Re: [PATCH nf-next v2] netfilter: nft_flow_offload: do not offload multicast

[Fernando Fernandez Mancera]

On 10/29/26 11:01 PM, Koral Ilgun wrote:
> From: Koral Ilgun <koral.ilgun@xxxxxxxxxx>
>
> A flow holds one output per direction, which it resolves when it is
> added. The outputs of a multicast route change when listeners join
> or leave. So a multicast flow in the flowtable continues to send to
> the output that it resolved, also after the last listener left, and
> the counters of the multicast routing stop.
>
> A ruleset can keep multicast out with a match before the flow
> offload statement. Without one, IPv4 multicast stays out of the
> flowtable only because the reverse route lookup in nft_flow_route()
> refuses a multicast source address. The IPv6 route lookup has no such
> check, so IPv6 multicast that ip6mr forwards goes into the flowtable.
>
> Skip a multicast destination for both families in the flow offload
> expression itself, so that the result no longer depends on the
> ruleset or on the route lookup.
>
> Signed-off-by: Koral Ilgun <koral.ilgun@xxxxxxxxxx>

Reviewed-by: Fernando Fernandez Mancera <fmancera@xxxxxxx>

Thanks!