[PATCH nf-next,v2 0/3] initial flowtable bridge support

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

This series adds initial support for the flowtable bridge family.
The goal is to allow to set up a forwarding path between bridge ports
which is not possible with the existing infrastructure.

This series does not support for VLAN/PPPoe tagged packets circulating
in the bridge, ie. packets are seen untagged from the ingress path of
the bridge ports.

Note that this does not include bridge vlan filtering which needs
a nf_conntrack_bridge enhancement to support PPPoE/VLAN natively, so
I can keeping back those patches 

Patch #1 and #2 are preparation patches, not strictly necessary at
this stage but they will be needed once the flowtable bridge can handle
tagged PPPoE/VLAN.

Patch #3 adds the initial flowtable bridge supports. This intentional
adds a new dataplane for the flowtable bridge, which is more boilerplate
code, rather than tweaking the existing flowtable IP dataplane. This is
intentional, for maintainability and extensibility reasons. Similarly
a new flow_offload expression is added for the bridge family.

Comments welcome, thanks.

Pablo Neira Ayuso (3):
  net: pass net_device_path_ctx struct to dev_fill_forward_path()
  net: expose dev_fwd_path() helper via static inline
  netfilter: flowtable: initial bridge support

 include/linux/netdevice.h             |  13 ++-
 include/net/netfilter/nf_flow_table.h |   7 ++
 net/core/dev.c                        |  28 ++----
 net/netfilter/nf_flow_table_inet.c    |  12 +++
 net/netfilter/nf_flow_table_ip.c      | 134 ++++++++++++++++++++++++++
 net/netfilter/nf_flow_table_path.c    |  79 ++++++++++++++-
 net/netfilter/nft_flow_offload.c      |  88 ++++++++++++++++-
 7 files changed, 336 insertions(+), 25 deletions(-)

-- 
2.47.3