History

netfilter: nft_inner: add geneve support

Geneve tunnel header may contain options, parse geneve header and update offset to point to the link layer header according to the opt_len field.

Pablo Neira Ayuso committed 4 years ago

Commit 0db14b91 parent a150d122 files · +18 −0Browse files

Unified · Split

2 files
  1. include/uapi/linux/netfilter/nf_tables.h +1 −0
  2. net/netfilter/nft_inner.c +17 −0
include/uapi/linux/netfilter/nf_tables.h+1−0
@@ -783,6 +783,7 @@ enum nft_payload_csum_flags { · 782 unmodified lines
783783 enum nft_inner_type {
784784 NFT_INNER_UNSPEC = 0,
785785 NFT_INNER_VXLAN,
786+ NFT_INNER_GENEVE,
786787 };
787788
788789 enum nft_inner_flags {
net/netfilter/nft_inner.c+17−0
@@ -17,6 +17,7 @@ · 16 unmodified lines
1717 #include <linux/tcp.h>
1818 #include <linux/udp.h>
1919 #include <net/gre.h>
20+#include <net/geneve.h>
2021 #include <net/ip.h>
2122 #include <linux/icmpv6.h>
2223 #include <linux/ip.h>
@@ -181,6 +182,22 @@ static int nft_inner_parse_tunhdr(const struct nft_inner *priv, · 158 unmodified lines
181182 ctx->flags |= NFT_PAYLOAD_CTX_INNER_TUN;
182183 *off += priv->hdrsize;
183184
185+ switch (priv->type) {
186+ case NFT_INNER_GENEVE: {
187+ struct genevehdr *gnvh, _gnvh;
188+
189+ gnvh = skb_header_pointer(pkt->skb, pkt->inneroff,
190+ sizeof(_gnvh), &_gnvh);
191+ if (!gnvh)
192+ return -1;
193+
194+ *off += gnvh->opt_len * 4;
195+ }
196+ break;
197+ default:
198+ break;
199+ }
200+
184201 return 0;
185202 }
186203