diff options
| author |   Pablo Neira Ayuso <pablo@netfilter.org> | 2022-02-17 23:41:20 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2022-02-20 01:22:20 +0100 |
| commit | b1a5983f56e371046dcf164f90bfaf704d2b89f6 (patch) | |
| tree | abfbbfe6bf9801129822d9fede2a46dcea87e783 /net/netfilter/nft_dup_netdev.c | |
| parent | netfilter: xt_socket: missing ifdef CONFIG_IP6_NF_IPTABLES dependency (diff) | |
| download | linux-dev-b1a5983f56e371046dcf164f90bfaf704d2b89f6.tar.xz linux-dev-b1a5983f56e371046dcf164f90bfaf704d2b89f6.zip | |
netfilter: nf_tables_offload: incorrect flow offload action array size
immediate verdict expression needs to allocate one slot in the flow offload
action array, however, immediate data expression does not need to do so.
fwd and dup expression need to allocate one slot, this is missing.
Add a new offload_action interface to report if this expression needs to
allocate one slot in the flow offload action array.
Fixes: be2861dc36d7 ("netfilter: nft_{fwd,dup}_netdev: add offload support")
Reported-and-tested-by: Nick Gregory <Nick.Gregory@Sophos.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nft_dup_netdev.c')
| -rw-r--r-- | net/netfilter/nft_dup_netdev.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/netfilter/nft_dup_netdev.c b/net/netfilter/nft_dup_netdev.c index bbf3fcba3df4..5b5c607fbf83 100644 --- a/net/netfilter/nft_dup_netdev.c +++ b/net/netfilter/nft_dup_netdev.c @@ -67,6 +67,11 @@ static int nft_dup_netdev_offload(struct nft_offload_ctx *ctx, return nft_fwd_dup_netdev_offload(ctx, flow, FLOW_ACTION_MIRRED, oif); } +static bool nft_dup_netdev_offload_action(const struct nft_expr *expr) +{ + return true; +} + static struct nft_expr_type nft_dup_netdev_type; static const struct nft_expr_ops nft_dup_netdev_ops = { .type = &nft_dup_netdev_type, @@ -75,6 +80,7 @@ static const struct nft_expr_ops nft_dup_netdev_ops = { .init = nft_dup_netdev_init, .dump = nft_dup_netdev_dump, .offload = nft_dup_netdev_offload, + .offload_action = nft_dup_netdev_offload_action, }; static struct nft_expr_type nft_dup_netdev_type __read_mostly = { |