diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-11-19 23:05:53 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-11-20 11:21:34 -0800 |
| commit | 8819efc9430142957c9c8fc7c09d9107e2061b87 (patch) | |
| tree | ddc5ed2e305c3e137abafa113497dbc723c915c9 /net/netfilter/nft_cmp.c | |
| parent | 7cd9a58d6860ae09acd7f0c219b5fa333703f72f (diff) | |
| download | linux-8819efc9430142957c9c8fc7c09d9107e2061b87.tar.gz | |
netfilter: nf_tables_offload: allow ethernet interface type only
Hardware offload support at this stage assumes an ethernet device in
place. The flow dissector provides the intermediate representation to
express this selector, so extend it to allow to store the interface
type. Flower does not uses this, so skb_flow_dissect_meta() is not
extended to match on this new field.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/netfilter/nft_cmp.c')
| -rw-r--r-- | net/netfilter/nft_cmp.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c index 0744b2bb46da9..b8092069f868f 100644 --- a/net/netfilter/nft_cmp.c +++ b/net/netfilter/nft_cmp.c @@ -10,6 +10,7 @@ #include <linux/module.h> #include <linux/netlink.h> #include <linux/netfilter.h> +#include <linux/if_arp.h> #include <linux/netfilter/nf_tables.h> #include <net/netfilter/nf_tables_core.h> #include <net/netfilter/nf_tables_offload.h> @@ -125,6 +126,11 @@ static int __nft_cmp_offload(struct nft_offload_ctx *ctx, flow->match.dissector.used_keys |= BIT(reg->key); flow->match.dissector.offset[reg->key] = reg->base_offset; + if (reg->key == FLOW_DISSECTOR_KEY_META && + reg->offset == offsetof(struct nft_flow_key, meta.ingress_iftype) && + nft_reg_load16(priv->data.data) != ARPHRD_ETHER) + return -EOPNOTSUPP; + nft_offload_update_dependency(ctx, &priv->data, priv->len); return 0; |