WSL2-Linux-Kernel/net/netfilter
Pablo Neira Ayuso a5d45bc0dc netfilter: nftables_offload: build mask based from the matching bytes
Userspace might match on prefix bytes of header fields if they are on
the byte boundary, this requires that the mask is adjusted accordingly.
Use NFT_OFFLOAD_MATCH_EXACT() for meta since prefix byte matching is not
allowed for this type of selector.

The bitwise expression might be optimized out by userspace, hence the
kernel needs to infer the prefix from the number of payload bytes to
match on. This patch adds nft_payload_offload_mask() to calculate the
bitmask to match on the prefix.

Fixes: c9626a2cbd ("netfilter: nf_tables: add hardware offload support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2020-11-27 12:10:47 +01:00
..
ipset netfilter: ipset: prevent uninit-value in hash_ip6_add 2020-11-26 00:09:42 +01:00
ipvs ipvs: fix possible memory leak in ip_vs_control_net_init 2020-11-27 12:10:46 +01:00
Kconfig netfilter: nftables: allow re-computing sctp CRC-32C in 'payload' statements 2020-10-15 11:45:19 -07:00
Makefile
core.c netfilter: add inet ingress support 2020-10-12 01:57:34 +02:00
nf_conncount.c
nf_conntrack_acct.c
nf_conntrack_amanda.c
nf_conntrack_broadcast.c
nf_conntrack_core.c
nf_conntrack_ecache.c
nf_conntrack_expect.c
nf_conntrack_extend.c
nf_conntrack_ftp.c
nf_conntrack_h323_asn1.c
nf_conntrack_h323_main.c
nf_conntrack_h323_types.c
nf_conntrack_helper.c
nf_conntrack_irc.c
nf_conntrack_labels.c
nf_conntrack_netbios_ns.c
nf_conntrack_netlink.c
nf_conntrack_pptp.c
nf_conntrack_proto.c
nf_conntrack_proto_dccp.c
nf_conntrack_proto_generic.c
nf_conntrack_proto_gre.c
nf_conntrack_proto_icmp.c
nf_conntrack_proto_icmpv6.c
nf_conntrack_proto_sctp.c
nf_conntrack_proto_tcp.c netfilter: conntrack: connection timeout after re-register 2020-10-20 13:54:53 +02:00
nf_conntrack_proto_udp.c
nf_conntrack_sane.c
nf_conntrack_seqadj.c
nf_conntrack_sip.c
nf_conntrack_snmp.c
nf_conntrack_standalone.c
nf_conntrack_tftp.c
nf_conntrack_timeout.c
nf_conntrack_timestamp.c
nf_dup_netdev.c netfilter: nf_fwd_netdev: clear timestamp in forwarding path 2020-10-22 14:49:36 +02:00
nf_flow_table_core.c netfilter: flowtable: reduce calls to pskb_may_pull() 2020-10-12 01:58:10 +02:00
nf_flow_table_inet.c
nf_flow_table_ip.c netfilter: flowtable: reduce calls to pskb_may_pull() 2020-10-12 01:58:10 +02:00
nf_flow_table_offload.c
nf_internals.h
nf_log.c
nf_log_common.c netfilter: nf_log: missing vlan offload tag and proto 2020-10-14 01:25:14 +02:00
nf_log_netdev.c
nf_nat_amanda.c
nf_nat_core.c
nf_nat_ftp.c
nf_nat_helper.c
nf_nat_irc.c
nf_nat_masquerade.c
nf_nat_proto.c netfilter: use actual socket sk rather than skb sk when routing harder 2020-10-30 12:57:39 +01:00
nf_nat_redirect.c
nf_nat_sip.c
nf_nat_tftp.c
nf_queue.c
nf_sockopt.c
nf_synproxy_core.c netfilter: use actual socket sk rather than skb sk when routing harder 2020-10-30 12:57:39 +01:00
nf_tables_api.c netfilter: nf_tables: avoid false-postive lockdep splat 2020-11-26 00:09:42 +01:00
nf_tables_core.c
nf_tables_offload.c netfilter: nftables_offload: set address type in control dissector 2020-11-27 12:10:46 +01:00
nf_tables_trace.c
nfnetlink.c netfilter: nf_tables: missing validation from the abort path 2020-10-30 12:57:39 +01:00
nfnetlink_acct.c
nfnetlink_cthelper.c
nfnetlink_cttimeout.c
nfnetlink_log.c
nfnetlink_osf.c
nfnetlink_queue.c
nft_bitwise.c
nft_byteorder.c
nft_chain_filter.c netfilter: nf_tables: add inet ingress support 2020-10-12 01:57:34 +02:00
nft_chain_nat.c
nft_chain_route.c netfilter: use actual socket sk rather than skb sk when routing harder 2020-10-30 12:57:39 +01:00
nft_cmp.c netfilter: nftables_offload: build mask based from the matching bytes 2020-11-27 12:10:47 +01:00
nft_compat.c
nft_connlimit.c
nft_counter.c
nft_ct.c
nft_dup_netdev.c
nft_dynset.c
nft_exthdr.c
nft_fib.c
nft_fib_inet.c
nft_fib_netdev.c
nft_flow_offload.c
nft_fwd_netdev.c netfilter: nf_fwd_netdev: clear timestamp in forwarding path 2020-10-22 14:49:36 +02:00
nft_hash.c
nft_immediate.c
nft_limit.c
nft_log.c
nft_lookup.c
nft_masq.c
nft_meta.c netfilter: nftables_offload: build mask based from the matching bytes 2020-11-27 12:10:47 +01:00
nft_nat.c
nft_numgen.c
nft_objref.c
nft_osf.c
nft_payload.c netfilter: nftables_offload: build mask based from the matching bytes 2020-11-27 12:10:47 +01:00
nft_queue.c
nft_quota.c
nft_range.c
nft_redir.c
nft_reject.c
nft_reject_inet.c
nft_rt.c
nft_set_bitmap.c
nft_set_hash.c
nft_set_pipapo.c
nft_set_pipapo.h
nft_set_pipapo_avx2.c
nft_set_pipapo_avx2.h
nft_set_rbtree.c
nft_socket.c
nft_synproxy.c
nft_tproxy.c
nft_tunnel.c
nft_xfrm.c
utils.c netfilter: use actual socket sk rather than skb sk when routing harder 2020-10-30 12:57:39 +01:00
x_tables.c
xt_AUDIT.c
xt_CHECKSUM.c
xt_CLASSIFY.c
xt_CONNSECMARK.c
xt_CT.c
xt_DSCP.c
xt_HL.c
xt_HMARK.c
xt_IDLETIMER.c
xt_LED.c
xt_LOG.c
xt_MASQUERADE.c
xt_NETMAP.c
xt_NFLOG.c
xt_NFQUEUE.c
xt_RATEEST.c
xt_REDIRECT.c
xt_SECMARK.c
xt_TCPMSS.c
xt_TCPOPTSTRIP.c
xt_TEE.c
xt_TPROXY.c
xt_TRACE.c
xt_addrtype.c
xt_bpf.c
xt_cgroup.c
xt_cluster.c
xt_comment.c
xt_connbytes.c
xt_connlabel.c
xt_connlimit.c
xt_connmark.c
xt_conntrack.c
xt_cpu.c
xt_dccp.c
xt_devgroup.c
xt_dscp.c
xt_ecn.c
xt_esp.c
xt_hashlimit.c
xt_helper.c
xt_hl.c
xt_ipcomp.c
xt_iprange.c
xt_ipvs.c
xt_l2tp.c
xt_length.c
xt_limit.c
xt_mac.c
xt_mark.c
xt_multiport.c
xt_nat.c
xt_nfacct.c
xt_osf.c
xt_owner.c
xt_physdev.c
xt_pkttype.c
xt_policy.c
xt_quota.c
xt_rateest.c
xt_realm.c
xt_recent.c
xt_repldata.h
xt_sctp.c
xt_set.c
xt_socket.c
xt_state.c
xt_statistic.c
xt_string.c
xt_tcpmss.c
xt_tcpudp.c
xt_time.c
xt_u32.c