On Fri, Jul 03, 2026 at 05:37:08PM +0800, Zhixing Chen wrote:
GTPv1-U packets may carry a chain of extension headers before the inner IP packet. The receive path already parses and skips these extension headers, but it currently reads the inner protocol before doing so.
As a result, the first extension header byte is interpreted as the inner IP version. Packets with extension headers are then dropped before PDP lookup.
Parse the extension header chain before calling gtp_inner_proto(), so the inner protocol is read from the actual inner IP header.
Fixes: c75fc0b9e5be ("gtp: identify tunnel via GTP device + GTP version + TEID + family") Signed-off-by: Zhixing Chen running910@gmail.com
Reviewed-by: Pablo Neira Ayuso pablo@netfilter.org
On Fri, Jul 03, 2026 at 01:38:39PM +0200, Pablo Neira Ayuso wrote:
On Fri, Jul 03, 2026 at 05:37:08PM +0800, Zhixing Chen wrote:
GTPv1-U packets may carry a chain of extension headers before the inner IP packet. The receive path already parses and skips these extension headers, but it currently reads the inner protocol before doing so.
As a result, the first extension header byte is interpreted as the inner IP version. Packets with extension headers are then dropped before PDP lookup.
Parse the extension header chain before calling gtp_inner_proto(), so the inner protocol is read from the actual inner IP header.
Fixes: c75fc0b9e5be ("gtp: identify tunnel via GTP device + GTP version + TEID + family") Signed-off-by: Zhixing Chen running910@gmail.com
Reviewed-by: Pablo Neira Ayuso pablo@netfilter.org
Patch is not good, it needs to refetch gtp header after pskb_may_pull().
osmocom-net-gprs@lists.osmocom.org
-
Pablo Neira Ayuso