Skip to content
  • Pablo Neira Ayuso's avatar
    3c78e9e0
    netfilter: nftables_offload: set address type in control dissector · 3c78e9e0
    Pablo Neira Ayuso authored
    
    
    This patch adds nft_flow_rule_set_addr_type() to set the address type
    from the nft_payload expression accordingly.
    
    If the address type is not set in the control dissector then a rule that
    matches either on source or destination IP address does not work.
    
    After this patch, nft hardware offload generates the flow dissector
    configuration as tc-flower does to match on an IP address.
    
    This patch has been also tested functionally to make sure packets are
    filtered out by the NIC.
    
    This is also getting the code aligned with the existing netfilter flow
    offload infrastructure which is also setting the control dissector.
    
    Fixes: c9626a2c ("netfilter: nf_tables: add hardware offload support")
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    3c78e9e0
    netfilter: nftables_offload: set address type in control dissector
    Pablo Neira Ayuso authored
    
    
    This patch adds nft_flow_rule_set_addr_type() to set the address type
    from the nft_payload expression accordingly.
    
    If the address type is not set in the control dissector then a rule that
    matches either on source or destination IP address does not work.
    
    After this patch, nft hardware offload generates the flow dissector
    configuration as tc-flower does to match on an IP address.
    
    This patch has been also tested functionally to make sure packets are
    filtered out by the NIC.
    
    This is also getting the code aligned with the existing netfilter flow
    offload infrastructure which is also setting the control dissector.
    
    Fixes: c9626a2c ("netfilter: nf_tables: add hardware offload support")
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Loading