Move the layer 2 encapsulation header parser out of the lookup function to prepare for IPv4 over IPv6 and SIT. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_flow_table_ip.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 18febca1dcef..af534000a287 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -458,12 +458,6 @@ nf_flow_offload_lookup(struct nf_flowtable_ctx *ctx, { struct flow_offload_tuple tuple = {}; - if (!nf_flow_skb_encap_protocol(ctx, skb)) - return NULL; - - if (unlikely(ctx->ether_type != htons(ETH_P_IP))) - return NULL; - if (nf_flow_tuple_ip(ctx, skb, &tuple) < 0) return NULL; @@ -875,6 +869,12 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, }; int ret; + if (!nf_flow_skb_encap_protocol(&ctx, skb)) + return NF_ACCEPT; + + if (unlikely(ctx.ether_type != htons(ETH_P_IP))) + return NF_ACCEPT; + tuplehash = nf_flow_offload_lookup(&ctx, flow_table, skb); if (!tuplehash) return NF_ACCEPT; @@ -1115,12 +1115,6 @@ nf_flow_offload_ipv6_lookup(struct nf_flowtable_ctx *ctx, { struct flow_offload_tuple tuple = {}; - if (!nf_flow_skb_encap_protocol(ctx, skb)) - return NULL; - - if (unlikely(ctx->ether_type != htons(ETH_P_IPV6))) - return NULL; - if (nf_flow_tuple_ipv6(ctx, skb, &tuple) < 0) return NULL; @@ -1203,6 +1197,12 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, }; int ret; + if (!nf_flow_skb_encap_protocol(&ctx, skb)) + return NF_ACCEPT; + + if (unlikely(ctx.ether_type != htons(ETH_P_IPV6))) + return NF_ACCEPT; + tuplehash = nf_flow_offload_ipv6_lookup(&ctx, flow_table, skb); if (!tuplehash) return NF_ACCEPT; -- 2.47.3