On 27/02/2025 04:45, Jakub Kicinski wrote:
The ordering guarantees of ntuple filters are a bit unclear.
My understanding was that first match terminates the search,
actually, so your example wouldn't work :S
My understanding is that in most ntuple implementations more-
specific filters override less-specific ones, in which case
Gal's setup would work.
On other implementations which use the rule number as a
position (like the API/naming implies) you could insert the
5-tuple rule first and that would work too.
Oh, I think Ed may tell us that using context 0 + queue offset is legit.
I hadn't actually thought of that, but yes that's true too.
Anyway, 'mechanism, not policy' says we should allow ctx 0
unless there's some mechanism reason why it can't be
supported, and I don't see one.