From: xiangxia.m....@gmail.com Date: Thu, 1 Aug 2019 16:40:59 +0800 > From: Tonghao Zhang <xiangxia.m....@gmail.com> > > In some case, we don't want to allow specific tunnel packets > to host that can avoid to take up high CPU (e.g network attacks). > But other tunnel packets which not matched in hardware will be > sent to host too. > > $ tc filter add dev vxlan_sys_4789 \ > protocol ip chain 0 parent ffff: prio 1 handle 1 \ > flower dst_ip 1.1.1.100 ip_proto tcp dst_port 80 \ > enc_dst_ip 2.2.2.100 enc_key_id 100 enc_dst_port 4789 \ > action tunnel_key unset pipe action drop > > Signed-off-by: Tonghao Zhang <xiangxia.m....@gmail.com>
Saeed, please pick this up. Thank you.
