Commit 22a9613d authored May 21, 2025 by Fernando Fernandez Mancera Committed by Pablo Neira Ayuso May 23, 2025

netfilter: nft_tunnel: fix geneve_opt dump



When dumping a nft_tunnel with more than one geneve_opt configured the
netlink attribute hierarchy should be as follow:

 NFTA_TUNNEL_KEY_OPTS
 |
 |--NFTA_TUNNEL_KEY_OPTS_GENEVE
 |  |
 |  |--NFTA_TUNNEL_KEY_GENEVE_CLASS
 |  |--NFTA_TUNNEL_KEY_GENEVE_TYPE
 |  |--NFTA_TUNNEL_KEY_GENEVE_DATA
 |
 |--NFTA_TUNNEL_KEY_OPTS_GENEVE
 |  |
 |  |--NFTA_TUNNEL_KEY_GENEVE_CLASS
 |  |--NFTA_TUNNEL_KEY_GENEVE_TYPE
 |  |--NFTA_TUNNEL_KEY_GENEVE_DATA
 |
 |--NFTA_TUNNEL_KEY_OPTS_GENEVE
 ...

Otherwise, userspace tools won't be able to fetch the geneve options
configured correctly.

Fixes: 925d8446 ("netfilter: nft_tunnel: add support for geneve opts")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 996d62ec

net/netfilter/nft_tunnel.c

+4 −4

Original line number	Diff line number	Diff line
		@@ -621,10 +621,10 @@ static int nft_tunnel_opts_dump(struct sk_buff *skb,
		struct geneve_opt *opt;
		int offset = 0;

		while (opts->len > offset) {
		inner = nla_nest_start_noflag(skb, NFTA_TUNNEL_KEY_OPTS_GENEVE);
		if (!inner)
		goto failure;
		while (opts->len > offset) {
		opt = (struct geneve_opt *)(opts->u.data + offset);
		if (nla_put_be16(skb, NFTA_TUNNEL_KEY_GENEVE_CLASS,
		opt->opt_class) \|\|
		@@ -634,9 +634,9 @@ static int nft_tunnel_opts_dump(struct sk_buff *skb,
		opt->length * 4, opt->opt_data))
		goto inner_failure;
		offset += sizeof(opt) + opt->length 4;
		}
		nla_nest_end(skb, inner);
		}
		}
		nla_nest_end(skb, nest);
		return 0;