Re: [PATCH nf-next 7/7] netfilter: flowtable: detach layer 2 encapsulation parser from lookup

[Lorenzo Bianconi <lorenzo@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 2084 bytes --]

> Move the layer 2 encapsulation header parser out of the lookup function
> to prepare for IPv4 over IPv6 and SIT.
> 
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>

> ---
>  net/netfilter/nf_flow_table_ip.c | 24 ++++++++++++------------
>  1 file changed, 12 insertions(+), 12 deletions(-)
> 
> diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
> index 18febca1dcef..af534000a287 100644
> --- a/net/netfilter/nf_flow_table_ip.c
> +++ b/net/netfilter/nf_flow_table_ip.c
> @@ -458,12 +458,6 @@ nf_flow_offload_lookup(struct nf_flowtable_ctx *ctx,
>  {
>  	struct flow_offload_tuple tuple = {};
>  
> -	if (!nf_flow_skb_encap_protocol(ctx, skb))
> -		return NULL;
> -
> -	if (unlikely(ctx->ether_type != htons(ETH_P_IP)))
> -		return NULL;
> -
>  	if (nf_flow_tuple_ip(ctx, skb, &tuple) < 0)
>  		return NULL;
>  
> @@ -875,6 +869,12 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
>  	};
>  	int ret;
>  
> +	if (!nf_flow_skb_encap_protocol(&ctx, skb))
> +		return NF_ACCEPT;
> +
> +	if (unlikely(ctx.ether_type != htons(ETH_P_IP)))
> +		return NF_ACCEPT;
> +
>  	tuplehash = nf_flow_offload_lookup(&ctx, flow_table, skb);
>  	if (!tuplehash)
>  		return NF_ACCEPT;
> @@ -1115,12 +1115,6 @@ nf_flow_offload_ipv6_lookup(struct nf_flowtable_ctx *ctx,
>  {
>  	struct flow_offload_tuple tuple = {};
>  
> -	if (!nf_flow_skb_encap_protocol(ctx, skb))
> -		return NULL;
> -
> -	if (unlikely(ctx->ether_type != htons(ETH_P_IPV6)))
> -		return NULL;
> -
>  	if (nf_flow_tuple_ipv6(ctx, skb, &tuple) < 0)
>  		return NULL;
>  
> @@ -1203,6 +1197,12 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
>  	};
>  	int ret;
>  
> +	if (!nf_flow_skb_encap_protocol(&ctx, skb))
> +		return NF_ACCEPT;
> +
> +	if (unlikely(ctx.ether_type != htons(ETH_P_IPV6)))
> +		return NF_ACCEPT;
> +
>  	tuplehash = nf_flow_offload_ipv6_lookup(&ctx, flow_table, skb);
>  	if (!tuplehash)
>  		return NF_ACCEPT;
> -- 
> 2.47.3
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]