[PATCH net-next 0/2] erspan: fix two header parsing issues on receive

The ERSPAN type II and III receive paths, in ip_gre and ip6_gre, trust
the header more than they should:

Patch 1 drops packets whose ERSPAN version is neither 1 (type II) nor 2
(type III). With version 0 the ERSPAN header was passed up as the start
of the inner frame, and collect_md copied the metadata from bytes that
were not pulled. This is not urgent, so it goes to net-next with the
Fixes tags.

Patch 2 skips the optional platform specific sub-header of type III,
which follows the header when its O flag is set, as described in
draft-foschiano-erspan-03. Without it, the 8 bytes of sub-header ended
up at the start of the mirrored frame.

Both were checked with hand-built GRE/ERSPAN packets sent over a veth
into erspan and ip6erspan devices, in plain and collect_md mode: before
the series, the version 0 and the O flag packets come out corrupted;
after it, the first is dropped and the second comes out intact, and
type II and type III packets without the sub-header are unchanged. Ping
over erspan and ip6erspan, version 1 and 2, still works.

Haishuang Yan (2):
  erspan: drop packets with an unknown ERSPAN version
  erspan: skip the platform specific sub-header of ERSPAN type III

 include/net/erspan.h |  4 ++++
 net/ipv4/ip_gre.c    | 14 +++++++++++++-
 net/ipv6/ip6_gre.c   | 13 +++++++++++++
 3 files changed, 30 insertions(+), 1 deletion(-)

-- 
2.43.0