netfilter: flowtable: fix IPv6 tunnel addr match

Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel os linux

Previously the IPv6 addresses in the key were clobbered and the mask was
left unset.

I haven't tested this; I noticed it while skimming the code to
understand an unrelated issue.

Fixes: cfab6dbd0ecf ("netfilter: flowtable: add tunnel match offload support")
Cc: wenxu <wenxu@ucloud.cn>
Signed-off-by: Will Mortensen <willmo@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

authored by

Will Mortensen and committed by

Pablo Neira Ayuso 4 years ago 39f6eed4 c08d3286

+2 -2

1 changed file

expand all

net

netfilter

nf_flow_table_offload.c

+2 -2

net/netfilter/nf_flow_table_offload.c

··· 65 65 sizeof(struct in6_addr)); 66 66 if (memcmp(&key->enc_ipv6.src, &in6addr_any, 67 67 sizeof(struct in6_addr))) 68 - memset(&key->enc_ipv6.src, 0xff, 68 + memset(&mask->enc_ipv6.src, 0xff, 69 69 sizeof(struct in6_addr)); 70 70 if (memcmp(&key->enc_ipv6.dst, &in6addr_any, 71 71 sizeof(struct in6_addr))) 72 - memset(&key->enc_ipv6.dst, 0xff, 72 + memset(&mask->enc_ipv6.dst, 0xff, 73 73 sizeof(struct in6_addr)); 74 74 enc_keys |= BIT(FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS); 75 75 key->enc_control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;