leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netfilter: nf_tables_offload: allow ethernet interface type only

Browse Source 
Hardware offload support at this stage assumes an ethernet device in
place. The flow dissector provides the intermediate representation to
express this selector, so extend it to allow to store the interface
type. Flower does not uses this, so skb_flow_dissect_meta() is not
extended to match on this new field.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Pablo Neira Ayuso 2019-11-19 23:05:53 +01:00 committed by David S. Miller
parent 7cd9a58d68
commit 8819efc943
3 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/net/flow_dissector.h
View File

@ -203,9 +203,11 @@ struct flow_dissector_key_ip {
/** /**
* struct flow_dissector_key_meta: * struct flow_dissector_key_meta:
* @ingress_ifindex: ingress ifindex * @ingress_ifindex: ingress ifindex
* @ingress_iftype: ingress interface type
*/ */
struct flow_dissector_key_meta { struct flow_dissector_key_meta {
int ingress_ifindex; int ingress_ifindex;
u16 ingress_iftype;
}; };
/** /**

6
net/netfilter/nft_cmp.c
View File

@ -10,6 +10,7 @@
#include <linux/module.h> #include <linux/module.h>
#include <linux/netlink.h> #include <linux/netlink.h>
#include <linux/netfilter.h> #include <linux/netfilter.h>
#include <linux/if_arp.h>
#include <linux/netfilter/nf_tables.h> #include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables_core.h> #include <net/netfilter/nf_tables_core.h>
#include <net/netfilter/nf_tables_offload.h> #include <net/netfilter/nf_tables_offload.h>
@ -125,6 +126,11 @@ static int __nft_cmp_offload(struct nft_offload_ctx *ctx,
flow->match.dissector.used_keys |= BIT(reg->key); flow->match.dissector.used_keys |= BIT(reg->key);
flow->match.dissector.offset[reg->key] = reg->base_offset; flow->match.dissector.offset[reg->key] = reg->base_offset;
if (reg->key == FLOW_DISSECTOR_KEY_META &&
reg->offset == offsetof(struct nft_flow_key, meta.ingress_iftype) &&
nft_reg_load16(priv->data.data) != ARPHRD_ETHER)
return -EOPNOTSUPP;
nft_offload_update_dependency(ctx, &priv->data, priv->len); nft_offload_update_dependency(ctx, &priv->data, priv->len);
return 0; return 0;

4
net/netfilter/nft_meta.c
View File

@ -551,6 +551,10 @@ static int nft_meta_get_offload(struct nft_offload_ctx *ctx,
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_META, meta, NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_META, meta,
ingress_ifindex, sizeof(__u32), reg); ingress_ifindex, sizeof(__u32), reg);
break; break;
case NFT_META_IIFTYPE:
NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_META, meta,
ingress_iftype, sizeof(__u16), reg);
break;
default: default:
return -EOPNOTSUPP; return -EOPNOTSUPP;
} }