[PATCH nf-next 0/4] flowtable: pass dst_entry from ipip tunnel

Pablo Neira Ayuso <[email protected]> Thu, 23 Jul 2026 19:49:48 +0200
Newsgroups gmane.comp.security.firewalls.netfilter.devel
Message-ID <[email protected]>
Hi,

This is revisiting the existing approach to avoid a double route lookup
and avoid a late failure to obtain the ipip route leading to an
incomplete forward path.

This is complementary work to Lorenzo's recent updates for .fill_forward_path
for ipip and ip6ip6 to make a more exhaustive route lookup.

Pablo Neira Ayuso (4):
  netfilter: flowtable: consolidate net_device field in nft_forward_info struct
  netfilter: flowtable: consolidate flowtable device check
  net: pass dst via net_device_path in dev_fill_forward_path()
  netfilter: flowtable: release tunnel route on error when building
    forward path

 include/linux/netdevice.h          |  1 +
 net/core/dev.c                     | 45 +++++++++++---
 net/ipv4/ipip.c                    |  2 +-
 net/ipv6/ip6_tunnel.c              |  2 +-
 net/netfilter/nf_flow_table_path.c | 95 ++++++++++--------------------
 5 files changed, 71 insertions(+), 74 deletions(-)

-- 
2.47.3