From: Eric Leblond <eric@regit.org>
Date: Thu, 14 Feb 2019 11:54:32 +0000 (+0100)
Subject: ebpf: remove BPF_LL_OFF in nhoff offset
X-Git-Tag: suricata-5.0.0-rc1~373
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=638a006e877e489074475af553e0a56e704a2b7c;p=thirdparty%2Fsuricata.git

ebpf: remove BPF_LL_OFF in nhoff offset

It fixes invalid parsing in with recent kernels and does
not affect older kernels.
---

diff --git a/ebpf/bypass_filter.c b/ebpf/bypass_filter.c
index 6d5206ecd5..0e858eed2f 100644
--- a/ebpf/bypass_filter.c
+++ b/ebpf/bypass_filter.c
@@ -207,7 +207,7 @@ static __always_inline int ipv6_filter(struct __sk_buff *skb)
  * \return 0 to drop packet out and -1 to accept it
  */
 int SEC("filter") hashfilter(struct __sk_buff *skb) {
-    __u32 nhoff = BPF_LL_OFF + ETH_HLEN;
+    __u32 nhoff = ETH_HLEN;
 
     skb->cb[0] = nhoff;
     switch (skb->protocol) {
diff --git a/ebpf/filter.c b/ebpf/filter.c
index fcd29e5b3d..32a4431431 100644
--- a/ebpf/filter.c
+++ b/ebpf/filter.c
@@ -39,7 +39,7 @@ struct bpf_map_def SEC("maps") ipv4_drop = {
 };
 
 int SEC("filter") hashfilter(struct __sk_buff *skb) {
-    __u32 nhoff = BPF_LL_OFF + ETH_HLEN;
+    __u32 nhoff = ETH_HLEN;
     __u32 ip = 0;
     __u32 *value;