From 97874c7c5f2c31236c4071d85b60c38c2f4bac3d Mon Sep 17 00:00:00 2001 From: Lorenzo Bianconi Date: Sun, 11 Oct 2026 23:59:42 +0200 Subject: [PATCH] netfilter: flowtable: populate tunnel tuple regardless of inner protocol Store the outer tunnel addresses and inner protocol in the flow tuple unconditionally in nf_flow_tuple_encap(), instead of only when the tunnel is IP-in-IP or IPv6-in-IPv6. Bail out early when the inner protocol is neither IPPROTO_IPIP nor IPPROTO_IPV6. This makes the tuple usable for cross-family tunnels such as IPv4-over-IPv6 and SIT, where the inner protocol differs from the outer address family. This is a preliminary patch to support IPv4 over IPv6 and SIT tunnel flowtable offload. Please note IPv4 over IPv6 and SIT tunnel flowtable offloading is not enabled yet. Signed-off-by: Lorenzo Bianconi Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_flow_table_ip.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 29d1a9f4a362..8379b45b2dad 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -189,22 +189,22 @@ static void nf_flow_tuple_encap(struct nf_flowtable_ctx *ctx, break; } + if (ctx->tun.inner_proto != IPPROTO_IPIP && + ctx->tun.inner_proto != IPPROTO_IPV6) + return; + switch (ctx->ether_type) { case htons(ETH_P_IP): iph = (struct iphdr *)(skb_network_header(skb) + offset); - if (ctx->tun.inner_proto == IPPROTO_IPIP) { - tuple->tun.dst_v4.s_addr = iph->daddr; - tuple->tun.src_v4.s_addr = iph->saddr; - tuple->tun.inner_proto = IPPROTO_IPIP; - } + tuple->tun.dst_v4.s_addr = iph->daddr; + tuple->tun.src_v4.s_addr = iph->saddr; + tuple->tun.inner_proto = ctx->tun.inner_proto; break; case htons(ETH_P_IPV6): ip6h = (struct ipv6hdr *)(skb_network_header(skb) + offset); - if (ctx->tun.inner_proto == IPPROTO_IPV6) { - tuple->tun.dst_v6 = ip6h->daddr; - tuple->tun.src_v6 = ip6h->saddr; - tuple->tun.inner_proto = IPPROTO_IPV6; - } + tuple->tun.dst_v6 = ip6h->daddr; + tuple->tun.src_v6 = ip6h->saddr; + tuple->tun.inner_proto = ctx->tun.inner_proto; break; default: break;