Linux Audio

Check our new training course

Loading...
v5.4
   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/* GTP according to GSM TS 09.60 / 3GPP TS 29.060
   3 *
   4 * (C) 2012-2014 by sysmocom - s.f.m.c. GmbH
   5 * (C) 2016 by Pablo Neira Ayuso <pablo@netfilter.org>
   6 *
   7 * Author: Harald Welte <hwelte@sysmocom.de>
   8 *	   Pablo Neira Ayuso <pablo@netfilter.org>
   9 *	   Andreas Schultz <aschultz@travelping.com>
  10 */
  11
  12#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  13
  14#include <linux/module.h>
  15#include <linux/skbuff.h>
  16#include <linux/udp.h>
  17#include <linux/rculist.h>
  18#include <linux/jhash.h>
  19#include <linux/if_tunnel.h>
  20#include <linux/net.h>
  21#include <linux/file.h>
  22#include <linux/gtp.h>
  23
  24#include <net/net_namespace.h>
  25#include <net/protocol.h>
  26#include <net/ip.h>
  27#include <net/udp.h>
  28#include <net/udp_tunnel.h>
  29#include <net/icmp.h>
  30#include <net/xfrm.h>
  31#include <net/genetlink.h>
  32#include <net/netns/generic.h>
  33#include <net/gtp.h>
  34
  35/* An active session for the subscriber. */
  36struct pdp_ctx {
  37	struct hlist_node	hlist_tid;
  38	struct hlist_node	hlist_addr;
  39
  40	union {
  41		u64		tid;
  42		struct {
  43			u64	tid;
  44			u16	flow;
  45		} v0;
  46		struct {
  47			u32	i_tei;
  48			u32	o_tei;
  49		} v1;
  50	} u;
  51	u8			gtp_version;
  52	u16			af;
  53
  54	struct in_addr		ms_addr_ip4;
  55	struct in_addr		peer_addr_ip4;
  56
  57	struct sock		*sk;
  58	struct net_device       *dev;
  59
  60	atomic_t		tx_seq;
  61	struct rcu_head		rcu_head;
  62};
  63
  64/* One instance of the GTP device. */
  65struct gtp_dev {
  66	struct list_head	list;
  67
  68	struct sock		*sk0;
  69	struct sock		*sk1u;
  70
  71	struct net_device	*dev;
  72
  73	unsigned int		role;
  74	unsigned int		hash_size;
  75	struct hlist_head	*tid_hash;
  76	struct hlist_head	*addr_hash;
  77};
  78
  79static unsigned int gtp_net_id __read_mostly;
  80
  81struct gtp_net {
  82	struct list_head gtp_dev_list;
  83};
  84
  85static u32 gtp_h_initval;
  86
  87static void pdp_context_delete(struct pdp_ctx *pctx);
  88
  89static inline u32 gtp0_hashfn(u64 tid)
  90{
  91	u32 *tid32 = (u32 *) &tid;
  92	return jhash_2words(tid32[0], tid32[1], gtp_h_initval);
  93}
  94
  95static inline u32 gtp1u_hashfn(u32 tid)
  96{
  97	return jhash_1word(tid, gtp_h_initval);
  98}
  99
 100static inline u32 ipv4_hashfn(__be32 ip)
 101{
 102	return jhash_1word((__force u32)ip, gtp_h_initval);
 103}
 104
 105/* Resolve a PDP context structure based on the 64bit TID. */
 106static struct pdp_ctx *gtp0_pdp_find(struct gtp_dev *gtp, u64 tid)
 107{
 108	struct hlist_head *head;
 109	struct pdp_ctx *pdp;
 110
 111	head = &gtp->tid_hash[gtp0_hashfn(tid) % gtp->hash_size];
 112
 113	hlist_for_each_entry_rcu(pdp, head, hlist_tid) {
 114		if (pdp->gtp_version == GTP_V0 &&
 115		    pdp->u.v0.tid == tid)
 116			return pdp;
 117	}
 118	return NULL;
 119}
 120
 121/* Resolve a PDP context structure based on the 32bit TEI. */
 122static struct pdp_ctx *gtp1_pdp_find(struct gtp_dev *gtp, u32 tid)
 123{
 124	struct hlist_head *head;
 125	struct pdp_ctx *pdp;
 126
 127	head = &gtp->tid_hash[gtp1u_hashfn(tid) % gtp->hash_size];
 128
 129	hlist_for_each_entry_rcu(pdp, head, hlist_tid) {
 130		if (pdp->gtp_version == GTP_V1 &&
 131		    pdp->u.v1.i_tei == tid)
 132			return pdp;
 133	}
 134	return NULL;
 135}
 136
 137/* Resolve a PDP context based on IPv4 address of MS. */
 138static struct pdp_ctx *ipv4_pdp_find(struct gtp_dev *gtp, __be32 ms_addr)
 139{
 140	struct hlist_head *head;
 141	struct pdp_ctx *pdp;
 142
 143	head = &gtp->addr_hash[ipv4_hashfn(ms_addr) % gtp->hash_size];
 144
 145	hlist_for_each_entry_rcu(pdp, head, hlist_addr) {
 146		if (pdp->af == AF_INET &&
 147		    pdp->ms_addr_ip4.s_addr == ms_addr)
 148			return pdp;
 149	}
 150
 151	return NULL;
 152}
 153
 154static bool gtp_check_ms_ipv4(struct sk_buff *skb, struct pdp_ctx *pctx,
 155				  unsigned int hdrlen, unsigned int role)
 156{
 157	struct iphdr *iph;
 158
 159	if (!pskb_may_pull(skb, hdrlen + sizeof(struct iphdr)))
 160		return false;
 161
 162	iph = (struct iphdr *)(skb->data + hdrlen);
 163
 164	if (role == GTP_ROLE_SGSN)
 165		return iph->daddr == pctx->ms_addr_ip4.s_addr;
 166	else
 167		return iph->saddr == pctx->ms_addr_ip4.s_addr;
 168}
 169
 170/* Check if the inner IP address in this packet is assigned to any
 171 * existing mobile subscriber.
 172 */
 173static bool gtp_check_ms(struct sk_buff *skb, struct pdp_ctx *pctx,
 174			     unsigned int hdrlen, unsigned int role)
 175{
 176	switch (ntohs(skb->protocol)) {
 177	case ETH_P_IP:
 178		return gtp_check_ms_ipv4(skb, pctx, hdrlen, role);
 179	}
 180	return false;
 181}
 182
 183static int gtp_rx(struct pdp_ctx *pctx, struct sk_buff *skb,
 184			unsigned int hdrlen, unsigned int role)
 185{
 186	struct pcpu_sw_netstats *stats;
 187
 188	if (!gtp_check_ms(skb, pctx, hdrlen, role)) {
 189		netdev_dbg(pctx->dev, "No PDP ctx for this MS\n");
 190		return 1;
 191	}
 192
 193	/* Get rid of the GTP + UDP headers. */
 194	if (iptunnel_pull_header(skb, hdrlen, skb->protocol,
 195				 !net_eq(sock_net(pctx->sk), dev_net(pctx->dev))))
 196		return -1;
 197
 198	netdev_dbg(pctx->dev, "forwarding packet from GGSN to uplink\n");
 199
 200	/* Now that the UDP and the GTP header have been removed, set up the
 201	 * new network header. This is required by the upper layer to
 202	 * calculate the transport header.
 203	 */
 204	skb_reset_network_header(skb);
 205
 206	skb->dev = pctx->dev;
 207
 208	stats = this_cpu_ptr(pctx->dev->tstats);
 209	u64_stats_update_begin(&stats->syncp);
 210	stats->rx_packets++;
 211	stats->rx_bytes += skb->len;
 212	u64_stats_update_end(&stats->syncp);
 213
 214	netif_rx(skb);
 215	return 0;
 216}
 217
 218/* 1 means pass up to the stack, -1 means drop and 0 means decapsulated. */
 219static int gtp0_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb)
 220{
 221	unsigned int hdrlen = sizeof(struct udphdr) +
 222			      sizeof(struct gtp0_header);
 223	struct gtp0_header *gtp0;
 224	struct pdp_ctx *pctx;
 225
 226	if (!pskb_may_pull(skb, hdrlen))
 227		return -1;
 228
 229	gtp0 = (struct gtp0_header *)(skb->data + sizeof(struct udphdr));
 230
 231	if ((gtp0->flags >> 5) != GTP_V0)
 232		return 1;
 233
 234	if (gtp0->type != GTP_TPDU)
 235		return 1;
 236
 237	pctx = gtp0_pdp_find(gtp, be64_to_cpu(gtp0->tid));
 238	if (!pctx) {
 239		netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb);
 240		return 1;
 241	}
 242
 243	return gtp_rx(pctx, skb, hdrlen, gtp->role);
 244}
 245
 246static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb)
 247{
 248	unsigned int hdrlen = sizeof(struct udphdr) +
 249			      sizeof(struct gtp1_header);
 250	struct gtp1_header *gtp1;
 251	struct pdp_ctx *pctx;
 252
 253	if (!pskb_may_pull(skb, hdrlen))
 254		return -1;
 255
 256	gtp1 = (struct gtp1_header *)(skb->data + sizeof(struct udphdr));
 257
 258	if ((gtp1->flags >> 5) != GTP_V1)
 259		return 1;
 260
 261	if (gtp1->type != GTP_TPDU)
 262		return 1;
 263
 264	/* From 29.060: "This field shall be present if and only if any one or
 265	 * more of the S, PN and E flags are set.".
 266	 *
 267	 * If any of the bit is set, then the remaining ones also have to be
 268	 * set.
 269	 */
 270	if (gtp1->flags & GTP1_F_MASK)
 271		hdrlen += 4;
 272
 273	/* Make sure the header is larger enough, including extensions. */
 274	if (!pskb_may_pull(skb, hdrlen))
 275		return -1;
 276
 277	gtp1 = (struct gtp1_header *)(skb->data + sizeof(struct udphdr));
 278
 279	pctx = gtp1_pdp_find(gtp, ntohl(gtp1->tid));
 280	if (!pctx) {
 281		netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb);
 282		return 1;
 283	}
 284
 285	return gtp_rx(pctx, skb, hdrlen, gtp->role);
 286}
 287
 288static void __gtp_encap_destroy(struct sock *sk)
 289{
 290	struct gtp_dev *gtp;
 291
 292	lock_sock(sk);
 293	gtp = sk->sk_user_data;
 294	if (gtp) {
 295		if (gtp->sk0 == sk)
 296			gtp->sk0 = NULL;
 297		else
 298			gtp->sk1u = NULL;
 299		udp_sk(sk)->encap_type = 0;
 300		rcu_assign_sk_user_data(sk, NULL);
 301		sock_put(sk);
 302	}
 303	release_sock(sk);
 304}
 305
 306static void gtp_encap_destroy(struct sock *sk)
 307{
 308	rtnl_lock();
 309	__gtp_encap_destroy(sk);
 310	rtnl_unlock();
 311}
 312
 313static void gtp_encap_disable_sock(struct sock *sk)
 314{
 315	if (!sk)
 316		return;
 317
 318	__gtp_encap_destroy(sk);
 319}
 320
 321static void gtp_encap_disable(struct gtp_dev *gtp)
 322{
 323	gtp_encap_disable_sock(gtp->sk0);
 324	gtp_encap_disable_sock(gtp->sk1u);
 325}
 326
 327/* UDP encapsulation receive handler. See net/ipv4/udp.c.
 328 * Return codes: 0: success, <0: error, >0: pass up to userspace UDP socket.
 329 */
 330static int gtp_encap_recv(struct sock *sk, struct sk_buff *skb)
 331{
 332	struct gtp_dev *gtp;
 333	int ret = 0;
 334
 335	gtp = rcu_dereference_sk_user_data(sk);
 336	if (!gtp)
 337		return 1;
 338
 339	netdev_dbg(gtp->dev, "encap_recv sk=%p\n", sk);
 340
 341	switch (udp_sk(sk)->encap_type) {
 342	case UDP_ENCAP_GTP0:
 343		netdev_dbg(gtp->dev, "received GTP0 packet\n");
 344		ret = gtp0_udp_encap_recv(gtp, skb);
 345		break;
 346	case UDP_ENCAP_GTP1U:
 347		netdev_dbg(gtp->dev, "received GTP1U packet\n");
 348		ret = gtp1u_udp_encap_recv(gtp, skb);
 349		break;
 350	default:
 351		ret = -1; /* Shouldn't happen. */
 352	}
 353
 354	switch (ret) {
 355	case 1:
 356		netdev_dbg(gtp->dev, "pass up to the process\n");
 357		break;
 358	case 0:
 359		break;
 360	case -1:
 361		netdev_dbg(gtp->dev, "GTP packet has been dropped\n");
 362		kfree_skb(skb);
 363		ret = 0;
 364		break;
 365	}
 366
 367	return ret;
 368}
 369
 370static int gtp_dev_init(struct net_device *dev)
 371{
 372	struct gtp_dev *gtp = netdev_priv(dev);
 373
 374	gtp->dev = dev;
 375
 376	dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
 377	if (!dev->tstats)
 378		return -ENOMEM;
 379
 380	return 0;
 381}
 382
 383static void gtp_dev_uninit(struct net_device *dev)
 384{
 385	struct gtp_dev *gtp = netdev_priv(dev);
 386
 387	gtp_encap_disable(gtp);
 388	free_percpu(dev->tstats);
 389}
 390
 391static struct rtable *ip4_route_output_gtp(struct flowi4 *fl4,
 392					   const struct sock *sk,
 393					   __be32 daddr)
 394{
 395	memset(fl4, 0, sizeof(*fl4));
 396	fl4->flowi4_oif		= sk->sk_bound_dev_if;
 397	fl4->daddr		= daddr;
 398	fl4->saddr		= inet_sk(sk)->inet_saddr;
 399	fl4->flowi4_tos		= RT_CONN_FLAGS(sk);
 400	fl4->flowi4_proto	= sk->sk_protocol;
 401
 402	return ip_route_output_key(sock_net(sk), fl4);
 403}
 404
 405static inline void gtp0_push_header(struct sk_buff *skb, struct pdp_ctx *pctx)
 406{
 407	int payload_len = skb->len;
 408	struct gtp0_header *gtp0;
 409
 410	gtp0 = skb_push(skb, sizeof(*gtp0));
 411
 412	gtp0->flags	= 0x1e; /* v0, GTP-non-prime. */
 413	gtp0->type	= GTP_TPDU;
 414	gtp0->length	= htons(payload_len);
 415	gtp0->seq	= htons((atomic_inc_return(&pctx->tx_seq) - 1) % 0xffff);
 416	gtp0->flow	= htons(pctx->u.v0.flow);
 417	gtp0->number	= 0xff;
 418	gtp0->spare[0]	= gtp0->spare[1] = gtp0->spare[2] = 0xff;
 419	gtp0->tid	= cpu_to_be64(pctx->u.v0.tid);
 420}
 421
 422static inline void gtp1_push_header(struct sk_buff *skb, struct pdp_ctx *pctx)
 423{
 424	int payload_len = skb->len;
 425	struct gtp1_header *gtp1;
 426
 427	gtp1 = skb_push(skb, sizeof(*gtp1));
 428
 429	/* Bits    8  7  6  5  4  3  2	1
 430	 *	  +--+--+--+--+--+--+--+--+
 431	 *	  |version |PT| 0| E| S|PN|
 432	 *	  +--+--+--+--+--+--+--+--+
 433	 *	    0  0  1  1	1  0  0  0
 434	 */
 435	gtp1->flags	= 0x30; /* v1, GTP-non-prime. */
 436	gtp1->type	= GTP_TPDU;
 437	gtp1->length	= htons(payload_len);
 438	gtp1->tid	= htonl(pctx->u.v1.o_tei);
 439
 440	/* TODO: Suppport for extension header, sequence number and N-PDU.
 441	 *	 Update the length field if any of them is available.
 442	 */
 443}
 444
 445struct gtp_pktinfo {
 446	struct sock		*sk;
 447	struct iphdr		*iph;
 448	struct flowi4		fl4;
 449	struct rtable		*rt;
 450	struct pdp_ctx		*pctx;
 451	struct net_device	*dev;
 452	__be16			gtph_port;
 453};
 454
 455static void gtp_push_header(struct sk_buff *skb, struct gtp_pktinfo *pktinfo)
 456{
 457	switch (pktinfo->pctx->gtp_version) {
 458	case GTP_V0:
 459		pktinfo->gtph_port = htons(GTP0_PORT);
 460		gtp0_push_header(skb, pktinfo->pctx);
 461		break;
 462	case GTP_V1:
 463		pktinfo->gtph_port = htons(GTP1U_PORT);
 464		gtp1_push_header(skb, pktinfo->pctx);
 465		break;
 466	}
 467}
 468
 469static inline void gtp_set_pktinfo_ipv4(struct gtp_pktinfo *pktinfo,
 470					struct sock *sk, struct iphdr *iph,
 471					struct pdp_ctx *pctx, struct rtable *rt,
 472					struct flowi4 *fl4,
 473					struct net_device *dev)
 474{
 475	pktinfo->sk	= sk;
 476	pktinfo->iph	= iph;
 477	pktinfo->pctx	= pctx;
 478	pktinfo->rt	= rt;
 479	pktinfo->fl4	= *fl4;
 480	pktinfo->dev	= dev;
 481}
 482
 483static int gtp_build_skb_ip4(struct sk_buff *skb, struct net_device *dev,
 484			     struct gtp_pktinfo *pktinfo)
 485{
 486	struct gtp_dev *gtp = netdev_priv(dev);
 487	struct pdp_ctx *pctx;
 488	struct rtable *rt;
 489	struct flowi4 fl4;
 490	struct iphdr *iph;
 491	__be16 df;
 492	int mtu;
 493
 494	/* Read the IP destination address and resolve the PDP context.
 495	 * Prepend PDP header with TEI/TID from PDP ctx.
 496	 */
 497	iph = ip_hdr(skb);
 498	if (gtp->role == GTP_ROLE_SGSN)
 499		pctx = ipv4_pdp_find(gtp, iph->saddr);
 500	else
 501		pctx = ipv4_pdp_find(gtp, iph->daddr);
 502
 503	if (!pctx) {
 504		netdev_dbg(dev, "no PDP ctx found for %pI4, skip\n",
 505			   &iph->daddr);
 506		return -ENOENT;
 507	}
 508	netdev_dbg(dev, "found PDP context %p\n", pctx);
 509
 510	rt = ip4_route_output_gtp(&fl4, pctx->sk, pctx->peer_addr_ip4.s_addr);
 511	if (IS_ERR(rt)) {
 512		netdev_dbg(dev, "no route to SSGN %pI4\n",
 513			   &pctx->peer_addr_ip4.s_addr);
 514		dev->stats.tx_carrier_errors++;
 515		goto err;
 516	}
 517
 518	if (rt->dst.dev == dev) {
 519		netdev_dbg(dev, "circular route to SSGN %pI4\n",
 520			   &pctx->peer_addr_ip4.s_addr);
 521		dev->stats.collisions++;
 522		goto err_rt;
 523	}
 524
 525	skb_dst_drop(skb);
 526
 527	/* This is similar to tnl_update_pmtu(). */
 528	df = iph->frag_off;
 529	if (df) {
 530		mtu = dst_mtu(&rt->dst) - dev->hard_header_len -
 531			sizeof(struct iphdr) - sizeof(struct udphdr);
 532		switch (pctx->gtp_version) {
 533		case GTP_V0:
 534			mtu -= sizeof(struct gtp0_header);
 535			break;
 536		case GTP_V1:
 537			mtu -= sizeof(struct gtp1_header);
 538			break;
 539		}
 540	} else {
 541		mtu = dst_mtu(&rt->dst);
 542	}
 543
 544	rt->dst.ops->update_pmtu(&rt->dst, NULL, skb, mtu);
 545
 546	if (!skb_is_gso(skb) && (iph->frag_off & htons(IP_DF)) &&
 547	    mtu < ntohs(iph->tot_len)) {
 548		netdev_dbg(dev, "packet too big, fragmentation needed\n");
 549		memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
 550		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
 551			  htonl(mtu));
 552		goto err_rt;
 553	}
 554
 555	gtp_set_pktinfo_ipv4(pktinfo, pctx->sk, iph, pctx, rt, &fl4, dev);
 556	gtp_push_header(skb, pktinfo);
 557
 558	return 0;
 559err_rt:
 560	ip_rt_put(rt);
 561err:
 562	return -EBADMSG;
 563}
 564
 565static netdev_tx_t gtp_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 566{
 567	unsigned int proto = ntohs(skb->protocol);
 568	struct gtp_pktinfo pktinfo;
 569	int err;
 570
 571	/* Ensure there is sufficient headroom. */
 572	if (skb_cow_head(skb, dev->needed_headroom))
 573		goto tx_err;
 574
 575	skb_reset_inner_headers(skb);
 576
 577	/* PDP context lookups in gtp_build_skb_*() need rcu read-side lock. */
 578	rcu_read_lock();
 579	switch (proto) {
 580	case ETH_P_IP:
 581		err = gtp_build_skb_ip4(skb, dev, &pktinfo);
 582		break;
 583	default:
 584		err = -EOPNOTSUPP;
 585		break;
 586	}
 587	rcu_read_unlock();
 588
 589	if (err < 0)
 590		goto tx_err;
 591
 592	switch (proto) {
 593	case ETH_P_IP:
 594		netdev_dbg(pktinfo.dev, "gtp -> IP src: %pI4 dst: %pI4\n",
 595			   &pktinfo.iph->saddr, &pktinfo.iph->daddr);
 596		udp_tunnel_xmit_skb(pktinfo.rt, pktinfo.sk, skb,
 597				    pktinfo.fl4.saddr, pktinfo.fl4.daddr,
 598				    pktinfo.iph->tos,
 599				    ip4_dst_hoplimit(&pktinfo.rt->dst),
 600				    0,
 601				    pktinfo.gtph_port, pktinfo.gtph_port,
 602				    true, false);
 603		break;
 604	}
 605
 606	return NETDEV_TX_OK;
 607tx_err:
 608	dev->stats.tx_errors++;
 609	dev_kfree_skb(skb);
 610	return NETDEV_TX_OK;
 611}
 612
 613static const struct net_device_ops gtp_netdev_ops = {
 614	.ndo_init		= gtp_dev_init,
 615	.ndo_uninit		= gtp_dev_uninit,
 616	.ndo_start_xmit		= gtp_dev_xmit,
 617	.ndo_get_stats64	= ip_tunnel_get_stats64,
 618};
 619
 620static void gtp_link_setup(struct net_device *dev)
 621{
 622	dev->netdev_ops		= &gtp_netdev_ops;
 623	dev->needs_free_netdev	= true;
 624
 625	dev->hard_header_len = 0;
 626	dev->addr_len = 0;
 627
 628	/* Zero header length. */
 629	dev->type = ARPHRD_NONE;
 630	dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
 631
 632	dev->priv_flags	|= IFF_NO_QUEUE;
 633	dev->features	|= NETIF_F_LLTX;
 634	netif_keep_dst(dev);
 635
 636	/* Assume largest header, ie. GTPv0. */
 637	dev->needed_headroom	= LL_MAX_HEADER +
 638				  sizeof(struct iphdr) +
 639				  sizeof(struct udphdr) +
 640				  sizeof(struct gtp0_header);
 641}
 642
 643static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize);
 644static void gtp_hashtable_free(struct gtp_dev *gtp);
 645static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]);
 646
 
 
 
 
 
 
 
 
 647static int gtp_newlink(struct net *src_net, struct net_device *dev,
 648		       struct nlattr *tb[], struct nlattr *data[],
 649		       struct netlink_ext_ack *extack)
 650{
 651	struct gtp_dev *gtp;
 652	struct gtp_net *gn;
 653	int hashsize, err;
 654
 655	if (!data[IFLA_GTP_FD0] && !data[IFLA_GTP_FD1])
 656		return -EINVAL;
 657
 658	gtp = netdev_priv(dev);
 659
 660	err = gtp_encap_enable(gtp, data);
 661	if (err < 0)
 662		return err;
 663
 664	if (!data[IFLA_GTP_PDP_HASHSIZE])
 665		hashsize = 1024;
 666	else
 667		hashsize = nla_get_u32(data[IFLA_GTP_PDP_HASHSIZE]);
 
 
 
 668
 669	err = gtp_hashtable_new(gtp, hashsize);
 670	if (err < 0)
 671		goto out_encap;
 672
 673	err = register_netdevice(dev);
 674	if (err < 0) {
 675		netdev_dbg(dev, "failed to register new netdev %d\n", err);
 676		goto out_hashtable;
 677	}
 678
 679	gn = net_generic(dev_net(dev), gtp_net_id);
 680	list_add_rcu(&gtp->list, &gn->gtp_dev_list);
 
 681
 682	netdev_dbg(dev, "registered new GTP interface\n");
 683
 684	return 0;
 685
 686out_hashtable:
 687	gtp_hashtable_free(gtp);
 
 688out_encap:
 689	gtp_encap_disable(gtp);
 690	return err;
 691}
 692
 693static void gtp_dellink(struct net_device *dev, struct list_head *head)
 694{
 695	struct gtp_dev *gtp = netdev_priv(dev);
 
 
 
 
 
 
 696
 697	gtp_hashtable_free(gtp);
 698	list_del_rcu(&gtp->list);
 699	unregister_netdevice_queue(dev, head);
 700}
 701
 702static const struct nla_policy gtp_policy[IFLA_GTP_MAX + 1] = {
 703	[IFLA_GTP_FD0]			= { .type = NLA_U32 },
 704	[IFLA_GTP_FD1]			= { .type = NLA_U32 },
 705	[IFLA_GTP_PDP_HASHSIZE]		= { .type = NLA_U32 },
 706	[IFLA_GTP_ROLE]			= { .type = NLA_U32 },
 707};
 708
 709static int gtp_validate(struct nlattr *tb[], struct nlattr *data[],
 710			struct netlink_ext_ack *extack)
 711{
 712	if (!data)
 713		return -EINVAL;
 714
 715	return 0;
 716}
 717
 718static size_t gtp_get_size(const struct net_device *dev)
 719{
 720	return nla_total_size(sizeof(__u32));	/* IFLA_GTP_PDP_HASHSIZE */
 721}
 722
 723static int gtp_fill_info(struct sk_buff *skb, const struct net_device *dev)
 724{
 725	struct gtp_dev *gtp = netdev_priv(dev);
 726
 727	if (nla_put_u32(skb, IFLA_GTP_PDP_HASHSIZE, gtp->hash_size))
 728		goto nla_put_failure;
 729
 730	return 0;
 731
 732nla_put_failure:
 733	return -EMSGSIZE;
 734}
 735
 736static struct rtnl_link_ops gtp_link_ops __read_mostly = {
 737	.kind		= "gtp",
 738	.maxtype	= IFLA_GTP_MAX,
 739	.policy		= gtp_policy,
 740	.priv_size	= sizeof(struct gtp_dev),
 741	.setup		= gtp_link_setup,
 742	.validate	= gtp_validate,
 743	.newlink	= gtp_newlink,
 744	.dellink	= gtp_dellink,
 745	.get_size	= gtp_get_size,
 746	.fill_info	= gtp_fill_info,
 747};
 748
 749static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize)
 750{
 751	int i;
 752
 753	gtp->addr_hash = kmalloc_array(hsize, sizeof(struct hlist_head),
 754				       GFP_KERNEL);
 755	if (gtp->addr_hash == NULL)
 756		return -ENOMEM;
 757
 758	gtp->tid_hash = kmalloc_array(hsize, sizeof(struct hlist_head),
 759				      GFP_KERNEL);
 760	if (gtp->tid_hash == NULL)
 761		goto err1;
 762
 763	gtp->hash_size = hsize;
 764
 765	for (i = 0; i < hsize; i++) {
 766		INIT_HLIST_HEAD(&gtp->addr_hash[i]);
 767		INIT_HLIST_HEAD(&gtp->tid_hash[i]);
 768	}
 769	return 0;
 770err1:
 771	kfree(gtp->addr_hash);
 772	return -ENOMEM;
 773}
 774
 775static void gtp_hashtable_free(struct gtp_dev *gtp)
 776{
 777	struct pdp_ctx *pctx;
 778	int i;
 779
 780	for (i = 0; i < gtp->hash_size; i++)
 781		hlist_for_each_entry_rcu(pctx, &gtp->tid_hash[i], hlist_tid)
 782			pdp_context_delete(pctx);
 783
 784	synchronize_rcu();
 785	kfree(gtp->addr_hash);
 786	kfree(gtp->tid_hash);
 787}
 788
 789static struct sock *gtp_encap_enable_socket(int fd, int type,
 790					    struct gtp_dev *gtp)
 791{
 792	struct udp_tunnel_sock_cfg tuncfg = {NULL};
 793	struct socket *sock;
 794	struct sock *sk;
 795	int err;
 796
 797	pr_debug("enable gtp on %d, %d\n", fd, type);
 798
 799	sock = sockfd_lookup(fd, &err);
 800	if (!sock) {
 801		pr_debug("gtp socket fd=%d not found\n", fd);
 802		return NULL;
 803	}
 804
 805	if (sock->sk->sk_protocol != IPPROTO_UDP) {
 
 
 
 806		pr_debug("socket fd=%d not UDP\n", fd);
 807		sk = ERR_PTR(-EINVAL);
 808		goto out_sock;
 809	}
 810
 811	lock_sock(sock->sk);
 812	if (sock->sk->sk_user_data) {
 813		sk = ERR_PTR(-EBUSY);
 814		goto out_sock;
 815	}
 816
 817	sk = sock->sk;
 818	sock_hold(sk);
 819
 820	tuncfg.sk_user_data = gtp;
 821	tuncfg.encap_type = type;
 822	tuncfg.encap_rcv = gtp_encap_recv;
 823	tuncfg.encap_destroy = gtp_encap_destroy;
 824
 825	setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg);
 826
 827out_sock:
 828	release_sock(sock->sk);
 
 829	sockfd_put(sock);
 830	return sk;
 831}
 832
 833static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[])
 834{
 835	struct sock *sk1u = NULL;
 836	struct sock *sk0 = NULL;
 837	unsigned int role = GTP_ROLE_GGSN;
 838
 839	if (data[IFLA_GTP_FD0]) {
 840		u32 fd0 = nla_get_u32(data[IFLA_GTP_FD0]);
 841
 842		sk0 = gtp_encap_enable_socket(fd0, UDP_ENCAP_GTP0, gtp);
 843		if (IS_ERR(sk0))
 844			return PTR_ERR(sk0);
 845	}
 846
 847	if (data[IFLA_GTP_FD1]) {
 848		u32 fd1 = nla_get_u32(data[IFLA_GTP_FD1]);
 849
 850		sk1u = gtp_encap_enable_socket(fd1, UDP_ENCAP_GTP1U, gtp);
 851		if (IS_ERR(sk1u)) {
 852			if (sk0)
 853				gtp_encap_disable_sock(sk0);
 854			return PTR_ERR(sk1u);
 855		}
 856	}
 857
 858	if (data[IFLA_GTP_ROLE]) {
 859		role = nla_get_u32(data[IFLA_GTP_ROLE]);
 860		if (role > GTP_ROLE_SGSN) {
 861			if (sk0)
 862				gtp_encap_disable_sock(sk0);
 863			if (sk1u)
 864				gtp_encap_disable_sock(sk1u);
 865			return -EINVAL;
 866		}
 867	}
 868
 869	gtp->sk0 = sk0;
 870	gtp->sk1u = sk1u;
 871	gtp->role = role;
 872
 873	return 0;
 874}
 875
 876static struct gtp_dev *gtp_find_dev(struct net *src_net, struct nlattr *nla[])
 877{
 878	struct gtp_dev *gtp = NULL;
 879	struct net_device *dev;
 880	struct net *net;
 881
 882	/* Examine the link attributes and figure out which network namespace
 883	 * we are talking about.
 884	 */
 885	if (nla[GTPA_NET_NS_FD])
 886		net = get_net_ns_by_fd(nla_get_u32(nla[GTPA_NET_NS_FD]));
 887	else
 888		net = get_net(src_net);
 889
 890	if (IS_ERR(net))
 891		return NULL;
 892
 893	/* Check if there's an existing gtpX device to configure */
 894	dev = dev_get_by_index_rcu(net, nla_get_u32(nla[GTPA_LINK]));
 895	if (dev && dev->netdev_ops == &gtp_netdev_ops)
 896		gtp = netdev_priv(dev);
 897
 898	put_net(net);
 899	return gtp;
 900}
 901
 902static void ipv4_pdp_fill(struct pdp_ctx *pctx, struct genl_info *info)
 903{
 904	pctx->gtp_version = nla_get_u32(info->attrs[GTPA_VERSION]);
 905	pctx->af = AF_INET;
 906	pctx->peer_addr_ip4.s_addr =
 907		nla_get_be32(info->attrs[GTPA_PEER_ADDRESS]);
 908	pctx->ms_addr_ip4.s_addr =
 909		nla_get_be32(info->attrs[GTPA_MS_ADDRESS]);
 910
 911	switch (pctx->gtp_version) {
 912	case GTP_V0:
 913		/* According to TS 09.60, sections 7.5.1 and 7.5.2, the flow
 914		 * label needs to be the same for uplink and downlink packets,
 915		 * so let's annotate this.
 916		 */
 917		pctx->u.v0.tid = nla_get_u64(info->attrs[GTPA_TID]);
 918		pctx->u.v0.flow = nla_get_u16(info->attrs[GTPA_FLOW]);
 919		break;
 920	case GTP_V1:
 921		pctx->u.v1.i_tei = nla_get_u32(info->attrs[GTPA_I_TEI]);
 922		pctx->u.v1.o_tei = nla_get_u32(info->attrs[GTPA_O_TEI]);
 923		break;
 924	default:
 925		break;
 926	}
 927}
 928
 929static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk,
 930			struct genl_info *info)
 931{
 
 932	struct net_device *dev = gtp->dev;
 933	u32 hash_ms, hash_tid = 0;
 934	struct pdp_ctx *pctx;
 935	bool found = false;
 936	__be32 ms_addr;
 937
 938	ms_addr = nla_get_be32(info->attrs[GTPA_MS_ADDRESS]);
 939	hash_ms = ipv4_hashfn(ms_addr) % gtp->hash_size;
 
 940
 941	hlist_for_each_entry_rcu(pctx, &gtp->addr_hash[hash_ms], hlist_addr) {
 942		if (pctx->ms_addr_ip4.s_addr == ms_addr) {
 943			found = true;
 944			break;
 945		}
 946	}
 
 
 
 
 
 947
 948	if (found) {
 949		if (info->nlhdr->nlmsg_flags & NLM_F_EXCL)
 950			return -EEXIST;
 951		if (info->nlhdr->nlmsg_flags & NLM_F_REPLACE)
 952			return -EOPNOTSUPP;
 953
 
 
 
 
 
 954		ipv4_pdp_fill(pctx, info);
 955
 956		if (pctx->gtp_version == GTP_V0)
 957			netdev_dbg(dev, "GTPv0-U: update tunnel id = %llx (pdp %p)\n",
 958				   pctx->u.v0.tid, pctx);
 959		else if (pctx->gtp_version == GTP_V1)
 960			netdev_dbg(dev, "GTPv1-U: update tunnel id = %x/%x (pdp %p)\n",
 961				   pctx->u.v1.i_tei, pctx->u.v1.o_tei, pctx);
 962
 963		return 0;
 964
 965	}
 966
 967	pctx = kmalloc(sizeof(*pctx), GFP_ATOMIC);
 968	if (pctx == NULL)
 969		return -ENOMEM;
 970
 971	sock_hold(sk);
 972	pctx->sk = sk;
 973	pctx->dev = gtp->dev;
 974	ipv4_pdp_fill(pctx, info);
 975	atomic_set(&pctx->tx_seq, 0);
 976
 977	switch (pctx->gtp_version) {
 978	case GTP_V0:
 979		/* TS 09.60: "The flow label identifies unambiguously a GTP
 980		 * flow.". We use the tid for this instead, I cannot find a
 981		 * situation in which this doesn't unambiguosly identify the
 982		 * PDP context.
 983		 */
 984		hash_tid = gtp0_hashfn(pctx->u.v0.tid) % gtp->hash_size;
 985		break;
 986	case GTP_V1:
 987		hash_tid = gtp1u_hashfn(pctx->u.v1.i_tei) % gtp->hash_size;
 988		break;
 989	}
 990
 991	hlist_add_head_rcu(&pctx->hlist_addr, &gtp->addr_hash[hash_ms]);
 992	hlist_add_head_rcu(&pctx->hlist_tid, &gtp->tid_hash[hash_tid]);
 993
 994	switch (pctx->gtp_version) {
 995	case GTP_V0:
 996		netdev_dbg(dev, "GTPv0-U: new PDP ctx id=%llx ssgn=%pI4 ms=%pI4 (pdp=%p)\n",
 997			   pctx->u.v0.tid, &pctx->peer_addr_ip4,
 998			   &pctx->ms_addr_ip4, pctx);
 999		break;
1000	case GTP_V1:
1001		netdev_dbg(dev, "GTPv1-U: new PDP ctx id=%x/%x ssgn=%pI4 ms=%pI4 (pdp=%p)\n",
1002			   pctx->u.v1.i_tei, pctx->u.v1.o_tei,
1003			   &pctx->peer_addr_ip4, &pctx->ms_addr_ip4, pctx);
1004		break;
1005	}
1006
1007	return 0;
1008}
1009
1010static void pdp_context_free(struct rcu_head *head)
1011{
1012	struct pdp_ctx *pctx = container_of(head, struct pdp_ctx, rcu_head);
1013
1014	sock_put(pctx->sk);
1015	kfree(pctx);
1016}
1017
1018static void pdp_context_delete(struct pdp_ctx *pctx)
1019{
1020	hlist_del_rcu(&pctx->hlist_tid);
1021	hlist_del_rcu(&pctx->hlist_addr);
1022	call_rcu(&pctx->rcu_head, pdp_context_free);
1023}
1024
1025static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info)
1026{
1027	unsigned int version;
1028	struct gtp_dev *gtp;
1029	struct sock *sk;
1030	int err;
1031
1032	if (!info->attrs[GTPA_VERSION] ||
1033	    !info->attrs[GTPA_LINK] ||
1034	    !info->attrs[GTPA_PEER_ADDRESS] ||
1035	    !info->attrs[GTPA_MS_ADDRESS])
1036		return -EINVAL;
1037
1038	version = nla_get_u32(info->attrs[GTPA_VERSION]);
1039
1040	switch (version) {
1041	case GTP_V0:
1042		if (!info->attrs[GTPA_TID] ||
1043		    !info->attrs[GTPA_FLOW])
1044			return -EINVAL;
1045		break;
1046	case GTP_V1:
1047		if (!info->attrs[GTPA_I_TEI] ||
1048		    !info->attrs[GTPA_O_TEI])
1049			return -EINVAL;
1050		break;
1051
1052	default:
1053		return -EINVAL;
1054	}
1055
1056	rtnl_lock();
1057	rcu_read_lock();
1058
1059	gtp = gtp_find_dev(sock_net(skb->sk), info->attrs);
1060	if (!gtp) {
1061		err = -ENODEV;
1062		goto out_unlock;
1063	}
1064
1065	if (version == GTP_V0)
1066		sk = gtp->sk0;
1067	else if (version == GTP_V1)
1068		sk = gtp->sk1u;
1069	else
1070		sk = NULL;
1071
1072	if (!sk) {
1073		err = -ENODEV;
1074		goto out_unlock;
1075	}
1076
1077	err = ipv4_pdp_add(gtp, sk, info);
1078
1079out_unlock:
1080	rcu_read_unlock();
1081	rtnl_unlock();
1082	return err;
1083}
1084
1085static struct pdp_ctx *gtp_find_pdp_by_link(struct net *net,
1086					    struct nlattr *nla[])
1087{
1088	struct gtp_dev *gtp;
1089
1090	gtp = gtp_find_dev(net, nla);
1091	if (!gtp)
1092		return ERR_PTR(-ENODEV);
1093
1094	if (nla[GTPA_MS_ADDRESS]) {
1095		__be32 ip = nla_get_be32(nla[GTPA_MS_ADDRESS]);
1096
1097		return ipv4_pdp_find(gtp, ip);
1098	} else if (nla[GTPA_VERSION]) {
1099		u32 gtp_version = nla_get_u32(nla[GTPA_VERSION]);
1100
1101		if (gtp_version == GTP_V0 && nla[GTPA_TID])
1102			return gtp0_pdp_find(gtp, nla_get_u64(nla[GTPA_TID]));
1103		else if (gtp_version == GTP_V1 && nla[GTPA_I_TEI])
1104			return gtp1_pdp_find(gtp, nla_get_u32(nla[GTPA_I_TEI]));
1105	}
1106
1107	return ERR_PTR(-EINVAL);
1108}
1109
1110static struct pdp_ctx *gtp_find_pdp(struct net *net, struct nlattr *nla[])
1111{
1112	struct pdp_ctx *pctx;
1113
1114	if (nla[GTPA_LINK])
1115		pctx = gtp_find_pdp_by_link(net, nla);
1116	else
1117		pctx = ERR_PTR(-EINVAL);
1118
1119	if (!pctx)
1120		pctx = ERR_PTR(-ENOENT);
1121
1122	return pctx;
1123}
1124
1125static int gtp_genl_del_pdp(struct sk_buff *skb, struct genl_info *info)
1126{
1127	struct pdp_ctx *pctx;
1128	int err = 0;
1129
1130	if (!info->attrs[GTPA_VERSION])
1131		return -EINVAL;
1132
1133	rcu_read_lock();
1134
1135	pctx = gtp_find_pdp(sock_net(skb->sk), info->attrs);
1136	if (IS_ERR(pctx)) {
1137		err = PTR_ERR(pctx);
1138		goto out_unlock;
1139	}
1140
1141	if (pctx->gtp_version == GTP_V0)
1142		netdev_dbg(pctx->dev, "GTPv0-U: deleting tunnel id = %llx (pdp %p)\n",
1143			   pctx->u.v0.tid, pctx);
1144	else if (pctx->gtp_version == GTP_V1)
1145		netdev_dbg(pctx->dev, "GTPv1-U: deleting tunnel id = %x/%x (pdp %p)\n",
1146			   pctx->u.v1.i_tei, pctx->u.v1.o_tei, pctx);
1147
1148	pdp_context_delete(pctx);
1149
1150out_unlock:
1151	rcu_read_unlock();
1152	return err;
1153}
1154
1155static struct genl_family gtp_genl_family;
1156
1157static int gtp_genl_fill_info(struct sk_buff *skb, u32 snd_portid, u32 snd_seq,
1158			      u32 type, struct pdp_ctx *pctx)
1159{
1160	void *genlh;
1161
1162	genlh = genlmsg_put(skb, snd_portid, snd_seq, &gtp_genl_family, 0,
1163			    type);
1164	if (genlh == NULL)
1165		goto nlmsg_failure;
1166
1167	if (nla_put_u32(skb, GTPA_VERSION, pctx->gtp_version) ||
 
1168	    nla_put_be32(skb, GTPA_PEER_ADDRESS, pctx->peer_addr_ip4.s_addr) ||
1169	    nla_put_be32(skb, GTPA_MS_ADDRESS, pctx->ms_addr_ip4.s_addr))
1170		goto nla_put_failure;
1171
1172	switch (pctx->gtp_version) {
1173	case GTP_V0:
1174		if (nla_put_u64_64bit(skb, GTPA_TID, pctx->u.v0.tid, GTPA_PAD) ||
1175		    nla_put_u16(skb, GTPA_FLOW, pctx->u.v0.flow))
1176			goto nla_put_failure;
1177		break;
1178	case GTP_V1:
1179		if (nla_put_u32(skb, GTPA_I_TEI, pctx->u.v1.i_tei) ||
1180		    nla_put_u32(skb, GTPA_O_TEI, pctx->u.v1.o_tei))
1181			goto nla_put_failure;
1182		break;
1183	}
1184	genlmsg_end(skb, genlh);
1185	return 0;
1186
1187nlmsg_failure:
1188nla_put_failure:
1189	genlmsg_cancel(skb, genlh);
1190	return -EMSGSIZE;
1191}
1192
1193static int gtp_genl_get_pdp(struct sk_buff *skb, struct genl_info *info)
1194{
1195	struct pdp_ctx *pctx = NULL;
1196	struct sk_buff *skb2;
1197	int err;
1198
1199	if (!info->attrs[GTPA_VERSION])
1200		return -EINVAL;
1201
1202	rcu_read_lock();
1203
1204	pctx = gtp_find_pdp(sock_net(skb->sk), info->attrs);
1205	if (IS_ERR(pctx)) {
1206		err = PTR_ERR(pctx);
1207		goto err_unlock;
1208	}
1209
1210	skb2 = genlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
1211	if (skb2 == NULL) {
1212		err = -ENOMEM;
1213		goto err_unlock;
1214	}
1215
1216	err = gtp_genl_fill_info(skb2, NETLINK_CB(skb).portid,
1217				 info->snd_seq, info->nlhdr->nlmsg_type, pctx);
1218	if (err < 0)
1219		goto err_unlock_free;
1220
1221	rcu_read_unlock();
1222	return genlmsg_unicast(genl_info_net(info), skb2, info->snd_portid);
1223
1224err_unlock_free:
1225	kfree_skb(skb2);
1226err_unlock:
1227	rcu_read_unlock();
1228	return err;
1229}
1230
1231static int gtp_genl_dump_pdp(struct sk_buff *skb,
1232				struct netlink_callback *cb)
1233{
1234	struct gtp_dev *last_gtp = (struct gtp_dev *)cb->args[2], *gtp;
 
1235	struct net *net = sock_net(skb->sk);
1236	struct gtp_net *gn = net_generic(net, gtp_net_id);
1237	unsigned long tid = cb->args[1];
1238	int i, k = cb->args[0], ret;
1239	struct pdp_ctx *pctx;
 
 
 
1240
1241	if (cb->args[4])
1242		return 0;
1243
 
1244	list_for_each_entry_rcu(gtp, &gn->gtp_dev_list, list) {
1245		if (last_gtp && last_gtp != gtp)
1246			continue;
1247		else
1248			last_gtp = NULL;
1249
1250		for (i = k; i < gtp->hash_size; i++) {
1251			hlist_for_each_entry_rcu(pctx, &gtp->tid_hash[i], hlist_tid) {
1252				if (tid && tid != pctx->u.tid)
1253					continue;
1254				else
1255					tid = 0;
1256
1257				ret = gtp_genl_fill_info(skb,
1258							 NETLINK_CB(cb->skb).portid,
1259							 cb->nlh->nlmsg_seq,
1260							 cb->nlh->nlmsg_type, pctx);
1261				if (ret < 0) {
1262					cb->args[0] = i;
1263					cb->args[1] = pctx->u.tid;
1264					cb->args[2] = (unsigned long)gtp;
1265					goto out;
1266				}
 
1267			}
 
1268		}
 
1269	}
1270	cb->args[4] = 1;
1271out:
 
1272	return skb->len;
1273}
1274
1275static const struct nla_policy gtp_genl_policy[GTPA_MAX + 1] = {
1276	[GTPA_LINK]		= { .type = NLA_U32, },
1277	[GTPA_VERSION]		= { .type = NLA_U32, },
1278	[GTPA_TID]		= { .type = NLA_U64, },
1279	[GTPA_PEER_ADDRESS]	= { .type = NLA_U32, },
1280	[GTPA_MS_ADDRESS]	= { .type = NLA_U32, },
1281	[GTPA_FLOW]		= { .type = NLA_U16, },
1282	[GTPA_NET_NS_FD]	= { .type = NLA_U32, },
1283	[GTPA_I_TEI]		= { .type = NLA_U32, },
1284	[GTPA_O_TEI]		= { .type = NLA_U32, },
1285};
1286
1287static const struct genl_ops gtp_genl_ops[] = {
1288	{
1289		.cmd = GTP_CMD_NEWPDP,
1290		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1291		.doit = gtp_genl_new_pdp,
1292		.flags = GENL_ADMIN_PERM,
1293	},
1294	{
1295		.cmd = GTP_CMD_DELPDP,
1296		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1297		.doit = gtp_genl_del_pdp,
1298		.flags = GENL_ADMIN_PERM,
1299	},
1300	{
1301		.cmd = GTP_CMD_GETPDP,
1302		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1303		.doit = gtp_genl_get_pdp,
1304		.dumpit = gtp_genl_dump_pdp,
1305		.flags = GENL_ADMIN_PERM,
1306	},
1307};
1308
1309static struct genl_family gtp_genl_family __ro_after_init = {
1310	.name		= "gtp",
1311	.version	= 0,
1312	.hdrsize	= 0,
1313	.maxattr	= GTPA_MAX,
1314	.policy = gtp_genl_policy,
1315	.netnsok	= true,
1316	.module		= THIS_MODULE,
1317	.ops		= gtp_genl_ops,
1318	.n_ops		= ARRAY_SIZE(gtp_genl_ops),
1319};
1320
1321static int __net_init gtp_net_init(struct net *net)
1322{
1323	struct gtp_net *gn = net_generic(net, gtp_net_id);
1324
1325	INIT_LIST_HEAD(&gn->gtp_dev_list);
1326	return 0;
1327}
1328
1329static void __net_exit gtp_net_exit(struct net *net)
1330{
1331	struct gtp_net *gn = net_generic(net, gtp_net_id);
1332	struct gtp_dev *gtp;
1333	LIST_HEAD(list);
1334
1335	rtnl_lock();
1336	list_for_each_entry(gtp, &gn->gtp_dev_list, list)
1337		gtp_dellink(gtp->dev, &list);
1338
1339	unregister_netdevice_many(&list);
1340	rtnl_unlock();
1341}
1342
1343static struct pernet_operations gtp_net_ops = {
1344	.init	= gtp_net_init,
1345	.exit	= gtp_net_exit,
1346	.id	= &gtp_net_id,
1347	.size	= sizeof(struct gtp_net),
1348};
1349
1350static int __init gtp_init(void)
1351{
1352	int err;
1353
1354	get_random_bytes(&gtp_h_initval, sizeof(gtp_h_initval));
1355
1356	err = rtnl_link_register(&gtp_link_ops);
1357	if (err < 0)
1358		goto error_out;
1359
1360	err = genl_register_family(&gtp_genl_family);
1361	if (err < 0)
1362		goto unreg_rtnl_link;
1363
1364	err = register_pernet_subsys(&gtp_net_ops);
1365	if (err < 0)
1366		goto unreg_genl_family;
1367
1368	pr_info("GTP module loaded (pdp ctx size %zd bytes)\n",
1369		sizeof(struct pdp_ctx));
1370	return 0;
1371
1372unreg_genl_family:
1373	genl_unregister_family(&gtp_genl_family);
1374unreg_rtnl_link:
1375	rtnl_link_unregister(&gtp_link_ops);
1376error_out:
1377	pr_err("error loading GTP module loaded\n");
1378	return err;
1379}
1380late_initcall(gtp_init);
1381
1382static void __exit gtp_fini(void)
1383{
1384	genl_unregister_family(&gtp_genl_family);
1385	rtnl_link_unregister(&gtp_link_ops);
1386	unregister_pernet_subsys(&gtp_net_ops);
1387
1388	pr_info("GTP module unloaded\n");
1389}
1390module_exit(gtp_fini);
1391
1392MODULE_LICENSE("GPL");
1393MODULE_AUTHOR("Harald Welte <hwelte@sysmocom.de>");
1394MODULE_DESCRIPTION("Interface driver for GTP encapsulated traffic");
1395MODULE_ALIAS_RTNL_LINK("gtp");
1396MODULE_ALIAS_GENL_FAMILY("gtp");
v5.9
   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/* GTP according to GSM TS 09.60 / 3GPP TS 29.060
   3 *
   4 * (C) 2012-2014 by sysmocom - s.f.m.c. GmbH
   5 * (C) 2016 by Pablo Neira Ayuso <pablo@netfilter.org>
   6 *
   7 * Author: Harald Welte <hwelte@sysmocom.de>
   8 *	   Pablo Neira Ayuso <pablo@netfilter.org>
   9 *	   Andreas Schultz <aschultz@travelping.com>
  10 */
  11
  12#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  13
  14#include <linux/module.h>
  15#include <linux/skbuff.h>
  16#include <linux/udp.h>
  17#include <linux/rculist.h>
  18#include <linux/jhash.h>
  19#include <linux/if_tunnel.h>
  20#include <linux/net.h>
  21#include <linux/file.h>
  22#include <linux/gtp.h>
  23
  24#include <net/net_namespace.h>
  25#include <net/protocol.h>
  26#include <net/ip.h>
  27#include <net/udp.h>
  28#include <net/udp_tunnel.h>
  29#include <net/icmp.h>
  30#include <net/xfrm.h>
  31#include <net/genetlink.h>
  32#include <net/netns/generic.h>
  33#include <net/gtp.h>
  34
  35/* An active session for the subscriber. */
  36struct pdp_ctx {
  37	struct hlist_node	hlist_tid;
  38	struct hlist_node	hlist_addr;
  39
  40	union {
 
  41		struct {
  42			u64	tid;
  43			u16	flow;
  44		} v0;
  45		struct {
  46			u32	i_tei;
  47			u32	o_tei;
  48		} v1;
  49	} u;
  50	u8			gtp_version;
  51	u16			af;
  52
  53	struct in_addr		ms_addr_ip4;
  54	struct in_addr		peer_addr_ip4;
  55
  56	struct sock		*sk;
  57	struct net_device       *dev;
  58
  59	atomic_t		tx_seq;
  60	struct rcu_head		rcu_head;
  61};
  62
  63/* One instance of the GTP device. */
  64struct gtp_dev {
  65	struct list_head	list;
  66
  67	struct sock		*sk0;
  68	struct sock		*sk1u;
  69
  70	struct net_device	*dev;
  71
  72	unsigned int		role;
  73	unsigned int		hash_size;
  74	struct hlist_head	*tid_hash;
  75	struct hlist_head	*addr_hash;
  76};
  77
  78static unsigned int gtp_net_id __read_mostly;
  79
  80struct gtp_net {
  81	struct list_head gtp_dev_list;
  82};
  83
  84static u32 gtp_h_initval;
  85
  86static void pdp_context_delete(struct pdp_ctx *pctx);
  87
  88static inline u32 gtp0_hashfn(u64 tid)
  89{
  90	u32 *tid32 = (u32 *) &tid;
  91	return jhash_2words(tid32[0], tid32[1], gtp_h_initval);
  92}
  93
  94static inline u32 gtp1u_hashfn(u32 tid)
  95{
  96	return jhash_1word(tid, gtp_h_initval);
  97}
  98
  99static inline u32 ipv4_hashfn(__be32 ip)
 100{
 101	return jhash_1word((__force u32)ip, gtp_h_initval);
 102}
 103
 104/* Resolve a PDP context structure based on the 64bit TID. */
 105static struct pdp_ctx *gtp0_pdp_find(struct gtp_dev *gtp, u64 tid)
 106{
 107	struct hlist_head *head;
 108	struct pdp_ctx *pdp;
 109
 110	head = &gtp->tid_hash[gtp0_hashfn(tid) % gtp->hash_size];
 111
 112	hlist_for_each_entry_rcu(pdp, head, hlist_tid) {
 113		if (pdp->gtp_version == GTP_V0 &&
 114		    pdp->u.v0.tid == tid)
 115			return pdp;
 116	}
 117	return NULL;
 118}
 119
 120/* Resolve a PDP context structure based on the 32bit TEI. */
 121static struct pdp_ctx *gtp1_pdp_find(struct gtp_dev *gtp, u32 tid)
 122{
 123	struct hlist_head *head;
 124	struct pdp_ctx *pdp;
 125
 126	head = &gtp->tid_hash[gtp1u_hashfn(tid) % gtp->hash_size];
 127
 128	hlist_for_each_entry_rcu(pdp, head, hlist_tid) {
 129		if (pdp->gtp_version == GTP_V1 &&
 130		    pdp->u.v1.i_tei == tid)
 131			return pdp;
 132	}
 133	return NULL;
 134}
 135
 136/* Resolve a PDP context based on IPv4 address of MS. */
 137static struct pdp_ctx *ipv4_pdp_find(struct gtp_dev *gtp, __be32 ms_addr)
 138{
 139	struct hlist_head *head;
 140	struct pdp_ctx *pdp;
 141
 142	head = &gtp->addr_hash[ipv4_hashfn(ms_addr) % gtp->hash_size];
 143
 144	hlist_for_each_entry_rcu(pdp, head, hlist_addr) {
 145		if (pdp->af == AF_INET &&
 146		    pdp->ms_addr_ip4.s_addr == ms_addr)
 147			return pdp;
 148	}
 149
 150	return NULL;
 151}
 152
 153static bool gtp_check_ms_ipv4(struct sk_buff *skb, struct pdp_ctx *pctx,
 154				  unsigned int hdrlen, unsigned int role)
 155{
 156	struct iphdr *iph;
 157
 158	if (!pskb_may_pull(skb, hdrlen + sizeof(struct iphdr)))
 159		return false;
 160
 161	iph = (struct iphdr *)(skb->data + hdrlen);
 162
 163	if (role == GTP_ROLE_SGSN)
 164		return iph->daddr == pctx->ms_addr_ip4.s_addr;
 165	else
 166		return iph->saddr == pctx->ms_addr_ip4.s_addr;
 167}
 168
 169/* Check if the inner IP address in this packet is assigned to any
 170 * existing mobile subscriber.
 171 */
 172static bool gtp_check_ms(struct sk_buff *skb, struct pdp_ctx *pctx,
 173			     unsigned int hdrlen, unsigned int role)
 174{
 175	switch (ntohs(skb->protocol)) {
 176	case ETH_P_IP:
 177		return gtp_check_ms_ipv4(skb, pctx, hdrlen, role);
 178	}
 179	return false;
 180}
 181
 182static int gtp_rx(struct pdp_ctx *pctx, struct sk_buff *skb,
 183			unsigned int hdrlen, unsigned int role)
 184{
 185	struct pcpu_sw_netstats *stats;
 186
 187	if (!gtp_check_ms(skb, pctx, hdrlen, role)) {
 188		netdev_dbg(pctx->dev, "No PDP ctx for this MS\n");
 189		return 1;
 190	}
 191
 192	/* Get rid of the GTP + UDP headers. */
 193	if (iptunnel_pull_header(skb, hdrlen, skb->protocol,
 194				 !net_eq(sock_net(pctx->sk), dev_net(pctx->dev))))
 195		return -1;
 196
 197	netdev_dbg(pctx->dev, "forwarding packet from GGSN to uplink\n");
 198
 199	/* Now that the UDP and the GTP header have been removed, set up the
 200	 * new network header. This is required by the upper layer to
 201	 * calculate the transport header.
 202	 */
 203	skb_reset_network_header(skb);
 204
 205	skb->dev = pctx->dev;
 206
 207	stats = this_cpu_ptr(pctx->dev->tstats);
 208	u64_stats_update_begin(&stats->syncp);
 209	stats->rx_packets++;
 210	stats->rx_bytes += skb->len;
 211	u64_stats_update_end(&stats->syncp);
 212
 213	netif_rx(skb);
 214	return 0;
 215}
 216
 217/* 1 means pass up to the stack, -1 means drop and 0 means decapsulated. */
 218static int gtp0_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb)
 219{
 220	unsigned int hdrlen = sizeof(struct udphdr) +
 221			      sizeof(struct gtp0_header);
 222	struct gtp0_header *gtp0;
 223	struct pdp_ctx *pctx;
 224
 225	if (!pskb_may_pull(skb, hdrlen))
 226		return -1;
 227
 228	gtp0 = (struct gtp0_header *)(skb->data + sizeof(struct udphdr));
 229
 230	if ((gtp0->flags >> 5) != GTP_V0)
 231		return 1;
 232
 233	if (gtp0->type != GTP_TPDU)
 234		return 1;
 235
 236	pctx = gtp0_pdp_find(gtp, be64_to_cpu(gtp0->tid));
 237	if (!pctx) {
 238		netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb);
 239		return 1;
 240	}
 241
 242	return gtp_rx(pctx, skb, hdrlen, gtp->role);
 243}
 244
 245static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb)
 246{
 247	unsigned int hdrlen = sizeof(struct udphdr) +
 248			      sizeof(struct gtp1_header);
 249	struct gtp1_header *gtp1;
 250	struct pdp_ctx *pctx;
 251
 252	if (!pskb_may_pull(skb, hdrlen))
 253		return -1;
 254
 255	gtp1 = (struct gtp1_header *)(skb->data + sizeof(struct udphdr));
 256
 257	if ((gtp1->flags >> 5) != GTP_V1)
 258		return 1;
 259
 260	if (gtp1->type != GTP_TPDU)
 261		return 1;
 262
 263	/* From 29.060: "This field shall be present if and only if any one or
 264	 * more of the S, PN and E flags are set.".
 265	 *
 266	 * If any of the bit is set, then the remaining ones also have to be
 267	 * set.
 268	 */
 269	if (gtp1->flags & GTP1_F_MASK)
 270		hdrlen += 4;
 271
 272	/* Make sure the header is larger enough, including extensions. */
 273	if (!pskb_may_pull(skb, hdrlen))
 274		return -1;
 275
 276	gtp1 = (struct gtp1_header *)(skb->data + sizeof(struct udphdr));
 277
 278	pctx = gtp1_pdp_find(gtp, ntohl(gtp1->tid));
 279	if (!pctx) {
 280		netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb);
 281		return 1;
 282	}
 283
 284	return gtp_rx(pctx, skb, hdrlen, gtp->role);
 285}
 286
 287static void __gtp_encap_destroy(struct sock *sk)
 288{
 289	struct gtp_dev *gtp;
 290
 291	lock_sock(sk);
 292	gtp = sk->sk_user_data;
 293	if (gtp) {
 294		if (gtp->sk0 == sk)
 295			gtp->sk0 = NULL;
 296		else
 297			gtp->sk1u = NULL;
 298		udp_sk(sk)->encap_type = 0;
 299		rcu_assign_sk_user_data(sk, NULL);
 300		sock_put(sk);
 301	}
 302	release_sock(sk);
 303}
 304
 305static void gtp_encap_destroy(struct sock *sk)
 306{
 307	rtnl_lock();
 308	__gtp_encap_destroy(sk);
 309	rtnl_unlock();
 310}
 311
 312static void gtp_encap_disable_sock(struct sock *sk)
 313{
 314	if (!sk)
 315		return;
 316
 317	__gtp_encap_destroy(sk);
 318}
 319
 320static void gtp_encap_disable(struct gtp_dev *gtp)
 321{
 322	gtp_encap_disable_sock(gtp->sk0);
 323	gtp_encap_disable_sock(gtp->sk1u);
 324}
 325
 326/* UDP encapsulation receive handler. See net/ipv4/udp.c.
 327 * Return codes: 0: success, <0: error, >0: pass up to userspace UDP socket.
 328 */
 329static int gtp_encap_recv(struct sock *sk, struct sk_buff *skb)
 330{
 331	struct gtp_dev *gtp;
 332	int ret = 0;
 333
 334	gtp = rcu_dereference_sk_user_data(sk);
 335	if (!gtp)
 336		return 1;
 337
 338	netdev_dbg(gtp->dev, "encap_recv sk=%p\n", sk);
 339
 340	switch (udp_sk(sk)->encap_type) {
 341	case UDP_ENCAP_GTP0:
 342		netdev_dbg(gtp->dev, "received GTP0 packet\n");
 343		ret = gtp0_udp_encap_recv(gtp, skb);
 344		break;
 345	case UDP_ENCAP_GTP1U:
 346		netdev_dbg(gtp->dev, "received GTP1U packet\n");
 347		ret = gtp1u_udp_encap_recv(gtp, skb);
 348		break;
 349	default:
 350		ret = -1; /* Shouldn't happen. */
 351	}
 352
 353	switch (ret) {
 354	case 1:
 355		netdev_dbg(gtp->dev, "pass up to the process\n");
 356		break;
 357	case 0:
 358		break;
 359	case -1:
 360		netdev_dbg(gtp->dev, "GTP packet has been dropped\n");
 361		kfree_skb(skb);
 362		ret = 0;
 363		break;
 364	}
 365
 366	return ret;
 367}
 368
 369static int gtp_dev_init(struct net_device *dev)
 370{
 371	struct gtp_dev *gtp = netdev_priv(dev);
 372
 373	gtp->dev = dev;
 374
 375	dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
 376	if (!dev->tstats)
 377		return -ENOMEM;
 378
 379	return 0;
 380}
 381
 382static void gtp_dev_uninit(struct net_device *dev)
 383{
 384	struct gtp_dev *gtp = netdev_priv(dev);
 385
 386	gtp_encap_disable(gtp);
 387	free_percpu(dev->tstats);
 388}
 389
 390static struct rtable *ip4_route_output_gtp(struct flowi4 *fl4,
 391					   const struct sock *sk,
 392					   __be32 daddr)
 393{
 394	memset(fl4, 0, sizeof(*fl4));
 395	fl4->flowi4_oif		= sk->sk_bound_dev_if;
 396	fl4->daddr		= daddr;
 397	fl4->saddr		= inet_sk(sk)->inet_saddr;
 398	fl4->flowi4_tos		= RT_CONN_FLAGS(sk);
 399	fl4->flowi4_proto	= sk->sk_protocol;
 400
 401	return ip_route_output_key(sock_net(sk), fl4);
 402}
 403
 404static inline void gtp0_push_header(struct sk_buff *skb, struct pdp_ctx *pctx)
 405{
 406	int payload_len = skb->len;
 407	struct gtp0_header *gtp0;
 408
 409	gtp0 = skb_push(skb, sizeof(*gtp0));
 410
 411	gtp0->flags	= 0x1e; /* v0, GTP-non-prime. */
 412	gtp0->type	= GTP_TPDU;
 413	gtp0->length	= htons(payload_len);
 414	gtp0->seq	= htons((atomic_inc_return(&pctx->tx_seq) - 1) % 0xffff);
 415	gtp0->flow	= htons(pctx->u.v0.flow);
 416	gtp0->number	= 0xff;
 417	gtp0->spare[0]	= gtp0->spare[1] = gtp0->spare[2] = 0xff;
 418	gtp0->tid	= cpu_to_be64(pctx->u.v0.tid);
 419}
 420
 421static inline void gtp1_push_header(struct sk_buff *skb, struct pdp_ctx *pctx)
 422{
 423	int payload_len = skb->len;
 424	struct gtp1_header *gtp1;
 425
 426	gtp1 = skb_push(skb, sizeof(*gtp1));
 427
 428	/* Bits    8  7  6  5  4  3  2	1
 429	 *	  +--+--+--+--+--+--+--+--+
 430	 *	  |version |PT| 0| E| S|PN|
 431	 *	  +--+--+--+--+--+--+--+--+
 432	 *	    0  0  1  1	1  0  0  0
 433	 */
 434	gtp1->flags	= 0x30; /* v1, GTP-non-prime. */
 435	gtp1->type	= GTP_TPDU;
 436	gtp1->length	= htons(payload_len);
 437	gtp1->tid	= htonl(pctx->u.v1.o_tei);
 438
 439	/* TODO: Suppport for extension header, sequence number and N-PDU.
 440	 *	 Update the length field if any of them is available.
 441	 */
 442}
 443
 444struct gtp_pktinfo {
 445	struct sock		*sk;
 446	struct iphdr		*iph;
 447	struct flowi4		fl4;
 448	struct rtable		*rt;
 449	struct pdp_ctx		*pctx;
 450	struct net_device	*dev;
 451	__be16			gtph_port;
 452};
 453
 454static void gtp_push_header(struct sk_buff *skb, struct gtp_pktinfo *pktinfo)
 455{
 456	switch (pktinfo->pctx->gtp_version) {
 457	case GTP_V0:
 458		pktinfo->gtph_port = htons(GTP0_PORT);
 459		gtp0_push_header(skb, pktinfo->pctx);
 460		break;
 461	case GTP_V1:
 462		pktinfo->gtph_port = htons(GTP1U_PORT);
 463		gtp1_push_header(skb, pktinfo->pctx);
 464		break;
 465	}
 466}
 467
 468static inline void gtp_set_pktinfo_ipv4(struct gtp_pktinfo *pktinfo,
 469					struct sock *sk, struct iphdr *iph,
 470					struct pdp_ctx *pctx, struct rtable *rt,
 471					struct flowi4 *fl4,
 472					struct net_device *dev)
 473{
 474	pktinfo->sk	= sk;
 475	pktinfo->iph	= iph;
 476	pktinfo->pctx	= pctx;
 477	pktinfo->rt	= rt;
 478	pktinfo->fl4	= *fl4;
 479	pktinfo->dev	= dev;
 480}
 481
 482static int gtp_build_skb_ip4(struct sk_buff *skb, struct net_device *dev,
 483			     struct gtp_pktinfo *pktinfo)
 484{
 485	struct gtp_dev *gtp = netdev_priv(dev);
 486	struct pdp_ctx *pctx;
 487	struct rtable *rt;
 488	struct flowi4 fl4;
 489	struct iphdr *iph;
 490	__be16 df;
 491	int mtu;
 492
 493	/* Read the IP destination address and resolve the PDP context.
 494	 * Prepend PDP header with TEI/TID from PDP ctx.
 495	 */
 496	iph = ip_hdr(skb);
 497	if (gtp->role == GTP_ROLE_SGSN)
 498		pctx = ipv4_pdp_find(gtp, iph->saddr);
 499	else
 500		pctx = ipv4_pdp_find(gtp, iph->daddr);
 501
 502	if (!pctx) {
 503		netdev_dbg(dev, "no PDP ctx found for %pI4, skip\n",
 504			   &iph->daddr);
 505		return -ENOENT;
 506	}
 507	netdev_dbg(dev, "found PDP context %p\n", pctx);
 508
 509	rt = ip4_route_output_gtp(&fl4, pctx->sk, pctx->peer_addr_ip4.s_addr);
 510	if (IS_ERR(rt)) {
 511		netdev_dbg(dev, "no route to SSGN %pI4\n",
 512			   &pctx->peer_addr_ip4.s_addr);
 513		dev->stats.tx_carrier_errors++;
 514		goto err;
 515	}
 516
 517	if (rt->dst.dev == dev) {
 518		netdev_dbg(dev, "circular route to SSGN %pI4\n",
 519			   &pctx->peer_addr_ip4.s_addr);
 520		dev->stats.collisions++;
 521		goto err_rt;
 522	}
 523
 524	skb_dst_drop(skb);
 525
 526	/* This is similar to tnl_update_pmtu(). */
 527	df = iph->frag_off;
 528	if (df) {
 529		mtu = dst_mtu(&rt->dst) - dev->hard_header_len -
 530			sizeof(struct iphdr) - sizeof(struct udphdr);
 531		switch (pctx->gtp_version) {
 532		case GTP_V0:
 533			mtu -= sizeof(struct gtp0_header);
 534			break;
 535		case GTP_V1:
 536			mtu -= sizeof(struct gtp1_header);
 537			break;
 538		}
 539	} else {
 540		mtu = dst_mtu(&rt->dst);
 541	}
 542
 543	rt->dst.ops->update_pmtu(&rt->dst, NULL, skb, mtu, false);
 544
 545	if (!skb_is_gso(skb) && (iph->frag_off & htons(IP_DF)) &&
 546	    mtu < ntohs(iph->tot_len)) {
 547		netdev_dbg(dev, "packet too big, fragmentation needed\n");
 548		memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
 549		icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
 550			      htonl(mtu));
 551		goto err_rt;
 552	}
 553
 554	gtp_set_pktinfo_ipv4(pktinfo, pctx->sk, iph, pctx, rt, &fl4, dev);
 555	gtp_push_header(skb, pktinfo);
 556
 557	return 0;
 558err_rt:
 559	ip_rt_put(rt);
 560err:
 561	return -EBADMSG;
 562}
 563
 564static netdev_tx_t gtp_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 565{
 566	unsigned int proto = ntohs(skb->protocol);
 567	struct gtp_pktinfo pktinfo;
 568	int err;
 569
 570	/* Ensure there is sufficient headroom. */
 571	if (skb_cow_head(skb, dev->needed_headroom))
 572		goto tx_err;
 573
 574	skb_reset_inner_headers(skb);
 575
 576	/* PDP context lookups in gtp_build_skb_*() need rcu read-side lock. */
 577	rcu_read_lock();
 578	switch (proto) {
 579	case ETH_P_IP:
 580		err = gtp_build_skb_ip4(skb, dev, &pktinfo);
 581		break;
 582	default:
 583		err = -EOPNOTSUPP;
 584		break;
 585	}
 586	rcu_read_unlock();
 587
 588	if (err < 0)
 589		goto tx_err;
 590
 591	switch (proto) {
 592	case ETH_P_IP:
 593		netdev_dbg(pktinfo.dev, "gtp -> IP src: %pI4 dst: %pI4\n",
 594			   &pktinfo.iph->saddr, &pktinfo.iph->daddr);
 595		udp_tunnel_xmit_skb(pktinfo.rt, pktinfo.sk, skb,
 596				    pktinfo.fl4.saddr, pktinfo.fl4.daddr,
 597				    pktinfo.iph->tos,
 598				    ip4_dst_hoplimit(&pktinfo.rt->dst),
 599				    0,
 600				    pktinfo.gtph_port, pktinfo.gtph_port,
 601				    true, false);
 602		break;
 603	}
 604
 605	return NETDEV_TX_OK;
 606tx_err:
 607	dev->stats.tx_errors++;
 608	dev_kfree_skb(skb);
 609	return NETDEV_TX_OK;
 610}
 611
 612static const struct net_device_ops gtp_netdev_ops = {
 613	.ndo_init		= gtp_dev_init,
 614	.ndo_uninit		= gtp_dev_uninit,
 615	.ndo_start_xmit		= gtp_dev_xmit,
 616	.ndo_get_stats64	= ip_tunnel_get_stats64,
 617};
 618
 619static void gtp_link_setup(struct net_device *dev)
 620{
 621	dev->netdev_ops		= &gtp_netdev_ops;
 622	dev->needs_free_netdev	= true;
 623
 624	dev->hard_header_len = 0;
 625	dev->addr_len = 0;
 626
 627	/* Zero header length. */
 628	dev->type = ARPHRD_NONE;
 629	dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
 630
 631	dev->priv_flags	|= IFF_NO_QUEUE;
 632	dev->features	|= NETIF_F_LLTX;
 633	netif_keep_dst(dev);
 634
 635	/* Assume largest header, ie. GTPv0. */
 636	dev->needed_headroom	= LL_MAX_HEADER +
 637				  sizeof(struct iphdr) +
 638				  sizeof(struct udphdr) +
 639				  sizeof(struct gtp0_header);
 640}
 641
 642static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize);
 
 643static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]);
 644
 645static void gtp_destructor(struct net_device *dev)
 646{
 647	struct gtp_dev *gtp = netdev_priv(dev);
 648
 649	kfree(gtp->addr_hash);
 650	kfree(gtp->tid_hash);
 651}
 652
 653static int gtp_newlink(struct net *src_net, struct net_device *dev,
 654		       struct nlattr *tb[], struct nlattr *data[],
 655		       struct netlink_ext_ack *extack)
 656{
 657	struct gtp_dev *gtp;
 658	struct gtp_net *gn;
 659	int hashsize, err;
 660
 661	if (!data[IFLA_GTP_FD0] && !data[IFLA_GTP_FD1])
 662		return -EINVAL;
 663
 664	gtp = netdev_priv(dev);
 665
 666	err = gtp_encap_enable(gtp, data);
 667	if (err < 0)
 668		return err;
 669
 670	if (!data[IFLA_GTP_PDP_HASHSIZE]) {
 671		hashsize = 1024;
 672	} else {
 673		hashsize = nla_get_u32(data[IFLA_GTP_PDP_HASHSIZE]);
 674		if (!hashsize)
 675			hashsize = 1024;
 676	}
 677
 678	err = gtp_hashtable_new(gtp, hashsize);
 679	if (err < 0)
 680		goto out_encap;
 681
 682	err = register_netdevice(dev);
 683	if (err < 0) {
 684		netdev_dbg(dev, "failed to register new netdev %d\n", err);
 685		goto out_hashtable;
 686	}
 687
 688	gn = net_generic(dev_net(dev), gtp_net_id);
 689	list_add_rcu(&gtp->list, &gn->gtp_dev_list);
 690	dev->priv_destructor = gtp_destructor;
 691
 692	netdev_dbg(dev, "registered new GTP interface\n");
 693
 694	return 0;
 695
 696out_hashtable:
 697	kfree(gtp->addr_hash);
 698	kfree(gtp->tid_hash);
 699out_encap:
 700	gtp_encap_disable(gtp);
 701	return err;
 702}
 703
 704static void gtp_dellink(struct net_device *dev, struct list_head *head)
 705{
 706	struct gtp_dev *gtp = netdev_priv(dev);
 707	struct pdp_ctx *pctx;
 708	int i;
 709
 710	for (i = 0; i < gtp->hash_size; i++)
 711		hlist_for_each_entry_rcu(pctx, &gtp->tid_hash[i], hlist_tid)
 712			pdp_context_delete(pctx);
 713
 
 714	list_del_rcu(&gtp->list);
 715	unregister_netdevice_queue(dev, head);
 716}
 717
 718static const struct nla_policy gtp_policy[IFLA_GTP_MAX + 1] = {
 719	[IFLA_GTP_FD0]			= { .type = NLA_U32 },
 720	[IFLA_GTP_FD1]			= { .type = NLA_U32 },
 721	[IFLA_GTP_PDP_HASHSIZE]		= { .type = NLA_U32 },
 722	[IFLA_GTP_ROLE]			= { .type = NLA_U32 },
 723};
 724
 725static int gtp_validate(struct nlattr *tb[], struct nlattr *data[],
 726			struct netlink_ext_ack *extack)
 727{
 728	if (!data)
 729		return -EINVAL;
 730
 731	return 0;
 732}
 733
 734static size_t gtp_get_size(const struct net_device *dev)
 735{
 736	return nla_total_size(sizeof(__u32));	/* IFLA_GTP_PDP_HASHSIZE */
 737}
 738
 739static int gtp_fill_info(struct sk_buff *skb, const struct net_device *dev)
 740{
 741	struct gtp_dev *gtp = netdev_priv(dev);
 742
 743	if (nla_put_u32(skb, IFLA_GTP_PDP_HASHSIZE, gtp->hash_size))
 744		goto nla_put_failure;
 745
 746	return 0;
 747
 748nla_put_failure:
 749	return -EMSGSIZE;
 750}
 751
 752static struct rtnl_link_ops gtp_link_ops __read_mostly = {
 753	.kind		= "gtp",
 754	.maxtype	= IFLA_GTP_MAX,
 755	.policy		= gtp_policy,
 756	.priv_size	= sizeof(struct gtp_dev),
 757	.setup		= gtp_link_setup,
 758	.validate	= gtp_validate,
 759	.newlink	= gtp_newlink,
 760	.dellink	= gtp_dellink,
 761	.get_size	= gtp_get_size,
 762	.fill_info	= gtp_fill_info,
 763};
 764
 765static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize)
 766{
 767	int i;
 768
 769	gtp->addr_hash = kmalloc_array(hsize, sizeof(struct hlist_head),
 770				       GFP_KERNEL | __GFP_NOWARN);
 771	if (gtp->addr_hash == NULL)
 772		return -ENOMEM;
 773
 774	gtp->tid_hash = kmalloc_array(hsize, sizeof(struct hlist_head),
 775				      GFP_KERNEL | __GFP_NOWARN);
 776	if (gtp->tid_hash == NULL)
 777		goto err1;
 778
 779	gtp->hash_size = hsize;
 780
 781	for (i = 0; i < hsize; i++) {
 782		INIT_HLIST_HEAD(&gtp->addr_hash[i]);
 783		INIT_HLIST_HEAD(&gtp->tid_hash[i]);
 784	}
 785	return 0;
 786err1:
 787	kfree(gtp->addr_hash);
 788	return -ENOMEM;
 789}
 790
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 791static struct sock *gtp_encap_enable_socket(int fd, int type,
 792					    struct gtp_dev *gtp)
 793{
 794	struct udp_tunnel_sock_cfg tuncfg = {NULL};
 795	struct socket *sock;
 796	struct sock *sk;
 797	int err;
 798
 799	pr_debug("enable gtp on %d, %d\n", fd, type);
 800
 801	sock = sockfd_lookup(fd, &err);
 802	if (!sock) {
 803		pr_debug("gtp socket fd=%d not found\n", fd);
 804		return NULL;
 805	}
 806
 807	sk = sock->sk;
 808	if (sk->sk_protocol != IPPROTO_UDP ||
 809	    sk->sk_type != SOCK_DGRAM ||
 810	    (sk->sk_family != AF_INET && sk->sk_family != AF_INET6)) {
 811		pr_debug("socket fd=%d not UDP\n", fd);
 812		sk = ERR_PTR(-EINVAL);
 813		goto out_sock;
 814	}
 815
 816	lock_sock(sk);
 817	if (sk->sk_user_data) {
 818		sk = ERR_PTR(-EBUSY);
 819		goto out_rel_sock;
 820	}
 821
 
 822	sock_hold(sk);
 823
 824	tuncfg.sk_user_data = gtp;
 825	tuncfg.encap_type = type;
 826	tuncfg.encap_rcv = gtp_encap_recv;
 827	tuncfg.encap_destroy = gtp_encap_destroy;
 828
 829	setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg);
 830
 831out_rel_sock:
 832	release_sock(sock->sk);
 833out_sock:
 834	sockfd_put(sock);
 835	return sk;
 836}
 837
 838static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[])
 839{
 840	struct sock *sk1u = NULL;
 841	struct sock *sk0 = NULL;
 842	unsigned int role = GTP_ROLE_GGSN;
 843
 844	if (data[IFLA_GTP_FD0]) {
 845		u32 fd0 = nla_get_u32(data[IFLA_GTP_FD0]);
 846
 847		sk0 = gtp_encap_enable_socket(fd0, UDP_ENCAP_GTP0, gtp);
 848		if (IS_ERR(sk0))
 849			return PTR_ERR(sk0);
 850	}
 851
 852	if (data[IFLA_GTP_FD1]) {
 853		u32 fd1 = nla_get_u32(data[IFLA_GTP_FD1]);
 854
 855		sk1u = gtp_encap_enable_socket(fd1, UDP_ENCAP_GTP1U, gtp);
 856		if (IS_ERR(sk1u)) {
 857			gtp_encap_disable_sock(sk0);
 
 858			return PTR_ERR(sk1u);
 859		}
 860	}
 861
 862	if (data[IFLA_GTP_ROLE]) {
 863		role = nla_get_u32(data[IFLA_GTP_ROLE]);
 864		if (role > GTP_ROLE_SGSN) {
 865			gtp_encap_disable_sock(sk0);
 866			gtp_encap_disable_sock(sk1u);
 
 
 867			return -EINVAL;
 868		}
 869	}
 870
 871	gtp->sk0 = sk0;
 872	gtp->sk1u = sk1u;
 873	gtp->role = role;
 874
 875	return 0;
 876}
 877
 878static struct gtp_dev *gtp_find_dev(struct net *src_net, struct nlattr *nla[])
 879{
 880	struct gtp_dev *gtp = NULL;
 881	struct net_device *dev;
 882	struct net *net;
 883
 884	/* Examine the link attributes and figure out which network namespace
 885	 * we are talking about.
 886	 */
 887	if (nla[GTPA_NET_NS_FD])
 888		net = get_net_ns_by_fd(nla_get_u32(nla[GTPA_NET_NS_FD]));
 889	else
 890		net = get_net(src_net);
 891
 892	if (IS_ERR(net))
 893		return NULL;
 894
 895	/* Check if there's an existing gtpX device to configure */
 896	dev = dev_get_by_index_rcu(net, nla_get_u32(nla[GTPA_LINK]));
 897	if (dev && dev->netdev_ops == &gtp_netdev_ops)
 898		gtp = netdev_priv(dev);
 899
 900	put_net(net);
 901	return gtp;
 902}
 903
 904static void ipv4_pdp_fill(struct pdp_ctx *pctx, struct genl_info *info)
 905{
 906	pctx->gtp_version = nla_get_u32(info->attrs[GTPA_VERSION]);
 907	pctx->af = AF_INET;
 908	pctx->peer_addr_ip4.s_addr =
 909		nla_get_be32(info->attrs[GTPA_PEER_ADDRESS]);
 910	pctx->ms_addr_ip4.s_addr =
 911		nla_get_be32(info->attrs[GTPA_MS_ADDRESS]);
 912
 913	switch (pctx->gtp_version) {
 914	case GTP_V0:
 915		/* According to TS 09.60, sections 7.5.1 and 7.5.2, the flow
 916		 * label needs to be the same for uplink and downlink packets,
 917		 * so let's annotate this.
 918		 */
 919		pctx->u.v0.tid = nla_get_u64(info->attrs[GTPA_TID]);
 920		pctx->u.v0.flow = nla_get_u16(info->attrs[GTPA_FLOW]);
 921		break;
 922	case GTP_V1:
 923		pctx->u.v1.i_tei = nla_get_u32(info->attrs[GTPA_I_TEI]);
 924		pctx->u.v1.o_tei = nla_get_u32(info->attrs[GTPA_O_TEI]);
 925		break;
 926	default:
 927		break;
 928	}
 929}
 930
 931static int gtp_pdp_add(struct gtp_dev *gtp, struct sock *sk,
 932		       struct genl_info *info)
 933{
 934	struct pdp_ctx *pctx, *pctx_tid = NULL;
 935	struct net_device *dev = gtp->dev;
 936	u32 hash_ms, hash_tid = 0;
 937	unsigned int version;
 938	bool found = false;
 939	__be32 ms_addr;
 940
 941	ms_addr = nla_get_be32(info->attrs[GTPA_MS_ADDRESS]);
 942	hash_ms = ipv4_hashfn(ms_addr) % gtp->hash_size;
 943	version = nla_get_u32(info->attrs[GTPA_VERSION]);
 944
 945	pctx = ipv4_pdp_find(gtp, ms_addr);
 946	if (pctx)
 947		found = true;
 948	if (version == GTP_V0)
 949		pctx_tid = gtp0_pdp_find(gtp,
 950					 nla_get_u64(info->attrs[GTPA_TID]));
 951	else if (version == GTP_V1)
 952		pctx_tid = gtp1_pdp_find(gtp,
 953					 nla_get_u32(info->attrs[GTPA_I_TEI]));
 954	if (pctx_tid)
 955		found = true;
 956
 957	if (found) {
 958		if (info->nlhdr->nlmsg_flags & NLM_F_EXCL)
 959			return -EEXIST;
 960		if (info->nlhdr->nlmsg_flags & NLM_F_REPLACE)
 961			return -EOPNOTSUPP;
 962
 963		if (pctx && pctx_tid)
 964			return -EEXIST;
 965		if (!pctx)
 966			pctx = pctx_tid;
 967
 968		ipv4_pdp_fill(pctx, info);
 969
 970		if (pctx->gtp_version == GTP_V0)
 971			netdev_dbg(dev, "GTPv0-U: update tunnel id = %llx (pdp %p)\n",
 972				   pctx->u.v0.tid, pctx);
 973		else if (pctx->gtp_version == GTP_V1)
 974			netdev_dbg(dev, "GTPv1-U: update tunnel id = %x/%x (pdp %p)\n",
 975				   pctx->u.v1.i_tei, pctx->u.v1.o_tei, pctx);
 976
 977		return 0;
 978
 979	}
 980
 981	pctx = kmalloc(sizeof(*pctx), GFP_ATOMIC);
 982	if (pctx == NULL)
 983		return -ENOMEM;
 984
 985	sock_hold(sk);
 986	pctx->sk = sk;
 987	pctx->dev = gtp->dev;
 988	ipv4_pdp_fill(pctx, info);
 989	atomic_set(&pctx->tx_seq, 0);
 990
 991	switch (pctx->gtp_version) {
 992	case GTP_V0:
 993		/* TS 09.60: "The flow label identifies unambiguously a GTP
 994		 * flow.". We use the tid for this instead, I cannot find a
 995		 * situation in which this doesn't unambiguosly identify the
 996		 * PDP context.
 997		 */
 998		hash_tid = gtp0_hashfn(pctx->u.v0.tid) % gtp->hash_size;
 999		break;
1000	case GTP_V1:
1001		hash_tid = gtp1u_hashfn(pctx->u.v1.i_tei) % gtp->hash_size;
1002		break;
1003	}
1004
1005	hlist_add_head_rcu(&pctx->hlist_addr, &gtp->addr_hash[hash_ms]);
1006	hlist_add_head_rcu(&pctx->hlist_tid, &gtp->tid_hash[hash_tid]);
1007
1008	switch (pctx->gtp_version) {
1009	case GTP_V0:
1010		netdev_dbg(dev, "GTPv0-U: new PDP ctx id=%llx ssgn=%pI4 ms=%pI4 (pdp=%p)\n",
1011			   pctx->u.v0.tid, &pctx->peer_addr_ip4,
1012			   &pctx->ms_addr_ip4, pctx);
1013		break;
1014	case GTP_V1:
1015		netdev_dbg(dev, "GTPv1-U: new PDP ctx id=%x/%x ssgn=%pI4 ms=%pI4 (pdp=%p)\n",
1016			   pctx->u.v1.i_tei, pctx->u.v1.o_tei,
1017			   &pctx->peer_addr_ip4, &pctx->ms_addr_ip4, pctx);
1018		break;
1019	}
1020
1021	return 0;
1022}
1023
1024static void pdp_context_free(struct rcu_head *head)
1025{
1026	struct pdp_ctx *pctx = container_of(head, struct pdp_ctx, rcu_head);
1027
1028	sock_put(pctx->sk);
1029	kfree(pctx);
1030}
1031
1032static void pdp_context_delete(struct pdp_ctx *pctx)
1033{
1034	hlist_del_rcu(&pctx->hlist_tid);
1035	hlist_del_rcu(&pctx->hlist_addr);
1036	call_rcu(&pctx->rcu_head, pdp_context_free);
1037}
1038
1039static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info)
1040{
1041	unsigned int version;
1042	struct gtp_dev *gtp;
1043	struct sock *sk;
1044	int err;
1045
1046	if (!info->attrs[GTPA_VERSION] ||
1047	    !info->attrs[GTPA_LINK] ||
1048	    !info->attrs[GTPA_PEER_ADDRESS] ||
1049	    !info->attrs[GTPA_MS_ADDRESS])
1050		return -EINVAL;
1051
1052	version = nla_get_u32(info->attrs[GTPA_VERSION]);
1053
1054	switch (version) {
1055	case GTP_V0:
1056		if (!info->attrs[GTPA_TID] ||
1057		    !info->attrs[GTPA_FLOW])
1058			return -EINVAL;
1059		break;
1060	case GTP_V1:
1061		if (!info->attrs[GTPA_I_TEI] ||
1062		    !info->attrs[GTPA_O_TEI])
1063			return -EINVAL;
1064		break;
1065
1066	default:
1067		return -EINVAL;
1068	}
1069
1070	rtnl_lock();
1071	rcu_read_lock();
1072
1073	gtp = gtp_find_dev(sock_net(skb->sk), info->attrs);
1074	if (!gtp) {
1075		err = -ENODEV;
1076		goto out_unlock;
1077	}
1078
1079	if (version == GTP_V0)
1080		sk = gtp->sk0;
1081	else if (version == GTP_V1)
1082		sk = gtp->sk1u;
1083	else
1084		sk = NULL;
1085
1086	if (!sk) {
1087		err = -ENODEV;
1088		goto out_unlock;
1089	}
1090
1091	err = gtp_pdp_add(gtp, sk, info);
1092
1093out_unlock:
1094	rcu_read_unlock();
1095	rtnl_unlock();
1096	return err;
1097}
1098
1099static struct pdp_ctx *gtp_find_pdp_by_link(struct net *net,
1100					    struct nlattr *nla[])
1101{
1102	struct gtp_dev *gtp;
1103
1104	gtp = gtp_find_dev(net, nla);
1105	if (!gtp)
1106		return ERR_PTR(-ENODEV);
1107
1108	if (nla[GTPA_MS_ADDRESS]) {
1109		__be32 ip = nla_get_be32(nla[GTPA_MS_ADDRESS]);
1110
1111		return ipv4_pdp_find(gtp, ip);
1112	} else if (nla[GTPA_VERSION]) {
1113		u32 gtp_version = nla_get_u32(nla[GTPA_VERSION]);
1114
1115		if (gtp_version == GTP_V0 && nla[GTPA_TID])
1116			return gtp0_pdp_find(gtp, nla_get_u64(nla[GTPA_TID]));
1117		else if (gtp_version == GTP_V1 && nla[GTPA_I_TEI])
1118			return gtp1_pdp_find(gtp, nla_get_u32(nla[GTPA_I_TEI]));
1119	}
1120
1121	return ERR_PTR(-EINVAL);
1122}
1123
1124static struct pdp_ctx *gtp_find_pdp(struct net *net, struct nlattr *nla[])
1125{
1126	struct pdp_ctx *pctx;
1127
1128	if (nla[GTPA_LINK])
1129		pctx = gtp_find_pdp_by_link(net, nla);
1130	else
1131		pctx = ERR_PTR(-EINVAL);
1132
1133	if (!pctx)
1134		pctx = ERR_PTR(-ENOENT);
1135
1136	return pctx;
1137}
1138
1139static int gtp_genl_del_pdp(struct sk_buff *skb, struct genl_info *info)
1140{
1141	struct pdp_ctx *pctx;
1142	int err = 0;
1143
1144	if (!info->attrs[GTPA_VERSION])
1145		return -EINVAL;
1146
1147	rcu_read_lock();
1148
1149	pctx = gtp_find_pdp(sock_net(skb->sk), info->attrs);
1150	if (IS_ERR(pctx)) {
1151		err = PTR_ERR(pctx);
1152		goto out_unlock;
1153	}
1154
1155	if (pctx->gtp_version == GTP_V0)
1156		netdev_dbg(pctx->dev, "GTPv0-U: deleting tunnel id = %llx (pdp %p)\n",
1157			   pctx->u.v0.tid, pctx);
1158	else if (pctx->gtp_version == GTP_V1)
1159		netdev_dbg(pctx->dev, "GTPv1-U: deleting tunnel id = %x/%x (pdp %p)\n",
1160			   pctx->u.v1.i_tei, pctx->u.v1.o_tei, pctx);
1161
1162	pdp_context_delete(pctx);
1163
1164out_unlock:
1165	rcu_read_unlock();
1166	return err;
1167}
1168
1169static struct genl_family gtp_genl_family;
1170
1171static int gtp_genl_fill_info(struct sk_buff *skb, u32 snd_portid, u32 snd_seq,
1172			      int flags, u32 type, struct pdp_ctx *pctx)
1173{
1174	void *genlh;
1175
1176	genlh = genlmsg_put(skb, snd_portid, snd_seq, &gtp_genl_family, flags,
1177			    type);
1178	if (genlh == NULL)
1179		goto nlmsg_failure;
1180
1181	if (nla_put_u32(skb, GTPA_VERSION, pctx->gtp_version) ||
1182	    nla_put_u32(skb, GTPA_LINK, pctx->dev->ifindex) ||
1183	    nla_put_be32(skb, GTPA_PEER_ADDRESS, pctx->peer_addr_ip4.s_addr) ||
1184	    nla_put_be32(skb, GTPA_MS_ADDRESS, pctx->ms_addr_ip4.s_addr))
1185		goto nla_put_failure;
1186
1187	switch (pctx->gtp_version) {
1188	case GTP_V0:
1189		if (nla_put_u64_64bit(skb, GTPA_TID, pctx->u.v0.tid, GTPA_PAD) ||
1190		    nla_put_u16(skb, GTPA_FLOW, pctx->u.v0.flow))
1191			goto nla_put_failure;
1192		break;
1193	case GTP_V1:
1194		if (nla_put_u32(skb, GTPA_I_TEI, pctx->u.v1.i_tei) ||
1195		    nla_put_u32(skb, GTPA_O_TEI, pctx->u.v1.o_tei))
1196			goto nla_put_failure;
1197		break;
1198	}
1199	genlmsg_end(skb, genlh);
1200	return 0;
1201
1202nlmsg_failure:
1203nla_put_failure:
1204	genlmsg_cancel(skb, genlh);
1205	return -EMSGSIZE;
1206}
1207
1208static int gtp_genl_get_pdp(struct sk_buff *skb, struct genl_info *info)
1209{
1210	struct pdp_ctx *pctx = NULL;
1211	struct sk_buff *skb2;
1212	int err;
1213
1214	if (!info->attrs[GTPA_VERSION])
1215		return -EINVAL;
1216
1217	rcu_read_lock();
1218
1219	pctx = gtp_find_pdp(sock_net(skb->sk), info->attrs);
1220	if (IS_ERR(pctx)) {
1221		err = PTR_ERR(pctx);
1222		goto err_unlock;
1223	}
1224
1225	skb2 = genlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
1226	if (skb2 == NULL) {
1227		err = -ENOMEM;
1228		goto err_unlock;
1229	}
1230
1231	err = gtp_genl_fill_info(skb2, NETLINK_CB(skb).portid, info->snd_seq,
1232				 0, info->nlhdr->nlmsg_type, pctx);
1233	if (err < 0)
1234		goto err_unlock_free;
1235
1236	rcu_read_unlock();
1237	return genlmsg_unicast(genl_info_net(info), skb2, info->snd_portid);
1238
1239err_unlock_free:
1240	kfree_skb(skb2);
1241err_unlock:
1242	rcu_read_unlock();
1243	return err;
1244}
1245
1246static int gtp_genl_dump_pdp(struct sk_buff *skb,
1247				struct netlink_callback *cb)
1248{
1249	struct gtp_dev *last_gtp = (struct gtp_dev *)cb->args[2], *gtp;
1250	int i, j, bucket = cb->args[0], skip = cb->args[1];
1251	struct net *net = sock_net(skb->sk);
 
 
 
1252	struct pdp_ctx *pctx;
1253	struct gtp_net *gn;
1254
1255	gn = net_generic(net, gtp_net_id);
1256
1257	if (cb->args[4])
1258		return 0;
1259
1260	rcu_read_lock();
1261	list_for_each_entry_rcu(gtp, &gn->gtp_dev_list, list) {
1262		if (last_gtp && last_gtp != gtp)
1263			continue;
1264		else
1265			last_gtp = NULL;
1266
1267		for (i = bucket; i < gtp->hash_size; i++) {
1268			j = 0;
1269			hlist_for_each_entry_rcu(pctx, &gtp->tid_hash[i],
1270						 hlist_tid) {
1271				if (j >= skip &&
1272				    gtp_genl_fill_info(skb,
1273					    NETLINK_CB(cb->skb).portid,
1274					    cb->nlh->nlmsg_seq,
1275					    NLM_F_MULTI,
1276					    cb->nlh->nlmsg_type, pctx)) {
 
 
1277					cb->args[0] = i;
1278					cb->args[1] = j;
1279					cb->args[2] = (unsigned long)gtp;
1280					goto out;
1281				}
1282				j++;
1283			}
1284			skip = 0;
1285		}
1286		bucket = 0;
1287	}
1288	cb->args[4] = 1;
1289out:
1290	rcu_read_unlock();
1291	return skb->len;
1292}
1293
1294static const struct nla_policy gtp_genl_policy[GTPA_MAX + 1] = {
1295	[GTPA_LINK]		= { .type = NLA_U32, },
1296	[GTPA_VERSION]		= { .type = NLA_U32, },
1297	[GTPA_TID]		= { .type = NLA_U64, },
1298	[GTPA_PEER_ADDRESS]	= { .type = NLA_U32, },
1299	[GTPA_MS_ADDRESS]	= { .type = NLA_U32, },
1300	[GTPA_FLOW]		= { .type = NLA_U16, },
1301	[GTPA_NET_NS_FD]	= { .type = NLA_U32, },
1302	[GTPA_I_TEI]		= { .type = NLA_U32, },
1303	[GTPA_O_TEI]		= { .type = NLA_U32, },
1304};
1305
1306static const struct genl_ops gtp_genl_ops[] = {
1307	{
1308		.cmd = GTP_CMD_NEWPDP,
1309		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1310		.doit = gtp_genl_new_pdp,
1311		.flags = GENL_ADMIN_PERM,
1312	},
1313	{
1314		.cmd = GTP_CMD_DELPDP,
1315		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1316		.doit = gtp_genl_del_pdp,
1317		.flags = GENL_ADMIN_PERM,
1318	},
1319	{
1320		.cmd = GTP_CMD_GETPDP,
1321		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1322		.doit = gtp_genl_get_pdp,
1323		.dumpit = gtp_genl_dump_pdp,
1324		.flags = GENL_ADMIN_PERM,
1325	},
1326};
1327
1328static struct genl_family gtp_genl_family __ro_after_init = {
1329	.name		= "gtp",
1330	.version	= 0,
1331	.hdrsize	= 0,
1332	.maxattr	= GTPA_MAX,
1333	.policy = gtp_genl_policy,
1334	.netnsok	= true,
1335	.module		= THIS_MODULE,
1336	.ops		= gtp_genl_ops,
1337	.n_ops		= ARRAY_SIZE(gtp_genl_ops),
1338};
1339
1340static int __net_init gtp_net_init(struct net *net)
1341{
1342	struct gtp_net *gn = net_generic(net, gtp_net_id);
1343
1344	INIT_LIST_HEAD(&gn->gtp_dev_list);
1345	return 0;
1346}
1347
1348static void __net_exit gtp_net_exit(struct net *net)
1349{
1350	struct gtp_net *gn = net_generic(net, gtp_net_id);
1351	struct gtp_dev *gtp;
1352	LIST_HEAD(list);
1353
1354	rtnl_lock();
1355	list_for_each_entry(gtp, &gn->gtp_dev_list, list)
1356		gtp_dellink(gtp->dev, &list);
1357
1358	unregister_netdevice_many(&list);
1359	rtnl_unlock();
1360}
1361
1362static struct pernet_operations gtp_net_ops = {
1363	.init	= gtp_net_init,
1364	.exit	= gtp_net_exit,
1365	.id	= &gtp_net_id,
1366	.size	= sizeof(struct gtp_net),
1367};
1368
1369static int __init gtp_init(void)
1370{
1371	int err;
1372
1373	get_random_bytes(&gtp_h_initval, sizeof(gtp_h_initval));
1374
1375	err = rtnl_link_register(&gtp_link_ops);
1376	if (err < 0)
1377		goto error_out;
1378
1379	err = genl_register_family(&gtp_genl_family);
1380	if (err < 0)
1381		goto unreg_rtnl_link;
1382
1383	err = register_pernet_subsys(&gtp_net_ops);
1384	if (err < 0)
1385		goto unreg_genl_family;
1386
1387	pr_info("GTP module loaded (pdp ctx size %zd bytes)\n",
1388		sizeof(struct pdp_ctx));
1389	return 0;
1390
1391unreg_genl_family:
1392	genl_unregister_family(&gtp_genl_family);
1393unreg_rtnl_link:
1394	rtnl_link_unregister(&gtp_link_ops);
1395error_out:
1396	pr_err("error loading GTP module loaded\n");
1397	return err;
1398}
1399late_initcall(gtp_init);
1400
1401static void __exit gtp_fini(void)
1402{
1403	genl_unregister_family(&gtp_genl_family);
1404	rtnl_link_unregister(&gtp_link_ops);
1405	unregister_pernet_subsys(&gtp_net_ops);
1406
1407	pr_info("GTP module unloaded\n");
1408}
1409module_exit(gtp_fini);
1410
1411MODULE_LICENSE("GPL");
1412MODULE_AUTHOR("Harald Welte <hwelte@sysmocom.de>");
1413MODULE_DESCRIPTION("Interface driver for GTP encapsulated traffic");
1414MODULE_ALIAS_RTNL_LINK("gtp");
1415MODULE_ALIAS_GENL_FAMILY("gtp");