Re: [PATCH nf v2 1/2] netfilter: flowtable: fill the vlan key from the outermost tag only

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sun, Sep 13, 2026 at 12:42:50PM +0200, Julius Bairaktaris wrote:
> The else branch of the second encapsulation block stores encap[1] in
> the vlan key whenever the first block left it unfilled. The first
> block skips encap[0] when the switch strips it, and also when it is
> not 802.1Q. In the second case, an 802.1ad tag outside an 802.1Q tag,
> encap[0] is still the first tag on the frame and the key describes
> the inner tag as the outer one.

There are only checks for ETH_P_8021Q in this codepath, no 8021.ad.

> Store encap[1] in the vlan key only when encap[0] is stripped. The
> 802.1ad case then gets no vlan key, as a single 802.1ad tag does
> today. The action list is unchanged.

How does this work?

        if (tuple->encap_num > 0 && !(tuple->in_vlan_ingress & BIT(0)) &&
            tuple->encap[0].proto == htons(ETH_P_8021Q)) {

in this case, FLOW_DISSECTOR_KEY_VLAN is filled up using
tuple->encap[0].

On top of this:

        if (tuple->encap_num > 1 && !(tuple->in_vlan_ingress & BIT(1)) &&
            tuple->encap[1].proto == htons(ETH_P_8021Q)) {

in this case, FLOW_DISSECTOR_KEY_CVLAN should be fill up, if KEY_VLAN
was filled up.

> Fixes: 3e1b0c168f6c ("netfilter: flowtable: add vlan match offload support")
> Assisted-by: Claude:claude-fable-5-1
> Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
> ---
>  net/netfilter/nf_flow_table_offload.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
> index 801a3dd9ceea..19adc6c7725f 100644
> --- a/net/netfilter/nf_flow_table_offload.c
> +++ b/net/netfilter/nf_flow_table_offload.c
> @@ -137,7 +137,7 @@ static int nf_flow_rule_match(struct nf_flow_match *match,
>  			nf_flow_rule_vlan_match(&key->cvlan, &mask->cvlan,
>  						tuple->encap[1].id,
>  						tuple->encap[1].proto);
> -		} else {
> +		} else if (tuple->in_vlan_ingress & BIT(0)) {
>  			NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_VLAN,
>  					  vlan);
>  			nf_flow_rule_vlan_match(&key->vlan, &mask->vlan,
                        match->dissector.used_keys |=
                                BIT_ULL(FLOW_DISSECTOR_KEY_VLAN);

IIRC, in_vlan_ingress means "skip" because pvid has been hardware offload.

Why this new check for tuple->in_vlan_ingress & BIT(0)?