Introduce bpf_xdp_flow_lookup kfunc in order to perform the lookup of
a given flowtable entry based on the fib tuple of incoming traffic.
bpf_xdp_flow_lookup can be used as building block to offload in XDP
the sw flowtable processing when the hw support is not available.
This series has been tested running the xdp_flowtable_offload eBPF program
on an ixgbe 10Gbps NIC (eno2) in order to XDP_REDIRECT the TCP traffic to
a veth pair (veth0-veth1) based on the content of the nf_flowtable as soon
as the TCP connection is in the established state:
[tcp client] (eno1) == LAN == (eno2) xdp_flowtable_offload [XDP_REDIRECT] --> veth0 == veth1 [tcp server]
table inet filter {
flowtable ft {
hook ingress priority filter
devices = { eno2, veth0 }
}
chain forward {
type filter hook forward priority filter
meta l4proto { tcp, udp } flow add @ft
}
}
- sw flowtable [1 TCP stream, T = 300s]: ~ 6.2 Gbps
- xdp flowtable [1 TCP stream, T = 300s]: ~ 7.6 Gbps
- sw flowtable [3 TCP stream, T = 300s]: ~ 7.7 Gbps
- xdp flowtable [3 TCP stream, T = 300s]: ~ 8.8 Gbps
Changes since v5:
- remove unused nf_flow_offload_xdp_cancel routine
- add missing __bpf_kfunc_start_defs()/__bpf_kfunc_end_defs()
- remove unused definition
Changes since v4:
- add missing BPF_NO_KFUNC_PROTOTYPES macro to selftest
Changes since v3:
- move flowtable map utilities in nf_flow_table_xdp.c
Changes since v2:
- introduce bpf_flowtable_opts struct in bpf_xdp_flow_lookup signature
- get rid of xdp_flowtable_offload bpf sample
- get rid of test_xdp_flowtable.sh for selftest and rely on prog_tests instead
- rename bpf_xdp_flow_offload_lookup in bpf_xdp_flow_lookup
Changes since v1:
- return NULL in bpf_xdp_flow_offload_lookup kfunc in case of error
- take into account kfunc registration possible failures
Changes since RFC:
- fix compilation error if BTF is not enabled
Florian Westphal (1):
netfilter: nf_tables: add flowtable map for xdp offload
Lorenzo Bianconi (2):
netfilter: add bpf_xdp_flow_lookup kfunc
selftests/bpf: Add selftest for bpf_xdp_flow_lookup kfunc
include/net/netfilter/nf_flow_table.h | 15 ++
net/netfilter/Makefile | 7 +-
net/netfilter/nf_flow_table_bpf.c | 121 +++++++++++++
net/netfilter/nf_flow_table_inet.c | 2 +-
net/netfilter/nf_flow_table_offload.c | 2 +-
net/netfilter/nf_flow_table_xdp.c | 147 +++++++++++++++
tools/testing/selftests/bpf/config | 13 ++
.../selftests/bpf/prog_tests/xdp_flowtable.c | 168 ++++++++++++++++++
.../selftests/bpf/progs/xdp_flowtable.c | 144 +++++++++++++++
9 files changed, 616 insertions(+), 3 deletions(-)
create mode 100644 net/netfilter/nf_flow_table_bpf.c
create mode 100644 net/netfilter/nf_flow_table_xdp.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/xdp_flowtable.c
create mode 100644 tools/testing/selftests/bpf/progs/xdp_flowtable.c
--
2.45.2
