163 static void l2tp_session_free(struct l2tp_session *session)  in l2tp_session_free()  argument
165 	trace_free_session(session);  in l2tp_session_free()
166 	if (session->tunnel)  in l2tp_session_free()
167 		l2tp_tunnel_dec_refcount(session->tunnel);  in l2tp_session_free()
168 	kfree(session);  in l2tp_session_free()
196 void l2tp_session_inc_refcount(struct l2tp_session *session)  in l2tp_session_inc_refcount()  argument
198 	refcount_inc(&session->ref_count);  in l2tp_session_inc_refcount()
202 void l2tp_session_dec_refcount(struct l2tp_session *session)  in l2tp_session_dec_refcount()  argument
204 	if (refcount_dec_and_test(&session->ref_count))  in l2tp_session_dec_refcount()
205 		l2tp_session_free(session);  in l2tp_session_dec_refcount()
252 	struct l2tp_session *session;  in l2tp_tunnel_get_session()  local
257 	hlist_for_each_entry_rcu(session, session_list, hlist)  in l2tp_tunnel_get_session()
258 		if (session->session_id == session_id) {  in l2tp_tunnel_get_session()
259 			l2tp_session_inc_refcount(session);  in l2tp_tunnel_get_session()
262 			return session;  in l2tp_tunnel_get_session()
273 	struct l2tp_session *session;  in l2tp_session_get()  local
278 	hlist_for_each_entry_rcu(session, session_list, global_hlist)  in l2tp_session_get()
279 		if (session->session_id == session_id) {  in l2tp_session_get()
280 			l2tp_session_inc_refcount(session);  in l2tp_session_get()
283 			return session;  in l2tp_session_get()
294 	struct l2tp_session *session;  in l2tp_session_get_nth()  local
299 		hlist_for_each_entry_rcu(session, &tunnel->session_hlist[hash], hlist) {  in l2tp_session_get_nth()
301 				l2tp_session_inc_refcount(session);  in l2tp_session_get_nth()
303 				return session;  in l2tp_session_get_nth()
322 	struct l2tp_session *session;  in l2tp_session_get_by_ifname()  local
326 		hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {  in l2tp_session_get_by_ifname()
327 			if (!strcmp(session->ifname, ifname)) {  in l2tp_session_get_by_ifname()
328 				l2tp_session_inc_refcount(session);  in l2tp_session_get_by_ifname()
331 				return session;  in l2tp_session_get_by_ifname()
342 int l2tp_session_register(struct l2tp_session *session,  in l2tp_session_register()  argument
351 	head = l2tp_session_id_hash(tunnel, session->session_id);  in l2tp_session_register()
360 		if (session_walk->session_id == session->session_id) {  in l2tp_session_register()
367 		g_head = l2tp_session_id_hash_2(pn, session->session_id);  in l2tp_session_register()
375 			if (session_walk->session_id == session->session_id &&  in l2tp_session_register()
383 		hlist_add_head_rcu(&session->global_hlist, g_head);  in l2tp_session_register()
390 	hlist_add_head_rcu(&session->hlist, head);  in l2tp_session_register()
393 	trace_register_session(session);  in l2tp_session_register()
413 static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)  in l2tp_recv_queue_skb()  argument
419 	spin_lock_bh(&session->reorder_q.lock);  in l2tp_recv_queue_skb()
420 	skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {  in l2tp_recv_queue_skb()
422 			__skb_queue_before(&session->reorder_q, skbp, skb);  in l2tp_recv_queue_skb()
423 			atomic_long_inc(&session->stats.rx_oos_packets);  in l2tp_recv_queue_skb()
428 	__skb_queue_tail(&session->reorder_q, skb);  in l2tp_recv_queue_skb()
431 	spin_unlock_bh(&session->reorder_q.lock);  in l2tp_recv_queue_skb()
436 static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)  in l2tp_recv_dequeue_skb()  argument
438 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_recv_dequeue_skb()
448 	atomic_long_inc(&session->stats.rx_packets);  in l2tp_recv_dequeue_skb()
449 	atomic_long_add(length, &session->stats.rx_bytes);  in l2tp_recv_dequeue_skb()
453 		session->nr++;  in l2tp_recv_dequeue_skb()
454 		session->nr &= session->nr_max;  in l2tp_recv_dequeue_skb()
455 		trace_session_seqnum_update(session);  in l2tp_recv_dequeue_skb()
459 	if (session->recv_skb)  in l2tp_recv_dequeue_skb()
460 		(*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);  in l2tp_recv_dequeue_skb()
468 static void l2tp_recv_dequeue(struct l2tp_session *session)  in l2tp_recv_dequeue()  argument
478 	spin_lock_bh(&session->reorder_q.lock);  in l2tp_recv_dequeue()
479 	skb_queue_walk_safe(&session->reorder_q, skb, tmp) {  in l2tp_recv_dequeue()
484 			atomic_long_inc(&session->stats.rx_seq_discards);  in l2tp_recv_dequeue()
485 			atomic_long_inc(&session->stats.rx_errors);  in l2tp_recv_dequeue()
486 			trace_session_pkt_expired(session, cb->ns);  in l2tp_recv_dequeue()
487 			session->reorder_skip = 1;  in l2tp_recv_dequeue()
488 			__skb_unlink(skb, &session->reorder_q);  in l2tp_recv_dequeue()
494 			if (session->reorder_skip) {  in l2tp_recv_dequeue()
495 				session->reorder_skip = 0;  in l2tp_recv_dequeue()
496 				session->nr = cb->ns;  in l2tp_recv_dequeue()
497 				trace_session_seqnum_reset(session);  in l2tp_recv_dequeue()
499 			if (cb->ns != session->nr)  in l2tp_recv_dequeue()
502 		__skb_unlink(skb, &session->reorder_q);  in l2tp_recv_dequeue()
507 		spin_unlock_bh(&session->reorder_q.lock);  in l2tp_recv_dequeue()
508 		l2tp_recv_dequeue_skb(session, skb);  in l2tp_recv_dequeue()
513 	spin_unlock_bh(&session->reorder_q.lock);  in l2tp_recv_dequeue()
516 static int l2tp_seq_check_rx_window(struct l2tp_session *session, u32 nr)  in l2tp_seq_check_rx_window()  argument
520 	if (nr >= session->nr)  in l2tp_seq_check_rx_window()
521 		nws = nr - session->nr;  in l2tp_seq_check_rx_window()
523 		nws = (session->nr_max + 1) - (session->nr - nr);  in l2tp_seq_check_rx_window()
525 	return nws < session->nr_window_size;  in l2tp_seq_check_rx_window()
531 static int l2tp_recv_data_seq(struct l2tp_session *session, struct sk_buff *skb)  in l2tp_recv_data_seq()  argument
535 	if (!l2tp_seq_check_rx_window(session, cb->ns)) {  in l2tp_recv_data_seq()
539 		trace_session_pkt_outside_rx_window(session, cb->ns);  in l2tp_recv_data_seq()
543 	if (session->reorder_timeout != 0) {  in l2tp_recv_data_seq()
547 		l2tp_recv_queue_skb(session, skb);  in l2tp_recv_data_seq()
556 	if (cb->ns == session->nr) {  in l2tp_recv_data_seq()
557 		skb_queue_tail(&session->reorder_q, skb);  in l2tp_recv_data_seq()
560 		u32 nr_next = (session->nr_oos + 1) & session->nr_max;  in l2tp_recv_data_seq()
563 			session->nr_oos_count++;  in l2tp_recv_data_seq()
565 			session->nr_oos_count = 0;  in l2tp_recv_data_seq()
567 		session->nr_oos = nr_oos;  in l2tp_recv_data_seq()
568 		if (session->nr_oos_count > session->nr_oos_count_max) {  in l2tp_recv_data_seq()
569 			session->reorder_skip = 1;  in l2tp_recv_data_seq()
571 		if (!session->reorder_skip) {  in l2tp_recv_data_seq()
572 			atomic_long_inc(&session->stats.rx_seq_discards);  in l2tp_recv_data_seq()
573 			trace_session_pkt_oos(session, cb->ns);  in l2tp_recv_data_seq()
576 		skb_queue_tail(&session->reorder_q, skb);  in l2tp_recv_data_seq()
645 void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,  in l2tp_recv_common()  argument
649 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_recv_common()
653 	if (session->peer_cookie_len > 0) {  in l2tp_recv_common()
654 		if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {  in l2tp_recv_common()
657 					     session->session_id);  in l2tp_recv_common()
658 			atomic_long_inc(&session->stats.rx_cookie_discards);  in l2tp_recv_common()
661 		ptr += session->peer_cookie_len;  in l2tp_recv_common()
682 	} else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {  in l2tp_recv_common()
698 		if (!session->lns_mode && !session->send_seq) {  in l2tp_recv_common()
699 			trace_session_seqnum_lns_enable(session);  in l2tp_recv_common()
700 			session->send_seq = 1;  in l2tp_recv_common()
701 			l2tp_session_set_header_len(session, tunnel->version);  in l2tp_recv_common()
707 		if (session->recv_seq) {  in l2tp_recv_common()
709 					     session->name);  in l2tp_recv_common()
710 			atomic_long_inc(&session->stats.rx_seq_discards);  in l2tp_recv_common()
719 		if (!session->lns_mode && session->send_seq) {  in l2tp_recv_common()
720 			trace_session_seqnum_lns_disable(session);  in l2tp_recv_common()
721 			session->send_seq = 0;  in l2tp_recv_common()
722 			l2tp_session_set_header_len(session, tunnel->version);  in l2tp_recv_common()
723 		} else if (session->send_seq) {  in l2tp_recv_common()
725 					     session->name);  in l2tp_recv_common()
726 			atomic_long_inc(&session->stats.rx_seq_discards);  in l2tp_recv_common()
754 		(session->reorder_timeout ? session->reorder_timeout : HZ);  in l2tp_recv_common()
760 		if (l2tp_recv_data_seq(session, skb))  in l2tp_recv_common()
767 		skb_queue_tail(&session->reorder_q, skb);  in l2tp_recv_common()
771 	l2tp_recv_dequeue(session);  in l2tp_recv_common()
776 	atomic_long_inc(&session->stats.rx_errors);  in l2tp_recv_common()
783 static void l2tp_session_queue_purge(struct l2tp_session *session)  in l2tp_session_queue_purge()  argument
787 	while ((skb = skb_dequeue(&session->reorder_q))) {  in l2tp_session_queue_purge()
788 		atomic_long_inc(&session->stats.rx_errors);  in l2tp_session_queue_purge()
801 	struct l2tp_session *session = NULL;  in l2tp_udp_recv_core()  local
863 	session = l2tp_tunnel_get_session(tunnel, session_id);  in l2tp_udp_recv_core()
864 	if (!session || !session->recv_skb) {  in l2tp_udp_recv_core()
865 		if (session)  in l2tp_udp_recv_core()
866 			l2tp_session_dec_refcount(session);  in l2tp_udp_recv_core()
875 	    l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) {  in l2tp_udp_recv_core()
876 		l2tp_session_dec_refcount(session);  in l2tp_udp_recv_core()
880 	l2tp_recv_common(session, skb, ptr, optr, hdrflags, length);  in l2tp_udp_recv_core()
881 	l2tp_session_dec_refcount(session);  in l2tp_udp_recv_core()
933 static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)  in l2tp_build_l2tpv2_header()  argument
935 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_build_l2tpv2_header()
940 	u32 session_id = session->peer_session_id;  in l2tp_build_l2tpv2_header()
942 	if (session->send_seq)  in l2tp_build_l2tpv2_header()
949 	if (session->send_seq) {  in l2tp_build_l2tpv2_header()
950 		*bufp++ = htons(session->ns);  in l2tp_build_l2tpv2_header()
952 		session->ns++;  in l2tp_build_l2tpv2_header()
953 		session->ns &= 0xffff;  in l2tp_build_l2tpv2_header()
954 		trace_session_seqnum_update(session);  in l2tp_build_l2tpv2_header()
960 static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)  in l2tp_build_l2tpv3_header()  argument
962 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_build_l2tpv3_header()
977 	*((__be32 *)bufp) = htonl(session->peer_session_id);  in l2tp_build_l2tpv3_header()
979 	if (session->cookie_len) {  in l2tp_build_l2tpv3_header()
980 		memcpy(bufp, &session->cookie[0], session->cookie_len);  in l2tp_build_l2tpv3_header()
981 		bufp += session->cookie_len;  in l2tp_build_l2tpv3_header()
983 	if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {  in l2tp_build_l2tpv3_header()
986 		if (session->send_seq) {  in l2tp_build_l2tpv3_header()
987 			l2h = 0x40000000 | session->ns;  in l2tp_build_l2tpv3_header()
988 			session->ns++;  in l2tp_build_l2tpv3_header()
989 			session->ns &= 0xffffff;  in l2tp_build_l2tpv3_header()
990 			trace_session_seqnum_update(session);  in l2tp_build_l2tpv3_header()
1017 static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, unsigned int *len)  in l2tp_xmit_core()  argument
1019 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_xmit_core()
1032 	headroom = NET_SKB_PAD + sizeof(struct iphdr) + uhlen + session->hdr_len;  in l2tp_xmit_core()
1040 		l2tp_build_l2tpv2_header(session, __skb_push(skb, session->hdr_len));  in l2tp_xmit_core()
1042 		l2tp_build_l2tpv3_header(session, __skb_push(skb, session->hdr_len));  in l2tp_xmit_core()
1085 		udp_len = uhlen + session->hdr_len + data_len;  in l2tp_xmit_core()
1115 int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb)  in l2tp_xmit_skb()  argument
1120 	ret = l2tp_xmit_core(session, skb, &len);  in l2tp_xmit_skb()
1122 		atomic_long_inc(&session->tunnel->stats.tx_packets);  in l2tp_xmit_skb()
1123 		atomic_long_add(len, &session->tunnel->stats.tx_bytes);  in l2tp_xmit_skb()
1124 		atomic_long_inc(&session->stats.tx_packets);  in l2tp_xmit_skb()
1125 		atomic_long_add(len, &session->stats.tx_bytes);  in l2tp_xmit_skb()
1127 		atomic_long_inc(&session->tunnel->stats.tx_errors);  in l2tp_xmit_skb()
1128 		atomic_long_inc(&session->stats.tx_errors);  in l2tp_xmit_skb()
1177 static void l2tp_session_unhash(struct l2tp_session *session)  in l2tp_session_unhash()  argument
1179 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_session_unhash()
1185 		hlist_del_init_rcu(&session->hlist);  in l2tp_session_unhash()
1193 			hlist_del_init_rcu(&session->global_hlist);  in l2tp_session_unhash()
1205 	struct l2tp_session *session;  in l2tp_tunnel_closeall()  local
1212 		hlist_for_each_entry_rcu(session, &tunnel->session_hlist[hash], hlist) {  in l2tp_tunnel_closeall()
1213 			hlist_del_init_rcu(&session->hlist);  in l2tp_tunnel_closeall()
1216 			l2tp_session_delete(session);  in l2tp_tunnel_closeall()
1559 void l2tp_session_delete(struct l2tp_session *session)  in l2tp_session_delete()  argument
1561 	if (test_and_set_bit(0, &session->dead))  in l2tp_session_delete()
1564 	trace_delete_session(session);  in l2tp_session_delete()
1565 	l2tp_session_unhash(session);  in l2tp_session_delete()
1566 	l2tp_session_queue_purge(session);  in l2tp_session_delete()
1567 	if (session->session_close)  in l2tp_session_delete()
1568 		(*session->session_close)(session);  in l2tp_session_delete()
1570 	l2tp_session_dec_refcount(session);  in l2tp_session_delete()
1577 void l2tp_session_set_header_len(struct l2tp_session *session, int version)  in l2tp_session_set_header_len()  argument
1580 		session->hdr_len = 6;  in l2tp_session_set_header_len()
1581 		if (session->send_seq)  in l2tp_session_set_header_len()
1582 			session->hdr_len += 4;  in l2tp_session_set_header_len()
1584 		session->hdr_len = 4 + session->cookie_len;  in l2tp_session_set_header_len()
1585 		session->hdr_len += l2tp_get_l2specific_len(session);  in l2tp_session_set_header_len()
1586 		if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)  in l2tp_session_set_header_len()
1587 			session->hdr_len += 4;  in l2tp_session_set_header_len()
1595 	struct l2tp_session *session;  in l2tp_session_create()  local
1597 	session = kzalloc(sizeof(*session) + priv_size, GFP_KERNEL);  in l2tp_session_create()
1598 	if (session) {  in l2tp_session_create()
1599 		session->magic = L2TP_SESSION_MAGIC;  in l2tp_session_create()
1600 		session->tunnel = tunnel;  in l2tp_session_create()
1602 		session->session_id = session_id;  in l2tp_session_create()
1603 		session->peer_session_id = peer_session_id;  in l2tp_session_create()
1604 		session->nr = 0;  in l2tp_session_create()
1606 			session->nr_max = 0xffff;  in l2tp_session_create()
1608 			session->nr_max = 0xffffff;  in l2tp_session_create()
1609 		session->nr_window_size = session->nr_max / 2;  in l2tp_session_create()
1610 		session->nr_oos_count_max = 4;  in l2tp_session_create()
1613 		session->reorder_skip = 1;  in l2tp_session_create()
1615 		sprintf(&session->name[0], "sess %u/%u",  in l2tp_session_create()
1616 			tunnel->tunnel_id, session->session_id);  in l2tp_session_create()
1618 		skb_queue_head_init(&session->reorder_q);  in l2tp_session_create()
1620 		INIT_HLIST_NODE(&session->hlist);  in l2tp_session_create()
1621 		INIT_HLIST_NODE(&session->global_hlist);  in l2tp_session_create()
1624 			session->pwtype = cfg->pw_type;  in l2tp_session_create()
1625 			session->send_seq = cfg->send_seq;  in l2tp_session_create()
1626 			session->recv_seq = cfg->recv_seq;  in l2tp_session_create()
1627 			session->lns_mode = cfg->lns_mode;  in l2tp_session_create()
1628 			session->reorder_timeout = cfg->reorder_timeout;  in l2tp_session_create()
1629 			session->l2specific_type = cfg->l2specific_type;  in l2tp_session_create()
1630 			session->cookie_len = cfg->cookie_len;  in l2tp_session_create()
1631 			memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);  in l2tp_session_create()
1632 			session->peer_cookie_len = cfg->peer_cookie_len;  in l2tp_session_create()
1633 			memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);  in l2tp_session_create()
1636 		l2tp_session_set_header_len(session, tunnel->version);  in l2tp_session_create()
1638 		refcount_set(&session->ref_count, 1);  in l2tp_session_create()
1640 		return session;  in l2tp_session_create()