netfilter: nft_payload: access ipip payload for inner offset

ipip is an special case, transport and inner header offset are set to
the same offset to use the upcoming inner expression for matching on
inner tunnel headers.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 03a1f271bf4fb62b61517396553381889d13364d..84b490d6cc7599b60bc4131b1772f445a1a512f3 100644 (file)
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -132,6 +132,9 @@ static int __nft_payload_inner_offset(struct nft_pktinfo *pkt)
                pkt->inneroff = thoff + offset;
                }
                break;
+       case IPPROTO_IPIP:
+               pkt->inneroff = thoff;
+               break;
        default:
                return -1;
        }