From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.netfilter.org (mail.netfilter.org [217.70.190.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E7324387566; Sun, 11 Oct 2026 22:00:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.70.190.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791756013; cv=none; b=jgdhI5Gjcgv8QYCUix1SW73WkIYCD9dqVjTUGXbYZ12nkgvqlMK7yj1uOV4cUreYcXTh1b2yrRjrAecEqP73UBjNeSEh18xIQTw654wRag0FWoTwXZrVf6WIR6CcP1HHalPB8Uv1vGfnOnd92cKBBuBcSWLKwMSEwjX+Lt/AXu0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791756013; c=relaxed/simple; bh=A9kZgHE2scmY+v2rdDO3Z1/7nGjf+47VsobztYm+Iqw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qFhMORamM5XGIcO9f1+xRk138KeTzK5qwHwFrMU67PjXY5u6NME4Vol9/0tD2PD1gN5cJsZgCrhdehx5GIEgXhzowGD26jfbwJR0T97vmnaHrgYmEV4vJSf3Z7wUgg1HfybmbggrM0joRyLKt+b8siLMewgENqNOwyEyEnYS/1U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=netfilter.org; spf=pass smtp.mailfrom=netfilter.org; dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org header.b=APACjN2a; arc=none smtp.client-ip=217.70.190.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=netfilter.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=netfilter.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org header.b="APACjN2a" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netfilter.org; s=2025; t=1791756008; bh=d9WYWY940g7yEDnX3O141nxk/3559kkBe7juBh3EJQg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=APACjN2abyO/yAEHPMoK0xbCg4E0hyN2dZH8NrdaaOzkwf+FuUr9BtVhgDVQXXTL6 hmiCVJcXn+S7jWKypzfZ0CSGuR58Fz1HrRLnODeAg9iCPUVo+rgAO7LXSvHk3ELN4Z NJUABTBhBcToJOmWpvtTMbqf9uZivNTWbBOXZ3To1jEZncqKtWMlVxALMQd4zcQ9FP xJ46mSpA19zpppIObln2KTUFOU2BxjqU4IJF91K6iB22l/U4yclD67WE9ByZKm+ld6 ywczHhUYrosXI+MIt7ZjIaZK4ZpQu6AN7B5BotDLBp+tp+u+Xj1pjE6B5Lq1V1NJDw SZnsGV8kEZihA== Received: from localhost.localdomain (mail-agni [217.70.190.124]) by mail.netfilter.org (Postfix) with ESMTPSA id 8EE4060060; Mon, 12 Oct 2026 00:00:07 +0200 (CEST) From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, netdev@vger.kernel.org, kuba@kernel.org, pabeni@redhat.com, edumazet@kernel.org, horms@kernel.org, fw@strlen.de, ja@ssi.bg Subject: [PATCH net-next 06/15] netfilter: flowtable: refactor MTU check for tunnel offload Date: Sun, 11 Oct 2026 23:59:44 +0200 Message-ID: <20261011215953.1334630-7-pablo@netfilter.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261011215953.1334630-1-pablo@netfilter.org> References: <20261011215953.1334630-1-pablo@netfilter.org> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Lorenzo Bianconi Introduce nf_flow_offload_check_mtu() helper and use the encapsulated protocol (tun.encap_proto) to compute the tunnel overhead instead of relying on tun_num, so the correct inner header size (IPv4 vs IPv6) is accounted for. Use it in both the IPv4 and IPv6 forward paths. This is a preliminary patch to support IPv4 over IPv6 and SIT flowtable tunnel offload. Please note IPv4 over IPv6 and SIT tunnel flowtable offloading is not enabled yet. Signed-off-by: Lorenzo Bianconi Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_flow_table_ip.c | 41 ++++++++++++++++++++++---------- 1 file changed, 29 insertions(+), 12 deletions(-) diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 1b9360d54dfc..96dbdadba4e7 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -472,6 +472,31 @@ nf_flow_offload_lookup(struct nf_flowtable_ctx *ctx, return flow_offload_lookup(flow_table, &tuple); } +static int nf_flow_offload_check_mtu(struct nf_flowtable_ctx *ctx, + struct flow_offload *flow, + enum flow_offload_tuple_dir dir, + struct sk_buff *skb) +{ + unsigned int mtu; + + mtu = flow->tuplehash[dir].tuple.mtu + ctx->offset; + switch (flow->tuplehash[!dir].tuple.tun.encap_proto) { + case AF_INET: + mtu -= sizeof(struct iphdr); + break; + case AF_INET6: + mtu -= sizeof(struct ipv6hdr); + break; + default: + break; + } + + if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) + return -EINVAL; + + return 0; +} + static int nf_flow_offload_forward(struct nf_flowtable_ctx *ctx, struct nf_flowtable *flow_table, struct flow_offload_tuple_rhash *tuplehash, @@ -479,17 +504,13 @@ static int nf_flow_offload_forward(struct nf_flowtable_ctx *ctx, { enum flow_offload_tuple_dir dir; struct flow_offload *flow; - unsigned int thoff, mtu; + unsigned int thoff; struct iphdr *iph; dir = tuplehash->tuple.dir; flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); - mtu = flow->tuplehash[dir].tuple.mtu + ctx->offset; - if (flow->tuplehash[!dir].tuple.tun_num) - mtu -= sizeof(*iph); - - if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) + if (nf_flow_offload_check_mtu(ctx, flow, dir, skb)) return 0; iph = (struct iphdr *)(skb_network_header(skb) + ctx->offset); @@ -1075,17 +1096,13 @@ static int nf_flow_offload_ipv6_forward(struct nf_flowtable_ctx *ctx, { enum flow_offload_tuple_dir dir; struct flow_offload *flow; - unsigned int thoff, mtu; struct ipv6hdr *ip6h; + unsigned int thoff; dir = tuplehash->tuple.dir; flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); - mtu = flow->tuplehash[dir].tuple.mtu + ctx->offset; - if (flow->tuplehash[!dir].tuple.tun_num) - mtu -= sizeof(*ip6h); - - if (unlikely(nf_flow_exceeds_mtu(skb, mtu))) + if (nf_flow_offload_check_mtu(ctx, flow, dir, skb)) return 0; ip6h = (struct ipv6hdr *)(skb_network_header(skb) + ctx->offset); -- 2.47.3