From patchwork Tue Sep 1 16:32:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lorenzo Bianconi X-Patchwork-Id: 2296127 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=qualcomm.com header.i=@qualcomm.com header.a=rsa-sha256 header.s=qcppdkim1 header.b=LCsURK0T; dkim=pass (2048-bit key; unprotected) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.a=rsa-sha256 header.s=google header.b=UcCIEEfy; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2600:3c04:e001:36c::12fc:5321; helo=tor.lore.kernel.org; envelope-from=netfilter-devel+bounces-14898-incoming=patchwork.ozlabs.org@vger.kernel.org; receiver=patchwork.ozlabs.org) Received: from tor.lore.kernel.org (tor.lore.kernel.org [IPv6:2600:3c04:e001:36c::12fc:5321]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZBWY2p6mz1xvS for ; Wed, 02 Sep 2026 02:43:37 +1000 (AEST) Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by tor.lore.kernel.org (Postfix) with ESMTP id 76684473B9 for ; Tue, 1 Sep 2026 16:32:49 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 8D597480DCD; Tue, 1 Sep 2026 16:32:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="LCsURK0T"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="UcCIEEfy" X-Original-To: netfilter-devel@vger.kernel.org Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C45E4480DD4 for ; Tue, 1 Sep 2026 16:32:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280363; cv=none; b=kcBa73Nd0QQ3N/yxBjY0pXJT5/Azo5l9LrV8qMNqaoOv8tuYxync3ATT6wWkUeqcrcKIf8wW+/FMXeJHm5THiEFn5FAayf04w8BZ2Lb/vHinEpXYpgInGNjVddNsfLiJSeKhlJB1etThWwxgUMpXYPnChzC0q3DwSscLB9n3N7c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280363; c=relaxed/simple; bh=LCzTV3Oa4mwsANRey5FLed9yYrH47qFSuDRHn6terT8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=drR8v1HPkYapARzw+PviVhFbrKG7+pahh0C9GZO6CEYY/tuwAFiDOvhlRKkgN7yRp0WhMr5sfSgGuOpzsUu4/iYcTqyYHFQMFL28CZsBHFDu8N/x+PuPdTtVU2TbzYTKT+DNbVTqBN9KczCn/8ESL4HtvtEzf5ZALw5ehTl0h1Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=LCsURK0T; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=UcCIEEfy; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 681E98pq3257802 for ; Tue, 1 Sep 2026 16:32:40 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= eoTJQI9JSbpKnALhVsO18yqtXzVjccIDUrsWHYzhvrw=; b=LCsURK0TE97ja1O8 IHkyue9slztsvAhef06LDHbgpyyWpHD/3z+pY4kkzJuk4pfeqYBfxf4JADaek7dc jpSanKFgaK6R0BTqjThfa8c5LvfiY4wPO/9W1pV8wxDL5/qaOaiZ/kpCYJgwKRUx ALgvFbESV9aJWErTwytM/SS+0WKS+zZlHuoPTuHzTH93z+/yVbAsxJ4XfEtVb2NV sb3FnypbPgUHpX3LuPMvfByZJpM6/fWLtQeW/CyoSxNf15I/zd4Qpz6GQmpseUk4 yX5wEJoUnyreCbXS4rYcfLG32BiZdKBYBlBWd8aBG6UfJlJQepBY5ChjtWIWWCJd 8XCujw== Received: from mail-qk1-f197.google.com (mail-qk1-f197.google.com [209.85.222.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4gdynt0y82-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 01 Sep 2026 16:32:40 +0000 (GMT) Received: by mail-qk1-f197.google.com with SMTP id af79cd13be357-930b571432fso5145685a.0 for ; Tue, 01 Sep 2026 09:32:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1788280360; x=1788885160; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=eoTJQI9JSbpKnALhVsO18yqtXzVjccIDUrsWHYzhvrw=; b=UcCIEEfykpb5aYf+Ah7Wxjl1OExBgwQLEv0B7utmg3Ipxy5buXC4ssdCPAKDaFPnpy rRPABd73bVM2B4kQrk7gVBbXm9/ObRpAYodgnDnwFpCZ9P13y4b36f+rkb5qdjbyMjFe hlWq8410g8MFcueLWMWVspUz7Cm4Xv8o/gz6c6JMOM5svj1ZAB5MVJYsAGiXqKQ1oRQS z9yKPdqwxOfInpfThZuPZAK6fCvPYyQI4pIW389kupo1avSV2xdhW0rcx2Jcao7FreY+ wZh8M1cLgRakVW3O67aE5aGIMlH+e5RIY2cSvGFypgECepeCqhf8eU84nCj/VbzUkk7b JG/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788280360; x=1788885160; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=eoTJQI9JSbpKnALhVsO18yqtXzVjccIDUrsWHYzhvrw=; b=nAV6LlvjxMOO07V80VO6uIP3ApRuo+oJhWNkqKQo7L2Ve/hnXQa2kSX54rKthivfhV fN3YWIxCWUvJ0gDRyinmWF236jImkFPZwfzJ3PJfaFprkFj2VycIRlENi0Z6xL4Kvi14 q+JrmNLnb6c4bqIpprougDX8XrjCk29umszb1RoF0dAf1PA9G0vzEGy6ZZ05+ha35lBa hhrtJY03nysF6jh5W98ocss452nku1N+ygbp0QbYubGKqdfBFAPkls3/JFf+SvUiopqZ 61Zu9+w9ETyAT9/88hO/rAg4mszXroOu2auPRUkEp6M2MC8EZ8DTiASP0B+buwziQkEe 4NoQ== X-Gm-Message-State: AFuF++mxGZrqhy+BFL7+rb9UDDUs5AiRmuetSVXoPX0B5FRuE1ascXOs ZRgbWwWMul1zTS93O0m5p6VLY+GHoC5vlSpe7WElmMP9MCqcMlwiTgGTaUtCRstLXNw+MApf0Z2 2Afo+fHR7DT3ZaRmJX5GEc1v6oG9EGOB4EFekYhF0ld8kdQX1k6epiGduSCUH4Zy8L+QR54E= X-Gm-Gg: AR+sD10i1ErLL89vD/AEnTHi0bq4+KgJTyA+Lrq1yzu4kBeM8JNN0+PQk4flW7v8VYK ki2389/HPzjQ1BrD1Hg3RPPSACNNYd7+9nzhbE3SyR0TgL6od4rYC7at5sR6tqA+WYB4+nMibu+ PqtEkvjh/oVMVPIylAnLcxWsT8OovhgBbUi0g5Nj8tNQRFYn0Hee2V3eslpxnoLOXSiGYeKTK3X PxoIrG2ALq8lgvHJqV50Hge56WSmO5UyvWo6VQCp1DiLAGlspZbeecnpbHpMAY+xcfuwVFBOAZs mLjZF6hQUlNyICHLw4Pim87pjNWyifSdV6gdoXt7R7uBOdR+GcKNezWZkZcFCszJBXf9sraJC7j +WZpsgXvV0EULGg== X-Received: by 2002:a05:620a:28c8:b0:930:9cbc:7121 with SMTP id af79cd13be357-9394bbd27dbmr828066285a.3.1788280359998; Tue, 01 Sep 2026 09:32:39 -0700 (PDT) X-Received: by 2002:a05:620a:28c8:b0:930:9cbc:7121 with SMTP id af79cd13be357-9394bbd27dbmr828051385a.3.1788280359177; Tue, 01 Sep 2026 09:32:39 -0700 (PDT) Received: from localhost ([188.216.77.92]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48448eeae34sm117397f8f.32.2026.09.01.09.32.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 01 Sep 2026 09:32:38 -0700 (PDT) From: Lorenzo Bianconi Date: Tue, 01 Sep 2026 18:32:16 +0200 Subject: [PATCH nf-next 1/6] net: netfilter: nf_flow_table: recognize IPv4/IPv6 in tunnel proto matching Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-1-72e49be8c31f@oss.qualcomm.com> References: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-0-72e49be8c31f@oss.qualcomm.com> In-Reply-To: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-0-72e49be8c31f@oss.qualcomm.com> To: Pablo Neira Ayuso , Florian Westphal , Phil Sutter , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn , David Ahern , Ido Schimmel Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, Lorenzo Bianconi X-Mailer: b4 0.14.3 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTAxMDE0NiBTYWx0ZWRfX9/hwVHdWU8uU m91XPk/iehF3xtzcf0lBFdv+5rUeMqnrvvZ4BUtUCltbUscgR83mOXYjoYjTIgsyfhck9KJPOjd 08i53V0nkcOwnC009FbQgTlzXK2Af30hBFX0SumWSIzJbPt7Hvs1NGUfk8soZSI6XyQ/oGVEMUO C2hANL1Yh4qA8dadrqWIbCKmA/6dsmkVBjfyEy1T2BwMcGlWNNxp+ii1l3ROLlSVmjjiTwfCPdp UBSVClXrOulUGANMyfsi9529Di8ost0rRHJRTvo/S32EbhUfiiOIRbWkmrnTdmgBFtz9Hx9Usbq Zckqf94mp6C3+e6JGABzJ9QoKxVDBbVWkxRuPee1GoCgVOOxjbyA6+il6ZmAinVVwTWsBWlkE2X L/Iqxn0VfmklRjsyVkq2sStMq3G0XHX0eje89YHXZWnhWqdcRKjb2TYtXElnAwTwUArq+BQxqBm SKrM0UOX49oFOKVeZOQ== X-Proofpoint-ORIG-GUID: Hg0MIHaDk4AFjrM571MolpPXkjP689GD X-Proofpoint-Spam-Info: AW1haW4tMjYwOTAxMDE0NiBTYWx0ZWRfXyCtnqgKJ5tSO b2HQloTbBiMhjV14SFpnGDST+ISy4QFaoe3B68xozaJT0R1SrpLbQIL1QW50fd8TaHtAiSqSje5 E7jQC49zpOqOvCLALNUqltPcZcDbsEw= X-Authority-Analysis: v=2.4 cv=LfkMLDfi c=1 sm=1 tr=0 ts=6a96fe28 cx=c_pps a=50t2pK5VMbmlHzFWWp8p/g==:117 a=WpTaRW6qxYHRGzLzQsVYzg==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=3WHJM1ZQz_JShphwDgj5:22 a=EUspDBNiAAAA:8 a=-vexEuCU66S_koW1hhoA:9 a=QEXdDO2ut3YA:10 a=IoWCM6iH3mJn3m4BftBB:22 X-Proofpoint-GUID: Hg0MIHaDk4AFjrM571MolpPXkjP689GD X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-01_04,2026-09-01_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 bulkscore=0 clxscore=1015 impostorscore=0 malwarescore=0 phishscore=0 lowpriorityscore=0 spamscore=0 priorityscore=1501 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2609010146 Allow the flowtable to parse IPv4-in-IPv6 and IPv6-in-IPv4 tunnels by accepting both IPPROTO_IPIP and IPPROTO_IPV6 as the inner protocol when walking the outer header in nf_flow_ip4_tunnel_proto() and nf_flow_ip6_tunnel_proto(). This is a preliminary patch to support IPv4 over IPv6 and SIT tunnel flowtable offload. Signed-off-by: Lorenzo Bianconi --- net/netfilter/nf_flow_table_ip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index c8c29a9a1684..42e8de696474 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -326,7 +326,7 @@ static bool nf_flow_ip4_tunnel_proto(struct nf_flowtable_ctx *ctx, if (iph->ttl <= 1) return false; - if (iph->protocol == IPPROTO_IPIP) { + if (iph->protocol == IPPROTO_IPIP || iph->protocol == IPPROTO_IPV6) { ctx->tun.inner_proto = iph->protocol; ctx->tun.hdr_size = size; ctx->offset += ctx->tun.hdr_size; @@ -351,7 +351,7 @@ static bool nf_flow_ip6_tunnel_proto(struct nf_flowtable_ctx *ctx, if (ipv6_ext_hdr(ip6h->nexthdr)) return false; - if (ip6h->nexthdr == IPPROTO_IPV6) { + if (ip6h->nexthdr == IPPROTO_IPIP || ip6h->nexthdr == IPPROTO_IPV6) { ctx->tun.inner_proto = ip6h->nexthdr; ctx->tun.hdr_size = sizeof(*ip6h); ctx->offset += ctx->tun.hdr_size; From patchwork Tue Sep 1 16:32:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lorenzo Bianconi X-Patchwork-Id: 2296152 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=qualcomm.com header.i=@qualcomm.com header.a=rsa-sha256 header.s=qcppdkim1 header.b=ahdnaVHF; dkim=pass (2048-bit key; unprotected) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.a=rsa-sha256 header.s=google header.b=jB45CY0c; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=104.64.211.4; helo=sin.lore.kernel.org; envelope-from=netfilter-devel+bounces-14899-incoming=patchwork.ozlabs.org@vger.kernel.org; receiver=patchwork.ozlabs.org) Received: from sin.lore.kernel.org (sin.lore.kernel.org [104.64.211.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZC5r2LfDz1xys for ; Wed, 02 Sep 2026 03:09:52 +1000 (AEST) Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sin.lore.kernel.org (Postfix) with ESMTP id 10CDE3AC52 for ; Tue, 1 Sep 2026 16:32:56 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id ED75C48125B; Tue, 1 Sep 2026 16:32:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="ahdnaVHF"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="jB45CY0c" X-Original-To: netfilter-devel@vger.kernel.org Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1CE03481241 for ; Tue, 1 Sep 2026 16:32:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280365; cv=none; b=aO24H5RrLVRijPi/Um1s/8cb3m3ZdipmTabw92XlLwJPM3tzCzJeYKcDNAviZsjKCds0/RB96PXyxUoa9pw4ADAOuG/oOcpgyDCgTfgjZpIt5+7mOhrFbOAo10rGx+vdgSa8eI5cREyaynY2ZXxiuFRBp0FwwF3btxbyoN6VBvU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280365; c=relaxed/simple; bh=g+TFW9abJUhRiMUcK8eCZhKAHBcCLM5cj4RR4Q8Owuw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=JWYBIo8CC130UtEDckNHFgnkutUyCX6VdE1uqYhgZmur3z2GEKUcl5r+GdFgZyQII9n59/nI/Moy+Q5sBU23pJpxVKb2+k9vANODvP/7qbTaqpw/Kd9b3KXnFUKEwKhRCXIzQKA2Zv1dLpjszDliz1ypnrJrxMC4fIZCJsWXLbc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=ahdnaVHF; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=jB45CY0c; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Received: from pps.filterd (m0279870.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 681E8gqg2910588 for ; Tue, 1 Sep 2026 16:32:43 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= 5uxRZ2UTtZbGWvdtadjbSiVLyF+IRytM/4hZqHjVbZI=; b=ahdnaVHFewTz9Y6w FlKFVr2fBuVp6aamKgiasbGciP3Tw8tRubtb+nZeg8JFKstVCRalgfDnXbOHW87R iTBvgtBSJKq/cMKY4GD7PCaqQ6H9oJObfK19qYDFkff4fXf/Lj1VElZsWrFApNG+ GWwbQkuqV3EeHs9NTRa3m9vBXGJH0KlN1FpE2BG5o/wmAzDBDTbXVZnT/Wh/uPXv 05TEKvkBzsnqllGXR6KFh4Td7HGERygdPuO6fq9WzSXZLhOntYU7AZ1+wYgK9FZJ uu/in6Xgj+OdWb9mvKQwWbKQsVbuA0nGSIM0BToNZ6Oopz7k0INnsiTncVFHWJ3Z 4Fvknw== Received: from mail-vs1-f70.google.com (mail-vs1-f70.google.com [209.85.217.70]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4gdp7r3g6r-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 01 Sep 2026 16:32:42 +0000 (GMT) Received: by mail-vs1-f70.google.com with SMTP id ada2fe7eead31-73760a7cd83so70677137.1 for ; Tue, 01 Sep 2026 09:32:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1788280362; x=1788885162; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=5uxRZ2UTtZbGWvdtadjbSiVLyF+IRytM/4hZqHjVbZI=; b=jB45CY0cGtKZjSyKGCemgfDkkTDlBS22CjxSeOKoF+A2QNU1IPorANoe9CGIqoQZ0j a1ZEvfnARd6Wl2ie7ZOOgx6AXqcGDQ0LcGOHJSJHIAJ6eLSDP08dOmujcwU6AJCb1mGq bdstTaA3PnV0MQ4roEZkx+BUR5BHEpEqUo+vd6BpLU2IGHuEsYF9Pao1AZw8cZHH8MYa 9jZQI3S4QH7KJPvoayuJVd4Pwxovbdf66auvtcGsYIBAOP1yJGifimkc0u6Qq+gre00L pINvPShTWbxTObIwmglr3YT6nRzPep3HKBh0ZNmaAsg/Ajf/pwoa+ygaZHgQsfAfq9pq JkKQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788280362; x=1788885162; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=5uxRZ2UTtZbGWvdtadjbSiVLyF+IRytM/4hZqHjVbZI=; b=DkCY1VmxBvyLovrpwgnO2tu40qcosM70NAitPjLIWC5lkj5spEvO8xVTxUOXun8QzS BQEsguXZyljZLSmJWWNvISmS5y9x3beKb81lujHSiLwcpcRa+DdjwHwFiVJI0pQdTmfT Pppbqok1c6ET6zECwQF6VKxLMvqSBtiB2C/RgM77UatOIkJ5B6hZTG0egwZ5hUGNJ7es RZNP3T9kp8Z50sNLH4CWslCyIOrbPKBClfCgnpPVQbhqMy4A0xshhWs6+hH2SMo6Sg4R jjEC1CUsQCwHfTT7MObBoJvLBKHL5N+6MAeXSYy0bCy2AdIagDMhRt1AZONL1lDNtJcw Hdsg== X-Gm-Message-State: AFuF++nB+XDPILDqrxZ6TC2Da1GA+/ZdkIVvsLc+SYBtgfICDB5rqOLQ ypJalQpSfLLNnyTpZVutxifCNeoHgssUVFXn9BIH0MPYd250YtWSQeCdo/3Gc17OnQPIdsoJgW3 hqklGNze9a+BrutnaoCkJpVfw6QUT5UDQOqfJh2iS4mHz2sxPOk3leZ+ZFxbtv3CLEG41bZ8= X-Gm-Gg: AR+sD13D1CdqAvUYVWAZhMB4dthTey/nodkfdTmeg79/0faNKiEv/BOF0ENU8ubKcoB sUelFXyeBPX7Itdll/5WftKUUx8mnBf1FNCJscVaTBZOfXFmEyJjvTOYvQ6iQtq2F30TSx96U2g +Vnv0s+oCiosczoxSqYVaeoMhYaWNPO7+ngYOAebI8isgJ+4Lfmsh/f1vvSsPsTpbRtyl0UL/pu txQ9aUt0935aWODBq7Nam5xg1bSM8ujvKsD1RDgs78RGOvzpNS/kyfvs9CsUBuLrYL768Fb7fQu fs73Pc0lFVfkuLn9Vh00NA+K9A+xQBD677ioBYA51mzApMmHcmnCEHEvnWLyD1CqENv3fulkNsH Tke2JxImmaIu4pw== X-Received: by 2002:a05:6102:4412:b0:785:a48a:e3b9 with SMTP id ada2fe7eead31-789fc1a33b9mr4214878137.4.1788280362089; Tue, 01 Sep 2026 09:32:42 -0700 (PDT) X-Received: by 2002:a05:6102:4412:b0:785:a48a:e3b9 with SMTP id ada2fe7eead31-789fc1a33b9mr4214841137.4.1788280361600; Tue, 01 Sep 2026 09:32:41 -0700 (PDT) Received: from localhost ([188.216.77.92]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49b91c510c9sm237352415e9.0.2026.09.01.09.32.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 01 Sep 2026 09:32:40 -0700 (PDT) From: Lorenzo Bianconi Date: Tue, 01 Sep 2026 18:32:17 +0200 Subject: [PATCH nf-next 2/6] net: netfilter: nf_flow_table: set inner protocol when popping tunnel header Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-2-72e49be8c31f@oss.qualcomm.com> References: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-0-72e49be8c31f@oss.qualcomm.com> In-Reply-To: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-0-72e49be8c31f@oss.qualcomm.com> To: Pablo Neira Ayuso , Florian Westphal , Phil Sutter , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn , David Ahern , Ido Schimmel Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, Lorenzo Bianconi X-Mailer: b4 0.14.3 X-Authority-Analysis: v=2.4 cv=beZbluPB c=1 sm=1 tr=0 ts=6a96fe2a cx=c_pps a=N1BjEkVkxJi3uNfLdpvX3g==:117 a=WpTaRW6qxYHRGzLzQsVYzg==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=gowsoOTTUOVcmtlkKump:22 a=EUspDBNiAAAA:8 a=efGzO-dN_8w9Us9pE3AA:9 a=QEXdDO2ut3YA:10 a=crWF4MFLhNY0qMRaF8an:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTAxMDE0NiBTYWx0ZWRfX44Ps0x/BP9Kt PalxA3LjcyJpuo+aE4hlouf05MSIG65PPKHIJaMod4eohV98WDdwI/h3yPAU3uP9cTQW/dml9SQ WtIQn4ij1gBR3+N7RYiNT1p1UT4QMM0Edv1YOjnE+mg8qHZ9wSSaCeKQflxkmZ0H9dDucyI+waf z/zAvk2foA9OZzpYk4aMHGYbNn/+DYllhgCaz6rrAeIV2Jr470gDJthDPacqkOqYNTVfg7i74JU bsK9M5PFf/huEg4LAqBSAiiGNZvfHMmzbdikqz7jETuOW/nTZODkCQoboVIWQHJnyzY8IAgXmqG 86askCp6OukZ+O9j0TSYYOeUXKYov2USv5ivC+3uhN/m4N5TxLC06/v+PFe+nuTqpsDWCc58NS2 /LS8pzTTyoGJR6zS9H9Bw3xGelptS+Ti3q6mTKf9yA42DpX13mEHmluhGg8ZE4tH0JlSg09Y8fr EYLq8PBxijyKEA3DjPQ== X-Proofpoint-GUID: f2-0Ps2WCh44e-8j8QCap0XAuR2wqQ8X X-Proofpoint-ORIG-GUID: f2-0Ps2WCh44e-8j8QCap0XAuR2wqQ8X X-Proofpoint-Spam-Info: AW1haW4tMjYwOTAxMDE0NiBTYWx0ZWRfXxVMlIC9qGXJB 9wuB0jmPmc250fKjM1c2Z18jO4YydNWURT0pX3F6nPpE8KW1YaVKojGhr+3pEwYXTVX9ML1Zlvk ZUrUinmgXWJyMUNidOEmFfXZa/rXhfI= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-01_04,2026-09-01_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 lowpriorityscore=0 bulkscore=0 clxscore=1015 impostorscore=0 priorityscore=1501 malwarescore=0 spamscore=0 adultscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2609010146 Pop the outer tunnel header and set skb->protocol to the inner protocol derived from ctx->tun.inner_proto in nf_flow_ip_tunnel_pop(), instead of bailing out unless the tunnel carries IP-in-IP or IPv6-in-IPv6. While at it, key nf_flow_encap_pop() off ctx->tun.inner_proto rather than skb->protocol to decide whether the tunnel header needs to be popped, as the skb protocol may not be updated yet at that point. This is a preliminary patch to support IPv4 over IPv6 and SIT tunnel flowtable offload. Signed-off-by: Lorenzo Bianconi --- net/netfilter/nf_flow_table_ip.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 42e8de696474..8af3d98ef4b2 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -158,6 +158,12 @@ struct nf_flowtable_ctx { } tun; }; +static bool nf_flow_is_tunnel_ip(struct nf_flowtable_ctx *ctx) +{ + return ctx->tun.inner_proto == IPPROTO_IPIP || + ctx->tun.inner_proto == IPPROTO_IPV6; +} + static void nf_flow_tuple_encap(struct nf_flowtable_ctx *ctx, struct sk_buff *skb, struct flow_offload_tuple *tuple) @@ -366,12 +372,13 @@ static bool nf_flow_ip6_tunnel_proto(struct nf_flowtable_ctx *ctx, static void nf_flow_ip_tunnel_pop(struct nf_flowtable_ctx *ctx, struct sk_buff *skb) { - if (ctx->tun.inner_proto != IPPROTO_IPIP && - ctx->tun.inner_proto != IPPROTO_IPV6) - return; - skb_pull(skb, ctx->tun.hdr_size); skb_reset_network_header(skb); + + if (ctx->tun.inner_proto == IPPROTO_IPIP) + skb->protocol = htons(ETH_P_IP); + else + skb->protocol = htons(ETH_P_IPV6); } static bool nf_flow_skb_encap_protocol(struct nf_flowtable_ctx *ctx, @@ -448,8 +455,7 @@ static void nf_flow_encap_pop(struct nf_flowtable_ctx *ctx, } } - if (skb->protocol == htons(ETH_P_IP) || - skb->protocol == htons(ETH_P_IPV6)) + if (unlikely(nf_flow_is_tunnel_ip(ctx))) nf_flow_ip_tunnel_pop(ctx, skb); } From patchwork Tue Sep 1 16:32:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lorenzo Bianconi X-Patchwork-Id: 2296132 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=qualcomm.com header.i=@qualcomm.com header.a=rsa-sha256 header.s=qcppdkim1 header.b=AAXymLNV; dkim=pass (2048-bit key; unprotected) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.a=rsa-sha256 header.s=google header.b=XPOuYmDO; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org; envelope-from=netfilter-devel+bounces-14900-incoming=patchwork.ozlabs.org@vger.kernel.org; receiver=patchwork.ozlabs.org) Received: from sea.lore.kernel.org (sea.lore.kernel.org [IPv6:2600:3c0a:e001:db::12fc:5321]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZBkj62zcz1xwZ for ; Wed, 02 Sep 2026 02:53:17 +1000 (AEST) Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sea.lore.kernel.org (Postfix) with ESMTP id 14F19E62CF for ; Tue, 1 Sep 2026 16:33:01 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 230F848166B; Tue, 1 Sep 2026 16:32:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="AAXymLNV"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="XPOuYmDO" X-Original-To: netfilter-devel@vger.kernel.org Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 573F6480DDA for ; Tue, 1 Sep 2026 16:32:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280366; cv=none; b=I1/A8U7DZlyNFSY2yiydEsGUjBCrCt1vOBDWD75GbgAAXX1Hj2YNnoIEQzExD3lI+UhNmXM2Fv6F3hzwEtKmejDKE/2W5Wu17XhTMrf9prwrGwqWuyxEhWQngFT+YYFmqmdL38o4uNZlpt2mPZk6bkpIdEuwwcLGTe002IWM90Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280366; c=relaxed/simple; bh=KPh7/9dZhiB6+r8VfyrhZ4JufaVnx8E+2HlD6sGp4Ds=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=cZtBPRF3TkIOUZ/s3rbIINv+dANhdu0lvkk1s3Urnapw+H2j+3QMfWAqkuwMtK6JRKHPuAxDV7voTAovhgsUoR7Tzyqmv2n9LZ6Q2eSMA6ZtW9nkJaFi6GKrKF//klE9jP0l8A9ZUQBXBTt2Ogu6K4thOvX4HFW00cBtLvebl3Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=AAXymLNV; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=XPOuYmDO; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Received: from pps.filterd (m0279873.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 681E8WAc2746428 for ; Tue, 1 Sep 2026 16:32:44 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= QLVTYZelpaIzN9Flzm0138Gvf/MSuAjYcqAkmw6vr78=; b=AAXymLNV4ASJE6BW 9UYfPiaYVpNVRtpMSKtIa4hV49k82AmXPuzrMNcFFM5fNPLAtcE9ynF3uY6+UArQ Nf+chkRzfBaXDBUmLT8uU0xzeyxNVv3fDrOBokuOxn1+uUYjvhxj5+RV+ycscNOq VpFyXh7JqSH8jmE/q87ncfYhGvDA8063L46n5Hgy6IlKtuazWBYCq10W5AQvyFfA k/2Ko33oUW/DUUEe5/8Xlo2iSmbOxUvRFSrey/f6GfN2t8l49PkwyNJ69j4iVwaE sIUf5gGM2mNhK9vL22HFd6FpKoLaOh1927K1tzA1AGgT9uaa4fABbUpldan+fhma C9ZZUw== Received: from mail-qk1-f199.google.com (mail-qk1-f199.google.com [209.85.222.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4gdvmm1smn-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 01 Sep 2026 16:32:44 +0000 (GMT) Received: by mail-qk1-f199.google.com with SMTP id af79cd13be357-93903622880so237556385a.0 for ; Tue, 01 Sep 2026 09:32:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1788280364; x=1788885164; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=QLVTYZelpaIzN9Flzm0138Gvf/MSuAjYcqAkmw6vr78=; b=XPOuYmDOioD/6e8NJ5o3vU+B3l9q8QYy+PBfrCPcFFekoog7EDl8y6jrqkx7BvqiWN pUbSBAY1mLp0ilR05a3TiuNG11NUqYvs+qFhvdNeW+UXDSy9snTpwTiodwwaNdTRrIBG lGsV/GuNCjZgR4waI6++Z7kVsp16pXW4GQ25BBPy2mIw8tnnLmoSejeGQo4IK4vbSf6N 4qsdcLzGslokHsV0+DXG1yVCkjC62pnVqEGD4Or5Ih2DBsy6qI5E4G6a9BoGobJ9IS0+ W9TSMoGYLSHk7tlMFN7lSoHBXReEaeDdTTeeSd+K3MLWLgvYmlgyc+2U4+K6PwevEMeo ifJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788280364; x=1788885164; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=QLVTYZelpaIzN9Flzm0138Gvf/MSuAjYcqAkmw6vr78=; b=E9sFIuG+RjQBRkGZwxjnVy7JSYDDqcbbjKtwFPfr2/LH4FLkLTuhM0jIB5AmSaoD9i LRelzLgrGQ8xpmqG+IFa+RYdNKxYTisGGHf2wHRhbIkP4Uqm2h2yoZ9lbr1w7+TvqdAA buCzLZgmO15YiNe2KZlHnSTqyrj1cMKVk/X3YhtCvKOGg6o22SMQeRqHsKOEmH0G7mJL H9xqtGEtZnjWGXnbMngoo5Rswo2nxVlTBawO0B4pU3BBc5nty4hM+h+XWjvZrQkhZy95 suJEHUpPBHBw8t5+nDiQya3HjXuCluVS4Tq3YV8GT0BsU5UixlVVaST36ZKOFMRy0ExE TLNA== X-Gm-Message-State: AFuF++l6pg02s9T+nIeVH5LbCy5PdojFA4R19ornRy2hfRPJTfdX7N68 DmvzaVbEL8kXfzlCyHHVNKnvEsYHugNv1Vg39IkMUya0Cy0qE43WHnbt3QXUMfKMH3trsB68Fwz ipCJ6gPF2t8H4+YdXkEZVBvcQqDvFY/koZn6HdZheuIpIPxQcyKbWXG6jbYynIZdAmU/4z7g= X-Gm-Gg: AR+sD13m19KprJctYkuDLDseVdwCO2GhbPnmi7tSoww9C9g79E1RY27H2M/jB5ePDjH Y8e1r+CIApuDr4WF+bh7sZB7XqO2ALJRQS2eDuj1P/eH8xz726AUjR90AUr0x4jG8MQpuitJhri MQBsgds5yhZBPUQIPLFziiC1N+/pUdjKFEzAJA3s7Yj77wJ4I8ReZ4aVXUfe86UlBY7/YDKwtVL 1eAbMFiF5JGkU1QWkyq/Sa+DtpW3Ovn22fwiBAZ8fD5/cLmP9Lg34Vy2Q20cnmUp7Bo3EKA0aRF 0F8pxaqy/tXDqUuztR/3Csk0fAQmFrU9fYnYClL/Mi/cwGkwzON1qrIRuZqJB7pQwiWdNQaJK5G T+/r0welac0TFsA== X-Received: by 2002:a05:620a:240d:20b0:939:319f:d6e3 with SMTP id af79cd13be357-9394bbd2ab7mr718221585a.5.1788280363594; Tue, 01 Sep 2026 09:32:43 -0700 (PDT) X-Received: by 2002:a05:620a:240d:20b0:939:319f:d6e3 with SMTP id af79cd13be357-9394bbd2ab7mr718213785a.5.1788280363107; Tue, 01 Sep 2026 09:32:43 -0700 (PDT) Received: from localhost ([188.216.77.92]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48448ee9cf7sm108396f8f.25.2026.09.01.09.32.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 01 Sep 2026 09:32:42 -0700 (PDT) From: Lorenzo Bianconi Date: Tue, 01 Sep 2026 18:32:18 +0200 Subject: [PATCH nf-next 3/6] net: netfilter: nf_flow_table: populate tunnel tuple regardless of inner protocol Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-3-72e49be8c31f@oss.qualcomm.com> References: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-0-72e49be8c31f@oss.qualcomm.com> In-Reply-To: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-0-72e49be8c31f@oss.qualcomm.com> To: Pablo Neira Ayuso , Florian Westphal , Phil Sutter , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn , David Ahern , Ido Schimmel Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, Lorenzo Bianconi X-Mailer: b4 0.14.3 X-Proofpoint-ORIG-GUID: 5whGp-AOYZhBQSbGZfYhjZR_dog1MJ-G X-Proofpoint-Spam-Info: AW1haW4tMjYwOTAxMDE0NiBTYWx0ZWRfX+JA97Mo6Opuk OF5NDwVSYE1urPEsr0E1a57S9QAHXXIzdqGVlUgbXR2Hf4RvUw5HEdNP86ukp/eb/cjVy8PZfzR MHacsFJfQMm/c/EQG3WVAhyB1Rwac4U= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTAxMDE0NiBTYWx0ZWRfX2me9HPYVNaDO t95p3hwVMgquLHEMNHwmynFzYeLynWj3YZTwbmR7KuMAawP22nWzdMD2BJBwnEv7cQ1MCLwfcMp loWV+ugy4RKJlvnm6a9i5QeVaUgzsQZEo9PoZTBUrodQlq/ccD1NosDHo/86dROc2Q6bSrTk7qt LrTBibr/vsO6PEK2HR8/KTM7sGE5yz3TbwwHddGXa5IXhnARCzjgdPZhk+aRY5ZSx+g22njnGhH 70DHRC4aao2t/E2iCIlKv0jdNetNhSeborBCUxjUjx5vM7XkeX/ycXONyC9GC75RoTTV65spPBz eRJKdQVd6Li89A3MvIoFjHmvfbprP2yEfE+MF4Fxvsbv8zNH5pKyKxolhyN+XaG6sRCGKeuY/B9 OAqCdb67kAG0oLUCIBR10zo8pv62LT9yoDSPPiRFQvtMvDxqWVYlsqEs5fl5FdFgHNZEk4+RYGb awVS5HC4AqRfGng7RMw== X-Proofpoint-GUID: 5whGp-AOYZhBQSbGZfYhjZR_dog1MJ-G X-Authority-Analysis: v=2.4 cv=GfwnWwXL c=1 sm=1 tr=0 ts=6a96fe2c cx=c_pps a=HLyN3IcIa5EE8TELMZ618Q==:117 a=WpTaRW6qxYHRGzLzQsVYzg==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=rJkE3RaqiGZ5pbrm-msn:22 a=EUspDBNiAAAA:8 a=8uPksCqhpMYrSrxJYREA:9 a=QEXdDO2ut3YA:10 a=bTQJ7kPSJx9SKPbeHEYW:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-01_04,2026-09-01_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 spamscore=0 malwarescore=0 lowpriorityscore=0 adultscore=0 phishscore=0 suspectscore=0 bulkscore=0 priorityscore=1501 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2609010146 Store the outer tunnel addresses and inner protocol in the flow tuple unconditionally in nf_flow_tuple_encap(), instead of only when the tunnel is IP-in-IP or IPv6-in-IPv6. Bail out early when the inner protocol is neither IPPROTO_IPIP nor IPPROTO_IPV6. This makes the tuple usable for cross-family tunnels such as IPv4-over-IPv6 and SIT, where the inner protocol differs from the outer address family. This is a preliminary patch to support IPv4 over IPv6 and SIT tunnel flowtable offload. Signed-off-by: Lorenzo Bianconi --- net/netfilter/nf_flow_table_ip.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 8af3d98ef4b2..3ecc47b57854 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -195,22 +195,21 @@ static void nf_flow_tuple_encap(struct nf_flowtable_ctx *ctx, break; } + if (likely(!nf_flow_is_tunnel_ip(ctx))) + return; + switch (ctx->ether_type) { case htons(ETH_P_IP): iph = (struct iphdr *)(skb_network_header(skb) + offset); - if (ctx->tun.inner_proto == IPPROTO_IPIP) { - tuple->tun.dst_v4.s_addr = iph->daddr; - tuple->tun.src_v4.s_addr = iph->saddr; - tuple->tun.inner_proto = IPPROTO_IPIP; - } + tuple->tun.dst_v4.s_addr = iph->daddr; + tuple->tun.src_v4.s_addr = iph->saddr; + tuple->tun.inner_proto = ctx->tun.inner_proto; break; case htons(ETH_P_IPV6): ip6h = (struct ipv6hdr *)(skb_network_header(skb) + offset); - if (ctx->tun.inner_proto == IPPROTO_IPV6) { - tuple->tun.dst_v6 = ip6h->daddr; - tuple->tun.src_v6 = ip6h->saddr; - tuple->tun.inner_proto = IPPROTO_IPV6; - } + tuple->tun.dst_v6 = ip6h->daddr; + tuple->tun.src_v6 = ip6h->saddr; + tuple->tun.inner_proto = ctx->tun.inner_proto; break; default: break; From patchwork Tue Sep 1 16:32:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lorenzo Bianconi X-Patchwork-Id: 2296196 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=qualcomm.com header.i=@qualcomm.com header.a=rsa-sha256 header.s=qcppdkim1 header.b=iAKp+XfD; dkim=pass (2048-bit key; unprotected) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.a=rsa-sha256 header.s=google header.b=J2JA8nG7; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org; envelope-from=netfilter-devel+bounces-14901-incoming=patchwork.ozlabs.org@vger.kernel.org; receiver=patchwork.ozlabs.org) Received: from sea.lore.kernel.org (sea.lore.kernel.org [IPv6:2600:3c0a:e001:db::12fc:5321]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZD9r1TjQz1xwg for ; Wed, 02 Sep 2026 03:58:24 +1000 (AEST) Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sea.lore.kernel.org (Postfix) with ESMTP id 55DA6E7088 for ; Tue, 1 Sep 2026 16:33:07 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 3FA3B481AAC; Tue, 1 Sep 2026 16:32:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="iAKp+XfD"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="J2JA8nG7" X-Original-To: netfilter-devel@vger.kernel.org Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 68D2F48167C for ; Tue, 1 Sep 2026 16:32:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280368; cv=none; b=KlSF+ITttbGiF/lyrwlq0Uj6CgO9Ep3vfdUncRaX2lNFb0arkVQ8XRSlizL+AMc2GzMNUHAxPxW9UJaAyq3S8C/vZeNPj55D+83cCkm5+RwWimrWB+7XeuwOsbvJpfWUW7kPQKNmMnJmh4rg+G7An8EvYFlx8NFCvtYa3qhTDnw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280368; c=relaxed/simple; bh=BZgGViVjbPQGYXtFEDayGxPACR4KC/doJcmK7GuYL1M=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=BHTxAKODdPtXyazyo93IwvyE2s/+ym7SK59FUPx0JhIObH+PVO8GURo7ekUgVi3Zn82KWCiL6m5y9Fh4NKijdOMQvX/ZLyukDjK6794P1FlGsuM/1VFHj9wE5Qej9wWi6O/OUOBvKgP+RE9udxrK9OmjUuY7DslD6yJz4dcE/Qg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=iAKp+XfD; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=J2JA8nG7; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Received: from pps.filterd (m0279869.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 681E8hpc3002674 for ; Tue, 1 Sep 2026 16:32:46 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= BuKOZcrHKSXcLVc+QoGKSs7QdAttA3Z6UguXUeCz26M=; b=iAKp+XfDGoJdfC/C 8HZlzOEsfvpvzLCDNrOZWu3ofs20hWvUNMFieb4fr+2L6nFaGP6OnmNwF2kr9c0x sJB1LNzOi70zLr4JK+sEbfmeopeUdbPiF/42sY4L/u3zehDwcnko43LxrGx+CV0F ZtPQrghGVP5nwredo++NfWP46YzhFie4NVAu5B2rKvRB1mxcosdKkBF3fCFi14NZ LjOb/q/VL+xmr1TnTRW/f/icTq3AD13PsfymA1ouNKvRc2GhITrOpdnW0ei3oq6/ tt7tikcik5+tb+jqGg/6LuS1ebaNyN90lepRxTESApcDTl8NwHaSA1cmSb0GGLOm hmy/Qg== Received: from mail-qk1-f200.google.com (mail-qk1-f200.google.com [209.85.222.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4gdqbh3arn-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 01 Sep 2026 16:32:45 +0000 (GMT) Received: by mail-qk1-f200.google.com with SMTP id af79cd13be357-9390a2c895bso30243785a.0 for ; Tue, 01 Sep 2026 09:32:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1788280365; x=1788885165; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=BuKOZcrHKSXcLVc+QoGKSs7QdAttA3Z6UguXUeCz26M=; b=J2JA8nG7rKegsX6iuPtGDt1NO5e7ZcpiSlwh53NpLfyXuluqgf43+nKgkMV4o8mngR yQ7Ltn9Kzhcj9AY2dtusGOlN9U+K9ZBF7kCgWMygVPcOCPhwlvGMKFnsUTaxuL+C0j+B QpkVsM0NNHXh/X6dFAmpk2WHVOgptHKRUovhozv7hEDRVtEm0/tZUmn4Zlv6ahXgFt+Y 1/jEhsqts+T8QCkiCf42UHIcPksmFSv/47IO5+XFswb6Raa0vKZSRUNTyD2Ao0QvRnd8 UDEnF8OLx3m751wJXkeVdgYYb51saDiM2f9ifFNE8ejaTvPBgr8LWbSOQZbP7GZWrQsv XVDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788280365; x=1788885165; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=BuKOZcrHKSXcLVc+QoGKSs7QdAttA3Z6UguXUeCz26M=; b=W0u81GOoV5Xgw/+PqOPgdZ2po+FWz8rFh0BW5TohhwFfiE5xUACh24ToF0MXaHtCVy vXSbe2Bk+S85niWewkYWQ/BkH6s8JpAcDaAbjjTaDKaYWsKHW+pvBkbtubbGXJmcelry tVQL1yMY0PbC8Ga/+1zckCW8+XTiPIpA+8WH6pY1R5XTDxr4keAIHFKuzUoMdk7XwaBJ 60sh2NycVZqfTea/G7VN9Y/5VHDXBSR46u+Exh1h1Qx9l/AaP3pMI4S4Z2cdG3jEBe79 8RR0R76vxx3DI6ahW05iPYs/Jo57o0UNfFWGo1AV6W07IC5N3Kp5zmbHuoE/c1CKNsZw 22yg== X-Gm-Message-State: AFuF++nt4TZFEHn5RCwcYG4Y5S2OqiUH1JP6elKlHvJ/rH6piX07LnQW SiKP5b5RrE834Lv/fooIPvAMj/ottkNVm7cvLTYhUp7OgdkJfbwNV22nRD2O9UTkgL0fQoH74cb oNSUhdWzafj3Bl5DzYisrNwqBcXq+5ZOZimWVzpuYcD1cngVII+5ItdKOPwvYBRPpp/WR6Xs= X-Gm-Gg: AR+sD12m1zLO07hh9hStQ8Aaq2h81gnFXvgxU5EZxCbRVj4iHhVKeFZryUaKgI6nii3 ryLe2fOZSmhxbY9awqKLgv6shn9c8Zeq2Bo2X770c0GckapPOdcbVtEJBzzLl5WI2yYNeJlUbqH OPJyTqrHDEgMNydJLxpoEAT78k4osSUjIodyroM0iwC++1ZB3oyvX3zQXyL0Nss9B+DLAAnZJwr WczbwAv5sdD7xQku9aUg0Av5JMga49+l2SXwMr4umLb+MzWCNJoPZ65wExKJZGm+5FIndoEAW3h ihjfXYl7wNMBmQ6RGLRvjOf+RddXs55mEu5LbN2qn4jONcelH0+J+S2fsSgKwn5xTrmWJnHsOWL 6tqeSTXrtWmHFZA== X-Received: by 2002:a05:620a:880f:b0:92e:bd39:9993 with SMTP id af79cd13be357-93913952c79mr4603718485a.31.1788280365107; Tue, 01 Sep 2026 09:32:45 -0700 (PDT) X-Received: by 2002:a05:620a:880f:b0:92e:bd39:9993 with SMTP id af79cd13be357-93913952c79mr4603706085a.31.1788280364574; Tue, 01 Sep 2026 09:32:44 -0700 (PDT) Received: from localhost ([188.216.77.92]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49cdce3e0desm83257115e9.11.2026.09.01.09.32.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 01 Sep 2026 09:32:43 -0700 (PDT) From: Lorenzo Bianconi Date: Tue, 01 Sep 2026 18:32:19 +0200 Subject: [PATCH nf-next 4/6] net: netfilter: nf_flow_table: refactor MTU check for tunnel offload Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-4-72e49be8c31f@oss.qualcomm.com> References: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-0-72e49be8c31f@oss.qualcomm.com> In-Reply-To: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-0-72e49be8c31f@oss.qualcomm.com> To: Pablo Neira Ayuso , Florian Westphal , Phil Sutter , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn , David Ahern , Ido Schimmel Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, Lorenzo Bianconi X-Mailer: b4 0.14.3 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTAxMDE0NiBTYWx0ZWRfXwVynEgmNBeGx gNu8hRwnIAwJvWxRCzqq37E6x+vTjGw9g4uRvcXPrZj7Cl6O1viMUJFpCd4ff+SqHZbnukRSkJe 19tk+HQL5jGNhSpxIzfVOFto5Uz9IFM= X-Authority-Analysis: v=2.4 cv=R9wz39RX c=1 sm=1 tr=0 ts=6a96fe2e cx=c_pps a=hnmNkyzTK/kJ09Xio7VxxA==:117 a=WpTaRW6qxYHRGzLzQsVYzg==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_glEPmIy2e8OvE2BGh3C:22 a=EUspDBNiAAAA:8 a=CJUkwBbGfM167N4AH6QA:9 a=QEXdDO2ut3YA:10 a=PEH46H7Ffwr30OY-TuGO:22 X-Proofpoint-GUID: Jujxt2XnhYtEjVNPM6DL7qPJ32vRlIdT X-Proofpoint-ORIG-GUID: Jujxt2XnhYtEjVNPM6DL7qPJ32vRlIdT X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTAxMDE0NiBTYWx0ZWRfX2VPIVNWg2guL FHAO7uKvb1hqQupTMU0ao4eywtBqzdq7zDqUxbJEbKbfei9eBLHisaei/e9H325bp5t/Ev16Ey3 dirmPNiAybVjZ8H67TZcgb+ZCRmtYAHE0uLUbLp3vSlJj7PPQcMpKIi8MnRuBFjBFDOXvPU+ndK eIQFeKeNyn57FDof7TWBdn3urxQrCxpVz/shmrWsIonDJv3JQ9y3lepxz26J3grYturkduflovl F/9shzSvayxM01e91rhoTqyxEzXrGxzZfk/GT9iT0np2CGZQ4xdSAZS5dXK2yerRiRvzdq88IQc WUU41cFKdSN50J0qLs7ZdLBKqJrjm3sR1aJgLJv87JC7tNW+2ntDfis9vlMTF3OoS8u0r1aEbXz HGqZFtg1SM+fGk8ZMWTRiGC6R232WkKlNOVhI30cciEECqoFF6wu1aj1PE4wFC2XuWejjvxBNNN 09PNHWPR7BEyOSlbNig== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-01_04,2026-09-01_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 adultscore=0 clxscore=1015 phishscore=0 suspectscore=0 malwarescore=0 lowpriorityscore=0 impostorscore=0 spamscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2609010146 Introduce nf_flow_offload_check_mtu() helper and use the encapsulated protocol (tun.encap_proto) to compute the tunnel overhead instead of relying on tun_num, so the correct inner header size (IPv4 vs IPv6) is accounted for. Use it in both the IPv4 and IPv6 forward paths. This is a preliminary patch to support IPv4 over IPv6 and SIT flowtable tunnel offload. Signed-off-by: Lorenzo Bianconi --- net/netfilter/nf_flow_table_ip.c | 47 ++++++++++++++++++++++++++++++---------- 1 file changed, 35 insertions(+), 12 deletions(-) diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 3ecc47b57854..0aaf1e07f320 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -470,6 +470,37 @@ nf_flow_offload_lookup(struct nf_flowtable_ctx *ctx, return flow_offload_lookup(flow_table, &tuple); } +static int nf_flow_offload_check_mtu(struct nf_flowtable_ctx *ctx, + struct flow_offload_tuple_rhash *tuplehash, + struct sk_buff *skb) +{ + enum flow_offload_tuple_dir dir; + struct flow_offload *flow; + unsigned int mtu; + + dir = tuplehash->tuple.dir; + flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); + + mtu = flow->tuplehash[dir].tuple.mtu + ctx->offset; + if (unlikely(nf_flow_is_tunnel_ip(ctx))) { + switch (ctx->ether_type) { + case htons(ETH_P_IP): + mtu -= sizeof(struct iphdr); + break; + case htons(ETH_P_IPV6): + mtu -= sizeof(struct ipv6hdr); + break; + default: + break; + } + } + + if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) + return -EINVAL; + + return 0; +} + static int nf_flow_offload_forward(struct nf_flowtable_ctx *ctx, struct nf_flowtable *flow_table, struct flow_offload_tuple_rhash *tuplehash, @@ -477,17 +508,13 @@ static int nf_flow_offload_forward(struct nf_flowtable_ctx *ctx, { enum flow_offload_tuple_dir dir; struct flow_offload *flow; - unsigned int thoff, mtu; + unsigned int thoff; struct iphdr *iph; dir = tuplehash->tuple.dir; flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); - mtu = flow->tuplehash[dir].tuple.mtu + ctx->offset; - if (flow->tuplehash[!dir].tuple.tun_num) - mtu -= sizeof(*iph); - - if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) + if (nf_flow_offload_check_mtu(ctx, tuplehash, skb)) return 0; iph = (struct iphdr *)(skb_network_header(skb) + ctx->offset); @@ -1073,17 +1100,13 @@ static int nf_flow_offload_ipv6_forward(struct nf_flowtable_ctx *ctx, { enum flow_offload_tuple_dir dir; struct flow_offload *flow; - unsigned int thoff, mtu; struct ipv6hdr *ip6h; + unsigned int thoff; dir = tuplehash->tuple.dir; flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); - mtu = flow->tuplehash[dir].tuple.mtu + ctx->offset; - if (flow->tuplehash[!dir].tuple.tun_num) - mtu -= sizeof(*ip6h); - - if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) + if (nf_flow_offload_check_mtu(ctx, tuplehash, skb)) return 0; ip6h = (struct ipv6hdr *)(skb_network_header(skb) + ctx->offset); From patchwork Tue Sep 1 16:32:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lorenzo Bianconi X-Patchwork-Id: 2296162 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=qualcomm.com header.i=@qualcomm.com header.a=rsa-sha256 header.s=qcppdkim1 header.b=oaiHOaN2; dkim=pass (2048-bit key; unprotected) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.a=rsa-sha256 header.s=google header.b=iVvwSeBN; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=104.64.211.4; helo=sin.lore.kernel.org; envelope-from=netfilter-devel+bounces-14902-incoming=patchwork.ozlabs.org@vger.kernel.org; receiver=patchwork.ozlabs.org) Received: from sin.lore.kernel.org (sin.lore.kernel.org [104.64.211.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZCNP3ZGhz1xvS for ; Wed, 02 Sep 2026 03:22:29 +1000 (AEST) Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sin.lore.kernel.org (Postfix) with ESMTP id 979763C58F for ; Tue, 1 Sep 2026 16:33:13 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 8957C481A93; Tue, 1 Sep 2026 16:32:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="oaiHOaN2"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="iVvwSeBN" X-Original-To: netfilter-devel@vger.kernel.org Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A6896481652 for ; Tue, 1 Sep 2026 16:32:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280370; cv=none; b=e28n2f/KsEz7a85/Lq80i3NroZNStnqfC8teg1qm6Kg5MuYHZnXW8xAfUKAYvkkF8aUbyvEaPaycAHJoG5Fzopfm+dikz0rUm5evujDjWzKGimHZ7FLVdDT+6RT2C0ff7RR+cTbMyBC3GI+nJLWQWVdn4739KjLoWi/03UWs5bA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280370; c=relaxed/simple; bh=7CslNYKk1vnhXwILR3c9oztN26/8RPZZqz5rCw2kOOo=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=pohh9CciYLpBQ4zjH5J9/REb48l6rxkaWIrq7G04y/7PTnwPJgkw9hlMGfra+A15w01DRJ7KD1T290k3xGkvDDJ74yY93mKJOUdcFeJ7ti/biT1NRMLN6RvgI1RZLYiWrL1Ku69DedmhAKYk7XbUwyfhPikeWLOhO2uMdDKGRcU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=oaiHOaN2; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=iVvwSeBN; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Received: from pps.filterd (m0279868.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 681E8oKr2646926 for ; Tue, 1 Sep 2026 16:32:47 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= j5kepUX1QpXNYsPdAWi1drX7J4nYNsNWxblq3mQxLpA=; b=oaiHOaN2GXLKj+gx D1GzVctHO4WOeVZG+26HUMQOcTBML4QPxhhwZ89f/RGWS1uq+Mjes8cqrawksjH+ PjMpoup7y5AZV3WIeeESMyYq7mKgifRNiX1ePi5+SbpM//1Mz22Uhk88F93Hx5ub BoB+C1yU2m4Q/2uxcSO/RbGsf0pdoEGzb310aXPcdTEo/e6glBVjFuCCXhNzhdD1 aV6ymrDYRKUuF2Ead6j41luEzrwG5JywzRxVfArHUsv1izm8NHHfL6R4MMlbfn4F kWIofALN9DeNOwVXUQ8MiTBmnhjXBhB0hcy0hDX9gKH/lJd3yL9bHXu3nWYJmxEt ggRggQ== Received: from mail-qk1-f198.google.com (mail-qk1-f198.google.com [209.85.222.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4gdp8fueae-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 01 Sep 2026 16:32:47 +0000 (GMT) Received: by mail-qk1-f198.google.com with SMTP id af79cd13be357-9375d92d8cdso20924885a.2 for ; Tue, 01 Sep 2026 09:32:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1788280367; x=1788885167; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=j5kepUX1QpXNYsPdAWi1drX7J4nYNsNWxblq3mQxLpA=; b=iVvwSeBN/joJyTPgazCKXnnbBT//DG7FJeJZ58+8FNmPHfi8NvEHZe+GDM7sy1K9l5 diwQ2Yr8kLq+j/eMnxqdEbjHLBoaUiT4rGwG/CY8L1C93U4eYI3S2+ABbH5F83OqXK4r bkEvRSFrMG4k0WDandp2QNfqbh8bBCy5ZswEt8hAJZSpZXnOgW7J9VL3bWL6d8sZnxnf uD0eJ+LxFZ7qJqBTSkzrsELl8Um9BMta76QXMr34ME9I7tgXv8e3YqqSGhynByZcwvcZ Jc+lCbNx1tDAIME3Ziv1Axh1LqdxLtrueCmKoKPJ5hYRDcDxSEvAvAchhDlDatR4MCUe pxog== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788280367; x=1788885167; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=j5kepUX1QpXNYsPdAWi1drX7J4nYNsNWxblq3mQxLpA=; b=dP9Crpixwv2dsTOmq4hhsr1iU4KsTlj860SP04aAeH/IAyQ0Kxmwrj2TDfUg6Rvhpw y6Ukv9D+yVuk0sxh5RKJcYTMvepSCLQOkg7RaGIJjzHG3wO2WWf5/wleGCEweJp/Iazq bDzsaERgPQcOo/88odAQvN4hknf+dPuENmTjDenGLwNnPjvTS6DL3k2wQwKTkJ1FjPEv 7rJcvXAjdPlra7HIWjRjnyNP5DKSSXmk65wXSIyUJ3ERC8UfevEFDvtv6XKfe8wKBAdQ OhV3SgxQXf/aivr6Fj1IrtfZYAe0NUFKaLhw0hIjRjCET7VFf0mzWb3pn+ZlovwnhAhe jJLw== X-Gm-Message-State: AFuF++kwDQ42U7oMmGrs922kEaOeyGy6Blsun9KSx29DiMXeegeJgWho 3dNN+Ob8ACQeFoEJwvUgjeRqO+0bq28HW2+YDETC1+mfeflUgouflitYAPjrBN9sResnQ1zzuGU oW7+aZiAGIC8hu7QVKuX8vn8FfpGjUQCXx6BrNscQ2TCnkb5qPHqwW6Y1fnF+l9DYqtrg8WM= X-Gm-Gg: AR+sD10yhoOAwHigjCce7N1utuIMG/uvKfHfpLPKFzjvcGEgNdhx3iUxQ+TnoeX8JA9 XNGZUj9wsJUM3rooX/K1YWYAj6tfbJMym0zmfqDcoHvPAaY4cls9xc+lbP+I+AlkTirherNgaHj zokTl4LriZOYfQ1SiwXTWXCdA25ZVuIay3vWQULiW3KMFpxrRJHpV87GDx/QA0IhMoTsiB5bBcB 62VoSL0Cx6uFhskgXapNdDF7vEhI7GkLy/XAewE9KCGJPOVSCWqsQcoUbbxDQoavjI7mLKOH9ap kPn64VYo4bcHimUMt19NZZ4/uywF5sk6hkUTXzQ69N772bxORBU9VvNw0tARRl0hu5I1SbHvij7 q7euTasDNglKlUg== X-Received: by 2002:a05:620a:8ec9:b0:939:492:20ce with SMTP id af79cd13be357-939137b3b66mr2516450285a.1.1788280366683; Tue, 01 Sep 2026 09:32:46 -0700 (PDT) X-Received: by 2002:a05:620a:8ec9:b0:939:492:20ce with SMTP id af79cd13be357-939137b3b66mr2516439885a.1.1788280366075; Tue, 01 Sep 2026 09:32:46 -0700 (PDT) Received: from localhost ([188.216.77.92]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49ce309e30dsm22020345e9.6.2026.09.01.09.32.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 01 Sep 2026 09:32:45 -0700 (PDT) From: Lorenzo Bianconi Date: Tue, 01 Sep 2026 18:32:20 +0200 Subject: [PATCH nf-next 5/6] net: netfilter: add encap_proto to flow_offload_tunnel Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-5-72e49be8c31f@oss.qualcomm.com> References: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-0-72e49be8c31f@oss.qualcomm.com> In-Reply-To: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-0-72e49be8c31f@oss.qualcomm.com> To: Pablo Neira Ayuso , Florian Westphal , Phil Sutter , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn , David Ahern , Ido Schimmel Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, Lorenzo Bianconi , Lorenzo Bianconi X-Mailer: b4 0.14.3 X-Proofpoint-GUID: DABNEgymUpCG77oau85l0_fu3PtVTQNe X-Proofpoint-Spam-Info: AW1haW4tMjYwOTAxMDE0NiBTYWx0ZWRfX9X5rFEGZ3Z2v DcrelQ+rM0aZ8Or07Fvq68ujbdG+Aj10WNDy401UC18FUUbRmUvBRJ0PcxkqERjKUqEtHwSAUA2 cMp8hSS1hhumapx0+Z6do/MJhaOXjuI= X-Proofpoint-ORIG-GUID: DABNEgymUpCG77oau85l0_fu3PtVTQNe X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTAxMDE0NiBTYWx0ZWRfX60hwitFtXq5x 5iF9HBHVOUx86WTI618mQqieqxzbTf/EwQloGMv8Vcl6jXmJqKQE9aSdk3KtAOMrSXVMHBu18Sh L6M214kfJWhGGfZbKJiBvEXp26uKUUJxLYaCiombrXV/o5b0HkvXtVXANostTPn1sTi8zBNxxYN 8irHPVlTXQHFGf/vErYmsjC60Mas53qDf9ZxKoJd0VcRcrv2H9Cm1k61ctCaiVN525GTgu8Fdiy emyjIk0yVIFcD6bp5pEFZOzs5eTHqFkUrsp5jkKMRC2x/PRtEDtz0G5/QyfH8orgkCtVITNhsDg xqxjrrl1ff9We5qIXfFAYUlDnIZAQ3686YPHsyjckPoMhtG4Tap+fXWsNNXdH416yICRaHjCxMR ntFP+OG0fmDX9PjTvrkL/TN0eJ4oqMZKIXyBWncz09PADagx1xMpPGQl6kKDXtb/WhNcud5B514 IJPsDCsesJn9EHtH9IA== X-Authority-Analysis: v=2.4 cv=BPWDalQG c=1 sm=1 tr=0 ts=6a96fe2f cx=c_pps a=qKBjSQ1v91RyAK45QCPf5w==:117 a=WpTaRW6qxYHRGzLzQsVYzg==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=ZpdpYltYx_vBUK5n70dp:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=EiAgCLLKtgnx6EotJx8A:9 a=QEXdDO2ut3YA:10 a=NFOGd7dJGGMPyQGDc5-O:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-01_04,2026-09-01_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 bulkscore=0 phishscore=0 adultscore=0 spamscore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 malwarescore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2609010146 From: Lorenzo Bianconi Add encap_proto (AF_INET or AF_INET6) to struct flow_offload_tunnel to allow its use as part of the hash table key during flowtable entry lookup. This is a preliminary change to support IPv4 over IPv6 tunneling via the flowtable infrastructure for software acceleration. Signed-off-by: Lorenzo Bianconi --- include/linux/netdevice.h | 1 + include/net/netfilter/nf_flow_table.h | 1 + net/ipv4/ipip.c | 1 + net/ipv6/ip6_tunnel.c | 1 + net/netfilter/nf_flow_table_ip.c | 2 ++ net/netfilter/nf_flow_table_path.c | 2 ++ 6 files changed, 8 insertions(+) diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 87cafc932e9e..22e4ed491eb2 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -910,6 +910,7 @@ struct net_device_path { }; u8 inner_proto; + u8 encap_proto; } tun; struct { enum { diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h index f2e2771f188f..306e7d9ec3ec 100644 --- a/include/net/netfilter/nf_flow_table.h +++ b/include/net/netfilter/nf_flow_table.h @@ -118,6 +118,7 @@ struct flow_offload_tunnel { }; u8 inner_proto; + u8 encap_proto; }; struct flow_offload_tuple { diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c index 1630325c77d3..e27323251a2a 100644 --- a/net/ipv4/ipip.c +++ b/net/ipv4/ipip.c @@ -379,6 +379,7 @@ static int ipip_fill_forward_path(struct net_device_path_ctx *ctx, path->tun.src_v4.s_addr = tiph->saddr; path->tun.dst_v4.s_addr = tiph->daddr; path->tun.inner_proto = IPPROTO_IPIP; + path->tun.encap_proto = AF_INET; path->tun.dst = &rt->dst; path->dev = ctx->dev; diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index d5ff50a2ac01..64a184bca467 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -1868,6 +1868,7 @@ static int ip6_tnl_fill_forward_path(struct net_device_path_ctx *ctx, path->tun.src_v6 = fl6.saddr; path->tun.dst_v6 = fl6.daddr; path->tun.inner_proto = IPPROTO_IPV6; + path->tun.encap_proto = AF_INET6; path->tun.dst = dst; path->dev = ctx->dev; ctx->dev = dst->dev; diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 0aaf1e07f320..5cbc3cf10ec2 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -204,12 +204,14 @@ static void nf_flow_tuple_encap(struct nf_flowtable_ctx *ctx, tuple->tun.dst_v4.s_addr = iph->daddr; tuple->tun.src_v4.s_addr = iph->saddr; tuple->tun.inner_proto = ctx->tun.inner_proto; + tuple->tun.encap_proto = AF_INET; break; case htons(ETH_P_IPV6): ip6h = (struct ipv6hdr *)(skb_network_header(skb) + offset); tuple->tun.dst_v6 = ip6h->daddr; tuple->tun.src_v6 = ip6h->saddr; tuple->tun.inner_proto = ctx->tun.inner_proto; + tuple->tun.encap_proto = AF_INET6; break; default: break; diff --git a/net/netfilter/nf_flow_table_path.c b/net/netfilter/nf_flow_table_path.c index 1e55644f2edb..90360406d11e 100644 --- a/net/netfilter/nf_flow_table_path.c +++ b/net/netfilter/nf_flow_table_path.c @@ -135,6 +135,7 @@ static int nft_dev_path_info(struct net_device_path_stack *stack, info->tun.dst_v6 = path->tun.dst_v6; info->tun.inner_proto = path->tun.inner_proto; info->tun_dst = path->tun.dst; + info->tun.encap_proto = path->tun.encap_proto; info->num_tuns++; } else { if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX) @@ -246,6 +247,7 @@ static int nft_dev_forward_path(const struct nft_pktinfo *pkt, route->tuple[!dir].in.tun.src_v6 = info.tun.dst_v6; route->tuple[!dir].in.tun.dst_v6 = info.tun.src_v6; route->tuple[!dir].in.tun.inner_proto = info.tun.inner_proto; + route->tuple[!dir].in.tun.encap_proto = info.tun.encap_proto; route->tuple[!dir].in.num_tuns = info.num_tuns; dst_release(route->tuple[dir].dst); route->tuple[dir].dst = info.tun_dst; From patchwork Tue Sep 1 16:32:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lorenzo Bianconi X-Patchwork-Id: 2296146 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=qualcomm.com header.i=@qualcomm.com header.a=rsa-sha256 header.s=qcppdkim1 header.b=gS/O4aWc; dkim=pass (2048-bit key; unprotected) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.a=rsa-sha256 header.s=google header.b=fiZIXdLG; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2600:3c15:e001:75::12fc:5321; helo=sin.lore.kernel.org; envelope-from=netfilter-devel+bounces-14903-incoming=patchwork.ozlabs.org@vger.kernel.org; receiver=patchwork.ozlabs.org) Received: from sin.lore.kernel.org (sin.lore.kernel.org [IPv6:2600:3c15:e001:75::12fc:5321]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZBvL23X4z1xwZ for ; Wed, 02 Sep 2026 03:00:46 +1000 (AEST) Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by sin.lore.kernel.org (Postfix) with ESMTP id EA97F3CDE4 for ; Tue, 1 Sep 2026 16:33:18 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 56ED1481FDD; Tue, 1 Sep 2026 16:32:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="gS/O4aWc"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="fiZIXdLG" X-Original-To: netfilter-devel@vger.kernel.org Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 486DD481FC5 for ; Tue, 1 Sep 2026 16:32:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280372; cv=none; b=i/o1sm/V6Hr/pOCq1AUuyJvQ1/2pgyLaBTi9KQa5fAmiLOoKJ1xrEFQE54TmENSzsVmTK9jAlRd1yrXlaY7aIOEtFOKb7LKWtaaHkMueqEKi3ij0/HjcDit61skt4JOFz503eybWiu3C2N7koGG5mE54FbDYTalRclx5Ce0fAtY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280372; c=relaxed/simple; bh=1Idn6aNfy9pd8Gk3lXsLrzpmsEoe+WcQxBXHj5VOW28=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=J4mhzLG0fDroIB22XchU6EswpR0Hc0Bo1poF5EzmtBAlKNsenIFxW4gpy9DINHQkeNa3itOBy2YNX8PuvDM65qz0demtKHIGdOLQVDTPRoHueW+YsS0n0N5EIgxgcEEnfgMESMW5Px51NuOckEcc5mqg5WEgQ6G0078hpD0NtcA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=gS/O4aWc; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=fiZIXdLG; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 681E8WRR3256336 for ; Tue, 1 Sep 2026 16:32:50 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= a4w/pkmZ0ZBipJIlxgM2eGUO8kVkv8mPgNOt+rLDSQ0=; b=gS/O4aWcf+dDfrfL TTR96Az6x6oZCHTziI8y6COSPgPj0cXWj6E9s74bYUBSU1KXVRutLaHM3pGoGGh1 zKJxB7esxz+7q8XWT+Gyrpi8APnwrFTHxid4vvmrRVbTjp7gY+4iPwd1sg0M35P0 RMey4tvxXW85I344xxhQI7vZ7tbRPaJUaXrOcKfcurP03bCfkbqjui1XCMF8xvyv oHvd59763DJDFQb5kgKGzSMsQz5IGYeL/bP4qBAM9IhL6EzWTVJhT8P0sKmto9cd fILGPg4nqeCCgFwDDO4fCiJJ1qNaiTjpuhmhnBjTI2n8EJ2cZj/zyPhjmlVuoKaI IV+aYA== Received: from mail-qk1-f199.google.com (mail-qk1-f199.google.com [209.85.222.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4gdynt0y9q-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 01 Sep 2026 16:32:49 +0000 (GMT) Received: by mail-qk1-f199.google.com with SMTP id af79cd13be357-933023a5980so20000285a.3 for ; Tue, 01 Sep 2026 09:32:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1788280369; x=1788885169; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=a4w/pkmZ0ZBipJIlxgM2eGUO8kVkv8mPgNOt+rLDSQ0=; b=fiZIXdLGRKT2Jg0fagMuts1/1aN5Z8MrPvpY+jjDSd3DFrqH2GebOE6lGQYifur3Cd K50cwre2UySO67DgKO4Xk/cGmZa8N8k+GrEd+xmu9QlCoZKajF7ETHD9/p8yzj5WYcis J8PudKl+HQIJ2j/CMGMdQ+Mx/6h/idCnIZsc9QermPRzZYYtAGXSKLBtOeKR7Es6F+H6 Aj7/ipt2T5TtpvHhOdNil1W3Lin4IsBA5/LNPOsd1+fECq8jESBdE2UdKXxHvmaWkJOv P2P9euIsex2SQ4q5p/23REtEepxIPSSql+pY3ZkwNA9W1GAkwsed/RLZhT6uJ00xNJQz QQsw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788280369; x=1788885169; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=a4w/pkmZ0ZBipJIlxgM2eGUO8kVkv8mPgNOt+rLDSQ0=; b=kM1Qbatkt5fdwaoeid7m2cfVDqMuiz6O/VfGrGtj341V3v+XNi3fw0MrbVk55n0XY3 Ul7D0idj6x2mWIUHNK8jl1jQkf78vaGqw+eD17cfP/aSTvt17VMWbWGFDbaZTnFfG7v/ gLfAEannQ6cVRxVpZYhw6kyX+kqAJDK1R+bbz5veQlWeqSHZPzZamQpHG0cZlQ8y1Mb8 Ctlv9LXObSAQ+UjWGd708kGXuPx9ovigKLI6Rz+Mptko6x0vgZA5CU4Tv1UaR3f2CDf9 yxmobt1/fCHFmB/Ymu00CReGaQDCXpESwRTltLsGPl7F6CuXgFpsejGbocA9mCTTeZn5 IMpw== X-Gm-Message-State: AFuF++nP4sx2XLS7pVqrLypJ57WzLIbGc6T5rir3MuwShcDVR99fyknY 4etzRTn1THhsNnbXb5kDtl6en21eVUDsx7sN2gpSAALq7oMzzA2xUdGDkvrKhcKXjz89Ev/c9jz AK3NcpI4jMhnatw3ROGuMCD78e3GCsTkPyJtNIyMpb9CtDZmdUYn8M9gc9k7BpaHV66uep24= X-Gm-Gg: AR+sD12/GQj3srku12CmH6XLEyK80bp+XolJQ/7WQlMLndGz/C0pjbnYtAtz6z0VTyE w2EUZPaPzk7dg3JReMf5jkZ8OU+JCgapfC1Ns/0MuA6yNcgcUg4RToRea1jkCes6ABJnitCPKgN dTHnzZZlZ1m/369g/3MnhAaVSuA6MJXX09SEjrwSI5BJc1lRpx8vllsGRumUfQbnHv7tSU1kT8a UguNjX6xPIVTytIj2dvFcRds5utzUD3d4l8BnzjzGPX76wyFG+fBpdJzRdVxYkvU1LHpkO3YF2s 8ymJmUbCp6FtoN3miLm+Nxe9WLNsVPyVZqr09E4GkuAwy/Ptx65A1amSmuJZDQ8OBLifZd4mUnw PUR0DlhAMX0PlHg== X-Received: by 2002:a05:620a:1b91:b0:936:ef9a:deea with SMTP id af79cd13be357-939138cb02bmr4583621485a.28.1788280368906; Tue, 01 Sep 2026 09:32:48 -0700 (PDT) X-Received: by 2002:a05:620a:1b91:b0:936:ef9a:deea with SMTP id af79cd13be357-939138cb02bmr4583607985a.28.1788280368237; Tue, 01 Sep 2026 09:32:48 -0700 (PDT) Received: from localhost ([188.216.77.92]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49b9267c369sm251945115e9.3.2026.09.01.09.32.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 01 Sep 2026 09:32:46 -0700 (PDT) From: Lorenzo Bianconi Date: Tue, 01 Sep 2026 18:32:21 +0200 Subject: [PATCH nf-next 6/6] net: netfilter: nf_flow_table: unify tunnel push for IPv4 and IPv6 Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-6-72e49be8c31f@oss.qualcomm.com> References: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-0-72e49be8c31f@oss.qualcomm.com> In-Reply-To: <20260901-nf-flowtable-sw-accel-ip6ip-sit-preliminary-v1-0-72e49be8c31f@oss.qualcomm.com> To: Pablo Neira Ayuso , Florian Westphal , Phil Sutter , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn , David Ahern , Ido Schimmel Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, Lorenzo Bianconi X-Mailer: b4 0.14.3 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTAxMDE0NiBTYWx0ZWRfX2+w43b7hbI9d LmGjAkvBd0XveQA9NrCL7aU8eYqLwCSRESfkWukOghxVJRoqFsAq6GLHejc8fwwcPoXjUH9mn/n SHCe78pH3CLtNLzZYDo4UnipXN53U9wbmutVTIFyvHm4kcRg/bNF5KzknAxy/AWGKg3/pd4q0dk sdToWOyxOrvkr0UvJUqyU8GeqB6u3WnhW42ie0SqYSmIYI4hF3kkuHQyPJSRZZOQd3gnG+ffo6d 8l0sBOuF4T30M3g6ug1FHK+jjRx056FcPPUyWhATVkAX9boaGfnXVFd2Rd/KF2sTq8EXO54uQSD Khiyy0O2WlHVuFi8L0WZ2mjsPNkfSz9YgvG+4nfGbhdJk75gBJa2eNhBQlEpqmeD0uvvM9I0Fzm 34MGoJQMUZVqcZFHyPiKZU7QAVd7M+daCp3ICJLbu5rqyyZ98PoWLz6O1etnVfdb55DU1q9eOju UEdDImcOoQ0a2hFDwvA== X-Proofpoint-ORIG-GUID: Al9Rt8nIu_VdcneZmjc9GB42moV5esd3 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTAxMDE0NiBTYWx0ZWRfX6Wh+LGWc3T7l MXWLQ2/ue58yIlev25IDeHhqnc+Xit0OLJfxEeQsaeDTUJ5UgEzIbdDXbTb7BgNukVeYIUypyOX x3YhUb+W3E8jsZBXIdJSi/gXpktLBJs= X-Authority-Analysis: v=2.4 cv=LfkMLDfi c=1 sm=1 tr=0 ts=6a96fe32 cx=c_pps a=HLyN3IcIa5EE8TELMZ618Q==:117 a=WpTaRW6qxYHRGzLzQsVYzg==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=3WHJM1ZQz_JShphwDgj5:22 a=EUspDBNiAAAA:8 a=CQvNws4Pyv-XnHjONYcA:9 a=QEXdDO2ut3YA:10 a=bTQJ7kPSJx9SKPbeHEYW:22 X-Proofpoint-GUID: Al9Rt8nIu_VdcneZmjc9GB42moV5esd3 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-01_04,2026-09-01_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 bulkscore=0 clxscore=1015 impostorscore=0 malwarescore=0 phishscore=0 lowpriorityscore=0 spamscore=0 priorityscore=1501 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2609010146 Refactor nf_flow_tunnel_ipip_push() and nf_flow_tunnel_ip6ip6_push() into nf_flow_tunnel_ip_push() and nf_flow_tunnel_ip6_push(), keying the inner header handling off tuple->tun.inner_proto so both IP-in-IP and IPv6-in-IPv6 inner protocols are supported regardless of the outer address family. Replace nf_flow_tunnel_v4_push() and nf_flow_tunnel_v6_push() with a single nf_flow_tunnel_push() that dispatches on tuple->tun.encap_proto, and set skb->protocol explicitly after pushing the outer header. This is a preliminary patch to support IPv4 over IPv6 and SIT tunnel flowtable offload. Signed-off-by: Lorenzo Bianconi --- net/netfilter/nf_flow_table_ip.c | 121 +++++++++++++++++++++++---------------- 1 file changed, 73 insertions(+), 48 deletions(-) diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 5cbc3cf10ec2..dc38dcc28773 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -614,23 +614,37 @@ static int nf_flow_pppoe_push(struct sk_buff *skb, u16 id, return 0; } -static int nf_flow_tunnel_ipip_push(struct net *net, struct sk_buff *skb, - struct flow_offload_tuple *tuple, - struct dst_entry *dst, __be32 *ip_daddr) +static int nf_flow_tunnel_ip_push(struct net *net, struct sk_buff *skb, + struct flow_offload_tuple *tuple, + struct dst_entry *dst, __be32 *ip_daddr) { - struct iphdr *iph = (struct iphdr *)skb_network_header(skb); - struct rtable *rt = dst_rtable(dst); - u8 tos = iph->tos, ttl = iph->ttl; - __be16 frag_off = iph->frag_off; - u32 headroom = sizeof(*iph); + __be16 frag_off = 0; + struct iphdr *iph; + u8 tos = 0, ttl; + u32 headroom; int err; + if (tuple->tun.inner_proto == IPPROTO_IPV6) { + struct ipv6hdr *ip6h; + + ip6h = (struct ipv6hdr *)skb_network_header(skb); + tos = ipv6_get_dsfield(ip6h); + ttl = ip6h->hop_limit; + frag_off = htons(IP_DF); + } else { + iph = (struct iphdr *)skb_network_header(skb); + frag_off = iph->frag_off; + tos = iph->tos; + ttl = iph->ttl; + } + err = iptunnel_handle_offloads(skb, SKB_GSO_IPXIP4); if (err) return err; - skb_set_inner_ipproto(skb, IPPROTO_IPIP); - headroom += LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len; + skb_set_inner_ipproto(skb, tuple->tun.inner_proto); + headroom = sizeof(*iph) + LL_RESERVED_SPACE(dst->dev) + + dst->header_len; err = skb_cow_head(skb, headroom); if (err) return err; @@ -641,11 +655,12 @@ static int nf_flow_tunnel_ipip_push(struct net *net, struct sk_buff *skb, /* Push down and install the IP header. */ skb_push(skb, sizeof(*iph)); skb_reset_network_header(skb); + skb->protocol = htons(ETH_P_IP); iph = ip_hdr(skb); iph->version = 4; iph->ihl = sizeof(*iph) >> 2; - iph->frag_off = ip_mtu_locked(&rt->dst) ? 0 : frag_off; + iph->frag_off = ip_mtu_locked(dst) ? 0 : frag_off; iph->protocol = tuple->tun.inner_proto; iph->tos = tos; iph->daddr = tuple->tun.src_v4.s_addr; @@ -660,57 +675,57 @@ static int nf_flow_tunnel_ipip_push(struct net *net, struct sk_buff *skb, return 0; } -static int nf_flow_tunnel_v4_push(struct net *net, struct sk_buff *skb, - struct flow_offload_tuple *tuple, - struct dst_entry *dst, __be32 *ip_daddr) +static int nf_flow_tunnel_ip6_push(struct net *net, struct sk_buff *skb, + struct flow_offload_tuple *tuple, + struct dst_entry *dst, + struct in6_addr **ip6_daddr) { - if (tuple->tun_num) - return nf_flow_tunnel_ipip_push(net, skb, tuple, dst, ip_daddr); - - return 0; -} - -static int nf_flow_tunnel_ip6ip6_push(struct net *net, struct sk_buff *skb, - struct flow_offload_tuple *tuple, - struct dst_entry *dst, - struct in6_addr **ip6_daddr) -{ - struct ipv6hdr *ip6h = (struct ipv6hdr *)skb_network_header(skb); - __u8 dsfield = ipv6_get_dsfield(ip6h); - struct rtable *rt = dst_rtable(dst); struct flowi6 fl6 = { .daddr = tuple->tun.src_v6, .saddr = tuple->tun.dst_v6, - .flowi6_proto = IPPROTO_IPV6, + .flowi6_proto = tuple->tun.inner_proto, }; - u8 hop_limit = ip6h->hop_limit; + u8 hop_limit, dsfield; + struct ipv6hdr *ip6h; int err, mtu; u32 headroom; + if (tuple->tun.inner_proto == IPPROTO_IPIP) { + struct iphdr *iph = (struct iphdr *)skb_network_header(skb); + + dsfield = ipv4_get_dsfield(iph); + hop_limit = iph->ttl; + } else { + ip6h = (struct ipv6hdr *)skb_network_header(skb); + dsfield = ipv6_get_dsfield(ip6h); + hop_limit = ip6h->hop_limit; + } + err = iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6); if (err) return err; - skb_set_inner_ipproto(skb, IPPROTO_IPV6); - headroom = sizeof(*ip6h) + LL_RESERVED_SPACE(rt->dst.dev) + - rt->dst.header_len; + skb_set_inner_ipproto(skb, tuple->tun.inner_proto); + headroom = sizeof(*ip6h) + LL_RESERVED_SPACE(dst->dev) + + dst->header_len; err = skb_cow_head(skb, headroom); if (err) return err; skb_scrub_packet(skb, true); - mtu = dst_mtu(&rt->dst) - sizeof(*ip6h); + mtu = dst_mtu(dst) - sizeof(*ip6h); mtu = max(mtu, IPV6_MIN_MTU); skb_dst_update_pmtu_no_confirm(skb, mtu); skb_push(skb, sizeof(*ip6h)); skb_reset_network_header(skb); + skb->protocol = htons(ETH_P_IPV6); ip6h = ipv6_hdr(skb); ip6_flow_hdr(ip6h, dsfield, ip6_make_flowlabel(net, skb, fl6.flowlabel, true, &fl6)); ip6h->hop_limit = hop_limit; - ip6h->nexthdr = IPPROTO_IPV6; + ip6h->nexthdr = tuple->tun.inner_proto; ip6h->daddr = tuple->tun.src_v6; ip6h->saddr = tuple->tun.dst_v6; ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(*ip6h)); @@ -721,15 +736,20 @@ static int nf_flow_tunnel_ip6ip6_push(struct net *net, struct sk_buff *skb, return 0; } -static int nf_flow_tunnel_v6_push(struct net *net, struct sk_buff *skb, - struct flow_offload_tuple *tuple, - struct dst_entry *dst, - struct in6_addr **ip6_daddr) +static int nf_flow_tunnel_push(struct net *net, struct sk_buff *skb, + struct flow_offload_tuple *tuple, + struct dst_entry *dst, __be32 *ip_daddr, + struct in6_addr **ip6_daddr) { - if (tuple->tun_num) - return nf_flow_tunnel_ip6ip6_push(net, skb, tuple, dst, ip6_daddr); - - return 0; + switch (tuple->tun.encap_proto) { + case AF_INET: + return nf_flow_tunnel_ip_push(net, skb, tuple, dst, ip_daddr); + case AF_INET6: + return nf_flow_tunnel_ip6_push(net, skb, tuple, dst, + ip6_daddr); + default: + return 0; + } } static int nf_flow_encap_push(struct sk_buff *skb, @@ -836,6 +856,7 @@ static int nf_flow_queue_xmit4(struct sk_buff *skb, struct flow_offload_tuple *other_tuple; enum flow_offload_tuple_dir dir; struct nf_flow_xmit xmit = {}; + struct in6_addr *ip6_daddr; struct flow_offload *flow; struct neighbour *neigh; struct rtable *rt; @@ -853,9 +874,11 @@ static int nf_flow_queue_xmit4(struct sk_buff *skb, flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); other_tuple = &flow->tuplehash[!dir].tuple; ip_daddr = other_tuple->src_v4.s_addr; + ip6_daddr = &other_tuple->src_v6; - if (nf_flow_tunnel_v4_push(state->net, skb, other_tuple, - tuplehash->tuple.dst_cache, &ip_daddr) < 0) + if (nf_flow_tunnel_push(state->net, skb, other_tuple, + tuplehash->tuple.dst_cache, + &ip_daddr, &ip6_daddr) < 0) return NF_DROP; switch (tuplehash->tuple.xmit_type) { @@ -1164,6 +1187,7 @@ static int nf_flow_queue_xmit6(struct sk_buff *skb, struct flow_offload *flow; struct neighbour *neigh; struct rt6_info *rt; + __be32 ip_daddr; if (unlikely(tuplehash->tuple.xmit_type == FLOW_OFFLOAD_XMIT_XFRM)) { rt = dst_rt6_info(tuplehash->tuple.dst_cache); @@ -1176,11 +1200,12 @@ static int nf_flow_queue_xmit6(struct sk_buff *skb, dir = tuplehash->tuple.dir; flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); other_tuple = &flow->tuplehash[!dir].tuple; + ip_daddr = other_tuple->src_v4.s_addr; ip6_daddr = &other_tuple->src_v6; - if (nf_flow_tunnel_v6_push(state->net, skb, other_tuple, - tuplehash->tuple.dst_cache, - &ip6_daddr) < 0) + if (nf_flow_tunnel_push(state->net, skb, other_tuple, + tuplehash->tuple.dst_cache, + &ip_daddr, &ip6_daddr) < 0) return NF_DROP; switch (tuplehash->tuple.xmit_type) {