Commit 14c20643 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_payload: fix C-VLAN offload support 



- add another struct flow_dissector_key_vlan for C-VLAN
- update layer 3 dependency to allow to match on IPv4/IPv6

Fixes: 89d8fd44 ("netfilter: nft_payload: add C-VLAN offload support")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 78ed0a9b

include/net/netfilter/nf_tables_offload.h

+1 −0
Original line number Diff line number Diff line
@@ -45,6 +45,7 @@ struct nft_flow_key { 
	struct flow_dissector_key_ports			tp;

	struct flow_dissector_key_ip			ip;

	struct flow_dissector_key_vlan			vlan;

	struct flow_dissector_key_vlan			cvlan;

	struct flow_dissector_key_eth_addrs		eth_addrs;

	struct flow_dissector_key_meta			meta;

} __aligned(BITS_PER_LONG / 8); /* Ensure that we can do comparisons as longs. */

net/netfilter/nft_payload.c

+3 −2
Original line number Diff line number Diff line
@@ -241,7 +241,7 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx, 
		if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16)))

			return -EOPNOTSUPP;



		NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_CVLAN, vlan,

		NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_CVLAN, cvlan,

				  vlan_tci, sizeof(__be16), reg);

		break;

	case offsetof(struct vlan_ethhdr, h_vlan_encapsulated_proto) +
@@ -249,8 +249,9 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx, 
		if (!nft_payload_offload_mask(reg, priv->len, sizeof(__be16)))

			return -EOPNOTSUPP;



		NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_CVLAN, vlan,

		NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_CVLAN, cvlan,

				  vlan_tpid, sizeof(__be16), reg);

		nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_NETWORK);

		break;

	default:

		return -EOPNOTSUPP;