On Thu, 2019-08-01 at 16:40 +0800, xiangxia.m....@gmail.com wrote: > From: Tonghao Zhang <xiangxia.m....@gmail.com> > > In some case, we don't want to allow specific tunnel packets > to host that can avoid to take up high CPU (e.g network attacks). > But other tunnel packets which not matched in hardware will be > sent to host too. > > $ tc filter add dev vxlan_sys_4789 \ > protocol ip chain 0 parent ffff: prio 1 handle 1 \ > flower dst_ip 1.1.1.100 ip_proto tcp dst_port 80 \ > enc_dst_ip 2.2.2.100 enc_key_id 100 enc_dst_port 4789 \ > action tunnel_key unset pipe action drop > > Signed-off-by: Tonghao Zhang <xiangxia.m....@gmail.com>
Applied to net-next-mlx5. Thanks!
