Re: [RFC PATCH net-next 0/3] support "flow-based" datapath in l2tp

Hi Tom,

On 29/09/2021 12:45, Tom Parkin wrote:
...

       The skb is then redirected to the tunnel virtual netdev: tc rules
       can then be added to match traffic based on the session ID and
       redirect it to the correct interface:

             tc qdisc add dev l2tpt1 handle ffff: ingress
             tc filter add dev l2tpt1 \
                     parent ffff: \
                     flower enc_key_id 1 \
                     action mirred egress redirect dev eth0

       In the case that no tc rule matches an incoming packet, the tunnel
       virtual device implements an rx handler which swallows the packet
       in order to prevent it continuing through the network stack.

There are other ways to utilize the tunnel key on rx, e.g. in ip rules.

IMHO it'd be nicer if the decision to drop would be an administrator 
decision which they can implement using a designated tc drop rule.

Eyal.