From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 06/17] netfilter: nf_flow_table_offload: add IPv6 match description
Date: Mon, 9 Dec 2019 20:26:27 +0100 [thread overview]
Message-ID: <20191209192638.71184-7-pablo@netfilter.org> (raw)
In-Reply-To: <20191209192638.71184-1-pablo@netfilter.org>
Add missing IPv6 matching description to flow_rule object.
Fixes: 5c27d8d76ce8 ("netfilter: nf_flow_table_offload: add IPv6 support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_flow_table_offload.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index dd78ae5441e9..c94ebad78c5c 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -28,6 +28,7 @@ struct nf_flow_key {
struct flow_dissector_key_basic basic;
union {
struct flow_dissector_key_ipv4_addrs ipv4;
+ struct flow_dissector_key_ipv6_addrs ipv6;
};
struct flow_dissector_key_tcp tcp;
struct flow_dissector_key_ports tp;
@@ -57,6 +58,7 @@ static int nf_flow_rule_match(struct nf_flow_match *match,
NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_CONTROL, control);
NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_BASIC, basic);
NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4);
+ NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6);
NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_TCP, tcp);
NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_PORTS, tp);
@@ -69,9 +71,18 @@ static int nf_flow_rule_match(struct nf_flow_match *match,
key->ipv4.dst = tuple->dst_v4.s_addr;
mask->ipv4.dst = 0xffffffff;
break;
+ case AF_INET6:
+ key->control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
+ key->basic.n_proto = htons(ETH_P_IPV6);
+ key->ipv6.src = tuple->src_v6;
+ memset(&mask->ipv6.src, 0xff, sizeof(mask->ipv6.src));
+ key->ipv6.dst = tuple->dst_v6;
+ memset(&mask->ipv6.dst, 0xff, sizeof(mask->ipv6.dst));
+ break;
default:
return -EOPNOTSUPP;
}
+ match->dissector.used_keys |= BIT(key->control.addr_type);
mask->basic.n_proto = 0xffff;
switch (tuple->l4proto) {
@@ -96,7 +107,6 @@ static int nf_flow_rule_match(struct nf_flow_match *match,
match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_CONTROL) |
BIT(FLOW_DISSECTOR_KEY_BASIC) |
- BIT(FLOW_DISSECTOR_KEY_IPV4_ADDRS) |
BIT(FLOW_DISSECTOR_KEY_PORTS);
return 0;
}
--
2.11.0
next prev parent reply other threads:[~2019-12-09 19:27 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-09 19:26 [PATCH 00/17] Netfilter fixes for net Pablo Neira Ayuso
2019-12-09 19:26 ` [PATCH 01/17] netfilter: ctnetlink: netns exit must wait for callbacks Pablo Neira Ayuso
2019-12-09 19:26 ` [PATCH 02/17] netfilter: nf_flow_table_offload: Fix block setup as TC_SETUP_FT cmd Pablo Neira Ayuso
2019-12-09 19:26 ` [PATCH 03/17] netfilter: nf_flow_table_offload: Fix block_cb tc_setup_type as TC_SETUP_CLSFLOWER Pablo Neira Ayuso
2019-12-09 19:26 ` [PATCH 04/17] netfilter: nf_flow_table_offload: Don't use offset uninitialized in flow_offload_port_{d,s}nat Pablo Neira Ayuso
2019-12-09 19:26 ` [PATCH 05/17] netfilter: conntrack: tell compiler to not inline nf_ct_resolve_clash Pablo Neira Ayuso
2019-12-09 19:26 ` Pablo Neira Ayuso [this message]
2019-12-09 19:26 ` [PATCH 07/17] netfilter: nf_tables_offload: Check for the NETDEV_UNREGISTER event Pablo Neira Ayuso
2019-12-09 19:26 ` [PATCH 08/17] selftests: netfilter: use randomized netns names Pablo Neira Ayuso
2019-12-09 19:26 ` [PATCH 09/17] netfilter: nf_queue: enqueue skbs with NULL dst Pablo Neira Ayuso
2019-12-09 19:26 ` [PATCH 10/17] netfilter: uapi: Avoid undefined left-shift in xt_sctp.h Pablo Neira Ayuso
2019-12-09 19:26 ` [PATCH 11/17] netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in named sets Pablo Neira Ayuso
2019-12-09 19:26 ` [PATCH 12/17] netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END Pablo Neira Ayuso
2019-12-09 19:26 ` [PATCH 13/17] netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init() Pablo Neira Ayuso
2019-12-09 19:26 ` [PATCH 14/17] netfilter: nf_tables: skip module reference count bump on object updates Pablo Neira Ayuso
2019-12-09 19:26 ` [PATCH 15/17] netfilter: nf_tables_offload: return EOPNOTSUPP if rule specifies no actions Pablo Neira Ayuso
2019-12-09 19:26 ` [PATCH 16/17] netfilter: bridge: make sure to pull arp header in br_nf_forward_arp() Pablo Neira Ayuso
2019-12-09 19:26 ` [PATCH 17/17] netfilter: nf_flow_table_offload: Correct memcpy size for flow_overload_mangle() Pablo Neira Ayuso
2019-12-09 22:03 ` [PATCH 00/17] Netfilter fixes for net David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191209192638.71184-7-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox