diff options
| author |   David S. Miller <davem@davemloft.net> | 2019-11-20 11:21:35 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-11-20 11:21:35 -0800 |
| commit | b9242da6f6e66d0e5548f0009abe9f781a536b51 (patch) | |
| tree | 7c7a62414892a60e3cc5534df46a19f6b3a4232c /net/netfilter/nft_cmp.c | |
| parent | lwtunnel: add support for multiple geneve opts (diff) | |
| parent | netfilter: nft_payload: add C-VLAN offload support (diff) | |
| download | linux-dev-b9242da6f6e66d0e5548f0009abe9f781a536b51.tar.xz linux-dev-b9242da6f6e66d0e5548f0009abe9f781a536b51.zip | |
Merge branch 'nf_tables_offload-vlan-matching-support'
Pablo Neira Ayuso says:
====================
nf_tables_offload: vlan matching support
The following patchset contains Netfilter support for vlan matching
offloads:
1) Constify nft_reg_load() as a preparation patch.
2) Restrict rule matching to ingress interface type ARPHRD_ETHER.
3) Add new vlan_tci field to flow_dissector_key_vlan structure,
to allow to set up vlan_id, vlan_dei and vlan_priority in one go.
4) C-VLAN matching support.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/netfilter/nft_cmp.c')
| -rw-r--r-- | net/netfilter/nft_cmp.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c index 0744b2bb46da..b8092069f868 100644 --- a/net/netfilter/nft_cmp.c +++ b/net/netfilter/nft_cmp.c @@ -10,6 +10,7 @@ #include <linux/module.h> #include <linux/netlink.h> #include <linux/netfilter.h> +#include <linux/if_arp.h> #include <linux/netfilter/nf_tables.h> #include <net/netfilter/nf_tables_core.h> #include <net/netfilter/nf_tables_offload.h> @@ -125,6 +126,11 @@ static int __nft_cmp_offload(struct nft_offload_ctx *ctx, flow->match.dissector.used_keys |= BIT(reg->key); flow->match.dissector.offset[reg->key] = reg->base_offset; + if (reg->key == FLOW_DISSECTOR_KEY_META && + reg->offset == offsetof(struct nft_flow_key, meta.ingress_iftype) && + nft_reg_load16(priv->data.data) != ARPHRD_ETHER) + return -EOPNOTSUPP; + nft_offload_update_dependency(ctx, &priv->data, priv->len); return 0; |