1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /***************************************************************************** 3 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets 4 * 5 * PPPoX --- Generic PPP encapsulation socket family 6 * PPPoL2TP --- PPP over L2TP (RFC 2661) 7 * 8 * Version: 2.0.0 9 * 10 * Authors: James Chapman (jchapman@katalix.com) 11 * 12 * Based on original work by Martijn van Oosterhout <kleptog@svana.org> 13 * 14 * License: 15 */ 16 17 /* This driver handles only L2TP data frames; control frames are handled by a 18 * userspace application. 19 * 20 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and 21 * attaches it to a bound UDP socket with local tunnel_id / session_id and 22 * peer tunnel_id / session_id set. Data can then be sent or received using 23 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket 24 * can be read or modified using ioctl() or [gs]etsockopt() calls. 25 * 26 * When a PPPoL2TP socket is connected with local and peer session_id values 27 * zero, the socket is treated as a special tunnel management socket. 28 * 29 * Here's example userspace code to create a socket for sending/receiving data 30 * over an L2TP session:- 31 * 32 * struct sockaddr_pppol2tp sax; 33 * int fd; 34 * int session_fd; 35 * 36 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); 37 * 38 * sax.sa_family = AF_PPPOX; 39 * sax.sa_protocol = PX_PROTO_OL2TP; 40 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket 41 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr; 42 * sax.pppol2tp.addr.sin_port = addr->sin_port; 43 * sax.pppol2tp.addr.sin_family = AF_INET; 44 * sax.pppol2tp.s_tunnel = tunnel_id; 45 * sax.pppol2tp.s_session = session_id; 46 * sax.pppol2tp.d_tunnel = peer_tunnel_id; 47 * sax.pppol2tp.d_session = peer_session_id; 48 * 49 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax)); 50 * 51 * A pppd plugin that allows PPP traffic to be carried over L2TP using 52 * this driver is available from the OpenL2TP project at 53 * http://openl2tp.sourceforge.net. 54 */ 55 56 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 57 58 #include <linux/module.h> 59 #include <linux/string.h> 60 #include <linux/list.h> 61 #include <linux/uaccess.h> 62 63 #include <linux/kernel.h> 64 #include <linux/spinlock.h> 65 #include <linux/kthread.h> 66 #include <linux/sched.h> 67 #include <linux/slab.h> 68 #include <linux/errno.h> 69 #include <linux/jiffies.h> 70 71 #include <linux/netdevice.h> 72 #include <linux/net.h> 73 #include <linux/inetdevice.h> 74 #include <linux/skbuff.h> 75 #include <linux/init.h> 76 #include <linux/ip.h> 77 #include <linux/udp.h> 78 #include <linux/if_pppox.h> 79 #include <linux/if_pppol2tp.h> 80 #include <net/sock.h> 81 #include <linux/ppp_channel.h> 82 #include <linux/ppp_defs.h> 83 #include <linux/ppp-ioctl.h> 84 #include <linux/file.h> 85 #include <linux/hash.h> 86 #include <linux/sort.h> 87 #include <linux/proc_fs.h> 88 #include <linux/l2tp.h> 89 #include <linux/nsproxy.h> 90 #include <net/net_namespace.h> 91 #include <net/netns/generic.h> 92 #include <net/ip.h> 93 #include <net/udp.h> 94 #include <net/inet_common.h> 95 96 #include <asm/byteorder.h> 97 #include <linux/atomic.h> 98 99 #include "l2tp_core.h" 100 101 #define PPPOL2TP_DRV_VERSION "V2.0" 102 103 /* Space for UDP, L2TP and PPP headers */ 104 #define PPPOL2TP_HEADER_OVERHEAD 40 105 106 /* Number of bytes to build transmit L2TP headers. 107 * Unfortunately the size is different depending on whether sequence numbers 108 * are enabled. 109 */ 110 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10 111 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6 112 113 /* Private data of each session. This data lives at the end of struct 114 * l2tp_session, referenced via session->priv[]. 115 */ 116 struct pppol2tp_session { 117 int owner; /* pid that opened the socket */ 118 119 struct mutex sk_lock; /* Protects .sk */ 120 struct sock __rcu *sk; /* Pointer to the session PPPoX socket */ 121 struct sock *__sk; /* Copy of .sk, for cleanup */ 122 struct rcu_head rcu; /* For asynchronous release */ 123 }; 124 125 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb); 126 127 static const struct ppp_channel_ops pppol2tp_chan_ops = { 128 .start_xmit = pppol2tp_xmit, 129 }; 130 131 static const struct proto_ops pppol2tp_ops; 132 133 /* Retrieves the pppol2tp socket associated to a session. 134 * A reference is held on the returned socket, so this function must be paired 135 * with sock_put(). 136 */ 137 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) 138 { 139 struct pppol2tp_session *ps = l2tp_session_priv(session); 140 struct sock *sk; 141 142 rcu_read_lock(); 143 sk = rcu_dereference(ps->sk); 144 if (sk) 145 sock_hold(sk); 146 rcu_read_unlock(); 147 148 return sk; 149 } 150 151 /* Helpers to obtain tunnel/session contexts from sockets. 152 */ 153 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) 154 { 155 struct l2tp_session *session; 156 157 if (!sk) 158 return NULL; 159 160 sock_hold(sk); 161 session = (struct l2tp_session *)(sk->sk_user_data); 162 if (!session) { 163 sock_put(sk); 164 goto out; 165 } 166 if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) { 167 session = NULL; 168 sock_put(sk); 169 goto out; 170 } 171 172 out: 173 return session; 174 } 175 176 /***************************************************************************** 177 * Receive data handling 178 *****************************************************************************/ 179 180 /* Receive message. This is the recvmsg for the PPPoL2TP socket. 181 */ 182 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, 183 size_t len, int flags) 184 { 185 int err; 186 struct sk_buff *skb; 187 struct sock *sk = sock->sk; 188 189 err = -EIO; 190 if (sk->sk_state & PPPOX_BOUND) 191 goto end; 192 193 err = 0; 194 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 195 flags & MSG_DONTWAIT, &err); 196 if (!skb) 197 goto end; 198 199 if (len > skb->len) 200 len = skb->len; 201 else if (len < skb->len) 202 msg->msg_flags |= MSG_TRUNC; 203 204 err = skb_copy_datagram_msg(skb, 0, msg, len); 205 if (likely(err == 0)) 206 err = len; 207 208 kfree_skb(skb); 209 end: 210 return err; 211 } 212 213 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) 214 { 215 struct pppol2tp_session *ps = l2tp_session_priv(session); 216 struct sock *sk = NULL; 217 218 /* If the socket is bound, send it in to PPP's input queue. Otherwise 219 * queue it on the session socket. 220 */ 221 rcu_read_lock(); 222 sk = rcu_dereference(ps->sk); 223 if (!sk) 224 goto no_sock; 225 226 /* If the first two bytes are 0xFF03, consider that it is the PPP's 227 * Address and Control fields and skip them. The L2TP module has always 228 * worked this way, although, in theory, the use of these fields should 229 * be negociated and handled at the PPP layer. These fields are 230 * constant: 0xFF is the All-Stations Address and 0x03 the Unnumbered 231 * Information command with Poll/Final bit set to zero (RFC 1662). 232 */ 233 if (pskb_may_pull(skb, 2) && skb->data[0] == PPP_ALLSTATIONS && 234 skb->data[1] == PPP_UI) 235 skb_pull(skb, 2); 236 237 if (sk->sk_state & PPPOX_BOUND) { 238 struct pppox_sock *po; 239 240 po = pppox_sk(sk); 241 ppp_input(&po->chan, skb); 242 } else { 243 if (sock_queue_rcv_skb(sk, skb) < 0) { 244 atomic_long_inc(&session->stats.rx_errors); 245 kfree_skb(skb); 246 } 247 } 248 rcu_read_unlock(); 249 250 return; 251 252 no_sock: 253 rcu_read_unlock(); 254 pr_warn_ratelimited("%s: no socket in recv\n", session->name); 255 kfree_skb(skb); 256 } 257 258 /************************************************************************ 259 * Transmit handling 260 ***********************************************************************/ 261 262 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here 263 * when a user application does a sendmsg() on the session socket. L2TP and 264 * PPP headers must be inserted into the user's data. 265 */ 266 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m, 267 size_t total_len) 268 { 269 struct sock *sk = sock->sk; 270 struct sk_buff *skb; 271 int error; 272 struct l2tp_session *session; 273 struct l2tp_tunnel *tunnel; 274 int uhlen; 275 276 error = -ENOTCONN; 277 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 278 goto error; 279 280 /* Get session and tunnel contexts */ 281 error = -EBADF; 282 session = pppol2tp_sock_to_session(sk); 283 if (!session) 284 goto error; 285 286 tunnel = session->tunnel; 287 288 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 289 290 /* Allocate a socket buffer */ 291 error = -ENOMEM; 292 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 293 uhlen + session->hdr_len + 294 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 295 0, GFP_KERNEL); 296 if (!skb) 297 goto error_put_sess; 298 299 /* Reserve space for headers. */ 300 skb_reserve(skb, NET_SKB_PAD); 301 skb_reset_network_header(skb); 302 skb_reserve(skb, sizeof(struct iphdr)); 303 skb_reset_transport_header(skb); 304 skb_reserve(skb, uhlen); 305 306 /* Add PPP header */ 307 skb->data[0] = PPP_ALLSTATIONS; 308 skb->data[1] = PPP_UI; 309 skb_put(skb, 2); 310 311 /* Copy user data into skb */ 312 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len); 313 if (error < 0) { 314 kfree_skb(skb); 315 goto error_put_sess; 316 } 317 318 local_bh_disable(); 319 l2tp_xmit_skb(session, skb, session->hdr_len); 320 local_bh_enable(); 321 322 sock_put(sk); 323 324 return total_len; 325 326 error_put_sess: 327 sock_put(sk); 328 error: 329 return error; 330 } 331 332 /* Transmit function called by generic PPP driver. Sends PPP frame 333 * over PPPoL2TP socket. 334 * 335 * This is almost the same as pppol2tp_sendmsg(), but rather than 336 * being called with a msghdr from userspace, it is called with a skb 337 * from the kernel. 338 * 339 * The supplied skb from ppp doesn't have enough headroom for the 340 * insertion of L2TP, UDP and IP headers so we need to allocate more 341 * headroom in the skb. This will create a cloned skb. But we must be 342 * careful in the error case because the caller will expect to free 343 * the skb it supplied, not our cloned skb. So we take care to always 344 * leave the original skb unfreed if we return an error. 345 */ 346 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) 347 { 348 struct sock *sk = (struct sock *)chan->private; 349 struct l2tp_session *session; 350 struct l2tp_tunnel *tunnel; 351 int uhlen, headroom; 352 353 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 354 goto abort; 355 356 /* Get session and tunnel contexts from the socket */ 357 session = pppol2tp_sock_to_session(sk); 358 if (!session) 359 goto abort; 360 361 tunnel = session->tunnel; 362 363 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 364 headroom = NET_SKB_PAD + 365 sizeof(struct iphdr) + /* IP header */ 366 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */ 367 session->hdr_len + /* L2TP header */ 368 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 369 if (skb_cow_head(skb, headroom)) 370 goto abort_put_sess; 371 372 /* Setup PPP header */ 373 __skb_push(skb, 2); 374 skb->data[0] = PPP_ALLSTATIONS; 375 skb->data[1] = PPP_UI; 376 377 local_bh_disable(); 378 l2tp_xmit_skb(session, skb, session->hdr_len); 379 local_bh_enable(); 380 381 sock_put(sk); 382 383 return 1; 384 385 abort_put_sess: 386 sock_put(sk); 387 abort: 388 /* Free the original skb */ 389 kfree_skb(skb); 390 return 1; 391 } 392 393 /***************************************************************************** 394 * Session (and tunnel control) socket create/destroy. 395 *****************************************************************************/ 396 397 static void pppol2tp_put_sk(struct rcu_head *head) 398 { 399 struct pppol2tp_session *ps; 400 401 ps = container_of(head, typeof(*ps), rcu); 402 sock_put(ps->__sk); 403 } 404 405 /* Really kill the session socket. (Called from sock_put() if 406 * refcnt == 0.) 407 */ 408 static void pppol2tp_session_destruct(struct sock *sk) 409 { 410 struct l2tp_session *session = sk->sk_user_data; 411 412 skb_queue_purge(&sk->sk_receive_queue); 413 skb_queue_purge(&sk->sk_write_queue); 414 415 if (session) { 416 sk->sk_user_data = NULL; 417 if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) 418 return; 419 l2tp_session_dec_refcount(session); 420 } 421 } 422 423 /* Called when the PPPoX socket (session) is closed. 424 */ 425 static int pppol2tp_release(struct socket *sock) 426 { 427 struct sock *sk = sock->sk; 428 struct l2tp_session *session; 429 int error; 430 431 if (!sk) 432 return 0; 433 434 error = -EBADF; 435 lock_sock(sk); 436 if (sock_flag(sk, SOCK_DEAD) != 0) 437 goto error; 438 439 pppox_unbind_sock(sk); 440 441 /* Signal the death of the socket. */ 442 sk->sk_state = PPPOX_DEAD; 443 sock_orphan(sk); 444 sock->sk = NULL; 445 446 session = pppol2tp_sock_to_session(sk); 447 if (session) { 448 struct pppol2tp_session *ps; 449 450 l2tp_session_delete(session); 451 452 ps = l2tp_session_priv(session); 453 mutex_lock(&ps->sk_lock); 454 ps->__sk = rcu_dereference_protected(ps->sk, 455 lockdep_is_held(&ps->sk_lock)); 456 RCU_INIT_POINTER(ps->sk, NULL); 457 mutex_unlock(&ps->sk_lock); 458 call_rcu(&ps->rcu, pppol2tp_put_sk); 459 460 /* Rely on the sock_put() call at the end of the function for 461 * dropping the reference held by pppol2tp_sock_to_session(). 462 * The last reference will be dropped by pppol2tp_put_sk(). 463 */ 464 } 465 466 release_sock(sk); 467 468 /* This will delete the session context via 469 * pppol2tp_session_destruct() if the socket's refcnt drops to 470 * zero. 471 */ 472 sock_put(sk); 473 474 return 0; 475 476 error: 477 release_sock(sk); 478 return error; 479 } 480 481 static struct proto pppol2tp_sk_proto = { 482 .name = "PPPOL2TP", 483 .owner = THIS_MODULE, 484 .obj_size = sizeof(struct pppox_sock), 485 }; 486 487 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb) 488 { 489 int rc; 490 491 rc = l2tp_udp_encap_recv(sk, skb); 492 if (rc) 493 kfree_skb(skb); 494 495 return NET_RX_SUCCESS; 496 } 497 498 /* socket() handler. Initialize a new struct sock. 499 */ 500 static int pppol2tp_create(struct net *net, struct socket *sock, int kern) 501 { 502 int error = -ENOMEM; 503 struct sock *sk; 504 505 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern); 506 if (!sk) 507 goto out; 508 509 sock_init_data(sock, sk); 510 511 sock->state = SS_UNCONNECTED; 512 sock->ops = &pppol2tp_ops; 513 514 sk->sk_backlog_rcv = pppol2tp_backlog_recv; 515 sk->sk_protocol = PX_PROTO_OL2TP; 516 sk->sk_family = PF_PPPOX; 517 sk->sk_state = PPPOX_NONE; 518 sk->sk_type = SOCK_STREAM; 519 sk->sk_destruct = pppol2tp_session_destruct; 520 521 error = 0; 522 523 out: 524 return error; 525 } 526 527 static void pppol2tp_show(struct seq_file *m, void *arg) 528 { 529 struct l2tp_session *session = arg; 530 struct sock *sk; 531 532 sk = pppol2tp_session_get_sock(session); 533 if (sk) { 534 struct pppox_sock *po = pppox_sk(sk); 535 536 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 537 sock_put(sk); 538 } 539 } 540 541 static void pppol2tp_session_init(struct l2tp_session *session) 542 { 543 struct pppol2tp_session *ps; 544 545 session->recv_skb = pppol2tp_recv; 546 if (IS_ENABLED(CONFIG_L2TP_DEBUGFS)) 547 session->show = pppol2tp_show; 548 549 ps = l2tp_session_priv(session); 550 mutex_init(&ps->sk_lock); 551 ps->owner = current->pid; 552 } 553 554 struct l2tp_connect_info { 555 u8 version; 556 int fd; 557 u32 tunnel_id; 558 u32 peer_tunnel_id; 559 u32 session_id; 560 u32 peer_session_id; 561 }; 562 563 static int pppol2tp_sockaddr_get_info(const void *sa, int sa_len, 564 struct l2tp_connect_info *info) 565 { 566 switch (sa_len) { 567 case sizeof(struct sockaddr_pppol2tp): 568 { 569 const struct sockaddr_pppol2tp *sa_v2in4 = sa; 570 571 if (sa_v2in4->sa_protocol != PX_PROTO_OL2TP) 572 return -EINVAL; 573 574 info->version = 2; 575 info->fd = sa_v2in4->pppol2tp.fd; 576 info->tunnel_id = sa_v2in4->pppol2tp.s_tunnel; 577 info->peer_tunnel_id = sa_v2in4->pppol2tp.d_tunnel; 578 info->session_id = sa_v2in4->pppol2tp.s_session; 579 info->peer_session_id = sa_v2in4->pppol2tp.d_session; 580 581 break; 582 } 583 case sizeof(struct sockaddr_pppol2tpv3): 584 { 585 const struct sockaddr_pppol2tpv3 *sa_v3in4 = sa; 586 587 if (sa_v3in4->sa_protocol != PX_PROTO_OL2TP) 588 return -EINVAL; 589 590 info->version = 3; 591 info->fd = sa_v3in4->pppol2tp.fd; 592 info->tunnel_id = sa_v3in4->pppol2tp.s_tunnel; 593 info->peer_tunnel_id = sa_v3in4->pppol2tp.d_tunnel; 594 info->session_id = sa_v3in4->pppol2tp.s_session; 595 info->peer_session_id = sa_v3in4->pppol2tp.d_session; 596 597 break; 598 } 599 case sizeof(struct sockaddr_pppol2tpin6): 600 { 601 const struct sockaddr_pppol2tpin6 *sa_v2in6 = sa; 602 603 if (sa_v2in6->sa_protocol != PX_PROTO_OL2TP) 604 return -EINVAL; 605 606 info->version = 2; 607 info->fd = sa_v2in6->pppol2tp.fd; 608 info->tunnel_id = sa_v2in6->pppol2tp.s_tunnel; 609 info->peer_tunnel_id = sa_v2in6->pppol2tp.d_tunnel; 610 info->session_id = sa_v2in6->pppol2tp.s_session; 611 info->peer_session_id = sa_v2in6->pppol2tp.d_session; 612 613 break; 614 } 615 case sizeof(struct sockaddr_pppol2tpv3in6): 616 { 617 const struct sockaddr_pppol2tpv3in6 *sa_v3in6 = sa; 618 619 if (sa_v3in6->sa_protocol != PX_PROTO_OL2TP) 620 return -EINVAL; 621 622 info->version = 3; 623 info->fd = sa_v3in6->pppol2tp.fd; 624 info->tunnel_id = sa_v3in6->pppol2tp.s_tunnel; 625 info->peer_tunnel_id = sa_v3in6->pppol2tp.d_tunnel; 626 info->session_id = sa_v3in6->pppol2tp.s_session; 627 info->peer_session_id = sa_v3in6->pppol2tp.d_session; 628 629 break; 630 } 631 default: 632 return -EINVAL; 633 } 634 635 return 0; 636 } 637 638 /* Rough estimation of the maximum payload size a tunnel can transmit without 639 * fragmenting at the lower IP layer. Assumes L2TPv2 with sequence 640 * numbers and no IP option. Not quite accurate, but the result is mostly 641 * unused anyway. 642 */ 643 static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel) 644 { 645 int mtu; 646 647 mtu = l2tp_tunnel_dst_mtu(tunnel); 648 if (mtu <= PPPOL2TP_HEADER_OVERHEAD) 649 return 1500 - PPPOL2TP_HEADER_OVERHEAD; 650 651 return mtu - PPPOL2TP_HEADER_OVERHEAD; 652 } 653 654 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket 655 */ 656 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 657 int sockaddr_len, int flags) 658 { 659 struct sock *sk = sock->sk; 660 struct pppox_sock *po = pppox_sk(sk); 661 struct l2tp_session *session = NULL; 662 struct l2tp_connect_info info; 663 struct l2tp_tunnel *tunnel; 664 struct pppol2tp_session *ps; 665 struct l2tp_session_cfg cfg = { 0, }; 666 bool drop_refcnt = false; 667 bool drop_tunnel = false; 668 bool new_session = false; 669 bool new_tunnel = false; 670 int error; 671 672 error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info); 673 if (error < 0) 674 return error; 675 676 lock_sock(sk); 677 678 /* Check for already bound sockets */ 679 error = -EBUSY; 680 if (sk->sk_state & PPPOX_CONNECTED) 681 goto end; 682 683 /* We don't supporting rebinding anyway */ 684 error = -EALREADY; 685 if (sk->sk_user_data) 686 goto end; /* socket is already attached */ 687 688 /* Don't bind if tunnel_id is 0 */ 689 error = -EINVAL; 690 if (!info.tunnel_id) 691 goto end; 692 693 tunnel = l2tp_tunnel_get(sock_net(sk), info.tunnel_id); 694 if (tunnel) 695 drop_tunnel = true; 696 697 /* Special case: create tunnel context if session_id and 698 * peer_session_id is 0. Otherwise look up tunnel using supplied 699 * tunnel id. 700 */ 701 if (!info.session_id && !info.peer_session_id) { 702 if (!tunnel) { 703 struct l2tp_tunnel_cfg tcfg = { 704 .encap = L2TP_ENCAPTYPE_UDP, 705 .debug = 0, 706 }; 707 708 /* Prevent l2tp_tunnel_register() from trying to set up 709 * a kernel socket. 710 */ 711 if (info.fd < 0) { 712 error = -EBADF; 713 goto end; 714 } 715 716 error = l2tp_tunnel_create(sock_net(sk), info.fd, 717 info.version, 718 info.tunnel_id, 719 info.peer_tunnel_id, &tcfg, 720 &tunnel); 721 if (error < 0) 722 goto end; 723 724 l2tp_tunnel_inc_refcount(tunnel); 725 error = l2tp_tunnel_register(tunnel, sock_net(sk), 726 &tcfg); 727 if (error < 0) { 728 kfree(tunnel); 729 goto end; 730 } 731 drop_tunnel = true; 732 new_tunnel = true; 733 } 734 } else { 735 /* Error if we can't find the tunnel */ 736 error = -ENOENT; 737 if (!tunnel) 738 goto end; 739 740 /* Error if socket is not prepped */ 741 if (!tunnel->sock) 742 goto end; 743 } 744 745 if (tunnel->peer_tunnel_id == 0) 746 tunnel->peer_tunnel_id = info.peer_tunnel_id; 747 748 session = l2tp_tunnel_get_session(tunnel, info.session_id); 749 if (session) { 750 drop_refcnt = true; 751 752 if (session->pwtype != L2TP_PWTYPE_PPP) { 753 error = -EPROTOTYPE; 754 goto end; 755 } 756 757 ps = l2tp_session_priv(session); 758 759 /* Using a pre-existing session is fine as long as it hasn't 760 * been connected yet. 761 */ 762 mutex_lock(&ps->sk_lock); 763 if (rcu_dereference_protected(ps->sk, 764 lockdep_is_held(&ps->sk_lock)) || 765 ps->__sk) { 766 mutex_unlock(&ps->sk_lock); 767 error = -EEXIST; 768 goto end; 769 } 770 } else { 771 cfg.pw_type = L2TP_PWTYPE_PPP; 772 773 session = l2tp_session_create(sizeof(struct pppol2tp_session), 774 tunnel, info.session_id, 775 info.peer_session_id, &cfg); 776 if (IS_ERR(session)) { 777 error = PTR_ERR(session); 778 goto end; 779 } 780 781 pppol2tp_session_init(session); 782 ps = l2tp_session_priv(session); 783 l2tp_session_inc_refcount(session); 784 785 mutex_lock(&ps->sk_lock); 786 error = l2tp_session_register(session, tunnel); 787 if (error < 0) { 788 mutex_unlock(&ps->sk_lock); 789 kfree(session); 790 goto end; 791 } 792 drop_refcnt = true; 793 new_session = true; 794 } 795 796 /* Special case: if source & dest session_id == 0x0000, this 797 * socket is being created to manage the tunnel. Just set up 798 * the internal context for use by ioctl() and sockopt() 799 * handlers. 800 */ 801 if (session->session_id == 0 && session->peer_session_id == 0) { 802 error = 0; 803 goto out_no_ppp; 804 } 805 806 /* The only header we need to worry about is the L2TP 807 * header. This size is different depending on whether 808 * sequence numbers are enabled for the data channel. 809 */ 810 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 811 812 po->chan.private = sk; 813 po->chan.ops = &pppol2tp_chan_ops; 814 po->chan.mtu = pppol2tp_tunnel_mtu(tunnel); 815 816 error = ppp_register_net_channel(sock_net(sk), &po->chan); 817 if (error) { 818 mutex_unlock(&ps->sk_lock); 819 goto end; 820 } 821 822 out_no_ppp: 823 /* This is how we get the session context from the socket. */ 824 sk->sk_user_data = session; 825 rcu_assign_pointer(ps->sk, sk); 826 mutex_unlock(&ps->sk_lock); 827 828 /* Keep the reference we've grabbed on the session: sk doesn't expect 829 * the session to disappear. pppol2tp_session_destruct() is responsible 830 * for dropping it. 831 */ 832 drop_refcnt = false; 833 834 sk->sk_state = PPPOX_CONNECTED; 835 836 end: 837 if (error) { 838 if (new_session) 839 l2tp_session_delete(session); 840 if (new_tunnel) 841 l2tp_tunnel_delete(tunnel); 842 } 843 if (drop_refcnt) 844 l2tp_session_dec_refcount(session); 845 if (drop_tunnel) 846 l2tp_tunnel_dec_refcount(tunnel); 847 release_sock(sk); 848 849 return error; 850 } 851 852 #ifdef CONFIG_L2TP_V3 853 854 /* Called when creating sessions via the netlink interface. */ 855 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, 856 u32 session_id, u32 peer_session_id, 857 struct l2tp_session_cfg *cfg) 858 { 859 int error; 860 struct l2tp_session *session; 861 862 /* Error if tunnel socket is not prepped */ 863 if (!tunnel->sock) { 864 error = -ENOENT; 865 goto err; 866 } 867 868 /* Allocate and initialize a new session context. */ 869 session = l2tp_session_create(sizeof(struct pppol2tp_session), 870 tunnel, session_id, 871 peer_session_id, cfg); 872 if (IS_ERR(session)) { 873 error = PTR_ERR(session); 874 goto err; 875 } 876 877 pppol2tp_session_init(session); 878 879 error = l2tp_session_register(session, tunnel); 880 if (error < 0) 881 goto err_sess; 882 883 return 0; 884 885 err_sess: 886 kfree(session); 887 err: 888 return error; 889 } 890 891 #endif /* CONFIG_L2TP_V3 */ 892 893 /* getname() support. 894 */ 895 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr, 896 int peer) 897 { 898 int len = 0; 899 int error = 0; 900 struct l2tp_session *session; 901 struct l2tp_tunnel *tunnel; 902 struct sock *sk = sock->sk; 903 struct inet_sock *inet; 904 struct pppol2tp_session *pls; 905 906 error = -ENOTCONN; 907 if (!sk) 908 goto end; 909 if (!(sk->sk_state & PPPOX_CONNECTED)) 910 goto end; 911 912 error = -EBADF; 913 session = pppol2tp_sock_to_session(sk); 914 if (!session) 915 goto end; 916 917 pls = l2tp_session_priv(session); 918 tunnel = session->tunnel; 919 920 inet = inet_sk(tunnel->sock); 921 if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET) { 922 struct sockaddr_pppol2tp sp; 923 924 len = sizeof(sp); 925 memset(&sp, 0, len); 926 sp.sa_family = AF_PPPOX; 927 sp.sa_protocol = PX_PROTO_OL2TP; 928 sp.pppol2tp.fd = tunnel->fd; 929 sp.pppol2tp.pid = pls->owner; 930 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 931 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 932 sp.pppol2tp.s_session = session->session_id; 933 sp.pppol2tp.d_session = session->peer_session_id; 934 sp.pppol2tp.addr.sin_family = AF_INET; 935 sp.pppol2tp.addr.sin_port = inet->inet_dport; 936 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 937 memcpy(uaddr, &sp, len); 938 #if IS_ENABLED(CONFIG_IPV6) 939 } else if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET6) { 940 struct sockaddr_pppol2tpin6 sp; 941 942 len = sizeof(sp); 943 memset(&sp, 0, len); 944 sp.sa_family = AF_PPPOX; 945 sp.sa_protocol = PX_PROTO_OL2TP; 946 sp.pppol2tp.fd = tunnel->fd; 947 sp.pppol2tp.pid = pls->owner; 948 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 949 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 950 sp.pppol2tp.s_session = session->session_id; 951 sp.pppol2tp.d_session = session->peer_session_id; 952 sp.pppol2tp.addr.sin6_family = AF_INET6; 953 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 954 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 955 sizeof(tunnel->sock->sk_v6_daddr)); 956 memcpy(uaddr, &sp, len); 957 } else if (tunnel->version == 3 && tunnel->sock->sk_family == AF_INET6) { 958 struct sockaddr_pppol2tpv3in6 sp; 959 960 len = sizeof(sp); 961 memset(&sp, 0, len); 962 sp.sa_family = AF_PPPOX; 963 sp.sa_protocol = PX_PROTO_OL2TP; 964 sp.pppol2tp.fd = tunnel->fd; 965 sp.pppol2tp.pid = pls->owner; 966 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 967 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 968 sp.pppol2tp.s_session = session->session_id; 969 sp.pppol2tp.d_session = session->peer_session_id; 970 sp.pppol2tp.addr.sin6_family = AF_INET6; 971 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 972 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 973 sizeof(tunnel->sock->sk_v6_daddr)); 974 memcpy(uaddr, &sp, len); 975 #endif 976 } else if (tunnel->version == 3) { 977 struct sockaddr_pppol2tpv3 sp; 978 979 len = sizeof(sp); 980 memset(&sp, 0, len); 981 sp.sa_family = AF_PPPOX; 982 sp.sa_protocol = PX_PROTO_OL2TP; 983 sp.pppol2tp.fd = tunnel->fd; 984 sp.pppol2tp.pid = pls->owner; 985 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 986 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 987 sp.pppol2tp.s_session = session->session_id; 988 sp.pppol2tp.d_session = session->peer_session_id; 989 sp.pppol2tp.addr.sin_family = AF_INET; 990 sp.pppol2tp.addr.sin_port = inet->inet_dport; 991 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 992 memcpy(uaddr, &sp, len); 993 } 994 995 error = len; 996 997 sock_put(sk); 998 end: 999 return error; 1000 } 1001 1002 /**************************************************************************** 1003 * ioctl() handlers. 1004 * 1005 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1006 * sockets. However, in order to control kernel tunnel features, we allow 1007 * userspace to create a special "tunnel" PPPoX socket which is used for 1008 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow 1009 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl() 1010 * calls. 1011 ****************************************************************************/ 1012 1013 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest, 1014 const struct l2tp_stats *stats) 1015 { 1016 memset(dest, 0, sizeof(*dest)); 1017 1018 dest->tx_packets = atomic_long_read(&stats->tx_packets); 1019 dest->tx_bytes = atomic_long_read(&stats->tx_bytes); 1020 dest->tx_errors = atomic_long_read(&stats->tx_errors); 1021 dest->rx_packets = atomic_long_read(&stats->rx_packets); 1022 dest->rx_bytes = atomic_long_read(&stats->rx_bytes); 1023 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards); 1024 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets); 1025 dest->rx_errors = atomic_long_read(&stats->rx_errors); 1026 } 1027 1028 static int pppol2tp_tunnel_copy_stats(struct pppol2tp_ioc_stats *stats, 1029 struct l2tp_tunnel *tunnel) 1030 { 1031 struct l2tp_session *session; 1032 1033 if (!stats->session_id) { 1034 pppol2tp_copy_stats(stats, &tunnel->stats); 1035 return 0; 1036 } 1037 1038 /* If session_id is set, search the corresponding session in the 1039 * context of this tunnel and record the session's statistics. 1040 */ 1041 session = l2tp_tunnel_get_session(tunnel, stats->session_id); 1042 if (!session) 1043 return -EBADR; 1044 1045 if (session->pwtype != L2TP_PWTYPE_PPP) { 1046 l2tp_session_dec_refcount(session); 1047 return -EBADR; 1048 } 1049 1050 pppol2tp_copy_stats(stats, &session->stats); 1051 l2tp_session_dec_refcount(session); 1052 1053 return 0; 1054 } 1055 1056 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, 1057 unsigned long arg) 1058 { 1059 struct pppol2tp_ioc_stats stats; 1060 struct l2tp_session *session; 1061 1062 switch (cmd) { 1063 case PPPIOCGMRU: 1064 case PPPIOCGFLAGS: 1065 session = sock->sk->sk_user_data; 1066 if (!session) 1067 return -ENOTCONN; 1068 1069 /* Not defined for tunnels */ 1070 if (!session->session_id && !session->peer_session_id) 1071 return -ENOSYS; 1072 1073 if (put_user(0, (int __user *)arg)) 1074 return -EFAULT; 1075 break; 1076 1077 case PPPIOCSMRU: 1078 case PPPIOCSFLAGS: 1079 session = sock->sk->sk_user_data; 1080 if (!session) 1081 return -ENOTCONN; 1082 1083 /* Not defined for tunnels */ 1084 if (!session->session_id && !session->peer_session_id) 1085 return -ENOSYS; 1086 1087 if (!access_ok((int __user *)arg, sizeof(int))) 1088 return -EFAULT; 1089 break; 1090 1091 case PPPIOCGL2TPSTATS: 1092 session = sock->sk->sk_user_data; 1093 if (!session) 1094 return -ENOTCONN; 1095 1096 /* Session 0 represents the parent tunnel */ 1097 if (!session->session_id && !session->peer_session_id) { 1098 u32 session_id; 1099 int err; 1100 1101 if (copy_from_user(&stats, (void __user *)arg, 1102 sizeof(stats))) 1103 return -EFAULT; 1104 1105 session_id = stats.session_id; 1106 err = pppol2tp_tunnel_copy_stats(&stats, 1107 session->tunnel); 1108 if (err < 0) 1109 return err; 1110 1111 stats.session_id = session_id; 1112 } else { 1113 pppol2tp_copy_stats(&stats, &session->stats); 1114 stats.session_id = session->session_id; 1115 } 1116 stats.tunnel_id = session->tunnel->tunnel_id; 1117 stats.using_ipsec = l2tp_tunnel_uses_xfrm(session->tunnel); 1118 1119 if (copy_to_user((void __user *)arg, &stats, sizeof(stats))) 1120 return -EFAULT; 1121 break; 1122 1123 default: 1124 return -ENOIOCTLCMD; 1125 } 1126 1127 return 0; 1128 } 1129 1130 /***************************************************************************** 1131 * setsockopt() / getsockopt() support. 1132 * 1133 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1134 * sockets. In order to control kernel tunnel features, we allow userspace to 1135 * create a special "tunnel" PPPoX socket which is used for control only. 1136 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user 1137 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls. 1138 *****************************************************************************/ 1139 1140 /* Tunnel setsockopt() helper. 1141 */ 1142 static int pppol2tp_tunnel_setsockopt(struct sock *sk, 1143 struct l2tp_tunnel *tunnel, 1144 int optname, int val) 1145 { 1146 int err = 0; 1147 1148 switch (optname) { 1149 case PPPOL2TP_SO_DEBUG: 1150 tunnel->debug = val; 1151 break; 1152 1153 default: 1154 err = -ENOPROTOOPT; 1155 break; 1156 } 1157 1158 return err; 1159 } 1160 1161 /* Session setsockopt helper. 1162 */ 1163 static int pppol2tp_session_setsockopt(struct sock *sk, 1164 struct l2tp_session *session, 1165 int optname, int val) 1166 { 1167 int err = 0; 1168 1169 switch (optname) { 1170 case PPPOL2TP_SO_RECVSEQ: 1171 if (val != 0 && val != 1) { 1172 err = -EINVAL; 1173 break; 1174 } 1175 session->recv_seq = !!val; 1176 break; 1177 1178 case PPPOL2TP_SO_SENDSEQ: 1179 if (val != 0 && val != 1) { 1180 err = -EINVAL; 1181 break; 1182 } 1183 session->send_seq = !!val; 1184 { 1185 struct pppox_sock *po = pppox_sk(sk); 1186 1187 po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ : 1188 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 1189 } 1190 l2tp_session_set_header_len(session, session->tunnel->version); 1191 break; 1192 1193 case PPPOL2TP_SO_LNSMODE: 1194 if (val != 0 && val != 1) { 1195 err = -EINVAL; 1196 break; 1197 } 1198 session->lns_mode = !!val; 1199 break; 1200 1201 case PPPOL2TP_SO_DEBUG: 1202 session->debug = val; 1203 break; 1204 1205 case PPPOL2TP_SO_REORDERTO: 1206 session->reorder_timeout = msecs_to_jiffies(val); 1207 break; 1208 1209 default: 1210 err = -ENOPROTOOPT; 1211 break; 1212 } 1213 1214 return err; 1215 } 1216 1217 /* Main setsockopt() entry point. 1218 * Does API checks, then calls either the tunnel or session setsockopt 1219 * handler, according to whether the PPPoL2TP socket is a for a regular 1220 * session or the special tunnel type. 1221 */ 1222 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, 1223 sockptr_t optval, unsigned int optlen) 1224 { 1225 struct sock *sk = sock->sk; 1226 struct l2tp_session *session; 1227 struct l2tp_tunnel *tunnel; 1228 int val; 1229 int err; 1230 1231 if (level != SOL_PPPOL2TP) 1232 return -EINVAL; 1233 1234 if (optlen < sizeof(int)) 1235 return -EINVAL; 1236 1237 if (copy_from_sockptr(&val, optval, sizeof(int))) 1238 return -EFAULT; 1239 1240 err = -ENOTCONN; 1241 if (!sk->sk_user_data) 1242 goto end; 1243 1244 /* Get session context from the socket */ 1245 err = -EBADF; 1246 session = pppol2tp_sock_to_session(sk); 1247 if (!session) 1248 goto end; 1249 1250 /* Special case: if session_id == 0x0000, treat as operation on tunnel 1251 */ 1252 if (session->session_id == 0 && session->peer_session_id == 0) { 1253 tunnel = session->tunnel; 1254 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val); 1255 } else { 1256 err = pppol2tp_session_setsockopt(sk, session, optname, val); 1257 } 1258 1259 sock_put(sk); 1260 end: 1261 return err; 1262 } 1263 1264 /* Tunnel getsockopt helper. Called with sock locked. 1265 */ 1266 static int pppol2tp_tunnel_getsockopt(struct sock *sk, 1267 struct l2tp_tunnel *tunnel, 1268 int optname, int *val) 1269 { 1270 int err = 0; 1271 1272 switch (optname) { 1273 case PPPOL2TP_SO_DEBUG: 1274 *val = tunnel->debug; 1275 break; 1276 1277 default: 1278 err = -ENOPROTOOPT; 1279 break; 1280 } 1281 1282 return err; 1283 } 1284 1285 /* Session getsockopt helper. Called with sock locked. 1286 */ 1287 static int pppol2tp_session_getsockopt(struct sock *sk, 1288 struct l2tp_session *session, 1289 int optname, int *val) 1290 { 1291 int err = 0; 1292 1293 switch (optname) { 1294 case PPPOL2TP_SO_RECVSEQ: 1295 *val = session->recv_seq; 1296 break; 1297 1298 case PPPOL2TP_SO_SENDSEQ: 1299 *val = session->send_seq; 1300 break; 1301 1302 case PPPOL2TP_SO_LNSMODE: 1303 *val = session->lns_mode; 1304 break; 1305 1306 case PPPOL2TP_SO_DEBUG: 1307 *val = session->debug; 1308 break; 1309 1310 case PPPOL2TP_SO_REORDERTO: 1311 *val = (int)jiffies_to_msecs(session->reorder_timeout); 1312 break; 1313 1314 default: 1315 err = -ENOPROTOOPT; 1316 } 1317 1318 return err; 1319 } 1320 1321 /* Main getsockopt() entry point. 1322 * Does API checks, then calls either the tunnel or session getsockopt 1323 * handler, according to whether the PPPoX socket is a for a regular session 1324 * or the special tunnel type. 1325 */ 1326 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, 1327 char __user *optval, int __user *optlen) 1328 { 1329 struct sock *sk = sock->sk; 1330 struct l2tp_session *session; 1331 struct l2tp_tunnel *tunnel; 1332 int val, len; 1333 int err; 1334 1335 if (level != SOL_PPPOL2TP) 1336 return -EINVAL; 1337 1338 if (get_user(len, optlen)) 1339 return -EFAULT; 1340 1341 len = min_t(unsigned int, len, sizeof(int)); 1342 1343 if (len < 0) 1344 return -EINVAL; 1345 1346 err = -ENOTCONN; 1347 if (!sk->sk_user_data) 1348 goto end; 1349 1350 /* Get the session context */ 1351 err = -EBADF; 1352 session = pppol2tp_sock_to_session(sk); 1353 if (!session) 1354 goto end; 1355 1356 /* Special case: if session_id == 0x0000, treat as operation on tunnel */ 1357 if (session->session_id == 0 && session->peer_session_id == 0) { 1358 tunnel = session->tunnel; 1359 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val); 1360 if (err) 1361 goto end_put_sess; 1362 } else { 1363 err = pppol2tp_session_getsockopt(sk, session, optname, &val); 1364 if (err) 1365 goto end_put_sess; 1366 } 1367 1368 err = -EFAULT; 1369 if (put_user(len, optlen)) 1370 goto end_put_sess; 1371 1372 if (copy_to_user((void __user *)optval, &val, len)) 1373 goto end_put_sess; 1374 1375 err = 0; 1376 1377 end_put_sess: 1378 sock_put(sk); 1379 end: 1380 return err; 1381 } 1382 1383 /***************************************************************************** 1384 * /proc filesystem for debug 1385 * Since the original pppol2tp driver provided /proc/net/pppol2tp for 1386 * L2TPv2, we dump only L2TPv2 tunnels and sessions here. 1387 *****************************************************************************/ 1388 1389 static unsigned int pppol2tp_net_id; 1390 1391 #ifdef CONFIG_PROC_FS 1392 1393 struct pppol2tp_seq_data { 1394 struct seq_net_private p; 1395 int tunnel_idx; /* current tunnel */ 1396 int session_idx; /* index of session within current tunnel */ 1397 struct l2tp_tunnel *tunnel; 1398 struct l2tp_session *session; /* NULL means get next tunnel */ 1399 }; 1400 1401 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) 1402 { 1403 /* Drop reference taken during previous invocation */ 1404 if (pd->tunnel) 1405 l2tp_tunnel_dec_refcount(pd->tunnel); 1406 1407 for (;;) { 1408 pd->tunnel = l2tp_tunnel_get_nth(net, pd->tunnel_idx); 1409 pd->tunnel_idx++; 1410 1411 /* Only accept L2TPv2 tunnels */ 1412 if (!pd->tunnel || pd->tunnel->version == 2) 1413 return; 1414 1415 l2tp_tunnel_dec_refcount(pd->tunnel); 1416 } 1417 } 1418 1419 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) 1420 { 1421 /* Drop reference taken during previous invocation */ 1422 if (pd->session) 1423 l2tp_session_dec_refcount(pd->session); 1424 1425 pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx); 1426 pd->session_idx++; 1427 1428 if (!pd->session) { 1429 pd->session_idx = 0; 1430 pppol2tp_next_tunnel(net, pd); 1431 } 1432 } 1433 1434 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs) 1435 { 1436 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN; 1437 loff_t pos = *offs; 1438 struct net *net; 1439 1440 if (!pos) 1441 goto out; 1442 1443 if (WARN_ON(!m->private)) { 1444 pd = NULL; 1445 goto out; 1446 } 1447 1448 pd = m->private; 1449 net = seq_file_net(m); 1450 1451 if (!pd->tunnel) 1452 pppol2tp_next_tunnel(net, pd); 1453 else 1454 pppol2tp_next_session(net, pd); 1455 1456 /* NULL tunnel and session indicates end of list */ 1457 if (!pd->tunnel && !pd->session) 1458 pd = NULL; 1459 1460 out: 1461 return pd; 1462 } 1463 1464 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos) 1465 { 1466 (*pos)++; 1467 return NULL; 1468 } 1469 1470 static void pppol2tp_seq_stop(struct seq_file *p, void *v) 1471 { 1472 struct pppol2tp_seq_data *pd = v; 1473 1474 if (!pd || pd == SEQ_START_TOKEN) 1475 return; 1476 1477 /* Drop reference taken by last invocation of pppol2tp_next_session() 1478 * or pppol2tp_next_tunnel(). 1479 */ 1480 if (pd->session) { 1481 l2tp_session_dec_refcount(pd->session); 1482 pd->session = NULL; 1483 } 1484 if (pd->tunnel) { 1485 l2tp_tunnel_dec_refcount(pd->tunnel); 1486 pd->tunnel = NULL; 1487 } 1488 } 1489 1490 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) 1491 { 1492 struct l2tp_tunnel *tunnel = v; 1493 1494 seq_printf(m, "\nTUNNEL '%s', %c %d\n", 1495 tunnel->name, 1496 (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N', 1497 refcount_read(&tunnel->ref_count) - 1); 1498 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n", 1499 tunnel->debug, 1500 atomic_long_read(&tunnel->stats.tx_packets), 1501 atomic_long_read(&tunnel->stats.tx_bytes), 1502 atomic_long_read(&tunnel->stats.tx_errors), 1503 atomic_long_read(&tunnel->stats.rx_packets), 1504 atomic_long_read(&tunnel->stats.rx_bytes), 1505 atomic_long_read(&tunnel->stats.rx_errors)); 1506 } 1507 1508 static void pppol2tp_seq_session_show(struct seq_file *m, void *v) 1509 { 1510 struct l2tp_session *session = v; 1511 struct l2tp_tunnel *tunnel = session->tunnel; 1512 unsigned char state; 1513 char user_data_ok; 1514 struct sock *sk; 1515 u32 ip = 0; 1516 u16 port = 0; 1517 1518 if (tunnel->sock) { 1519 struct inet_sock *inet = inet_sk(tunnel->sock); 1520 1521 ip = ntohl(inet->inet_saddr); 1522 port = ntohs(inet->inet_sport); 1523 } 1524 1525 sk = pppol2tp_session_get_sock(session); 1526 if (sk) { 1527 state = sk->sk_state; 1528 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N'; 1529 } else { 1530 state = 0; 1531 user_data_ok = 'N'; 1532 } 1533 1534 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> %04X/%04X %d %c\n", 1535 session->name, ip, port, 1536 tunnel->tunnel_id, 1537 session->session_id, 1538 tunnel->peer_tunnel_id, 1539 session->peer_session_id, 1540 state, user_data_ok); 1541 seq_printf(m, " 0/0/%c/%c/%s %08x %u\n", 1542 session->recv_seq ? 'R' : '-', 1543 session->send_seq ? 'S' : '-', 1544 session->lns_mode ? "LNS" : "LAC", 1545 session->debug, 1546 jiffies_to_msecs(session->reorder_timeout)); 1547 seq_printf(m, " %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n", 1548 session->nr, session->ns, 1549 atomic_long_read(&session->stats.tx_packets), 1550 atomic_long_read(&session->stats.tx_bytes), 1551 atomic_long_read(&session->stats.tx_errors), 1552 atomic_long_read(&session->stats.rx_packets), 1553 atomic_long_read(&session->stats.rx_bytes), 1554 atomic_long_read(&session->stats.rx_errors)); 1555 1556 if (sk) { 1557 struct pppox_sock *po = pppox_sk(sk); 1558 1559 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 1560 sock_put(sk); 1561 } 1562 } 1563 1564 static int pppol2tp_seq_show(struct seq_file *m, void *v) 1565 { 1566 struct pppol2tp_seq_data *pd = v; 1567 1568 /* display header on line 1 */ 1569 if (v == SEQ_START_TOKEN) { 1570 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n"); 1571 seq_puts(m, "TUNNEL name, user-data-ok session-count\n"); 1572 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1573 seq_puts(m, " SESSION name, addr/port src-tid/sid dest-tid/sid state user-data-ok\n"); 1574 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n"); 1575 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1576 goto out; 1577 } 1578 1579 if (!pd->session) 1580 pppol2tp_seq_tunnel_show(m, pd->tunnel); 1581 else 1582 pppol2tp_seq_session_show(m, pd->session); 1583 1584 out: 1585 return 0; 1586 } 1587 1588 static const struct seq_operations pppol2tp_seq_ops = { 1589 .start = pppol2tp_seq_start, 1590 .next = pppol2tp_seq_next, 1591 .stop = pppol2tp_seq_stop, 1592 .show = pppol2tp_seq_show, 1593 }; 1594 #endif /* CONFIG_PROC_FS */ 1595 1596 /***************************************************************************** 1597 * Network namespace 1598 *****************************************************************************/ 1599 1600 static __net_init int pppol2tp_init_net(struct net *net) 1601 { 1602 struct proc_dir_entry *pde; 1603 int err = 0; 1604 1605 pde = proc_create_net("pppol2tp", 0444, net->proc_net, 1606 &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data)); 1607 if (!pde) { 1608 err = -ENOMEM; 1609 goto out; 1610 } 1611 1612 out: 1613 return err; 1614 } 1615 1616 static __net_exit void pppol2tp_exit_net(struct net *net) 1617 { 1618 remove_proc_entry("pppol2tp", net->proc_net); 1619 } 1620 1621 static struct pernet_operations pppol2tp_net_ops = { 1622 .init = pppol2tp_init_net, 1623 .exit = pppol2tp_exit_net, 1624 .id = &pppol2tp_net_id, 1625 }; 1626 1627 /***************************************************************************** 1628 * Init and cleanup 1629 *****************************************************************************/ 1630 1631 static const struct proto_ops pppol2tp_ops = { 1632 .family = AF_PPPOX, 1633 .owner = THIS_MODULE, 1634 .release = pppol2tp_release, 1635 .bind = sock_no_bind, 1636 .connect = pppol2tp_connect, 1637 .socketpair = sock_no_socketpair, 1638 .accept = sock_no_accept, 1639 .getname = pppol2tp_getname, 1640 .poll = datagram_poll, 1641 .listen = sock_no_listen, 1642 .shutdown = sock_no_shutdown, 1643 .setsockopt = pppol2tp_setsockopt, 1644 .getsockopt = pppol2tp_getsockopt, 1645 .sendmsg = pppol2tp_sendmsg, 1646 .recvmsg = pppol2tp_recvmsg, 1647 .mmap = sock_no_mmap, 1648 .ioctl = pppox_ioctl, 1649 #ifdef CONFIG_COMPAT 1650 .compat_ioctl = pppox_compat_ioctl, 1651 #endif 1652 }; 1653 1654 static const struct pppox_proto pppol2tp_proto = { 1655 .create = pppol2tp_create, 1656 .ioctl = pppol2tp_ioctl, 1657 .owner = THIS_MODULE, 1658 }; 1659 1660 #ifdef CONFIG_L2TP_V3 1661 1662 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = { 1663 .session_create = pppol2tp_session_create, 1664 .session_delete = l2tp_session_delete, 1665 }; 1666 1667 #endif /* CONFIG_L2TP_V3 */ 1668 1669 static int __init pppol2tp_init(void) 1670 { 1671 int err; 1672 1673 err = register_pernet_device(&pppol2tp_net_ops); 1674 if (err) 1675 goto out; 1676 1677 err = proto_register(&pppol2tp_sk_proto, 0); 1678 if (err) 1679 goto out_unregister_pppol2tp_pernet; 1680 1681 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto); 1682 if (err) 1683 goto out_unregister_pppol2tp_proto; 1684 1685 #ifdef CONFIG_L2TP_V3 1686 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops); 1687 if (err) 1688 goto out_unregister_pppox; 1689 #endif 1690 1691 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION); 1692 1693 out: 1694 return err; 1695 1696 #ifdef CONFIG_L2TP_V3 1697 out_unregister_pppox: 1698 unregister_pppox_proto(PX_PROTO_OL2TP); 1699 #endif 1700 out_unregister_pppol2tp_proto: 1701 proto_unregister(&pppol2tp_sk_proto); 1702 out_unregister_pppol2tp_pernet: 1703 unregister_pernet_device(&pppol2tp_net_ops); 1704 goto out; 1705 } 1706 1707 static void __exit pppol2tp_exit(void) 1708 { 1709 #ifdef CONFIG_L2TP_V3 1710 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP); 1711 #endif 1712 unregister_pppox_proto(PX_PROTO_OL2TP); 1713 proto_unregister(&pppol2tp_sk_proto); 1714 unregister_pernet_device(&pppol2tp_net_ops); 1715 } 1716 1717 module_init(pppol2tp_init); 1718 module_exit(pppol2tp_exit); 1719 1720 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1721 MODULE_DESCRIPTION("PPP over L2TP over UDP"); 1722 MODULE_LICENSE("GPL"); 1723 MODULE_VERSION(PPPOL2TP_DRV_VERSION); 1724 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP); 1725 MODULE_ALIAS_L2TP_PWTYPE(7); 1726