1// SPDX-License-Identifier: GPL-2.0-or-later 2/***************************************************************************** 3 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets 4 * 5 * PPPoX --- Generic PPP encapsulation socket family 6 * PPPoL2TP --- PPP over L2TP (RFC 2661) 7 * 8 * Version: 2.0.0 9 * 10 * Authors: James Chapman (jchapman@katalix.com) 11 * 12 * Based on original work by Martijn van Oosterhout <kleptog@svana.org> 13 * 14 * License: 15 */ 16 17/* This driver handles only L2TP data frames; control frames are handled by a 18 * userspace application. 19 * 20 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and 21 * attaches it to a bound UDP socket with local tunnel_id / session_id and 22 * peer tunnel_id / session_id set. Data can then be sent or received using 23 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket 24 * can be read or modified using ioctl() or [gs]etsockopt() calls. 25 * 26 * When a PPPoL2TP socket is connected with local and peer session_id values 27 * zero, the socket is treated as a special tunnel management socket. 28 * 29 * Here's example userspace code to create a socket for sending/receiving data 30 * over an L2TP session:- 31 * 32 * struct sockaddr_pppol2tp sax; 33 * int fd; 34 * int session_fd; 35 * 36 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); 37 * 38 * sax.sa_family = AF_PPPOX; 39 * sax.sa_protocol = PX_PROTO_OL2TP; 40 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket 41 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr; 42 * sax.pppol2tp.addr.sin_port = addr->sin_port; 43 * sax.pppol2tp.addr.sin_family = AF_INET; 44 * sax.pppol2tp.s_tunnel = tunnel_id; 45 * sax.pppol2tp.s_session = session_id; 46 * sax.pppol2tp.d_tunnel = peer_tunnel_id; 47 * sax.pppol2tp.d_session = peer_session_id; 48 * 49 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax)); 50 * 51 * A pppd plugin that allows PPP traffic to be carried over L2TP using 52 * this driver is available from the OpenL2TP project at 53 * http://openl2tp.sourceforge.net. 54 */ 55 56#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 57 58#include <linux/module.h> 59#include <linux/string.h> 60#include <linux/list.h> 61#include <linux/uaccess.h> 62 63#include <linux/kernel.h> 64#include <linux/spinlock.h> 65#include <linux/kthread.h> 66#include <linux/sched.h> 67#include <linux/slab.h> 68#include <linux/errno.h> 69#include <linux/jiffies.h> 70 71#include <linux/netdevice.h> 72#include <linux/net.h> 73#include <linux/inetdevice.h> 74#include <linux/skbuff.h> 75#include <linux/init.h> 76#include <linux/ip.h> 77#include <linux/udp.h> 78#include <linux/if_pppox.h> 79#include <linux/if_pppol2tp.h> 80#include <net/sock.h> 81#include <linux/ppp_channel.h> 82#include <linux/ppp_defs.h> 83#include <linux/ppp-ioctl.h> 84#include <linux/file.h> 85#include <linux/hash.h> 86#include <linux/sort.h> 87#include <linux/proc_fs.h> 88#include <linux/l2tp.h> 89#include <linux/nsproxy.h> 90#include <net/net_namespace.h> 91#include <net/netns/generic.h> 92#include <net/ip.h> 93#include <net/udp.h> 94#include <net/inet_common.h> 95 96#include <asm/byteorder.h> 97#include <linux/atomic.h> 98 99#include "l2tp_core.h" 100 101#define PPPOL2TP_DRV_VERSION "V2.0" 102 103/* Space for UDP, L2TP and PPP headers */ 104#define PPPOL2TP_HEADER_OVERHEAD 40 105 106/* Number of bytes to build transmit L2TP headers. 107 * Unfortunately the size is different depending on whether sequence numbers 108 * are enabled. 109 */ 110#define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10 111#define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6 112 113/* Private data of each session. This data lives at the end of struct 114 * l2tp_session, referenced via session->priv[]. 115 */ 116struct pppol2tp_session { 117 int owner; /* pid that opened the socket */ 118 119 struct mutex sk_lock; /* Protects .sk */ 120 struct sock __rcu *sk; /* Pointer to the session PPPoX socket */ 121 struct sock *__sk; /* Copy of .sk, for cleanup */ 122 struct rcu_head rcu; /* For asynchronous release */ 123}; 124 125static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb); 126 127static const struct ppp_channel_ops pppol2tp_chan_ops = { 128 .start_xmit = pppol2tp_xmit, 129}; 130 131static const struct proto_ops pppol2tp_ops; 132 133/* Retrieves the pppol2tp socket associated to a session. 134 * A reference is held on the returned socket, so this function must be paired 135 * with sock_put(). 136 */ 137static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) 138{ 139 struct pppol2tp_session *ps = l2tp_session_priv(session); 140 struct sock *sk; 141 142 rcu_read_lock(); 143 sk = rcu_dereference(ps->sk); 144 if (sk) 145 sock_hold(sk); 146 rcu_read_unlock(); 147 148 return sk; 149} 150 151/* Helpers to obtain tunnel/session contexts from sockets. 152 */ 153static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) 154{ 155 struct l2tp_session *session; 156 157 if (!sk) 158 return NULL; 159 160 sock_hold(sk); 161 session = (struct l2tp_session *)(sk->sk_user_data); 162 if (!session) { 163 sock_put(sk); 164 goto out; 165 } 166 if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) { 167 session = NULL; 168 sock_put(sk); 169 goto out; 170 } 171 172out: 173 return session; 174} 175 176/***************************************************************************** 177 * Receive data handling 178 *****************************************************************************/ 179 180/* Receive message. This is the recvmsg for the PPPoL2TP socket. 181 */ 182static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, 183 size_t len, int flags) 184{ 185 int err; 186 struct sk_buff *skb; 187 struct sock *sk = sock->sk; 188 189 err = -EIO; 190 if (sk->sk_state & PPPOX_BOUND) 191 goto end; 192 193 err = 0; 194 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 195 flags & MSG_DONTWAIT, &err); 196 if (!skb) 197 goto end; 198 199 if (len > skb->len) 200 len = skb->len; 201 else if (len < skb->len) 202 msg->msg_flags |= MSG_TRUNC; 203 204 err = skb_copy_datagram_msg(skb, 0, msg, len); 205 if (likely(err == 0)) 206 err = len; 207 208 kfree_skb(skb); 209end: 210 return err; 211} 212 213static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) 214{ 215 struct pppol2tp_session *ps = l2tp_session_priv(session); 216 struct sock *sk = NULL; 217 218 /* If the socket is bound, send it in to PPP's input queue. Otherwise 219 * queue it on the session socket. 220 */ 221 rcu_read_lock(); 222 sk = rcu_dereference(ps->sk); 223 if (!sk) 224 goto no_sock; 225 226 /* If the first two bytes are 0xFF03, consider that it is the PPP's 227 * Address and Control fields and skip them. The L2TP module has always 228 * worked this way, although, in theory, the use of these fields should 229 * be negociated and handled at the PPP layer. These fields are 230 * constant: 0xFF is the All-Stations Address and 0x03 the Unnumbered 231 * Information command with Poll/Final bit set to zero (RFC 1662). 232 */ 233 if (pskb_may_pull(skb, 2) && skb->data[0] == PPP_ALLSTATIONS && 234 skb->data[1] == PPP_UI) 235 skb_pull(skb, 2); 236 237 if (sk->sk_state & PPPOX_BOUND) { 238 struct pppox_sock *po; 239 240 po = pppox_sk(sk); 241 ppp_input(&po->chan, skb); 242 } else { 243 if (sock_queue_rcv_skb(sk, skb) < 0) { 244 atomic_long_inc(&session->stats.rx_errors); 245 kfree_skb(skb); 246 } 247 } 248 rcu_read_unlock(); 249 250 return; 251 252no_sock: 253 rcu_read_unlock(); 254 pr_warn_ratelimited("%s: no socket in recv\n", session->name); 255 kfree_skb(skb); 256} 257 258/************************************************************************ 259 * Transmit handling 260 ***********************************************************************/ 261 262/* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here 263 * when a user application does a sendmsg() on the session socket. L2TP and 264 * PPP headers must be inserted into the user's data. 265 */ 266static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m, 267 size_t total_len) 268{ 269 struct sock *sk = sock->sk; 270 struct sk_buff *skb; 271 int error; 272 struct l2tp_session *session; 273 struct l2tp_tunnel *tunnel; 274 int uhlen; 275 276 error = -ENOTCONN; 277 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 278 goto error; 279 280 /* Get session and tunnel contexts */ 281 error = -EBADF; 282 session = pppol2tp_sock_to_session(sk); 283 if (!session) 284 goto error; 285 286 tunnel = session->tunnel; 287 288 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 289 290 /* Allocate a socket buffer */ 291 error = -ENOMEM; 292 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 293 uhlen + session->hdr_len + 294 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 295 0, GFP_KERNEL); 296 if (!skb) 297 goto error_put_sess; 298 299 /* Reserve space for headers. */ 300 skb_reserve(skb, NET_SKB_PAD); 301 skb_reset_network_header(skb); 302 skb_reserve(skb, sizeof(struct iphdr)); 303 skb_reset_transport_header(skb); 304 skb_reserve(skb, uhlen); 305 306 /* Add PPP header */ 307 skb->data[0] = PPP_ALLSTATIONS; 308 skb->data[1] = PPP_UI; 309 skb_put(skb, 2); 310 311 /* Copy user data into skb */ 312 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len); 313 if (error < 0) { 314 kfree_skb(skb); 315 goto error_put_sess; 316 } 317 318 local_bh_disable(); 319 l2tp_xmit_skb(session, skb); 320 local_bh_enable(); 321 322 sock_put(sk); 323 324 return total_len; 325 326error_put_sess: 327 sock_put(sk); 328error: 329 return error; 330} 331 332/* Transmit function called by generic PPP driver. Sends PPP frame 333 * over PPPoL2TP socket. 334 * 335 * This is almost the same as pppol2tp_sendmsg(), but rather than 336 * being called with a msghdr from userspace, it is called with a skb 337 * from the kernel. 338 * 339 * The supplied skb from ppp doesn't have enough headroom for the 340 * insertion of L2TP, UDP and IP headers so we need to allocate more 341 * headroom in the skb. This will create a cloned skb. But we must be 342 * careful in the error case because the caller will expect to free 343 * the skb it supplied, not our cloned skb. So we take care to always 344 * leave the original skb unfreed if we return an error. 345 */ 346static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) 347{ 348 struct sock *sk = (struct sock *)chan->private; 349 struct l2tp_session *session; 350 struct l2tp_tunnel *tunnel; 351 int uhlen, headroom; 352 353 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 354 goto abort; 355 356 /* Get session and tunnel contexts from the socket */ 357 session = pppol2tp_sock_to_session(sk); 358 if (!session) 359 goto abort; 360 361 tunnel = session->tunnel; 362 363 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 364 headroom = NET_SKB_PAD + 365 sizeof(struct iphdr) + /* IP header */ 366 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */ 367 session->hdr_len + /* L2TP header */ 368 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 369 if (skb_cow_head(skb, headroom)) 370 goto abort_put_sess; 371 372 /* Setup PPP header */ 373 __skb_push(skb, 2); 374 skb->data[0] = PPP_ALLSTATIONS; 375 skb->data[1] = PPP_UI; 376 377 local_bh_disable(); 378 l2tp_xmit_skb(session, skb); 379 local_bh_enable(); 380 381 sock_put(sk); 382 383 return 1; 384 385abort_put_sess: 386 sock_put(sk); 387abort: 388 /* Free the original skb */ 389 kfree_skb(skb); 390 return 1; 391} 392 393/***************************************************************************** 394 * Session (and tunnel control) socket create/destroy. 395 *****************************************************************************/ 396 397static void pppol2tp_put_sk(struct rcu_head *head) 398{ 399 struct pppol2tp_session *ps; 400 401 ps = container_of(head, typeof(*ps), rcu); 402 sock_put(ps->__sk); 403} 404 405/* Really kill the session socket. (Called from sock_put() if 406 * refcnt == 0.) 407 */ 408static void pppol2tp_session_destruct(struct sock *sk) 409{ 410 struct l2tp_session *session = sk->sk_user_data; 411 412 skb_queue_purge(&sk->sk_receive_queue); 413 skb_queue_purge(&sk->sk_write_queue); 414 415 if (session) { 416 sk->sk_user_data = NULL; 417 if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) 418 return; 419 l2tp_session_dec_refcount(session); 420 } 421} 422 423/* Called when the PPPoX socket (session) is closed. 424 */ 425static int pppol2tp_release(struct socket *sock) 426{ 427 struct sock *sk = sock->sk; 428 struct l2tp_session *session; 429 int error; 430 431 if (!sk) 432 return 0; 433 434 error = -EBADF; 435 lock_sock(sk); 436 if (sock_flag(sk, SOCK_DEAD) != 0) 437 goto error; 438 439 pppox_unbind_sock(sk); 440 441 /* Signal the death of the socket. */ 442 sk->sk_state = PPPOX_DEAD; 443 sock_orphan(sk); 444 sock->sk = NULL; 445 446 session = pppol2tp_sock_to_session(sk); 447 if (session) { 448 struct pppol2tp_session *ps; 449 450 l2tp_session_delete(session); 451 452 ps = l2tp_session_priv(session); 453 mutex_lock(&ps->sk_lock); 454 ps->__sk = rcu_dereference_protected(ps->sk, 455 lockdep_is_held(&ps->sk_lock)); 456 RCU_INIT_POINTER(ps->sk, NULL); 457 mutex_unlock(&ps->sk_lock); 458 call_rcu(&ps->rcu, pppol2tp_put_sk); 459 460 /* Rely on the sock_put() call at the end of the function for 461 * dropping the reference held by pppol2tp_sock_to_session(). 462 * The last reference will be dropped by pppol2tp_put_sk(). 463 */ 464 } 465 466 release_sock(sk); 467 468 /* This will delete the session context via 469 * pppol2tp_session_destruct() if the socket's refcnt drops to 470 * zero. 471 */ 472 sock_put(sk); 473 474 return 0; 475 476error: 477 release_sock(sk); 478 return error; 479} 480 481static struct proto pppol2tp_sk_proto = { 482 .name = "PPPOL2TP", 483 .owner = THIS_MODULE, 484 .obj_size = sizeof(struct pppox_sock), 485}; 486 487static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb) 488{ 489 int rc; 490 491 rc = l2tp_udp_encap_recv(sk, skb); 492 if (rc) 493 kfree_skb(skb); 494 495 return NET_RX_SUCCESS; 496} 497 498/* socket() handler. Initialize a new struct sock. 499 */ 500static int pppol2tp_create(struct net *net, struct socket *sock, int kern) 501{ 502 int error = -ENOMEM; 503 struct sock *sk; 504 505 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern); 506 if (!sk) 507 goto out; 508 509 sock_init_data(sock, sk); 510 511 sock->state = SS_UNCONNECTED; 512 sock->ops = &pppol2tp_ops; 513 514 sk->sk_backlog_rcv = pppol2tp_backlog_recv; 515 sk->sk_protocol = PX_PROTO_OL2TP; 516 sk->sk_family = PF_PPPOX; 517 sk->sk_state = PPPOX_NONE; 518 sk->sk_type = SOCK_STREAM; 519 sk->sk_destruct = pppol2tp_session_destruct; 520 521 error = 0; 522 523out: 524 return error; 525} 526 527static void pppol2tp_show(struct seq_file *m, void *arg) 528{ 529 struct l2tp_session *session = arg; 530 struct sock *sk; 531 532 sk = pppol2tp_session_get_sock(session); 533 if (sk) { 534 struct pppox_sock *po = pppox_sk(sk); 535 536 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 537 sock_put(sk); 538 } 539} 540 541static void pppol2tp_session_init(struct l2tp_session *session) 542{ 543 struct pppol2tp_session *ps; 544 545 session->recv_skb = pppol2tp_recv; 546 if (IS_ENABLED(CONFIG_L2TP_DEBUGFS)) 547 session->show = pppol2tp_show; 548 549 ps = l2tp_session_priv(session); 550 mutex_init(&ps->sk_lock); 551 ps->owner = current->pid; 552} 553 554struct l2tp_connect_info { 555 u8 version; 556 int fd; 557 u32 tunnel_id; 558 u32 peer_tunnel_id; 559 u32 session_id; 560 u32 peer_session_id; 561}; 562 563static int pppol2tp_sockaddr_get_info(const void *sa, int sa_len, 564 struct l2tp_connect_info *info) 565{ 566 switch (sa_len) { 567 case sizeof(struct sockaddr_pppol2tp): 568 { 569 const struct sockaddr_pppol2tp *sa_v2in4 = sa; 570 571 if (sa_v2in4->sa_protocol != PX_PROTO_OL2TP) 572 return -EINVAL; 573 574 info->version = 2; 575 info->fd = sa_v2in4->pppol2tp.fd; 576 info->tunnel_id = sa_v2in4->pppol2tp.s_tunnel; 577 info->peer_tunnel_id = sa_v2in4->pppol2tp.d_tunnel; 578 info->session_id = sa_v2in4->pppol2tp.s_session; 579 info->peer_session_id = sa_v2in4->pppol2tp.d_session; 580 581 break; 582 } 583 case sizeof(struct sockaddr_pppol2tpv3): 584 { 585 const struct sockaddr_pppol2tpv3 *sa_v3in4 = sa; 586 587 if (sa_v3in4->sa_protocol != PX_PROTO_OL2TP) 588 return -EINVAL; 589 590 info->version = 3; 591 info->fd = sa_v3in4->pppol2tp.fd; 592 info->tunnel_id = sa_v3in4->pppol2tp.s_tunnel; 593 info->peer_tunnel_id = sa_v3in4->pppol2tp.d_tunnel; 594 info->session_id = sa_v3in4->pppol2tp.s_session; 595 info->peer_session_id = sa_v3in4->pppol2tp.d_session; 596 597 break; 598 } 599 case sizeof(struct sockaddr_pppol2tpin6): 600 { 601 const struct sockaddr_pppol2tpin6 *sa_v2in6 = sa; 602 603 if (sa_v2in6->sa_protocol != PX_PROTO_OL2TP) 604 return -EINVAL; 605 606 info->version = 2; 607 info->fd = sa_v2in6->pppol2tp.fd; 608 info->tunnel_id = sa_v2in6->pppol2tp.s_tunnel; 609 info->peer_tunnel_id = sa_v2in6->pppol2tp.d_tunnel; 610 info->session_id = sa_v2in6->pppol2tp.s_session; 611 info->peer_session_id = sa_v2in6->pppol2tp.d_session; 612 613 break; 614 } 615 case sizeof(struct sockaddr_pppol2tpv3in6): 616 { 617 const struct sockaddr_pppol2tpv3in6 *sa_v3in6 = sa; 618 619 if (sa_v3in6->sa_protocol != PX_PROTO_OL2TP) 620 return -EINVAL; 621 622 info->version = 3; 623 info->fd = sa_v3in6->pppol2tp.fd; 624 info->tunnel_id = sa_v3in6->pppol2tp.s_tunnel; 625 info->peer_tunnel_id = sa_v3in6->pppol2tp.d_tunnel; 626 info->session_id = sa_v3in6->pppol2tp.s_session; 627 info->peer_session_id = sa_v3in6->pppol2tp.d_session; 628 629 break; 630 } 631 default: 632 return -EINVAL; 633 } 634 635 return 0; 636} 637 638/* Rough estimation of the maximum payload size a tunnel can transmit without 639 * fragmenting at the lower IP layer. Assumes L2TPv2 with sequence 640 * numbers and no IP option. Not quite accurate, but the result is mostly 641 * unused anyway. 642 */ 643static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel) 644{ 645 int mtu; 646 647 mtu = l2tp_tunnel_dst_mtu(tunnel); 648 if (mtu <= PPPOL2TP_HEADER_OVERHEAD) 649 return 1500 - PPPOL2TP_HEADER_OVERHEAD; 650 651 return mtu - PPPOL2TP_HEADER_OVERHEAD; 652} 653 654static struct l2tp_tunnel *pppol2tp_tunnel_get(struct net *net, 655 const struct l2tp_connect_info *info, 656 bool *new_tunnel) 657{ 658 struct l2tp_tunnel *tunnel; 659 int error; 660 661 *new_tunnel = false; 662 663 tunnel = l2tp_tunnel_get(net, info->tunnel_id); 664 665 /* Special case: create tunnel context if session_id and 666 * peer_session_id is 0. Otherwise look up tunnel using supplied 667 * tunnel id. 668 */ 669 if (!info->session_id && !info->peer_session_id) { 670 if (!tunnel) { 671 struct l2tp_tunnel_cfg tcfg = { 672 .encap = L2TP_ENCAPTYPE_UDP, 673 }; 674 675 /* Prevent l2tp_tunnel_register() from trying to set up 676 * a kernel socket. 677 */ 678 if (info->fd < 0) 679 return ERR_PTR(-EBADF); 680 681 error = l2tp_tunnel_create(info->fd, 682 info->version, 683 info->tunnel_id, 684 info->peer_tunnel_id, &tcfg, 685 &tunnel); 686 if (error < 0) 687 return ERR_PTR(error); 688 689 l2tp_tunnel_inc_refcount(tunnel); 690 error = l2tp_tunnel_register(tunnel, net, &tcfg); 691 if (error < 0) { 692 kfree(tunnel); 693 return ERR_PTR(error); 694 } 695 696 *new_tunnel = true; 697 } 698 } else { 699 /* Error if we can't find the tunnel */ 700 if (!tunnel) 701 return ERR_PTR(-ENOENT); 702 703 /* Error if socket is not prepped */ 704 if (!tunnel->sock) { 705 l2tp_tunnel_dec_refcount(tunnel); 706 return ERR_PTR(-ENOENT); 707 } 708 } 709 710 return tunnel; 711} 712 713/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket 714 */ 715static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 716 int sockaddr_len, int flags) 717{ 718 struct sock *sk = sock->sk; 719 struct pppox_sock *po = pppox_sk(sk); 720 struct l2tp_session *session = NULL; 721 struct l2tp_connect_info info; 722 struct l2tp_tunnel *tunnel; 723 struct pppol2tp_session *ps; 724 struct l2tp_session_cfg cfg = { 0, }; 725 bool drop_refcnt = false; 726 bool new_session = false; 727 bool new_tunnel = false; 728 int error; 729 730 error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info); 731 if (error < 0) 732 return error; 733 734 /* Don't bind if tunnel_id is 0 */ 735 if (!info.tunnel_id) 736 return -EINVAL; 737 738 tunnel = pppol2tp_tunnel_get(sock_net(sk), &info, &new_tunnel); 739 if (IS_ERR(tunnel)) 740 return PTR_ERR(tunnel); 741 742 lock_sock(sk); 743 744 /* Check for already bound sockets */ 745 error = -EBUSY; 746 if (sk->sk_state & PPPOX_CONNECTED) 747 goto end; 748 749 /* We don't supporting rebinding anyway */ 750 error = -EALREADY; 751 if (sk->sk_user_data) 752 goto end; /* socket is already attached */ 753 754 if (tunnel->peer_tunnel_id == 0) 755 tunnel->peer_tunnel_id = info.peer_tunnel_id; 756 757 session = l2tp_tunnel_get_session(tunnel, info.session_id); 758 if (session) { 759 drop_refcnt = true; 760 761 if (session->pwtype != L2TP_PWTYPE_PPP) { 762 error = -EPROTOTYPE; 763 goto end; 764 } 765 766 ps = l2tp_session_priv(session); 767 768 /* Using a pre-existing session is fine as long as it hasn't 769 * been connected yet. 770 */ 771 mutex_lock(&ps->sk_lock); 772 if (rcu_dereference_protected(ps->sk, 773 lockdep_is_held(&ps->sk_lock)) || 774 ps->__sk) { 775 mutex_unlock(&ps->sk_lock); 776 error = -EEXIST; 777 goto end; 778 } 779 } else { 780 cfg.pw_type = L2TP_PWTYPE_PPP; 781 782 session = l2tp_session_create(sizeof(struct pppol2tp_session), 783 tunnel, info.session_id, 784 info.peer_session_id, &cfg); 785 if (IS_ERR(session)) { 786 error = PTR_ERR(session); 787 goto end; 788 } 789 790 pppol2tp_session_init(session); 791 ps = l2tp_session_priv(session); 792 l2tp_session_inc_refcount(session); 793 794 mutex_lock(&ps->sk_lock); 795 error = l2tp_session_register(session, tunnel); 796 if (error < 0) { 797 mutex_unlock(&ps->sk_lock); 798 kfree(session); 799 goto end; 800 } 801 drop_refcnt = true; 802 new_session = true; 803 } 804 805 /* Special case: if source & dest session_id == 0x0000, this 806 * socket is being created to manage the tunnel. Just set up 807 * the internal context for use by ioctl() and sockopt() 808 * handlers. 809 */ 810 if (session->session_id == 0 && session->peer_session_id == 0) { 811 error = 0; 812 goto out_no_ppp; 813 } 814 815 /* The only header we need to worry about is the L2TP 816 * header. This size is different depending on whether 817 * sequence numbers are enabled for the data channel. 818 */ 819 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 820 821 po->chan.private = sk; 822 po->chan.ops = &pppol2tp_chan_ops; 823 po->chan.mtu = pppol2tp_tunnel_mtu(tunnel); 824 825 error = ppp_register_net_channel(sock_net(sk), &po->chan); 826 if (error) { 827 mutex_unlock(&ps->sk_lock); 828 goto end; 829 } 830 831out_no_ppp: 832 /* This is how we get the session context from the socket. */ 833 sk->sk_user_data = session; 834 rcu_assign_pointer(ps->sk, sk); 835 mutex_unlock(&ps->sk_lock); 836 837 /* Keep the reference we've grabbed on the session: sk doesn't expect 838 * the session to disappear. pppol2tp_session_destruct() is responsible 839 * for dropping it. 840 */ 841 drop_refcnt = false; 842 843 sk->sk_state = PPPOX_CONNECTED; 844 845end: 846 if (error) { 847 if (new_session) 848 l2tp_session_delete(session); 849 if (new_tunnel) 850 l2tp_tunnel_delete(tunnel); 851 } 852 if (drop_refcnt) 853 l2tp_session_dec_refcount(session); 854 l2tp_tunnel_dec_refcount(tunnel); 855 release_sock(sk); 856 857 return error; 858} 859 860#ifdef CONFIG_L2TP_V3 861 862/* Called when creating sessions via the netlink interface. */ 863static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, 864 u32 session_id, u32 peer_session_id, 865 struct l2tp_session_cfg *cfg) 866{ 867 int error; 868 struct l2tp_session *session; 869 870 /* Error if tunnel socket is not prepped */ 871 if (!tunnel->sock) { 872 error = -ENOENT; 873 goto err; 874 } 875 876 /* Allocate and initialize a new session context. */ 877 session = l2tp_session_create(sizeof(struct pppol2tp_session), 878 tunnel, session_id, 879 peer_session_id, cfg); 880 if (IS_ERR(session)) { 881 error = PTR_ERR(session); 882 goto err; 883 } 884 885 pppol2tp_session_init(session); 886 887 error = l2tp_session_register(session, tunnel); 888 if (error < 0) 889 goto err_sess; 890 891 return 0; 892 893err_sess: 894 kfree(session); 895err: 896 return error; 897} 898 899#endif /* CONFIG_L2TP_V3 */ 900 901/* getname() support. 902 */ 903static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr, 904 int peer) 905{ 906 int len = 0; 907 int error = 0; 908 struct l2tp_session *session; 909 struct l2tp_tunnel *tunnel; 910 struct sock *sk = sock->sk; 911 struct inet_sock *inet; 912 struct pppol2tp_session *pls; 913 914 error = -ENOTCONN; 915 if (!sk) 916 goto end; 917 if (!(sk->sk_state & PPPOX_CONNECTED)) 918 goto end; 919 920 error = -EBADF; 921 session = pppol2tp_sock_to_session(sk); 922 if (!session) 923 goto end; 924 925 pls = l2tp_session_priv(session); 926 tunnel = session->tunnel; 927 928 inet = inet_sk(tunnel->sock); 929 if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET) { 930 struct sockaddr_pppol2tp sp; 931 932 len = sizeof(sp); 933 memset(&sp, 0, len); 934 sp.sa_family = AF_PPPOX; 935 sp.sa_protocol = PX_PROTO_OL2TP; 936 sp.pppol2tp.fd = tunnel->fd; 937 sp.pppol2tp.pid = pls->owner; 938 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 939 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 940 sp.pppol2tp.s_session = session->session_id; 941 sp.pppol2tp.d_session = session->peer_session_id; 942 sp.pppol2tp.addr.sin_family = AF_INET; 943 sp.pppol2tp.addr.sin_port = inet->inet_dport; 944 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 945 memcpy(uaddr, &sp, len); 946#if IS_ENABLED(CONFIG_IPV6) 947 } else if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET6) { 948 struct sockaddr_pppol2tpin6 sp; 949 950 len = sizeof(sp); 951 memset(&sp, 0, len); 952 sp.sa_family = AF_PPPOX; 953 sp.sa_protocol = PX_PROTO_OL2TP; 954 sp.pppol2tp.fd = tunnel->fd; 955 sp.pppol2tp.pid = pls->owner; 956 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 957 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 958 sp.pppol2tp.s_session = session->session_id; 959 sp.pppol2tp.d_session = session->peer_session_id; 960 sp.pppol2tp.addr.sin6_family = AF_INET6; 961 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 962 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 963 sizeof(tunnel->sock->sk_v6_daddr)); 964 memcpy(uaddr, &sp, len); 965 } else if (tunnel->version == 3 && tunnel->sock->sk_family == AF_INET6) { 966 struct sockaddr_pppol2tpv3in6 sp; 967 968 len = sizeof(sp); 969 memset(&sp, 0, len); 970 sp.sa_family = AF_PPPOX; 971 sp.sa_protocol = PX_PROTO_OL2TP; 972 sp.pppol2tp.fd = tunnel->fd; 973 sp.pppol2tp.pid = pls->owner; 974 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 975 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 976 sp.pppol2tp.s_session = session->session_id; 977 sp.pppol2tp.d_session = session->peer_session_id; 978 sp.pppol2tp.addr.sin6_family = AF_INET6; 979 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 980 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 981 sizeof(tunnel->sock->sk_v6_daddr)); 982 memcpy(uaddr, &sp, len); 983#endif 984 } else if (tunnel->version == 3) { 985 struct sockaddr_pppol2tpv3 sp; 986 987 len = sizeof(sp); 988 memset(&sp, 0, len); 989 sp.sa_family = AF_PPPOX; 990 sp.sa_protocol = PX_PROTO_OL2TP; 991 sp.pppol2tp.fd = tunnel->fd; 992 sp.pppol2tp.pid = pls->owner; 993 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 994 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 995 sp.pppol2tp.s_session = session->session_id; 996 sp.pppol2tp.d_session = session->peer_session_id; 997 sp.pppol2tp.addr.sin_family = AF_INET; 998 sp.pppol2tp.addr.sin_port = inet->inet_dport; 999 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 1000 memcpy(uaddr, &sp, len); 1001 } 1002 1003 error = len; 1004 1005 sock_put(sk); 1006end: 1007 return error; 1008} 1009 1010/**************************************************************************** 1011 * ioctl() handlers. 1012 * 1013 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1014 * sockets. However, in order to control kernel tunnel features, we allow 1015 * userspace to create a special "tunnel" PPPoX socket which is used for 1016 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow 1017 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl() 1018 * calls. 1019 ****************************************************************************/ 1020 1021static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest, 1022 const struct l2tp_stats *stats) 1023{ 1024 memset(dest, 0, sizeof(*dest)); 1025 1026 dest->tx_packets = atomic_long_read(&stats->tx_packets); 1027 dest->tx_bytes = atomic_long_read(&stats->tx_bytes); 1028 dest->tx_errors = atomic_long_read(&stats->tx_errors); 1029 dest->rx_packets = atomic_long_read(&stats->rx_packets); 1030 dest->rx_bytes = atomic_long_read(&stats->rx_bytes); 1031 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards); 1032 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets); 1033 dest->rx_errors = atomic_long_read(&stats->rx_errors); 1034} 1035 1036static int pppol2tp_tunnel_copy_stats(struct pppol2tp_ioc_stats *stats, 1037 struct l2tp_tunnel *tunnel) 1038{ 1039 struct l2tp_session *session; 1040 1041 if (!stats->session_id) { 1042 pppol2tp_copy_stats(stats, &tunnel->stats); 1043 return 0; 1044 } 1045 1046 /* If session_id is set, search the corresponding session in the 1047 * context of this tunnel and record the session's statistics. 1048 */ 1049 session = l2tp_tunnel_get_session(tunnel, stats->session_id); 1050 if (!session) 1051 return -EBADR; 1052 1053 if (session->pwtype != L2TP_PWTYPE_PPP) { 1054 l2tp_session_dec_refcount(session); 1055 return -EBADR; 1056 } 1057 1058 pppol2tp_copy_stats(stats, &session->stats); 1059 l2tp_session_dec_refcount(session); 1060 1061 return 0; 1062} 1063 1064static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, 1065 unsigned long arg) 1066{ 1067 struct pppol2tp_ioc_stats stats; 1068 struct l2tp_session *session; 1069 1070 switch (cmd) { 1071 case PPPIOCGMRU: 1072 case PPPIOCGFLAGS: 1073 session = sock->sk->sk_user_data; 1074 if (!session) 1075 return -ENOTCONN; 1076 1077 if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) 1078 return -EBADF; 1079 1080 /* Not defined for tunnels */ 1081 if (!session->session_id && !session->peer_session_id) 1082 return -ENOSYS; 1083 1084 if (put_user(0, (int __user *)arg)) 1085 return -EFAULT; 1086 break; 1087 1088 case PPPIOCSMRU: 1089 case PPPIOCSFLAGS: 1090 session = sock->sk->sk_user_data; 1091 if (!session) 1092 return -ENOTCONN; 1093 1094 if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) 1095 return -EBADF; 1096 1097 /* Not defined for tunnels */ 1098 if (!session->session_id && !session->peer_session_id) 1099 return -ENOSYS; 1100 1101 if (!access_ok((int __user *)arg, sizeof(int))) 1102 return -EFAULT; 1103 break; 1104 1105 case PPPIOCGL2TPSTATS: 1106 session = sock->sk->sk_user_data; 1107 if (!session) 1108 return -ENOTCONN; 1109 1110 if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) 1111 return -EBADF; 1112 1113 /* Session 0 represents the parent tunnel */ 1114 if (!session->session_id && !session->peer_session_id) { 1115 u32 session_id; 1116 int err; 1117 1118 if (copy_from_user(&stats, (void __user *)arg, 1119 sizeof(stats))) 1120 return -EFAULT; 1121 1122 session_id = stats.session_id; 1123 err = pppol2tp_tunnel_copy_stats(&stats, 1124 session->tunnel); 1125 if (err < 0) 1126 return err; 1127 1128 stats.session_id = session_id; 1129 } else { 1130 pppol2tp_copy_stats(&stats, &session->stats); 1131 stats.session_id = session->session_id; 1132 } 1133 stats.tunnel_id = session->tunnel->tunnel_id; 1134 stats.using_ipsec = l2tp_tunnel_uses_xfrm(session->tunnel); 1135 1136 if (copy_to_user((void __user *)arg, &stats, sizeof(stats))) 1137 return -EFAULT; 1138 break; 1139 1140 default: 1141 return -ENOIOCTLCMD; 1142 } 1143 1144 return 0; 1145} 1146 1147/***************************************************************************** 1148 * setsockopt() / getsockopt() support. 1149 * 1150 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1151 * sockets. In order to control kernel tunnel features, we allow userspace to 1152 * create a special "tunnel" PPPoX socket which is used for control only. 1153 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user 1154 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls. 1155 *****************************************************************************/ 1156 1157/* Tunnel setsockopt() helper. 1158 */ 1159static int pppol2tp_tunnel_setsockopt(struct sock *sk, 1160 struct l2tp_tunnel *tunnel, 1161 int optname, int val) 1162{ 1163 int err = 0; 1164 1165 switch (optname) { 1166 case PPPOL2TP_SO_DEBUG: 1167 /* Tunnel debug flags option is deprecated */ 1168 break; 1169 1170 default: 1171 err = -ENOPROTOOPT; 1172 break; 1173 } 1174 1175 return err; 1176} 1177 1178/* Session setsockopt helper. 1179 */ 1180static int pppol2tp_session_setsockopt(struct sock *sk, 1181 struct l2tp_session *session, 1182 int optname, int val) 1183{ 1184 int err = 0; 1185 1186 switch (optname) { 1187 case PPPOL2TP_SO_RECVSEQ: 1188 if (val != 0 && val != 1) { 1189 err = -EINVAL; 1190 break; 1191 } 1192 session->recv_seq = !!val; 1193 break; 1194 1195 case PPPOL2TP_SO_SENDSEQ: 1196 if (val != 0 && val != 1) { 1197 err = -EINVAL; 1198 break; 1199 } 1200 session->send_seq = !!val; 1201 { 1202 struct pppox_sock *po = pppox_sk(sk); 1203 1204 po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ : 1205 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 1206 } 1207 l2tp_session_set_header_len(session, session->tunnel->version); 1208 break; 1209 1210 case PPPOL2TP_SO_LNSMODE: 1211 if (val != 0 && val != 1) { 1212 err = -EINVAL; 1213 break; 1214 } 1215 session->lns_mode = !!val; 1216 break; 1217 1218 case PPPOL2TP_SO_DEBUG: 1219 /* Session debug flags option is deprecated */ 1220 break; 1221 1222 case PPPOL2TP_SO_REORDERTO: 1223 session->reorder_timeout = msecs_to_jiffies(val); 1224 break; 1225 1226 default: 1227 err = -ENOPROTOOPT; 1228 break; 1229 } 1230 1231 return err; 1232} 1233 1234/* Main setsockopt() entry point. 1235 * Does API checks, then calls either the tunnel or session setsockopt 1236 * handler, according to whether the PPPoL2TP socket is a for a regular 1237 * session or the special tunnel type. 1238 */ 1239static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, 1240 sockptr_t optval, unsigned int optlen) 1241{ 1242 struct sock *sk = sock->sk; 1243 struct l2tp_session *session; 1244 struct l2tp_tunnel *tunnel; 1245 int val; 1246 int err; 1247 1248 if (level != SOL_PPPOL2TP) 1249 return -EINVAL; 1250 1251 if (optlen < sizeof(int)) 1252 return -EINVAL; 1253 1254 if (copy_from_sockptr(&val, optval, sizeof(int))) 1255 return -EFAULT; 1256 1257 err = -ENOTCONN; 1258 if (!sk->sk_user_data) 1259 goto end; 1260 1261 /* Get session context from the socket */ 1262 err = -EBADF; 1263 session = pppol2tp_sock_to_session(sk); 1264 if (!session) 1265 goto end; 1266 1267 /* Special case: if session_id == 0x0000, treat as operation on tunnel 1268 */ 1269 if (session->session_id == 0 && session->peer_session_id == 0) { 1270 tunnel = session->tunnel; 1271 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val); 1272 } else { 1273 err = pppol2tp_session_setsockopt(sk, session, optname, val); 1274 } 1275 1276 sock_put(sk); 1277end: 1278 return err; 1279} 1280 1281/* Tunnel getsockopt helper. Called with sock locked. 1282 */ 1283static int pppol2tp_tunnel_getsockopt(struct sock *sk, 1284 struct l2tp_tunnel *tunnel, 1285 int optname, int *val) 1286{ 1287 int err = 0; 1288 1289 switch (optname) { 1290 case PPPOL2TP_SO_DEBUG: 1291 /* Tunnel debug flags option is deprecated */ 1292 *val = 0; 1293 break; 1294 1295 default: 1296 err = -ENOPROTOOPT; 1297 break; 1298 } 1299 1300 return err; 1301} 1302 1303/* Session getsockopt helper. Called with sock locked. 1304 */ 1305static int pppol2tp_session_getsockopt(struct sock *sk, 1306 struct l2tp_session *session, 1307 int optname, int *val) 1308{ 1309 int err = 0; 1310 1311 switch (optname) { 1312 case PPPOL2TP_SO_RECVSEQ: 1313 *val = session->recv_seq; 1314 break; 1315 1316 case PPPOL2TP_SO_SENDSEQ: 1317 *val = session->send_seq; 1318 break; 1319 1320 case PPPOL2TP_SO_LNSMODE: 1321 *val = session->lns_mode; 1322 break; 1323 1324 case PPPOL2TP_SO_DEBUG: 1325 /* Session debug flags option is deprecated */ 1326 *val = 0; 1327 break; 1328 1329 case PPPOL2TP_SO_REORDERTO: 1330 *val = (int)jiffies_to_msecs(session->reorder_timeout); 1331 break; 1332 1333 default: 1334 err = -ENOPROTOOPT; 1335 } 1336 1337 return err; 1338} 1339 1340/* Main getsockopt() entry point. 1341 * Does API checks, then calls either the tunnel or session getsockopt 1342 * handler, according to whether the PPPoX socket is a for a regular session 1343 * or the special tunnel type. 1344 */ 1345static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, 1346 char __user *optval, int __user *optlen) 1347{ 1348 struct sock *sk = sock->sk; 1349 struct l2tp_session *session; 1350 struct l2tp_tunnel *tunnel; 1351 int val, len; 1352 int err; 1353 1354 if (level != SOL_PPPOL2TP) 1355 return -EINVAL; 1356 1357 if (get_user(len, optlen)) 1358 return -EFAULT; 1359 1360 len = min_t(unsigned int, len, sizeof(int)); 1361 1362 if (len < 0) 1363 return -EINVAL; 1364 1365 err = -ENOTCONN; 1366 if (!sk->sk_user_data) 1367 goto end; 1368 1369 /* Get the session context */ 1370 err = -EBADF; 1371 session = pppol2tp_sock_to_session(sk); 1372 if (!session) 1373 goto end; 1374 1375 /* Special case: if session_id == 0x0000, treat as operation on tunnel */ 1376 if (session->session_id == 0 && session->peer_session_id == 0) { 1377 tunnel = session->tunnel; 1378 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val); 1379 if (err) 1380 goto end_put_sess; 1381 } else { 1382 err = pppol2tp_session_getsockopt(sk, session, optname, &val); 1383 if (err) 1384 goto end_put_sess; 1385 } 1386 1387 err = -EFAULT; 1388 if (put_user(len, optlen)) 1389 goto end_put_sess; 1390 1391 if (copy_to_user((void __user *)optval, &val, len)) 1392 goto end_put_sess; 1393 1394 err = 0; 1395 1396end_put_sess: 1397 sock_put(sk); 1398end: 1399 return err; 1400} 1401 1402/***************************************************************************** 1403 * /proc filesystem for debug 1404 * Since the original pppol2tp driver provided /proc/net/pppol2tp for 1405 * L2TPv2, we dump only L2TPv2 tunnels and sessions here. 1406 *****************************************************************************/ 1407 1408static unsigned int pppol2tp_net_id; 1409 1410#ifdef CONFIG_PROC_FS 1411 1412struct pppol2tp_seq_data { 1413 struct seq_net_private p; 1414 int tunnel_idx; /* current tunnel */ 1415 int session_idx; /* index of session within current tunnel */ 1416 struct l2tp_tunnel *tunnel; 1417 struct l2tp_session *session; /* NULL means get next tunnel */ 1418}; 1419 1420static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) 1421{ 1422 /* Drop reference taken during previous invocation */ 1423 if (pd->tunnel) 1424 l2tp_tunnel_dec_refcount(pd->tunnel); 1425 1426 for (;;) { 1427 pd->tunnel = l2tp_tunnel_get_nth(net, pd->tunnel_idx); 1428 pd->tunnel_idx++; 1429 1430 /* Only accept L2TPv2 tunnels */ 1431 if (!pd->tunnel || pd->tunnel->version == 2) 1432 return; 1433 1434 l2tp_tunnel_dec_refcount(pd->tunnel); 1435 } 1436} 1437 1438static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) 1439{ 1440 /* Drop reference taken during previous invocation */ 1441 if (pd->session) 1442 l2tp_session_dec_refcount(pd->session); 1443 1444 pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx); 1445 pd->session_idx++; 1446 1447 if (!pd->session) { 1448 pd->session_idx = 0; 1449 pppol2tp_next_tunnel(net, pd); 1450 } 1451} 1452 1453static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs) 1454{ 1455 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN; 1456 loff_t pos = *offs; 1457 struct net *net; 1458 1459 if (!pos) 1460 goto out; 1461 1462 if (WARN_ON(!m->private)) { 1463 pd = NULL; 1464 goto out; 1465 } 1466 1467 pd = m->private; 1468 net = seq_file_net(m); 1469 1470 if (!pd->tunnel) 1471 pppol2tp_next_tunnel(net, pd); 1472 else 1473 pppol2tp_next_session(net, pd); 1474 1475 /* NULL tunnel and session indicates end of list */ 1476 if (!pd->tunnel && !pd->session) 1477 pd = NULL; 1478 1479out: 1480 return pd; 1481} 1482 1483static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos) 1484{ 1485 (*pos)++; 1486 return NULL; 1487} 1488 1489static void pppol2tp_seq_stop(struct seq_file *p, void *v) 1490{ 1491 struct pppol2tp_seq_data *pd = v; 1492 1493 if (!pd || pd == SEQ_START_TOKEN) 1494 return; 1495 1496 /* Drop reference taken by last invocation of pppol2tp_next_session() 1497 * or pppol2tp_next_tunnel(). 1498 */ 1499 if (pd->session) { 1500 l2tp_session_dec_refcount(pd->session); 1501 pd->session = NULL; 1502 } 1503 if (pd->tunnel) { 1504 l2tp_tunnel_dec_refcount(pd->tunnel); 1505 pd->tunnel = NULL; 1506 } 1507} 1508 1509static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) 1510{ 1511 struct l2tp_tunnel *tunnel = v; 1512 1513 seq_printf(m, "\nTUNNEL '%s', %c %d\n", 1514 tunnel->name, 1515 (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N', 1516 refcount_read(&tunnel->ref_count) - 1); 1517 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n", 1518 0, 1519 atomic_long_read(&tunnel->stats.tx_packets), 1520 atomic_long_read(&tunnel->stats.tx_bytes), 1521 atomic_long_read(&tunnel->stats.tx_errors), 1522 atomic_long_read(&tunnel->stats.rx_packets), 1523 atomic_long_read(&tunnel->stats.rx_bytes), 1524 atomic_long_read(&tunnel->stats.rx_errors)); 1525} 1526 1527static void pppol2tp_seq_session_show(struct seq_file *m, void *v) 1528{ 1529 struct l2tp_session *session = v; 1530 struct l2tp_tunnel *tunnel = session->tunnel; 1531 unsigned char state; 1532 char user_data_ok; 1533 struct sock *sk; 1534 u32 ip = 0; 1535 u16 port = 0; 1536 1537 if (tunnel->sock) { 1538 struct inet_sock *inet = inet_sk(tunnel->sock); 1539 1540 ip = ntohl(inet->inet_saddr); 1541 port = ntohs(inet->inet_sport); 1542 } 1543 1544 sk = pppol2tp_session_get_sock(session); 1545 if (sk) { 1546 state = sk->sk_state; 1547 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N'; 1548 } else { 1549 state = 0; 1550 user_data_ok = 'N'; 1551 } 1552 1553 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> %04X/%04X %d %c\n", 1554 session->name, ip, port, 1555 tunnel->tunnel_id, 1556 session->session_id, 1557 tunnel->peer_tunnel_id, 1558 session->peer_session_id, 1559 state, user_data_ok); 1560 seq_printf(m, " 0/0/%c/%c/%s %08x %u\n", 1561 session->recv_seq ? 'R' : '-', 1562 session->send_seq ? 'S' : '-', 1563 session->lns_mode ? "LNS" : "LAC", 1564 0, 1565 jiffies_to_msecs(session->reorder_timeout)); 1566 seq_printf(m, " %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n", 1567 session->nr, session->ns, 1568 atomic_long_read(&session->stats.tx_packets), 1569 atomic_long_read(&session->stats.tx_bytes), 1570 atomic_long_read(&session->stats.tx_errors), 1571 atomic_long_read(&session->stats.rx_packets), 1572 atomic_long_read(&session->stats.rx_bytes), 1573 atomic_long_read(&session->stats.rx_errors)); 1574 1575 if (sk) { 1576 struct pppox_sock *po = pppox_sk(sk); 1577 1578 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 1579 sock_put(sk); 1580 } 1581} 1582 1583static int pppol2tp_seq_show(struct seq_file *m, void *v) 1584{ 1585 struct pppol2tp_seq_data *pd = v; 1586 1587 /* display header on line 1 */ 1588 if (v == SEQ_START_TOKEN) { 1589 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n"); 1590 seq_puts(m, "TUNNEL name, user-data-ok session-count\n"); 1591 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1592 seq_puts(m, " SESSION name, addr/port src-tid/sid dest-tid/sid state user-data-ok\n"); 1593 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n"); 1594 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1595 goto out; 1596 } 1597 1598 if (!pd->session) 1599 pppol2tp_seq_tunnel_show(m, pd->tunnel); 1600 else 1601 pppol2tp_seq_session_show(m, pd->session); 1602 1603out: 1604 return 0; 1605} 1606 1607static const struct seq_operations pppol2tp_seq_ops = { 1608 .start = pppol2tp_seq_start, 1609 .next = pppol2tp_seq_next, 1610 .stop = pppol2tp_seq_stop, 1611 .show = pppol2tp_seq_show, 1612}; 1613#endif /* CONFIG_PROC_FS */ 1614 1615/***************************************************************************** 1616 * Network namespace 1617 *****************************************************************************/ 1618 1619static __net_init int pppol2tp_init_net(struct net *net) 1620{ 1621 struct proc_dir_entry *pde; 1622 int err = 0; 1623 1624 pde = proc_create_net("pppol2tp", 0444, net->proc_net, 1625 &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data)); 1626 if (!pde) { 1627 err = -ENOMEM; 1628 goto out; 1629 } 1630 1631out: 1632 return err; 1633} 1634 1635static __net_exit void pppol2tp_exit_net(struct net *net) 1636{ 1637 remove_proc_entry("pppol2tp", net->proc_net); 1638} 1639 1640static struct pernet_operations pppol2tp_net_ops = { 1641 .init = pppol2tp_init_net, 1642 .exit = pppol2tp_exit_net, 1643 .id = &pppol2tp_net_id, 1644}; 1645 1646/***************************************************************************** 1647 * Init and cleanup 1648 *****************************************************************************/ 1649 1650static const struct proto_ops pppol2tp_ops = { 1651 .family = AF_PPPOX, 1652 .owner = THIS_MODULE, 1653 .release = pppol2tp_release, 1654 .bind = sock_no_bind, 1655 .connect = pppol2tp_connect, 1656 .socketpair = sock_no_socketpair, 1657 .accept = sock_no_accept, 1658 .getname = pppol2tp_getname, 1659 .poll = datagram_poll, 1660 .listen = sock_no_listen, 1661 .shutdown = sock_no_shutdown, 1662 .setsockopt = pppol2tp_setsockopt, 1663 .getsockopt = pppol2tp_getsockopt, 1664 .sendmsg = pppol2tp_sendmsg, 1665 .recvmsg = pppol2tp_recvmsg, 1666 .mmap = sock_no_mmap, 1667 .ioctl = pppox_ioctl, 1668#ifdef CONFIG_COMPAT 1669 .compat_ioctl = pppox_compat_ioctl, 1670#endif 1671}; 1672 1673static const struct pppox_proto pppol2tp_proto = { 1674 .create = pppol2tp_create, 1675 .ioctl = pppol2tp_ioctl, 1676 .owner = THIS_MODULE, 1677}; 1678 1679#ifdef CONFIG_L2TP_V3 1680 1681static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = { 1682 .session_create = pppol2tp_session_create, 1683 .session_delete = l2tp_session_delete, 1684}; 1685 1686#endif /* CONFIG_L2TP_V3 */ 1687 1688static int __init pppol2tp_init(void) 1689{ 1690 int err; 1691 1692 err = register_pernet_device(&pppol2tp_net_ops); 1693 if (err) 1694 goto out; 1695 1696 err = proto_register(&pppol2tp_sk_proto, 0); 1697 if (err) 1698 goto out_unregister_pppol2tp_pernet; 1699 1700 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto); 1701 if (err) 1702 goto out_unregister_pppol2tp_proto; 1703 1704#ifdef CONFIG_L2TP_V3 1705 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops); 1706 if (err) 1707 goto out_unregister_pppox; 1708#endif 1709 1710 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION); 1711 1712out: 1713 return err; 1714 1715#ifdef CONFIG_L2TP_V3 1716out_unregister_pppox: 1717 unregister_pppox_proto(PX_PROTO_OL2TP); 1718#endif 1719out_unregister_pppol2tp_proto: 1720 proto_unregister(&pppol2tp_sk_proto); 1721out_unregister_pppol2tp_pernet: 1722 unregister_pernet_device(&pppol2tp_net_ops); 1723 goto out; 1724} 1725 1726static void __exit pppol2tp_exit(void) 1727{ 1728#ifdef CONFIG_L2TP_V3 1729 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP); 1730#endif 1731 unregister_pppox_proto(PX_PROTO_OL2TP); 1732 proto_unregister(&pppol2tp_sk_proto); 1733 unregister_pernet_device(&pppol2tp_net_ops); 1734} 1735 1736module_init(pppol2tp_init); 1737module_exit(pppol2tp_exit); 1738 1739MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1740MODULE_DESCRIPTION("PPP over L2TP over UDP"); 1741MODULE_LICENSE("GPL"); 1742MODULE_VERSION(PPPOL2TP_DRV_VERSION); 1743MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP); 1744MODULE_ALIAS_L2TP_PWTYPE(7); 1745