# Re: \[RFC PATCH net-next 0/3\] support "flow-based" datapath in l2tp

- From: Tom Parkin \<hidden\>
- Date: 2021-10-01 08:41:04 
- List: netdev
- Page: https://ratatoskr.run/netdev/2021/10/11212417
- Thread: https://ratatoskr.run/netdev/2021/09/11212028/t.md

```text
On  Wed, Sep 29, 2021 at 13:03:21 +0300, Eyal Birger wrote:
> Hi Tom,
> 
> On 29/09/2021 12:45, Tom Parkin wrote:
> ...
> >        The skb is then redirected to the tunnel virtual netdev: tc rules
> >        can then be added to match traffic based on the session ID and
> >        redirect it to the correct interface:
> > 
> >              tc qdisc add dev l2tpt1 handle ffff: ingress
> >              tc filter add dev l2tpt1 \
> >                      parent ffff: \
> >                      flower enc_key_id 1 \
> >                      action mirred egress redirect dev eth0
> > 
> >        In the case that no tc rule matches an incoming packet, the tunnel
> >        virtual device implements an rx handler which swallows the packet
> >        in order to prevent it continuing through the network stack.
> 
> There are other ways to utilize the tunnel key on rx, e.g. in ip rules.
> 
> IMHO it'd be nicer if the decision to drop would be an administrator
> decision which they can implement using a designated tc drop rule.

Good point, and one I hadn't considered.

My concern with letting the packet enter the stack is that it could
possibly cause issues, but maybe it's better to allow the admin to
make that call.
```

## Attachments

- [signature.asc](https://ratatoskr.run/netdev/2021/10/11212417/attachment/0) (application/pgp-signature, 488 bytes)