* [PATCH nf-next,v2 2/5] netfilter: flowtable: consolidate flowtable device check
2026-07-27 11:59 [PATCH nf-next,v2 1/5] netfilter: flowtable: consolidate net_device field in nft_forward_info struct Pablo Neira Ayuso
@ 2026-07-27 11:59 ` Pablo Neira Ayuso
2026-07-27 11:59 ` [PATCH nf-next,v2 3/5] net: do not advance stack index from dev_fwd_path() Pablo Neira Ayuso
` (2 subsequent siblings)
3 siblings, 0 replies; 7+ messages in thread
From: Pablo Neira Ayuso @ 2026-07-27 11:59 UTC (permalink / raw)
To: netfilter-devel; +Cc: lorenzo
Check that device belongs to the flowtable right after the flowtable
discovery path. This is a preparation patch to obtain the dst entry
from the .fill_forward_path in tunnels.
No functional changes are intended.
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v2: no changes
net/netfilter/nf_flow_table_path.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/nf_flow_table_path.c b/net/netfilter/nf_flow_table_path.c
index 261bb44d08eb..8f04a4487897 100644
--- a/net/netfilter/nf_flow_table_path.c
+++ b/net/netfilter/nf_flow_table_path.c
@@ -90,9 +90,12 @@ struct nft_forward_info {
enum flow_offload_xmit_type xmit_type;
};
+static bool nft_flowtable_find_dev(const struct net_device *dev,
+ struct nft_flowtable *ft);
+
static int nft_dev_path_info(const struct net_device_path_stack *stack,
struct nft_forward_info *info,
- unsigned char *ha, struct nf_flowtable *flowtable)
+ unsigned char *ha, struct nft_flowtable *ft)
{
const struct net_device_path *path;
int i;
@@ -178,10 +181,13 @@ static int nft_dev_path_info(const struct net_device_path_stack *stack,
}
}
- if (nf_flowtable_hw_offload(flowtable) &&
+ if (nf_flowtable_hw_offload(&ft->data) &&
nft_is_valid_ether_device(info->dev))
info->xmit_type = FLOW_OFFLOAD_XMIT_DIRECT;
+ if (!nft_flowtable_find_dev(info->dev, ft))
+ return -1;
+
return 0;
}
@@ -253,10 +259,7 @@ static int nft_dev_forward_path(const struct nft_pktinfo *pkt,
int i;
if (nft_dev_fill_forward_path(dst, ct, dir, ha, &stack) < 0 ||
- nft_dev_path_info(&stack, &info, ha, &ft->data) < 0)
- return -ENOENT;
-
- if (!nft_flowtable_find_dev(info.dev, ft))
+ nft_dev_path_info(&stack, &info, ha, ft) < 0)
return -ENOENT;
route->tuple[!dir].in.ifindex = info.dev->ifindex;
--
2.47.3
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH nf-next,v2 3/5] net: do not advance stack index from dev_fwd_path()
2026-07-27 11:59 [PATCH nf-next,v2 1/5] netfilter: flowtable: consolidate net_device field in nft_forward_info struct Pablo Neira Ayuso
2026-07-27 11:59 ` [PATCH nf-next,v2 2/5] netfilter: flowtable: consolidate flowtable device check Pablo Neira Ayuso
@ 2026-07-27 11:59 ` Pablo Neira Ayuso
2026-07-27 12:42 ` Lorenzo Bianconi
2026-07-27 11:59 ` [PATCH nf-next,v2 4/5] net: pass dst via net_device_path in dev_fill_forward_path() Pablo Neira Ayuso
2026-07-27 11:59 ` [PATCH nf-next,v2 5/5] netfilter: flowtable: release tunnel route on error when building forward path Pablo Neira Ayuso
3 siblings, 1 reply; 7+ messages in thread
From: Pablo Neira Ayuso @ 2026-07-27 11:59 UTC (permalink / raw)
To: netfilter-devel; +Cc: lorenzo
Update stack index from dev_fill_forward_path() instead, once the
forward path slot has been populated.
Adjust existing drivers that recycle dev_fill_forward_path() as a
way to reach the mtk SoC WDMA info.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v2: new in this series to address sashiko report on possible access
to uninitialized path in stack in case tunnel route reference
need to be dropped.
drivers/net/ethernet/airoha/airoha_ppe.c | 2 +-
drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 2 +-
net/core/dev.c | 6 ++++--
3 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/airoha/airoha_ppe.c b/drivers/net/ethernet/airoha/airoha_ppe.c
index e4c3644dd6ec..72755ca974fa 100644
--- a/drivers/net/ethernet/airoha/airoha_ppe.c
+++ b/drivers/net/ethernet/airoha/airoha_ppe.c
@@ -292,7 +292,7 @@ static int airoha_ppe_get_wdma_info(struct net_device *dev, const u8 *addr,
if (err)
return err;
- path = &stack.path[stack.num_paths - 1];
+ path = &stack.path[stack.num_paths];
if (path->type != DEV_PATH_MTK_WDMA)
return -EINVAL;
diff --git a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
index cc8c4ef8038f..7dab360b8be3 100644
--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
@@ -107,7 +107,7 @@ mtk_flow_get_wdma_info(struct net_device *dev, const u8 *addr, struct mtk_wdma_i
if (err)
return err;
- path = &stack.path[stack.num_paths - 1];
+ path = &stack.path[stack.num_paths];
if (path->type != DEV_PATH_MTK_WDMA)
return -1;
diff --git a/net/core/dev.c b/net/core/dev.c
index c1c1be1a6962..ca65d1dcd604 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -742,9 +742,9 @@ EXPORT_SYMBOL_GPL(dev_fill_metadata_dst);
static struct net_device_path *dev_fwd_path(struct net_device_path_stack *stack)
{
- int k = stack->num_paths++;
+ int k = stack->num_paths;
- if (k >= NET_DEVICE_PATH_STACK_MAX)
+ if (k + 1 >= NET_DEVICE_PATH_STACK_MAX)
return NULL;
return &stack->path[k];
@@ -773,6 +773,7 @@ int dev_fill_forward_path(const struct net_device *dev, const u8 *daddr,
if (ret < 0)
return -1;
+ stack->num_paths++;
if (WARN_ON_ONCE(last_dev == ctx.dev))
return -1;
}
@@ -785,6 +786,7 @@ int dev_fill_forward_path(const struct net_device *dev, const u8 *daddr,
return -1;
path->type = DEV_PATH_ETHERNET;
path->dev = ctx.dev;
+ stack->num_paths++;
return ret;
}
--
2.47.3
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH nf-next,v2 3/5] net: do not advance stack index from dev_fwd_path()
2026-07-27 11:59 ` [PATCH nf-next,v2 3/5] net: do not advance stack index from dev_fwd_path() Pablo Neira Ayuso
@ 2026-07-27 12:42 ` Lorenzo Bianconi
2026-07-27 14:25 ` Pablo Neira Ayuso
0 siblings, 1 reply; 7+ messages in thread
From: Lorenzo Bianconi @ 2026-07-27 12:42 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
[-- Attachment #1: Type: text/plain, Size: 2962 bytes --]
> Update stack index from dev_fill_forward_path() instead, once the
> forward path slot has been populated.
>
> Adjust existing drivers that recycle dev_fill_forward_path() as a
> way to reach the mtk SoC WDMA info.
>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
> ---
> v2: new in this series to address sashiko report on possible access
> to uninitialized path in stack in case tunnel route reference
> need to be dropped.
>
> drivers/net/ethernet/airoha/airoha_ppe.c | 2 +-
> drivers/net/ethernet/mediatek/mtk_ppe_offload.c | 2 +-
> net/core/dev.c | 6 ++++--
> 3 files changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/net/ethernet/airoha/airoha_ppe.c b/drivers/net/ethernet/airoha/airoha_ppe.c
> index e4c3644dd6ec..72755ca974fa 100644
> --- a/drivers/net/ethernet/airoha/airoha_ppe.c
> +++ b/drivers/net/ethernet/airoha/airoha_ppe.c
> @@ -292,7 +292,7 @@ static int airoha_ppe_get_wdma_info(struct net_device *dev, const u8 *addr,
> if (err)
> return err;
>
> - path = &stack.path[stack.num_paths - 1];
> + path = &stack.path[stack.num_paths];
> if (path->type != DEV_PATH_MTK_WDMA)
> return -EINVAL;
>
> diff --git a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
> index cc8c4ef8038f..7dab360b8be3 100644
> --- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
> +++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
> @@ -107,7 +107,7 @@ mtk_flow_get_wdma_info(struct net_device *dev, const u8 *addr, struct mtk_wdma_i
> if (err)
> return err;
>
> - path = &stack.path[stack.num_paths - 1];
> + path = &stack.path[stack.num_paths];
> if (path->type != DEV_PATH_MTK_WDMA)
> return -1;
>
> diff --git a/net/core/dev.c b/net/core/dev.c
> index c1c1be1a6962..ca65d1dcd604 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -742,9 +742,9 @@ EXPORT_SYMBOL_GPL(dev_fill_metadata_dst);
>
> static struct net_device_path *dev_fwd_path(struct net_device_path_stack *stack)
> {
> - int k = stack->num_paths++;
> + int k = stack->num_paths;
>
> - if (k >= NET_DEVICE_PATH_STACK_MAX)
> + if (k + 1 >= NET_DEVICE_PATH_STACK_MAX)
nit: do we really need k in this case? (ignore the comment if you do not
need to repost).
Regards,
Lorenzo
> return NULL;
>
> return &stack->path[k];
> @@ -773,6 +773,7 @@ int dev_fill_forward_path(const struct net_device *dev, const u8 *daddr,
> if (ret < 0)
> return -1;
>
> + stack->num_paths++;
> if (WARN_ON_ONCE(last_dev == ctx.dev))
> return -1;
> }
> @@ -785,6 +786,7 @@ int dev_fill_forward_path(const struct net_device *dev, const u8 *daddr,
> return -1;
> path->type = DEV_PATH_ETHERNET;
> path->dev = ctx.dev;
> + stack->num_paths++;
>
> return ret;
> }
> --
> 2.47.3
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH nf-next,v2 3/5] net: do not advance stack index from dev_fwd_path()
2026-07-27 12:42 ` Lorenzo Bianconi
@ 2026-07-27 14:25 ` Pablo Neira Ayuso
0 siblings, 0 replies; 7+ messages in thread
From: Pablo Neira Ayuso @ 2026-07-27 14:25 UTC (permalink / raw)
To: Lorenzo Bianconi; +Cc: netfilter-devel
On Mon, Jul 27, 2026 at 02:42:19PM +0200, Lorenzo Bianconi wrote:
[...]
> > diff --git a/net/core/dev.c b/net/core/dev.c
> > index c1c1be1a6962..ca65d1dcd604 100644
> > --- a/net/core/dev.c
> > +++ b/net/core/dev.c
> > @@ -742,9 +742,9 @@ EXPORT_SYMBOL_GPL(dev_fill_metadata_dst);
> >
> > static struct net_device_path *dev_fwd_path(struct net_device_path_stack *stack)
> > {
> > - int k = stack->num_paths++;
> > + int k = stack->num_paths;
> >
> > - if (k >= NET_DEVICE_PATH_STACK_MAX)
> > + if (k + 1 >= NET_DEVICE_PATH_STACK_MAX)
>
> nit: do we really need k in this case? (ignore the comment if you do not
> need to repost).
Yes, I can do that. I will have to repost anyway, sashiko did not kick in.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH nf-next,v2 4/5] net: pass dst via net_device_path in dev_fill_forward_path()
2026-07-27 11:59 [PATCH nf-next,v2 1/5] netfilter: flowtable: consolidate net_device field in nft_forward_info struct Pablo Neira Ayuso
2026-07-27 11:59 ` [PATCH nf-next,v2 2/5] netfilter: flowtable: consolidate flowtable device check Pablo Neira Ayuso
2026-07-27 11:59 ` [PATCH nf-next,v2 3/5] net: do not advance stack index from dev_fwd_path() Pablo Neira Ayuso
@ 2026-07-27 11:59 ` Pablo Neira Ayuso
2026-07-27 11:59 ` [PATCH nf-next,v2 5/5] netfilter: flowtable: release tunnel route on error when building forward path Pablo Neira Ayuso
3 siblings, 0 replies; 7+ messages in thread
From: Pablo Neira Ayuso @ 2026-07-27 11:59 UTC (permalink / raw)
To: netfilter-devel; +Cc: lorenzo
Add dst_entry to tunnel device path, this will allow us to remove
a duplicated route lookup.
This is a preparation patch to retrieve the tunnel route directly
from the .fill_forward_path. This new dst_entry in the tunnel will be
used by a follow up patch.
Since dst_release() works fine on NULL interface, this is still
noop until the flowtable starts using this.
Add a new dev_fill_forward_path_release() function to drop the refcount
on the tunnel device route, in case of error out. Export it so it can be
use in case of error out, to drop the refcount on the tunnel route at a
later stage.
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v2: - move dst field in net_device_path at the beginning of tun field per Lorenzo
- fix dev_fill_forward_path_release() initial index value
- remove useless ret assignment per Lorenzo
include/linux/netdevice.h | 2 ++
net/core/dev.c | 36 +++++++++++++++++++++++++++++++-----
2 files changed, 33 insertions(+), 5 deletions(-)
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 8db25b79573e..62cfad7e6b79 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -892,6 +892,7 @@ struct net_device_path {
u8 h_dest[ETH_ALEN];
} encap;
struct {
+ struct dst_entry *dst;
union {
struct in_addr src_v4;
struct in6_addr src_v6;
@@ -3427,6 +3428,7 @@ int dev_get_iflink(const struct net_device *dev);
int dev_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb);
int dev_fill_forward_path(const struct net_device *dev, const u8 *daddr,
struct net_device_path_stack *stack);
+void dev_fill_forward_path_release(struct net_device_path_stack *stack);
struct net_device *dev_get_by_name(struct net *net, const char *name);
struct net_device *dev_get_by_name_rcu(struct net *net, const char *name);
struct net_device *__dev_get_by_name(struct net *net, const char *name);
diff --git a/net/core/dev.c b/net/core/dev.c
index ca65d1dcd604..b6e3700b674f 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -750,6 +750,27 @@ static struct net_device_path *dev_fwd_path(struct net_device_path_stack *stack)
return &stack->path[k];
}
+void dev_fill_forward_path_release(struct net_device_path_stack *stack)
+{
+ struct net_device_path *path;
+ int k;
+
+ if (stack->num_paths == 0)
+ return;
+
+ for (k = stack->num_paths - 1; k >= 0; k--) {
+ path = &stack->path[k];
+ switch (path->type) {
+ case DEV_PATH_TUN:
+ dst_release(path->tun.dst);
+ break;
+ default:
+ break;
+ }
+ }
+}
+EXPORT_SYMBOL_GPL(dev_fill_forward_path_release);
+
int dev_fill_forward_path(const struct net_device *dev, const u8 *daddr,
struct net_device_path_stack *stack)
{
@@ -766,16 +787,16 @@ int dev_fill_forward_path(const struct net_device *dev, const u8 *daddr,
last_dev = ctx.dev;
path = dev_fwd_path(stack);
if (!path)
- return -1;
+ goto err_out;
memset(path, 0, sizeof(struct net_device_path));
ret = ctx.dev->netdev_ops->ndo_fill_forward_path(&ctx, path);
if (ret < 0)
- return -1;
+ goto err_out;
stack->num_paths++;
if (WARN_ON_ONCE(last_dev == ctx.dev))
- return -1;
+ goto err_out;
}
if (!ctx.dev)
@@ -783,12 +804,17 @@ int dev_fill_forward_path(const struct net_device *dev, const u8 *daddr,
path = dev_fwd_path(stack);
if (!path)
- return -1;
+ goto err_out;
+
path->type = DEV_PATH_ETHERNET;
path->dev = ctx.dev;
stack->num_paths++;
- return ret;
+ return 0;
+err_out:
+ dev_fill_forward_path_release(stack);
+
+ return -1;
}
EXPORT_SYMBOL_GPL(dev_fill_forward_path);
--
2.47.3
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH nf-next,v2 5/5] netfilter: flowtable: release tunnel route on error when building forward path
2026-07-27 11:59 [PATCH nf-next,v2 1/5] netfilter: flowtable: consolidate net_device field in nft_forward_info struct Pablo Neira Ayuso
` (2 preceding siblings ...)
2026-07-27 11:59 ` [PATCH nf-next,v2 4/5] net: pass dst via net_device_path in dev_fill_forward_path() Pablo Neira Ayuso
@ 2026-07-27 11:59 ` Pablo Neira Ayuso
3 siblings, 0 replies; 7+ messages in thread
From: Pablo Neira Ayuso @ 2026-07-27 11:59 UTC (permalink / raw)
To: netfilter-devel; +Cc: lorenzo
nft_flow_tunnel_update_route() can lazy fail, leaving an incomplete
forward path set ip. The route lookup also happens twice, once from
dev_fill_forward_path() and again in this aforementioned function.
Update ipip and ip6ip6 not to release the dst_entry and pass it on
via the tunnel forward path information.
In case of failure when setting up the forwarding path, release the
tunnel dst that was provided via dev_fill_forward_path().
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v2: - fix missing dst_release() call in v6.
- use dev_fill_forward_path_release() in err_out path.
net/ipv4/ipip.c | 2 +-
net/ipv6/ip6_tunnel.c | 4 +-
net/netfilter/nf_flow_table_path.c | 65 ++++++++----------------------
3 files changed, 21 insertions(+), 50 deletions(-)
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index d1aa048a6099..0a4fa1351dd7 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -370,10 +370,10 @@ static int ipip_fill_forward_path(struct net_device_path_ctx *ctx,
path->tun.src_v4.s_addr = tiph->saddr;
path->tun.dst_v4.s_addr = tiph->daddr;
path->tun.l3_proto = IPPROTO_IPIP;
+ path->tun.dst = &rt->dst;
path->dev = ctx->dev;
ctx->dev = rt->dst.dev;
-- ip_rt_put(rt);
return 0;
}
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index bf8e40af60b0..82eeed183001 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1864,12 +1864,14 @@ static int ip6_tnl_fill_forward_path(struct net_device_path_ctx *ctx,
path->tun.src_v6 = t->parms.laddr;
path->tun.dst_v6 = t->parms.raddr;
path->tun.l3_proto = IPPROTO_IPV6;
+ path->tun.dst = dst;
path->dev = ctx->dev;
ctx->dev = dst->dev;
}
err = dst->error;
- dst_release(dst);
+ if (err)
+ dst_release(dst);
return err;
}
diff --git a/net/netfilter/nf_flow_table_path.c b/net/netfilter/nf_flow_table_path.c
index 8f04a4487897..9a00fe99a50d 100644
--- a/net/netfilter/nf_flow_table_path.c
+++ b/net/netfilter/nf_flow_table_path.c
@@ -82,6 +82,7 @@ struct nft_forward_info {
} encap[NF_FLOW_TABLE_ENCAP_MAX];
u8 num_encaps;
struct flow_offload_tunnel tun;
+ struct dst_entry *tun_dst;
u8 num_tuns;
u8 ingress_vlans;
u8 h_source[ETH_ALEN];
@@ -93,7 +94,7 @@ struct nft_forward_info {
static bool nft_flowtable_find_dev(const struct net_device *dev,
struct nft_flowtable *ft);
-static int nft_dev_path_info(const struct net_device_path_stack *stack,
+static int nft_dev_path_info(struct net_device_path_stack *stack,
struct nft_forward_info *info,
unsigned char *ha, struct nft_flowtable *ft)
{
@@ -124,15 +125,16 @@ static int nft_dev_path_info(const struct net_device_path_stack *stack,
/* DEV_PATH_VLAN, DEV_PATH_PPPOE and DEV_PATH_TUN */
if (path->type == DEV_PATH_TUN) {
if (info->num_tuns)
- return -1;
+ goto err_out;
info->tun.src_v6 = path->tun.src_v6;
info->tun.dst_v6 = path->tun.dst_v6;
info->tun.l3_proto = path->tun.l3_proto;
+ info->tun_dst = path->tun.dst;
info->num_tuns++;
} else {
if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX)
- return -1;
+ goto err_out;
info->encap[info->num_encaps].id =
path->encap.id;
@@ -153,13 +155,13 @@ static int nft_dev_path_info(const struct net_device_path_stack *stack,
switch (path->bridge.vlan_mode) {
case DEV_PATH_BR_VLAN_UNTAG_HW:
if (info->num_encaps == 0)
- return -1;
+ goto err_out;
info->ingress_vlans |= BIT(info->num_encaps - 1);
break;
case DEV_PATH_BR_VLAN_TAG:
if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX)
- return -1;
+ goto err_out;
info->encap[info->num_encaps].id = path->bridge.vlan_id;
info->encap[info->num_encaps].proto = path->bridge.vlan_proto;
@@ -167,7 +169,7 @@ static int nft_dev_path_info(const struct net_device_path_stack *stack,
break;
case DEV_PATH_BR_VLAN_UNTAG:
if (info->num_encaps == 0)
- return -1;
+ goto err_out;
info->num_encaps--;
break;
@@ -177,7 +179,7 @@ static int nft_dev_path_info(const struct net_device_path_stack *stack,
info->xmit_type = FLOW_OFFLOAD_XMIT_DIRECT;
break;
default:
- return -1;
+ goto err_out;
}
}
@@ -186,9 +188,13 @@ static int nft_dev_path_info(const struct net_device_path_stack *stack,
info->xmit_type = FLOW_OFFLOAD_XMIT_DIRECT;
if (!nft_flowtable_find_dev(info->dev, ft))
- return -1;
+ goto err_out;
return 0;
+err_out:
+ dev_fill_forward_path_release(stack);
+
+ return -1;
}
static bool nft_flowtable_find_dev(const struct net_device *dev,
@@ -208,44 +214,6 @@ static bool nft_flowtable_find_dev(const struct net_device *dev,
return found;
}
-static int nft_flow_tunnel_update_route(const struct nft_pktinfo *pkt,
- struct flow_offload_tunnel *tun,
- struct nf_flow_route *route,
- enum ip_conntrack_dir dir)
-{
- struct dst_entry *cur_dst = route->tuple[dir].dst;
- struct dst_entry *tun_dst = NULL;
- struct flowi fl = {};
-
- switch (nft_pf(pkt)) {
- case NFPROTO_IPV4:
- fl.u.ip4.daddr = tun->dst_v4.s_addr;
- fl.u.ip4.saddr = tun->src_v4.s_addr;
- fl.u.ip4.flowi4_iif = nft_in(pkt)->ifindex;
- fl.u.ip4.flowi4_dscp = ip4h_dscp(ip_hdr(pkt->skb));
- fl.u.ip4.flowi4_mark = pkt->skb->mark;
- fl.u.ip4.flowi4_flags = FLOWI_FLAG_ANYSRC;
- break;
- case NFPROTO_IPV6:
- fl.u.ip6.daddr = tun->dst_v6;
- fl.u.ip6.saddr = tun->src_v6;
- fl.u.ip6.flowi6_iif = nft_in(pkt)->ifindex;
- fl.u.ip6.flowlabel = ip6_flowinfo(ipv6_hdr(pkt->skb));
- fl.u.ip6.flowi6_mark = pkt->skb->mark;
- fl.u.ip6.flowi6_flags = FLOWI_FLAG_ANYSRC;
- break;
- }
-
- nf_route(nft_net(pkt), &tun_dst, &fl, false, nft_pf(pkt));
- if (!tun_dst)
- return -ENOENT;
-
- route->tuple[dir].dst = tun_dst;
- dst_release(cur_dst);
-
- return 0;
-}
-
static int nft_dev_forward_path(const struct nft_pktinfo *pkt,
struct nf_flow_route *route,
const struct nf_conn *ct,
@@ -270,12 +238,13 @@ static int nft_dev_forward_path(const struct nft_pktinfo *pkt,
route->tuple[!dir].in.encap[i].proto = info.encap[i].proto;
}
- if (info.num_tuns &&
- !nft_flow_tunnel_update_route(pkt, &info.tun, route, dir)) {
+ if (info.num_tuns) {
route->tuple[!dir].in.tun.src_v6 = info.tun.dst_v6;
route->tuple[!dir].in.tun.dst_v6 = info.tun.src_v6;
route->tuple[!dir].in.tun.l3_proto = info.tun.l3_proto;
route->tuple[!dir].in.num_tuns = info.num_tuns;
+ dst_release(route->tuple[dir].dst);
+ route->tuple[dir].dst = info.tun_dst;
}
route->tuple[!dir].in.num_encaps = info.num_encaps;
--
2.47.3
^ permalink raw reply related [flat|nested] 7+ messages in thread