Re: [PATCH net-next,v2 00/16] Netfilter updates for net-next

[Paolo Abeni <pabeni@redhat.com>]

On 11/26/25 9:55 PM, Pablo Neira Ayuso wrote:
> v2: - Move ifidx to avoid adding a hole, per Eric Dumazet.
>     - Update pppoe xmit inline patch description, per Qingfang Deng.
> 
> -o-
> 
> Hi,
> 
> The following batch contains Netfilter updates for net-next:
>  
> 1) Move the flowtable path discovery code to its own file, the
>    nft_flow_offload.c mixes the nf_tables evaluation with the path
>    discovery logic, just split this in two for clarity.
>  
> 2) Consolidate flowtable xmit path by using dev_queue_xmit() and the
>    real device behind the layer 2 vlan/pppoe device. This allows to
>    inline encapsulation. After this update, hw_ifidx can be removed
>    since both ifidx and hw_ifidx now point to the same device.
>  
> 3) Support for IPIP encapsulation in the flowtable, extend selftest
>    to cover for this new layer 3 offload, from Lorenzo Bianconi.
>  
> 4) Push down the skb into the conncount API to fix duplicates in the
>    conncount list for packets with non-confirmed conntrack entries,
>    this is due to an optimization introduced in d265929930e2
>    ("netfilter: nf_conncount: reduce unnecessary GC").
>    From Fernando Fernandez Mancera.
>  
> 5) In conncount, disable BH when performing garbage collection 
>    to consolidate existing behaviour in the conncount API, also
>    from Fernando.
>  
> 6) A matching packet with a confirmed conntrack invokes GC if
>    conncount reaches the limit in an attempt to release slots.
>    This allows the existing extensions to be used for real conntrack
>    counting, not just limiting new connections, from Fernando.
>  
> 7) Support for updating ct count objects in nf_tables, from Fernando.
>  
> 8) Extend nft_flowtables.sh selftest to send IPv6 TCP traffic,
>    from Lorenzo Bianconi.
>  
> 9) Fixes for UAPI kernel-doc documentation, from Randy Dunlap.
> 
> Please, pull these changes from:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git nf-next-25-11-26
> 
> Thanks.

The AI review tool found a few possible issue on this PR:

https://netdev-ai.bots.linux.dev/ai-review.html?id=fd5a6706-c2f8-4cf2-a220-0c01492fdb90

I'm still digging the report, but I think that at least first item
reported (possibly wrong ifidx used in nf_flow_offload_ipv6_hook() by
patch "netfilter: flowtable: consolidate xmit path") makes sense.

I *think* that at least for that specific point it would be better to
follow-up on net (as opposed to a v3 and possibly miss the cycle), but
could you please have a look at that report, too?

Thanks,

Paolo