netfilter: flowtable: consolidate xmit path

Browse source

Use dev_queue_xmit() for the XMIT_NEIGH case. Store the interface index
of the real device behind the vlan/pppoe device, this introduces  an
extra lookup for the real device in the xmit path because rt->dst.dev
provides the vlan/pppoe device.

XMIT_NEIGH now looks more similar to XMIT_DIRECT but the check for stale
dst and the neighbour lookup still remain in place which is convenient
to deal with network topology changes.

Note that nft_flow_route() needs to relax the check for _XMIT_NEIGH so
the existing basic xfrm offload (which only works in one direction) does
not break.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Pablo Neira Ayuso 2025-10-10 12:32:35 +02:00

parent 93d7a7ed07

commit b5964aac51

4 changed files with 57 additions and 39 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

include/net/netfilter/nf_flow_table.h

View file

1

net/netfilter/nf_flow_table_core.c

View file

87

net/netfilter/nf_flow_table_ip.c

View file

7

net/netfilter/nf_flow_table_path.c

View file