1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* GTP according to GSM TS 09.60 / 3GPP TS 29.060 3 * 4 * (C) 2012-2014 by sysmocom - s.f.m.c. GmbH 5 * (C) 2016 by Pablo Neira Ayuso <pablo@netfilter.org> 6 * 7 * Author: Harald Welte <hwelte@sysmocom.de> 8 * Pablo Neira Ayuso <pablo@netfilter.org> 9 * Andreas Schultz <aschultz@travelping.com> 10 */ 11 12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 13 14 #include <linux/module.h> 15 #include <linux/skbuff.h> 16 #include <linux/udp.h> 17 #include <linux/rculist.h> 18 #include <linux/jhash.h> 19 #include <linux/if_tunnel.h> 20 #include <linux/net.h> 21 #include <linux/file.h> 22 #include <linux/gtp.h> 23 24 #include <net/net_namespace.h> 25 #include <net/protocol.h> 26 #include <net/ip.h> 27 #include <net/ipv6.h> 28 #include <net/udp.h> 29 #include <net/udp_tunnel.h> 30 #include <net/icmp.h> 31 #include <net/xfrm.h> 32 #include <net/genetlink.h> 33 #include <net/netns/generic.h> 34 #include <net/gtp.h> 35 36 /* An active session for the subscriber. */ 37 struct pdp_ctx { 38 struct hlist_node hlist_tid; 39 struct hlist_node hlist_addr; 40 41 union { 42 struct { 43 u64 tid; 44 u16 flow; 45 } v0; 46 struct { 47 u32 i_tei; 48 u32 o_tei; 49 } v1; 50 } u; 51 u8 gtp_version; 52 u16 af; 53 54 union { 55 struct in_addr addr; 56 struct in6_addr addr6; 57 } ms; 58 union { 59 struct in_addr addr; 60 struct in6_addr addr6; 61 } peer; 62 63 struct sock *sk; 64 struct net_device *dev; 65 66 atomic_t tx_seq; 67 struct rcu_head rcu_head; 68 }; 69 70 /* One instance of the GTP device. */ 71 struct gtp_dev { 72 struct list_head list; 73 74 struct sock *sk0; 75 struct sock *sk1u; 76 u8 sk_created; 77 78 struct net_device *dev; 79 struct net *net; 80 81 unsigned int role; 82 unsigned int hash_size; 83 struct hlist_head *tid_hash; 84 struct hlist_head *addr_hash; 85 86 u8 restart_count; 87 }; 88 89 struct echo_info { 90 u16 af; 91 u8 gtp_version; 92 93 union { 94 struct in_addr addr; 95 } ms; 96 union { 97 struct in_addr addr; 98 } peer; 99 }; 100 101 static unsigned int gtp_net_id __read_mostly; 102 103 struct gtp_net { 104 struct list_head gtp_dev_list; 105 }; 106 107 static u32 gtp_h_initval; 108 109 static struct genl_family gtp_genl_family; 110 111 enum gtp_multicast_groups { 112 GTP_GENL_MCGRP, 113 }; 114 115 static const struct genl_multicast_group gtp_genl_mcgrps[] = { 116 [GTP_GENL_MCGRP] = { .name = GTP_GENL_MCGRP_NAME }, 117 }; 118 119 static void pdp_context_delete(struct pdp_ctx *pctx); 120 121 static inline u32 gtp0_hashfn(u64 tid) 122 { 123 u32 *tid32 = (u32 *) &tid; 124 return jhash_2words(tid32[0], tid32[1], gtp_h_initval); 125 } 126 127 static inline u32 gtp1u_hashfn(u32 tid) 128 { 129 return jhash_1word(tid, gtp_h_initval); 130 } 131 132 static inline u32 ipv4_hashfn(__be32 ip) 133 { 134 return jhash_1word((__force u32)ip, gtp_h_initval); 135 } 136 137 static u32 ipv6_hashfn(const struct in6_addr *ip6) 138 { 139 return jhash_2words((__force u32)ip6->s6_addr32[0], 140 (__force u32)ip6->s6_addr32[1], gtp_h_initval); 141 } 142 143 /* Resolve a PDP context structure based on the 64bit TID. */ 144 static struct pdp_ctx *gtp0_pdp_find(struct gtp_dev *gtp, u64 tid, u16 family) 145 { 146 struct hlist_head *head; 147 struct pdp_ctx *pdp; 148 149 head = >p->tid_hash[gtp0_hashfn(tid) % gtp->hash_size]; 150 151 hlist_for_each_entry_rcu(pdp, head, hlist_tid) { 152 if (pdp->af == family && 153 pdp->gtp_version == GTP_V0 && 154 pdp->u.v0.tid == tid) 155 return pdp; 156 } 157 return NULL; 158 } 159 160 /* Resolve a PDP context structure based on the 32bit TEI. */ 161 static struct pdp_ctx *gtp1_pdp_find(struct gtp_dev *gtp, u32 tid, u16 family) 162 { 163 struct hlist_head *head; 164 struct pdp_ctx *pdp; 165 166 head = >p->tid_hash[gtp1u_hashfn(tid) % gtp->hash_size]; 167 168 hlist_for_each_entry_rcu(pdp, head, hlist_tid) { 169 if (pdp->af == family && 170 pdp->gtp_version == GTP_V1 && 171 pdp->u.v1.i_tei == tid) 172 return pdp; 173 } 174 return NULL; 175 } 176 177 /* Resolve a PDP context based on IPv4 address of MS. */ 178 static struct pdp_ctx *ipv4_pdp_find(struct gtp_dev *gtp, __be32 ms_addr) 179 { 180 struct hlist_head *head; 181 struct pdp_ctx *pdp; 182 183 head = >p->addr_hash[ipv4_hashfn(ms_addr) % gtp->hash_size]; 184 185 hlist_for_each_entry_rcu(pdp, head, hlist_addr) { 186 if (pdp->af == AF_INET && 187 pdp->ms.addr.s_addr == ms_addr) 188 return pdp; 189 } 190 191 return NULL; 192 } 193 194 /* 3GPP TS 29.060: PDN Connection: the association between a MS represented by 195 * [...] one IPv6 *prefix* and a PDN represented by an APN. 196 * 197 * Then, 3GPP TS 29.061, Section 11.2.1.3 says: The size of the prefix shall be 198 * according to the maximum prefix length for a global IPv6 address as 199 * specified in the IPv6 Addressing Architecture, see RFC 4291. 200 * 201 * Finally, RFC 4291 section 2.5.4 states: All Global Unicast addresses other 202 * than those that start with binary 000 have a 64-bit interface ID field 203 * (i.e., n + m = 64). 204 */ 205 static bool ipv6_pdp_addr_equal(const struct in6_addr *a, 206 const struct in6_addr *b) 207 { 208 return a->s6_addr32[0] == b->s6_addr32[0] && 209 a->s6_addr32[1] == b->s6_addr32[1]; 210 } 211 212 static struct pdp_ctx *ipv6_pdp_find(struct gtp_dev *gtp, 213 const struct in6_addr *ms_addr) 214 { 215 struct hlist_head *head; 216 struct pdp_ctx *pdp; 217 218 head = >p->addr_hash[ipv6_hashfn(ms_addr) % gtp->hash_size]; 219 220 hlist_for_each_entry_rcu(pdp, head, hlist_addr) { 221 if (pdp->af == AF_INET6 && 222 ipv6_pdp_addr_equal(&pdp->ms.addr6, ms_addr)) 223 return pdp; 224 } 225 226 return NULL; 227 } 228 229 static bool gtp_check_ms_ipv4(struct sk_buff *skb, struct pdp_ctx *pctx, 230 unsigned int hdrlen, unsigned int role) 231 { 232 struct iphdr *iph; 233 234 if (!pskb_may_pull(skb, hdrlen + sizeof(struct iphdr))) 235 return false; 236 237 iph = (struct iphdr *)(skb->data + hdrlen); 238 239 if (role == GTP_ROLE_SGSN) 240 return iph->daddr == pctx->ms.addr.s_addr; 241 else 242 return iph->saddr == pctx->ms.addr.s_addr; 243 } 244 245 static bool gtp_check_ms_ipv6(struct sk_buff *skb, struct pdp_ctx *pctx, 246 unsigned int hdrlen, unsigned int role) 247 { 248 struct ipv6hdr *ip6h; 249 int ret; 250 251 if (!pskb_may_pull(skb, hdrlen + sizeof(struct ipv6hdr))) 252 return false; 253 254 ip6h = (struct ipv6hdr *)(skb->data + hdrlen); 255 256 if ((ipv6_addr_type(&ip6h->saddr) & IPV6_ADDR_LINKLOCAL) || 257 (ipv6_addr_type(&ip6h->daddr) & IPV6_ADDR_LINKLOCAL)) 258 return false; 259 260 if (role == GTP_ROLE_SGSN) { 261 ret = ipv6_pdp_addr_equal(&ip6h->daddr, &pctx->ms.addr6); 262 } else { 263 ret = ipv6_pdp_addr_equal(&ip6h->saddr, &pctx->ms.addr6); 264 } 265 266 return ret; 267 } 268 269 /* Check if the inner IP address in this packet is assigned to any 270 * existing mobile subscriber. 271 */ 272 static bool gtp_check_ms(struct sk_buff *skb, struct pdp_ctx *pctx, 273 unsigned int hdrlen, unsigned int role, 274 __u16 inner_proto) 275 { 276 switch (inner_proto) { 277 case ETH_P_IP: 278 return gtp_check_ms_ipv4(skb, pctx, hdrlen, role); 279 case ETH_P_IPV6: 280 return gtp_check_ms_ipv6(skb, pctx, hdrlen, role); 281 } 282 return false; 283 } 284 285 static int gtp_inner_proto(struct sk_buff *skb, unsigned int hdrlen, 286 __u16 *inner_proto) 287 { 288 __u8 *ip_version, _ip_version; 289 290 ip_version = skb_header_pointer(skb, hdrlen, sizeof(*ip_version), 291 &_ip_version); 292 if (!ip_version) 293 return -1; 294 295 switch (*ip_version & 0xf0) { 296 case 0x40: 297 *inner_proto = ETH_P_IP; 298 break; 299 case 0x60: 300 *inner_proto = ETH_P_IPV6; 301 break; 302 default: 303 return -1; 304 } 305 306 return 0; 307 } 308 309 static int gtp_rx(struct pdp_ctx *pctx, struct sk_buff *skb, 310 unsigned int hdrlen, unsigned int role, __u16 inner_proto) 311 { 312 if (!gtp_check_ms(skb, pctx, hdrlen, role, inner_proto)) { 313 netdev_dbg(pctx->dev, "No PDP ctx for this MS\n"); 314 return 1; 315 } 316 317 /* Get rid of the GTP + UDP headers. */ 318 if (iptunnel_pull_header(skb, hdrlen, htons(inner_proto), 319 !net_eq(sock_net(pctx->sk), dev_net(pctx->dev)))) { 320 pctx->dev->stats.rx_length_errors++; 321 goto err; 322 } 323 324 netdev_dbg(pctx->dev, "forwarding packet from GGSN to uplink\n"); 325 326 /* Now that the UDP and the GTP header have been removed, set up the 327 * new network header. This is required by the upper layer to 328 * calculate the transport header. 329 */ 330 skb_reset_network_header(skb); 331 skb_reset_mac_header(skb); 332 333 skb->dev = pctx->dev; 334 335 dev_sw_netstats_rx_add(pctx->dev, skb->len); 336 337 __netif_rx(skb); 338 return 0; 339 340 err: 341 pctx->dev->stats.rx_dropped++; 342 return -1; 343 } 344 345 static struct rtable *ip4_route_output_gtp(struct flowi4 *fl4, 346 const struct sock *sk, 347 __be32 daddr, __be32 saddr) 348 { 349 memset(fl4, 0, sizeof(*fl4)); 350 fl4->flowi4_oif = sk->sk_bound_dev_if; 351 fl4->daddr = daddr; 352 fl4->saddr = saddr; 353 fl4->flowi4_tos = ip_sock_rt_tos(sk); 354 fl4->flowi4_scope = ip_sock_rt_scope(sk); 355 fl4->flowi4_proto = sk->sk_protocol; 356 357 return ip_route_output_key(sock_net(sk), fl4); 358 } 359 360 static struct rt6_info *ip6_route_output_gtp(struct net *net, 361 struct flowi6 *fl6, 362 const struct sock *sk, 363 const struct in6_addr *daddr, 364 struct in6_addr *saddr) 365 { 366 struct dst_entry *dst; 367 368 memset(fl6, 0, sizeof(*fl6)); 369 fl6->flowi6_oif = sk->sk_bound_dev_if; 370 fl6->daddr = *daddr; 371 fl6->saddr = *saddr; 372 fl6->flowi6_proto = sk->sk_protocol; 373 374 dst = ipv6_stub->ipv6_dst_lookup_flow(net, sk, fl6, NULL); 375 if (IS_ERR(dst)) 376 return ERR_PTR(-ENETUNREACH); 377 378 return (struct rt6_info *)dst; 379 } 380 381 /* GSM TS 09.60. 7.3 382 * In all Path Management messages: 383 * - TID: is not used and shall be set to 0. 384 * - Flow Label is not used and shall be set to 0 385 * In signalling messages: 386 * - number: this field is not yet used in signalling messages. 387 * It shall be set to 255 by the sender and shall be ignored 388 * by the receiver 389 * Returns true if the echo req was correct, false otherwise. 390 */ 391 static bool gtp0_validate_echo_hdr(struct gtp0_header *gtp0) 392 { 393 return !(gtp0->tid || (gtp0->flags ^ 0x1e) || 394 gtp0->number != 0xff || gtp0->flow); 395 } 396 397 /* msg_type has to be GTP_ECHO_REQ or GTP_ECHO_RSP */ 398 static void gtp0_build_echo_msg(struct gtp0_header *hdr, __u8 msg_type) 399 { 400 int len_pkt, len_hdr; 401 402 hdr->flags = 0x1e; /* v0, GTP-non-prime. */ 403 hdr->type = msg_type; 404 /* GSM TS 09.60. 7.3 In all Path Management Flow Label and TID 405 * are not used and shall be set to 0. 406 */ 407 hdr->flow = 0; 408 hdr->tid = 0; 409 hdr->number = 0xff; 410 hdr->spare[0] = 0xff; 411 hdr->spare[1] = 0xff; 412 hdr->spare[2] = 0xff; 413 414 len_pkt = sizeof(struct gtp0_packet); 415 len_hdr = sizeof(struct gtp0_header); 416 417 if (msg_type == GTP_ECHO_RSP) 418 hdr->length = htons(len_pkt - len_hdr); 419 else 420 hdr->length = 0; 421 } 422 423 static int gtp0_send_echo_resp_ip(struct gtp_dev *gtp, struct sk_buff *skb) 424 { 425 struct iphdr *iph = ip_hdr(skb); 426 struct flowi4 fl4; 427 struct rtable *rt; 428 429 /* find route to the sender, 430 * src address becomes dst address and vice versa. 431 */ 432 rt = ip4_route_output_gtp(&fl4, gtp->sk0, iph->saddr, iph->daddr); 433 if (IS_ERR(rt)) { 434 netdev_dbg(gtp->dev, "no route for echo response from %pI4\n", 435 &iph->saddr); 436 return -1; 437 } 438 439 udp_tunnel_xmit_skb(rt, gtp->sk0, skb, 440 fl4.saddr, fl4.daddr, 441 iph->tos, 442 ip4_dst_hoplimit(&rt->dst), 443 0, 444 htons(GTP0_PORT), htons(GTP0_PORT), 445 !net_eq(sock_net(gtp->sk1u), 446 dev_net(gtp->dev)), 447 false); 448 449 return 0; 450 } 451 452 static int gtp0_send_echo_resp(struct gtp_dev *gtp, struct sk_buff *skb) 453 { 454 struct gtp0_packet *gtp_pkt; 455 struct gtp0_header *gtp0; 456 __be16 seq; 457 458 gtp0 = (struct gtp0_header *)(skb->data + sizeof(struct udphdr)); 459 460 if (!gtp0_validate_echo_hdr(gtp0)) 461 return -1; 462 463 seq = gtp0->seq; 464 465 /* pull GTP and UDP headers */ 466 skb_pull_data(skb, sizeof(struct gtp0_header) + sizeof(struct udphdr)); 467 468 gtp_pkt = skb_push(skb, sizeof(struct gtp0_packet)); 469 memset(gtp_pkt, 0, sizeof(struct gtp0_packet)); 470 471 gtp0_build_echo_msg(>p_pkt->gtp0_h, GTP_ECHO_RSP); 472 473 /* GSM TS 09.60. 7.3 The Sequence Number in a signalling response 474 * message shall be copied from the signalling request message 475 * that the GSN is replying to. 476 */ 477 gtp_pkt->gtp0_h.seq = seq; 478 479 gtp_pkt->ie.tag = GTPIE_RECOVERY; 480 gtp_pkt->ie.val = gtp->restart_count; 481 482 switch (gtp->sk0->sk_family) { 483 case AF_INET: 484 if (gtp0_send_echo_resp_ip(gtp, skb) < 0) 485 return -1; 486 break; 487 case AF_INET6: 488 return -1; 489 } 490 491 return 0; 492 } 493 494 static int gtp_genl_fill_echo(struct sk_buff *skb, u32 snd_portid, u32 snd_seq, 495 int flags, u32 type, struct echo_info echo) 496 { 497 void *genlh; 498 499 genlh = genlmsg_put(skb, snd_portid, snd_seq, >p_genl_family, flags, 500 type); 501 if (!genlh) 502 goto failure; 503 504 if (nla_put_u32(skb, GTPA_VERSION, echo.gtp_version) || 505 nla_put_be32(skb, GTPA_PEER_ADDRESS, echo.peer.addr.s_addr) || 506 nla_put_be32(skb, GTPA_MS_ADDRESS, echo.ms.addr.s_addr)) 507 goto failure; 508 509 genlmsg_end(skb, genlh); 510 return 0; 511 512 failure: 513 genlmsg_cancel(skb, genlh); 514 return -EMSGSIZE; 515 } 516 517 static void gtp0_handle_echo_resp_ip(struct sk_buff *skb, struct echo_info *echo) 518 { 519 struct iphdr *iph = ip_hdr(skb); 520 521 echo->ms.addr.s_addr = iph->daddr; 522 echo->peer.addr.s_addr = iph->saddr; 523 echo->gtp_version = GTP_V0; 524 } 525 526 static int gtp0_handle_echo_resp(struct gtp_dev *gtp, struct sk_buff *skb) 527 { 528 struct gtp0_header *gtp0; 529 struct echo_info echo; 530 struct sk_buff *msg; 531 int ret; 532 533 gtp0 = (struct gtp0_header *)(skb->data + sizeof(struct udphdr)); 534 535 if (!gtp0_validate_echo_hdr(gtp0)) 536 return -1; 537 538 switch (gtp->sk0->sk_family) { 539 case AF_INET: 540 gtp0_handle_echo_resp_ip(skb, &echo); 541 break; 542 case AF_INET6: 543 return -1; 544 } 545 546 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 547 if (!msg) 548 return -ENOMEM; 549 550 ret = gtp_genl_fill_echo(msg, 0, 0, 0, GTP_CMD_ECHOREQ, echo); 551 if (ret < 0) { 552 nlmsg_free(msg); 553 return ret; 554 } 555 556 return genlmsg_multicast_netns(>p_genl_family, dev_net(gtp->dev), 557 msg, 0, GTP_GENL_MCGRP, GFP_ATOMIC); 558 } 559 560 static int gtp_proto_to_family(__u16 proto) 561 { 562 switch (proto) { 563 case ETH_P_IP: 564 return AF_INET; 565 case ETH_P_IPV6: 566 return AF_INET6; 567 default: 568 WARN_ON_ONCE(1); 569 break; 570 } 571 572 return AF_UNSPEC; 573 } 574 575 /* 1 means pass up to the stack, -1 means drop and 0 means decapsulated. */ 576 static int gtp0_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb) 577 { 578 unsigned int hdrlen = sizeof(struct udphdr) + 579 sizeof(struct gtp0_header); 580 struct gtp0_header *gtp0; 581 struct pdp_ctx *pctx; 582 __u16 inner_proto; 583 584 if (!pskb_may_pull(skb, hdrlen)) 585 return -1; 586 587 gtp0 = (struct gtp0_header *)(skb->data + sizeof(struct udphdr)); 588 589 if ((gtp0->flags >> 5) != GTP_V0) 590 return 1; 591 592 /* If the sockets were created in kernel, it means that 593 * there is no daemon running in userspace which would 594 * handle echo request. 595 */ 596 if (gtp0->type == GTP_ECHO_REQ && gtp->sk_created) 597 return gtp0_send_echo_resp(gtp, skb); 598 599 if (gtp0->type == GTP_ECHO_RSP && gtp->sk_created) 600 return gtp0_handle_echo_resp(gtp, skb); 601 602 if (gtp0->type != GTP_TPDU) 603 return 1; 604 605 if (gtp_inner_proto(skb, hdrlen, &inner_proto) < 0) { 606 netdev_dbg(gtp->dev, "GTP packet does not encapsulate an IP packet\n"); 607 return -1; 608 } 609 610 pctx = gtp0_pdp_find(gtp, be64_to_cpu(gtp0->tid), 611 gtp_proto_to_family(inner_proto)); 612 if (!pctx) { 613 netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb); 614 return 1; 615 } 616 617 return gtp_rx(pctx, skb, hdrlen, gtp->role, inner_proto); 618 } 619 620 /* msg_type has to be GTP_ECHO_REQ or GTP_ECHO_RSP */ 621 static void gtp1u_build_echo_msg(struct gtp1_header_long *hdr, __u8 msg_type) 622 { 623 int len_pkt, len_hdr; 624 625 /* S flag must be set to 1 */ 626 hdr->flags = 0x32; /* v1, GTP-non-prime. */ 627 hdr->type = msg_type; 628 /* 3GPP TS 29.281 5.1 - TEID has to be set to 0 */ 629 hdr->tid = 0; 630 631 /* seq, npdu and next should be counted to the length of the GTP packet 632 * that's why szie of gtp1_header should be subtracted, 633 * not size of gtp1_header_long. 634 */ 635 636 len_hdr = sizeof(struct gtp1_header); 637 638 if (msg_type == GTP_ECHO_RSP) { 639 len_pkt = sizeof(struct gtp1u_packet); 640 hdr->length = htons(len_pkt - len_hdr); 641 } else { 642 /* GTP_ECHO_REQ does not carry GTP Information Element, 643 * the why gtp1_header_long is used here. 644 */ 645 len_pkt = sizeof(struct gtp1_header_long); 646 hdr->length = htons(len_pkt - len_hdr); 647 } 648 } 649 650 static int gtp1u_send_echo_resp(struct gtp_dev *gtp, struct sk_buff *skb) 651 { 652 struct gtp1_header_long *gtp1u; 653 struct gtp1u_packet *gtp_pkt; 654 struct rtable *rt; 655 struct flowi4 fl4; 656 struct iphdr *iph; 657 658 gtp1u = (struct gtp1_header_long *)(skb->data + sizeof(struct udphdr)); 659 660 /* 3GPP TS 29.281 5.1 - For the Echo Request, Echo Response, 661 * Error Indication and Supported Extension Headers Notification 662 * messages, the S flag shall be set to 1 and TEID shall be set to 0. 663 */ 664 if (!(gtp1u->flags & GTP1_F_SEQ) || gtp1u->tid) 665 return -1; 666 667 /* pull GTP and UDP headers */ 668 skb_pull_data(skb, 669 sizeof(struct gtp1_header_long) + sizeof(struct udphdr)); 670 671 gtp_pkt = skb_push(skb, sizeof(struct gtp1u_packet)); 672 memset(gtp_pkt, 0, sizeof(struct gtp1u_packet)); 673 674 gtp1u_build_echo_msg(>p_pkt->gtp1u_h, GTP_ECHO_RSP); 675 676 /* 3GPP TS 29.281 7.7.2 - The Restart Counter value in the 677 * Recovery information element shall not be used, i.e. it shall 678 * be set to zero by the sender and shall be ignored by the receiver. 679 * The Recovery information element is mandatory due to backwards 680 * compatibility reasons. 681 */ 682 gtp_pkt->ie.tag = GTPIE_RECOVERY; 683 gtp_pkt->ie.val = 0; 684 685 iph = ip_hdr(skb); 686 687 /* find route to the sender, 688 * src address becomes dst address and vice versa. 689 */ 690 rt = ip4_route_output_gtp(&fl4, gtp->sk1u, iph->saddr, iph->daddr); 691 if (IS_ERR(rt)) { 692 netdev_dbg(gtp->dev, "no route for echo response from %pI4\n", 693 &iph->saddr); 694 return -1; 695 } 696 697 udp_tunnel_xmit_skb(rt, gtp->sk1u, skb, 698 fl4.saddr, fl4.daddr, 699 iph->tos, 700 ip4_dst_hoplimit(&rt->dst), 701 0, 702 htons(GTP1U_PORT), htons(GTP1U_PORT), 703 !net_eq(sock_net(gtp->sk1u), 704 dev_net(gtp->dev)), 705 false); 706 return 0; 707 } 708 709 static int gtp1u_handle_echo_resp(struct gtp_dev *gtp, struct sk_buff *skb) 710 { 711 struct gtp1_header_long *gtp1u; 712 struct echo_info echo; 713 struct sk_buff *msg; 714 struct iphdr *iph; 715 int ret; 716 717 gtp1u = (struct gtp1_header_long *)(skb->data + sizeof(struct udphdr)); 718 719 /* 3GPP TS 29.281 5.1 - For the Echo Request, Echo Response, 720 * Error Indication and Supported Extension Headers Notification 721 * messages, the S flag shall be set to 1 and TEID shall be set to 0. 722 */ 723 if (!(gtp1u->flags & GTP1_F_SEQ) || gtp1u->tid) 724 return -1; 725 726 iph = ip_hdr(skb); 727 echo.ms.addr.s_addr = iph->daddr; 728 echo.peer.addr.s_addr = iph->saddr; 729 echo.gtp_version = GTP_V1; 730 731 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 732 if (!msg) 733 return -ENOMEM; 734 735 ret = gtp_genl_fill_echo(msg, 0, 0, 0, GTP_CMD_ECHOREQ, echo); 736 if (ret < 0) { 737 nlmsg_free(msg); 738 return ret; 739 } 740 741 return genlmsg_multicast_netns(>p_genl_family, dev_net(gtp->dev), 742 msg, 0, GTP_GENL_MCGRP, GFP_ATOMIC); 743 } 744 745 static int gtp_parse_exthdrs(struct sk_buff *skb, unsigned int *hdrlen) 746 { 747 struct gtp_ext_hdr *gtp_exthdr, _gtp_exthdr; 748 unsigned int offset = *hdrlen; 749 __u8 *next_type, _next_type; 750 751 /* From 29.060: "The Extension Header Length field specifies the length 752 * of the particular Extension header in 4 octets units." 753 * 754 * This length field includes length field size itself (1 byte), 755 * payload (variable length) and next type (1 byte). The extension 756 * header is aligned to to 4 bytes. 757 */ 758 759 do { 760 gtp_exthdr = skb_header_pointer(skb, offset, sizeof(*gtp_exthdr), 761 &_gtp_exthdr); 762 if (!gtp_exthdr || !gtp_exthdr->len) 763 return -1; 764 765 offset += gtp_exthdr->len * 4; 766 767 /* From 29.060: "If no such Header follows, then the value of 768 * the Next Extension Header Type shall be 0." 769 */ 770 next_type = skb_header_pointer(skb, offset - 1, 771 sizeof(_next_type), &_next_type); 772 if (!next_type) 773 return -1; 774 775 } while (*next_type != 0); 776 777 *hdrlen = offset; 778 779 return 0; 780 } 781 782 static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb) 783 { 784 unsigned int hdrlen = sizeof(struct udphdr) + 785 sizeof(struct gtp1_header); 786 struct gtp1_header *gtp1; 787 struct pdp_ctx *pctx; 788 __u16 inner_proto; 789 790 if (!pskb_may_pull(skb, hdrlen)) 791 return -1; 792 793 gtp1 = (struct gtp1_header *)(skb->data + sizeof(struct udphdr)); 794 795 if ((gtp1->flags >> 5) != GTP_V1) 796 return 1; 797 798 /* If the sockets were created in kernel, it means that 799 * there is no daemon running in userspace which would 800 * handle echo request. 801 */ 802 if (gtp1->type == GTP_ECHO_REQ && gtp->sk_created) 803 return gtp1u_send_echo_resp(gtp, skb); 804 805 if (gtp1->type == GTP_ECHO_RSP && gtp->sk_created) 806 return gtp1u_handle_echo_resp(gtp, skb); 807 808 if (gtp1->type != GTP_TPDU) 809 return 1; 810 811 /* From 29.060: "This field shall be present if and only if any one or 812 * more of the S, PN and E flags are set.". 813 * 814 * If any of the bit is set, then the remaining ones also have to be 815 * set. 816 */ 817 if (gtp1->flags & GTP1_F_MASK) 818 hdrlen += 4; 819 820 /* Make sure the header is larger enough, including extensions. */ 821 if (!pskb_may_pull(skb, hdrlen)) 822 return -1; 823 824 if (gtp_inner_proto(skb, hdrlen, &inner_proto) < 0) { 825 netdev_dbg(gtp->dev, "GTP packet does not encapsulate an IP packet\n"); 826 return -1; 827 } 828 829 gtp1 = (struct gtp1_header *)(skb->data + sizeof(struct udphdr)); 830 831 pctx = gtp1_pdp_find(gtp, ntohl(gtp1->tid), 832 gtp_proto_to_family(inner_proto)); 833 if (!pctx) { 834 netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb); 835 return 1; 836 } 837 838 if (gtp1->flags & GTP1_F_EXTHDR && 839 gtp_parse_exthdrs(skb, &hdrlen) < 0) 840 return -1; 841 842 return gtp_rx(pctx, skb, hdrlen, gtp->role, inner_proto); 843 } 844 845 static void __gtp_encap_destroy(struct sock *sk) 846 { 847 struct gtp_dev *gtp; 848 849 lock_sock(sk); 850 gtp = sk->sk_user_data; 851 if (gtp) { 852 if (gtp->sk0 == sk) 853 gtp->sk0 = NULL; 854 else 855 gtp->sk1u = NULL; 856 WRITE_ONCE(udp_sk(sk)->encap_type, 0); 857 rcu_assign_sk_user_data(sk, NULL); 858 release_sock(sk); 859 sock_put(sk); 860 return; 861 } 862 release_sock(sk); 863 } 864 865 static void gtp_encap_destroy(struct sock *sk) 866 { 867 rtnl_lock(); 868 __gtp_encap_destroy(sk); 869 rtnl_unlock(); 870 } 871 872 static void gtp_encap_disable_sock(struct sock *sk) 873 { 874 if (!sk) 875 return; 876 877 __gtp_encap_destroy(sk); 878 } 879 880 static void gtp_encap_disable(struct gtp_dev *gtp) 881 { 882 if (gtp->sk_created) { 883 udp_tunnel_sock_release(gtp->sk0->sk_socket); 884 udp_tunnel_sock_release(gtp->sk1u->sk_socket); 885 gtp->sk_created = false; 886 gtp->sk0 = NULL; 887 gtp->sk1u = NULL; 888 } else { 889 gtp_encap_disable_sock(gtp->sk0); 890 gtp_encap_disable_sock(gtp->sk1u); 891 } 892 } 893 894 /* UDP encapsulation receive handler. See net/ipv4/udp.c. 895 * Return codes: 0: success, <0: error, >0: pass up to userspace UDP socket. 896 */ 897 static int gtp_encap_recv(struct sock *sk, struct sk_buff *skb) 898 { 899 struct gtp_dev *gtp; 900 int ret = 0; 901 902 gtp = rcu_dereference_sk_user_data(sk); 903 if (!gtp) 904 return 1; 905 906 netdev_dbg(gtp->dev, "encap_recv sk=%p\n", sk); 907 908 switch (READ_ONCE(udp_sk(sk)->encap_type)) { 909 case UDP_ENCAP_GTP0: 910 netdev_dbg(gtp->dev, "received GTP0 packet\n"); 911 ret = gtp0_udp_encap_recv(gtp, skb); 912 break; 913 case UDP_ENCAP_GTP1U: 914 netdev_dbg(gtp->dev, "received GTP1U packet\n"); 915 ret = gtp1u_udp_encap_recv(gtp, skb); 916 break; 917 default: 918 ret = -1; /* Shouldn't happen. */ 919 } 920 921 switch (ret) { 922 case 1: 923 netdev_dbg(gtp->dev, "pass up to the process\n"); 924 break; 925 case 0: 926 break; 927 case -1: 928 netdev_dbg(gtp->dev, "GTP packet has been dropped\n"); 929 kfree_skb(skb); 930 ret = 0; 931 break; 932 } 933 934 return ret; 935 } 936 937 static void gtp_dev_uninit(struct net_device *dev) 938 { 939 struct gtp_dev *gtp = netdev_priv(dev); 940 941 gtp_encap_disable(gtp); 942 } 943 944 static inline void gtp0_push_header(struct sk_buff *skb, struct pdp_ctx *pctx) 945 { 946 int payload_len = skb->len; 947 struct gtp0_header *gtp0; 948 949 gtp0 = skb_push(skb, sizeof(*gtp0)); 950 951 gtp0->flags = 0x1e; /* v0, GTP-non-prime. */ 952 gtp0->type = GTP_TPDU; 953 gtp0->length = htons(payload_len); 954 gtp0->seq = htons((atomic_inc_return(&pctx->tx_seq) - 1) % 0xffff); 955 gtp0->flow = htons(pctx->u.v0.flow); 956 gtp0->number = 0xff; 957 gtp0->spare[0] = gtp0->spare[1] = gtp0->spare[2] = 0xff; 958 gtp0->tid = cpu_to_be64(pctx->u.v0.tid); 959 } 960 961 static inline void gtp1_push_header(struct sk_buff *skb, struct pdp_ctx *pctx) 962 { 963 int payload_len = skb->len; 964 struct gtp1_header *gtp1; 965 966 gtp1 = skb_push(skb, sizeof(*gtp1)); 967 968 /* Bits 8 7 6 5 4 3 2 1 969 * +--+--+--+--+--+--+--+--+ 970 * |version |PT| 0| E| S|PN| 971 * +--+--+--+--+--+--+--+--+ 972 * 0 0 1 1 1 0 0 0 973 */ 974 gtp1->flags = 0x30; /* v1, GTP-non-prime. */ 975 gtp1->type = GTP_TPDU; 976 gtp1->length = htons(payload_len); 977 gtp1->tid = htonl(pctx->u.v1.o_tei); 978 979 /* TODO: Support for extension header, sequence number and N-PDU. 980 * Update the length field if any of them is available. 981 */ 982 } 983 984 struct gtp_pktinfo { 985 struct sock *sk; 986 union { 987 struct flowi4 fl4; 988 struct flowi6 fl6; 989 }; 990 union { 991 struct rtable *rt; 992 struct rt6_info *rt6; 993 }; 994 struct pdp_ctx *pctx; 995 struct net_device *dev; 996 __u8 tos; 997 __be16 gtph_port; 998 }; 999 1000 static void gtp_push_header(struct sk_buff *skb, struct gtp_pktinfo *pktinfo) 1001 { 1002 switch (pktinfo->pctx->gtp_version) { 1003 case GTP_V0: 1004 pktinfo->gtph_port = htons(GTP0_PORT); 1005 gtp0_push_header(skb, pktinfo->pctx); 1006 break; 1007 case GTP_V1: 1008 pktinfo->gtph_port = htons(GTP1U_PORT); 1009 gtp1_push_header(skb, pktinfo->pctx); 1010 break; 1011 } 1012 } 1013 1014 static inline void gtp_set_pktinfo_ipv4(struct gtp_pktinfo *pktinfo, 1015 struct sock *sk, __u8 tos, 1016 struct pdp_ctx *pctx, struct rtable *rt, 1017 struct flowi4 *fl4, 1018 struct net_device *dev) 1019 { 1020 pktinfo->sk = sk; 1021 pktinfo->tos = tos; 1022 pktinfo->pctx = pctx; 1023 pktinfo->rt = rt; 1024 pktinfo->fl4 = *fl4; 1025 pktinfo->dev = dev; 1026 } 1027 1028 static void gtp_set_pktinfo_ipv6(struct gtp_pktinfo *pktinfo, 1029 struct sock *sk, __u8 tos, 1030 struct pdp_ctx *pctx, struct rt6_info *rt6, 1031 struct flowi6 *fl6, 1032 struct net_device *dev) 1033 { 1034 pktinfo->sk = sk; 1035 pktinfo->tos = tos; 1036 pktinfo->pctx = pctx; 1037 pktinfo->rt6 = rt6; 1038 pktinfo->fl6 = *fl6; 1039 pktinfo->dev = dev; 1040 } 1041 1042 static int gtp_build_skb_outer_ip4(struct sk_buff *skb, struct net_device *dev, 1043 struct gtp_pktinfo *pktinfo, 1044 struct pdp_ctx *pctx, __u8 tos, 1045 __be16 frag_off) 1046 { 1047 struct rtable *rt; 1048 struct flowi4 fl4; 1049 __be16 df; 1050 int mtu; 1051 1052 rt = ip4_route_output_gtp(&fl4, pctx->sk, pctx->peer.addr.s_addr, 1053 inet_sk(pctx->sk)->inet_saddr); 1054 if (IS_ERR(rt)) { 1055 netdev_dbg(dev, "no route to SSGN %pI4\n", 1056 &pctx->peer.addr.s_addr); 1057 dev->stats.tx_carrier_errors++; 1058 goto err; 1059 } 1060 1061 if (rt->dst.dev == dev) { 1062 netdev_dbg(dev, "circular route to SSGN %pI4\n", 1063 &pctx->peer.addr.s_addr); 1064 dev->stats.collisions++; 1065 goto err_rt; 1066 } 1067 1068 /* This is similar to tnl_update_pmtu(). */ 1069 df = frag_off; 1070 if (df) { 1071 mtu = dst_mtu(&rt->dst) - dev->hard_header_len - 1072 sizeof(struct iphdr) - sizeof(struct udphdr); 1073 switch (pctx->gtp_version) { 1074 case GTP_V0: 1075 mtu -= sizeof(struct gtp0_header); 1076 break; 1077 case GTP_V1: 1078 mtu -= sizeof(struct gtp1_header); 1079 break; 1080 } 1081 } else { 1082 mtu = dst_mtu(&rt->dst); 1083 } 1084 1085 skb_dst_update_pmtu_no_confirm(skb, mtu); 1086 1087 if (frag_off & htons(IP_DF) && 1088 ((!skb_is_gso(skb) && skb->len > mtu) || 1089 (skb_is_gso(skb) && !skb_gso_validate_network_len(skb, mtu)))) { 1090 netdev_dbg(dev, "packet too big, fragmentation needed\n"); 1091 icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, 1092 htonl(mtu)); 1093 goto err_rt; 1094 } 1095 1096 gtp_set_pktinfo_ipv4(pktinfo, pctx->sk, tos, pctx, rt, &fl4, dev); 1097 gtp_push_header(skb, pktinfo); 1098 1099 return 0; 1100 err_rt: 1101 ip_rt_put(rt); 1102 err: 1103 return -EBADMSG; 1104 } 1105 1106 static int gtp_build_skb_outer_ip6(struct net *net, struct sk_buff *skb, 1107 struct net_device *dev, 1108 struct gtp_pktinfo *pktinfo, 1109 struct pdp_ctx *pctx, __u8 tos) 1110 { 1111 struct dst_entry *dst; 1112 struct rt6_info *rt; 1113 struct flowi6 fl6; 1114 int mtu; 1115 1116 rt = ip6_route_output_gtp(net, &fl6, pctx->sk, &pctx->peer.addr6, 1117 &inet6_sk(pctx->sk)->saddr); 1118 if (IS_ERR(rt)) { 1119 netdev_dbg(dev, "no route to SSGN %pI6\n", 1120 &pctx->peer.addr6); 1121 dev->stats.tx_carrier_errors++; 1122 goto err; 1123 } 1124 dst = &rt->dst; 1125 1126 if (rt->dst.dev == dev) { 1127 netdev_dbg(dev, "circular route to SSGN %pI6\n", 1128 &pctx->peer.addr6); 1129 dev->stats.collisions++; 1130 goto err_rt; 1131 } 1132 1133 mtu = dst_mtu(&rt->dst) - dev->hard_header_len - 1134 sizeof(struct ipv6hdr) - sizeof(struct udphdr); 1135 switch (pctx->gtp_version) { 1136 case GTP_V0: 1137 mtu -= sizeof(struct gtp0_header); 1138 break; 1139 case GTP_V1: 1140 mtu -= sizeof(struct gtp1_header); 1141 break; 1142 } 1143 1144 skb_dst_update_pmtu_no_confirm(skb, mtu); 1145 1146 if ((!skb_is_gso(skb) && skb->len > mtu) || 1147 (skb_is_gso(skb) && !skb_gso_validate_network_len(skb, mtu))) { 1148 netdev_dbg(dev, "packet too big, fragmentation needed\n"); 1149 icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); 1150 goto err_rt; 1151 } 1152 1153 gtp_set_pktinfo_ipv6(pktinfo, pctx->sk, tos, pctx, rt, &fl6, dev); 1154 gtp_push_header(skb, pktinfo); 1155 1156 return 0; 1157 err_rt: 1158 dst_release(dst); 1159 err: 1160 return -EBADMSG; 1161 } 1162 1163 static int gtp_build_skb_ip4(struct sk_buff *skb, struct net_device *dev, 1164 struct gtp_pktinfo *pktinfo) 1165 { 1166 struct gtp_dev *gtp = netdev_priv(dev); 1167 struct net *net = gtp->net; 1168 struct pdp_ctx *pctx; 1169 struct iphdr *iph; 1170 int ret; 1171 1172 /* Read the IP destination address and resolve the PDP context. 1173 * Prepend PDP header with TEI/TID from PDP ctx. 1174 */ 1175 iph = ip_hdr(skb); 1176 if (gtp->role == GTP_ROLE_SGSN) 1177 pctx = ipv4_pdp_find(gtp, iph->saddr); 1178 else 1179 pctx = ipv4_pdp_find(gtp, iph->daddr); 1180 1181 if (!pctx) { 1182 netdev_dbg(dev, "no PDP ctx found for %pI4, skip\n", 1183 &iph->daddr); 1184 return -ENOENT; 1185 } 1186 netdev_dbg(dev, "found PDP context %p\n", pctx); 1187 1188 switch (pctx->sk->sk_family) { 1189 case AF_INET: 1190 ret = gtp_build_skb_outer_ip4(skb, dev, pktinfo, pctx, 1191 iph->tos, iph->frag_off); 1192 break; 1193 case AF_INET6: 1194 ret = gtp_build_skb_outer_ip6(net, skb, dev, pktinfo, pctx, 1195 iph->tos); 1196 break; 1197 default: 1198 ret = -1; 1199 WARN_ON_ONCE(1); 1200 break; 1201 } 1202 1203 if (ret < 0) 1204 return ret; 1205 1206 netdev_dbg(dev, "gtp -> IP src: %pI4 dst: %pI4\n", 1207 &iph->saddr, &iph->daddr); 1208 1209 return 0; 1210 } 1211 1212 static int gtp_build_skb_ip6(struct sk_buff *skb, struct net_device *dev, 1213 struct gtp_pktinfo *pktinfo) 1214 { 1215 struct gtp_dev *gtp = netdev_priv(dev); 1216 struct net *net = gtp->net; 1217 struct pdp_ctx *pctx; 1218 struct ipv6hdr *ip6h; 1219 __u8 tos; 1220 int ret; 1221 1222 /* Read the IP destination address and resolve the PDP context. 1223 * Prepend PDP header with TEI/TID from PDP ctx. 1224 */ 1225 ip6h = ipv6_hdr(skb); 1226 if (gtp->role == GTP_ROLE_SGSN) 1227 pctx = ipv6_pdp_find(gtp, &ip6h->saddr); 1228 else 1229 pctx = ipv6_pdp_find(gtp, &ip6h->daddr); 1230 1231 if (!pctx) { 1232 netdev_dbg(dev, "no PDP ctx found for %pI6, skip\n", 1233 &ip6h->daddr); 1234 return -ENOENT; 1235 } 1236 netdev_dbg(dev, "found PDP context %p\n", pctx); 1237 1238 tos = ipv6_get_dsfield(ip6h); 1239 1240 switch (pctx->sk->sk_family) { 1241 case AF_INET: 1242 ret = gtp_build_skb_outer_ip4(skb, dev, pktinfo, pctx, tos, 0); 1243 break; 1244 case AF_INET6: 1245 ret = gtp_build_skb_outer_ip6(net, skb, dev, pktinfo, pctx, tos); 1246 break; 1247 default: 1248 ret = -1; 1249 WARN_ON_ONCE(1); 1250 break; 1251 } 1252 1253 if (ret < 0) 1254 return ret; 1255 1256 netdev_dbg(dev, "gtp -> IP src: %pI6 dst: %pI6\n", 1257 &ip6h->saddr, &ip6h->daddr); 1258 1259 return 0; 1260 } 1261 1262 static netdev_tx_t gtp_dev_xmit(struct sk_buff *skb, struct net_device *dev) 1263 { 1264 unsigned int proto = ntohs(skb->protocol); 1265 struct gtp_pktinfo pktinfo; 1266 int err; 1267 1268 /* Ensure there is sufficient headroom. */ 1269 if (skb_cow_head(skb, dev->needed_headroom)) 1270 goto tx_err; 1271 1272 if (!pskb_inet_may_pull(skb)) 1273 goto tx_err; 1274 1275 skb_reset_inner_headers(skb); 1276 1277 /* PDP context lookups in gtp_build_skb_*() need rcu read-side lock. */ 1278 rcu_read_lock(); 1279 switch (proto) { 1280 case ETH_P_IP: 1281 err = gtp_build_skb_ip4(skb, dev, &pktinfo); 1282 break; 1283 case ETH_P_IPV6: 1284 err = gtp_build_skb_ip6(skb, dev, &pktinfo); 1285 break; 1286 default: 1287 err = -EOPNOTSUPP; 1288 break; 1289 } 1290 rcu_read_unlock(); 1291 1292 if (err < 0) 1293 goto tx_err; 1294 1295 switch (pktinfo.pctx->sk->sk_family) { 1296 case AF_INET: 1297 udp_tunnel_xmit_skb(pktinfo.rt, pktinfo.sk, skb, 1298 pktinfo.fl4.saddr, pktinfo.fl4.daddr, 1299 pktinfo.tos, 1300 ip4_dst_hoplimit(&pktinfo.rt->dst), 1301 0, 1302 pktinfo.gtph_port, pktinfo.gtph_port, 1303 !net_eq(sock_net(pktinfo.pctx->sk), 1304 dev_net(dev)), 1305 false); 1306 break; 1307 case AF_INET6: 1308 #if IS_ENABLED(CONFIG_IPV6) 1309 udp_tunnel6_xmit_skb(&pktinfo.rt6->dst, pktinfo.sk, skb, dev, 1310 &pktinfo.fl6.saddr, &pktinfo.fl6.daddr, 1311 pktinfo.tos, 1312 ip6_dst_hoplimit(&pktinfo.rt->dst), 1313 0, 1314 pktinfo.gtph_port, pktinfo.gtph_port, 1315 false); 1316 #else 1317 goto tx_err; 1318 #endif 1319 break; 1320 } 1321 1322 return NETDEV_TX_OK; 1323 tx_err: 1324 dev->stats.tx_errors++; 1325 dev_kfree_skb(skb); 1326 return NETDEV_TX_OK; 1327 } 1328 1329 static const struct net_device_ops gtp_netdev_ops = { 1330 .ndo_uninit = gtp_dev_uninit, 1331 .ndo_start_xmit = gtp_dev_xmit, 1332 }; 1333 1334 static const struct device_type gtp_type = { 1335 .name = "gtp", 1336 }; 1337 1338 #define GTP_TH_MAXLEN (sizeof(struct udphdr) + sizeof(struct gtp0_header)) 1339 #define GTP_IPV4_MAXLEN (sizeof(struct iphdr) + GTP_TH_MAXLEN) 1340 1341 static void gtp_link_setup(struct net_device *dev) 1342 { 1343 struct gtp_dev *gtp = netdev_priv(dev); 1344 1345 dev->netdev_ops = >p_netdev_ops; 1346 dev->needs_free_netdev = true; 1347 SET_NETDEV_DEVTYPE(dev, >p_type); 1348 1349 dev->hard_header_len = 0; 1350 dev->addr_len = 0; 1351 dev->mtu = ETH_DATA_LEN - GTP_IPV4_MAXLEN; 1352 1353 /* Zero header length. */ 1354 dev->type = ARPHRD_NONE; 1355 dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST; 1356 1357 dev->pcpu_stat_type = NETDEV_PCPU_STAT_TSTATS; 1358 dev->priv_flags |= IFF_NO_QUEUE; 1359 dev->lltx = true; 1360 netif_keep_dst(dev); 1361 1362 dev->needed_headroom = LL_MAX_HEADER + GTP_IPV4_MAXLEN; 1363 gtp->dev = dev; 1364 } 1365 1366 static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize); 1367 static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]); 1368 1369 static void gtp_destructor(struct net_device *dev) 1370 { 1371 struct gtp_dev *gtp = netdev_priv(dev); 1372 1373 kfree(gtp->addr_hash); 1374 kfree(gtp->tid_hash); 1375 } 1376 1377 static int gtp_sock_udp_config(struct udp_port_cfg *udp_conf, 1378 const struct nlattr *nla, int family) 1379 { 1380 udp_conf->family = family; 1381 1382 switch (udp_conf->family) { 1383 case AF_INET: 1384 udp_conf->local_ip.s_addr = nla_get_be32(nla); 1385 break; 1386 #if IS_ENABLED(CONFIG_IPV6) 1387 case AF_INET6: 1388 udp_conf->local_ip6 = nla_get_in6_addr(nla); 1389 break; 1390 #endif 1391 default: 1392 return -EOPNOTSUPP; 1393 } 1394 1395 return 0; 1396 } 1397 1398 static struct sock *gtp_create_sock(int type, struct gtp_dev *gtp, 1399 const struct nlattr *nla, int family) 1400 { 1401 struct udp_tunnel_sock_cfg tuncfg = {}; 1402 struct udp_port_cfg udp_conf = {}; 1403 struct net *net = gtp->net; 1404 struct socket *sock; 1405 int err; 1406 1407 if (nla) { 1408 err = gtp_sock_udp_config(&udp_conf, nla, family); 1409 if (err < 0) 1410 return ERR_PTR(err); 1411 } else { 1412 udp_conf.local_ip.s_addr = htonl(INADDR_ANY); 1413 udp_conf.family = AF_INET; 1414 } 1415 1416 if (type == UDP_ENCAP_GTP0) 1417 udp_conf.local_udp_port = htons(GTP0_PORT); 1418 else if (type == UDP_ENCAP_GTP1U) 1419 udp_conf.local_udp_port = htons(GTP1U_PORT); 1420 else 1421 return ERR_PTR(-EINVAL); 1422 1423 err = udp_sock_create(net, &udp_conf, &sock); 1424 if (err) 1425 return ERR_PTR(err); 1426 1427 tuncfg.sk_user_data = gtp; 1428 tuncfg.encap_type = type; 1429 tuncfg.encap_rcv = gtp_encap_recv; 1430 tuncfg.encap_destroy = NULL; 1431 1432 setup_udp_tunnel_sock(net, sock, &tuncfg); 1433 1434 return sock->sk; 1435 } 1436 1437 static int gtp_create_sockets(struct gtp_dev *gtp, const struct nlattr *nla, 1438 int family) 1439 { 1440 struct sock *sk1u; 1441 struct sock *sk0; 1442 1443 sk0 = gtp_create_sock(UDP_ENCAP_GTP0, gtp, nla, family); 1444 if (IS_ERR(sk0)) 1445 return PTR_ERR(sk0); 1446 1447 sk1u = gtp_create_sock(UDP_ENCAP_GTP1U, gtp, nla, family); 1448 if (IS_ERR(sk1u)) { 1449 udp_tunnel_sock_release(sk0->sk_socket); 1450 return PTR_ERR(sk1u); 1451 } 1452 1453 gtp->sk_created = true; 1454 gtp->sk0 = sk0; 1455 gtp->sk1u = sk1u; 1456 1457 return 0; 1458 } 1459 1460 #define GTP_TH_MAXLEN (sizeof(struct udphdr) + sizeof(struct gtp0_header)) 1461 #define GTP_IPV6_MAXLEN (sizeof(struct ipv6hdr) + GTP_TH_MAXLEN) 1462 1463 static int gtp_newlink(struct net *src_net, struct net_device *dev, 1464 struct nlattr *tb[], struct nlattr *data[], 1465 struct netlink_ext_ack *extack) 1466 { 1467 unsigned int role = GTP_ROLE_GGSN; 1468 struct gtp_dev *gtp; 1469 struct gtp_net *gn; 1470 int hashsize, err; 1471 1472 #if !IS_ENABLED(CONFIG_IPV6) 1473 if (data[IFLA_GTP_LOCAL6]) 1474 return -EAFNOSUPPORT; 1475 #endif 1476 1477 gtp = netdev_priv(dev); 1478 1479 if (!data[IFLA_GTP_PDP_HASHSIZE]) { 1480 hashsize = 1024; 1481 } else { 1482 hashsize = nla_get_u32(data[IFLA_GTP_PDP_HASHSIZE]); 1483 if (!hashsize) 1484 hashsize = 1024; 1485 } 1486 1487 if (data[IFLA_GTP_ROLE]) { 1488 role = nla_get_u32(data[IFLA_GTP_ROLE]); 1489 if (role > GTP_ROLE_SGSN) 1490 return -EINVAL; 1491 } 1492 gtp->role = role; 1493 1494 gtp->restart_count = nla_get_u8_default(data[IFLA_GTP_RESTART_COUNT], 1495 0); 1496 1497 gtp->net = src_net; 1498 1499 err = gtp_hashtable_new(gtp, hashsize); 1500 if (err < 0) 1501 return err; 1502 1503 if (data[IFLA_GTP_CREATE_SOCKETS]) { 1504 if (data[IFLA_GTP_LOCAL6]) 1505 err = gtp_create_sockets(gtp, data[IFLA_GTP_LOCAL6], AF_INET6); 1506 else 1507 err = gtp_create_sockets(gtp, data[IFLA_GTP_LOCAL], AF_INET); 1508 } else { 1509 err = gtp_encap_enable(gtp, data); 1510 } 1511 1512 if (err < 0) 1513 goto out_hashtable; 1514 1515 if ((gtp->sk0 && gtp->sk0->sk_family == AF_INET6) || 1516 (gtp->sk1u && gtp->sk1u->sk_family == AF_INET6)) { 1517 dev->mtu = ETH_DATA_LEN - GTP_IPV6_MAXLEN; 1518 dev->needed_headroom = LL_MAX_HEADER + GTP_IPV6_MAXLEN; 1519 } 1520 1521 err = register_netdevice(dev); 1522 if (err < 0) { 1523 netdev_dbg(dev, "failed to register new netdev %d\n", err); 1524 goto out_encap; 1525 } 1526 1527 gn = net_generic(dev_net(dev), gtp_net_id); 1528 list_add_rcu(>p->list, &gn->gtp_dev_list); 1529 dev->priv_destructor = gtp_destructor; 1530 1531 netdev_dbg(dev, "registered new GTP interface\n"); 1532 1533 return 0; 1534 1535 out_encap: 1536 gtp_encap_disable(gtp); 1537 out_hashtable: 1538 kfree(gtp->addr_hash); 1539 kfree(gtp->tid_hash); 1540 return err; 1541 } 1542 1543 static void gtp_dellink(struct net_device *dev, struct list_head *head) 1544 { 1545 struct gtp_dev *gtp = netdev_priv(dev); 1546 struct hlist_node *next; 1547 struct pdp_ctx *pctx; 1548 int i; 1549 1550 for (i = 0; i < gtp->hash_size; i++) 1551 hlist_for_each_entry_safe(pctx, next, >p->tid_hash[i], hlist_tid) 1552 pdp_context_delete(pctx); 1553 1554 list_del_rcu(>p->list); 1555 unregister_netdevice_queue(dev, head); 1556 } 1557 1558 static const struct nla_policy gtp_policy[IFLA_GTP_MAX + 1] = { 1559 [IFLA_GTP_FD0] = { .type = NLA_U32 }, 1560 [IFLA_GTP_FD1] = { .type = NLA_U32 }, 1561 [IFLA_GTP_PDP_HASHSIZE] = { .type = NLA_U32 }, 1562 [IFLA_GTP_ROLE] = { .type = NLA_U32 }, 1563 [IFLA_GTP_CREATE_SOCKETS] = { .type = NLA_U8 }, 1564 [IFLA_GTP_RESTART_COUNT] = { .type = NLA_U8 }, 1565 [IFLA_GTP_LOCAL] = { .type = NLA_U32 }, 1566 [IFLA_GTP_LOCAL6] = { .len = sizeof(struct in6_addr) }, 1567 }; 1568 1569 static int gtp_validate(struct nlattr *tb[], struct nlattr *data[], 1570 struct netlink_ext_ack *extack) 1571 { 1572 if (!data) 1573 return -EINVAL; 1574 1575 return 0; 1576 } 1577 1578 static size_t gtp_get_size(const struct net_device *dev) 1579 { 1580 return nla_total_size(sizeof(__u32)) + /* IFLA_GTP_PDP_HASHSIZE */ 1581 nla_total_size(sizeof(__u32)) + /* IFLA_GTP_ROLE */ 1582 nla_total_size(sizeof(__u8)); /* IFLA_GTP_RESTART_COUNT */ 1583 } 1584 1585 static int gtp_fill_info(struct sk_buff *skb, const struct net_device *dev) 1586 { 1587 struct gtp_dev *gtp = netdev_priv(dev); 1588 1589 if (nla_put_u32(skb, IFLA_GTP_PDP_HASHSIZE, gtp->hash_size)) 1590 goto nla_put_failure; 1591 if (nla_put_u32(skb, IFLA_GTP_ROLE, gtp->role)) 1592 goto nla_put_failure; 1593 if (nla_put_u8(skb, IFLA_GTP_RESTART_COUNT, gtp->restart_count)) 1594 goto nla_put_failure; 1595 1596 return 0; 1597 1598 nla_put_failure: 1599 return -EMSGSIZE; 1600 } 1601 1602 static struct rtnl_link_ops gtp_link_ops __read_mostly = { 1603 .kind = "gtp", 1604 .maxtype = IFLA_GTP_MAX, 1605 .policy = gtp_policy, 1606 .priv_size = sizeof(struct gtp_dev), 1607 .setup = gtp_link_setup, 1608 .validate = gtp_validate, 1609 .newlink = gtp_newlink, 1610 .dellink = gtp_dellink, 1611 .get_size = gtp_get_size, 1612 .fill_info = gtp_fill_info, 1613 }; 1614 1615 static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize) 1616 { 1617 int i; 1618 1619 gtp->addr_hash = kmalloc_array(hsize, sizeof(struct hlist_head), 1620 GFP_KERNEL | __GFP_NOWARN); 1621 if (gtp->addr_hash == NULL) 1622 return -ENOMEM; 1623 1624 gtp->tid_hash = kmalloc_array(hsize, sizeof(struct hlist_head), 1625 GFP_KERNEL | __GFP_NOWARN); 1626 if (gtp->tid_hash == NULL) 1627 goto err1; 1628 1629 gtp->hash_size = hsize; 1630 1631 for (i = 0; i < hsize; i++) { 1632 INIT_HLIST_HEAD(>p->addr_hash[i]); 1633 INIT_HLIST_HEAD(>p->tid_hash[i]); 1634 } 1635 return 0; 1636 err1: 1637 kfree(gtp->addr_hash); 1638 return -ENOMEM; 1639 } 1640 1641 static struct sock *gtp_encap_enable_socket(int fd, int type, 1642 struct gtp_dev *gtp) 1643 { 1644 struct udp_tunnel_sock_cfg tuncfg = {NULL}; 1645 struct socket *sock; 1646 struct sock *sk; 1647 int err; 1648 1649 pr_debug("enable gtp on %d, %d\n", fd, type); 1650 1651 sock = sockfd_lookup(fd, &err); 1652 if (!sock) { 1653 pr_debug("gtp socket fd=%d not found\n", fd); 1654 return ERR_PTR(err); 1655 } 1656 1657 sk = sock->sk; 1658 if (sk->sk_protocol != IPPROTO_UDP || 1659 sk->sk_type != SOCK_DGRAM || 1660 (sk->sk_family != AF_INET && sk->sk_family != AF_INET6)) { 1661 pr_debug("socket fd=%d not UDP\n", fd); 1662 sk = ERR_PTR(-EINVAL); 1663 goto out_sock; 1664 } 1665 1666 if (sk->sk_family == AF_INET6 && 1667 !sk->sk_ipv6only) { 1668 sk = ERR_PTR(-EADDRNOTAVAIL); 1669 goto out_sock; 1670 } 1671 1672 lock_sock(sk); 1673 if (sk->sk_user_data) { 1674 sk = ERR_PTR(-EBUSY); 1675 goto out_rel_sock; 1676 } 1677 1678 sock_hold(sk); 1679 1680 tuncfg.sk_user_data = gtp; 1681 tuncfg.encap_type = type; 1682 tuncfg.encap_rcv = gtp_encap_recv; 1683 tuncfg.encap_destroy = gtp_encap_destroy; 1684 1685 setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg); 1686 1687 out_rel_sock: 1688 release_sock(sock->sk); 1689 out_sock: 1690 sockfd_put(sock); 1691 return sk; 1692 } 1693 1694 static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]) 1695 { 1696 struct sock *sk1u = NULL; 1697 struct sock *sk0 = NULL; 1698 1699 if (!data[IFLA_GTP_FD0] && !data[IFLA_GTP_FD1]) 1700 return -EINVAL; 1701 1702 if (data[IFLA_GTP_FD0]) { 1703 int fd0 = nla_get_u32(data[IFLA_GTP_FD0]); 1704 1705 if (fd0 >= 0) { 1706 sk0 = gtp_encap_enable_socket(fd0, UDP_ENCAP_GTP0, gtp); 1707 if (IS_ERR(sk0)) 1708 return PTR_ERR(sk0); 1709 } 1710 } 1711 1712 if (data[IFLA_GTP_FD1]) { 1713 int fd1 = nla_get_u32(data[IFLA_GTP_FD1]); 1714 1715 if (fd1 >= 0) { 1716 sk1u = gtp_encap_enable_socket(fd1, UDP_ENCAP_GTP1U, gtp); 1717 if (IS_ERR(sk1u)) { 1718 gtp_encap_disable_sock(sk0); 1719 return PTR_ERR(sk1u); 1720 } 1721 } 1722 } 1723 1724 gtp->sk0 = sk0; 1725 gtp->sk1u = sk1u; 1726 1727 if (sk0 && sk1u && 1728 sk0->sk_family != sk1u->sk_family) { 1729 gtp_encap_disable_sock(sk0); 1730 gtp_encap_disable_sock(sk1u); 1731 return -EINVAL; 1732 } 1733 1734 return 0; 1735 } 1736 1737 static struct gtp_dev *gtp_find_dev(struct net *src_net, struct nlattr *nla[]) 1738 { 1739 struct gtp_dev *gtp = NULL; 1740 struct net_device *dev; 1741 struct net *net; 1742 1743 /* Examine the link attributes and figure out which network namespace 1744 * we are talking about. 1745 */ 1746 if (nla[GTPA_NET_NS_FD]) 1747 net = get_net_ns_by_fd(nla_get_u32(nla[GTPA_NET_NS_FD])); 1748 else 1749 net = get_net(src_net); 1750 1751 if (IS_ERR(net)) 1752 return NULL; 1753 1754 /* Check if there's an existing gtpX device to configure */ 1755 dev = dev_get_by_index_rcu(net, nla_get_u32(nla[GTPA_LINK])); 1756 if (dev && dev->netdev_ops == >p_netdev_ops) 1757 gtp = netdev_priv(dev); 1758 1759 put_net(net); 1760 return gtp; 1761 } 1762 1763 static void gtp_pdp_fill(struct pdp_ctx *pctx, struct genl_info *info) 1764 { 1765 pctx->gtp_version = nla_get_u32(info->attrs[GTPA_VERSION]); 1766 1767 switch (pctx->gtp_version) { 1768 case GTP_V0: 1769 /* According to TS 09.60, sections 7.5.1 and 7.5.2, the flow 1770 * label needs to be the same for uplink and downlink packets, 1771 * so let's annotate this. 1772 */ 1773 pctx->u.v0.tid = nla_get_u64(info->attrs[GTPA_TID]); 1774 pctx->u.v0.flow = nla_get_u16(info->attrs[GTPA_FLOW]); 1775 break; 1776 case GTP_V1: 1777 pctx->u.v1.i_tei = nla_get_u32(info->attrs[GTPA_I_TEI]); 1778 pctx->u.v1.o_tei = nla_get_u32(info->attrs[GTPA_O_TEI]); 1779 break; 1780 default: 1781 break; 1782 } 1783 } 1784 1785 static void ip_pdp_peer_fill(struct pdp_ctx *pctx, struct genl_info *info) 1786 { 1787 if (info->attrs[GTPA_PEER_ADDRESS]) { 1788 pctx->peer.addr.s_addr = 1789 nla_get_be32(info->attrs[GTPA_PEER_ADDRESS]); 1790 } else if (info->attrs[GTPA_PEER_ADDR6]) { 1791 pctx->peer.addr6 = nla_get_in6_addr(info->attrs[GTPA_PEER_ADDR6]); 1792 } 1793 } 1794 1795 static void ipv4_pdp_fill(struct pdp_ctx *pctx, struct genl_info *info) 1796 { 1797 ip_pdp_peer_fill(pctx, info); 1798 pctx->ms.addr.s_addr = 1799 nla_get_be32(info->attrs[GTPA_MS_ADDRESS]); 1800 gtp_pdp_fill(pctx, info); 1801 } 1802 1803 static bool ipv6_pdp_fill(struct pdp_ctx *pctx, struct genl_info *info) 1804 { 1805 ip_pdp_peer_fill(pctx, info); 1806 pctx->ms.addr6 = nla_get_in6_addr(info->attrs[GTPA_MS_ADDR6]); 1807 if (pctx->ms.addr6.s6_addr32[2] || 1808 pctx->ms.addr6.s6_addr32[3]) 1809 return false; 1810 1811 gtp_pdp_fill(pctx, info); 1812 1813 return true; 1814 } 1815 1816 static struct pdp_ctx *gtp_pdp_add(struct gtp_dev *gtp, struct sock *sk, 1817 struct genl_info *info) 1818 { 1819 struct pdp_ctx *pctx, *pctx_tid = NULL; 1820 struct net_device *dev = gtp->dev; 1821 u32 hash_ms, hash_tid = 0; 1822 struct in6_addr ms_addr6; 1823 unsigned int version; 1824 bool found = false; 1825 __be32 ms_addr; 1826 int family; 1827 1828 version = nla_get_u32(info->attrs[GTPA_VERSION]); 1829 1830 family = nla_get_u8_default(info->attrs[GTPA_FAMILY], AF_INET); 1831 1832 #if !IS_ENABLED(CONFIG_IPV6) 1833 if (family == AF_INET6) 1834 return ERR_PTR(-EAFNOSUPPORT); 1835 #endif 1836 if (!info->attrs[GTPA_PEER_ADDRESS] && 1837 !info->attrs[GTPA_PEER_ADDR6]) 1838 return ERR_PTR(-EINVAL); 1839 1840 if ((info->attrs[GTPA_PEER_ADDRESS] && 1841 sk->sk_family == AF_INET6) || 1842 (info->attrs[GTPA_PEER_ADDR6] && 1843 sk->sk_family == AF_INET)) 1844 return ERR_PTR(-EAFNOSUPPORT); 1845 1846 switch (family) { 1847 case AF_INET: 1848 if (!info->attrs[GTPA_MS_ADDRESS] || 1849 info->attrs[GTPA_MS_ADDR6]) 1850 return ERR_PTR(-EINVAL); 1851 1852 ms_addr = nla_get_be32(info->attrs[GTPA_MS_ADDRESS]); 1853 hash_ms = ipv4_hashfn(ms_addr) % gtp->hash_size; 1854 pctx = ipv4_pdp_find(gtp, ms_addr); 1855 break; 1856 case AF_INET6: 1857 if (!info->attrs[GTPA_MS_ADDR6] || 1858 info->attrs[GTPA_MS_ADDRESS]) 1859 return ERR_PTR(-EINVAL); 1860 1861 ms_addr6 = nla_get_in6_addr(info->attrs[GTPA_MS_ADDR6]); 1862 hash_ms = ipv6_hashfn(&ms_addr6) % gtp->hash_size; 1863 pctx = ipv6_pdp_find(gtp, &ms_addr6); 1864 break; 1865 default: 1866 return ERR_PTR(-EAFNOSUPPORT); 1867 } 1868 if (pctx) 1869 found = true; 1870 if (version == GTP_V0) 1871 pctx_tid = gtp0_pdp_find(gtp, 1872 nla_get_u64(info->attrs[GTPA_TID]), 1873 family); 1874 else if (version == GTP_V1) 1875 pctx_tid = gtp1_pdp_find(gtp, 1876 nla_get_u32(info->attrs[GTPA_I_TEI]), 1877 family); 1878 if (pctx_tid) 1879 found = true; 1880 1881 if (found) { 1882 if (info->nlhdr->nlmsg_flags & NLM_F_EXCL) 1883 return ERR_PTR(-EEXIST); 1884 if (info->nlhdr->nlmsg_flags & NLM_F_REPLACE) 1885 return ERR_PTR(-EOPNOTSUPP); 1886 1887 if (pctx && pctx_tid) 1888 return ERR_PTR(-EEXIST); 1889 if (!pctx) 1890 pctx = pctx_tid; 1891 1892 switch (pctx->af) { 1893 case AF_INET: 1894 ipv4_pdp_fill(pctx, info); 1895 break; 1896 case AF_INET6: 1897 if (!ipv6_pdp_fill(pctx, info)) 1898 return ERR_PTR(-EADDRNOTAVAIL); 1899 break; 1900 } 1901 1902 if (pctx->gtp_version == GTP_V0) 1903 netdev_dbg(dev, "GTPv0-U: update tunnel id = %llx (pdp %p)\n", 1904 pctx->u.v0.tid, pctx); 1905 else if (pctx->gtp_version == GTP_V1) 1906 netdev_dbg(dev, "GTPv1-U: update tunnel id = %x/%x (pdp %p)\n", 1907 pctx->u.v1.i_tei, pctx->u.v1.o_tei, pctx); 1908 1909 return pctx; 1910 1911 } 1912 1913 pctx = kmalloc(sizeof(*pctx), GFP_ATOMIC); 1914 if (pctx == NULL) 1915 return ERR_PTR(-ENOMEM); 1916 1917 sock_hold(sk); 1918 pctx->sk = sk; 1919 pctx->dev = gtp->dev; 1920 pctx->af = family; 1921 1922 switch (pctx->af) { 1923 case AF_INET: 1924 if (!info->attrs[GTPA_MS_ADDRESS]) { 1925 sock_put(sk); 1926 kfree(pctx); 1927 return ERR_PTR(-EINVAL); 1928 } 1929 1930 ipv4_pdp_fill(pctx, info); 1931 break; 1932 case AF_INET6: 1933 if (!info->attrs[GTPA_MS_ADDR6]) { 1934 sock_put(sk); 1935 kfree(pctx); 1936 return ERR_PTR(-EINVAL); 1937 } 1938 1939 if (!ipv6_pdp_fill(pctx, info)) { 1940 sock_put(sk); 1941 kfree(pctx); 1942 return ERR_PTR(-EADDRNOTAVAIL); 1943 } 1944 break; 1945 } 1946 atomic_set(&pctx->tx_seq, 0); 1947 1948 switch (pctx->gtp_version) { 1949 case GTP_V0: 1950 /* TS 09.60: "The flow label identifies unambiguously a GTP 1951 * flow.". We use the tid for this instead, I cannot find a 1952 * situation in which this doesn't unambiguosly identify the 1953 * PDP context. 1954 */ 1955 hash_tid = gtp0_hashfn(pctx->u.v0.tid) % gtp->hash_size; 1956 break; 1957 case GTP_V1: 1958 hash_tid = gtp1u_hashfn(pctx->u.v1.i_tei) % gtp->hash_size; 1959 break; 1960 } 1961 1962 hlist_add_head_rcu(&pctx->hlist_addr, >p->addr_hash[hash_ms]); 1963 hlist_add_head_rcu(&pctx->hlist_tid, >p->tid_hash[hash_tid]); 1964 1965 switch (pctx->gtp_version) { 1966 case GTP_V0: 1967 netdev_dbg(dev, "GTPv0-U: new PDP ctx id=%llx ssgn=%pI4 ms=%pI4 (pdp=%p)\n", 1968 pctx->u.v0.tid, &pctx->peer.addr, 1969 &pctx->ms.addr, pctx); 1970 break; 1971 case GTP_V1: 1972 netdev_dbg(dev, "GTPv1-U: new PDP ctx id=%x/%x ssgn=%pI4 ms=%pI4 (pdp=%p)\n", 1973 pctx->u.v1.i_tei, pctx->u.v1.o_tei, 1974 &pctx->peer.addr, &pctx->ms.addr, pctx); 1975 break; 1976 } 1977 1978 return pctx; 1979 } 1980 1981 static void pdp_context_free(struct rcu_head *head) 1982 { 1983 struct pdp_ctx *pctx = container_of(head, struct pdp_ctx, rcu_head); 1984 1985 sock_put(pctx->sk); 1986 kfree(pctx); 1987 } 1988 1989 static void pdp_context_delete(struct pdp_ctx *pctx) 1990 { 1991 hlist_del_rcu(&pctx->hlist_tid); 1992 hlist_del_rcu(&pctx->hlist_addr); 1993 call_rcu(&pctx->rcu_head, pdp_context_free); 1994 } 1995 1996 static int gtp_tunnel_notify(struct pdp_ctx *pctx, u8 cmd, gfp_t allocation); 1997 1998 static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info) 1999 { 2000 unsigned int version; 2001 struct pdp_ctx *pctx; 2002 struct gtp_dev *gtp; 2003 struct sock *sk; 2004 int err; 2005 2006 if (!info->attrs[GTPA_VERSION] || 2007 !info->attrs[GTPA_LINK]) 2008 return -EINVAL; 2009 2010 version = nla_get_u32(info->attrs[GTPA_VERSION]); 2011 2012 switch (version) { 2013 case GTP_V0: 2014 if (!info->attrs[GTPA_TID] || 2015 !info->attrs[GTPA_FLOW]) 2016 return -EINVAL; 2017 break; 2018 case GTP_V1: 2019 if (!info->attrs[GTPA_I_TEI] || 2020 !info->attrs[GTPA_O_TEI]) 2021 return -EINVAL; 2022 break; 2023 2024 default: 2025 return -EINVAL; 2026 } 2027 2028 rtnl_lock(); 2029 2030 gtp = gtp_find_dev(sock_net(skb->sk), info->attrs); 2031 if (!gtp) { 2032 err = -ENODEV; 2033 goto out_unlock; 2034 } 2035 2036 if (version == GTP_V0) 2037 sk = gtp->sk0; 2038 else if (version == GTP_V1) 2039 sk = gtp->sk1u; 2040 else 2041 sk = NULL; 2042 2043 if (!sk) { 2044 err = -ENODEV; 2045 goto out_unlock; 2046 } 2047 2048 pctx = gtp_pdp_add(gtp, sk, info); 2049 if (IS_ERR(pctx)) { 2050 err = PTR_ERR(pctx); 2051 } else { 2052 gtp_tunnel_notify(pctx, GTP_CMD_NEWPDP, GFP_KERNEL); 2053 err = 0; 2054 } 2055 2056 out_unlock: 2057 rtnl_unlock(); 2058 return err; 2059 } 2060 2061 static struct pdp_ctx *gtp_find_pdp_by_link(struct net *net, 2062 struct nlattr *nla[]) 2063 { 2064 struct gtp_dev *gtp; 2065 int family; 2066 2067 family = nla_get_u8_default(nla[GTPA_FAMILY], AF_INET); 2068 2069 gtp = gtp_find_dev(net, nla); 2070 if (!gtp) 2071 return ERR_PTR(-ENODEV); 2072 2073 if (nla[GTPA_MS_ADDRESS]) { 2074 __be32 ip = nla_get_be32(nla[GTPA_MS_ADDRESS]); 2075 2076 if (family != AF_INET) 2077 return ERR_PTR(-EINVAL); 2078 2079 return ipv4_pdp_find(gtp, ip); 2080 } else if (nla[GTPA_MS_ADDR6]) { 2081 struct in6_addr addr = nla_get_in6_addr(nla[GTPA_MS_ADDR6]); 2082 2083 if (family != AF_INET6) 2084 return ERR_PTR(-EINVAL); 2085 2086 if (addr.s6_addr32[2] || 2087 addr.s6_addr32[3]) 2088 return ERR_PTR(-EADDRNOTAVAIL); 2089 2090 return ipv6_pdp_find(gtp, &addr); 2091 } else if (nla[GTPA_VERSION]) { 2092 u32 gtp_version = nla_get_u32(nla[GTPA_VERSION]); 2093 2094 if (gtp_version == GTP_V0 && nla[GTPA_TID]) { 2095 return gtp0_pdp_find(gtp, nla_get_u64(nla[GTPA_TID]), 2096 family); 2097 } else if (gtp_version == GTP_V1 && nla[GTPA_I_TEI]) { 2098 return gtp1_pdp_find(gtp, nla_get_u32(nla[GTPA_I_TEI]), 2099 family); 2100 } 2101 } 2102 2103 return ERR_PTR(-EINVAL); 2104 } 2105 2106 static struct pdp_ctx *gtp_find_pdp(struct net *net, struct nlattr *nla[]) 2107 { 2108 struct pdp_ctx *pctx; 2109 2110 if (nla[GTPA_LINK]) 2111 pctx = gtp_find_pdp_by_link(net, nla); 2112 else 2113 pctx = ERR_PTR(-EINVAL); 2114 2115 if (!pctx) 2116 pctx = ERR_PTR(-ENOENT); 2117 2118 return pctx; 2119 } 2120 2121 static int gtp_genl_del_pdp(struct sk_buff *skb, struct genl_info *info) 2122 { 2123 struct pdp_ctx *pctx; 2124 int err = 0; 2125 2126 if (!info->attrs[GTPA_VERSION]) 2127 return -EINVAL; 2128 2129 rcu_read_lock(); 2130 2131 pctx = gtp_find_pdp(sock_net(skb->sk), info->attrs); 2132 if (IS_ERR(pctx)) { 2133 err = PTR_ERR(pctx); 2134 goto out_unlock; 2135 } 2136 2137 if (pctx->gtp_version == GTP_V0) 2138 netdev_dbg(pctx->dev, "GTPv0-U: deleting tunnel id = %llx (pdp %p)\n", 2139 pctx->u.v0.tid, pctx); 2140 else if (pctx->gtp_version == GTP_V1) 2141 netdev_dbg(pctx->dev, "GTPv1-U: deleting tunnel id = %x/%x (pdp %p)\n", 2142 pctx->u.v1.i_tei, pctx->u.v1.o_tei, pctx); 2143 2144 gtp_tunnel_notify(pctx, GTP_CMD_DELPDP, GFP_ATOMIC); 2145 pdp_context_delete(pctx); 2146 2147 out_unlock: 2148 rcu_read_unlock(); 2149 return err; 2150 } 2151 2152 static int gtp_genl_fill_info(struct sk_buff *skb, u32 snd_portid, u32 snd_seq, 2153 int flags, u32 type, struct pdp_ctx *pctx) 2154 { 2155 void *genlh; 2156 2157 genlh = genlmsg_put(skb, snd_portid, snd_seq, >p_genl_family, flags, 2158 type); 2159 if (genlh == NULL) 2160 goto nlmsg_failure; 2161 2162 if (nla_put_u32(skb, GTPA_VERSION, pctx->gtp_version) || 2163 nla_put_u32(skb, GTPA_LINK, pctx->dev->ifindex) || 2164 nla_put_u8(skb, GTPA_FAMILY, pctx->af)) 2165 goto nla_put_failure; 2166 2167 switch (pctx->af) { 2168 case AF_INET: 2169 if (nla_put_be32(skb, GTPA_MS_ADDRESS, pctx->ms.addr.s_addr)) 2170 goto nla_put_failure; 2171 break; 2172 case AF_INET6: 2173 if (nla_put_in6_addr(skb, GTPA_MS_ADDR6, &pctx->ms.addr6)) 2174 goto nla_put_failure; 2175 break; 2176 } 2177 2178 switch (pctx->sk->sk_family) { 2179 case AF_INET: 2180 if (nla_put_be32(skb, GTPA_PEER_ADDRESS, pctx->peer.addr.s_addr)) 2181 goto nla_put_failure; 2182 break; 2183 case AF_INET6: 2184 if (nla_put_in6_addr(skb, GTPA_PEER_ADDR6, &pctx->peer.addr6)) 2185 goto nla_put_failure; 2186 break; 2187 } 2188 2189 switch (pctx->gtp_version) { 2190 case GTP_V0: 2191 if (nla_put_u64_64bit(skb, GTPA_TID, pctx->u.v0.tid, GTPA_PAD) || 2192 nla_put_u16(skb, GTPA_FLOW, pctx->u.v0.flow)) 2193 goto nla_put_failure; 2194 break; 2195 case GTP_V1: 2196 if (nla_put_u32(skb, GTPA_I_TEI, pctx->u.v1.i_tei) || 2197 nla_put_u32(skb, GTPA_O_TEI, pctx->u.v1.o_tei)) 2198 goto nla_put_failure; 2199 break; 2200 } 2201 genlmsg_end(skb, genlh); 2202 return 0; 2203 2204 nlmsg_failure: 2205 nla_put_failure: 2206 genlmsg_cancel(skb, genlh); 2207 return -EMSGSIZE; 2208 } 2209 2210 static int gtp_tunnel_notify(struct pdp_ctx *pctx, u8 cmd, gfp_t allocation) 2211 { 2212 struct sk_buff *msg; 2213 int ret; 2214 2215 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, allocation); 2216 if (!msg) 2217 return -ENOMEM; 2218 2219 ret = gtp_genl_fill_info(msg, 0, 0, 0, cmd, pctx); 2220 if (ret < 0) { 2221 nlmsg_free(msg); 2222 return ret; 2223 } 2224 2225 ret = genlmsg_multicast_netns(>p_genl_family, dev_net(pctx->dev), msg, 2226 0, GTP_GENL_MCGRP, GFP_ATOMIC); 2227 return ret; 2228 } 2229 2230 static int gtp_genl_get_pdp(struct sk_buff *skb, struct genl_info *info) 2231 { 2232 struct pdp_ctx *pctx = NULL; 2233 struct sk_buff *skb2; 2234 int err; 2235 2236 if (!info->attrs[GTPA_VERSION]) 2237 return -EINVAL; 2238 2239 rcu_read_lock(); 2240 2241 pctx = gtp_find_pdp(sock_net(skb->sk), info->attrs); 2242 if (IS_ERR(pctx)) { 2243 err = PTR_ERR(pctx); 2244 goto err_unlock; 2245 } 2246 2247 skb2 = genlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC); 2248 if (skb2 == NULL) { 2249 err = -ENOMEM; 2250 goto err_unlock; 2251 } 2252 2253 err = gtp_genl_fill_info(skb2, NETLINK_CB(skb).portid, info->snd_seq, 2254 0, info->nlhdr->nlmsg_type, pctx); 2255 if (err < 0) 2256 goto err_unlock_free; 2257 2258 rcu_read_unlock(); 2259 return genlmsg_unicast(genl_info_net(info), skb2, info->snd_portid); 2260 2261 err_unlock_free: 2262 kfree_skb(skb2); 2263 err_unlock: 2264 rcu_read_unlock(); 2265 return err; 2266 } 2267 2268 static int gtp_genl_dump_pdp(struct sk_buff *skb, 2269 struct netlink_callback *cb) 2270 { 2271 struct gtp_dev *last_gtp = (struct gtp_dev *)cb->args[2], *gtp; 2272 int i, j, bucket = cb->args[0], skip = cb->args[1]; 2273 struct net *net = sock_net(skb->sk); 2274 struct pdp_ctx *pctx; 2275 struct gtp_net *gn; 2276 2277 gn = net_generic(net, gtp_net_id); 2278 2279 if (cb->args[4]) 2280 return 0; 2281 2282 rcu_read_lock(); 2283 list_for_each_entry_rcu(gtp, &gn->gtp_dev_list, list) { 2284 if (last_gtp && last_gtp != gtp) 2285 continue; 2286 else 2287 last_gtp = NULL; 2288 2289 for (i = bucket; i < gtp->hash_size; i++) { 2290 j = 0; 2291 hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], 2292 hlist_tid) { 2293 if (j >= skip && 2294 gtp_genl_fill_info(skb, 2295 NETLINK_CB(cb->skb).portid, 2296 cb->nlh->nlmsg_seq, 2297 NLM_F_MULTI, 2298 cb->nlh->nlmsg_type, pctx)) { 2299 cb->args[0] = i; 2300 cb->args[1] = j; 2301 cb->args[2] = (unsigned long)gtp; 2302 goto out; 2303 } 2304 j++; 2305 } 2306 skip = 0; 2307 } 2308 bucket = 0; 2309 } 2310 cb->args[4] = 1; 2311 out: 2312 rcu_read_unlock(); 2313 return skb->len; 2314 } 2315 2316 static int gtp_genl_send_echo_req(struct sk_buff *skb, struct genl_info *info) 2317 { 2318 struct sk_buff *skb_to_send; 2319 __be32 src_ip, dst_ip; 2320 unsigned int version; 2321 struct gtp_dev *gtp; 2322 struct flowi4 fl4; 2323 struct rtable *rt; 2324 struct sock *sk; 2325 __be16 port; 2326 int len; 2327 2328 if (!info->attrs[GTPA_VERSION] || 2329 !info->attrs[GTPA_LINK] || 2330 !info->attrs[GTPA_PEER_ADDRESS] || 2331 !info->attrs[GTPA_MS_ADDRESS]) 2332 return -EINVAL; 2333 2334 version = nla_get_u32(info->attrs[GTPA_VERSION]); 2335 dst_ip = nla_get_be32(info->attrs[GTPA_PEER_ADDRESS]); 2336 src_ip = nla_get_be32(info->attrs[GTPA_MS_ADDRESS]); 2337 2338 gtp = gtp_find_dev(sock_net(skb->sk), info->attrs); 2339 if (!gtp) 2340 return -ENODEV; 2341 2342 if (!gtp->sk_created) 2343 return -EOPNOTSUPP; 2344 if (!(gtp->dev->flags & IFF_UP)) 2345 return -ENETDOWN; 2346 2347 if (version == GTP_V0) { 2348 struct gtp0_header *gtp0_h; 2349 2350 len = LL_RESERVED_SPACE(gtp->dev) + sizeof(struct gtp0_header) + 2351 sizeof(struct iphdr) + sizeof(struct udphdr); 2352 2353 skb_to_send = netdev_alloc_skb_ip_align(gtp->dev, len); 2354 if (!skb_to_send) 2355 return -ENOMEM; 2356 2357 sk = gtp->sk0; 2358 port = htons(GTP0_PORT); 2359 2360 gtp0_h = skb_push(skb_to_send, sizeof(struct gtp0_header)); 2361 memset(gtp0_h, 0, sizeof(struct gtp0_header)); 2362 gtp0_build_echo_msg(gtp0_h, GTP_ECHO_REQ); 2363 } else if (version == GTP_V1) { 2364 struct gtp1_header_long *gtp1u_h; 2365 2366 len = LL_RESERVED_SPACE(gtp->dev) + 2367 sizeof(struct gtp1_header_long) + 2368 sizeof(struct iphdr) + sizeof(struct udphdr); 2369 2370 skb_to_send = netdev_alloc_skb_ip_align(gtp->dev, len); 2371 if (!skb_to_send) 2372 return -ENOMEM; 2373 2374 sk = gtp->sk1u; 2375 port = htons(GTP1U_PORT); 2376 2377 gtp1u_h = skb_push(skb_to_send, 2378 sizeof(struct gtp1_header_long)); 2379 memset(gtp1u_h, 0, sizeof(struct gtp1_header_long)); 2380 gtp1u_build_echo_msg(gtp1u_h, GTP_ECHO_REQ); 2381 } else { 2382 return -ENODEV; 2383 } 2384 2385 rt = ip4_route_output_gtp(&fl4, sk, dst_ip, src_ip); 2386 if (IS_ERR(rt)) { 2387 netdev_dbg(gtp->dev, "no route for echo request to %pI4\n", 2388 &dst_ip); 2389 kfree_skb(skb_to_send); 2390 return -ENODEV; 2391 } 2392 2393 udp_tunnel_xmit_skb(rt, sk, skb_to_send, 2394 fl4.saddr, fl4.daddr, 2395 fl4.flowi4_tos, 2396 ip4_dst_hoplimit(&rt->dst), 2397 0, 2398 port, port, 2399 !net_eq(sock_net(sk), 2400 dev_net(gtp->dev)), 2401 false); 2402 return 0; 2403 } 2404 2405 static const struct nla_policy gtp_genl_policy[GTPA_MAX + 1] = { 2406 [GTPA_LINK] = { .type = NLA_U32, }, 2407 [GTPA_VERSION] = { .type = NLA_U32, }, 2408 [GTPA_TID] = { .type = NLA_U64, }, 2409 [GTPA_PEER_ADDRESS] = { .type = NLA_U32, }, 2410 [GTPA_MS_ADDRESS] = { .type = NLA_U32, }, 2411 [GTPA_FLOW] = { .type = NLA_U16, }, 2412 [GTPA_NET_NS_FD] = { .type = NLA_U32, }, 2413 [GTPA_I_TEI] = { .type = NLA_U32, }, 2414 [GTPA_O_TEI] = { .type = NLA_U32, }, 2415 [GTPA_PEER_ADDR6] = { .len = sizeof(struct in6_addr), }, 2416 [GTPA_MS_ADDR6] = { .len = sizeof(struct in6_addr), }, 2417 [GTPA_FAMILY] = { .type = NLA_U8, }, 2418 }; 2419 2420 static const struct genl_small_ops gtp_genl_ops[] = { 2421 { 2422 .cmd = GTP_CMD_NEWPDP, 2423 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2424 .doit = gtp_genl_new_pdp, 2425 .flags = GENL_ADMIN_PERM, 2426 }, 2427 { 2428 .cmd = GTP_CMD_DELPDP, 2429 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2430 .doit = gtp_genl_del_pdp, 2431 .flags = GENL_ADMIN_PERM, 2432 }, 2433 { 2434 .cmd = GTP_CMD_GETPDP, 2435 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2436 .doit = gtp_genl_get_pdp, 2437 .dumpit = gtp_genl_dump_pdp, 2438 .flags = GENL_ADMIN_PERM, 2439 }, 2440 { 2441 .cmd = GTP_CMD_ECHOREQ, 2442 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2443 .doit = gtp_genl_send_echo_req, 2444 .flags = GENL_ADMIN_PERM, 2445 }, 2446 }; 2447 2448 static struct genl_family gtp_genl_family __ro_after_init = { 2449 .name = "gtp", 2450 .version = 0, 2451 .hdrsize = 0, 2452 .maxattr = GTPA_MAX, 2453 .policy = gtp_genl_policy, 2454 .netnsok = true, 2455 .module = THIS_MODULE, 2456 .small_ops = gtp_genl_ops, 2457 .n_small_ops = ARRAY_SIZE(gtp_genl_ops), 2458 .resv_start_op = GTP_CMD_ECHOREQ + 1, 2459 .mcgrps = gtp_genl_mcgrps, 2460 .n_mcgrps = ARRAY_SIZE(gtp_genl_mcgrps), 2461 }; 2462 2463 static int __net_init gtp_net_init(struct net *net) 2464 { 2465 struct gtp_net *gn = net_generic(net, gtp_net_id); 2466 2467 INIT_LIST_HEAD(&gn->gtp_dev_list); 2468 return 0; 2469 } 2470 2471 static void __net_exit gtp_net_exit_batch_rtnl(struct list_head *net_list, 2472 struct list_head *dev_to_kill) 2473 { 2474 struct net *net; 2475 2476 list_for_each_entry(net, net_list, exit_list) { 2477 struct gtp_net *gn = net_generic(net, gtp_net_id); 2478 struct gtp_dev *gtp; 2479 2480 list_for_each_entry(gtp, &gn->gtp_dev_list, list) 2481 gtp_dellink(gtp->dev, dev_to_kill); 2482 } 2483 } 2484 2485 static struct pernet_operations gtp_net_ops = { 2486 .init = gtp_net_init, 2487 .exit_batch_rtnl = gtp_net_exit_batch_rtnl, 2488 .id = >p_net_id, 2489 .size = sizeof(struct gtp_net), 2490 }; 2491 2492 static int __init gtp_init(void) 2493 { 2494 int err; 2495 2496 get_random_bytes(>p_h_initval, sizeof(gtp_h_initval)); 2497 2498 err = register_pernet_subsys(>p_net_ops); 2499 if (err < 0) 2500 goto error_out; 2501 2502 err = rtnl_link_register(>p_link_ops); 2503 if (err < 0) 2504 goto unreg_pernet_subsys; 2505 2506 err = genl_register_family(>p_genl_family); 2507 if (err < 0) 2508 goto unreg_rtnl_link; 2509 2510 pr_info("GTP module loaded (pdp ctx size %zd bytes)\n", 2511 sizeof(struct pdp_ctx)); 2512 return 0; 2513 2514 unreg_rtnl_link: 2515 rtnl_link_unregister(>p_link_ops); 2516 unreg_pernet_subsys: 2517 unregister_pernet_subsys(>p_net_ops); 2518 error_out: 2519 pr_err("error loading GTP module loaded\n"); 2520 return err; 2521 } 2522 late_initcall(gtp_init); 2523 2524 static void __exit gtp_fini(void) 2525 { 2526 genl_unregister_family(>p_genl_family); 2527 rtnl_link_unregister(>p_link_ops); 2528 unregister_pernet_subsys(>p_net_ops); 2529 2530 pr_info("GTP module unloaded\n"); 2531 } 2532 module_exit(gtp_fini); 2533 2534 MODULE_LICENSE("GPL"); 2535 MODULE_AUTHOR("Harald Welte <hwelte@sysmocom.de>"); 2536 MODULE_DESCRIPTION("Interface driver for GTP encapsulated traffic"); 2537 MODULE_ALIAS_RTNL_LINK("gtp"); 2538 MODULE_ALIAS_GENL_FAMILY("gtp"); 2539