netdev - Re: [PATCH nf-next v9 2/3] net: netfilter: Add IPIP flowtable tx sw acceleration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aR2nq_UIz9oF5Xt_@lore-desk>
Date: Wed, 19 Nov 2025 12:19:07 +0100
From: Lorenzo Bianconi <lorenzo@...nel.org>
To: Pablo Neira Ayuso <pablo@...filter.org>
Cc: "David S. Miller" <davem@...emloft.net>,
	David Ahern <dsahern@...nel.org>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Simon Horman <horms@...nel.org>,
	Jozsef Kadlecsik <kadlec@...filter.org>,
	Shuah Khan <shuah@...nel.org>, Andrew Lunn <andrew+netdev@...n.ch>,
	Phil Sutter <phil@....cc>, Florian Westphal <fw@...len.de>,
	netdev@...r.kernel.org, netfilter-devel@...r.kernel.org,
	coreteam@...filter.org, linux-kselftest@...r.kernel.org
Subject: Re: [PATCH nf-next v9 2/3] net: netfilter: Add IPIP flowtable tx sw
 acceleration

> Hi Lorenzo,
> 
> I found one more issue: caching the ip6 daddr does not work because
> skb_cow_head() can reallocate the skb header, invalidating all
> pointers.
> 
> I went back to use the other_tuple, it is safer, new branch:
> 
>         flowtable-consolidate-xmit+ipip3

Hi Pablo,

thx for fixing it. I tested the branch above and it works fine with IPIP tunnel
flowtable offloading.

> 
> Hopefully, this is the last iteration for this series.
> 
> I am attaching a diff that compares flowtable-consolidate-xmit+ipip2
> vs. flowtable-consolidate-xmit+ipip3 branches.
> 
> I also made a few cosmetic edits.

> diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
> index ee81ee3a5110..e128b0fe9a7b 100644
> --- a/net/netfilter/nf_flow_table_ip.c
> +++ b/net/netfilter/nf_flow_table_ip.c
> @@ -512,13 +512,14 @@ static int nf_flow_pppoe_push(struct sk_buff *skb, u16 id)
>  }
>  
>  static int nf_flow_tunnel_ipip_push(struct net *net, struct sk_buff *skb,
> -				    struct flow_offload_tuple *tuple)
> +				    struct flow_offload_tuple *tuple,
> +				    __be32 *ip_daddr)
>  {
>  	struct iphdr *iph = (struct iphdr *)skb_network_header(skb);
>  	struct rtable *rt = dst_rtable(tuple->dst_cache);
> -	__be16	frag_off = iph->frag_off;
> -	u32 headroom = sizeof(*iph);
>  	u8 tos = iph->tos, ttl = iph->ttl;
> +	__be16 frag_off = iph->frag_off;
> +	u32 headroom = sizeof(*iph);
>  	int err;
>  
>  	err = iptunnel_handle_offloads(skb, SKB_GSO_IPXIP4);
> @@ -551,14 +552,17 @@ static int nf_flow_tunnel_ipip_push(struct net *net, struct sk_buff *skb,
>  	__ip_select_ident(net, iph, skb_shinfo(skb)->gso_segs ?: 1);
>  	ip_send_check(iph);
>  
> +	*ip_daddr = tuple->tun.src_v4.s_addr;
> +
>  	return 0;
>  }
>  
>  static int nf_flow_tunnel_v4_push(struct net *net, struct sk_buff *skb,
> -				  struct flow_offload_tuple *tuple)
> +				  struct flow_offload_tuple *tuple,
> +				  __be32 *ip_daddr)
>  {
>  	if (tuple->tun_num)
> -		return nf_flow_tunnel_ipip_push(net, skb, tuple);
> +		return nf_flow_tunnel_ipip_push(net, skb, tuple, ip_daddr);
>  
>  	return 0;
>  }
> @@ -572,7 +576,8 @@ static int nf_flow_encap_push(struct sk_buff *skb,
>  		switch (tuple->encap[i].proto) {
>  		case htons(ETH_P_8021Q):
>  		case htons(ETH_P_8021AD):
> -			if (skb_vlan_push(skb, tuple->encap[i].proto, tuple->encap[i].id) < 0)
> +			if (skb_vlan_push(skb, tuple->encap[i].proto,
> +					  tuple->encap[i].id) < 0)
>  				return -1;
>  			break;
>  		case htons(ETH_P_PPP_SES):
> @@ -624,12 +629,11 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
>  	dir = tuplehash->tuple.dir;
>  	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
>  	other_tuple = &flow->tuplehash[!dir].tuple;
> +	ip_daddr = other_tuple->src_v4.s_addr;
>  
> -	if (nf_flow_tunnel_v4_push(state->net, skb, other_tuple) < 0)
> +	if (nf_flow_tunnel_v4_push(state->net, skb, other_tuple, &ip_daddr) < 0)
>  		return NF_DROP;
>  
> -	ip_daddr = ip_hdr(skb)->daddr;
> -
>  	if (nf_flow_encap_push(skb, other_tuple) < 0)
>  		return NF_DROP;
>  
> @@ -906,6 +910,7 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
>  {
>  	struct flow_offload_tuple_rhash *tuplehash;
>  	struct nf_flowtable *flow_table = priv;
> +	struct flow_offload_tuple *other_tuple;
>  	enum flow_offload_tuple_dir dir;
>  	struct nf_flowtable_ctx ctx = {
>  		.in	= state->in,
> @@ -937,9 +942,10 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
>  
>  	dir = tuplehash->tuple.dir;
>  	flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
> -	ip6_daddr = &ipv6_hdr(skb)->daddr;
> +	other_tuple = &flow->tuplehash[!dir].tuple;
> +	ip6_daddr = &other_tuple->src_v6;
>  
> -	if (nf_flow_encap_push(skb, &flow->tuplehash[!dir].tuple) < 0)
> +	if (nf_flow_encap_push(skb, other_tuple) < 0)
>  		return NF_DROP;
>  
>  	switch (tuplehash->tuple.xmit_type) {

ack, the above changes are fine to me.

Regards,
Lorenzo



Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)