History

netfilter: nft_inner: add geneve support

Geneve tunnel header may contain options, parse geneve header and update offset to point to the link layer header according to the opt_len field.

Pablo Neira Ayuso committed 4 years ago

Commit 0db14b91 parent a150d122 files · +18 −0Browse files

Unified · Split

2 files
  1. include/uapi/linux/netfilter/nf_tables.h +1 −0
  2. net/netfilter/nft_inner.c +17 −0
include/uapi/linux/netfilter/nf_tables.h+1−0
@@ -783,6 +783,7 @@ enum nft_payload_csum_flags { · 782 unmodified lines
783enum nft_inner_type {783enum nft_inner_type {
784 NFT_INNER_UNSPEC = 0,784 NFT_INNER_UNSPEC = 0,
785 NFT_INNER_VXLAN,785 NFT_INNER_VXLAN,
786 NFT_INNER_GENEVE,
786};787};
787 788
788enum nft_inner_flags {789enum nft_inner_flags {
net/netfilter/nft_inner.c+17−0
@@ -17,6 +17,7 @@ · 16 unmodified lines
17#include <linux/tcp.h>17#include <linux/tcp.h>
18#include <linux/udp.h>18#include <linux/udp.h>
19#include <net/gre.h>19#include <net/gre.h>
20#include <net/geneve.h>
20#include <net/ip.h>21#include <net/ip.h>
21#include <linux/icmpv6.h>22#include <linux/icmpv6.h>
22#include <linux/ip.h>23#include <linux/ip.h>
@@ -181,6 +182,22 @@ static int nft_inner_parse_tunhdr(const struct nft_inner *priv, · 158 unmodified lines
181 ctx->flags |= NFT_PAYLOAD_CTX_INNER_TUN;182 ctx->flags |= NFT_PAYLOAD_CTX_INNER_TUN;
182 *off += priv->hdrsize;183 *off += priv->hdrsize;
183 184
185 switch (priv->type) {
186 case NFT_INNER_GENEVE: {
187 struct genevehdr *gnvh, _gnvh;
188
189 gnvh = skb_header_pointer(pkt->skb, pkt->inneroff,
190 sizeof(_gnvh), &_gnvh);
191 if (!gnvh)
192 return -1;
193
194 *off += gnvh->opt_len * 4;
195 }
196 break;
197 default:
198 break;
199 }
200
184 return 0;201 return 0;
185}202}
186 203