Commit b6fc0956 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

gtp: properly parse extension headers 



Currently GTP packets are dropped if the next extension field is set to
non-zero value, but this are valid GTP packets.

TS 29.281 provides a longer header format, which is defined as struct
gtp1_header_long. Such long header format is used if any of the S, PN, E
flags is set.

This long header is 4 bytes longer than struct gtp1_header, plus
variable length (optional) extension headers. The next extension header
field is zero is no extension header is provided.

The extension header is composed of a length field which includes total
number of 4 byte words including the extension header itself (1 byte),
payload (variable length) and next type (1 byte). The extension header
size and its payload is aligned to 4 bytes.

A GTP packet might come with a chain extensions headers, which makes it
slightly cumbersome to parse because the extension next header field
comes at the end of the extension header, and there is a need to check
if this field becomes zero to stop the extension header parser.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 353f5ffb

drivers/net/gtp.c

+41 −0
Original line number Diff line number Diff line
@@ -567,6 +567,43 @@ static int gtp1u_handle_echo_resp(struct gtp_dev *gtp, struct sk_buff *skb) 
				       msg, 0, GTP_GENL_MCGRP, GFP_ATOMIC);

}



static int gtp_parse_exthdrs(struct sk_buff *skb, unsigned int *hdrlen)

{

	struct gtp_ext_hdr *gtp_exthdr, _gtp_exthdr;

	unsigned int offset = *hdrlen;

	__u8 *next_type, _next_type;



	/* From 29.060: "The Extension Header Length field specifies the length

	 * of the particular Extension header in 4 octets units."

	 *

	 * This length field includes length field size itself (1 byte),

	 * payload (variable length) and next type (1 byte). The extension

	 * header is aligned to to 4 bytes.

	 */



	do {

		gtp_exthdr = skb_header_pointer(skb, offset, sizeof(*gtp_exthdr),

						&_gtp_exthdr);

		if (!gtp_exthdr || !gtp_exthdr->len)

			return -1;



		offset += gtp_exthdr->len * 4;



		/* From 29.060: "If no such Header follows, then the value of

		 * the Next Extension Header Type shall be 0."

		 */

		next_type = skb_header_pointer(skb, offset - 1,

					       sizeof(_next_type), &_next_type);

		if (!next_type)

			return -1;



	} while (*next_type != 0);



	*hdrlen = offset;



	return 0;

}



static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb)

{

	unsigned int hdrlen = sizeof(struct udphdr) +
@@ -616,6 +653,10 @@ static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb) 
		return 1;

	}



	if (gtp1->flags & GTP1_F_EXTHDR &&

	    gtp_parse_exthdrs(skb, &hdrlen) < 0)

		return -1;



	return gtp_rx(pctx, skb, hdrlen, gtp->role);

}

include/net/gtp.h

+5 −0
Original line number Diff line number Diff line
@@ -78,4 +78,9 @@ static inline bool netif_is_gtp(const struct net_device *dev) 
#define GTP1_F_EXTHDR	0x04

#define GTP1_F_MASK	0x07



struct gtp_ext_hdr {

	__u8	len;

	__u8	data[];

};



#endif