On 10/22/2019 11:47 PM, Pablo Neira Ayuso wrote: > Hi, > > This is a RFC patchset, untested, to introduce new infrastructure to > specify protocol decapsulation and encapsulation actions. This patchset > comes with initial support for VLAN, eg. > > 1) VLAN decapsulation: > > ... meta iif . vlan id { eth0 . 10, eth1 . 11} decap vlan > > The decapsulation is a single statement with no extra options. Currently there is no vlan meta match expr. So it is better to extend the meta expr or add new ntf_vlan_get_expr? > > 2) VLAN encapsulation: > > add vlan "network0" { type push; id 100; proto 0x8100; } > add vlan "network1" { type update; id 101; } > ... encap vlan set ip daddr map { 192.168.0.0/24 : "network0", > 192.168.1.0/24 : "network1" } > > The idea is that the user specifies the vlan policy through object > definition, eg. "network0" and "network1", then it applies this policy > via the "encap vlan set" statement. > > This infrastructure should allow for more encapsulation protocols > with little work, eg. MPLS. So the tunnel already exist in nft_tunnel also can add in this encapsulation protocols as ip. like ip-route encap ip id 100 dst 10.0.0.1? > > I have places the encap object and the decap expression in the same > nft_encap module. > > I'm still considering to extend the object infrastructure to specify > the operation type through the rule, ie. > > add vlan "network0" { id 100; proto 0x8100; } > add vlan "network1" { id 101; } > ... encap vlan push ip daddr map { 192.168.0.0/24 : "network0", > 192.168.1.0/24 : "network1" } > > So the VLAN object does not come with the operation type, instead this > is specified through the encap statement, that would require a bit more > work on the object infrastructure which is probably a good idea. > > This is work-in-progress, syntax is tentative, comments welcome. > > Thanks. > > Pablo Neira Ayuso (2): > netfilter: nf_tables: add decapsulation support > netfilter: nf_tables: add encapsulation support > > include/uapi/linux/netfilter/nf_tables.h | 56 ++++- > net/netfilter/Kconfig | 6 + > net/netfilter/Makefile | 1 + > net/netfilter/nft_encap.c | 341 +++++++++++++++++++++++++++++++ > 4 files changed, 403 insertions(+), 1 deletion(-) > create mode 100644 net/netfilter/nft_encap.c > > -- > 2.11.0 > >