nft_pipapo_lookup(9)

📦 version 7.3.1, in nixpkgs unstable

💖 nft_pipapo_lookup(9) 💖

Okay bestie, welcome to the Kernel API Manual page for nft_pipapo_lookup(9) — this is literally the dataplane front door for the main lookup function, and it's giving main character energy. Let's get into it. 🫶

🔍 SYNOPSIS 🔍

       const struct nft_set_ext * nft_pipapo_lookup (const struct net *net ,
       const struct nft_set *set , const u32 *key );

💅 ARGUMENTS 💅

  • net — the network namespace, obvi.
  • set — the nftables API set representation, your main character set.
  • key — a pointer to the nft registers holding the key data you're hunting for.

🌸 DESCRIPTION 🌸

So like, this function gets called straight from the data path, no cap. It's gonna search for an element that matches the key you give it, but only in the current active copy. And here's the tea: unlike other set types, this uses 0 instead of nft_genmask_cur. Iconic behavior, honestly.

Why? Because new (future) elements aren't reachable from priv->match — they get added to priv->clone instead. When the commit phase flips the generation bitmask, those elements become visible. Using nft_genmask_cur thus creates inconsistent state: matching old entries get skipped, but the newly matching entries are unreachable. It's giving broken vibes. 😭

GENMASK_ANY doesn't work for the same reason: old-gen entries get skipped, new-gen entries are only reachable from priv->clone. Then nft_pipapo_commit swaps ->clone and ->match shortly after the genbit flip. Since ->clone doesn't contain the old entries in the first place, the lookup will only find the now-current ones. Slay. 💅

🎀 RETURN 🎀

It returns the ntables API extension pointer, or NULL if there's no match — literally no match, no vibes. 🫶

👑 SEE ALSO 👑

Bestie, if you wanna go deeper, here's the whole friend group:

This page is from ./net/netfilter, dated October 2026, and it's all about nft_pipapo_lookup(9). Bye bestie! 💖✨

📦 where this page comes from