Commit a82055af authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by David S. Miller
Browse files

netfilter: nft_payload: add VLAN offload support 



Match on ethertype and set up protocol dependency. Check for protocol
dependency before accessing the tci field. Allow to match on the
encapsulated ethertype too.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8819efc9

include/net/flow_dissector.h

+6 −3
Original line number Diff line number Diff line
@@ -48,9 +48,12 @@ struct flow_dissector_key_tags { 
};



struct flow_dissector_key_vlan {

	union {

		u16	vlan_id:12,

			vlan_dei:1,

			vlan_priority:3;

		__be16	vlan_tci;

	};

	__be16	vlan_tpid;

};

net/netfilter/nft_payload.c

+22 −0
Original line number Diff line number Diff line
@@ -182,6 +182,28 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx, 
		NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_ETH_ADDRS, eth_addrs,

				  dst, ETH_ALEN, reg);

		break;

	case offsetof(struct ethhdr, h_proto):

		if (priv->len != sizeof(__be16))

			return -EOPNOTSUPP;



		NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC, basic,

				  n_proto, sizeof(__be16), reg);

		nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_NETWORK);

		break;

	case offsetof(struct vlan_ethhdr, h_vlan_TCI):

		if (priv->len != sizeof(__be16))

			return -EOPNOTSUPP;



		NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_VLAN, vlan,

				  vlan_tci, sizeof(__be16), reg);

		break;

	case offsetof(struct vlan_ethhdr, h_vlan_encapsulated_proto):

		if (priv->len != sizeof(__be16))

			return -EOPNOTSUPP;



		NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_VLAN, vlan,

				  vlan_tpid, sizeof(__be16), reg);

		break;

	default:

		return -EOPNOTSUPP;

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE