Re: [PATCH nf-next v7 1/2] netfilter: flowtable: tear down direct xmit flows when the fdb entry moves

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Oct 15, 2026 at 12:34:06PM +0200, Pablo Neira Ayuso wrote:
> On Thu, Oct 15, 2026 at 01:56:26AM +0200, Julius Bairaktaris wrote:
[...]
> > @@ -183,6 +185,11 @@ static int nft_dev_path_info(struct net_device_path_stack *stack,
> >  			case DEV_PATH_BR_VLAN_KEEP:
> >  				break;
> >  			}
> > +			/* dev_fill_forward_path() adds the bridge port after
> > +			 * the bridge.
> > +			 */
> > +			info->bridge_ifidx = stack->path[i + 1].dev->ifindex;
> > +			info->bridge_vid = path->bridge.vlan_id;
> 
> Why do we need this new bridge_vid field? This is stored in info->encaps.
> 
>                 case DEV_PATH_BR_VLAN_TAG:
>                                 if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX)
>                                         goto err_out;
>  
>                                 info->encap[info->num_encaps].id = path->bridge.vlan_id;
> 
> My understanding is that this is need to know if this vlan coming from
> bridge vlan filtering (not vlan device), but it is possible to track
> this in a local variable while walking over the path stack?

A new flag might be need, but there is room for new flags to annotate
this VLAN header came from bridge filter filtering, I understand
info->encap is not enough.

> >  			info->xmit_type = FLOW_OFFLOAD_XMIT_DIRECT;
> >  			break;
> >  		default: