* [PATCH nf-next] netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it
@ 2026-03-30 9:01 Pablo Neira Ayuso
2026-03-30 11:41 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2026-03-30 9:01 UTC (permalink / raw)
To: netfilter-devel
Add a new helper function to retrieve the next action entry in flow
rule, check if the maximum number of actions is reached, bail out in
such case.
Replace existing opencoded iteration on the action array by this
helper function.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_tables_offload.h | 10 ++++++++++
net/netfilter/nf_dup_netdev.c | 5 ++++-
net/netfilter/nft_immediate.c | 4 +++-
3 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/include/net/netfilter/nf_tables_offload.h b/include/net/netfilter/nf_tables_offload.h
index 3568b6a2f5f0..14c427891ee6 100644
--- a/include/net/netfilter/nf_tables_offload.h
+++ b/include/net/netfilter/nf_tables_offload.h
@@ -67,6 +67,16 @@ struct nft_flow_rule {
struct flow_rule *rule;
};
+static inline struct flow_action_entry *
+nft_flow_action_entry_next(struct nft_offload_ctx *ctx,
+ struct nft_flow_rule *flow)
+{
+ if (unlikely(ctx->num_actions >= flow->rule->action.num_entries))
+ return NULL;
+
+ return &flow->rule->action.entries[ctx->num_actions++];
+}
+
void nft_flow_rule_set_addr_type(struct nft_flow_rule *flow,
enum flow_dissector_key_id addr_type);
diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
index fab8b9011098..e348fb90b8dc 100644
--- a/net/netfilter/nf_dup_netdev.c
+++ b/net/netfilter/nf_dup_netdev.c
@@ -95,7 +95,10 @@ int nft_fwd_dup_netdev_offload(struct nft_offload_ctx *ctx,
if (!dev)
return -EOPNOTSUPP;
- entry = &flow->rule->action.entries[ctx->num_actions++];
+ entry = nft_flow_action_entry_next(ctx, flow);
+ if (!entry)
+ return -E2BIG;
+
entry->id = id;
entry->dev = dev;
diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
index 37c29947b380..0046baf44bdb 100644
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -279,7 +279,9 @@ static int nft_immediate_offload_verdict(struct nft_offload_ctx *ctx,
struct flow_action_entry *entry;
const struct nft_data *data;
- entry = &flow->rule->action.entries[ctx->num_actions++];
+ entry = nft_flow_action_entry_next(ctx, flow);
+ if (!entry)
+ return -E2BIG;
data = &priv->data;
switch (data->verdict.code) {
--
2.47.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH nf-next] netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it
@ 2026-03-30 9:04 Pablo Neira Ayuso
0 siblings, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2026-03-30 9:04 UTC (permalink / raw)
To: netfilter-devel
Add a new helper function to retrieve the next action entry in flow
rule, check if the maximum number of actions is reached, bail out in
such case.
Replace existing opencoded iteration on the action array by this
helper function.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/net/netfilter/nf_tables_offload.h | 10 ++++++++++
net/netfilter/nf_dup_netdev.c | 5 ++++-
net/netfilter/nft_immediate.c | 4 +++-
3 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/include/net/netfilter/nf_tables_offload.h b/include/net/netfilter/nf_tables_offload.h
index 3568b6a2f5f0..14c427891ee6 100644
--- a/include/net/netfilter/nf_tables_offload.h
+++ b/include/net/netfilter/nf_tables_offload.h
@@ -67,6 +67,16 @@ struct nft_flow_rule {
struct flow_rule *rule;
};
+static inline struct flow_action_entry *
+nft_flow_action_entry_next(struct nft_offload_ctx *ctx,
+ struct nft_flow_rule *flow)
+{
+ if (unlikely(ctx->num_actions >= flow->rule->action.num_entries))
+ return NULL;
+
+ return &flow->rule->action.entries[ctx->num_actions++];
+}
+
void nft_flow_rule_set_addr_type(struct nft_flow_rule *flow,
enum flow_dissector_key_id addr_type);
diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
index fab8b9011098..e348fb90b8dc 100644
--- a/net/netfilter/nf_dup_netdev.c
+++ b/net/netfilter/nf_dup_netdev.c
@@ -95,7 +95,10 @@ int nft_fwd_dup_netdev_offload(struct nft_offload_ctx *ctx,
if (!dev)
return -EOPNOTSUPP;
- entry = &flow->rule->action.entries[ctx->num_actions++];
+ entry = nft_flow_action_entry_next(ctx, flow);
+ if (!entry)
+ return -E2BIG;
+
entry->id = id;
entry->dev = dev;
diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
index 37c29947b380..0046baf44bdb 100644
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -279,7 +279,9 @@ static int nft_immediate_offload_verdict(struct nft_offload_ctx *ctx,
struct flow_action_entry *entry;
const struct nft_data *data;
- entry = &flow->rule->action.entries[ctx->num_actions++];
+ entry = nft_flow_action_entry_next(ctx, flow);
+ if (!entry)
+ return -E2BIG;
data = &priv->data;
switch (data->verdict.code) {
--
2.47.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH nf-next] netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it
2026-03-30 9:01 [PATCH nf-next] netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it Pablo Neira Ayuso
@ 2026-03-30 11:41 ` Pablo Neira Ayuso
0 siblings, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2026-03-30 11:41 UTC (permalink / raw)
To: netfilter-devel
On Mon, Mar 30, 2026 at 11:01:53AM +0200, Pablo Neira Ayuso wrote:
> Add a new helper function to retrieve the next action entry in flow
> rule, check if the maximum number of actions is reached, bail out in
> such case.
>
> Replace existing opencoded iteration on the action array by this
> helper function.
Same patch as before, apologies for this duplicate.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-03-30 11:41 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-30 9:01 [PATCH nf-next] netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it Pablo Neira Ayuso
2026-03-30 11:41 ` Pablo Neira Ayuso
-- strict thread matches above, loose matches on Subject: below --
2026-03-30 9:04 Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox