diff options
| author |   Pablo Neira Ayuso <pablo@netfilter.org> | 2022-10-17 13:03:34 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2022-10-25 13:48:42 +0200 |
| commit | 0db14b95660b63dceeb7e89f2e3ffa97d331fce0 (patch) | |
| tree | 864860f95de4af1473f67db3a8c738a1a9b81562 /net | |
| parent | netfilter: nft_meta: add inner match support (diff) | |
| download | wireguard-linux-0db14b95660b63dceeb7e89f2e3ffa97d331fce0.tar.xz wireguard-linux-0db14b95660b63dceeb7e89f2e3ffa97d331fce0.zip | |
netfilter: nft_inner: add geneve support
Geneve tunnel header may contain options, parse geneve header and update
offset to point to the link layer header according to the opt_len field.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nft_inner.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c index c43a2fe0ceb7..19fdc8c70cd1 100644 --- a/net/netfilter/nft_inner.c +++ b/net/netfilter/nft_inner.c @@ -17,6 +17,7 @@ #include <linux/tcp.h> #include <linux/udp.h> #include <net/gre.h> +#include <net/geneve.h> #include <net/ip.h> #include <linux/icmpv6.h> #include <linux/ip.h> @@ -181,6 +182,22 @@ static int nft_inner_parse_tunhdr(const struct nft_inner *priv, ctx->flags |= NFT_PAYLOAD_CTX_INNER_TUN; *off += priv->hdrsize; + switch (priv->type) { + case NFT_INNER_GENEVE: { + struct genevehdr *gnvh, _gnvh; + + gnvh = skb_header_pointer(pkt->skb, pkt->inneroff, + sizeof(_gnvh), &_gnvh); + if (!gnvh) + return -1; + + *off += gnvh->opt_len * 4; + } + break; + default: + break; + } + return 0; } |