netdev - Re: [PATCH net-next 02/16] netfilter: flowtable: consolidate xmit path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CANn89i+pLDYSCfz9Yq7MPw5+zS+k9VfL4EXZWxztDGbiL==-Gw@mail.gmail.com>
Date: Tue, 25 Nov 2025 20:20:55 -0800
From: Eric Dumazet <edumazet@...gle.com>
To: Pablo Neira Ayuso <pablo@...filter.org>
Cc: netfilter-devel@...r.kernel.org, davem@...emloft.net, 
	netdev@...r.kernel.org, kuba@...nel.org, pabeni@...hat.com, fw@...len.de, 
	horms@...nel.org
Subject: Re: [PATCH net-next 02/16] netfilter: flowtable: consolidate xmit path

On Tue, Nov 25, 2025 at 2:33 PM Pablo Neira Ayuso <pablo@...filter.org> wrote:
>
> Use dev_queue_xmit() for the XMIT_NEIGH case. Store the interface index
> of the real device behind the vlan/pppoe device, this introduces  an
> extra lookup for the real device in the xmit path because rt->dst.dev
> provides the vlan/pppoe device.
>
> XMIT_NEIGH now looks more similar to XMIT_DIRECT but the check for stale
> dst and the neighbour lookup still remain in place which is convenient
> to deal with network topology changes.
>
> Note that nft_flow_route() needs to relax the check for _XMIT_NEIGH so
> the existing basic xfrm offload (which only works in one direction) does
> not break.
>
> Signed-off-by: Pablo Neira Ayuso <pablo@...filter.org>
> ---
>  include/net/netfilter/nf_flow_table.h |  1 +
>  net/netfilter/nf_flow_table_core.c    |  1 +
>  net/netfilter/nf_flow_table_ip.c      | 87 ++++++++++++++++-----------
>  net/netfilter/nf_flow_table_path.c    |  7 +--
>  4 files changed, 57 insertions(+), 39 deletions(-)
>
> diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
> index e9f72d2558e9..efede742106c 100644
> --- a/include/net/netfilter/nf_flow_table.h
> +++ b/include/net/netfilter/nf_flow_table.h
> @@ -140,6 +140,7 @@ struct flow_offload_tuple {
>         u16                             mtu;
>         union {
>                 struct {
> +                       u32             ifidx;

This ifidx should be moved after dst_cache, to avoid adding one hole
for 64bit arches.

(No need to resend the whole series, this can be fixed later in a
stand alone patch)

>                         struct dst_entry *dst_cache;
>                         u32             dst_cookie;
>                 };