Add new instruction for the nf_tables VM that allows us to specify what flows are offloaded into a given flow table via name. This new instruction creates the flow entry and adds it to the flow table. Only established flows, ie. we have seen traffic in both directions, are added to the flow table. You can still decide to offload entries at a later stage via packet counting or checking the ct status in case you want to offload assured conntracks. This new extension depends on the conntrack subsystem.
Showing the changes to include/uapi/linux (1 of 4 files). Show all
Unified · Split
| @@ -957,6 +957,17 @@ enum nft_ct_attributes { · 956 unmodified lines | ||
| 957 | 957 | }; |
| 958 | 958 | #define NFTA_CT_MAX (__NFTA_CT_MAX - 1) |
| 959 | 959 | |
| 960 | +/** | |
| 961 | + * enum nft_flow_attributes - ct offload expression attributes | |
| 962 | + * @NFTA_FLOW_TABLE_NAME: flow table name (NLA_STRING) | |
| 963 | + */ | |
| 964 | +enum nft_offload_attributes { | |
| 965 | + NFTA_FLOW_UNSPEC, | |
| 966 | + NFTA_FLOW_TABLE_NAME, | |
| 967 | + __NFTA_FLOW_MAX, | |
| 968 | +}; | |
| 969 | +#define NFTA_FLOW_MAX (__NFTA_FLOW_MAX - 1) | |
| 970 | + | |
| 960 | 971 | enum nft_limit_type { |
| 961 | 972 | NFT_LIMIT_PKTS, |
| 962 | 973 | NFT_LIMIT_PKT_BYTES |