1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* GTP according to GSM TS 09.60 / 3GPP TS 29.060 3 * 4 * (C) 2012-2014 by sysmocom - s.f.m.c. GmbH 5 * (C) 2016 by Pablo Neira Ayuso <pablo@netfilter.org> 6 * 7 * Author: Harald Welte <hwelte@sysmocom.de> 8 * Pablo Neira Ayuso <pablo@netfilter.org> 9 * Andreas Schultz <aschultz@travelping.com> 10 */ 11 12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 13 14 #include <linux/module.h> 15 #include <linux/skbuff.h> 16 #include <linux/udp.h> 17 #include <linux/rculist.h> 18 #include <linux/jhash.h> 19 #include <linux/if_tunnel.h> 20 #include <linux/net.h> 21 #include <linux/file.h> 22 #include <linux/gtp.h> 23 24 #include <net/net_namespace.h> 25 #include <net/protocol.h> 26 #include <net/ip.h> 27 #include <net/ipv6.h> 28 #include <net/udp.h> 29 #include <net/udp_tunnel.h> 30 #include <net/icmp.h> 31 #include <net/xfrm.h> 32 #include <net/genetlink.h> 33 #include <net/netns/generic.h> 34 #include <net/gtp.h> 35 36 /* An active session for the subscriber. */ 37 struct pdp_ctx { 38 struct hlist_node hlist_tid; 39 struct hlist_node hlist_addr; 40 41 union { 42 struct { 43 u64 tid; 44 u16 flow; 45 } v0; 46 struct { 47 u32 i_tei; 48 u32 o_tei; 49 } v1; 50 } u; 51 u8 gtp_version; 52 u16 af; 53 54 union { 55 struct in_addr addr; 56 struct in6_addr addr6; 57 } ms; 58 union { 59 struct in_addr addr; 60 struct in6_addr addr6; 61 } peer; 62 63 struct sock *sk; 64 struct net_device *dev; 65 66 atomic_t tx_seq; 67 struct rcu_head rcu_head; 68 }; 69 70 /* One instance of the GTP device. */ 71 struct gtp_dev { 72 struct list_head list; 73 74 struct sock *sk0; 75 struct sock *sk1u; 76 u8 sk_created; 77 78 struct net_device *dev; 79 struct net *net; 80 81 unsigned int role; 82 unsigned int hash_size; 83 struct hlist_head *tid_hash; 84 struct hlist_head *addr_hash; 85 86 u8 restart_count; 87 }; 88 89 struct echo_info { 90 u16 af; 91 u8 gtp_version; 92 93 union { 94 struct in_addr addr; 95 } ms; 96 union { 97 struct in_addr addr; 98 } peer; 99 }; 100 101 static unsigned int gtp_net_id __read_mostly; 102 103 struct gtp_net { 104 struct list_head gtp_dev_list; 105 }; 106 107 static u32 gtp_h_initval; 108 109 static struct genl_family gtp_genl_family; 110 111 enum gtp_multicast_groups { 112 GTP_GENL_MCGRP, 113 }; 114 115 static const struct genl_multicast_group gtp_genl_mcgrps[] = { 116 [GTP_GENL_MCGRP] = { .name = GTP_GENL_MCGRP_NAME }, 117 }; 118 119 static void pdp_context_delete(struct pdp_ctx *pctx); 120 121 static inline u32 gtp0_hashfn(u64 tid) 122 { 123 u32 *tid32 = (u32 *) &tid; 124 return jhash_2words(tid32[0], tid32[1], gtp_h_initval); 125 } 126 127 static inline u32 gtp1u_hashfn(u32 tid) 128 { 129 return jhash_1word(tid, gtp_h_initval); 130 } 131 132 static inline u32 ipv4_hashfn(__be32 ip) 133 { 134 return jhash_1word((__force u32)ip, gtp_h_initval); 135 } 136 137 static u32 ipv6_hashfn(const struct in6_addr *ip6) 138 { 139 return jhash_2words((__force u32)ip6->s6_addr32[0], 140 (__force u32)ip6->s6_addr32[1], gtp_h_initval); 141 } 142 143 /* Resolve a PDP context structure based on the 64bit TID. */ 144 static struct pdp_ctx *gtp0_pdp_find(struct gtp_dev *gtp, u64 tid, u16 family) 145 { 146 struct hlist_head *head; 147 struct pdp_ctx *pdp; 148 149 head = >p->tid_hash[gtp0_hashfn(tid) % gtp->hash_size]; 150 151 hlist_for_each_entry_rcu(pdp, head, hlist_tid) { 152 if (pdp->af == family && 153 pdp->gtp_version == GTP_V0 && 154 pdp->u.v0.tid == tid) 155 return pdp; 156 } 157 return NULL; 158 } 159 160 /* Resolve a PDP context structure based on the 32bit TEI. */ 161 static struct pdp_ctx *gtp1_pdp_find(struct gtp_dev *gtp, u32 tid, u16 family) 162 { 163 struct hlist_head *head; 164 struct pdp_ctx *pdp; 165 166 head = >p->tid_hash[gtp1u_hashfn(tid) % gtp->hash_size]; 167 168 hlist_for_each_entry_rcu(pdp, head, hlist_tid) { 169 if (pdp->af == family && 170 pdp->gtp_version == GTP_V1 && 171 pdp->u.v1.i_tei == tid) 172 return pdp; 173 } 174 return NULL; 175 } 176 177 /* Resolve a PDP context based on IPv4 address of MS. */ 178 static struct pdp_ctx *ipv4_pdp_find(struct gtp_dev *gtp, __be32 ms_addr) 179 { 180 struct hlist_head *head; 181 struct pdp_ctx *pdp; 182 183 head = >p->addr_hash[ipv4_hashfn(ms_addr) % gtp->hash_size]; 184 185 hlist_for_each_entry_rcu(pdp, head, hlist_addr) { 186 if (pdp->af == AF_INET && 187 pdp->ms.addr.s_addr == ms_addr) 188 return pdp; 189 } 190 191 return NULL; 192 } 193 194 /* 3GPP TS 29.060: PDN Connection: the association between a MS represented by 195 * [...] one IPv6 *prefix* and a PDN represented by an APN. 196 * 197 * Then, 3GPP TS 29.061, Section 11.2.1.3 says: The size of the prefix shall be 198 * according to the maximum prefix length for a global IPv6 address as 199 * specified in the IPv6 Addressing Architecture, see RFC 4291. 200 * 201 * Finally, RFC 4291 section 2.5.4 states: All Global Unicast addresses other 202 * than those that start with binary 000 have a 64-bit interface ID field 203 * (i.e., n + m = 64). 204 */ 205 static bool ipv6_pdp_addr_equal(const struct in6_addr *a, 206 const struct in6_addr *b) 207 { 208 return a->s6_addr32[0] == b->s6_addr32[0] && 209 a->s6_addr32[1] == b->s6_addr32[1]; 210 } 211 212 static struct pdp_ctx *ipv6_pdp_find(struct gtp_dev *gtp, 213 const struct in6_addr *ms_addr) 214 { 215 struct hlist_head *head; 216 struct pdp_ctx *pdp; 217 218 head = >p->addr_hash[ipv6_hashfn(ms_addr) % gtp->hash_size]; 219 220 hlist_for_each_entry_rcu(pdp, head, hlist_addr) { 221 if (pdp->af == AF_INET6 && 222 ipv6_pdp_addr_equal(&pdp->ms.addr6, ms_addr)) 223 return pdp; 224 } 225 226 return NULL; 227 } 228 229 static bool gtp_check_ms_ipv4(struct sk_buff *skb, struct pdp_ctx *pctx, 230 unsigned int hdrlen, unsigned int role) 231 { 232 struct iphdr *iph; 233 234 if (!pskb_may_pull(skb, hdrlen + sizeof(struct iphdr))) 235 return false; 236 237 iph = (struct iphdr *)(skb->data + hdrlen); 238 239 if (role == GTP_ROLE_SGSN) 240 return iph->daddr == pctx->ms.addr.s_addr; 241 else 242 return iph->saddr == pctx->ms.addr.s_addr; 243 } 244 245 static bool gtp_check_ms_ipv6(struct sk_buff *skb, struct pdp_ctx *pctx, 246 unsigned int hdrlen, unsigned int role) 247 { 248 struct ipv6hdr *ip6h; 249 int ret; 250 251 if (!pskb_may_pull(skb, hdrlen + sizeof(struct ipv6hdr))) 252 return false; 253 254 ip6h = (struct ipv6hdr *)(skb->data + hdrlen); 255 256 if ((ipv6_addr_type(&ip6h->saddr) & IPV6_ADDR_LINKLOCAL) || 257 (ipv6_addr_type(&ip6h->daddr) & IPV6_ADDR_LINKLOCAL)) 258 return false; 259 260 if (role == GTP_ROLE_SGSN) { 261 ret = ipv6_pdp_addr_equal(&ip6h->daddr, &pctx->ms.addr6); 262 } else { 263 ret = ipv6_pdp_addr_equal(&ip6h->saddr, &pctx->ms.addr6); 264 } 265 266 return ret; 267 } 268 269 /* Check if the inner IP address in this packet is assigned to any 270 * existing mobile subscriber. 271 */ 272 static bool gtp_check_ms(struct sk_buff *skb, struct pdp_ctx *pctx, 273 unsigned int hdrlen, unsigned int role, 274 __u16 inner_proto) 275 { 276 switch (inner_proto) { 277 case ETH_P_IP: 278 return gtp_check_ms_ipv4(skb, pctx, hdrlen, role); 279 case ETH_P_IPV6: 280 return gtp_check_ms_ipv6(skb, pctx, hdrlen, role); 281 } 282 return false; 283 } 284 285 static int gtp_inner_proto(struct sk_buff *skb, unsigned int hdrlen, 286 __u16 *inner_proto) 287 { 288 __u8 *ip_version, _ip_version; 289 290 ip_version = skb_header_pointer(skb, hdrlen, sizeof(*ip_version), 291 &_ip_version); 292 if (!ip_version) 293 return -1; 294 295 switch (*ip_version & 0xf0) { 296 case 0x40: 297 *inner_proto = ETH_P_IP; 298 break; 299 case 0x60: 300 *inner_proto = ETH_P_IPV6; 301 break; 302 default: 303 return -1; 304 } 305 306 return 0; 307 } 308 309 static int gtp_rx(struct pdp_ctx *pctx, struct sk_buff *skb, 310 unsigned int hdrlen, unsigned int role, __u16 inner_proto) 311 { 312 if (!gtp_check_ms(skb, pctx, hdrlen, role, inner_proto)) { 313 netdev_dbg(pctx->dev, "No PDP ctx for this MS\n"); 314 return 1; 315 } 316 317 /* Get rid of the GTP + UDP headers. */ 318 if (iptunnel_pull_header(skb, hdrlen, htons(inner_proto), 319 !net_eq(sock_net(pctx->sk), dev_net(pctx->dev)))) { 320 pctx->dev->stats.rx_length_errors++; 321 goto err; 322 } 323 324 netdev_dbg(pctx->dev, "forwarding packet from GGSN to uplink\n"); 325 326 /* Now that the UDP and the GTP header have been removed, set up the 327 * new network header. This is required by the upper layer to 328 * calculate the transport header. 329 */ 330 skb_reset_network_header(skb); 331 skb_reset_mac_header(skb); 332 333 skb->dev = pctx->dev; 334 335 dev_sw_netstats_rx_add(pctx->dev, skb->len); 336 337 __netif_rx(skb); 338 return 0; 339 340 err: 341 pctx->dev->stats.rx_dropped++; 342 return -1; 343 } 344 345 static struct rtable *ip4_route_output_gtp(struct flowi4 *fl4, 346 const struct sock *sk, 347 __be32 daddr, __be32 saddr) 348 { 349 memset(fl4, 0, sizeof(*fl4)); 350 fl4->flowi4_oif = sk->sk_bound_dev_if; 351 fl4->daddr = daddr; 352 fl4->saddr = saddr; 353 fl4->flowi4_tos = ip_sock_rt_tos(sk); 354 fl4->flowi4_scope = ip_sock_rt_scope(sk); 355 fl4->flowi4_proto = sk->sk_protocol; 356 357 return ip_route_output_key(sock_net(sk), fl4); 358 } 359 360 static struct rt6_info *ip6_route_output_gtp(struct net *net, 361 struct flowi6 *fl6, 362 const struct sock *sk, 363 const struct in6_addr *daddr, 364 struct in6_addr *saddr) 365 { 366 struct dst_entry *dst; 367 368 memset(fl6, 0, sizeof(*fl6)); 369 fl6->flowi6_oif = sk->sk_bound_dev_if; 370 fl6->daddr = *daddr; 371 fl6->saddr = *saddr; 372 fl6->flowi6_proto = sk->sk_protocol; 373 374 dst = ipv6_stub->ipv6_dst_lookup_flow(net, sk, fl6, NULL); 375 if (IS_ERR(dst)) 376 return ERR_PTR(-ENETUNREACH); 377 378 return (struct rt6_info *)dst; 379 } 380 381 /* GSM TS 09.60. 7.3 382 * In all Path Management messages: 383 * - TID: is not used and shall be set to 0. 384 * - Flow Label is not used and shall be set to 0 385 * In signalling messages: 386 * - number: this field is not yet used in signalling messages. 387 * It shall be set to 255 by the sender and shall be ignored 388 * by the receiver 389 * Returns true if the echo req was correct, false otherwise. 390 */ 391 static bool gtp0_validate_echo_hdr(struct gtp0_header *gtp0) 392 { 393 return !(gtp0->tid || (gtp0->flags ^ 0x1e) || 394 gtp0->number != 0xff || gtp0->flow); 395 } 396 397 /* msg_type has to be GTP_ECHO_REQ or GTP_ECHO_RSP */ 398 static void gtp0_build_echo_msg(struct gtp0_header *hdr, __u8 msg_type) 399 { 400 int len_pkt, len_hdr; 401 402 hdr->flags = 0x1e; /* v0, GTP-non-prime. */ 403 hdr->type = msg_type; 404 /* GSM TS 09.60. 7.3 In all Path Management Flow Label and TID 405 * are not used and shall be set to 0. 406 */ 407 hdr->flow = 0; 408 hdr->tid = 0; 409 hdr->number = 0xff; 410 hdr->spare[0] = 0xff; 411 hdr->spare[1] = 0xff; 412 hdr->spare[2] = 0xff; 413 414 len_pkt = sizeof(struct gtp0_packet); 415 len_hdr = sizeof(struct gtp0_header); 416 417 if (msg_type == GTP_ECHO_RSP) 418 hdr->length = htons(len_pkt - len_hdr); 419 else 420 hdr->length = 0; 421 } 422 423 static int gtp0_send_echo_resp_ip(struct gtp_dev *gtp, struct sk_buff *skb) 424 { 425 struct iphdr *iph = ip_hdr(skb); 426 struct flowi4 fl4; 427 struct rtable *rt; 428 429 /* find route to the sender, 430 * src address becomes dst address and vice versa. 431 */ 432 rt = ip4_route_output_gtp(&fl4, gtp->sk0, iph->saddr, iph->daddr); 433 if (IS_ERR(rt)) { 434 netdev_dbg(gtp->dev, "no route for echo response from %pI4\n", 435 &iph->saddr); 436 return -1; 437 } 438 439 udp_tunnel_xmit_skb(rt, gtp->sk0, skb, 440 fl4.saddr, fl4.daddr, 441 iph->tos, 442 ip4_dst_hoplimit(&rt->dst), 443 0, 444 htons(GTP0_PORT), htons(GTP0_PORT), 445 !net_eq(sock_net(gtp->sk1u), 446 dev_net(gtp->dev)), 447 false); 448 449 return 0; 450 } 451 452 static int gtp0_send_echo_resp(struct gtp_dev *gtp, struct sk_buff *skb) 453 { 454 struct gtp0_packet *gtp_pkt; 455 struct gtp0_header *gtp0; 456 __be16 seq; 457 458 gtp0 = (struct gtp0_header *)(skb->data + sizeof(struct udphdr)); 459 460 if (!gtp0_validate_echo_hdr(gtp0)) 461 return -1; 462 463 seq = gtp0->seq; 464 465 /* pull GTP and UDP headers */ 466 skb_pull_data(skb, sizeof(struct gtp0_header) + sizeof(struct udphdr)); 467 468 gtp_pkt = skb_push(skb, sizeof(struct gtp0_packet)); 469 memset(gtp_pkt, 0, sizeof(struct gtp0_packet)); 470 471 gtp0_build_echo_msg(>p_pkt->gtp0_h, GTP_ECHO_RSP); 472 473 /* GSM TS 09.60. 7.3 The Sequence Number in a signalling response 474 * message shall be copied from the signalling request message 475 * that the GSN is replying to. 476 */ 477 gtp_pkt->gtp0_h.seq = seq; 478 479 gtp_pkt->ie.tag = GTPIE_RECOVERY; 480 gtp_pkt->ie.val = gtp->restart_count; 481 482 switch (gtp->sk0->sk_family) { 483 case AF_INET: 484 if (gtp0_send_echo_resp_ip(gtp, skb) < 0) 485 return -1; 486 break; 487 case AF_INET6: 488 return -1; 489 } 490 491 return 0; 492 } 493 494 static int gtp_genl_fill_echo(struct sk_buff *skb, u32 snd_portid, u32 snd_seq, 495 int flags, u32 type, struct echo_info echo) 496 { 497 void *genlh; 498 499 genlh = genlmsg_put(skb, snd_portid, snd_seq, >p_genl_family, flags, 500 type); 501 if (!genlh) 502 goto failure; 503 504 if (nla_put_u32(skb, GTPA_VERSION, echo.gtp_version) || 505 nla_put_be32(skb, GTPA_PEER_ADDRESS, echo.peer.addr.s_addr) || 506 nla_put_be32(skb, GTPA_MS_ADDRESS, echo.ms.addr.s_addr)) 507 goto failure; 508 509 genlmsg_end(skb, genlh); 510 return 0; 511 512 failure: 513 genlmsg_cancel(skb, genlh); 514 return -EMSGSIZE; 515 } 516 517 static void gtp0_handle_echo_resp_ip(struct sk_buff *skb, struct echo_info *echo) 518 { 519 struct iphdr *iph = ip_hdr(skb); 520 521 echo->ms.addr.s_addr = iph->daddr; 522 echo->peer.addr.s_addr = iph->saddr; 523 echo->gtp_version = GTP_V0; 524 } 525 526 static int gtp0_handle_echo_resp(struct gtp_dev *gtp, struct sk_buff *skb) 527 { 528 struct gtp0_header *gtp0; 529 struct echo_info echo; 530 struct sk_buff *msg; 531 int ret; 532 533 gtp0 = (struct gtp0_header *)(skb->data + sizeof(struct udphdr)); 534 535 if (!gtp0_validate_echo_hdr(gtp0)) 536 return -1; 537 538 switch (gtp->sk0->sk_family) { 539 case AF_INET: 540 gtp0_handle_echo_resp_ip(skb, &echo); 541 break; 542 case AF_INET6: 543 return -1; 544 } 545 546 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 547 if (!msg) 548 return -ENOMEM; 549 550 ret = gtp_genl_fill_echo(msg, 0, 0, 0, GTP_CMD_ECHOREQ, echo); 551 if (ret < 0) { 552 nlmsg_free(msg); 553 return ret; 554 } 555 556 return genlmsg_multicast_netns(>p_genl_family, dev_net(gtp->dev), 557 msg, 0, GTP_GENL_MCGRP, GFP_ATOMIC); 558 } 559 560 static int gtp_proto_to_family(__u16 proto) 561 { 562 switch (proto) { 563 case ETH_P_IP: 564 return AF_INET; 565 case ETH_P_IPV6: 566 return AF_INET6; 567 default: 568 WARN_ON_ONCE(1); 569 break; 570 } 571 572 return AF_UNSPEC; 573 } 574 575 /* 1 means pass up to the stack, -1 means drop and 0 means decapsulated. */ 576 static int gtp0_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb) 577 { 578 unsigned int hdrlen = sizeof(struct udphdr) + 579 sizeof(struct gtp0_header); 580 struct gtp0_header *gtp0; 581 struct pdp_ctx *pctx; 582 __u16 inner_proto; 583 584 if (!pskb_may_pull(skb, hdrlen)) 585 return -1; 586 587 gtp0 = (struct gtp0_header *)(skb->data + sizeof(struct udphdr)); 588 589 if ((gtp0->flags >> 5) != GTP_V0) 590 return 1; 591 592 /* If the sockets were created in kernel, it means that 593 * there is no daemon running in userspace which would 594 * handle echo request. 595 */ 596 if (gtp0->type == GTP_ECHO_REQ && gtp->sk_created) 597 return gtp0_send_echo_resp(gtp, skb); 598 599 if (gtp0->type == GTP_ECHO_RSP && gtp->sk_created) 600 return gtp0_handle_echo_resp(gtp, skb); 601 602 if (gtp0->type != GTP_TPDU) 603 return 1; 604 605 if (gtp_inner_proto(skb, hdrlen, &inner_proto) < 0) { 606 netdev_dbg(gtp->dev, "GTP packet does not encapsulate an IP packet\n"); 607 return -1; 608 } 609 610 pctx = gtp0_pdp_find(gtp, be64_to_cpu(gtp0->tid), 611 gtp_proto_to_family(inner_proto)); 612 if (!pctx) { 613 netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb); 614 return 1; 615 } 616 617 return gtp_rx(pctx, skb, hdrlen, gtp->role, inner_proto); 618 } 619 620 /* msg_type has to be GTP_ECHO_REQ or GTP_ECHO_RSP */ 621 static void gtp1u_build_echo_msg(struct gtp1_header_long *hdr, __u8 msg_type) 622 { 623 int len_pkt, len_hdr; 624 625 /* S flag must be set to 1 */ 626 hdr->flags = 0x32; /* v1, GTP-non-prime. */ 627 hdr->type = msg_type; 628 /* 3GPP TS 29.281 5.1 - TEID has to be set to 0 */ 629 hdr->tid = 0; 630 631 /* seq, npdu and next should be counted to the length of the GTP packet 632 * that's why szie of gtp1_header should be subtracted, 633 * not size of gtp1_header_long. 634 */ 635 636 len_hdr = sizeof(struct gtp1_header); 637 638 if (msg_type == GTP_ECHO_RSP) { 639 len_pkt = sizeof(struct gtp1u_packet); 640 hdr->length = htons(len_pkt - len_hdr); 641 } else { 642 /* GTP_ECHO_REQ does not carry GTP Information Element, 643 * the why gtp1_header_long is used here. 644 */ 645 len_pkt = sizeof(struct gtp1_header_long); 646 hdr->length = htons(len_pkt - len_hdr); 647 } 648 } 649 650 static int gtp1u_send_echo_resp(struct gtp_dev *gtp, struct sk_buff *skb) 651 { 652 struct gtp1_header_long *gtp1u; 653 struct gtp1u_packet *gtp_pkt; 654 struct rtable *rt; 655 struct flowi4 fl4; 656 struct iphdr *iph; 657 658 gtp1u = (struct gtp1_header_long *)(skb->data + sizeof(struct udphdr)); 659 660 /* 3GPP TS 29.281 5.1 - For the Echo Request, Echo Response, 661 * Error Indication and Supported Extension Headers Notification 662 * messages, the S flag shall be set to 1 and TEID shall be set to 0. 663 */ 664 if (!(gtp1u->flags & GTP1_F_SEQ) || gtp1u->tid) 665 return -1; 666 667 /* pull GTP and UDP headers */ 668 skb_pull_data(skb, 669 sizeof(struct gtp1_header_long) + sizeof(struct udphdr)); 670 671 gtp_pkt = skb_push(skb, sizeof(struct gtp1u_packet)); 672 memset(gtp_pkt, 0, sizeof(struct gtp1u_packet)); 673 674 gtp1u_build_echo_msg(>p_pkt->gtp1u_h, GTP_ECHO_RSP); 675 676 /* 3GPP TS 29.281 7.7.2 - The Restart Counter value in the 677 * Recovery information element shall not be used, i.e. it shall 678 * be set to zero by the sender and shall be ignored by the receiver. 679 * The Recovery information element is mandatory due to backwards 680 * compatibility reasons. 681 */ 682 gtp_pkt->ie.tag = GTPIE_RECOVERY; 683 gtp_pkt->ie.val = 0; 684 685 iph = ip_hdr(skb); 686 687 /* find route to the sender, 688 * src address becomes dst address and vice versa. 689 */ 690 rt = ip4_route_output_gtp(&fl4, gtp->sk1u, iph->saddr, iph->daddr); 691 if (IS_ERR(rt)) { 692 netdev_dbg(gtp->dev, "no route for echo response from %pI4\n", 693 &iph->saddr); 694 return -1; 695 } 696 697 udp_tunnel_xmit_skb(rt, gtp->sk1u, skb, 698 fl4.saddr, fl4.daddr, 699 iph->tos, 700 ip4_dst_hoplimit(&rt->dst), 701 0, 702 htons(GTP1U_PORT), htons(GTP1U_PORT), 703 !net_eq(sock_net(gtp->sk1u), 704 dev_net(gtp->dev)), 705 false); 706 return 0; 707 } 708 709 static int gtp1u_handle_echo_resp(struct gtp_dev *gtp, struct sk_buff *skb) 710 { 711 struct gtp1_header_long *gtp1u; 712 struct echo_info echo; 713 struct sk_buff *msg; 714 struct iphdr *iph; 715 int ret; 716 717 gtp1u = (struct gtp1_header_long *)(skb->data + sizeof(struct udphdr)); 718 719 /* 3GPP TS 29.281 5.1 - For the Echo Request, Echo Response, 720 * Error Indication and Supported Extension Headers Notification 721 * messages, the S flag shall be set to 1 and TEID shall be set to 0. 722 */ 723 if (!(gtp1u->flags & GTP1_F_SEQ) || gtp1u->tid) 724 return -1; 725 726 iph = ip_hdr(skb); 727 echo.ms.addr.s_addr = iph->daddr; 728 echo.peer.addr.s_addr = iph->saddr; 729 echo.gtp_version = GTP_V1; 730 731 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 732 if (!msg) 733 return -ENOMEM; 734 735 ret = gtp_genl_fill_echo(msg, 0, 0, 0, GTP_CMD_ECHOREQ, echo); 736 if (ret < 0) { 737 nlmsg_free(msg); 738 return ret; 739 } 740 741 return genlmsg_multicast_netns(>p_genl_family, dev_net(gtp->dev), 742 msg, 0, GTP_GENL_MCGRP, GFP_ATOMIC); 743 } 744 745 static int gtp_parse_exthdrs(struct sk_buff *skb, unsigned int *hdrlen) 746 { 747 struct gtp_ext_hdr *gtp_exthdr, _gtp_exthdr; 748 unsigned int offset = *hdrlen; 749 __u8 *next_type, _next_type; 750 751 /* From 29.060: "The Extension Header Length field specifies the length 752 * of the particular Extension header in 4 octets units." 753 * 754 * This length field includes length field size itself (1 byte), 755 * payload (variable length) and next type (1 byte). The extension 756 * header is aligned to to 4 bytes. 757 */ 758 759 do { 760 gtp_exthdr = skb_header_pointer(skb, offset, sizeof(*gtp_exthdr), 761 &_gtp_exthdr); 762 if (!gtp_exthdr || !gtp_exthdr->len) 763 return -1; 764 765 offset += gtp_exthdr->len * 4; 766 767 /* From 29.060: "If no such Header follows, then the value of 768 * the Next Extension Header Type shall be 0." 769 */ 770 next_type = skb_header_pointer(skb, offset - 1, 771 sizeof(_next_type), &_next_type); 772 if (!next_type) 773 return -1; 774 775 } while (*next_type != 0); 776 777 *hdrlen = offset; 778 779 return 0; 780 } 781 782 static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb) 783 { 784 unsigned int hdrlen = sizeof(struct udphdr) + 785 sizeof(struct gtp1_header); 786 struct gtp1_header *gtp1; 787 struct pdp_ctx *pctx; 788 __u16 inner_proto; 789 790 if (!pskb_may_pull(skb, hdrlen)) 791 return -1; 792 793 gtp1 = (struct gtp1_header *)(skb->data + sizeof(struct udphdr)); 794 795 if ((gtp1->flags >> 5) != GTP_V1) 796 return 1; 797 798 /* If the sockets were created in kernel, it means that 799 * there is no daemon running in userspace which would 800 * handle echo request. 801 */ 802 if (gtp1->type == GTP_ECHO_REQ && gtp->sk_created) 803 return gtp1u_send_echo_resp(gtp, skb); 804 805 if (gtp1->type == GTP_ECHO_RSP && gtp->sk_created) 806 return gtp1u_handle_echo_resp(gtp, skb); 807 808 if (gtp1->type != GTP_TPDU) 809 return 1; 810 811 /* From 29.060: "This field shall be present if and only if any one or 812 * more of the S, PN and E flags are set.". 813 * 814 * If any of the bit is set, then the remaining ones also have to be 815 * set. 816 */ 817 if (gtp1->flags & GTP1_F_MASK) 818 hdrlen += 4; 819 820 /* Make sure the header is larger enough, including extensions. */ 821 if (!pskb_may_pull(skb, hdrlen)) 822 return -1; 823 824 if (gtp_inner_proto(skb, hdrlen, &inner_proto) < 0) { 825 netdev_dbg(gtp->dev, "GTP packet does not encapsulate an IP packet\n"); 826 return -1; 827 } 828 829 gtp1 = (struct gtp1_header *)(skb->data + sizeof(struct udphdr)); 830 831 pctx = gtp1_pdp_find(gtp, ntohl(gtp1->tid), 832 gtp_proto_to_family(inner_proto)); 833 if (!pctx) { 834 netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb); 835 return 1; 836 } 837 838 if (gtp1->flags & GTP1_F_EXTHDR && 839 gtp_parse_exthdrs(skb, &hdrlen) < 0) 840 return -1; 841 842 return gtp_rx(pctx, skb, hdrlen, gtp->role, inner_proto); 843 } 844 845 static void __gtp_encap_destroy(struct sock *sk) 846 { 847 struct gtp_dev *gtp; 848 849 lock_sock(sk); 850 gtp = sk->sk_user_data; 851 if (gtp) { 852 if (gtp->sk0 == sk) 853 gtp->sk0 = NULL; 854 else 855 gtp->sk1u = NULL; 856 WRITE_ONCE(udp_sk(sk)->encap_type, 0); 857 rcu_assign_sk_user_data(sk, NULL); 858 release_sock(sk); 859 sock_put(sk); 860 return; 861 } 862 release_sock(sk); 863 } 864 865 static void gtp_encap_destroy(struct sock *sk) 866 { 867 rtnl_lock(); 868 __gtp_encap_destroy(sk); 869 rtnl_unlock(); 870 } 871 872 static void gtp_encap_disable_sock(struct sock *sk) 873 { 874 if (!sk) 875 return; 876 877 __gtp_encap_destroy(sk); 878 } 879 880 static void gtp_encap_disable(struct gtp_dev *gtp) 881 { 882 if (gtp->sk_created) { 883 udp_tunnel_sock_release(gtp->sk0->sk_socket); 884 udp_tunnel_sock_release(gtp->sk1u->sk_socket); 885 gtp->sk_created = false; 886 gtp->sk0 = NULL; 887 gtp->sk1u = NULL; 888 } else { 889 gtp_encap_disable_sock(gtp->sk0); 890 gtp_encap_disable_sock(gtp->sk1u); 891 } 892 } 893 894 /* UDP encapsulation receive handler. See net/ipv4/udp.c. 895 * Return codes: 0: success, <0: error, >0: pass up to userspace UDP socket. 896 */ 897 static int gtp_encap_recv(struct sock *sk, struct sk_buff *skb) 898 { 899 struct gtp_dev *gtp; 900 int ret = 0; 901 902 gtp = rcu_dereference_sk_user_data(sk); 903 if (!gtp) 904 return 1; 905 906 netdev_dbg(gtp->dev, "encap_recv sk=%p\n", sk); 907 908 switch (READ_ONCE(udp_sk(sk)->encap_type)) { 909 case UDP_ENCAP_GTP0: 910 netdev_dbg(gtp->dev, "received GTP0 packet\n"); 911 ret = gtp0_udp_encap_recv(gtp, skb); 912 break; 913 case UDP_ENCAP_GTP1U: 914 netdev_dbg(gtp->dev, "received GTP1U packet\n"); 915 ret = gtp1u_udp_encap_recv(gtp, skb); 916 break; 917 default: 918 ret = -1; /* Shouldn't happen. */ 919 } 920 921 switch (ret) { 922 case 1: 923 netdev_dbg(gtp->dev, "pass up to the process\n"); 924 break; 925 case 0: 926 break; 927 case -1: 928 netdev_dbg(gtp->dev, "GTP packet has been dropped\n"); 929 kfree_skb(skb); 930 ret = 0; 931 break; 932 } 933 934 return ret; 935 } 936 937 static void gtp_dev_uninit(struct net_device *dev) 938 { 939 struct gtp_dev *gtp = netdev_priv(dev); 940 941 gtp_encap_disable(gtp); 942 } 943 944 static inline void gtp0_push_header(struct sk_buff *skb, struct pdp_ctx *pctx) 945 { 946 int payload_len = skb->len; 947 struct gtp0_header *gtp0; 948 949 gtp0 = skb_push(skb, sizeof(*gtp0)); 950 951 gtp0->flags = 0x1e; /* v0, GTP-non-prime. */ 952 gtp0->type = GTP_TPDU; 953 gtp0->length = htons(payload_len); 954 gtp0->seq = htons((atomic_inc_return(&pctx->tx_seq) - 1) % 0xffff); 955 gtp0->flow = htons(pctx->u.v0.flow); 956 gtp0->number = 0xff; 957 gtp0->spare[0] = gtp0->spare[1] = gtp0->spare[2] = 0xff; 958 gtp0->tid = cpu_to_be64(pctx->u.v0.tid); 959 } 960 961 static inline void gtp1_push_header(struct sk_buff *skb, struct pdp_ctx *pctx) 962 { 963 int payload_len = skb->len; 964 struct gtp1_header *gtp1; 965 966 gtp1 = skb_push(skb, sizeof(*gtp1)); 967 968 /* Bits 8 7 6 5 4 3 2 1 969 * +--+--+--+--+--+--+--+--+ 970 * |version |PT| 0| E| S|PN| 971 * +--+--+--+--+--+--+--+--+ 972 * 0 0 1 1 1 0 0 0 973 */ 974 gtp1->flags = 0x30; /* v1, GTP-non-prime. */ 975 gtp1->type = GTP_TPDU; 976 gtp1->length = htons(payload_len); 977 gtp1->tid = htonl(pctx->u.v1.o_tei); 978 979 /* TODO: Support for extension header, sequence number and N-PDU. 980 * Update the length field if any of them is available. 981 */ 982 } 983 984 struct gtp_pktinfo { 985 struct sock *sk; 986 union { 987 struct flowi4 fl4; 988 struct flowi6 fl6; 989 }; 990 union { 991 struct rtable *rt; 992 struct rt6_info *rt6; 993 }; 994 struct pdp_ctx *pctx; 995 struct net_device *dev; 996 __u8 tos; 997 __be16 gtph_port; 998 }; 999 1000 static void gtp_push_header(struct sk_buff *skb, struct gtp_pktinfo *pktinfo) 1001 { 1002 switch (pktinfo->pctx->gtp_version) { 1003 case GTP_V0: 1004 pktinfo->gtph_port = htons(GTP0_PORT); 1005 gtp0_push_header(skb, pktinfo->pctx); 1006 break; 1007 case GTP_V1: 1008 pktinfo->gtph_port = htons(GTP1U_PORT); 1009 gtp1_push_header(skb, pktinfo->pctx); 1010 break; 1011 } 1012 } 1013 1014 static inline void gtp_set_pktinfo_ipv4(struct gtp_pktinfo *pktinfo, 1015 struct sock *sk, __u8 tos, 1016 struct pdp_ctx *pctx, struct rtable *rt, 1017 struct flowi4 *fl4, 1018 struct net_device *dev) 1019 { 1020 pktinfo->sk = sk; 1021 pktinfo->tos = tos; 1022 pktinfo->pctx = pctx; 1023 pktinfo->rt = rt; 1024 pktinfo->fl4 = *fl4; 1025 pktinfo->dev = dev; 1026 } 1027 1028 static void gtp_set_pktinfo_ipv6(struct gtp_pktinfo *pktinfo, 1029 struct sock *sk, __u8 tos, 1030 struct pdp_ctx *pctx, struct rt6_info *rt6, 1031 struct flowi6 *fl6, 1032 struct net_device *dev) 1033 { 1034 pktinfo->sk = sk; 1035 pktinfo->tos = tos; 1036 pktinfo->pctx = pctx; 1037 pktinfo->rt6 = rt6; 1038 pktinfo->fl6 = *fl6; 1039 pktinfo->dev = dev; 1040 } 1041 1042 static int gtp_build_skb_outer_ip4(struct sk_buff *skb, struct net_device *dev, 1043 struct gtp_pktinfo *pktinfo, 1044 struct pdp_ctx *pctx, __u8 tos, 1045 __be16 frag_off) 1046 { 1047 struct rtable *rt; 1048 struct flowi4 fl4; 1049 __be16 df; 1050 int mtu; 1051 1052 rt = ip4_route_output_gtp(&fl4, pctx->sk, pctx->peer.addr.s_addr, 1053 inet_sk(pctx->sk)->inet_saddr); 1054 if (IS_ERR(rt)) { 1055 netdev_dbg(dev, "no route to SSGN %pI4\n", 1056 &pctx->peer.addr.s_addr); 1057 dev->stats.tx_carrier_errors++; 1058 goto err; 1059 } 1060 1061 if (rt->dst.dev == dev) { 1062 netdev_dbg(dev, "circular route to SSGN %pI4\n", 1063 &pctx->peer.addr.s_addr); 1064 dev->stats.collisions++; 1065 goto err_rt; 1066 } 1067 1068 /* This is similar to tnl_update_pmtu(). */ 1069 df = frag_off; 1070 if (df) { 1071 mtu = dst_mtu(&rt->dst) - dev->hard_header_len - 1072 sizeof(struct iphdr) - sizeof(struct udphdr); 1073 switch (pctx->gtp_version) { 1074 case GTP_V0: 1075 mtu -= sizeof(struct gtp0_header); 1076 break; 1077 case GTP_V1: 1078 mtu -= sizeof(struct gtp1_header); 1079 break; 1080 } 1081 } else { 1082 mtu = dst_mtu(&rt->dst); 1083 } 1084 1085 skb_dst_update_pmtu_no_confirm(skb, mtu); 1086 1087 if (frag_off & htons(IP_DF) && 1088 ((!skb_is_gso(skb) && skb->len > mtu) || 1089 (skb_is_gso(skb) && !skb_gso_validate_network_len(skb, mtu)))) { 1090 netdev_dbg(dev, "packet too big, fragmentation needed\n"); 1091 icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, 1092 htonl(mtu)); 1093 goto err_rt; 1094 } 1095 1096 gtp_set_pktinfo_ipv4(pktinfo, pctx->sk, tos, pctx, rt, &fl4, dev); 1097 gtp_push_header(skb, pktinfo); 1098 1099 return 0; 1100 err_rt: 1101 ip_rt_put(rt); 1102 err: 1103 return -EBADMSG; 1104 } 1105 1106 static int gtp_build_skb_outer_ip6(struct net *net, struct sk_buff *skb, 1107 struct net_device *dev, 1108 struct gtp_pktinfo *pktinfo, 1109 struct pdp_ctx *pctx, __u8 tos) 1110 { 1111 struct dst_entry *dst; 1112 struct rt6_info *rt; 1113 struct flowi6 fl6; 1114 int mtu; 1115 1116 rt = ip6_route_output_gtp(net, &fl6, pctx->sk, &pctx->peer.addr6, 1117 &inet6_sk(pctx->sk)->saddr); 1118 if (IS_ERR(rt)) { 1119 netdev_dbg(dev, "no route to SSGN %pI6\n", 1120 &pctx->peer.addr6); 1121 dev->stats.tx_carrier_errors++; 1122 goto err; 1123 } 1124 dst = &rt->dst; 1125 1126 if (rt->dst.dev == dev) { 1127 netdev_dbg(dev, "circular route to SSGN %pI6\n", 1128 &pctx->peer.addr6); 1129 dev->stats.collisions++; 1130 goto err_rt; 1131 } 1132 1133 mtu = dst_mtu(&rt->dst) - dev->hard_header_len - 1134 sizeof(struct ipv6hdr) - sizeof(struct udphdr); 1135 switch (pctx->gtp_version) { 1136 case GTP_V0: 1137 mtu -= sizeof(struct gtp0_header); 1138 break; 1139 case GTP_V1: 1140 mtu -= sizeof(struct gtp1_header); 1141 break; 1142 } 1143 1144 skb_dst_update_pmtu_no_confirm(skb, mtu); 1145 1146 if ((!skb_is_gso(skb) && skb->len > mtu) || 1147 (skb_is_gso(skb) && !skb_gso_validate_network_len(skb, mtu))) { 1148 netdev_dbg(dev, "packet too big, fragmentation needed\n"); 1149 icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); 1150 goto err_rt; 1151 } 1152 1153 gtp_set_pktinfo_ipv6(pktinfo, pctx->sk, tos, pctx, rt, &fl6, dev); 1154 gtp_push_header(skb, pktinfo); 1155 1156 return 0; 1157 err_rt: 1158 dst_release(dst); 1159 err: 1160 return -EBADMSG; 1161 } 1162 1163 static int gtp_build_skb_ip4(struct sk_buff *skb, struct net_device *dev, 1164 struct gtp_pktinfo *pktinfo) 1165 { 1166 struct gtp_dev *gtp = netdev_priv(dev); 1167 struct net *net = gtp->net; 1168 struct pdp_ctx *pctx; 1169 struct iphdr *iph; 1170 int ret; 1171 1172 /* Read the IP destination address and resolve the PDP context. 1173 * Prepend PDP header with TEI/TID from PDP ctx. 1174 */ 1175 iph = ip_hdr(skb); 1176 if (gtp->role == GTP_ROLE_SGSN) 1177 pctx = ipv4_pdp_find(gtp, iph->saddr); 1178 else 1179 pctx = ipv4_pdp_find(gtp, iph->daddr); 1180 1181 if (!pctx) { 1182 netdev_dbg(dev, "no PDP ctx found for %pI4, skip\n", 1183 &iph->daddr); 1184 return -ENOENT; 1185 } 1186 netdev_dbg(dev, "found PDP context %p\n", pctx); 1187 1188 switch (pctx->sk->sk_family) { 1189 case AF_INET: 1190 ret = gtp_build_skb_outer_ip4(skb, dev, pktinfo, pctx, 1191 iph->tos, iph->frag_off); 1192 break; 1193 case AF_INET6: 1194 ret = gtp_build_skb_outer_ip6(net, skb, dev, pktinfo, pctx, 1195 iph->tos); 1196 break; 1197 default: 1198 ret = -1; 1199 WARN_ON_ONCE(1); 1200 break; 1201 } 1202 1203 if (ret < 0) 1204 return ret; 1205 1206 netdev_dbg(dev, "gtp -> IP src: %pI4 dst: %pI4\n", 1207 &iph->saddr, &iph->daddr); 1208 1209 return 0; 1210 } 1211 1212 static int gtp_build_skb_ip6(struct sk_buff *skb, struct net_device *dev, 1213 struct gtp_pktinfo *pktinfo) 1214 { 1215 struct gtp_dev *gtp = netdev_priv(dev); 1216 struct net *net = gtp->net; 1217 struct pdp_ctx *pctx; 1218 struct ipv6hdr *ip6h; 1219 __u8 tos; 1220 int ret; 1221 1222 /* Read the IP destination address and resolve the PDP context. 1223 * Prepend PDP header with TEI/TID from PDP ctx. 1224 */ 1225 ip6h = ipv6_hdr(skb); 1226 if (gtp->role == GTP_ROLE_SGSN) 1227 pctx = ipv6_pdp_find(gtp, &ip6h->saddr); 1228 else 1229 pctx = ipv6_pdp_find(gtp, &ip6h->daddr); 1230 1231 if (!pctx) { 1232 netdev_dbg(dev, "no PDP ctx found for %pI6, skip\n", 1233 &ip6h->daddr); 1234 return -ENOENT; 1235 } 1236 netdev_dbg(dev, "found PDP context %p\n", pctx); 1237 1238 tos = ipv6_get_dsfield(ip6h); 1239 1240 switch (pctx->sk->sk_family) { 1241 case AF_INET: 1242 ret = gtp_build_skb_outer_ip4(skb, dev, pktinfo, pctx, tos, 0); 1243 break; 1244 case AF_INET6: 1245 ret = gtp_build_skb_outer_ip6(net, skb, dev, pktinfo, pctx, tos); 1246 break; 1247 default: 1248 ret = -1; 1249 WARN_ON_ONCE(1); 1250 break; 1251 } 1252 1253 if (ret < 0) 1254 return ret; 1255 1256 netdev_dbg(dev, "gtp -> IP src: %pI6 dst: %pI6\n", 1257 &ip6h->saddr, &ip6h->daddr); 1258 1259 return 0; 1260 } 1261 1262 static netdev_tx_t gtp_dev_xmit(struct sk_buff *skb, struct net_device *dev) 1263 { 1264 unsigned int proto = ntohs(skb->protocol); 1265 struct gtp_pktinfo pktinfo; 1266 int err; 1267 1268 /* Ensure there is sufficient headroom. */ 1269 if (skb_cow_head(skb, dev->needed_headroom)) 1270 goto tx_err; 1271 1272 if (!pskb_inet_may_pull(skb)) 1273 goto tx_err; 1274 1275 skb_reset_inner_headers(skb); 1276 1277 /* PDP context lookups in gtp_build_skb_*() need rcu read-side lock. */ 1278 rcu_read_lock(); 1279 switch (proto) { 1280 case ETH_P_IP: 1281 err = gtp_build_skb_ip4(skb, dev, &pktinfo); 1282 break; 1283 case ETH_P_IPV6: 1284 err = gtp_build_skb_ip6(skb, dev, &pktinfo); 1285 break; 1286 default: 1287 err = -EOPNOTSUPP; 1288 break; 1289 } 1290 rcu_read_unlock(); 1291 1292 if (err < 0) 1293 goto tx_err; 1294 1295 switch (pktinfo.pctx->sk->sk_family) { 1296 case AF_INET: 1297 udp_tunnel_xmit_skb(pktinfo.rt, pktinfo.sk, skb, 1298 pktinfo.fl4.saddr, pktinfo.fl4.daddr, 1299 pktinfo.tos, 1300 ip4_dst_hoplimit(&pktinfo.rt->dst), 1301 0, 1302 pktinfo.gtph_port, pktinfo.gtph_port, 1303 !net_eq(sock_net(pktinfo.pctx->sk), 1304 dev_net(dev)), 1305 false); 1306 break; 1307 case AF_INET6: 1308 #if IS_ENABLED(CONFIG_IPV6) 1309 udp_tunnel6_xmit_skb(&pktinfo.rt6->dst, pktinfo.sk, skb, dev, 1310 &pktinfo.fl6.saddr, &pktinfo.fl6.daddr, 1311 pktinfo.tos, 1312 ip6_dst_hoplimit(&pktinfo.rt->dst), 1313 0, 1314 pktinfo.gtph_port, pktinfo.gtph_port, 1315 false); 1316 #else 1317 goto tx_err; 1318 #endif 1319 break; 1320 } 1321 1322 return NETDEV_TX_OK; 1323 tx_err: 1324 dev->stats.tx_errors++; 1325 dev_kfree_skb(skb); 1326 return NETDEV_TX_OK; 1327 } 1328 1329 static const struct net_device_ops gtp_netdev_ops = { 1330 .ndo_uninit = gtp_dev_uninit, 1331 .ndo_start_xmit = gtp_dev_xmit, 1332 }; 1333 1334 static const struct device_type gtp_type = { 1335 .name = "gtp", 1336 }; 1337 1338 #define GTP_TH_MAXLEN (sizeof(struct udphdr) + sizeof(struct gtp0_header)) 1339 #define GTP_IPV4_MAXLEN (sizeof(struct iphdr) + GTP_TH_MAXLEN) 1340 1341 static void gtp_link_setup(struct net_device *dev) 1342 { 1343 struct gtp_dev *gtp = netdev_priv(dev); 1344 1345 dev->netdev_ops = >p_netdev_ops; 1346 dev->needs_free_netdev = true; 1347 SET_NETDEV_DEVTYPE(dev, >p_type); 1348 1349 dev->hard_header_len = 0; 1350 dev->addr_len = 0; 1351 dev->mtu = ETH_DATA_LEN - GTP_IPV4_MAXLEN; 1352 1353 /* Zero header length. */ 1354 dev->type = ARPHRD_NONE; 1355 dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST; 1356 1357 dev->pcpu_stat_type = NETDEV_PCPU_STAT_TSTATS; 1358 dev->priv_flags |= IFF_NO_QUEUE; 1359 dev->features |= NETIF_F_LLTX; 1360 netif_keep_dst(dev); 1361 1362 dev->needed_headroom = LL_MAX_HEADER + GTP_IPV4_MAXLEN; 1363 gtp->dev = dev; 1364 } 1365 1366 static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize); 1367 static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]); 1368 1369 static void gtp_destructor(struct net_device *dev) 1370 { 1371 struct gtp_dev *gtp = netdev_priv(dev); 1372 1373 kfree(gtp->addr_hash); 1374 kfree(gtp->tid_hash); 1375 } 1376 1377 static int gtp_sock_udp_config(struct udp_port_cfg *udp_conf, 1378 const struct nlattr *nla, int family) 1379 { 1380 udp_conf->family = family; 1381 1382 switch (udp_conf->family) { 1383 case AF_INET: 1384 udp_conf->local_ip.s_addr = nla_get_be32(nla); 1385 break; 1386 #if IS_ENABLED(CONFIG_IPV6) 1387 case AF_INET6: 1388 udp_conf->local_ip6 = nla_get_in6_addr(nla); 1389 break; 1390 #endif 1391 default: 1392 return -EOPNOTSUPP; 1393 } 1394 1395 return 0; 1396 } 1397 1398 static struct sock *gtp_create_sock(int type, struct gtp_dev *gtp, 1399 const struct nlattr *nla, int family) 1400 { 1401 struct udp_tunnel_sock_cfg tuncfg = {}; 1402 struct udp_port_cfg udp_conf = {}; 1403 struct net *net = gtp->net; 1404 struct socket *sock; 1405 int err; 1406 1407 if (nla) { 1408 err = gtp_sock_udp_config(&udp_conf, nla, family); 1409 if (err < 0) 1410 return ERR_PTR(err); 1411 } else { 1412 udp_conf.local_ip.s_addr = htonl(INADDR_ANY); 1413 udp_conf.family = AF_INET; 1414 } 1415 1416 if (type == UDP_ENCAP_GTP0) 1417 udp_conf.local_udp_port = htons(GTP0_PORT); 1418 else if (type == UDP_ENCAP_GTP1U) 1419 udp_conf.local_udp_port = htons(GTP1U_PORT); 1420 else 1421 return ERR_PTR(-EINVAL); 1422 1423 err = udp_sock_create(net, &udp_conf, &sock); 1424 if (err) 1425 return ERR_PTR(err); 1426 1427 tuncfg.sk_user_data = gtp; 1428 tuncfg.encap_type = type; 1429 tuncfg.encap_rcv = gtp_encap_recv; 1430 tuncfg.encap_destroy = NULL; 1431 1432 setup_udp_tunnel_sock(net, sock, &tuncfg); 1433 1434 return sock->sk; 1435 } 1436 1437 static int gtp_create_sockets(struct gtp_dev *gtp, const struct nlattr *nla, 1438 int family) 1439 { 1440 struct sock *sk1u; 1441 struct sock *sk0; 1442 1443 sk0 = gtp_create_sock(UDP_ENCAP_GTP0, gtp, nla, family); 1444 if (IS_ERR(sk0)) 1445 return PTR_ERR(sk0); 1446 1447 sk1u = gtp_create_sock(UDP_ENCAP_GTP1U, gtp, nla, family); 1448 if (IS_ERR(sk1u)) { 1449 udp_tunnel_sock_release(sk0->sk_socket); 1450 return PTR_ERR(sk1u); 1451 } 1452 1453 gtp->sk_created = true; 1454 gtp->sk0 = sk0; 1455 gtp->sk1u = sk1u; 1456 1457 return 0; 1458 } 1459 1460 #define GTP_TH_MAXLEN (sizeof(struct udphdr) + sizeof(struct gtp0_header)) 1461 #define GTP_IPV6_MAXLEN (sizeof(struct ipv6hdr) + GTP_TH_MAXLEN) 1462 1463 static int gtp_newlink(struct net *src_net, struct net_device *dev, 1464 struct nlattr *tb[], struct nlattr *data[], 1465 struct netlink_ext_ack *extack) 1466 { 1467 unsigned int role = GTP_ROLE_GGSN; 1468 struct gtp_dev *gtp; 1469 struct gtp_net *gn; 1470 int hashsize, err; 1471 1472 #if !IS_ENABLED(CONFIG_IPV6) 1473 if (data[IFLA_GTP_LOCAL6]) 1474 return -EAFNOSUPPORT; 1475 #endif 1476 1477 gtp = netdev_priv(dev); 1478 1479 if (!data[IFLA_GTP_PDP_HASHSIZE]) { 1480 hashsize = 1024; 1481 } else { 1482 hashsize = nla_get_u32(data[IFLA_GTP_PDP_HASHSIZE]); 1483 if (!hashsize) 1484 hashsize = 1024; 1485 } 1486 1487 if (data[IFLA_GTP_ROLE]) { 1488 role = nla_get_u32(data[IFLA_GTP_ROLE]); 1489 if (role > GTP_ROLE_SGSN) 1490 return -EINVAL; 1491 } 1492 gtp->role = role; 1493 1494 if (!data[IFLA_GTP_RESTART_COUNT]) 1495 gtp->restart_count = 0; 1496 else 1497 gtp->restart_count = nla_get_u8(data[IFLA_GTP_RESTART_COUNT]); 1498 1499 gtp->net = src_net; 1500 1501 err = gtp_hashtable_new(gtp, hashsize); 1502 if (err < 0) 1503 return err; 1504 1505 if (data[IFLA_GTP_CREATE_SOCKETS]) { 1506 if (data[IFLA_GTP_LOCAL6]) 1507 err = gtp_create_sockets(gtp, data[IFLA_GTP_LOCAL6], AF_INET6); 1508 else 1509 err = gtp_create_sockets(gtp, data[IFLA_GTP_LOCAL], AF_INET); 1510 } else { 1511 err = gtp_encap_enable(gtp, data); 1512 } 1513 1514 if (err < 0) 1515 goto out_hashtable; 1516 1517 if ((gtp->sk0 && gtp->sk0->sk_family == AF_INET6) || 1518 (gtp->sk1u && gtp->sk1u->sk_family == AF_INET6)) { 1519 dev->mtu = ETH_DATA_LEN - GTP_IPV6_MAXLEN; 1520 dev->needed_headroom = LL_MAX_HEADER + GTP_IPV6_MAXLEN; 1521 } 1522 1523 err = register_netdevice(dev); 1524 if (err < 0) { 1525 netdev_dbg(dev, "failed to register new netdev %d\n", err); 1526 goto out_encap; 1527 } 1528 1529 gn = net_generic(dev_net(dev), gtp_net_id); 1530 list_add_rcu(>p->list, &gn->gtp_dev_list); 1531 dev->priv_destructor = gtp_destructor; 1532 1533 netdev_dbg(dev, "registered new GTP interface\n"); 1534 1535 return 0; 1536 1537 out_encap: 1538 gtp_encap_disable(gtp); 1539 out_hashtable: 1540 kfree(gtp->addr_hash); 1541 kfree(gtp->tid_hash); 1542 return err; 1543 } 1544 1545 static void gtp_dellink(struct net_device *dev, struct list_head *head) 1546 { 1547 struct gtp_dev *gtp = netdev_priv(dev); 1548 struct hlist_node *next; 1549 struct pdp_ctx *pctx; 1550 int i; 1551 1552 for (i = 0; i < gtp->hash_size; i++) 1553 hlist_for_each_entry_safe(pctx, next, >p->tid_hash[i], hlist_tid) 1554 pdp_context_delete(pctx); 1555 1556 list_del_rcu(>p->list); 1557 unregister_netdevice_queue(dev, head); 1558 } 1559 1560 static const struct nla_policy gtp_policy[IFLA_GTP_MAX + 1] = { 1561 [IFLA_GTP_FD0] = { .type = NLA_U32 }, 1562 [IFLA_GTP_FD1] = { .type = NLA_U32 }, 1563 [IFLA_GTP_PDP_HASHSIZE] = { .type = NLA_U32 }, 1564 [IFLA_GTP_ROLE] = { .type = NLA_U32 }, 1565 [IFLA_GTP_CREATE_SOCKETS] = { .type = NLA_U8 }, 1566 [IFLA_GTP_RESTART_COUNT] = { .type = NLA_U8 }, 1567 [IFLA_GTP_LOCAL] = { .type = NLA_U32 }, 1568 [IFLA_GTP_LOCAL6] = { .len = sizeof(struct in6_addr) }, 1569 }; 1570 1571 static int gtp_validate(struct nlattr *tb[], struct nlattr *data[], 1572 struct netlink_ext_ack *extack) 1573 { 1574 if (!data) 1575 return -EINVAL; 1576 1577 return 0; 1578 } 1579 1580 static size_t gtp_get_size(const struct net_device *dev) 1581 { 1582 return nla_total_size(sizeof(__u32)) + /* IFLA_GTP_PDP_HASHSIZE */ 1583 nla_total_size(sizeof(__u32)) + /* IFLA_GTP_ROLE */ 1584 nla_total_size(sizeof(__u8)); /* IFLA_GTP_RESTART_COUNT */ 1585 } 1586 1587 static int gtp_fill_info(struct sk_buff *skb, const struct net_device *dev) 1588 { 1589 struct gtp_dev *gtp = netdev_priv(dev); 1590 1591 if (nla_put_u32(skb, IFLA_GTP_PDP_HASHSIZE, gtp->hash_size)) 1592 goto nla_put_failure; 1593 if (nla_put_u32(skb, IFLA_GTP_ROLE, gtp->role)) 1594 goto nla_put_failure; 1595 if (nla_put_u8(skb, IFLA_GTP_RESTART_COUNT, gtp->restart_count)) 1596 goto nla_put_failure; 1597 1598 return 0; 1599 1600 nla_put_failure: 1601 return -EMSGSIZE; 1602 } 1603 1604 static struct rtnl_link_ops gtp_link_ops __read_mostly = { 1605 .kind = "gtp", 1606 .maxtype = IFLA_GTP_MAX, 1607 .policy = gtp_policy, 1608 .priv_size = sizeof(struct gtp_dev), 1609 .setup = gtp_link_setup, 1610 .validate = gtp_validate, 1611 .newlink = gtp_newlink, 1612 .dellink = gtp_dellink, 1613 .get_size = gtp_get_size, 1614 .fill_info = gtp_fill_info, 1615 }; 1616 1617 static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize) 1618 { 1619 int i; 1620 1621 gtp->addr_hash = kmalloc_array(hsize, sizeof(struct hlist_head), 1622 GFP_KERNEL | __GFP_NOWARN); 1623 if (gtp->addr_hash == NULL) 1624 return -ENOMEM; 1625 1626 gtp->tid_hash = kmalloc_array(hsize, sizeof(struct hlist_head), 1627 GFP_KERNEL | __GFP_NOWARN); 1628 if (gtp->tid_hash == NULL) 1629 goto err1; 1630 1631 gtp->hash_size = hsize; 1632 1633 for (i = 0; i < hsize; i++) { 1634 INIT_HLIST_HEAD(>p->addr_hash[i]); 1635 INIT_HLIST_HEAD(>p->tid_hash[i]); 1636 } 1637 return 0; 1638 err1: 1639 kfree(gtp->addr_hash); 1640 return -ENOMEM; 1641 } 1642 1643 static struct sock *gtp_encap_enable_socket(int fd, int type, 1644 struct gtp_dev *gtp) 1645 { 1646 struct udp_tunnel_sock_cfg tuncfg = {NULL}; 1647 struct socket *sock; 1648 struct sock *sk; 1649 int err; 1650 1651 pr_debug("enable gtp on %d, %d\n", fd, type); 1652 1653 sock = sockfd_lookup(fd, &err); 1654 if (!sock) { 1655 pr_debug("gtp socket fd=%d not found\n", fd); 1656 return ERR_PTR(err); 1657 } 1658 1659 sk = sock->sk; 1660 if (sk->sk_protocol != IPPROTO_UDP || 1661 sk->sk_type != SOCK_DGRAM || 1662 (sk->sk_family != AF_INET && sk->sk_family != AF_INET6)) { 1663 pr_debug("socket fd=%d not UDP\n", fd); 1664 sk = ERR_PTR(-EINVAL); 1665 goto out_sock; 1666 } 1667 1668 if (sk->sk_family == AF_INET6 && 1669 !sk->sk_ipv6only) { 1670 sk = ERR_PTR(-EADDRNOTAVAIL); 1671 goto out_sock; 1672 } 1673 1674 lock_sock(sk); 1675 if (sk->sk_user_data) { 1676 sk = ERR_PTR(-EBUSY); 1677 goto out_rel_sock; 1678 } 1679 1680 sock_hold(sk); 1681 1682 tuncfg.sk_user_data = gtp; 1683 tuncfg.encap_type = type; 1684 tuncfg.encap_rcv = gtp_encap_recv; 1685 tuncfg.encap_destroy = gtp_encap_destroy; 1686 1687 setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg); 1688 1689 out_rel_sock: 1690 release_sock(sock->sk); 1691 out_sock: 1692 sockfd_put(sock); 1693 return sk; 1694 } 1695 1696 static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]) 1697 { 1698 struct sock *sk1u = NULL; 1699 struct sock *sk0 = NULL; 1700 1701 if (!data[IFLA_GTP_FD0] && !data[IFLA_GTP_FD1]) 1702 return -EINVAL; 1703 1704 if (data[IFLA_GTP_FD0]) { 1705 u32 fd0 = nla_get_u32(data[IFLA_GTP_FD0]); 1706 1707 sk0 = gtp_encap_enable_socket(fd0, UDP_ENCAP_GTP0, gtp); 1708 if (IS_ERR(sk0)) 1709 return PTR_ERR(sk0); 1710 } 1711 1712 if (data[IFLA_GTP_FD1]) { 1713 u32 fd1 = nla_get_u32(data[IFLA_GTP_FD1]); 1714 1715 sk1u = gtp_encap_enable_socket(fd1, UDP_ENCAP_GTP1U, gtp); 1716 if (IS_ERR(sk1u)) { 1717 gtp_encap_disable_sock(sk0); 1718 return PTR_ERR(sk1u); 1719 } 1720 } 1721 1722 gtp->sk0 = sk0; 1723 gtp->sk1u = sk1u; 1724 1725 if (sk0 && sk1u && 1726 sk0->sk_family != sk1u->sk_family) { 1727 gtp_encap_disable_sock(sk0); 1728 gtp_encap_disable_sock(sk1u); 1729 return -EINVAL; 1730 } 1731 1732 return 0; 1733 } 1734 1735 static struct gtp_dev *gtp_find_dev(struct net *src_net, struct nlattr *nla[]) 1736 { 1737 struct gtp_dev *gtp = NULL; 1738 struct net_device *dev; 1739 struct net *net; 1740 1741 /* Examine the link attributes and figure out which network namespace 1742 * we are talking about. 1743 */ 1744 if (nla[GTPA_NET_NS_FD]) 1745 net = get_net_ns_by_fd(nla_get_u32(nla[GTPA_NET_NS_FD])); 1746 else 1747 net = get_net(src_net); 1748 1749 if (IS_ERR(net)) 1750 return NULL; 1751 1752 /* Check if there's an existing gtpX device to configure */ 1753 dev = dev_get_by_index_rcu(net, nla_get_u32(nla[GTPA_LINK])); 1754 if (dev && dev->netdev_ops == >p_netdev_ops) 1755 gtp = netdev_priv(dev); 1756 1757 put_net(net); 1758 return gtp; 1759 } 1760 1761 static void gtp_pdp_fill(struct pdp_ctx *pctx, struct genl_info *info) 1762 { 1763 pctx->gtp_version = nla_get_u32(info->attrs[GTPA_VERSION]); 1764 1765 switch (pctx->gtp_version) { 1766 case GTP_V0: 1767 /* According to TS 09.60, sections 7.5.1 and 7.5.2, the flow 1768 * label needs to be the same for uplink and downlink packets, 1769 * so let's annotate this. 1770 */ 1771 pctx->u.v0.tid = nla_get_u64(info->attrs[GTPA_TID]); 1772 pctx->u.v0.flow = nla_get_u16(info->attrs[GTPA_FLOW]); 1773 break; 1774 case GTP_V1: 1775 pctx->u.v1.i_tei = nla_get_u32(info->attrs[GTPA_I_TEI]); 1776 pctx->u.v1.o_tei = nla_get_u32(info->attrs[GTPA_O_TEI]); 1777 break; 1778 default: 1779 break; 1780 } 1781 } 1782 1783 static void ip_pdp_peer_fill(struct pdp_ctx *pctx, struct genl_info *info) 1784 { 1785 if (info->attrs[GTPA_PEER_ADDRESS]) { 1786 pctx->peer.addr.s_addr = 1787 nla_get_be32(info->attrs[GTPA_PEER_ADDRESS]); 1788 } else if (info->attrs[GTPA_PEER_ADDR6]) { 1789 pctx->peer.addr6 = nla_get_in6_addr(info->attrs[GTPA_PEER_ADDR6]); 1790 } 1791 } 1792 1793 static void ipv4_pdp_fill(struct pdp_ctx *pctx, struct genl_info *info) 1794 { 1795 ip_pdp_peer_fill(pctx, info); 1796 pctx->ms.addr.s_addr = 1797 nla_get_be32(info->attrs[GTPA_MS_ADDRESS]); 1798 gtp_pdp_fill(pctx, info); 1799 } 1800 1801 static bool ipv6_pdp_fill(struct pdp_ctx *pctx, struct genl_info *info) 1802 { 1803 ip_pdp_peer_fill(pctx, info); 1804 pctx->ms.addr6 = nla_get_in6_addr(info->attrs[GTPA_MS_ADDR6]); 1805 if (pctx->ms.addr6.s6_addr32[2] || 1806 pctx->ms.addr6.s6_addr32[3]) 1807 return false; 1808 1809 gtp_pdp_fill(pctx, info); 1810 1811 return true; 1812 } 1813 1814 static struct pdp_ctx *gtp_pdp_add(struct gtp_dev *gtp, struct sock *sk, 1815 struct genl_info *info) 1816 { 1817 struct pdp_ctx *pctx, *pctx_tid = NULL; 1818 struct net_device *dev = gtp->dev; 1819 u32 hash_ms, hash_tid = 0; 1820 struct in6_addr ms_addr6; 1821 unsigned int version; 1822 bool found = false; 1823 __be32 ms_addr; 1824 int family; 1825 1826 version = nla_get_u32(info->attrs[GTPA_VERSION]); 1827 1828 if (info->attrs[GTPA_FAMILY]) 1829 family = nla_get_u8(info->attrs[GTPA_FAMILY]); 1830 else 1831 family = AF_INET; 1832 1833 #if !IS_ENABLED(CONFIG_IPV6) 1834 if (family == AF_INET6) 1835 return ERR_PTR(-EAFNOSUPPORT); 1836 #endif 1837 if (!info->attrs[GTPA_PEER_ADDRESS] && 1838 !info->attrs[GTPA_PEER_ADDR6]) 1839 return ERR_PTR(-EINVAL); 1840 1841 if ((info->attrs[GTPA_PEER_ADDRESS] && 1842 sk->sk_family == AF_INET6) || 1843 (info->attrs[GTPA_PEER_ADDR6] && 1844 sk->sk_family == AF_INET)) 1845 return ERR_PTR(-EAFNOSUPPORT); 1846 1847 switch (family) { 1848 case AF_INET: 1849 if (!info->attrs[GTPA_MS_ADDRESS] || 1850 info->attrs[GTPA_MS_ADDR6]) 1851 return ERR_PTR(-EINVAL); 1852 1853 ms_addr = nla_get_be32(info->attrs[GTPA_MS_ADDRESS]); 1854 hash_ms = ipv4_hashfn(ms_addr) % gtp->hash_size; 1855 pctx = ipv4_pdp_find(gtp, ms_addr); 1856 break; 1857 case AF_INET6: 1858 if (!info->attrs[GTPA_MS_ADDR6] || 1859 info->attrs[GTPA_MS_ADDRESS]) 1860 return ERR_PTR(-EINVAL); 1861 1862 ms_addr6 = nla_get_in6_addr(info->attrs[GTPA_MS_ADDR6]); 1863 hash_ms = ipv6_hashfn(&ms_addr6) % gtp->hash_size; 1864 pctx = ipv6_pdp_find(gtp, &ms_addr6); 1865 break; 1866 default: 1867 return ERR_PTR(-EAFNOSUPPORT); 1868 } 1869 if (pctx) 1870 found = true; 1871 if (version == GTP_V0) 1872 pctx_tid = gtp0_pdp_find(gtp, 1873 nla_get_u64(info->attrs[GTPA_TID]), 1874 family); 1875 else if (version == GTP_V1) 1876 pctx_tid = gtp1_pdp_find(gtp, 1877 nla_get_u32(info->attrs[GTPA_I_TEI]), 1878 family); 1879 if (pctx_tid) 1880 found = true; 1881 1882 if (found) { 1883 if (info->nlhdr->nlmsg_flags & NLM_F_EXCL) 1884 return ERR_PTR(-EEXIST); 1885 if (info->nlhdr->nlmsg_flags & NLM_F_REPLACE) 1886 return ERR_PTR(-EOPNOTSUPP); 1887 1888 if (pctx && pctx_tid) 1889 return ERR_PTR(-EEXIST); 1890 if (!pctx) 1891 pctx = pctx_tid; 1892 1893 switch (pctx->af) { 1894 case AF_INET: 1895 ipv4_pdp_fill(pctx, info); 1896 break; 1897 case AF_INET6: 1898 if (!ipv6_pdp_fill(pctx, info)) 1899 return ERR_PTR(-EADDRNOTAVAIL); 1900 break; 1901 } 1902 1903 if (pctx->gtp_version == GTP_V0) 1904 netdev_dbg(dev, "GTPv0-U: update tunnel id = %llx (pdp %p)\n", 1905 pctx->u.v0.tid, pctx); 1906 else if (pctx->gtp_version == GTP_V1) 1907 netdev_dbg(dev, "GTPv1-U: update tunnel id = %x/%x (pdp %p)\n", 1908 pctx->u.v1.i_tei, pctx->u.v1.o_tei, pctx); 1909 1910 return pctx; 1911 1912 } 1913 1914 pctx = kmalloc(sizeof(*pctx), GFP_ATOMIC); 1915 if (pctx == NULL) 1916 return ERR_PTR(-ENOMEM); 1917 1918 sock_hold(sk); 1919 pctx->sk = sk; 1920 pctx->dev = gtp->dev; 1921 pctx->af = family; 1922 1923 switch (pctx->af) { 1924 case AF_INET: 1925 if (!info->attrs[GTPA_MS_ADDRESS]) { 1926 sock_put(sk); 1927 kfree(pctx); 1928 return ERR_PTR(-EINVAL); 1929 } 1930 1931 ipv4_pdp_fill(pctx, info); 1932 break; 1933 case AF_INET6: 1934 if (!info->attrs[GTPA_MS_ADDR6]) { 1935 sock_put(sk); 1936 kfree(pctx); 1937 return ERR_PTR(-EINVAL); 1938 } 1939 1940 if (!ipv6_pdp_fill(pctx, info)) { 1941 sock_put(sk); 1942 kfree(pctx); 1943 return ERR_PTR(-EADDRNOTAVAIL); 1944 } 1945 break; 1946 } 1947 atomic_set(&pctx->tx_seq, 0); 1948 1949 switch (pctx->gtp_version) { 1950 case GTP_V0: 1951 /* TS 09.60: "The flow label identifies unambiguously a GTP 1952 * flow.". We use the tid for this instead, I cannot find a 1953 * situation in which this doesn't unambiguosly identify the 1954 * PDP context. 1955 */ 1956 hash_tid = gtp0_hashfn(pctx->u.v0.tid) % gtp->hash_size; 1957 break; 1958 case GTP_V1: 1959 hash_tid = gtp1u_hashfn(pctx->u.v1.i_tei) % gtp->hash_size; 1960 break; 1961 } 1962 1963 hlist_add_head_rcu(&pctx->hlist_addr, >p->addr_hash[hash_ms]); 1964 hlist_add_head_rcu(&pctx->hlist_tid, >p->tid_hash[hash_tid]); 1965 1966 switch (pctx->gtp_version) { 1967 case GTP_V0: 1968 netdev_dbg(dev, "GTPv0-U: new PDP ctx id=%llx ssgn=%pI4 ms=%pI4 (pdp=%p)\n", 1969 pctx->u.v0.tid, &pctx->peer.addr, 1970 &pctx->ms.addr, pctx); 1971 break; 1972 case GTP_V1: 1973 netdev_dbg(dev, "GTPv1-U: new PDP ctx id=%x/%x ssgn=%pI4 ms=%pI4 (pdp=%p)\n", 1974 pctx->u.v1.i_tei, pctx->u.v1.o_tei, 1975 &pctx->peer.addr, &pctx->ms.addr, pctx); 1976 break; 1977 } 1978 1979 return pctx; 1980 } 1981 1982 static void pdp_context_free(struct rcu_head *head) 1983 { 1984 struct pdp_ctx *pctx = container_of(head, struct pdp_ctx, rcu_head); 1985 1986 sock_put(pctx->sk); 1987 kfree(pctx); 1988 } 1989 1990 static void pdp_context_delete(struct pdp_ctx *pctx) 1991 { 1992 hlist_del_rcu(&pctx->hlist_tid); 1993 hlist_del_rcu(&pctx->hlist_addr); 1994 call_rcu(&pctx->rcu_head, pdp_context_free); 1995 } 1996 1997 static int gtp_tunnel_notify(struct pdp_ctx *pctx, u8 cmd, gfp_t allocation); 1998 1999 static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info) 2000 { 2001 unsigned int version; 2002 struct pdp_ctx *pctx; 2003 struct gtp_dev *gtp; 2004 struct sock *sk; 2005 int err; 2006 2007 if (!info->attrs[GTPA_VERSION] || 2008 !info->attrs[GTPA_LINK]) 2009 return -EINVAL; 2010 2011 version = nla_get_u32(info->attrs[GTPA_VERSION]); 2012 2013 switch (version) { 2014 case GTP_V0: 2015 if (!info->attrs[GTPA_TID] || 2016 !info->attrs[GTPA_FLOW]) 2017 return -EINVAL; 2018 break; 2019 case GTP_V1: 2020 if (!info->attrs[GTPA_I_TEI] || 2021 !info->attrs[GTPA_O_TEI]) 2022 return -EINVAL; 2023 break; 2024 2025 default: 2026 return -EINVAL; 2027 } 2028 2029 rtnl_lock(); 2030 2031 gtp = gtp_find_dev(sock_net(skb->sk), info->attrs); 2032 if (!gtp) { 2033 err = -ENODEV; 2034 goto out_unlock; 2035 } 2036 2037 if (version == GTP_V0) 2038 sk = gtp->sk0; 2039 else if (version == GTP_V1) 2040 sk = gtp->sk1u; 2041 else 2042 sk = NULL; 2043 2044 if (!sk) { 2045 err = -ENODEV; 2046 goto out_unlock; 2047 } 2048 2049 pctx = gtp_pdp_add(gtp, sk, info); 2050 if (IS_ERR(pctx)) { 2051 err = PTR_ERR(pctx); 2052 } else { 2053 gtp_tunnel_notify(pctx, GTP_CMD_NEWPDP, GFP_KERNEL); 2054 err = 0; 2055 } 2056 2057 out_unlock: 2058 rtnl_unlock(); 2059 return err; 2060 } 2061 2062 static struct pdp_ctx *gtp_find_pdp_by_link(struct net *net, 2063 struct nlattr *nla[]) 2064 { 2065 struct gtp_dev *gtp; 2066 int family; 2067 2068 if (nla[GTPA_FAMILY]) 2069 family = nla_get_u8(nla[GTPA_FAMILY]); 2070 else 2071 family = AF_INET; 2072 2073 gtp = gtp_find_dev(net, nla); 2074 if (!gtp) 2075 return ERR_PTR(-ENODEV); 2076 2077 if (nla[GTPA_MS_ADDRESS]) { 2078 __be32 ip = nla_get_be32(nla[GTPA_MS_ADDRESS]); 2079 2080 if (family != AF_INET) 2081 return ERR_PTR(-EINVAL); 2082 2083 return ipv4_pdp_find(gtp, ip); 2084 } else if (nla[GTPA_MS_ADDR6]) { 2085 struct in6_addr addr = nla_get_in6_addr(nla[GTPA_MS_ADDR6]); 2086 2087 if (family != AF_INET6) 2088 return ERR_PTR(-EINVAL); 2089 2090 if (addr.s6_addr32[2] || 2091 addr.s6_addr32[3]) 2092 return ERR_PTR(-EADDRNOTAVAIL); 2093 2094 return ipv6_pdp_find(gtp, &addr); 2095 } else if (nla[GTPA_VERSION]) { 2096 u32 gtp_version = nla_get_u32(nla[GTPA_VERSION]); 2097 2098 if (gtp_version == GTP_V0 && nla[GTPA_TID]) { 2099 return gtp0_pdp_find(gtp, nla_get_u64(nla[GTPA_TID]), 2100 family); 2101 } else if (gtp_version == GTP_V1 && nla[GTPA_I_TEI]) { 2102 return gtp1_pdp_find(gtp, nla_get_u32(nla[GTPA_I_TEI]), 2103 family); 2104 } 2105 } 2106 2107 return ERR_PTR(-EINVAL); 2108 } 2109 2110 static struct pdp_ctx *gtp_find_pdp(struct net *net, struct nlattr *nla[]) 2111 { 2112 struct pdp_ctx *pctx; 2113 2114 if (nla[GTPA_LINK]) 2115 pctx = gtp_find_pdp_by_link(net, nla); 2116 else 2117 pctx = ERR_PTR(-EINVAL); 2118 2119 if (!pctx) 2120 pctx = ERR_PTR(-ENOENT); 2121 2122 return pctx; 2123 } 2124 2125 static int gtp_genl_del_pdp(struct sk_buff *skb, struct genl_info *info) 2126 { 2127 struct pdp_ctx *pctx; 2128 int err = 0; 2129 2130 if (!info->attrs[GTPA_VERSION]) 2131 return -EINVAL; 2132 2133 rcu_read_lock(); 2134 2135 pctx = gtp_find_pdp(sock_net(skb->sk), info->attrs); 2136 if (IS_ERR(pctx)) { 2137 err = PTR_ERR(pctx); 2138 goto out_unlock; 2139 } 2140 2141 if (pctx->gtp_version == GTP_V0) 2142 netdev_dbg(pctx->dev, "GTPv0-U: deleting tunnel id = %llx (pdp %p)\n", 2143 pctx->u.v0.tid, pctx); 2144 else if (pctx->gtp_version == GTP_V1) 2145 netdev_dbg(pctx->dev, "GTPv1-U: deleting tunnel id = %x/%x (pdp %p)\n", 2146 pctx->u.v1.i_tei, pctx->u.v1.o_tei, pctx); 2147 2148 gtp_tunnel_notify(pctx, GTP_CMD_DELPDP, GFP_ATOMIC); 2149 pdp_context_delete(pctx); 2150 2151 out_unlock: 2152 rcu_read_unlock(); 2153 return err; 2154 } 2155 2156 static int gtp_genl_fill_info(struct sk_buff *skb, u32 snd_portid, u32 snd_seq, 2157 int flags, u32 type, struct pdp_ctx *pctx) 2158 { 2159 void *genlh; 2160 2161 genlh = genlmsg_put(skb, snd_portid, snd_seq, >p_genl_family, flags, 2162 type); 2163 if (genlh == NULL) 2164 goto nlmsg_failure; 2165 2166 if (nla_put_u32(skb, GTPA_VERSION, pctx->gtp_version) || 2167 nla_put_u32(skb, GTPA_LINK, pctx->dev->ifindex) || 2168 nla_put_u8(skb, GTPA_FAMILY, pctx->af)) 2169 goto nla_put_failure; 2170 2171 switch (pctx->af) { 2172 case AF_INET: 2173 if (nla_put_be32(skb, GTPA_MS_ADDRESS, pctx->ms.addr.s_addr)) 2174 goto nla_put_failure; 2175 break; 2176 case AF_INET6: 2177 if (nla_put_in6_addr(skb, GTPA_MS_ADDR6, &pctx->ms.addr6)) 2178 goto nla_put_failure; 2179 break; 2180 } 2181 2182 switch (pctx->sk->sk_family) { 2183 case AF_INET: 2184 if (nla_put_be32(skb, GTPA_PEER_ADDRESS, pctx->peer.addr.s_addr)) 2185 goto nla_put_failure; 2186 break; 2187 case AF_INET6: 2188 if (nla_put_in6_addr(skb, GTPA_PEER_ADDR6, &pctx->peer.addr6)) 2189 goto nla_put_failure; 2190 break; 2191 } 2192 2193 switch (pctx->gtp_version) { 2194 case GTP_V0: 2195 if (nla_put_u64_64bit(skb, GTPA_TID, pctx->u.v0.tid, GTPA_PAD) || 2196 nla_put_u16(skb, GTPA_FLOW, pctx->u.v0.flow)) 2197 goto nla_put_failure; 2198 break; 2199 case GTP_V1: 2200 if (nla_put_u32(skb, GTPA_I_TEI, pctx->u.v1.i_tei) || 2201 nla_put_u32(skb, GTPA_O_TEI, pctx->u.v1.o_tei)) 2202 goto nla_put_failure; 2203 break; 2204 } 2205 genlmsg_end(skb, genlh); 2206 return 0; 2207 2208 nlmsg_failure: 2209 nla_put_failure: 2210 genlmsg_cancel(skb, genlh); 2211 return -EMSGSIZE; 2212 } 2213 2214 static int gtp_tunnel_notify(struct pdp_ctx *pctx, u8 cmd, gfp_t allocation) 2215 { 2216 struct sk_buff *msg; 2217 int ret; 2218 2219 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, allocation); 2220 if (!msg) 2221 return -ENOMEM; 2222 2223 ret = gtp_genl_fill_info(msg, 0, 0, 0, cmd, pctx); 2224 if (ret < 0) { 2225 nlmsg_free(msg); 2226 return ret; 2227 } 2228 2229 ret = genlmsg_multicast_netns(>p_genl_family, dev_net(pctx->dev), msg, 2230 0, GTP_GENL_MCGRP, GFP_ATOMIC); 2231 return ret; 2232 } 2233 2234 static int gtp_genl_get_pdp(struct sk_buff *skb, struct genl_info *info) 2235 { 2236 struct pdp_ctx *pctx = NULL; 2237 struct sk_buff *skb2; 2238 int err; 2239 2240 if (!info->attrs[GTPA_VERSION]) 2241 return -EINVAL; 2242 2243 rcu_read_lock(); 2244 2245 pctx = gtp_find_pdp(sock_net(skb->sk), info->attrs); 2246 if (IS_ERR(pctx)) { 2247 err = PTR_ERR(pctx); 2248 goto err_unlock; 2249 } 2250 2251 skb2 = genlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC); 2252 if (skb2 == NULL) { 2253 err = -ENOMEM; 2254 goto err_unlock; 2255 } 2256 2257 err = gtp_genl_fill_info(skb2, NETLINK_CB(skb).portid, info->snd_seq, 2258 0, info->nlhdr->nlmsg_type, pctx); 2259 if (err < 0) 2260 goto err_unlock_free; 2261 2262 rcu_read_unlock(); 2263 return genlmsg_unicast(genl_info_net(info), skb2, info->snd_portid); 2264 2265 err_unlock_free: 2266 kfree_skb(skb2); 2267 err_unlock: 2268 rcu_read_unlock(); 2269 return err; 2270 } 2271 2272 static int gtp_genl_dump_pdp(struct sk_buff *skb, 2273 struct netlink_callback *cb) 2274 { 2275 struct gtp_dev *last_gtp = (struct gtp_dev *)cb->args[2], *gtp; 2276 int i, j, bucket = cb->args[0], skip = cb->args[1]; 2277 struct net *net = sock_net(skb->sk); 2278 struct pdp_ctx *pctx; 2279 struct gtp_net *gn; 2280 2281 gn = net_generic(net, gtp_net_id); 2282 2283 if (cb->args[4]) 2284 return 0; 2285 2286 rcu_read_lock(); 2287 list_for_each_entry_rcu(gtp, &gn->gtp_dev_list, list) { 2288 if (last_gtp && last_gtp != gtp) 2289 continue; 2290 else 2291 last_gtp = NULL; 2292 2293 for (i = bucket; i < gtp->hash_size; i++) { 2294 j = 0; 2295 hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], 2296 hlist_tid) { 2297 if (j >= skip && 2298 gtp_genl_fill_info(skb, 2299 NETLINK_CB(cb->skb).portid, 2300 cb->nlh->nlmsg_seq, 2301 NLM_F_MULTI, 2302 cb->nlh->nlmsg_type, pctx)) { 2303 cb->args[0] = i; 2304 cb->args[1] = j; 2305 cb->args[2] = (unsigned long)gtp; 2306 goto out; 2307 } 2308 j++; 2309 } 2310 skip = 0; 2311 } 2312 bucket = 0; 2313 } 2314 cb->args[4] = 1; 2315 out: 2316 rcu_read_unlock(); 2317 return skb->len; 2318 } 2319 2320 static int gtp_genl_send_echo_req(struct sk_buff *skb, struct genl_info *info) 2321 { 2322 struct sk_buff *skb_to_send; 2323 __be32 src_ip, dst_ip; 2324 unsigned int version; 2325 struct gtp_dev *gtp; 2326 struct flowi4 fl4; 2327 struct rtable *rt; 2328 struct sock *sk; 2329 __be16 port; 2330 int len; 2331 2332 if (!info->attrs[GTPA_VERSION] || 2333 !info->attrs[GTPA_LINK] || 2334 !info->attrs[GTPA_PEER_ADDRESS] || 2335 !info->attrs[GTPA_MS_ADDRESS]) 2336 return -EINVAL; 2337 2338 version = nla_get_u32(info->attrs[GTPA_VERSION]); 2339 dst_ip = nla_get_be32(info->attrs[GTPA_PEER_ADDRESS]); 2340 src_ip = nla_get_be32(info->attrs[GTPA_MS_ADDRESS]); 2341 2342 gtp = gtp_find_dev(sock_net(skb->sk), info->attrs); 2343 if (!gtp) 2344 return -ENODEV; 2345 2346 if (!gtp->sk_created) 2347 return -EOPNOTSUPP; 2348 if (!(gtp->dev->flags & IFF_UP)) 2349 return -ENETDOWN; 2350 2351 if (version == GTP_V0) { 2352 struct gtp0_header *gtp0_h; 2353 2354 len = LL_RESERVED_SPACE(gtp->dev) + sizeof(struct gtp0_header) + 2355 sizeof(struct iphdr) + sizeof(struct udphdr); 2356 2357 skb_to_send = netdev_alloc_skb_ip_align(gtp->dev, len); 2358 if (!skb_to_send) 2359 return -ENOMEM; 2360 2361 sk = gtp->sk0; 2362 port = htons(GTP0_PORT); 2363 2364 gtp0_h = skb_push(skb_to_send, sizeof(struct gtp0_header)); 2365 memset(gtp0_h, 0, sizeof(struct gtp0_header)); 2366 gtp0_build_echo_msg(gtp0_h, GTP_ECHO_REQ); 2367 } else if (version == GTP_V1) { 2368 struct gtp1_header_long *gtp1u_h; 2369 2370 len = LL_RESERVED_SPACE(gtp->dev) + 2371 sizeof(struct gtp1_header_long) + 2372 sizeof(struct iphdr) + sizeof(struct udphdr); 2373 2374 skb_to_send = netdev_alloc_skb_ip_align(gtp->dev, len); 2375 if (!skb_to_send) 2376 return -ENOMEM; 2377 2378 sk = gtp->sk1u; 2379 port = htons(GTP1U_PORT); 2380 2381 gtp1u_h = skb_push(skb_to_send, 2382 sizeof(struct gtp1_header_long)); 2383 memset(gtp1u_h, 0, sizeof(struct gtp1_header_long)); 2384 gtp1u_build_echo_msg(gtp1u_h, GTP_ECHO_REQ); 2385 } else { 2386 return -ENODEV; 2387 } 2388 2389 rt = ip4_route_output_gtp(&fl4, sk, dst_ip, src_ip); 2390 if (IS_ERR(rt)) { 2391 netdev_dbg(gtp->dev, "no route for echo request to %pI4\n", 2392 &dst_ip); 2393 kfree_skb(skb_to_send); 2394 return -ENODEV; 2395 } 2396 2397 udp_tunnel_xmit_skb(rt, sk, skb_to_send, 2398 fl4.saddr, fl4.daddr, 2399 fl4.flowi4_tos, 2400 ip4_dst_hoplimit(&rt->dst), 2401 0, 2402 port, port, 2403 !net_eq(sock_net(sk), 2404 dev_net(gtp->dev)), 2405 false); 2406 return 0; 2407 } 2408 2409 static const struct nla_policy gtp_genl_policy[GTPA_MAX + 1] = { 2410 [GTPA_LINK] = { .type = NLA_U32, }, 2411 [GTPA_VERSION] = { .type = NLA_U32, }, 2412 [GTPA_TID] = { .type = NLA_U64, }, 2413 [GTPA_PEER_ADDRESS] = { .type = NLA_U32, }, 2414 [GTPA_MS_ADDRESS] = { .type = NLA_U32, }, 2415 [GTPA_FLOW] = { .type = NLA_U16, }, 2416 [GTPA_NET_NS_FD] = { .type = NLA_U32, }, 2417 [GTPA_I_TEI] = { .type = NLA_U32, }, 2418 [GTPA_O_TEI] = { .type = NLA_U32, }, 2419 [GTPA_PEER_ADDR6] = { .len = sizeof(struct in6_addr), }, 2420 [GTPA_MS_ADDR6] = { .len = sizeof(struct in6_addr), }, 2421 [GTPA_FAMILY] = { .type = NLA_U8, }, 2422 }; 2423 2424 static const struct genl_small_ops gtp_genl_ops[] = { 2425 { 2426 .cmd = GTP_CMD_NEWPDP, 2427 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2428 .doit = gtp_genl_new_pdp, 2429 .flags = GENL_ADMIN_PERM, 2430 }, 2431 { 2432 .cmd = GTP_CMD_DELPDP, 2433 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2434 .doit = gtp_genl_del_pdp, 2435 .flags = GENL_ADMIN_PERM, 2436 }, 2437 { 2438 .cmd = GTP_CMD_GETPDP, 2439 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2440 .doit = gtp_genl_get_pdp, 2441 .dumpit = gtp_genl_dump_pdp, 2442 .flags = GENL_ADMIN_PERM, 2443 }, 2444 { 2445 .cmd = GTP_CMD_ECHOREQ, 2446 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 2447 .doit = gtp_genl_send_echo_req, 2448 .flags = GENL_ADMIN_PERM, 2449 }, 2450 }; 2451 2452 static struct genl_family gtp_genl_family __ro_after_init = { 2453 .name = "gtp", 2454 .version = 0, 2455 .hdrsize = 0, 2456 .maxattr = GTPA_MAX, 2457 .policy = gtp_genl_policy, 2458 .netnsok = true, 2459 .module = THIS_MODULE, 2460 .small_ops = gtp_genl_ops, 2461 .n_small_ops = ARRAY_SIZE(gtp_genl_ops), 2462 .resv_start_op = GTP_CMD_ECHOREQ + 1, 2463 .mcgrps = gtp_genl_mcgrps, 2464 .n_mcgrps = ARRAY_SIZE(gtp_genl_mcgrps), 2465 }; 2466 2467 static int __net_init gtp_net_init(struct net *net) 2468 { 2469 struct gtp_net *gn = net_generic(net, gtp_net_id); 2470 2471 INIT_LIST_HEAD(&gn->gtp_dev_list); 2472 return 0; 2473 } 2474 2475 static void __net_exit gtp_net_exit_batch_rtnl(struct list_head *net_list, 2476 struct list_head *dev_to_kill) 2477 { 2478 struct net *net; 2479 2480 list_for_each_entry(net, net_list, exit_list) { 2481 struct gtp_net *gn = net_generic(net, gtp_net_id); 2482 struct gtp_dev *gtp; 2483 2484 list_for_each_entry(gtp, &gn->gtp_dev_list, list) 2485 gtp_dellink(gtp->dev, dev_to_kill); 2486 } 2487 } 2488 2489 static struct pernet_operations gtp_net_ops = { 2490 .init = gtp_net_init, 2491 .exit_batch_rtnl = gtp_net_exit_batch_rtnl, 2492 .id = >p_net_id, 2493 .size = sizeof(struct gtp_net), 2494 }; 2495 2496 static int __init gtp_init(void) 2497 { 2498 int err; 2499 2500 get_random_bytes(>p_h_initval, sizeof(gtp_h_initval)); 2501 2502 err = register_pernet_subsys(>p_net_ops); 2503 if (err < 0) 2504 goto error_out; 2505 2506 err = rtnl_link_register(>p_link_ops); 2507 if (err < 0) 2508 goto unreg_pernet_subsys; 2509 2510 err = genl_register_family(>p_genl_family); 2511 if (err < 0) 2512 goto unreg_rtnl_link; 2513 2514 pr_info("GTP module loaded (pdp ctx size %zd bytes)\n", 2515 sizeof(struct pdp_ctx)); 2516 return 0; 2517 2518 unreg_rtnl_link: 2519 rtnl_link_unregister(>p_link_ops); 2520 unreg_pernet_subsys: 2521 unregister_pernet_subsys(>p_net_ops); 2522 error_out: 2523 pr_err("error loading GTP module loaded\n"); 2524 return err; 2525 } 2526 late_initcall(gtp_init); 2527 2528 static void __exit gtp_fini(void) 2529 { 2530 genl_unregister_family(>p_genl_family); 2531 rtnl_link_unregister(>p_link_ops); 2532 unregister_pernet_subsys(>p_net_ops); 2533 2534 pr_info("GTP module unloaded\n"); 2535 } 2536 module_exit(gtp_fini); 2537 2538 MODULE_LICENSE("GPL"); 2539 MODULE_AUTHOR("Harald Welte <hwelte@sysmocom.de>"); 2540 MODULE_DESCRIPTION("Interface driver for GTP encapsulated traffic"); 2541 MODULE_ALIAS_RTNL_LINK("gtp"); 2542 MODULE_ALIAS_GENL_FAMILY("gtp"); 2543