| Message ID | 20170124172402.12096-6-aschultz@tpip.net |
|---|---|
| State | New |
| Headers | show |
Hi Andreas, On Tue, Jan 24, 2017 at 06:24:02PM +0100, Andreas Schultz wrote: > enable userspace to send error replies for invalid tunnels > > Signed-off-by: Andreas Schultz <aschultz@tpip.net> > --- > drivers/net/gtp.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c > index 912721e..c607333 100644 > --- a/drivers/net/gtp.c > +++ b/drivers/net/gtp.c > @@ -198,12 +198,12 @@ static int gtp0_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb, > pctx = gtp0_pdp_find(gtp, be64_to_cpu(gtp0->tid)); > if (!pctx) { > netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb); > - return -1; > + return 1; > } > > if (!gtp_check_src_ms(skb, pctx, hdrlen)) { > netdev_dbg(gtp->dev, "No PDP ctx for this MS\n"); > - return -1; > + return 1; So userspace gets the packet that we cannot forward. I guess your userspace codebase performs this sanity checks again so you can send the appropriate error reply? > } > > /* Get rid of the GTP + UDP headers. */ > @@ -247,12 +247,12 @@ static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb, > pctx = gtp1_pdp_find(gtp, ntohl(gtp1->tid)); > if (!pctx) { > netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb); > - return -1; > + return 1; > } > > if (!gtp_check_src_ms(skb, pctx, hdrlen)) { > netdev_dbg(gtp->dev, "No PDP ctx for this MS\n"); > - return -1; > + return 1; > } > > /* Get rid of the GTP + UDP headers. */ > -- > 2.10.2 >
Hi Pablo, ----- On Jan 24, 2017, at 8:03 PM, pablo pablo@netfilter.org wrote: > Hi Andreas, > > On Tue, Jan 24, 2017 at 06:24:02PM +0100, Andreas Schultz wrote: >> enable userspace to send error replies for invalid tunnels >> >> Signed-off-by: Andreas Schultz <aschultz@tpip.net> >> --- >> drivers/net/gtp.c | 8 ++++---- >> 1 file changed, 4 insertions(+), 4 deletions(-) >> >> diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c >> index 912721e..c607333 100644 >> --- a/drivers/net/gtp.c >> +++ b/drivers/net/gtp.c >> @@ -198,12 +198,12 @@ static int gtp0_udp_encap_recv(struct gtp_dev *gtp, struct >> sk_buff *skb, >> pctx = gtp0_pdp_find(gtp, be64_to_cpu(gtp0->tid)); >> if (!pctx) { >> netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb); >> - return -1; >> + return 1; >> } >> >> if (!gtp_check_src_ms(skb, pctx, hdrlen)) { >> netdev_dbg(gtp->dev, "No PDP ctx for this MS\n"); >> - return -1; >> + return 1; > > So userspace gets the packet that we cannot forward. I guess your > userspace codebase performs this sanity checks again so you can send > the appropriate error reply? For TEID /= 0, the only reply is a T-PDU of type error indication. There is no cause specified. So I don't actually have to repeat the check. TEID == 0 is more interesting, this tells userspace that it tried to send on an invalid tunnel and should tear it down. If you like, you can have a look at the userspace code. The relevant piece is at https://github.com/travelping/gtp_u_kmod/blob/master/src/gtp_u_kmod_port.erl#L231 But be warned, it's written in Erlang ;-) Andreas > >> } >> >> /* Get rid of the GTP + UDP headers. */ >> @@ -247,12 +247,12 @@ static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, >> struct sk_buff *skb, >> pctx = gtp1_pdp_find(gtp, ntohl(gtp1->tid)); >> if (!pctx) { >> netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb); >> - return -1; >> + return 1; >> } >> >> if (!gtp_check_src_ms(skb, pctx, hdrlen)) { >> netdev_dbg(gtp->dev, "No PDP ctx for this MS\n"); >> - return -1; >> + return 1; >> } >> >> /* Get rid of the GTP + UDP headers. */ >> -- >> 2.10.2
On Tue, Jan 24, 2017 at 09:02:31PM +0100, Andreas Schultz wrote: > Hi Pablo, > > ----- On Jan 24, 2017, at 8:03 PM, pablo pablo@netfilter.org wrote: > > > Hi Andreas, > > > > On Tue, Jan 24, 2017 at 06:24:02PM +0100, Andreas Schultz wrote: > >> enable userspace to send error replies for invalid tunnels > >> > >> Signed-off-by: Andreas Schultz <aschultz@tpip.net> > >> --- > >> drivers/net/gtp.c | 8 ++++---- > >> 1 file changed, 4 insertions(+), 4 deletions(-) > >> > >> diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c > >> index 912721e..c607333 100644 > >> --- a/drivers/net/gtp.c > >> +++ b/drivers/net/gtp.c > >> @@ -198,12 +198,12 @@ static int gtp0_udp_encap_recv(struct gtp_dev *gtp, struct > >> sk_buff *skb, > >> pctx = gtp0_pdp_find(gtp, be64_to_cpu(gtp0->tid)); > >> if (!pctx) { > >> netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb); > >> - return -1; > >> + return 1; > >> } > >> > >> if (!gtp_check_src_ms(skb, pctx, hdrlen)) { > >> netdev_dbg(gtp->dev, "No PDP ctx for this MS\n"); > >> - return -1; > >> + return 1; > > > > So userspace gets the packet that we cannot forward. I guess your > > userspace codebase performs this sanity checks again so you can send > > the appropriate error reply? > > For TEID /= 0, the only reply is a T-PDU of type error indication. There > is no cause specified. So I don't actually have to repeat the check. > TEID == 0 is more interesting, this tells userspace that it tried to > send on an invalid tunnel and should tear it down. Ah, I see, thanks for explaining, I guess this is good to debug misconfigurations. > If you like, you can have a look at the userspace code. The relevant piece > is at https://github.com/travelping/gtp_u_kmod/blob/master/src/gtp_u_kmod_port.erl#L231 > > But be warned, it's written in Erlang ;-) Will have a look, but you taking me away from my usual domains :).
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 912721e..c607333 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -198,12 +198,12 @@ static int gtp0_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb, pctx = gtp0_pdp_find(gtp, be64_to_cpu(gtp0->tid)); if (!pctx) { netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb); - return -1; + return 1; } if (!gtp_check_src_ms(skb, pctx, hdrlen)) { netdev_dbg(gtp->dev, "No PDP ctx for this MS\n"); - return -1; + return 1; } /* Get rid of the GTP + UDP headers. */ @@ -247,12 +247,12 @@ static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb, pctx = gtp1_pdp_find(gtp, ntohl(gtp1->tid)); if (!pctx) { netdev_dbg(gtp->dev, "No PDP ctx to decap skb=%p\n", skb); - return -1; + return 1; } if (!gtp_check_src_ms(skb, pctx, hdrlen)) { netdev_dbg(gtp->dev, "No PDP ctx for this MS\n"); - return -1; + return 1; } /* Get rid of the GTP + UDP headers. */
enable userspace to send error replies for invalid tunnels Signed-off-by: Andreas Schultz <aschultz@tpip.net> --- drivers/net/gtp.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)