[PATCH net-next 04/15] netfilter: flowtable: populate tunnel tuple regardless of inner protocol
flat view
WARM3d
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: 2026-10-11 22:00:05
Also in:
netfilter-devel
Subsystem:
netfilter, networking [general], the rest · Maintainers:
Pablo Neira Ayuso, Florian Westphal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
Revision v1 of 52 in this series.
Revisions (52)
From: Lorenzo Bianconi <redacted> Store the outer tunnel addresses and inner protocol in the flow tuple unconditionally in nf_flow_tuple_encap(), instead of only when the tunnel is IP-in-IP or IPv6-in-IPv6. Bail out early when the inner protocol is neither IPPROTO_IPIP nor IPPROTO_IPV6. This makes the tuple usable for cross-family tunnels such as IPv4-over-IPv6 and SIT, where the inner protocol differs from the outer address family. This is a preliminary patch to support IPv4 over IPv6 and SIT tunnel flowtable offload. Please note IPv4 over IPv6 and SIT tunnel flowtable offloading is not enabled yet. Signed-off-by: Lorenzo Bianconi <redacted> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nf_flow_table_ip.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index cd636b4cf74b..a53393f8eda0 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c@@ -189,22 +189,22 @@ static void nf_flow_tuple_encap(struct nf_flowtable_ctx *ctx, break; } + if (ctx->tun.inner_proto != IPPROTO_IPIP && + ctx->tun.inner_proto != IPPROTO_IPV6) + return; + switch (ctx->ether_type) { case htons(ETH_P_IP): iph = (struct iphdr *)(skb_network_header(skb) + offset); - if (ctx->tun.inner_proto == IPPROTO_IPIP) { - tuple->tun.dst_v4.s_addr = iph->daddr; - tuple->tun.src_v4.s_addr = iph->saddr; - tuple->tun.inner_proto = IPPROTO_IPIP; - } + tuple->tun.dst_v4.s_addr = iph->daddr; + tuple->tun.src_v4.s_addr = iph->saddr; + tuple->tun.inner_proto = ctx->tun.inner_proto; break; case htons(ETH_P_IPV6): ip6h = (struct ipv6hdr *)(skb_network_header(skb) + offset); - if (ctx->tun.inner_proto == IPPROTO_IPV6) { - tuple->tun.dst_v6 = ip6h->daddr; - tuple->tun.src_v6 = ip6h->saddr; - tuple->tun.inner_proto = IPPROTO_IPV6; - } + tuple->tun.dst_v6 = ip6h->daddr; + tuple->tun.src_v6 = ip6h->saddr; + tuple->tun.inner_proto = ctx->tun.inner_proto; break; default: break;
--
2.47.3