From: Lorenzo Bianconi <lorenzo@kernel.org>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: netfilter-devel@vger.kernel.org, lorenzo.bianconi@oss.qualcomm.com
Subject: Re: [PATCH nf-next 6/7] netfilter: flowtable: move ipv4 and ipv6 xmit path to function
Date: Fri, 7 Aug 2026 11:13:05 +0200 [thread overview]
Message-ID: <anWhoSwYThFBuS2h@lore-desk> (raw)
In-Reply-To: <20260806223535.523098-7-pablo@netfilter.org>
[-- Attachment #1: Type: text/plain, Size: 4935 bytes --]
> Move the existing ipv4 and ipv6 transmit path to functions in
> preparation of the IPv4 over IPv6 and SIT support.
>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Nice :)
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
> ---
> net/netfilter/nf_flow_table_ip.c | 92 +++++++++++++++++++-------------
> 1 file changed, 54 insertions(+), 38 deletions(-)
>
> diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
> index 4437f3a13cb2..18febca1dcef 100644
> --- a/net/netfilter/nf_flow_table_ip.c
> +++ b/net/netfilter/nf_flow_table_ip.c
> @@ -800,33 +800,17 @@ static unsigned int nf_flow_queue_xmit(struct net *net, struct sk_buff *skb,
> return NF_STOLEN;
> }
>
> -unsigned int
> -nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
> - const struct nf_hook_state *state)
> +static int nf_flow_queue_xmit4(struct sk_buff *skb,
> + struct flow_offload_tuple_rhash *tuplehash,
> + const struct nf_hook_state *state)
> {
> - struct flow_offload_tuple_rhash *tuplehash;
> - struct nf_flowtable *flow_table = priv;
> struct flow_offload_tuple *other_tuple;
> enum flow_offload_tuple_dir dir;
> - struct nf_flowtable_ctx ctx = {
> - .in = state->in,
> - };
> struct nf_flow_xmit xmit = {};
> struct flow_offload *flow;
> struct neighbour *neigh;
> struct rtable *rt;
> __be32 ip_daddr;
> - int ret;
> -
> - tuplehash = nf_flow_offload_lookup(&ctx, flow_table, skb);
> - if (!tuplehash)
> - return NF_ACCEPT;
> -
> - ret = nf_flow_offload_forward(&ctx, flow_table, tuplehash, skb);
> - if (ret < 0)
> - return NF_DROP;
> - else if (ret == 0)
> - return NF_ACCEPT;
>
> if (unlikely(tuplehash->tuple.xmit_type == FLOW_OFFLOAD_XMIT_XFRM)) {
> rt = dst_rtable(tuplehash->tuple.dst_cache);
> @@ -879,6 +863,30 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
>
> return nf_flow_queue_xmit(state->net, skb, &xmit);
> }
> +
> +unsigned int
> +nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
> + const struct nf_hook_state *state)
> +{
> + struct flow_offload_tuple_rhash *tuplehash;
> + struct nf_flowtable *flow_table = priv;
> + struct nf_flowtable_ctx ctx = {
> + .in = state->in,
> + };
> + int ret;
> +
> + tuplehash = nf_flow_offload_lookup(&ctx, flow_table, skb);
> + if (!tuplehash)
> + return NF_ACCEPT;
> +
> + ret = nf_flow_offload_forward(&ctx, flow_table, tuplehash, skb);
> + if (ret < 0)
> + return NF_DROP;
> + else if (ret == 0)
> + return NF_ACCEPT;
> +
> + return nf_flow_queue_xmit4(skb, tuplehash, state);
> +}
> EXPORT_SYMBOL_GPL(nf_flow_offload_ip_hook);
>
> static void nf_flow_nat_ipv6_tcp(struct sk_buff *skb, unsigned int thoff,
> @@ -1119,33 +1127,17 @@ nf_flow_offload_ipv6_lookup(struct nf_flowtable_ctx *ctx,
> return flow_offload_lookup(flow_table, &tuple);
> }
>
> -unsigned int
> -nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
> - const struct nf_hook_state *state)
> +static int nf_flow_queue_xmit6(struct sk_buff *skb,
> + struct flow_offload_tuple_rhash *tuplehash,
> + const struct nf_hook_state *state)
> {
> - struct flow_offload_tuple_rhash *tuplehash;
> - struct nf_flowtable *flow_table = priv;
> struct flow_offload_tuple *other_tuple;
> enum flow_offload_tuple_dir dir;
> - struct nf_flowtable_ctx ctx = {
> - .in = state->in,
> - };
> struct nf_flow_xmit xmit = {};
> struct in6_addr *ip6_daddr;
> struct flow_offload *flow;
> struct neighbour *neigh;
> struct rt6_info *rt;
> - int ret;
> -
> - tuplehash = nf_flow_offload_ipv6_lookup(&ctx, flow_table, skb);
> - if (tuplehash == NULL)
> - return NF_ACCEPT;
> -
> - ret = nf_flow_offload_ipv6_forward(&ctx, flow_table, tuplehash, skb);
> - if (ret < 0)
> - return NF_DROP;
> - else if (ret == 0)
> - return NF_ACCEPT;
>
> if (unlikely(tuplehash->tuple.xmit_type == FLOW_OFFLOAD_XMIT_XFRM)) {
> rt = dst_rt6_info(tuplehash->tuple.dst_cache);
> @@ -1199,4 +1191,28 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
>
> return nf_flow_queue_xmit(state->net, skb, &xmit);
> }
> +
> +unsigned int
> +nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
> + const struct nf_hook_state *state)
> +{
> + struct flow_offload_tuple_rhash *tuplehash;
> + struct nf_flowtable *flow_table = priv;
> + struct nf_flowtable_ctx ctx = {
> + .in = state->in,
> + };
> + int ret;
> +
> + tuplehash = nf_flow_offload_ipv6_lookup(&ctx, flow_table, skb);
> + if (!tuplehash)
> + return NF_ACCEPT;
> +
> + ret = nf_flow_offload_ipv6_forward(&ctx, flow_table, tuplehash, skb);
> + if (ret < 0)
> + return NF_DROP;
> + else if (ret == 0)
> + return NF_ACCEPT;
> +
> + return nf_flow_queue_xmit6(skb, tuplehash, state);
> +}
> EXPORT_SYMBOL_GPL(nf_flow_offload_ipv6_hook);
> --
> 2.47.3
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
next prev parent reply other threads:[~2026-08-07 9:13 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-06 22:35 [PATCH nf-next 0/7] flowtable preparation for IPv4 over IPv6 and SIT Pablo Neira Ayuso
2026-08-06 22:35 ` [PATCH nf-next 1/7] net: pass net_device_path_ctx to dev_fill_forward_path() Pablo Neira Ayuso
2026-08-06 22:35 ` [PATCH nf-next 2/7] net: netfilter: add ether_type to net_device_path_ctx and use it Pablo Neira Ayuso
2026-08-07 9:00 ` Lorenzo Bianconi
2026-08-06 22:35 ` [PATCH nf-next 3/7] netfilter: flowtable: rename tun.l3_proto to tun.inner_proto Pablo Neira Ayuso
2026-08-07 9:01 ` Lorenzo Bianconi
2026-08-06 22:35 ` [PATCH nf-next 4/7] netfilter: flowtable: rename ctx.tun.proto to ctx.tun.inner_proto Pablo Neira Ayuso
2026-08-07 9:02 ` Lorenzo Bianconi
2026-08-06 22:35 ` [PATCH nf-next 5/7] netfilter: flowtable: store ethertype in flowtable context Pablo Neira Ayuso
2026-08-07 9:10 ` Lorenzo Bianconi
2026-08-06 22:35 ` [PATCH nf-next 6/7] netfilter: flowtable: move ipv4 and ipv6 xmit path to function Pablo Neira Ayuso
2026-08-07 9:13 ` Lorenzo Bianconi [this message]
2026-08-06 22:35 ` [PATCH nf-next 7/7] netfilter: flowtable: detach layer 2 encapsulation parser from lookup Pablo Neira Ayuso
2026-08-07 9:15 ` Lorenzo Bianconi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=anWhoSwYThFBuS2h@lore-desk \
--to=lorenzo@kernel.org \
--cc=lorenzo.bianconi@oss.qualcomm.com \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox