Linux Audio

Check our new training course

Loading...
v4.17
 
   1/* GTP according to GSM TS 09.60 / 3GPP TS 29.060
   2 *
   3 * (C) 2012-2014 by sysmocom - s.f.m.c. GmbH
   4 * (C) 2016 by Pablo Neira Ayuso <pablo@netfilter.org>
   5 *
   6 * Author: Harald Welte <hwelte@sysmocom.de>
   7 *	   Pablo Neira Ayuso <pablo@netfilter.org>
   8 *	   Andreas Schultz <aschultz@travelping.com>
   9 *
  10 * This program is free software; you can redistribute it and/or
  11 * modify it under the terms of the GNU General Public License
  12 * as published by the Free Software Foundation; either version
  13 * 2 of the License, or (at your option) any later version.
  14 */
  15
  16#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  17
  18#include <linux/module.h>
  19#include <linux/skbuff.h>
  20#include <linux/udp.h>
  21#include <linux/rculist.h>
  22#include <linux/jhash.h>
  23#include <linux/if_tunnel.h>
  24#include <linux/net.h>
  25#include <linux/file.h>
  26#include <linux/gtp.h>
  27
  28#include <net/net_namespace.h>
  29#include <net/protocol.h>
  30#include <net/ip.h>
  31#include <net/udp.h>
  32#include <net/udp_tunnel.h>
  33#include <net/icmp.h>
  34#include <net/xfrm.h>
  35#include <net/genetlink.h>
  36#include <net/netns/generic.h>
  37#include <net/gtp.h>
  38
  39/* An active session for the subscriber. */
  40struct pdp_ctx {
  41	struct hlist_node	hlist_tid;
  42	struct hlist_node	hlist_addr;
  43
  44	union {
  45		u64		tid;
  46		struct {
  47			u64	tid;
  48			u16	flow;
  49		} v0;
  50		struct {
  51			u32	i_tei;
  52			u32	o_tei;
  53		} v1;
  54	} u;
  55	u8			gtp_version;
  56	u16			af;
  57
  58	struct in_addr		ms_addr_ip4;
  59	struct in_addr		peer_addr_ip4;
  60
  61	struct sock		*sk;
  62	struct net_device       *dev;
  63
  64	atomic_t		tx_seq;
  65	struct rcu_head		rcu_head;
  66};
  67
  68/* One instance of the GTP device. */
  69struct gtp_dev {
  70	struct list_head	list;
  71
  72	struct sock		*sk0;
  73	struct sock		*sk1u;
  74
  75	struct net_device	*dev;
  76
  77	unsigned int		role;
  78	unsigned int		hash_size;
  79	struct hlist_head	*tid_hash;
  80	struct hlist_head	*addr_hash;
  81};
  82
  83static unsigned int gtp_net_id __read_mostly;
  84
  85struct gtp_net {
  86	struct list_head gtp_dev_list;
  87};
  88
  89static u32 gtp_h_initval;
  90
  91static void pdp_context_delete(struct pdp_ctx *pctx);
  92
  93static inline u32 gtp0_hashfn(u64 tid)
  94{
  95	u32 *tid32 = (u32 *) &tid;
  96	return jhash_2words(tid32[0], tid32[1], gtp_h_initval);
  97}
  98
  99static inline u32 gtp1u_hashfn(u32 tid)
 100{
 101	return jhash_1word(tid, gtp_h_initval);
 102}
 103
 104static inline u32 ipv4_hashfn(__be32 ip)
 105{
 106	return jhash_1word((__force u32)ip, gtp_h_initval);
 107}
 108
 109/* Resolve a PDP context structure based on the 64bit TID. */
 110static struct pdp_ctx *gtp0_pdp_find(struct gtp_dev *gtp, u64 tid)
 111{
 112	struct hlist_head *head;
 113	struct pdp_ctx *pdp;
 114
 115	head = &gtp->tid_hash[gtp0_hashfn(tid) % gtp->hash_size];
 116
 117	hlist_for_each_entry_rcu(pdp, head, hlist_tid) {
 118		if (pdp->gtp_version == GTP_V0 &&
 119		    pdp->u.v0.tid == tid)
 120			return pdp;
 121	}
 122	return NULL;
 123}
 124
 125/* Resolve a PDP context structure based on the 32bit TEI. */
 126static struct pdp_ctx *gtp1_pdp_find(struct gtp_dev *gtp, u32 tid)
 127{
 128	struct hlist_head *head;
 129	struct pdp_ctx *pdp;
 130
 131	head = &gtp->tid_hash[gtp1u_hashfn(tid) % gtp->hash_size];
 132
 133	hlist_for_each_entry_rcu(pdp, head, hlist_tid) {
 134		if (pdp->gtp_version == GTP_V1 &&
 135		    pdp->u.v1.i_tei == tid)
 136			return pdp;
 137	}
 138	return NULL;
 139}
 140
 141/* Resolve a PDP context based on IPv4 address of MS. */
 142static struct pdp_ctx *ipv4_pdp_find(struct gtp_dev *gtp, __be32 ms_addr)
 143{
 144	struct hlist_head *head;
 145	struct pdp_ctx *pdp;
 146
 147	head = &gtp->addr_hash[ipv4_hashfn(ms_addr) % gtp->hash_size];
 148
 149	hlist_for_each_entry_rcu(pdp, head, hlist_addr) {
 150		if (pdp->af == AF_INET &&
 151		    pdp->ms_addr_ip4.s_addr == ms_addr)
 152			return pdp;
 153	}
 154
 155	return NULL;
 156}
 157
 158static bool gtp_check_ms_ipv4(struct sk_buff *skb, struct pdp_ctx *pctx,
 159				  unsigned int hdrlen, unsigned int role)
 160{
 161	struct iphdr *iph;
 162
 163	if (!pskb_may_pull(skb, hdrlen + sizeof(struct iphdr)))
 164		return false;
 165
 166	iph = (struct iphdr *)(skb->data + hdrlen);
 167
 168	if (role == GTP_ROLE_SGSN)
 169		return iph->daddr == pctx->ms_addr_ip4.s_addr;
 170	else
 171		return iph->saddr == pctx->ms_addr_ip4.s_addr;
 172}
 173
 174/* Check if the inner IP address in this packet is assigned to any
 175 * existing mobile subscriber.
 176 */
 177static bool gtp_check_ms(struct sk_buff *skb, struct pdp_ctx *pctx,
 178			     unsigned int hdrlen, unsigned int role)
 179{
 180	switch (ntohs(skb->protocol)) {
 181	case ETH_P_IP:
 182		return gtp_check_ms_ipv4(skb, pctx, hdrlen, role);
 183	}
 184	return false;
 185}
 186
 187static int gtp_rx(struct pdp_ctx *pctx, struct sk_buff *skb,
 188			unsigned int hdrlen, unsigned int role)
 189{
 190	struct pcpu_sw_netstats *stats;
 191
 192	if (!gtp_check_ms(skb, pctx, hdrlen, role)) {
 193		netdev_dbg(pctx->dev, "No PDP ctx for this MS\n");
 194		return 1;
 195	}
 196
 197	/* Get rid of the GTP + UDP headers. */
 198	if (iptunnel_pull_header(skb, hdrlen, skb->protocol,
 199				 !net_eq(sock_net(pctx->sk), dev_net(pctx->dev))))
 200		return -1;
 201
 202	netdev_dbg(pctx->dev, "forwarding packet from GGSN to uplink\n");
 203
 204	/* Now that the UDP and the GTP header have been removed, set up the
 205	 * new network header. This is required by the upper layer to
 206	 * calculate the transport header.
 207	 */
 208	skb_reset_network_header(skb);
 209
 210	skb->dev = pctx->dev;
 211
 212	stats = this_cpu_ptr(pctx->dev->tstats);
 213	u64_stats_update_begin(&stats->syncp);
 214	stats->rx_packets++;
 215	stats->rx_bytes += skb->len;
 216	u64_stats_update_end(&stats->syncp);
 217
 218	netif_rx(skb);
 219	return 0;
 220}
 221
 222/* 1 means pass up to the stack, -1 means drop and 0 means decapsulated. */
 223static int gtp0_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb)
 224{
 225	unsigned int hdrlen = sizeof(struct udphdr) +
 226			      sizeof(struct gtp0_header);
 227	struct gtp0_header *gtp0;
 228	struct pdp_ctx *pctx;
 229
 230	if (!pskb_may_pull(skb, hdrlen))
 231		return -1;
 232
 233	gtp0 = (struct gtp0_header *)(skb->data + sizeof(struct udphdr));
 234
 235	if ((gtp0->flags >> 5) != GTP_V0)
 236		return 1;
 237
 238	if (gtp0->type != GTP_TPDU)
 239		return 1;
 240
 241	pctx = gtp0_pdp_find(gtp, be64_to_cpu(gtp0->tid));
 242	if (!pctx) {
 243		netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb);
 244		return 1;
 245	}
 246
 247	return gtp_rx(pctx, skb, hdrlen, gtp->role);
 248}
 249
 250static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb)
 251{
 252	unsigned int hdrlen = sizeof(struct udphdr) +
 253			      sizeof(struct gtp1_header);
 254	struct gtp1_header *gtp1;
 255	struct pdp_ctx *pctx;
 256
 257	if (!pskb_may_pull(skb, hdrlen))
 258		return -1;
 259
 260	gtp1 = (struct gtp1_header *)(skb->data + sizeof(struct udphdr));
 261
 262	if ((gtp1->flags >> 5) != GTP_V1)
 263		return 1;
 264
 265	if (gtp1->type != GTP_TPDU)
 266		return 1;
 267
 268	/* From 29.060: "This field shall be present if and only if any one or
 269	 * more of the S, PN and E flags are set.".
 270	 *
 271	 * If any of the bit is set, then the remaining ones also have to be
 272	 * set.
 273	 */
 274	if (gtp1->flags & GTP1_F_MASK)
 275		hdrlen += 4;
 276
 277	/* Make sure the header is larger enough, including extensions. */
 278	if (!pskb_may_pull(skb, hdrlen))
 279		return -1;
 280
 281	gtp1 = (struct gtp1_header *)(skb->data + sizeof(struct udphdr));
 282
 283	pctx = gtp1_pdp_find(gtp, ntohl(gtp1->tid));
 284	if (!pctx) {
 285		netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb);
 286		return 1;
 287	}
 288
 289	return gtp_rx(pctx, skb, hdrlen, gtp->role);
 290}
 291
 292static void gtp_encap_destroy(struct sock *sk)
 293{
 294	struct gtp_dev *gtp;
 295
 296	gtp = rcu_dereference_sk_user_data(sk);
 
 297	if (gtp) {
 
 
 
 
 298		udp_sk(sk)->encap_type = 0;
 299		rcu_assign_sk_user_data(sk, NULL);
 300		sock_put(sk);
 301	}
 
 
 
 
 
 
 
 
 302}
 303
 304static void gtp_encap_disable_sock(struct sock *sk)
 305{
 306	if (!sk)
 307		return;
 308
 309	gtp_encap_destroy(sk);
 310}
 311
 312static void gtp_encap_disable(struct gtp_dev *gtp)
 313{
 314	gtp_encap_disable_sock(gtp->sk0);
 315	gtp_encap_disable_sock(gtp->sk1u);
 316}
 317
 318/* UDP encapsulation receive handler. See net/ipv4/udp.c.
 319 * Return codes: 0: success, <0: error, >0: pass up to userspace UDP socket.
 320 */
 321static int gtp_encap_recv(struct sock *sk, struct sk_buff *skb)
 322{
 323	struct gtp_dev *gtp;
 324	int ret = 0;
 325
 326	gtp = rcu_dereference_sk_user_data(sk);
 327	if (!gtp)
 328		return 1;
 329
 330	netdev_dbg(gtp->dev, "encap_recv sk=%p\n", sk);
 331
 332	switch (udp_sk(sk)->encap_type) {
 333	case UDP_ENCAP_GTP0:
 334		netdev_dbg(gtp->dev, "received GTP0 packet\n");
 335		ret = gtp0_udp_encap_recv(gtp, skb);
 336		break;
 337	case UDP_ENCAP_GTP1U:
 338		netdev_dbg(gtp->dev, "received GTP1U packet\n");
 339		ret = gtp1u_udp_encap_recv(gtp, skb);
 340		break;
 341	default:
 342		ret = -1; /* Shouldn't happen. */
 343	}
 344
 345	switch (ret) {
 346	case 1:
 347		netdev_dbg(gtp->dev, "pass up to the process\n");
 348		break;
 349	case 0:
 350		break;
 351	case -1:
 352		netdev_dbg(gtp->dev, "GTP packet has been dropped\n");
 353		kfree_skb(skb);
 354		ret = 0;
 355		break;
 356	}
 357
 358	return ret;
 359}
 360
 361static int gtp_dev_init(struct net_device *dev)
 362{
 363	struct gtp_dev *gtp = netdev_priv(dev);
 364
 365	gtp->dev = dev;
 366
 367	dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
 368	if (!dev->tstats)
 369		return -ENOMEM;
 370
 371	return 0;
 372}
 373
 374static void gtp_dev_uninit(struct net_device *dev)
 375{
 376	struct gtp_dev *gtp = netdev_priv(dev);
 377
 378	gtp_encap_disable(gtp);
 379	free_percpu(dev->tstats);
 380}
 381
 382static struct rtable *ip4_route_output_gtp(struct flowi4 *fl4,
 383					   const struct sock *sk,
 384					   __be32 daddr)
 385{
 386	memset(fl4, 0, sizeof(*fl4));
 387	fl4->flowi4_oif		= sk->sk_bound_dev_if;
 388	fl4->daddr		= daddr;
 389	fl4->saddr		= inet_sk(sk)->inet_saddr;
 390	fl4->flowi4_tos		= RT_CONN_FLAGS(sk);
 391	fl4->flowi4_proto	= sk->sk_protocol;
 392
 393	return ip_route_output_key(sock_net(sk), fl4);
 394}
 395
 396static inline void gtp0_push_header(struct sk_buff *skb, struct pdp_ctx *pctx)
 397{
 398	int payload_len = skb->len;
 399	struct gtp0_header *gtp0;
 400
 401	gtp0 = skb_push(skb, sizeof(*gtp0));
 402
 403	gtp0->flags	= 0x1e; /* v0, GTP-non-prime. */
 404	gtp0->type	= GTP_TPDU;
 405	gtp0->length	= htons(payload_len);
 406	gtp0->seq	= htons((atomic_inc_return(&pctx->tx_seq) - 1) % 0xffff);
 407	gtp0->flow	= htons(pctx->u.v0.flow);
 408	gtp0->number	= 0xff;
 409	gtp0->spare[0]	= gtp0->spare[1] = gtp0->spare[2] = 0xff;
 410	gtp0->tid	= cpu_to_be64(pctx->u.v0.tid);
 411}
 412
 413static inline void gtp1_push_header(struct sk_buff *skb, struct pdp_ctx *pctx)
 414{
 415	int payload_len = skb->len;
 416	struct gtp1_header *gtp1;
 417
 418	gtp1 = skb_push(skb, sizeof(*gtp1));
 419
 420	/* Bits    8  7  6  5  4  3  2	1
 421	 *	  +--+--+--+--+--+--+--+--+
 422	 *	  |version |PT| 0| E| S|PN|
 423	 *	  +--+--+--+--+--+--+--+--+
 424	 *	    0  0  1  1	1  0  0  0
 425	 */
 426	gtp1->flags	= 0x30; /* v1, GTP-non-prime. */
 427	gtp1->type	= GTP_TPDU;
 428	gtp1->length	= htons(payload_len);
 429	gtp1->tid	= htonl(pctx->u.v1.o_tei);
 430
 431	/* TODO: Suppport for extension header, sequence number and N-PDU.
 432	 *	 Update the length field if any of them is available.
 433	 */
 434}
 435
 436struct gtp_pktinfo {
 437	struct sock		*sk;
 438	struct iphdr		*iph;
 439	struct flowi4		fl4;
 440	struct rtable		*rt;
 441	struct pdp_ctx		*pctx;
 442	struct net_device	*dev;
 443	__be16			gtph_port;
 444};
 445
 446static void gtp_push_header(struct sk_buff *skb, struct gtp_pktinfo *pktinfo)
 447{
 448	switch (pktinfo->pctx->gtp_version) {
 449	case GTP_V0:
 450		pktinfo->gtph_port = htons(GTP0_PORT);
 451		gtp0_push_header(skb, pktinfo->pctx);
 452		break;
 453	case GTP_V1:
 454		pktinfo->gtph_port = htons(GTP1U_PORT);
 455		gtp1_push_header(skb, pktinfo->pctx);
 456		break;
 457	}
 458}
 459
 460static inline void gtp_set_pktinfo_ipv4(struct gtp_pktinfo *pktinfo,
 461					struct sock *sk, struct iphdr *iph,
 462					struct pdp_ctx *pctx, struct rtable *rt,
 463					struct flowi4 *fl4,
 464					struct net_device *dev)
 465{
 466	pktinfo->sk	= sk;
 467	pktinfo->iph	= iph;
 468	pktinfo->pctx	= pctx;
 469	pktinfo->rt	= rt;
 470	pktinfo->fl4	= *fl4;
 471	pktinfo->dev	= dev;
 472}
 473
 474static int gtp_build_skb_ip4(struct sk_buff *skb, struct net_device *dev,
 475			     struct gtp_pktinfo *pktinfo)
 476{
 477	struct gtp_dev *gtp = netdev_priv(dev);
 478	struct pdp_ctx *pctx;
 479	struct rtable *rt;
 480	struct flowi4 fl4;
 481	struct iphdr *iph;
 482	__be16 df;
 483	int mtu;
 484
 485	/* Read the IP destination address and resolve the PDP context.
 486	 * Prepend PDP header with TEI/TID from PDP ctx.
 487	 */
 488	iph = ip_hdr(skb);
 489	if (gtp->role == GTP_ROLE_SGSN)
 490		pctx = ipv4_pdp_find(gtp, iph->saddr);
 491	else
 492		pctx = ipv4_pdp_find(gtp, iph->daddr);
 493
 494	if (!pctx) {
 495		netdev_dbg(dev, "no PDP ctx found for %pI4, skip\n",
 496			   &iph->daddr);
 497		return -ENOENT;
 498	}
 499	netdev_dbg(dev, "found PDP context %p\n", pctx);
 500
 501	rt = ip4_route_output_gtp(&fl4, pctx->sk, pctx->peer_addr_ip4.s_addr);
 502	if (IS_ERR(rt)) {
 503		netdev_dbg(dev, "no route to SSGN %pI4\n",
 504			   &pctx->peer_addr_ip4.s_addr);
 505		dev->stats.tx_carrier_errors++;
 506		goto err;
 507	}
 508
 509	if (rt->dst.dev == dev) {
 510		netdev_dbg(dev, "circular route to SSGN %pI4\n",
 511			   &pctx->peer_addr_ip4.s_addr);
 512		dev->stats.collisions++;
 513		goto err_rt;
 514	}
 515
 516	skb_dst_drop(skb);
 517
 518	/* This is similar to tnl_update_pmtu(). */
 519	df = iph->frag_off;
 520	if (df) {
 521		mtu = dst_mtu(&rt->dst) - dev->hard_header_len -
 522			sizeof(struct iphdr) - sizeof(struct udphdr);
 523		switch (pctx->gtp_version) {
 524		case GTP_V0:
 525			mtu -= sizeof(struct gtp0_header);
 526			break;
 527		case GTP_V1:
 528			mtu -= sizeof(struct gtp1_header);
 529			break;
 530		}
 531	} else {
 532		mtu = dst_mtu(&rt->dst);
 533	}
 534
 535	rt->dst.ops->update_pmtu(&rt->dst, NULL, skb, mtu);
 536
 537	if (!skb_is_gso(skb) && (iph->frag_off & htons(IP_DF)) &&
 538	    mtu < ntohs(iph->tot_len)) {
 539		netdev_dbg(dev, "packet too big, fragmentation needed\n");
 540		memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
 541		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
 542			  htonl(mtu));
 543		goto err_rt;
 544	}
 545
 546	gtp_set_pktinfo_ipv4(pktinfo, pctx->sk, iph, pctx, rt, &fl4, dev);
 547	gtp_push_header(skb, pktinfo);
 548
 549	return 0;
 550err_rt:
 551	ip_rt_put(rt);
 552err:
 553	return -EBADMSG;
 554}
 555
 556static netdev_tx_t gtp_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 557{
 558	unsigned int proto = ntohs(skb->protocol);
 559	struct gtp_pktinfo pktinfo;
 560	int err;
 561
 562	/* Ensure there is sufficient headroom. */
 563	if (skb_cow_head(skb, dev->needed_headroom))
 564		goto tx_err;
 565
 566	skb_reset_inner_headers(skb);
 567
 568	/* PDP context lookups in gtp_build_skb_*() need rcu read-side lock. */
 569	rcu_read_lock();
 570	switch (proto) {
 571	case ETH_P_IP:
 572		err = gtp_build_skb_ip4(skb, dev, &pktinfo);
 573		break;
 574	default:
 575		err = -EOPNOTSUPP;
 576		break;
 577	}
 578	rcu_read_unlock();
 579
 580	if (err < 0)
 581		goto tx_err;
 582
 583	switch (proto) {
 584	case ETH_P_IP:
 585		netdev_dbg(pktinfo.dev, "gtp -> IP src: %pI4 dst: %pI4\n",
 586			   &pktinfo.iph->saddr, &pktinfo.iph->daddr);
 587		udp_tunnel_xmit_skb(pktinfo.rt, pktinfo.sk, skb,
 588				    pktinfo.fl4.saddr, pktinfo.fl4.daddr,
 589				    pktinfo.iph->tos,
 590				    ip4_dst_hoplimit(&pktinfo.rt->dst),
 591				    0,
 592				    pktinfo.gtph_port, pktinfo.gtph_port,
 593				    true, false);
 594		break;
 595	}
 596
 597	return NETDEV_TX_OK;
 598tx_err:
 599	dev->stats.tx_errors++;
 600	dev_kfree_skb(skb);
 601	return NETDEV_TX_OK;
 602}
 603
 604static const struct net_device_ops gtp_netdev_ops = {
 605	.ndo_init		= gtp_dev_init,
 606	.ndo_uninit		= gtp_dev_uninit,
 607	.ndo_start_xmit		= gtp_dev_xmit,
 608	.ndo_get_stats64	= ip_tunnel_get_stats64,
 609};
 610
 611static void gtp_link_setup(struct net_device *dev)
 612{
 613	dev->netdev_ops		= &gtp_netdev_ops;
 614	dev->needs_free_netdev	= true;
 615
 616	dev->hard_header_len = 0;
 617	dev->addr_len = 0;
 618
 619	/* Zero header length. */
 620	dev->type = ARPHRD_NONE;
 621	dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
 622
 623	dev->priv_flags	|= IFF_NO_QUEUE;
 624	dev->features	|= NETIF_F_LLTX;
 625	netif_keep_dst(dev);
 626
 627	/* Assume largest header, ie. GTPv0. */
 628	dev->needed_headroom	= LL_MAX_HEADER +
 629				  sizeof(struct iphdr) +
 630				  sizeof(struct udphdr) +
 631				  sizeof(struct gtp0_header);
 632}
 633
 634static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize);
 635static void gtp_hashtable_free(struct gtp_dev *gtp);
 636static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]);
 637
 
 
 
 
 
 
 
 
 638static int gtp_newlink(struct net *src_net, struct net_device *dev,
 639		       struct nlattr *tb[], struct nlattr *data[],
 640		       struct netlink_ext_ack *extack)
 641{
 642	struct gtp_dev *gtp;
 643	struct gtp_net *gn;
 644	int hashsize, err;
 645
 646	if (!data[IFLA_GTP_FD0] && !data[IFLA_GTP_FD1])
 647		return -EINVAL;
 648
 649	gtp = netdev_priv(dev);
 650
 651	err = gtp_encap_enable(gtp, data);
 652	if (err < 0)
 653		return err;
 654
 655	if (!data[IFLA_GTP_PDP_HASHSIZE])
 656		hashsize = 1024;
 657	else
 658		hashsize = nla_get_u32(data[IFLA_GTP_PDP_HASHSIZE]);
 
 
 
 659
 660	err = gtp_hashtable_new(gtp, hashsize);
 661	if (err < 0)
 662		goto out_encap;
 663
 664	err = register_netdevice(dev);
 665	if (err < 0) {
 666		netdev_dbg(dev, "failed to register new netdev %d\n", err);
 667		goto out_hashtable;
 668	}
 669
 670	gn = net_generic(dev_net(dev), gtp_net_id);
 671	list_add_rcu(&gtp->list, &gn->gtp_dev_list);
 
 672
 673	netdev_dbg(dev, "registered new GTP interface\n");
 674
 675	return 0;
 676
 677out_hashtable:
 678	gtp_hashtable_free(gtp);
 
 679out_encap:
 680	gtp_encap_disable(gtp);
 681	return err;
 682}
 683
 684static void gtp_dellink(struct net_device *dev, struct list_head *head)
 685{
 686	struct gtp_dev *gtp = netdev_priv(dev);
 
 
 
 
 
 
 687
 688	gtp_encap_disable(gtp);
 689	gtp_hashtable_free(gtp);
 690	list_del_rcu(&gtp->list);
 691	unregister_netdevice_queue(dev, head);
 692}
 693
 694static const struct nla_policy gtp_policy[IFLA_GTP_MAX + 1] = {
 695	[IFLA_GTP_FD0]			= { .type = NLA_U32 },
 696	[IFLA_GTP_FD1]			= { .type = NLA_U32 },
 697	[IFLA_GTP_PDP_HASHSIZE]		= { .type = NLA_U32 },
 698	[IFLA_GTP_ROLE]			= { .type = NLA_U32 },
 699};
 700
 701static int gtp_validate(struct nlattr *tb[], struct nlattr *data[],
 702			struct netlink_ext_ack *extack)
 703{
 704	if (!data)
 705		return -EINVAL;
 706
 707	return 0;
 708}
 709
 710static size_t gtp_get_size(const struct net_device *dev)
 711{
 712	return nla_total_size(sizeof(__u32));	/* IFLA_GTP_PDP_HASHSIZE */
 713}
 714
 715static int gtp_fill_info(struct sk_buff *skb, const struct net_device *dev)
 716{
 717	struct gtp_dev *gtp = netdev_priv(dev);
 718
 719	if (nla_put_u32(skb, IFLA_GTP_PDP_HASHSIZE, gtp->hash_size))
 720		goto nla_put_failure;
 721
 722	return 0;
 723
 724nla_put_failure:
 725	return -EMSGSIZE;
 726}
 727
 728static struct rtnl_link_ops gtp_link_ops __read_mostly = {
 729	.kind		= "gtp",
 730	.maxtype	= IFLA_GTP_MAX,
 731	.policy		= gtp_policy,
 732	.priv_size	= sizeof(struct gtp_dev),
 733	.setup		= gtp_link_setup,
 734	.validate	= gtp_validate,
 735	.newlink	= gtp_newlink,
 736	.dellink	= gtp_dellink,
 737	.get_size	= gtp_get_size,
 738	.fill_info	= gtp_fill_info,
 739};
 740
 741static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize)
 742{
 743	int i;
 744
 745	gtp->addr_hash = kmalloc(sizeof(struct hlist_head) * hsize, GFP_KERNEL);
 
 746	if (gtp->addr_hash == NULL)
 747		return -ENOMEM;
 748
 749	gtp->tid_hash = kmalloc(sizeof(struct hlist_head) * hsize, GFP_KERNEL);
 
 750	if (gtp->tid_hash == NULL)
 751		goto err1;
 752
 753	gtp->hash_size = hsize;
 754
 755	for (i = 0; i < hsize; i++) {
 756		INIT_HLIST_HEAD(&gtp->addr_hash[i]);
 757		INIT_HLIST_HEAD(&gtp->tid_hash[i]);
 758	}
 759	return 0;
 760err1:
 761	kfree(gtp->addr_hash);
 762	return -ENOMEM;
 763}
 764
 765static void gtp_hashtable_free(struct gtp_dev *gtp)
 766{
 767	struct pdp_ctx *pctx;
 768	int i;
 769
 770	for (i = 0; i < gtp->hash_size; i++)
 771		hlist_for_each_entry_rcu(pctx, &gtp->tid_hash[i], hlist_tid)
 772			pdp_context_delete(pctx);
 773
 774	synchronize_rcu();
 775	kfree(gtp->addr_hash);
 776	kfree(gtp->tid_hash);
 777}
 778
 779static struct sock *gtp_encap_enable_socket(int fd, int type,
 780					    struct gtp_dev *gtp)
 781{
 782	struct udp_tunnel_sock_cfg tuncfg = {NULL};
 783	struct socket *sock;
 784	struct sock *sk;
 785	int err;
 786
 787	pr_debug("enable gtp on %d, %d\n", fd, type);
 788
 789	sock = sockfd_lookup(fd, &err);
 790	if (!sock) {
 791		pr_debug("gtp socket fd=%d not found\n", fd);
 792		return NULL;
 793	}
 794
 795	if (sock->sk->sk_protocol != IPPROTO_UDP) {
 
 
 
 796		pr_debug("socket fd=%d not UDP\n", fd);
 797		sk = ERR_PTR(-EINVAL);
 798		goto out_sock;
 799	}
 800
 801	if (rcu_dereference_sk_user_data(sock->sk)) {
 
 802		sk = ERR_PTR(-EBUSY);
 803		goto out_sock;
 804	}
 805
 806	sk = sock->sk;
 807	sock_hold(sk);
 808
 809	tuncfg.sk_user_data = gtp;
 810	tuncfg.encap_type = type;
 811	tuncfg.encap_rcv = gtp_encap_recv;
 812	tuncfg.encap_destroy = gtp_encap_destroy;
 813
 814	setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg);
 815
 
 
 816out_sock:
 817	sockfd_put(sock);
 818	return sk;
 819}
 820
 821static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[])
 822{
 823	struct sock *sk1u = NULL;
 824	struct sock *sk0 = NULL;
 825	unsigned int role = GTP_ROLE_GGSN;
 826
 827	if (data[IFLA_GTP_FD0]) {
 828		u32 fd0 = nla_get_u32(data[IFLA_GTP_FD0]);
 829
 830		sk0 = gtp_encap_enable_socket(fd0, UDP_ENCAP_GTP0, gtp);
 831		if (IS_ERR(sk0))
 832			return PTR_ERR(sk0);
 833	}
 834
 835	if (data[IFLA_GTP_FD1]) {
 836		u32 fd1 = nla_get_u32(data[IFLA_GTP_FD1]);
 837
 838		sk1u = gtp_encap_enable_socket(fd1, UDP_ENCAP_GTP1U, gtp);
 839		if (IS_ERR(sk1u)) {
 840			if (sk0)
 841				gtp_encap_disable_sock(sk0);
 842			return PTR_ERR(sk1u);
 843		}
 844	}
 845
 846	if (data[IFLA_GTP_ROLE]) {
 847		role = nla_get_u32(data[IFLA_GTP_ROLE]);
 848		if (role > GTP_ROLE_SGSN)
 
 
 849			return -EINVAL;
 
 850	}
 851
 852	gtp->sk0 = sk0;
 853	gtp->sk1u = sk1u;
 854	gtp->role = role;
 855
 856	return 0;
 857}
 858
 859static struct gtp_dev *gtp_find_dev(struct net *src_net, struct nlattr *nla[])
 860{
 861	struct gtp_dev *gtp = NULL;
 862	struct net_device *dev;
 863	struct net *net;
 864
 865	/* Examine the link attributes and figure out which network namespace
 866	 * we are talking about.
 867	 */
 868	if (nla[GTPA_NET_NS_FD])
 869		net = get_net_ns_by_fd(nla_get_u32(nla[GTPA_NET_NS_FD]));
 870	else
 871		net = get_net(src_net);
 872
 873	if (IS_ERR(net))
 874		return NULL;
 875
 876	/* Check if there's an existing gtpX device to configure */
 877	dev = dev_get_by_index_rcu(net, nla_get_u32(nla[GTPA_LINK]));
 878	if (dev && dev->netdev_ops == &gtp_netdev_ops)
 879		gtp = netdev_priv(dev);
 880
 881	put_net(net);
 882	return gtp;
 883}
 884
 885static void ipv4_pdp_fill(struct pdp_ctx *pctx, struct genl_info *info)
 886{
 887	pctx->gtp_version = nla_get_u32(info->attrs[GTPA_VERSION]);
 888	pctx->af = AF_INET;
 889	pctx->peer_addr_ip4.s_addr =
 890		nla_get_be32(info->attrs[GTPA_PEER_ADDRESS]);
 891	pctx->ms_addr_ip4.s_addr =
 892		nla_get_be32(info->attrs[GTPA_MS_ADDRESS]);
 893
 894	switch (pctx->gtp_version) {
 895	case GTP_V0:
 896		/* According to TS 09.60, sections 7.5.1 and 7.5.2, the flow
 897		 * label needs to be the same for uplink and downlink packets,
 898		 * so let's annotate this.
 899		 */
 900		pctx->u.v0.tid = nla_get_u64(info->attrs[GTPA_TID]);
 901		pctx->u.v0.flow = nla_get_u16(info->attrs[GTPA_FLOW]);
 902		break;
 903	case GTP_V1:
 904		pctx->u.v1.i_tei = nla_get_u32(info->attrs[GTPA_I_TEI]);
 905		pctx->u.v1.o_tei = nla_get_u32(info->attrs[GTPA_O_TEI]);
 906		break;
 907	default:
 908		break;
 909	}
 910}
 911
 912static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk,
 913			struct genl_info *info)
 914{
 
 915	struct net_device *dev = gtp->dev;
 916	u32 hash_ms, hash_tid = 0;
 917	struct pdp_ctx *pctx;
 918	bool found = false;
 919	__be32 ms_addr;
 920
 921	ms_addr = nla_get_be32(info->attrs[GTPA_MS_ADDRESS]);
 922	hash_ms = ipv4_hashfn(ms_addr) % gtp->hash_size;
 
 923
 924	hlist_for_each_entry_rcu(pctx, &gtp->addr_hash[hash_ms], hlist_addr) {
 925		if (pctx->ms_addr_ip4.s_addr == ms_addr) {
 926			found = true;
 927			break;
 928		}
 929	}
 
 
 
 
 
 930
 931	if (found) {
 932		if (info->nlhdr->nlmsg_flags & NLM_F_EXCL)
 933			return -EEXIST;
 934		if (info->nlhdr->nlmsg_flags & NLM_F_REPLACE)
 935			return -EOPNOTSUPP;
 936
 
 
 
 
 
 937		ipv4_pdp_fill(pctx, info);
 938
 939		if (pctx->gtp_version == GTP_V0)
 940			netdev_dbg(dev, "GTPv0-U: update tunnel id = %llx (pdp %p)\n",
 941				   pctx->u.v0.tid, pctx);
 942		else if (pctx->gtp_version == GTP_V1)
 943			netdev_dbg(dev, "GTPv1-U: update tunnel id = %x/%x (pdp %p)\n",
 944				   pctx->u.v1.i_tei, pctx->u.v1.o_tei, pctx);
 945
 946		return 0;
 947
 948	}
 949
 950	pctx = kmalloc(sizeof(struct pdp_ctx), GFP_KERNEL);
 951	if (pctx == NULL)
 952		return -ENOMEM;
 953
 954	sock_hold(sk);
 955	pctx->sk = sk;
 956	pctx->dev = gtp->dev;
 957	ipv4_pdp_fill(pctx, info);
 958	atomic_set(&pctx->tx_seq, 0);
 959
 960	switch (pctx->gtp_version) {
 961	case GTP_V0:
 962		/* TS 09.60: "The flow label identifies unambiguously a GTP
 963		 * flow.". We use the tid for this instead, I cannot find a
 964		 * situation in which this doesn't unambiguosly identify the
 965		 * PDP context.
 966		 */
 967		hash_tid = gtp0_hashfn(pctx->u.v0.tid) % gtp->hash_size;
 968		break;
 969	case GTP_V1:
 970		hash_tid = gtp1u_hashfn(pctx->u.v1.i_tei) % gtp->hash_size;
 971		break;
 972	}
 973
 974	hlist_add_head_rcu(&pctx->hlist_addr, &gtp->addr_hash[hash_ms]);
 975	hlist_add_head_rcu(&pctx->hlist_tid, &gtp->tid_hash[hash_tid]);
 976
 977	switch (pctx->gtp_version) {
 978	case GTP_V0:
 979		netdev_dbg(dev, "GTPv0-U: new PDP ctx id=%llx ssgn=%pI4 ms=%pI4 (pdp=%p)\n",
 980			   pctx->u.v0.tid, &pctx->peer_addr_ip4,
 981			   &pctx->ms_addr_ip4, pctx);
 982		break;
 983	case GTP_V1:
 984		netdev_dbg(dev, "GTPv1-U: new PDP ctx id=%x/%x ssgn=%pI4 ms=%pI4 (pdp=%p)\n",
 985			   pctx->u.v1.i_tei, pctx->u.v1.o_tei,
 986			   &pctx->peer_addr_ip4, &pctx->ms_addr_ip4, pctx);
 987		break;
 988	}
 989
 990	return 0;
 991}
 992
 993static void pdp_context_free(struct rcu_head *head)
 994{
 995	struct pdp_ctx *pctx = container_of(head, struct pdp_ctx, rcu_head);
 996
 997	sock_put(pctx->sk);
 998	kfree(pctx);
 999}
1000
1001static void pdp_context_delete(struct pdp_ctx *pctx)
1002{
1003	hlist_del_rcu(&pctx->hlist_tid);
1004	hlist_del_rcu(&pctx->hlist_addr);
1005	call_rcu(&pctx->rcu_head, pdp_context_free);
1006}
1007
1008static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info)
1009{
1010	unsigned int version;
1011	struct gtp_dev *gtp;
1012	struct sock *sk;
1013	int err;
1014
1015	if (!info->attrs[GTPA_VERSION] ||
1016	    !info->attrs[GTPA_LINK] ||
1017	    !info->attrs[GTPA_PEER_ADDRESS] ||
1018	    !info->attrs[GTPA_MS_ADDRESS])
1019		return -EINVAL;
1020
1021	version = nla_get_u32(info->attrs[GTPA_VERSION]);
1022
1023	switch (version) {
1024	case GTP_V0:
1025		if (!info->attrs[GTPA_TID] ||
1026		    !info->attrs[GTPA_FLOW])
1027			return -EINVAL;
1028		break;
1029	case GTP_V1:
1030		if (!info->attrs[GTPA_I_TEI] ||
1031		    !info->attrs[GTPA_O_TEI])
1032			return -EINVAL;
1033		break;
1034
1035	default:
1036		return -EINVAL;
1037	}
1038
 
1039	rcu_read_lock();
1040
1041	gtp = gtp_find_dev(sock_net(skb->sk), info->attrs);
1042	if (!gtp) {
1043		err = -ENODEV;
1044		goto out_unlock;
1045	}
1046
1047	if (version == GTP_V0)
1048		sk = gtp->sk0;
1049	else if (version == GTP_V1)
1050		sk = gtp->sk1u;
1051	else
1052		sk = NULL;
1053
1054	if (!sk) {
1055		err = -ENODEV;
1056		goto out_unlock;
1057	}
1058
1059	err = ipv4_pdp_add(gtp, sk, info);
1060
1061out_unlock:
1062	rcu_read_unlock();
 
1063	return err;
1064}
1065
1066static struct pdp_ctx *gtp_find_pdp_by_link(struct net *net,
1067					    struct nlattr *nla[])
1068{
1069	struct gtp_dev *gtp;
1070
1071	gtp = gtp_find_dev(net, nla);
1072	if (!gtp)
1073		return ERR_PTR(-ENODEV);
1074
1075	if (nla[GTPA_MS_ADDRESS]) {
1076		__be32 ip = nla_get_be32(nla[GTPA_MS_ADDRESS]);
1077
1078		return ipv4_pdp_find(gtp, ip);
1079	} else if (nla[GTPA_VERSION]) {
1080		u32 gtp_version = nla_get_u32(nla[GTPA_VERSION]);
1081
1082		if (gtp_version == GTP_V0 && nla[GTPA_TID])
1083			return gtp0_pdp_find(gtp, nla_get_u64(nla[GTPA_TID]));
1084		else if (gtp_version == GTP_V1 && nla[GTPA_I_TEI])
1085			return gtp1_pdp_find(gtp, nla_get_u32(nla[GTPA_I_TEI]));
1086	}
1087
1088	return ERR_PTR(-EINVAL);
1089}
1090
1091static struct pdp_ctx *gtp_find_pdp(struct net *net, struct nlattr *nla[])
1092{
1093	struct pdp_ctx *pctx;
1094
1095	if (nla[GTPA_LINK])
1096		pctx = gtp_find_pdp_by_link(net, nla);
1097	else
1098		pctx = ERR_PTR(-EINVAL);
1099
1100	if (!pctx)
1101		pctx = ERR_PTR(-ENOENT);
1102
1103	return pctx;
1104}
1105
1106static int gtp_genl_del_pdp(struct sk_buff *skb, struct genl_info *info)
1107{
1108	struct pdp_ctx *pctx;
1109	int err = 0;
1110
1111	if (!info->attrs[GTPA_VERSION])
1112		return -EINVAL;
1113
1114	rcu_read_lock();
1115
1116	pctx = gtp_find_pdp(sock_net(skb->sk), info->attrs);
1117	if (IS_ERR(pctx)) {
1118		err = PTR_ERR(pctx);
1119		goto out_unlock;
1120	}
1121
1122	if (pctx->gtp_version == GTP_V0)
1123		netdev_dbg(pctx->dev, "GTPv0-U: deleting tunnel id = %llx (pdp %p)\n",
1124			   pctx->u.v0.tid, pctx);
1125	else if (pctx->gtp_version == GTP_V1)
1126		netdev_dbg(pctx->dev, "GTPv1-U: deleting tunnel id = %x/%x (pdp %p)\n",
1127			   pctx->u.v1.i_tei, pctx->u.v1.o_tei, pctx);
1128
1129	pdp_context_delete(pctx);
1130
1131out_unlock:
1132	rcu_read_unlock();
1133	return err;
1134}
1135
1136static struct genl_family gtp_genl_family;
1137
1138static int gtp_genl_fill_info(struct sk_buff *skb, u32 snd_portid, u32 snd_seq,
1139			      u32 type, struct pdp_ctx *pctx)
1140{
1141	void *genlh;
1142
1143	genlh = genlmsg_put(skb, snd_portid, snd_seq, &gtp_genl_family, 0,
1144			    type);
1145	if (genlh == NULL)
1146		goto nlmsg_failure;
1147
1148	if (nla_put_u32(skb, GTPA_VERSION, pctx->gtp_version) ||
 
1149	    nla_put_be32(skb, GTPA_PEER_ADDRESS, pctx->peer_addr_ip4.s_addr) ||
1150	    nla_put_be32(skb, GTPA_MS_ADDRESS, pctx->ms_addr_ip4.s_addr))
1151		goto nla_put_failure;
1152
1153	switch (pctx->gtp_version) {
1154	case GTP_V0:
1155		if (nla_put_u64_64bit(skb, GTPA_TID, pctx->u.v0.tid, GTPA_PAD) ||
1156		    nla_put_u16(skb, GTPA_FLOW, pctx->u.v0.flow))
1157			goto nla_put_failure;
1158		break;
1159	case GTP_V1:
1160		if (nla_put_u32(skb, GTPA_I_TEI, pctx->u.v1.i_tei) ||
1161		    nla_put_u32(skb, GTPA_O_TEI, pctx->u.v1.o_tei))
1162			goto nla_put_failure;
1163		break;
1164	}
1165	genlmsg_end(skb, genlh);
1166	return 0;
1167
1168nlmsg_failure:
1169nla_put_failure:
1170	genlmsg_cancel(skb, genlh);
1171	return -EMSGSIZE;
1172}
1173
1174static int gtp_genl_get_pdp(struct sk_buff *skb, struct genl_info *info)
1175{
1176	struct pdp_ctx *pctx = NULL;
1177	struct sk_buff *skb2;
1178	int err;
1179
1180	if (!info->attrs[GTPA_VERSION])
1181		return -EINVAL;
1182
1183	rcu_read_lock();
1184
1185	pctx = gtp_find_pdp(sock_net(skb->sk), info->attrs);
1186	if (IS_ERR(pctx)) {
1187		err = PTR_ERR(pctx);
1188		goto err_unlock;
1189	}
1190
1191	skb2 = genlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
1192	if (skb2 == NULL) {
1193		err = -ENOMEM;
1194		goto err_unlock;
1195	}
1196
1197	err = gtp_genl_fill_info(skb2, NETLINK_CB(skb).portid,
1198				 info->snd_seq, info->nlhdr->nlmsg_type, pctx);
1199	if (err < 0)
1200		goto err_unlock_free;
1201
1202	rcu_read_unlock();
1203	return genlmsg_unicast(genl_info_net(info), skb2, info->snd_portid);
1204
1205err_unlock_free:
1206	kfree_skb(skb2);
1207err_unlock:
1208	rcu_read_unlock();
1209	return err;
1210}
1211
1212static int gtp_genl_dump_pdp(struct sk_buff *skb,
1213				struct netlink_callback *cb)
1214{
1215	struct gtp_dev *last_gtp = (struct gtp_dev *)cb->args[2], *gtp;
 
1216	struct net *net = sock_net(skb->sk);
1217	struct gtp_net *gn = net_generic(net, gtp_net_id);
1218	unsigned long tid = cb->args[1];
1219	int i, k = cb->args[0], ret;
1220	struct pdp_ctx *pctx;
 
 
 
1221
1222	if (cb->args[4])
1223		return 0;
1224
 
1225	list_for_each_entry_rcu(gtp, &gn->gtp_dev_list, list) {
1226		if (last_gtp && last_gtp != gtp)
1227			continue;
1228		else
1229			last_gtp = NULL;
1230
1231		for (i = k; i < gtp->hash_size; i++) {
1232			hlist_for_each_entry_rcu(pctx, &gtp->tid_hash[i], hlist_tid) {
1233				if (tid && tid != pctx->u.tid)
1234					continue;
1235				else
1236					tid = 0;
1237
1238				ret = gtp_genl_fill_info(skb,
1239							 NETLINK_CB(cb->skb).portid,
1240							 cb->nlh->nlmsg_seq,
1241							 cb->nlh->nlmsg_type, pctx);
1242				if (ret < 0) {
1243					cb->args[0] = i;
1244					cb->args[1] = pctx->u.tid;
1245					cb->args[2] = (unsigned long)gtp;
1246					goto out;
1247				}
 
1248			}
 
1249		}
 
1250	}
1251	cb->args[4] = 1;
1252out:
 
1253	return skb->len;
1254}
1255
1256static struct nla_policy gtp_genl_policy[GTPA_MAX + 1] = {
1257	[GTPA_LINK]		= { .type = NLA_U32, },
1258	[GTPA_VERSION]		= { .type = NLA_U32, },
1259	[GTPA_TID]		= { .type = NLA_U64, },
1260	[GTPA_PEER_ADDRESS]	= { .type = NLA_U32, },
1261	[GTPA_MS_ADDRESS]	= { .type = NLA_U32, },
1262	[GTPA_FLOW]		= { .type = NLA_U16, },
1263	[GTPA_NET_NS_FD]	= { .type = NLA_U32, },
1264	[GTPA_I_TEI]		= { .type = NLA_U32, },
1265	[GTPA_O_TEI]		= { .type = NLA_U32, },
1266};
1267
1268static const struct genl_ops gtp_genl_ops[] = {
1269	{
1270		.cmd = GTP_CMD_NEWPDP,
 
1271		.doit = gtp_genl_new_pdp,
1272		.policy = gtp_genl_policy,
1273		.flags = GENL_ADMIN_PERM,
1274	},
1275	{
1276		.cmd = GTP_CMD_DELPDP,
 
1277		.doit = gtp_genl_del_pdp,
1278		.policy = gtp_genl_policy,
1279		.flags = GENL_ADMIN_PERM,
1280	},
1281	{
1282		.cmd = GTP_CMD_GETPDP,
 
1283		.doit = gtp_genl_get_pdp,
1284		.dumpit = gtp_genl_dump_pdp,
1285		.policy = gtp_genl_policy,
1286		.flags = GENL_ADMIN_PERM,
1287	},
1288};
1289
1290static struct genl_family gtp_genl_family __ro_after_init = {
1291	.name		= "gtp",
1292	.version	= 0,
1293	.hdrsize	= 0,
1294	.maxattr	= GTPA_MAX,
 
1295	.netnsok	= true,
1296	.module		= THIS_MODULE,
1297	.ops		= gtp_genl_ops,
1298	.n_ops		= ARRAY_SIZE(gtp_genl_ops),
1299};
1300
1301static int __net_init gtp_net_init(struct net *net)
1302{
1303	struct gtp_net *gn = net_generic(net, gtp_net_id);
1304
1305	INIT_LIST_HEAD(&gn->gtp_dev_list);
1306	return 0;
1307}
1308
1309static void __net_exit gtp_net_exit(struct net *net)
1310{
1311	struct gtp_net *gn = net_generic(net, gtp_net_id);
1312	struct gtp_dev *gtp;
1313	LIST_HEAD(list);
1314
1315	rtnl_lock();
1316	list_for_each_entry(gtp, &gn->gtp_dev_list, list)
1317		gtp_dellink(gtp->dev, &list);
1318
1319	unregister_netdevice_many(&list);
1320	rtnl_unlock();
1321}
1322
1323static struct pernet_operations gtp_net_ops = {
1324	.init	= gtp_net_init,
1325	.exit	= gtp_net_exit,
1326	.id	= &gtp_net_id,
1327	.size	= sizeof(struct gtp_net),
1328};
1329
1330static int __init gtp_init(void)
1331{
1332	int err;
1333
1334	get_random_bytes(&gtp_h_initval, sizeof(gtp_h_initval));
1335
1336	err = rtnl_link_register(&gtp_link_ops);
1337	if (err < 0)
1338		goto error_out;
1339
1340	err = genl_register_family(&gtp_genl_family);
1341	if (err < 0)
1342		goto unreg_rtnl_link;
1343
1344	err = register_pernet_subsys(&gtp_net_ops);
1345	if (err < 0)
1346		goto unreg_genl_family;
1347
1348	pr_info("GTP module loaded (pdp ctx size %zd bytes)\n",
1349		sizeof(struct pdp_ctx));
1350	return 0;
1351
1352unreg_genl_family:
1353	genl_unregister_family(&gtp_genl_family);
1354unreg_rtnl_link:
1355	rtnl_link_unregister(&gtp_link_ops);
1356error_out:
1357	pr_err("error loading GTP module loaded\n");
1358	return err;
1359}
1360late_initcall(gtp_init);
1361
1362static void __exit gtp_fini(void)
1363{
1364	unregister_pernet_subsys(&gtp_net_ops);
1365	genl_unregister_family(&gtp_genl_family);
1366	rtnl_link_unregister(&gtp_link_ops);
 
1367
1368	pr_info("GTP module unloaded\n");
1369}
1370module_exit(gtp_fini);
1371
1372MODULE_LICENSE("GPL");
1373MODULE_AUTHOR("Harald Welte <hwelte@sysmocom.de>");
1374MODULE_DESCRIPTION("Interface driver for GTP encapsulated traffic");
1375MODULE_ALIAS_RTNL_LINK("gtp");
1376MODULE_ALIAS_GENL_FAMILY("gtp");
v5.9
   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/* GTP according to GSM TS 09.60 / 3GPP TS 29.060
   3 *
   4 * (C) 2012-2014 by sysmocom - s.f.m.c. GmbH
   5 * (C) 2016 by Pablo Neira Ayuso <pablo@netfilter.org>
   6 *
   7 * Author: Harald Welte <hwelte@sysmocom.de>
   8 *	   Pablo Neira Ayuso <pablo@netfilter.org>
   9 *	   Andreas Schultz <aschultz@travelping.com>
 
 
 
 
 
  10 */
  11
  12#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  13
  14#include <linux/module.h>
  15#include <linux/skbuff.h>
  16#include <linux/udp.h>
  17#include <linux/rculist.h>
  18#include <linux/jhash.h>
  19#include <linux/if_tunnel.h>
  20#include <linux/net.h>
  21#include <linux/file.h>
  22#include <linux/gtp.h>
  23
  24#include <net/net_namespace.h>
  25#include <net/protocol.h>
  26#include <net/ip.h>
  27#include <net/udp.h>
  28#include <net/udp_tunnel.h>
  29#include <net/icmp.h>
  30#include <net/xfrm.h>
  31#include <net/genetlink.h>
  32#include <net/netns/generic.h>
  33#include <net/gtp.h>
  34
  35/* An active session for the subscriber. */
  36struct pdp_ctx {
  37	struct hlist_node	hlist_tid;
  38	struct hlist_node	hlist_addr;
  39
  40	union {
 
  41		struct {
  42			u64	tid;
  43			u16	flow;
  44		} v0;
  45		struct {
  46			u32	i_tei;
  47			u32	o_tei;
  48		} v1;
  49	} u;
  50	u8			gtp_version;
  51	u16			af;
  52
  53	struct in_addr		ms_addr_ip4;
  54	struct in_addr		peer_addr_ip4;
  55
  56	struct sock		*sk;
  57	struct net_device       *dev;
  58
  59	atomic_t		tx_seq;
  60	struct rcu_head		rcu_head;
  61};
  62
  63/* One instance of the GTP device. */
  64struct gtp_dev {
  65	struct list_head	list;
  66
  67	struct sock		*sk0;
  68	struct sock		*sk1u;
  69
  70	struct net_device	*dev;
  71
  72	unsigned int		role;
  73	unsigned int		hash_size;
  74	struct hlist_head	*tid_hash;
  75	struct hlist_head	*addr_hash;
  76};
  77
  78static unsigned int gtp_net_id __read_mostly;
  79
  80struct gtp_net {
  81	struct list_head gtp_dev_list;
  82};
  83
  84static u32 gtp_h_initval;
  85
  86static void pdp_context_delete(struct pdp_ctx *pctx);
  87
  88static inline u32 gtp0_hashfn(u64 tid)
  89{
  90	u32 *tid32 = (u32 *) &tid;
  91	return jhash_2words(tid32[0], tid32[1], gtp_h_initval);
  92}
  93
  94static inline u32 gtp1u_hashfn(u32 tid)
  95{
  96	return jhash_1word(tid, gtp_h_initval);
  97}
  98
  99static inline u32 ipv4_hashfn(__be32 ip)
 100{
 101	return jhash_1word((__force u32)ip, gtp_h_initval);
 102}
 103
 104/* Resolve a PDP context structure based on the 64bit TID. */
 105static struct pdp_ctx *gtp0_pdp_find(struct gtp_dev *gtp, u64 tid)
 106{
 107	struct hlist_head *head;
 108	struct pdp_ctx *pdp;
 109
 110	head = &gtp->tid_hash[gtp0_hashfn(tid) % gtp->hash_size];
 111
 112	hlist_for_each_entry_rcu(pdp, head, hlist_tid) {
 113		if (pdp->gtp_version == GTP_V0 &&
 114		    pdp->u.v0.tid == tid)
 115			return pdp;
 116	}
 117	return NULL;
 118}
 119
 120/* Resolve a PDP context structure based on the 32bit TEI. */
 121static struct pdp_ctx *gtp1_pdp_find(struct gtp_dev *gtp, u32 tid)
 122{
 123	struct hlist_head *head;
 124	struct pdp_ctx *pdp;
 125
 126	head = &gtp->tid_hash[gtp1u_hashfn(tid) % gtp->hash_size];
 127
 128	hlist_for_each_entry_rcu(pdp, head, hlist_tid) {
 129		if (pdp->gtp_version == GTP_V1 &&
 130		    pdp->u.v1.i_tei == tid)
 131			return pdp;
 132	}
 133	return NULL;
 134}
 135
 136/* Resolve a PDP context based on IPv4 address of MS. */
 137static struct pdp_ctx *ipv4_pdp_find(struct gtp_dev *gtp, __be32 ms_addr)
 138{
 139	struct hlist_head *head;
 140	struct pdp_ctx *pdp;
 141
 142	head = &gtp->addr_hash[ipv4_hashfn(ms_addr) % gtp->hash_size];
 143
 144	hlist_for_each_entry_rcu(pdp, head, hlist_addr) {
 145		if (pdp->af == AF_INET &&
 146		    pdp->ms_addr_ip4.s_addr == ms_addr)
 147			return pdp;
 148	}
 149
 150	return NULL;
 151}
 152
 153static bool gtp_check_ms_ipv4(struct sk_buff *skb, struct pdp_ctx *pctx,
 154				  unsigned int hdrlen, unsigned int role)
 155{
 156	struct iphdr *iph;
 157
 158	if (!pskb_may_pull(skb, hdrlen + sizeof(struct iphdr)))
 159		return false;
 160
 161	iph = (struct iphdr *)(skb->data + hdrlen);
 162
 163	if (role == GTP_ROLE_SGSN)
 164		return iph->daddr == pctx->ms_addr_ip4.s_addr;
 165	else
 166		return iph->saddr == pctx->ms_addr_ip4.s_addr;
 167}
 168
 169/* Check if the inner IP address in this packet is assigned to any
 170 * existing mobile subscriber.
 171 */
 172static bool gtp_check_ms(struct sk_buff *skb, struct pdp_ctx *pctx,
 173			     unsigned int hdrlen, unsigned int role)
 174{
 175	switch (ntohs(skb->protocol)) {
 176	case ETH_P_IP:
 177		return gtp_check_ms_ipv4(skb, pctx, hdrlen, role);
 178	}
 179	return false;
 180}
 181
 182static int gtp_rx(struct pdp_ctx *pctx, struct sk_buff *skb,
 183			unsigned int hdrlen, unsigned int role)
 184{
 185	struct pcpu_sw_netstats *stats;
 186
 187	if (!gtp_check_ms(skb, pctx, hdrlen, role)) {
 188		netdev_dbg(pctx->dev, "No PDP ctx for this MS\n");
 189		return 1;
 190	}
 191
 192	/* Get rid of the GTP + UDP headers. */
 193	if (iptunnel_pull_header(skb, hdrlen, skb->protocol,
 194				 !net_eq(sock_net(pctx->sk), dev_net(pctx->dev))))
 195		return -1;
 196
 197	netdev_dbg(pctx->dev, "forwarding packet from GGSN to uplink\n");
 198
 199	/* Now that the UDP and the GTP header have been removed, set up the
 200	 * new network header. This is required by the upper layer to
 201	 * calculate the transport header.
 202	 */
 203	skb_reset_network_header(skb);
 204
 205	skb->dev = pctx->dev;
 206
 207	stats = this_cpu_ptr(pctx->dev->tstats);
 208	u64_stats_update_begin(&stats->syncp);
 209	stats->rx_packets++;
 210	stats->rx_bytes += skb->len;
 211	u64_stats_update_end(&stats->syncp);
 212
 213	netif_rx(skb);
 214	return 0;
 215}
 216
 217/* 1 means pass up to the stack, -1 means drop and 0 means decapsulated. */
 218static int gtp0_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb)
 219{
 220	unsigned int hdrlen = sizeof(struct udphdr) +
 221			      sizeof(struct gtp0_header);
 222	struct gtp0_header *gtp0;
 223	struct pdp_ctx *pctx;
 224
 225	if (!pskb_may_pull(skb, hdrlen))
 226		return -1;
 227
 228	gtp0 = (struct gtp0_header *)(skb->data + sizeof(struct udphdr));
 229
 230	if ((gtp0->flags >> 5) != GTP_V0)
 231		return 1;
 232
 233	if (gtp0->type != GTP_TPDU)
 234		return 1;
 235
 236	pctx = gtp0_pdp_find(gtp, be64_to_cpu(gtp0->tid));
 237	if (!pctx) {
 238		netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb);
 239		return 1;
 240	}
 241
 242	return gtp_rx(pctx, skb, hdrlen, gtp->role);
 243}
 244
 245static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb)
 246{
 247	unsigned int hdrlen = sizeof(struct udphdr) +
 248			      sizeof(struct gtp1_header);
 249	struct gtp1_header *gtp1;
 250	struct pdp_ctx *pctx;
 251
 252	if (!pskb_may_pull(skb, hdrlen))
 253		return -1;
 254
 255	gtp1 = (struct gtp1_header *)(skb->data + sizeof(struct udphdr));
 256
 257	if ((gtp1->flags >> 5) != GTP_V1)
 258		return 1;
 259
 260	if (gtp1->type != GTP_TPDU)
 261		return 1;
 262
 263	/* From 29.060: "This field shall be present if and only if any one or
 264	 * more of the S, PN and E flags are set.".
 265	 *
 266	 * If any of the bit is set, then the remaining ones also have to be
 267	 * set.
 268	 */
 269	if (gtp1->flags & GTP1_F_MASK)
 270		hdrlen += 4;
 271
 272	/* Make sure the header is larger enough, including extensions. */
 273	if (!pskb_may_pull(skb, hdrlen))
 274		return -1;
 275
 276	gtp1 = (struct gtp1_header *)(skb->data + sizeof(struct udphdr));
 277
 278	pctx = gtp1_pdp_find(gtp, ntohl(gtp1->tid));
 279	if (!pctx) {
 280		netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb);
 281		return 1;
 282	}
 283
 284	return gtp_rx(pctx, skb, hdrlen, gtp->role);
 285}
 286
 287static void __gtp_encap_destroy(struct sock *sk)
 288{
 289	struct gtp_dev *gtp;
 290
 291	lock_sock(sk);
 292	gtp = sk->sk_user_data;
 293	if (gtp) {
 294		if (gtp->sk0 == sk)
 295			gtp->sk0 = NULL;
 296		else
 297			gtp->sk1u = NULL;
 298		udp_sk(sk)->encap_type = 0;
 299		rcu_assign_sk_user_data(sk, NULL);
 300		sock_put(sk);
 301	}
 302	release_sock(sk);
 303}
 304
 305static void gtp_encap_destroy(struct sock *sk)
 306{
 307	rtnl_lock();
 308	__gtp_encap_destroy(sk);
 309	rtnl_unlock();
 310}
 311
 312static void gtp_encap_disable_sock(struct sock *sk)
 313{
 314	if (!sk)
 315		return;
 316
 317	__gtp_encap_destroy(sk);
 318}
 319
 320static void gtp_encap_disable(struct gtp_dev *gtp)
 321{
 322	gtp_encap_disable_sock(gtp->sk0);
 323	gtp_encap_disable_sock(gtp->sk1u);
 324}
 325
 326/* UDP encapsulation receive handler. See net/ipv4/udp.c.
 327 * Return codes: 0: success, <0: error, >0: pass up to userspace UDP socket.
 328 */
 329static int gtp_encap_recv(struct sock *sk, struct sk_buff *skb)
 330{
 331	struct gtp_dev *gtp;
 332	int ret = 0;
 333
 334	gtp = rcu_dereference_sk_user_data(sk);
 335	if (!gtp)
 336		return 1;
 337
 338	netdev_dbg(gtp->dev, "encap_recv sk=%p\n", sk);
 339
 340	switch (udp_sk(sk)->encap_type) {
 341	case UDP_ENCAP_GTP0:
 342		netdev_dbg(gtp->dev, "received GTP0 packet\n");
 343		ret = gtp0_udp_encap_recv(gtp, skb);
 344		break;
 345	case UDP_ENCAP_GTP1U:
 346		netdev_dbg(gtp->dev, "received GTP1U packet\n");
 347		ret = gtp1u_udp_encap_recv(gtp, skb);
 348		break;
 349	default:
 350		ret = -1; /* Shouldn't happen. */
 351	}
 352
 353	switch (ret) {
 354	case 1:
 355		netdev_dbg(gtp->dev, "pass up to the process\n");
 356		break;
 357	case 0:
 358		break;
 359	case -1:
 360		netdev_dbg(gtp->dev, "GTP packet has been dropped\n");
 361		kfree_skb(skb);
 362		ret = 0;
 363		break;
 364	}
 365
 366	return ret;
 367}
 368
 369static int gtp_dev_init(struct net_device *dev)
 370{
 371	struct gtp_dev *gtp = netdev_priv(dev);
 372
 373	gtp->dev = dev;
 374
 375	dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
 376	if (!dev->tstats)
 377		return -ENOMEM;
 378
 379	return 0;
 380}
 381
 382static void gtp_dev_uninit(struct net_device *dev)
 383{
 384	struct gtp_dev *gtp = netdev_priv(dev);
 385
 386	gtp_encap_disable(gtp);
 387	free_percpu(dev->tstats);
 388}
 389
 390static struct rtable *ip4_route_output_gtp(struct flowi4 *fl4,
 391					   const struct sock *sk,
 392					   __be32 daddr)
 393{
 394	memset(fl4, 0, sizeof(*fl4));
 395	fl4->flowi4_oif		= sk->sk_bound_dev_if;
 396	fl4->daddr		= daddr;
 397	fl4->saddr		= inet_sk(sk)->inet_saddr;
 398	fl4->flowi4_tos		= RT_CONN_FLAGS(sk);
 399	fl4->flowi4_proto	= sk->sk_protocol;
 400
 401	return ip_route_output_key(sock_net(sk), fl4);
 402}
 403
 404static inline void gtp0_push_header(struct sk_buff *skb, struct pdp_ctx *pctx)
 405{
 406	int payload_len = skb->len;
 407	struct gtp0_header *gtp0;
 408
 409	gtp0 = skb_push(skb, sizeof(*gtp0));
 410
 411	gtp0->flags	= 0x1e; /* v0, GTP-non-prime. */
 412	gtp0->type	= GTP_TPDU;
 413	gtp0->length	= htons(payload_len);
 414	gtp0->seq	= htons((atomic_inc_return(&pctx->tx_seq) - 1) % 0xffff);
 415	gtp0->flow	= htons(pctx->u.v0.flow);
 416	gtp0->number	= 0xff;
 417	gtp0->spare[0]	= gtp0->spare[1] = gtp0->spare[2] = 0xff;
 418	gtp0->tid	= cpu_to_be64(pctx->u.v0.tid);
 419}
 420
 421static inline void gtp1_push_header(struct sk_buff *skb, struct pdp_ctx *pctx)
 422{
 423	int payload_len = skb->len;
 424	struct gtp1_header *gtp1;
 425
 426	gtp1 = skb_push(skb, sizeof(*gtp1));
 427
 428	/* Bits    8  7  6  5  4  3  2	1
 429	 *	  +--+--+--+--+--+--+--+--+
 430	 *	  |version |PT| 0| E| S|PN|
 431	 *	  +--+--+--+--+--+--+--+--+
 432	 *	    0  0  1  1	1  0  0  0
 433	 */
 434	gtp1->flags	= 0x30; /* v1, GTP-non-prime. */
 435	gtp1->type	= GTP_TPDU;
 436	gtp1->length	= htons(payload_len);
 437	gtp1->tid	= htonl(pctx->u.v1.o_tei);
 438
 439	/* TODO: Suppport for extension header, sequence number and N-PDU.
 440	 *	 Update the length field if any of them is available.
 441	 */
 442}
 443
 444struct gtp_pktinfo {
 445	struct sock		*sk;
 446	struct iphdr		*iph;
 447	struct flowi4		fl4;
 448	struct rtable		*rt;
 449	struct pdp_ctx		*pctx;
 450	struct net_device	*dev;
 451	__be16			gtph_port;
 452};
 453
 454static void gtp_push_header(struct sk_buff *skb, struct gtp_pktinfo *pktinfo)
 455{
 456	switch (pktinfo->pctx->gtp_version) {
 457	case GTP_V0:
 458		pktinfo->gtph_port = htons(GTP0_PORT);
 459		gtp0_push_header(skb, pktinfo->pctx);
 460		break;
 461	case GTP_V1:
 462		pktinfo->gtph_port = htons(GTP1U_PORT);
 463		gtp1_push_header(skb, pktinfo->pctx);
 464		break;
 465	}
 466}
 467
 468static inline void gtp_set_pktinfo_ipv4(struct gtp_pktinfo *pktinfo,
 469					struct sock *sk, struct iphdr *iph,
 470					struct pdp_ctx *pctx, struct rtable *rt,
 471					struct flowi4 *fl4,
 472					struct net_device *dev)
 473{
 474	pktinfo->sk	= sk;
 475	pktinfo->iph	= iph;
 476	pktinfo->pctx	= pctx;
 477	pktinfo->rt	= rt;
 478	pktinfo->fl4	= *fl4;
 479	pktinfo->dev	= dev;
 480}
 481
 482static int gtp_build_skb_ip4(struct sk_buff *skb, struct net_device *dev,
 483			     struct gtp_pktinfo *pktinfo)
 484{
 485	struct gtp_dev *gtp = netdev_priv(dev);
 486	struct pdp_ctx *pctx;
 487	struct rtable *rt;
 488	struct flowi4 fl4;
 489	struct iphdr *iph;
 490	__be16 df;
 491	int mtu;
 492
 493	/* Read the IP destination address and resolve the PDP context.
 494	 * Prepend PDP header with TEI/TID from PDP ctx.
 495	 */
 496	iph = ip_hdr(skb);
 497	if (gtp->role == GTP_ROLE_SGSN)
 498		pctx = ipv4_pdp_find(gtp, iph->saddr);
 499	else
 500		pctx = ipv4_pdp_find(gtp, iph->daddr);
 501
 502	if (!pctx) {
 503		netdev_dbg(dev, "no PDP ctx found for %pI4, skip\n",
 504			   &iph->daddr);
 505		return -ENOENT;
 506	}
 507	netdev_dbg(dev, "found PDP context %p\n", pctx);
 508
 509	rt = ip4_route_output_gtp(&fl4, pctx->sk, pctx->peer_addr_ip4.s_addr);
 510	if (IS_ERR(rt)) {
 511		netdev_dbg(dev, "no route to SSGN %pI4\n",
 512			   &pctx->peer_addr_ip4.s_addr);
 513		dev->stats.tx_carrier_errors++;
 514		goto err;
 515	}
 516
 517	if (rt->dst.dev == dev) {
 518		netdev_dbg(dev, "circular route to SSGN %pI4\n",
 519			   &pctx->peer_addr_ip4.s_addr);
 520		dev->stats.collisions++;
 521		goto err_rt;
 522	}
 523
 524	skb_dst_drop(skb);
 525
 526	/* This is similar to tnl_update_pmtu(). */
 527	df = iph->frag_off;
 528	if (df) {
 529		mtu = dst_mtu(&rt->dst) - dev->hard_header_len -
 530			sizeof(struct iphdr) - sizeof(struct udphdr);
 531		switch (pctx->gtp_version) {
 532		case GTP_V0:
 533			mtu -= sizeof(struct gtp0_header);
 534			break;
 535		case GTP_V1:
 536			mtu -= sizeof(struct gtp1_header);
 537			break;
 538		}
 539	} else {
 540		mtu = dst_mtu(&rt->dst);
 541	}
 542
 543	rt->dst.ops->update_pmtu(&rt->dst, NULL, skb, mtu, false);
 544
 545	if (!skb_is_gso(skb) && (iph->frag_off & htons(IP_DF)) &&
 546	    mtu < ntohs(iph->tot_len)) {
 547		netdev_dbg(dev, "packet too big, fragmentation needed\n");
 548		memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
 549		icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
 550			      htonl(mtu));
 551		goto err_rt;
 552	}
 553
 554	gtp_set_pktinfo_ipv4(pktinfo, pctx->sk, iph, pctx, rt, &fl4, dev);
 555	gtp_push_header(skb, pktinfo);
 556
 557	return 0;
 558err_rt:
 559	ip_rt_put(rt);
 560err:
 561	return -EBADMSG;
 562}
 563
 564static netdev_tx_t gtp_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 565{
 566	unsigned int proto = ntohs(skb->protocol);
 567	struct gtp_pktinfo pktinfo;
 568	int err;
 569
 570	/* Ensure there is sufficient headroom. */
 571	if (skb_cow_head(skb, dev->needed_headroom))
 572		goto tx_err;
 573
 574	skb_reset_inner_headers(skb);
 575
 576	/* PDP context lookups in gtp_build_skb_*() need rcu read-side lock. */
 577	rcu_read_lock();
 578	switch (proto) {
 579	case ETH_P_IP:
 580		err = gtp_build_skb_ip4(skb, dev, &pktinfo);
 581		break;
 582	default:
 583		err = -EOPNOTSUPP;
 584		break;
 585	}
 586	rcu_read_unlock();
 587
 588	if (err < 0)
 589		goto tx_err;
 590
 591	switch (proto) {
 592	case ETH_P_IP:
 593		netdev_dbg(pktinfo.dev, "gtp -> IP src: %pI4 dst: %pI4\n",
 594			   &pktinfo.iph->saddr, &pktinfo.iph->daddr);
 595		udp_tunnel_xmit_skb(pktinfo.rt, pktinfo.sk, skb,
 596				    pktinfo.fl4.saddr, pktinfo.fl4.daddr,
 597				    pktinfo.iph->tos,
 598				    ip4_dst_hoplimit(&pktinfo.rt->dst),
 599				    0,
 600				    pktinfo.gtph_port, pktinfo.gtph_port,
 601				    true, false);
 602		break;
 603	}
 604
 605	return NETDEV_TX_OK;
 606tx_err:
 607	dev->stats.tx_errors++;
 608	dev_kfree_skb(skb);
 609	return NETDEV_TX_OK;
 610}
 611
 612static const struct net_device_ops gtp_netdev_ops = {
 613	.ndo_init		= gtp_dev_init,
 614	.ndo_uninit		= gtp_dev_uninit,
 615	.ndo_start_xmit		= gtp_dev_xmit,
 616	.ndo_get_stats64	= ip_tunnel_get_stats64,
 617};
 618
 619static void gtp_link_setup(struct net_device *dev)
 620{
 621	dev->netdev_ops		= &gtp_netdev_ops;
 622	dev->needs_free_netdev	= true;
 623
 624	dev->hard_header_len = 0;
 625	dev->addr_len = 0;
 626
 627	/* Zero header length. */
 628	dev->type = ARPHRD_NONE;
 629	dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
 630
 631	dev->priv_flags	|= IFF_NO_QUEUE;
 632	dev->features	|= NETIF_F_LLTX;
 633	netif_keep_dst(dev);
 634
 635	/* Assume largest header, ie. GTPv0. */
 636	dev->needed_headroom	= LL_MAX_HEADER +
 637				  sizeof(struct iphdr) +
 638				  sizeof(struct udphdr) +
 639				  sizeof(struct gtp0_header);
 640}
 641
 642static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize);
 
 643static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]);
 644
 645static void gtp_destructor(struct net_device *dev)
 646{
 647	struct gtp_dev *gtp = netdev_priv(dev);
 648
 649	kfree(gtp->addr_hash);
 650	kfree(gtp->tid_hash);
 651}
 652
 653static int gtp_newlink(struct net *src_net, struct net_device *dev,
 654		       struct nlattr *tb[], struct nlattr *data[],
 655		       struct netlink_ext_ack *extack)
 656{
 657	struct gtp_dev *gtp;
 658	struct gtp_net *gn;
 659	int hashsize, err;
 660
 661	if (!data[IFLA_GTP_FD0] && !data[IFLA_GTP_FD1])
 662		return -EINVAL;
 663
 664	gtp = netdev_priv(dev);
 665
 666	err = gtp_encap_enable(gtp, data);
 667	if (err < 0)
 668		return err;
 669
 670	if (!data[IFLA_GTP_PDP_HASHSIZE]) {
 671		hashsize = 1024;
 672	} else {
 673		hashsize = nla_get_u32(data[IFLA_GTP_PDP_HASHSIZE]);
 674		if (!hashsize)
 675			hashsize = 1024;
 676	}
 677
 678	err = gtp_hashtable_new(gtp, hashsize);
 679	if (err < 0)
 680		goto out_encap;
 681
 682	err = register_netdevice(dev);
 683	if (err < 0) {
 684		netdev_dbg(dev, "failed to register new netdev %d\n", err);
 685		goto out_hashtable;
 686	}
 687
 688	gn = net_generic(dev_net(dev), gtp_net_id);
 689	list_add_rcu(&gtp->list, &gn->gtp_dev_list);
 690	dev->priv_destructor = gtp_destructor;
 691
 692	netdev_dbg(dev, "registered new GTP interface\n");
 693
 694	return 0;
 695
 696out_hashtable:
 697	kfree(gtp->addr_hash);
 698	kfree(gtp->tid_hash);
 699out_encap:
 700	gtp_encap_disable(gtp);
 701	return err;
 702}
 703
 704static void gtp_dellink(struct net_device *dev, struct list_head *head)
 705{
 706	struct gtp_dev *gtp = netdev_priv(dev);
 707	struct pdp_ctx *pctx;
 708	int i;
 709
 710	for (i = 0; i < gtp->hash_size; i++)
 711		hlist_for_each_entry_rcu(pctx, &gtp->tid_hash[i], hlist_tid)
 712			pdp_context_delete(pctx);
 713
 
 
 714	list_del_rcu(&gtp->list);
 715	unregister_netdevice_queue(dev, head);
 716}
 717
 718static const struct nla_policy gtp_policy[IFLA_GTP_MAX + 1] = {
 719	[IFLA_GTP_FD0]			= { .type = NLA_U32 },
 720	[IFLA_GTP_FD1]			= { .type = NLA_U32 },
 721	[IFLA_GTP_PDP_HASHSIZE]		= { .type = NLA_U32 },
 722	[IFLA_GTP_ROLE]			= { .type = NLA_U32 },
 723};
 724
 725static int gtp_validate(struct nlattr *tb[], struct nlattr *data[],
 726			struct netlink_ext_ack *extack)
 727{
 728	if (!data)
 729		return -EINVAL;
 730
 731	return 0;
 732}
 733
 734static size_t gtp_get_size(const struct net_device *dev)
 735{
 736	return nla_total_size(sizeof(__u32));	/* IFLA_GTP_PDP_HASHSIZE */
 737}
 738
 739static int gtp_fill_info(struct sk_buff *skb, const struct net_device *dev)
 740{
 741	struct gtp_dev *gtp = netdev_priv(dev);
 742
 743	if (nla_put_u32(skb, IFLA_GTP_PDP_HASHSIZE, gtp->hash_size))
 744		goto nla_put_failure;
 745
 746	return 0;
 747
 748nla_put_failure:
 749	return -EMSGSIZE;
 750}
 751
 752static struct rtnl_link_ops gtp_link_ops __read_mostly = {
 753	.kind		= "gtp",
 754	.maxtype	= IFLA_GTP_MAX,
 755	.policy		= gtp_policy,
 756	.priv_size	= sizeof(struct gtp_dev),
 757	.setup		= gtp_link_setup,
 758	.validate	= gtp_validate,
 759	.newlink	= gtp_newlink,
 760	.dellink	= gtp_dellink,
 761	.get_size	= gtp_get_size,
 762	.fill_info	= gtp_fill_info,
 763};
 764
 765static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize)
 766{
 767	int i;
 768
 769	gtp->addr_hash = kmalloc_array(hsize, sizeof(struct hlist_head),
 770				       GFP_KERNEL | __GFP_NOWARN);
 771	if (gtp->addr_hash == NULL)
 772		return -ENOMEM;
 773
 774	gtp->tid_hash = kmalloc_array(hsize, sizeof(struct hlist_head),
 775				      GFP_KERNEL | __GFP_NOWARN);
 776	if (gtp->tid_hash == NULL)
 777		goto err1;
 778
 779	gtp->hash_size = hsize;
 780
 781	for (i = 0; i < hsize; i++) {
 782		INIT_HLIST_HEAD(&gtp->addr_hash[i]);
 783		INIT_HLIST_HEAD(&gtp->tid_hash[i]);
 784	}
 785	return 0;
 786err1:
 787	kfree(gtp->addr_hash);
 788	return -ENOMEM;
 789}
 790
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 791static struct sock *gtp_encap_enable_socket(int fd, int type,
 792					    struct gtp_dev *gtp)
 793{
 794	struct udp_tunnel_sock_cfg tuncfg = {NULL};
 795	struct socket *sock;
 796	struct sock *sk;
 797	int err;
 798
 799	pr_debug("enable gtp on %d, %d\n", fd, type);
 800
 801	sock = sockfd_lookup(fd, &err);
 802	if (!sock) {
 803		pr_debug("gtp socket fd=%d not found\n", fd);
 804		return NULL;
 805	}
 806
 807	sk = sock->sk;
 808	if (sk->sk_protocol != IPPROTO_UDP ||
 809	    sk->sk_type != SOCK_DGRAM ||
 810	    (sk->sk_family != AF_INET && sk->sk_family != AF_INET6)) {
 811		pr_debug("socket fd=%d not UDP\n", fd);
 812		sk = ERR_PTR(-EINVAL);
 813		goto out_sock;
 814	}
 815
 816	lock_sock(sk);
 817	if (sk->sk_user_data) {
 818		sk = ERR_PTR(-EBUSY);
 819		goto out_rel_sock;
 820	}
 821
 
 822	sock_hold(sk);
 823
 824	tuncfg.sk_user_data = gtp;
 825	tuncfg.encap_type = type;
 826	tuncfg.encap_rcv = gtp_encap_recv;
 827	tuncfg.encap_destroy = gtp_encap_destroy;
 828
 829	setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg);
 830
 831out_rel_sock:
 832	release_sock(sock->sk);
 833out_sock:
 834	sockfd_put(sock);
 835	return sk;
 836}
 837
 838static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[])
 839{
 840	struct sock *sk1u = NULL;
 841	struct sock *sk0 = NULL;
 842	unsigned int role = GTP_ROLE_GGSN;
 843
 844	if (data[IFLA_GTP_FD0]) {
 845		u32 fd0 = nla_get_u32(data[IFLA_GTP_FD0]);
 846
 847		sk0 = gtp_encap_enable_socket(fd0, UDP_ENCAP_GTP0, gtp);
 848		if (IS_ERR(sk0))
 849			return PTR_ERR(sk0);
 850	}
 851
 852	if (data[IFLA_GTP_FD1]) {
 853		u32 fd1 = nla_get_u32(data[IFLA_GTP_FD1]);
 854
 855		sk1u = gtp_encap_enable_socket(fd1, UDP_ENCAP_GTP1U, gtp);
 856		if (IS_ERR(sk1u)) {
 857			gtp_encap_disable_sock(sk0);
 
 858			return PTR_ERR(sk1u);
 859		}
 860	}
 861
 862	if (data[IFLA_GTP_ROLE]) {
 863		role = nla_get_u32(data[IFLA_GTP_ROLE]);
 864		if (role > GTP_ROLE_SGSN) {
 865			gtp_encap_disable_sock(sk0);
 866			gtp_encap_disable_sock(sk1u);
 867			return -EINVAL;
 868		}
 869	}
 870
 871	gtp->sk0 = sk0;
 872	gtp->sk1u = sk1u;
 873	gtp->role = role;
 874
 875	return 0;
 876}
 877
 878static struct gtp_dev *gtp_find_dev(struct net *src_net, struct nlattr *nla[])
 879{
 880	struct gtp_dev *gtp = NULL;
 881	struct net_device *dev;
 882	struct net *net;
 883
 884	/* Examine the link attributes and figure out which network namespace
 885	 * we are talking about.
 886	 */
 887	if (nla[GTPA_NET_NS_FD])
 888		net = get_net_ns_by_fd(nla_get_u32(nla[GTPA_NET_NS_FD]));
 889	else
 890		net = get_net(src_net);
 891
 892	if (IS_ERR(net))
 893		return NULL;
 894
 895	/* Check if there's an existing gtpX device to configure */
 896	dev = dev_get_by_index_rcu(net, nla_get_u32(nla[GTPA_LINK]));
 897	if (dev && dev->netdev_ops == &gtp_netdev_ops)
 898		gtp = netdev_priv(dev);
 899
 900	put_net(net);
 901	return gtp;
 902}
 903
 904static void ipv4_pdp_fill(struct pdp_ctx *pctx, struct genl_info *info)
 905{
 906	pctx->gtp_version = nla_get_u32(info->attrs[GTPA_VERSION]);
 907	pctx->af = AF_INET;
 908	pctx->peer_addr_ip4.s_addr =
 909		nla_get_be32(info->attrs[GTPA_PEER_ADDRESS]);
 910	pctx->ms_addr_ip4.s_addr =
 911		nla_get_be32(info->attrs[GTPA_MS_ADDRESS]);
 912
 913	switch (pctx->gtp_version) {
 914	case GTP_V0:
 915		/* According to TS 09.60, sections 7.5.1 and 7.5.2, the flow
 916		 * label needs to be the same for uplink and downlink packets,
 917		 * so let's annotate this.
 918		 */
 919		pctx->u.v0.tid = nla_get_u64(info->attrs[GTPA_TID]);
 920		pctx->u.v0.flow = nla_get_u16(info->attrs[GTPA_FLOW]);
 921		break;
 922	case GTP_V1:
 923		pctx->u.v1.i_tei = nla_get_u32(info->attrs[GTPA_I_TEI]);
 924		pctx->u.v1.o_tei = nla_get_u32(info->attrs[GTPA_O_TEI]);
 925		break;
 926	default:
 927		break;
 928	}
 929}
 930
 931static int gtp_pdp_add(struct gtp_dev *gtp, struct sock *sk,
 932		       struct genl_info *info)
 933{
 934	struct pdp_ctx *pctx, *pctx_tid = NULL;
 935	struct net_device *dev = gtp->dev;
 936	u32 hash_ms, hash_tid = 0;
 937	unsigned int version;
 938	bool found = false;
 939	__be32 ms_addr;
 940
 941	ms_addr = nla_get_be32(info->attrs[GTPA_MS_ADDRESS]);
 942	hash_ms = ipv4_hashfn(ms_addr) % gtp->hash_size;
 943	version = nla_get_u32(info->attrs[GTPA_VERSION]);
 944
 945	pctx = ipv4_pdp_find(gtp, ms_addr);
 946	if (pctx)
 947		found = true;
 948	if (version == GTP_V0)
 949		pctx_tid = gtp0_pdp_find(gtp,
 950					 nla_get_u64(info->attrs[GTPA_TID]));
 951	else if (version == GTP_V1)
 952		pctx_tid = gtp1_pdp_find(gtp,
 953					 nla_get_u32(info->attrs[GTPA_I_TEI]));
 954	if (pctx_tid)
 955		found = true;
 956
 957	if (found) {
 958		if (info->nlhdr->nlmsg_flags & NLM_F_EXCL)
 959			return -EEXIST;
 960		if (info->nlhdr->nlmsg_flags & NLM_F_REPLACE)
 961			return -EOPNOTSUPP;
 962
 963		if (pctx && pctx_tid)
 964			return -EEXIST;
 965		if (!pctx)
 966			pctx = pctx_tid;
 967
 968		ipv4_pdp_fill(pctx, info);
 969
 970		if (pctx->gtp_version == GTP_V0)
 971			netdev_dbg(dev, "GTPv0-U: update tunnel id = %llx (pdp %p)\n",
 972				   pctx->u.v0.tid, pctx);
 973		else if (pctx->gtp_version == GTP_V1)
 974			netdev_dbg(dev, "GTPv1-U: update tunnel id = %x/%x (pdp %p)\n",
 975				   pctx->u.v1.i_tei, pctx->u.v1.o_tei, pctx);
 976
 977		return 0;
 978
 979	}
 980
 981	pctx = kmalloc(sizeof(*pctx), GFP_ATOMIC);
 982	if (pctx == NULL)
 983		return -ENOMEM;
 984
 985	sock_hold(sk);
 986	pctx->sk = sk;
 987	pctx->dev = gtp->dev;
 988	ipv4_pdp_fill(pctx, info);
 989	atomic_set(&pctx->tx_seq, 0);
 990
 991	switch (pctx->gtp_version) {
 992	case GTP_V0:
 993		/* TS 09.60: "The flow label identifies unambiguously a GTP
 994		 * flow.". We use the tid for this instead, I cannot find a
 995		 * situation in which this doesn't unambiguosly identify the
 996		 * PDP context.
 997		 */
 998		hash_tid = gtp0_hashfn(pctx->u.v0.tid) % gtp->hash_size;
 999		break;
1000	case GTP_V1:
1001		hash_tid = gtp1u_hashfn(pctx->u.v1.i_tei) % gtp->hash_size;
1002		break;
1003	}
1004
1005	hlist_add_head_rcu(&pctx->hlist_addr, &gtp->addr_hash[hash_ms]);
1006	hlist_add_head_rcu(&pctx->hlist_tid, &gtp->tid_hash[hash_tid]);
1007
1008	switch (pctx->gtp_version) {
1009	case GTP_V0:
1010		netdev_dbg(dev, "GTPv0-U: new PDP ctx id=%llx ssgn=%pI4 ms=%pI4 (pdp=%p)\n",
1011			   pctx->u.v0.tid, &pctx->peer_addr_ip4,
1012			   &pctx->ms_addr_ip4, pctx);
1013		break;
1014	case GTP_V1:
1015		netdev_dbg(dev, "GTPv1-U: new PDP ctx id=%x/%x ssgn=%pI4 ms=%pI4 (pdp=%p)\n",
1016			   pctx->u.v1.i_tei, pctx->u.v1.o_tei,
1017			   &pctx->peer_addr_ip4, &pctx->ms_addr_ip4, pctx);
1018		break;
1019	}
1020
1021	return 0;
1022}
1023
1024static void pdp_context_free(struct rcu_head *head)
1025{
1026	struct pdp_ctx *pctx = container_of(head, struct pdp_ctx, rcu_head);
1027
1028	sock_put(pctx->sk);
1029	kfree(pctx);
1030}
1031
1032static void pdp_context_delete(struct pdp_ctx *pctx)
1033{
1034	hlist_del_rcu(&pctx->hlist_tid);
1035	hlist_del_rcu(&pctx->hlist_addr);
1036	call_rcu(&pctx->rcu_head, pdp_context_free);
1037}
1038
1039static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info)
1040{
1041	unsigned int version;
1042	struct gtp_dev *gtp;
1043	struct sock *sk;
1044	int err;
1045
1046	if (!info->attrs[GTPA_VERSION] ||
1047	    !info->attrs[GTPA_LINK] ||
1048	    !info->attrs[GTPA_PEER_ADDRESS] ||
1049	    !info->attrs[GTPA_MS_ADDRESS])
1050		return -EINVAL;
1051
1052	version = nla_get_u32(info->attrs[GTPA_VERSION]);
1053
1054	switch (version) {
1055	case GTP_V0:
1056		if (!info->attrs[GTPA_TID] ||
1057		    !info->attrs[GTPA_FLOW])
1058			return -EINVAL;
1059		break;
1060	case GTP_V1:
1061		if (!info->attrs[GTPA_I_TEI] ||
1062		    !info->attrs[GTPA_O_TEI])
1063			return -EINVAL;
1064		break;
1065
1066	default:
1067		return -EINVAL;
1068	}
1069
1070	rtnl_lock();
1071	rcu_read_lock();
1072
1073	gtp = gtp_find_dev(sock_net(skb->sk), info->attrs);
1074	if (!gtp) {
1075		err = -ENODEV;
1076		goto out_unlock;
1077	}
1078
1079	if (version == GTP_V0)
1080		sk = gtp->sk0;
1081	else if (version == GTP_V1)
1082		sk = gtp->sk1u;
1083	else
1084		sk = NULL;
1085
1086	if (!sk) {
1087		err = -ENODEV;
1088		goto out_unlock;
1089	}
1090
1091	err = gtp_pdp_add(gtp, sk, info);
1092
1093out_unlock:
1094	rcu_read_unlock();
1095	rtnl_unlock();
1096	return err;
1097}
1098
1099static struct pdp_ctx *gtp_find_pdp_by_link(struct net *net,
1100					    struct nlattr *nla[])
1101{
1102	struct gtp_dev *gtp;
1103
1104	gtp = gtp_find_dev(net, nla);
1105	if (!gtp)
1106		return ERR_PTR(-ENODEV);
1107
1108	if (nla[GTPA_MS_ADDRESS]) {
1109		__be32 ip = nla_get_be32(nla[GTPA_MS_ADDRESS]);
1110
1111		return ipv4_pdp_find(gtp, ip);
1112	} else if (nla[GTPA_VERSION]) {
1113		u32 gtp_version = nla_get_u32(nla[GTPA_VERSION]);
1114
1115		if (gtp_version == GTP_V0 && nla[GTPA_TID])
1116			return gtp0_pdp_find(gtp, nla_get_u64(nla[GTPA_TID]));
1117		else if (gtp_version == GTP_V1 && nla[GTPA_I_TEI])
1118			return gtp1_pdp_find(gtp, nla_get_u32(nla[GTPA_I_TEI]));
1119	}
1120
1121	return ERR_PTR(-EINVAL);
1122}
1123
1124static struct pdp_ctx *gtp_find_pdp(struct net *net, struct nlattr *nla[])
1125{
1126	struct pdp_ctx *pctx;
1127
1128	if (nla[GTPA_LINK])
1129		pctx = gtp_find_pdp_by_link(net, nla);
1130	else
1131		pctx = ERR_PTR(-EINVAL);
1132
1133	if (!pctx)
1134		pctx = ERR_PTR(-ENOENT);
1135
1136	return pctx;
1137}
1138
1139static int gtp_genl_del_pdp(struct sk_buff *skb, struct genl_info *info)
1140{
1141	struct pdp_ctx *pctx;
1142	int err = 0;
1143
1144	if (!info->attrs[GTPA_VERSION])
1145		return -EINVAL;
1146
1147	rcu_read_lock();
1148
1149	pctx = gtp_find_pdp(sock_net(skb->sk), info->attrs);
1150	if (IS_ERR(pctx)) {
1151		err = PTR_ERR(pctx);
1152		goto out_unlock;
1153	}
1154
1155	if (pctx->gtp_version == GTP_V0)
1156		netdev_dbg(pctx->dev, "GTPv0-U: deleting tunnel id = %llx (pdp %p)\n",
1157			   pctx->u.v0.tid, pctx);
1158	else if (pctx->gtp_version == GTP_V1)
1159		netdev_dbg(pctx->dev, "GTPv1-U: deleting tunnel id = %x/%x (pdp %p)\n",
1160			   pctx->u.v1.i_tei, pctx->u.v1.o_tei, pctx);
1161
1162	pdp_context_delete(pctx);
1163
1164out_unlock:
1165	rcu_read_unlock();
1166	return err;
1167}
1168
1169static struct genl_family gtp_genl_family;
1170
1171static int gtp_genl_fill_info(struct sk_buff *skb, u32 snd_portid, u32 snd_seq,
1172			      int flags, u32 type, struct pdp_ctx *pctx)
1173{
1174	void *genlh;
1175
1176	genlh = genlmsg_put(skb, snd_portid, snd_seq, &gtp_genl_family, flags,
1177			    type);
1178	if (genlh == NULL)
1179		goto nlmsg_failure;
1180
1181	if (nla_put_u32(skb, GTPA_VERSION, pctx->gtp_version) ||
1182	    nla_put_u32(skb, GTPA_LINK, pctx->dev->ifindex) ||
1183	    nla_put_be32(skb, GTPA_PEER_ADDRESS, pctx->peer_addr_ip4.s_addr) ||
1184	    nla_put_be32(skb, GTPA_MS_ADDRESS, pctx->ms_addr_ip4.s_addr))
1185		goto nla_put_failure;
1186
1187	switch (pctx->gtp_version) {
1188	case GTP_V0:
1189		if (nla_put_u64_64bit(skb, GTPA_TID, pctx->u.v0.tid, GTPA_PAD) ||
1190		    nla_put_u16(skb, GTPA_FLOW, pctx->u.v0.flow))
1191			goto nla_put_failure;
1192		break;
1193	case GTP_V1:
1194		if (nla_put_u32(skb, GTPA_I_TEI, pctx->u.v1.i_tei) ||
1195		    nla_put_u32(skb, GTPA_O_TEI, pctx->u.v1.o_tei))
1196			goto nla_put_failure;
1197		break;
1198	}
1199	genlmsg_end(skb, genlh);
1200	return 0;
1201
1202nlmsg_failure:
1203nla_put_failure:
1204	genlmsg_cancel(skb, genlh);
1205	return -EMSGSIZE;
1206}
1207
1208static int gtp_genl_get_pdp(struct sk_buff *skb, struct genl_info *info)
1209{
1210	struct pdp_ctx *pctx = NULL;
1211	struct sk_buff *skb2;
1212	int err;
1213
1214	if (!info->attrs[GTPA_VERSION])
1215		return -EINVAL;
1216
1217	rcu_read_lock();
1218
1219	pctx = gtp_find_pdp(sock_net(skb->sk), info->attrs);
1220	if (IS_ERR(pctx)) {
1221		err = PTR_ERR(pctx);
1222		goto err_unlock;
1223	}
1224
1225	skb2 = genlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
1226	if (skb2 == NULL) {
1227		err = -ENOMEM;
1228		goto err_unlock;
1229	}
1230
1231	err = gtp_genl_fill_info(skb2, NETLINK_CB(skb).portid, info->snd_seq,
1232				 0, info->nlhdr->nlmsg_type, pctx);
1233	if (err < 0)
1234		goto err_unlock_free;
1235
1236	rcu_read_unlock();
1237	return genlmsg_unicast(genl_info_net(info), skb2, info->snd_portid);
1238
1239err_unlock_free:
1240	kfree_skb(skb2);
1241err_unlock:
1242	rcu_read_unlock();
1243	return err;
1244}
1245
1246static int gtp_genl_dump_pdp(struct sk_buff *skb,
1247				struct netlink_callback *cb)
1248{
1249	struct gtp_dev *last_gtp = (struct gtp_dev *)cb->args[2], *gtp;
1250	int i, j, bucket = cb->args[0], skip = cb->args[1];
1251	struct net *net = sock_net(skb->sk);
 
 
 
1252	struct pdp_ctx *pctx;
1253	struct gtp_net *gn;
1254
1255	gn = net_generic(net, gtp_net_id);
1256
1257	if (cb->args[4])
1258		return 0;
1259
1260	rcu_read_lock();
1261	list_for_each_entry_rcu(gtp, &gn->gtp_dev_list, list) {
1262		if (last_gtp && last_gtp != gtp)
1263			continue;
1264		else
1265			last_gtp = NULL;
1266
1267		for (i = bucket; i < gtp->hash_size; i++) {
1268			j = 0;
1269			hlist_for_each_entry_rcu(pctx, &gtp->tid_hash[i],
1270						 hlist_tid) {
1271				if (j >= skip &&
1272				    gtp_genl_fill_info(skb,
1273					    NETLINK_CB(cb->skb).portid,
1274					    cb->nlh->nlmsg_seq,
1275					    NLM_F_MULTI,
1276					    cb->nlh->nlmsg_type, pctx)) {
 
 
1277					cb->args[0] = i;
1278					cb->args[1] = j;
1279					cb->args[2] = (unsigned long)gtp;
1280					goto out;
1281				}
1282				j++;
1283			}
1284			skip = 0;
1285		}
1286		bucket = 0;
1287	}
1288	cb->args[4] = 1;
1289out:
1290	rcu_read_unlock();
1291	return skb->len;
1292}
1293
1294static const struct nla_policy gtp_genl_policy[GTPA_MAX + 1] = {
1295	[GTPA_LINK]		= { .type = NLA_U32, },
1296	[GTPA_VERSION]		= { .type = NLA_U32, },
1297	[GTPA_TID]		= { .type = NLA_U64, },
1298	[GTPA_PEER_ADDRESS]	= { .type = NLA_U32, },
1299	[GTPA_MS_ADDRESS]	= { .type = NLA_U32, },
1300	[GTPA_FLOW]		= { .type = NLA_U16, },
1301	[GTPA_NET_NS_FD]	= { .type = NLA_U32, },
1302	[GTPA_I_TEI]		= { .type = NLA_U32, },
1303	[GTPA_O_TEI]		= { .type = NLA_U32, },
1304};
1305
1306static const struct genl_ops gtp_genl_ops[] = {
1307	{
1308		.cmd = GTP_CMD_NEWPDP,
1309		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1310		.doit = gtp_genl_new_pdp,
 
1311		.flags = GENL_ADMIN_PERM,
1312	},
1313	{
1314		.cmd = GTP_CMD_DELPDP,
1315		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1316		.doit = gtp_genl_del_pdp,
 
1317		.flags = GENL_ADMIN_PERM,
1318	},
1319	{
1320		.cmd = GTP_CMD_GETPDP,
1321		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1322		.doit = gtp_genl_get_pdp,
1323		.dumpit = gtp_genl_dump_pdp,
 
1324		.flags = GENL_ADMIN_PERM,
1325	},
1326};
1327
1328static struct genl_family gtp_genl_family __ro_after_init = {
1329	.name		= "gtp",
1330	.version	= 0,
1331	.hdrsize	= 0,
1332	.maxattr	= GTPA_MAX,
1333	.policy = gtp_genl_policy,
1334	.netnsok	= true,
1335	.module		= THIS_MODULE,
1336	.ops		= gtp_genl_ops,
1337	.n_ops		= ARRAY_SIZE(gtp_genl_ops),
1338};
1339
1340static int __net_init gtp_net_init(struct net *net)
1341{
1342	struct gtp_net *gn = net_generic(net, gtp_net_id);
1343
1344	INIT_LIST_HEAD(&gn->gtp_dev_list);
1345	return 0;
1346}
1347
1348static void __net_exit gtp_net_exit(struct net *net)
1349{
1350	struct gtp_net *gn = net_generic(net, gtp_net_id);
1351	struct gtp_dev *gtp;
1352	LIST_HEAD(list);
1353
1354	rtnl_lock();
1355	list_for_each_entry(gtp, &gn->gtp_dev_list, list)
1356		gtp_dellink(gtp->dev, &list);
1357
1358	unregister_netdevice_many(&list);
1359	rtnl_unlock();
1360}
1361
1362static struct pernet_operations gtp_net_ops = {
1363	.init	= gtp_net_init,
1364	.exit	= gtp_net_exit,
1365	.id	= &gtp_net_id,
1366	.size	= sizeof(struct gtp_net),
1367};
1368
1369static int __init gtp_init(void)
1370{
1371	int err;
1372
1373	get_random_bytes(&gtp_h_initval, sizeof(gtp_h_initval));
1374
1375	err = rtnl_link_register(&gtp_link_ops);
1376	if (err < 0)
1377		goto error_out;
1378
1379	err = genl_register_family(&gtp_genl_family);
1380	if (err < 0)
1381		goto unreg_rtnl_link;
1382
1383	err = register_pernet_subsys(&gtp_net_ops);
1384	if (err < 0)
1385		goto unreg_genl_family;
1386
1387	pr_info("GTP module loaded (pdp ctx size %zd bytes)\n",
1388		sizeof(struct pdp_ctx));
1389	return 0;
1390
1391unreg_genl_family:
1392	genl_unregister_family(&gtp_genl_family);
1393unreg_rtnl_link:
1394	rtnl_link_unregister(&gtp_link_ops);
1395error_out:
1396	pr_err("error loading GTP module loaded\n");
1397	return err;
1398}
1399late_initcall(gtp_init);
1400
1401static void __exit gtp_fini(void)
1402{
 
1403	genl_unregister_family(&gtp_genl_family);
1404	rtnl_link_unregister(&gtp_link_ops);
1405	unregister_pernet_subsys(&gtp_net_ops);
1406
1407	pr_info("GTP module unloaded\n");
1408}
1409module_exit(gtp_fini);
1410
1411MODULE_LICENSE("GPL");
1412MODULE_AUTHOR("Harald Welte <hwelte@sysmocom.de>");
1413MODULE_DESCRIPTION("Interface driver for GTP encapsulated traffic");
1414MODULE_ALIAS_RTNL_LINK("gtp");
1415MODULE_ALIAS_GENL_FAMILY("gtp");