netfilter: nft_payload: add VLAN offload support

Match on ethertype and set up protocol dependency. Check for protocol
dependency before accessing the tci field. Allow to match on the
encapsulated ethertype too.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h
index 1a0727d..f06b023 100644 (file)
--- a/include/net/flow_dissector.h
+++ b/include/net/flow_dissector.h
@@ -48,9 +48,12 @@ struct flow_dissector_key_tags {
 };
 
 struct flow_dissector_key_vlan {
-       u16     vlan_id:12,
-               vlan_dei:1,
-               vlan_priority:3;
+       union {
+               u16     vlan_id:12,
+                       vlan_dei:1,
+                       vlan_priority:3;
+               __be16  vlan_tci;
+       };
        __be16  vlan_tpid;
 };
 

diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 0877d46..f17939f 100644 (file)
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -182,6 +182,28 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,
                NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_ETH_ADDRS, eth_addrs,
                                  dst, ETH_ALEN, reg);
                break;
+       case offsetof(struct ethhdr, h_proto):
+               if (priv->len != sizeof(__be16))
+                       return -EOPNOTSUPP;
+
+               NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC, basic,
+                                 n_proto, sizeof(__be16), reg);
+               nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_NETWORK);
+               break;
+       case offsetof(struct vlan_ethhdr, h_vlan_TCI):
+               if (priv->len != sizeof(__be16))
+                       return -EOPNOTSUPP;
+
+               NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_VLAN, vlan,
+                                 vlan_tci, sizeof(__be16), reg);
+               break;
+       case offsetof(struct vlan_ethhdr, h_vlan_encapsulated_proto):
+               if (priv->len != sizeof(__be16))
+                       return -EOPNOTSUPP;
+
+               NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_VLAN, vlan,
+                                 vlan_tpid, sizeof(__be16), reg);
+               break;
        default:
                return -EOPNOTSUPP;
        }