[PATCH] net/mlx5: fix IPIP tunnel verification

[PATCH] net/mlx5: fix IPIP tunnel verification

[Gregory Etelson]

Assuming a case with the following pattern:

eth / ipv4 / udp / vxlan / eth / ipv4 proto is (IPv4 | IPv6)

MLX5 PMD incorrectly recognized this as a packet encapsulated as
VXLAN and IP in IP at the same packet header level.
This caused a flow validation error.

This patch fixes the inner IP in IP detection logic.

Fixes: 2db234e769e1 ("net/mlx5: fix IP-in-IP tunnels recognition")

Cc: stable@dpdk.org

Signed-off-by: Gregory Etelson <getelson@nvidia.com>
Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>
---
 drivers/net/mlx5/mlx5_flow_dv.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_flow_dv.c b/drivers/net/mlx5/mlx5_flow_dv.c
index 61d3101ce8..2d03a3f480 100644
--- a/drivers/net/mlx5/mlx5_flow_dv.c
+++ b/drivers/net/mlx5/mlx5_flow_dv.c
@@ -7925,7 +7925,10 @@ flow_dv_validate(struct rte_eth_dev *dev, const struct rte_flow_attr *attr,
 				mlx5_flow_tunnel_ip_check(items, next_protocol,
 							  item_flags,
 							  &l3_tunnel_flag);
-			if (l3_tunnel_detection == l3_tunnel_inner) {
+			/*
+			 * explicitly allow inner IPIP match
+			 */
+			if (l3_tunnel_detection == l3_tunnel_outer) {
 				item_flags |= l3_tunnel_flag;
 				tunnel = 1;
 			}
@@ -7949,7 +7952,10 @@ flow_dv_validate(struct rte_eth_dev *dev, const struct rte_flow_attr *attr,
 				mlx5_flow_tunnel_ip_check(items, next_protocol,
 							  item_flags,
 							  &l3_tunnel_flag);
-			if (l3_tunnel_detection == l3_tunnel_inner) {
+			/*
+			 * explicitly allow inner IPIP match
+			 */
+			if (l3_tunnel_detection == l3_tunnel_outer) {
 				item_flags |= l3_tunnel_flag;
 				tunnel = 1;
 			}
-- 
2.45.2

Re: [PATCH] net/mlx5: fix IPIP tunnel verification

[Raslan Darawsheh]

Hi,

From: Gregory Etelson <getelson@nvidia.com>
Sent: Monday, March 10, 2025 1:19 PM
To: dev@dpdk.org
Cc: Gregory Etelson; Maayan Kashani; Raslan Darawsheh; stable@dpdk.org; Dariusz Sosnowski; Slava Ovsiienko; Bing Zhao; Ori Kam; Suanming Mou; Matan Azrad
Subject: [PATCH] net/mlx5: fix IPIP tunnel verification

Assuming a case with the following pattern:

eth / ipv4 / udp / vxlan / eth / ipv4 proto is (IPv4 | IPv6)

MLX5 PMD incorrectly recognized this as a packet encapsulated as
VXLAN and IP in IP at the same packet header level.
This caused a flow validation error.

This patch fixes the inner IP in IP detection logic.

Fixes: 2db234e769e1 ("net/mlx5: fix IP-in-IP tunnels recognition")

Cc: stable@dpdk.org

Signed-off-by: Gregory Etelson <getelson@nvidia.com>
Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>

Patch applied to next-net-mlx,

Kindest regards,
Raslan Darawsheh