[PATCH nf-next 1/2] netfilter: flowtable: use PPPoE GSO handler

[PATCH nf-next 1/2] netfilter: flowtable: use PPPoE GSO handler

[Qingfang Deng]

Flowtable currently segments GSO packets before adding encapsulation
headers, calling nf_flow_encap_push() separately for each segment.

Since commit 55a5d8fca836 ("net: pppoe: implement GRO/GSO support"), the
PPPoE GSO handler can segment encapsulated packets and update the PPPoE
payload length in each resulting segment.

Push the encapsulation headers before segmentation and let the PPPoE GSO
handler update them. This removes the per-segment encapsulation step
from nf_flow_encap_gso_xmit() while keeping the software segmentation.

Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
---
 net/netfilter/nf_flow_table_ip.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index c8c29a9a1684..ce69f4e741e2 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -767,12 +767,6 @@ static unsigned int nf_flow_encap_gso_xmit(struct net *net, struct sk_buff *skb,
 
 	skb_list_walk_safe(segs, segs, nskb) {
 		skb_mark_not_on_list(segs);
-
-		if (nf_flow_encap_push(segs, xmit->tuple, xmit->outdev) < 0) {
-			kfree_skb(segs);
-			kfree_skb_list(nskb);
-			return NF_STOLEN;
-		}
 		__nf_flow_queue_xmit(net, segs, xmit);
 	}
 
@@ -783,11 +777,12 @@ static unsigned int nf_flow_queue_xmit(struct net *net, struct sk_buff *skb,
 				       struct nf_flow_xmit *xmit)
 {
 	if (xmit->tuple->encap_num) {
+		if (nf_flow_encap_push(skb, xmit->tuple, xmit->outdev) < 0)
+			return NF_DROP;
+
 		if (skb_is_gso(skb) && xmit->needs_gso_segment)
 			return nf_flow_encap_gso_xmit(net, skb, xmit);
 
-		if (nf_flow_encap_push(skb, xmit->tuple, xmit->outdev) < 0)
-			return NF_DROP;
 	}
 
 	__nf_flow_queue_xmit(net, skb, xmit);
-- 
2.43.0

[PATCH nf-next 2/2] netfilter: flowtable: avoid unnecessary linearization for PPPoE

[Qingfang Deng]

Passing no features to skb_gso_segment() forces nonlinear skb to be
linearized, even when the output device can transmit them directly.

Allow scatter-gather and frag_list payloads during segmentation to avoid
the linearization. dev_queue_xmit() subsequently validates each segment
against the output device's features and linearizes it if necessary.

Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
---
 net/netfilter/nf_flow_table_ip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index ce69f4e741e2..aeef1fb27d70 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -756,7 +756,7 @@ static unsigned int nf_flow_encap_gso_xmit(struct net *net, struct sk_buff *skb,
 {
 	struct sk_buff *segs, *nskb;
 
-	segs = skb_gso_segment(skb, 0);
+	segs = skb_gso_segment(skb, NETIF_F_SG | NETIF_F_FRAGLIST);
 	if (IS_ERR(segs))
 		return NF_DROP;
 
-- 
2.43.0