From 88edf10315c8d72db70d39f3851cf2c91abdb634 Mon Sep 17 00:00:00 2001 From: Lionel Gauthier Date: Thu, 15 Dec 2016 22:35:52 +0100 Subject: [PATCH 1/2] gtp: gtp_check_src_ms_ipv4() always return success gtp_check_src_ms_ipv4() did not find the PDP context matching with the UE IP address because the memory location is not right, but the result is inverted by the Boolean "not" operator. So whatever is the PDP context, any call to this function is successful. Signed-off-by: Lionel Gauthier Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller --- drivers/net/gtp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 98f10c2165214..6031d499f2beb 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -158,9 +158,9 @@ static bool gtp_check_src_ms_ipv4(struct sk_buff *skb, struct pdp_ctx *pctx, if (!pskb_may_pull(skb, hdrlen + sizeof(struct iphdr))) return false; - iph = (struct iphdr *)(skb->data + hdrlen + sizeof(struct iphdr)); + iph = (struct iphdr *)(skb->data + hdrlen); - return iph->saddr != pctx->ms_addr_ip4.s_addr; + return iph->saddr == pctx->ms_addr_ip4.s_addr; } /* Check if the inner IP source address in this packet is assigned to any From d928be81b44dc3cad75d7a9f9fcbe99725dc7e56 Mon Sep 17 00:00:00 2001 From: Harald Welte Date: Thu, 15 Dec 2016 22:35:53 +0100 Subject: [PATCH 2/2] gtp: Fix initialization of Flags octet in GTPv1 header When generating a GTPv1 header in gtp1_push_header(), initialize the 'reserved' bit to zero. All 3GPP specifications for GTPv1 from Release 99 through Release 13 agree that a transmitter shall set this bit to zero, see e.g. Note 0 of Figure 2 in Section 6 of 3GPP TS 29.060 v13.5.0 Release 13, available from http://www.etsi.org/deliver/etsi_ts/129000_129099/129060/13.05.00_60/ts_129060v130500p.pdf Signed-off-by: Harald Welte Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller --- drivers/net/gtp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 6031d499f2beb..8b6810bad54b7 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -423,11 +423,11 @@ static inline void gtp1_push_header(struct sk_buff *skb, struct pdp_ctx *pctx) /* Bits 8 7 6 5 4 3 2 1 * +--+--+--+--+--+--+--+--+ - * |version |PT| 1| E| S|PN| + * |version |PT| 0| E| S|PN| * +--+--+--+--+--+--+--+--+ * 0 0 1 1 1 0 0 0 */ - gtp1->flags = 0x38; /* v1, GTP-non-prime. */ + gtp1->flags = 0x30; /* v1, GTP-non-prime. */ gtp1->type = GTP_TPDU; gtp1->length = htons(payload_len); gtp1->tid = htonl(pctx->u.v1.o_tei);