Refactored to ensure if udp payload is less than geneve header size packet will still be processed as non geneve udp packet

Author: r-caamano

src/zfw_tc_ingress.c

@@ -1135,46 +1135,43 @@ static struct bpf_sock_tuple *get_tuple(struct __sk_buff *skb, __u64 nh_off,
                 /* read receive geneve version and header length */
                 __u8 *genhdr = NULL;
                 genhdr = (void *)(unsigned long)(skb->data + nh_off + sizeof(struct iphdr) + sizeof(struct udphdr));
-                if ((unsigned long)(genhdr + 1) > (unsigned long)skb->data_end){
-                    event->error_code = GENEVE_HEADER_TOO_BIG;
-                    send_event(event);
-                    return NULL;
-                }
-                __u32 gen_ver  = genhdr[0] & 0xC0 >> 6;
-                __u32 gen_hdr_len = genhdr[0] & 0x3F;
-            
-                /* if the length is not equal to 32 bytes and version 0 */
-                if ((gen_hdr_len == AWS_GNV_HDR_OPT_LEN / 4) && (gen_ver == GENEVE_VER)){
-                    /* Updating the skb to pop geneve header */
-                    int ret = 0;
-                    ret = bpf_skb_adjust_room(skb, -68, BPF_ADJ_ROOM_MAC, 0);
-                    if (ret) {
-                        event->error_code = SKB_ADJUST_ERROR;
-                        send_event(event);
-                        return NULL;
-                    }
-                    /* Initialize iph for after popping outer */
-                    iph = (struct iphdr *)(skb->data + nh_off);
-                    if((unsigned long)(iph + 1) > (unsigned long)skb->data_end){
-                        event->error_code = IP_HEADER_TOO_BIG;
-                        send_event(event);
-                        return NULL;
-                    }
-                    unsigned char version = iph->version;
-                    if(version == 6){
-                        *ipv4 = false;
-                        event->version = 6;
-                        ip6h = (struct ipv6hdr *)(skb->data + nh_off);
-                        /* ensure ip header is in packet bounds */
-                        if ((unsigned long)(ip6h + 1) > (unsigned long)skb->data_end){
-                            event->error_code = IP6_HEADER_TOO_BIG;
+                if ((unsigned long)(genhdr + 1) <= (unsigned long)skb->data_end){
+                    __u32 gen_ver  = genhdr[0] & 0xC0 >> 6;
+                    __u32 gen_hdr_len = genhdr[0] & 0x3F;
+                
+                    /* if the length is not equal to 32 bytes and version 0 */
+                    if ((gen_hdr_len == AWS_GNV_HDR_OPT_LEN / 4) && (gen_ver == GENEVE_VER)){
+                        /* Updating the skb to pop geneve header */
+                        int ret = 0;
+                        ret = bpf_skb_adjust_room(skb, -68, BPF_ADJ_ROOM_MAC, 0);
+                        if (ret) {
+                            event->error_code = SKB_ADJUST_ERROR;
                             send_event(event);
                             return NULL;
                         }
-                        *ipv6 = true;
-                        proto = ip6h->nexthdr;
-                    }else{
-                        proto = iph->protocol;
+                        /* Initialize iph for after popping outer */
+                        iph = (struct iphdr *)(skb->data + nh_off);
+                        if((unsigned long)(iph + 1) > (unsigned long)skb->data_end){
+                            event->error_code = IP_HEADER_TOO_BIG;
+                            send_event(event);
+                            return NULL;
+                        }
+                        unsigned char version = iph->version;
+                        if(version == 6){
+                            *ipv4 = false;
+                            event->version = 6;
+                            ip6h = (struct ipv6hdr *)(skb->data + nh_off);
+                            /* ensure ip header is in packet bounds */
+                            if ((unsigned long)(ip6h + 1) > (unsigned long)skb->data_end){
+                                event->error_code = IP6_HEADER_TOO_BIG;
+                                send_event(event);
+                                return NULL;
+                            }
+                            *ipv6 = true;
+                            proto = ip6h->nexthdr;
+                        }else{
+                            proto = iph->protocol;
+                        }
                     }
                 }