From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.netfilter.org (mail.netfilter.org [217.70.190.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3582D31717D; Sun, 18 Oct 2026 00:57:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.70.190.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792285028; cv=none; b=tRctSHkSxUj/vc6JhrNDZRFz2XLjWwQx0AFnNHIECmC5g97eENv5Ta2zgQutwHikO2/0W8dJr8h5kLDqmlQ9ec9bdq+Leta0TWXA2npByMJcSbUgP4oj/FswTDRkyYvef08UrnT2nHRsHB+/aLtvqN1leMMiM+bO6m5K6nLvZeY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792285028; c=relaxed/simple; bh=c0X8scIxgBiBoFLKEotCXBzvHlZu7hchb1pOsCERDi0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=SWdsNRH28TbBSODGHO4PhLAbgMuzRC+ABX1CMqdTUv66EEaR4IcMuPe0e5LFcn7knI2uNiGmHXUTJtyt/4qVsrx7anBy/5FIruHXszYQL1kNJaiLc2fzb7EXX4VfS6XTLwNHvaQ7xOcsOH/ieavS0AixoLpNOw5L+rACGQkheuE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=netfilter.org; spf=pass smtp.mailfrom=netfilter.org; dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org header.b=VtA+b4m7; arc=none smtp.client-ip=217.70.190.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=netfilter.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=netfilter.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org header.b="VtA+b4m7" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netfilter.org; s=2025; t=1792285024; bh=VRlGnmSw0Qyg1o8Sdz1Eo8q6cxmKA/BI113bnJmhlYE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VtA+b4m7dy5JG7amnK3zi2tiKLTWMfEU2eiUYII+bZlK5R866EG0+m360Q5Q+2J5q beTiaFwYV3zOmM16/D0xxgmXNN1z2ILhtHLWB9+txyl/ObjhYbuk93beVye4g2yiTM qUTx06863bXtOA+vOAfhbnY4pzSCDCdGtxP+ika9Zuqx9Xnby2TAUWxa8j9HQmtrE0 V8lri8Nk87kEyXtv0orIt7JRsyfBRN2SyV94xxKe7paTF1kt61UAKk9px+LFGS/YnA 8N1I+76hPHInhRPTTHL5Rnqntlj2h+Haxwy0jjLeNCFjwjgPCwzculKKqq1brY+vbS DrQBpEtpOtt2g== Received: from localhost.localdomain (mail-agni [217.70.190.124]) by mail.netfilter.org (Postfix) with ESMTPSA id 0983160085; Sun, 18 Oct 2026 02:57:03 +0200 (CEST) From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, netdev@vger.kernel.org, kuba@kernel.org, pabeni@redhat.com, edumazet@kernel.org, horms@kernel.org, fw@strlen.de, ja@ssi.bg Subject: [PATCH net-next 13/15] netfilter: flowtable: populate tunnel tuple regardless of inner protocol Date: Sun, 18 Oct 2026 02:56:36 +0200 Message-ID: <20261018005638.1776148-14-pablo@netfilter.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261018005638.1776148-1-pablo@netfilter.org> References: <20261018005638.1776148-1-pablo@netfilter.org> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Lorenzo Bianconi Store the outer tunnel addresses and inner protocol in the flow tuple unconditionally in nf_flow_tuple_encap(), instead of only when the tunnel is IP-in-IP or IPv6-in-IPv6. Bail out early when the inner protocol is neither IPPROTO_IPIP nor IPPROTO_IPV6. This makes the tuple usable for cross-family tunnels such as IPv4-over-IPv6 and SIT, where the inner protocol differs from the outer address family. This is a preliminary patch to support IPv4 over IPv6 and SIT tunnel flowtable offload. Please note IPv4 over IPv6 and SIT tunnel flowtable offloading is not enabled yet. Signed-off-by: Lorenzo Bianconi Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_flow_table_ip.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 29d1a9f4a362..8379b45b2dad 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -189,22 +189,22 @@ static void nf_flow_tuple_encap(struct nf_flowtable_ctx *ctx, break; } + if (ctx->tun.inner_proto != IPPROTO_IPIP && + ctx->tun.inner_proto != IPPROTO_IPV6) + return; + switch (ctx->ether_type) { case htons(ETH_P_IP): iph = (struct iphdr *)(skb_network_header(skb) + offset); - if (ctx->tun.inner_proto == IPPROTO_IPIP) { - tuple->tun.dst_v4.s_addr = iph->daddr; - tuple->tun.src_v4.s_addr = iph->saddr; - tuple->tun.inner_proto = IPPROTO_IPIP; - } + tuple->tun.dst_v4.s_addr = iph->daddr; + tuple->tun.src_v4.s_addr = iph->saddr; + tuple->tun.inner_proto = ctx->tun.inner_proto; break; case htons(ETH_P_IPV6): ip6h = (struct ipv6hdr *)(skb_network_header(skb) + offset); - if (ctx->tun.inner_proto == IPPROTO_IPV6) { - tuple->tun.dst_v6 = ip6h->daddr; - tuple->tun.src_v6 = ip6h->saddr; - tuple->tun.inner_proto = IPPROTO_IPV6; - } + tuple->tun.dst_v6 = ip6h->daddr; + tuple->tun.src_v6 = ip6h->saddr; + tuple->tun.inner_proto = ctx->tun.inner_proto; break; default: break; -- 2.47.3