Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-12-28 16:56:26 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

gtp: properly parse extension headers

Browse Source 
Currently GTP packets are dropped if the next extension field is set to
non-zero value, but this are valid GTP packets.

TS 29.281 provides a longer header format, which is defined as struct
gtp1_header_long. Such long header format is used if any of the S, PN, E
flags is set.

This long header is 4 bytes longer than struct gtp1_header, plus
variable length (optional) extension headers. The next extension header
field is zero is no extension header is provided.

The extension header is composed of a length field which includes total
number of 4 byte words including the extension header itself (1 byte),
payload (variable length) and next type (1 byte). The extension header
size and its payload is aligned to 4 bytes.

A GTP packet might come with a chain extensions headers, which makes it
slightly cumbersome to parse because the extension next header field
comes at the end of the extension header, and there is a need to check
if this field becomes zero to stop the extension header parser.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2024-05-07 01:11:47 +02:00
parent 353f5ffbc6
commit b6fc0956ac
2 changed files with 46 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
drivers/net/gtp.c
View File

@ -567,6 +567,43 @@ static int gtp1u_handle_echo_resp(struct gtp_dev *gtp, struct sk_buff *skb)
msg, 0, GTP_GENL_MCGRP, GFP_ATOMIC);
}
static int gtp_parse_exthdrs(struct sk_buff *skb, unsigned int *hdrlen)
{
struct gtp_ext_hdr *gtp_exthdr, _gtp_exthdr;
unsigned int offset = *hdrlen;
__u8 *next_type, _next_type;
/* From 29.060: "The Extension Header Length field specifies the length
* of the particular Extension header in 4 octets units."
*
* This length field includes length field size itself (1 byte),
* payload (variable length) and next type (1 byte). The extension
* header is aligned to to 4 bytes.
*/
do {
gtp_exthdr = skb_header_pointer(skb, offset, sizeof(*gtp_exthdr),
&_gtp_exthdr);
if (!gtp_exthdr || !gtp_exthdr->len)
return -1;
offset += gtp_exthdr->len * 4;
/* From 29.060: "If no such Header follows, then the value of
* the Next Extension Header Type shall be 0."
*/
next_type = skb_header_pointer(skb, offset - 1,
sizeof(_next_type), &_next_type);
if (!next_type)
return -1;
} while (*next_type != 0);
*hdrlen = offset;
return 0;
}
static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb)
{
unsigned int hdrlen = sizeof(struct udphdr) +
@ -616,6 +653,10 @@ static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb)
return 1;
}
if (gtp1->flags & GTP1_F_EXTHDR &&
gtp_parse_exthdrs(skb, &hdrlen) < 0)
return -1;
return gtp_rx(pctx, skb, hdrlen, gtp->role);
}

5
include/net/gtp.h
View File

@ -78,4 +78,9 @@ static inline bool netif_is_gtp(const struct net_device *dev)
#define GTP1_F_EXTHDR 0x04
#define GTP1_F_MASK 0x07
struct gtp_ext_hdr {
__u8 len;
__u8 data[];
};
#endif