On Fri, Jul 03, 2026 at 01:38:39PM +0200, Pablo Neira Ayuso wrote:

On Fri, Jul 03, 2026 at 05:37:08PM +0800, Zhixing Chen wrote:

quoted

GTPv1-U packets may carry a chain of extension headers before the inner
IP packet. The receive path already parses and skips these extension
headers, but it currently reads the inner protocol before doing so.

As a result, the first extension header byte is interpreted as the inner
IP version. Packets with extension headers are then dropped before PDP
lookup.

Parse the extension header chain before calling gtp_inner_proto(), so the
inner protocol is read from the actual inner IP header.

Fixes: c75fc0b9e5be ("gtp: identify tunnel via GTP device + GTP version + TEID + family")
Signed-off-by: Zhixing Chen <redacted>

Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>

Patch is not good, it needs to refetch gtp header after
pskb_may_pull().