From 3dcafe6cb5e1b467a25fde347c8c3949a2866adc Mon Sep 17 00:00:00 2001 From: Lorenzo Bianconi Date: Sun, 11 Oct 2026 23:59:43 +0200 Subject: netfilter: flowtable: add encap_proto to flow_offload_tunnel Add encap_proto (AF_INET or AF_INET6) to struct flow_offload_tunnel to allow its use as part of the hash table key during flowtable entry lookup. This is a preliminary change to support IPv4 over IPv6 tunneling via the flowtable infrastructure for software acceleration. Signed-off-by: Lorenzo Bianconi Signed-off-by: Pablo Neira Ayuso --- include/linux/netdevice.h | 1 + include/net/netfilter/nf_flow_table.h | 1 + net/ipv4/ipip.c | 1 + net/ipv6/ip6_tunnel.c | 1 + net/netfilter/nf_flow_table_ip.c | 2 ++ net/netfilter/nf_flow_table_path.c | 2 ++ 6 files changed, 8 insertions(+) diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index f61c97231309..fee3728ad666 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -911,6 +911,7 @@ struct net_device_path { }; u8 inner_proto; + u8 encap_proto; } tun; struct { enum { diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h index 5b611efaa3cd..5b22d31cb140 100644 --- a/include/net/netfilter/nf_flow_table.h +++ b/include/net/netfilter/nf_flow_table.h @@ -118,6 +118,7 @@ struct flow_offload_tunnel { }; u8 inner_proto; + u8 encap_proto; }; struct flow_offload_tuple { diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c index 2ffe64e736e0..15189e1fa068 100644 --- a/net/ipv4/ipip.c +++ b/net/ipv4/ipip.c @@ -379,6 +379,7 @@ static int ipip_fill_forward_path(struct net_device_path_ctx *ctx, path->tun.src_v4.s_addr = tiph->saddr; path->tun.dst_v4.s_addr = tiph->daddr; path->tun.inner_proto = IPPROTO_IPIP; + path->tun.encap_proto = AF_INET; path->tun.dst = &rt->dst; path->dev = ctx->dev; diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index d5ff50a2ac01..64a184bca467 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -1868,6 +1868,7 @@ static int ip6_tnl_fill_forward_path(struct net_device_path_ctx *ctx, path->tun.src_v6 = fl6.saddr; path->tun.dst_v6 = fl6.daddr; path->tun.inner_proto = IPPROTO_IPV6; + path->tun.encap_proto = AF_INET6; path->tun.dst = dst; path->dev = ctx->dev; ctx->dev = dst->dev; diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 8379b45b2dad..29a769736dbf 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -199,12 +199,14 @@ static void nf_flow_tuple_encap(struct nf_flowtable_ctx *ctx, tuple->tun.dst_v4.s_addr = iph->daddr; tuple->tun.src_v4.s_addr = iph->saddr; tuple->tun.inner_proto = ctx->tun.inner_proto; + tuple->tun.encap_proto = AF_INET; break; case htons(ETH_P_IPV6): ip6h = (struct ipv6hdr *)(skb_network_header(skb) + offset); tuple->tun.dst_v6 = ip6h->daddr; tuple->tun.src_v6 = ip6h->saddr; tuple->tun.inner_proto = ctx->tun.inner_proto; + tuple->tun.encap_proto = AF_INET6; break; default: break; diff --git a/net/netfilter/nf_flow_table_path.c b/net/netfilter/nf_flow_table_path.c index d90013685bf1..841f099434d9 100644 --- a/net/netfilter/nf_flow_table_path.c +++ b/net/netfilter/nf_flow_table_path.c @@ -138,6 +138,7 @@ static int nft_dev_path_info(struct net_device_path_stack *stack, info->tun.dst_v6 = path->tun.dst_v6; info->tun.inner_proto = path->tun.inner_proto; info->tun_dst = path->tun.dst; + info->tun.encap_proto = path->tun.encap_proto; info->num_tuns++; } else { if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX) @@ -249,6 +250,7 @@ static int nft_dev_forward_path(const struct nft_pktinfo *pkt, route->tuple[!dir].in.tun.src_v6 = info.tun.dst_v6; route->tuple[!dir].in.tun.dst_v6 = info.tun.src_v6; route->tuple[!dir].in.tun.inner_proto = info.tun.inner_proto; + route->tuple[!dir].in.tun.encap_proto = info.tun.encap_proto; route->tuple[!dir].in.num_tuns = info.num_tuns; dst_release(route->tuple[dir].dst); route->tuple[dir].dst = info.tun_dst; -- cgit v1.2.3