[PATCH nf 0/3] flowtable fixes for ipip tunnels

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

The following patchset contains fixes for the flowtable ipip support:

Patch #1 updates nf_flow_tunnel_ip{6}ip{6}_push() to use the dst_entry
         in this direction to calculate headroom and set iph->frag_off.
	 Apparently, nft_flow_tunnel_update_route() sets the right
	 dst_entry in this direction, but datapath uses the other direction.

Patch #2 adds a function to bail out early on any attempt to hardware
	 offload a flow entry which is not supported. Currently, ->num_tun
	 has no drivers supporting this.

Patch #3 makes dst_entry available for all xmit modes which is required
	 to reach the dst_entry when pushing the ipip header (see related
	 patch #1). Based on patch from Rein Wein.

This series is passing nft_flowtable.sh selftest here, including Ren Wei's
patch:

  [nf,v3,2/2] selftests: netfilter: add bridge tunnel flowtable regression
  https://patchwork.ozlabs.org/project/netfilter-devel/patch/5b8a9e87ff7b47401612bb0e0fc841d8bfdd333d.1782092221.git.chzhengyang2023@lzu.edu.cn/

which should be also be taken upstream.

Pablo Neira Ayuso (3):
  netfilter: flowtable: use dst in this direction when pushing IPIP header
  netfilter: flowtable: IPIP tunnel hardware offload is not yet support
  netfilter: flowtable: support IPIP tunnel with direct xmit

 include/net/netfilter/nf_flow_table.h |  4 ++--
 net/netfilter/nf_flow_table_core.c    | 15 +++++++++++----
 net/netfilter/nf_flow_table_ip.c      | 21 ++++++++++++---------
 net/netfilter/nf_flow_table_offload.c | 17 +++++++++++++++++
 4 files changed, 42 insertions(+), 15 deletions(-)

-- 
2.47.3