[PATCH nf-next 1/2] netfilter: nft_payload: access GRE payload via inner offset

[PATCH nf-next 1/2] netfilter: nft_payload: access GRE payload via inner offset

[Pablo Neira Ayuso]

Parse GRE packets to properly set up inner offset, this allow for
matching on inner headers.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nft_payload.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 99d971fc54ad..81913b74f7c8 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -19,6 +19,7 @@
 /* For layer 4 checksum field offset. */
 #include <linux/tcp.h>
 #include <linux/udp.h>
+#include <net/gre.h>
 #include <linux/icmpv6.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
@@ -100,6 +101,9 @@ static int __nft_payload_inner_offset(struct nft_pktinfo *pkt)
 		pkt->inneroff = thoff + __tcp_hdrlen(th);
 		}
 		break;
+	case IPPROTO_GRE:
+		pkt->inneroff = thoff + sizeof(struct gre_base_hdr);
+		break;
 	default:
 		return -1;
 	}
-- 
2.30.2

[PATCH nf-next 2/2] netfilter: nft_payload: access ipip payload for inner offset

[Pablo Neira Ayuso]

ipip is an special case, transport and inner header offset are set to
the same offset to use the upcoming inner expression for matching on
inner tunnel headers.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nft_payload.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 81913b74f7c8..47425ccd9fae 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -104,6 +104,9 @@ static int __nft_payload_inner_offset(struct nft_pktinfo *pkt)
 	case IPPROTO_GRE:
 		pkt->inneroff = thoff + sizeof(struct gre_base_hdr);
 		break;
+	case IPPROTO_IPIP:
+		pkt->inneroff = thoff;
+		break;
 	default:
 		return -1;
 	}
-- 
2.30.2