From 91619eb60aeccd3181d9b88975add706a9b763c1 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 17 Oct 2022 13:03:35 +0200 Subject: [PATCH] netfilter: nft_inner: set tunnel offset to GRE header offset Set inner tunnel offset to the GRE header, this is redundant to existing transport header offset, but this normalizes the handling of the tunnel header regardless its location in the layering. GRE version 0 is overloaded with RFCs, the type decorator in the inner expression might also be useful to interpret matching fields from the netlink delinearize path in userspace. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nft_inner.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c index 19fdc8c70cd1..eae7caeff316 100644 --- a/net/netfilter/nft_inner.c +++ b/net/netfilter/nft_inner.c @@ -174,8 +174,13 @@ static int nft_inner_parse_tunhdr(const struct nft_inner *priv, const struct nft_pktinfo *pkt, struct nft_inner_tun_ctx *ctx, u32 *off) { - if (pkt->tprot != IPPROTO_UDP || - pkt->tprot != IPPROTO_GRE) + if (pkt->tprot == IPPROTO_GRE) { + ctx->inner_tunoff = pkt->thoff; + ctx->flags |= NFT_PAYLOAD_CTX_INNER_TUN; + return 0; + } + + if (pkt->tprot != IPPROTO_UDP) return -1; ctx->inner_tunoff = *off;