted

tc qdisc add dev $ETH ingress

# ENCAP rule for ARP
tc filter add dev $ETH protocol 0x806 parent ffff: prio 11 \
                flower \
                action mirred egress redirect dev $VXLAN enc_src_ip 11.11.0.1 enc_dst_ip 11.11.0.2 enc_key_id 11 enc_dst_port 4789

# ENCAP rule for ICMP
tc filter add dev $ETH protocol ip parent ffff: prio 10 \
                flower ip_proto 1 \
                action mirred egress redirect dev $VXLAN enc_src_ip 11.11.0.1 enc_dst_ip 11.11.0.2 enc_key_id 11 enc_dst_port 4789

I don't like this. This makes mirred action unnecessarily
complex, it should really just mirror or redirect packets as
it is, why it should be aware of tunnel information?

I think you probably need to introduce a new tc action
for these tunnel information and pipe it to mirred.

that is the first thing that I thinked of when I saw the patch. I think
you can introduce act_vxlan similar to act_vlan.

introducing a new action was the first thing I thought of, but it felt
problematic because the actual encap is done by the redirection to the
vxlan device. This action is only responsible to supply the metadata and
work tightly with the mirred. It is not exactly like vlan that the
push/pop actions can live without mirroring/redirecting.
But still as all of you said, it makes mirred complex with stuff that
shouldn't be there. And between the two options it is better to
introduce a new action.

I will go in this direction.

Thanks,
Amir

Any objection to the following?

# ENCAP rule
tc filter add dev $ETH protocol ip parent ffff: prio 10 \
	flower ip_proto 1 \
	action set_tunnel_key src_ip 11.11.0.1 dst_ip 11.11.0.2 key_id 11 dst_port 4789 \

Looks fine to me.

	action mirred egress redirect dev $VXLAN 

# DECAP rule
tc filter add dev $VXLAN protocol ip parent ffff: prio 10 \
	flower \
		enc_src_ip 11.11.0.2 enc_dst_ip 11.11.0.1 enc_key_id 11 \
		ip_proto 1 \
	action mirred egress redirect dev $ETH