[PATCH nf-next v2 1/6] net: netfilter: nf_flow_table: recognize IPv4/IPv6 in tunnel proto matching
flat view
COLD27d
SUPERSEDED
From: Lorenzo Bianconi <hidden>
Date: 2026-09-07 07:34:09
Also in:
netfilter-devel
Subsystem:
netfilter, networking [general], the rest · Maintainers:
Pablo Neira Ayuso, Florian Westphal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
Revision v2 of 3 in this series.
Revisions (3)
- v1 [diff vs current]
- v2 current
- v3 [diff vs current]
Allow the flowtable to parse IPv4-in-IPv6 and IPv6-in-IPv4 tunnels by accepting both IPPROTO_IPIP and IPPROTO_IPV6 as the inner protocol when walking the outer header in nf_flow_ip4_tunnel_proto() and nf_flow_ip6_tunnel_proto(). This is a preliminary patch to support IPv4 over IPv6 and SIT tunnel flowtable offload. Please note IPv4 over IPv6 and SIT tunnel flowtable offloading is not enabled yet. Signed-off-by: Lorenzo Bianconi <redacted> --- net/netfilter/nf_flow_table_ip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index c8c29a9a1684..42e8de696474 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c@@ -326,7 +326,7 @@ static bool nf_flow_ip4_tunnel_proto(struct nf_flowtable_ctx *ctx, if (iph->ttl <= 1) return false; - if (iph->protocol == IPPROTO_IPIP) { + if (iph->protocol == IPPROTO_IPIP || iph->protocol == IPPROTO_IPV6) { ctx->tun.inner_proto = iph->protocol; ctx->tun.hdr_size = size; ctx->offset += ctx->tun.hdr_size;
@@ -351,7 +351,7 @@ static bool nf_flow_ip6_tunnel_proto(struct nf_flowtable_ctx *ctx, if (ipv6_ext_hdr(ip6h->nexthdr)) return false; - if (ip6h->nexthdr == IPPROTO_IPV6) { + if (ip6h->nexthdr == IPPROTO_IPIP || ip6h->nexthdr == IPPROTO_IPV6) { ctx->tun.inner_proto = ip6h->nexthdr; ctx->tun.hdr_size = sizeof(*ip6h); ctx->offset += ctx->tun.hdr_size;
--
2.55.0