[PATCH net-next 2/2] erspan: skip the platform specific sub-header of ERSPAN type III

[Haishuang Yan]

The ERSPAN type III header has an O flag, which tells whether an
optional platform specific sub-header of 8 octets follows it. The
ERSPAN payload starts after that sub-header when the flag is set [1].

Linux never sets the flag on transmit, but it ignores it on receive
too. When a peer sends the sub-header, its 8 bytes are passed up as the
start of the mirrored Ethernet frame, so the frame is corrupted.

Pull the sub-header as well when the O flag is set. The collect_md
metadata still only carries the fixed part of the type III header.

[1] https://datatracker.ietf.org/doc/html/draft-foschiano-erspan-03

Signed-off-by: Haishuang Yan <yanhaishuang@xxxxxxxxxxxxxxxxxxxx>
---
 include/net/erspan.h |  4 ++++
 net/ipv4/ip_gre.c    | 10 ++++++++++
 net/ipv6/ip6_gre.c   | 10 ++++++++++
 3 files changed, 24 insertions(+)

diff --git a/include/net/erspan.h b/include/net/erspan.h
index c6209e7b6c96..0ef4338588c4 100644
--- a/include/net/erspan.h
+++ b/include/net/erspan.h
@@ -94,6 +94,10 @@ enum erspan_encap_type {
 
 #define ERSPAN_V1_MDSIZE	4
 #define ERSPAN_V2_MDSIZE	8
+/* Optional platform specific sub-header of ERSPAN type III, which follows
+ * the header when its O flag is set.
+ */
+#define ERSPAN_V2_SUBHDR_LEN	8
 
 struct erspan_base_hdr {
 #if defined(__LITTLE_ENDIAN_BITFIELD)
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 2f112c1edf7c..b24ff0eca30b 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -311,6 +311,16 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
 		if (unlikely(!pskb_may_pull(skb, len)))
 			return PACKET_REJECT;
 
+		if (ver == ERSPAN_VERSION2) {
+			md2 = (struct erspan_md2 *)(skb->data + gre_hdr_len +
+						    sizeof(*ershdr));
+			if (md2->o) {
+				len += ERSPAN_V2_SUBHDR_LEN;
+				if (unlikely(!pskb_may_pull(skb, len)))
+					return PACKET_REJECT;
+			}
+		}
+
 		if (__iptunnel_pull_header(skb,
 					   len,
 					   htons(ETH_P_TEB),
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 3fe395ed92f9..c87a7198e5a8 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -513,6 +513,16 @@ static int ip6erspan_rcv(struct sk_buff *skb,
 		if (unlikely(!pskb_may_pull(skb, len)))
 			return PACKET_REJECT;
 
+		if (ver == ERSPAN_VERSION2) {
+			md2 = (struct erspan_md2 *)(skb->data +
+						    sizeof(*ershdr));
+			if (md2->o) {
+				len += ERSPAN_V2_SUBHDR_LEN;
+				if (unlikely(!pskb_may_pull(skb, len)))
+					return PACKET_REJECT;
+			}
+		}
+
 		if (__iptunnel_pull_header(skb, len,
 					   htons(ETH_P_TEB),
 					   false, false))
-- 
2.43.0