1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /***************************************************************************** 3 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets 4 * 5 * PPPoX --- Generic PPP encapsulation socket family 6 * PPPoL2TP --- PPP over L2TP (RFC 2661) 7 * 8 * Version: 2.0.0 9 * 10 * Authors: James Chapman (jchapman@katalix.com) 11 * 12 * Based on original work by Martijn van Oosterhout <kleptog@svana.org> 13 * 14 * License: 15 */ 16 17 /* This driver handles only L2TP data frames; control frames are handled by a 18 * userspace application. 19 * 20 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and 21 * attaches it to a bound UDP socket with local tunnel_id / session_id and 22 * peer tunnel_id / session_id set. Data can then be sent or received using 23 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket 24 * can be read or modified using ioctl() or [gs]etsockopt() calls. 25 * 26 * When a PPPoL2TP socket is connected with local and peer session_id values 27 * zero, the socket is treated as a special tunnel management socket. 28 * 29 * Here's example userspace code to create a socket for sending/receiving data 30 * over an L2TP session:- 31 * 32 * struct sockaddr_pppol2tp sax; 33 * int fd; 34 * int session_fd; 35 * 36 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); 37 * 38 * sax.sa_family = AF_PPPOX; 39 * sax.sa_protocol = PX_PROTO_OL2TP; 40 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket 41 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr; 42 * sax.pppol2tp.addr.sin_port = addr->sin_port; 43 * sax.pppol2tp.addr.sin_family = AF_INET; 44 * sax.pppol2tp.s_tunnel = tunnel_id; 45 * sax.pppol2tp.s_session = session_id; 46 * sax.pppol2tp.d_tunnel = peer_tunnel_id; 47 * sax.pppol2tp.d_session = peer_session_id; 48 * 49 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax)); 50 * 51 * A pppd plugin that allows PPP traffic to be carried over L2TP using 52 * this driver is available from the OpenL2TP project at 53 * http://openl2tp.sourceforge.net. 54 */ 55 56 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 57 58 #include <linux/module.h> 59 #include <linux/string.h> 60 #include <linux/list.h> 61 #include <linux/uaccess.h> 62 63 #include <linux/kernel.h> 64 #include <linux/spinlock.h> 65 #include <linux/kthread.h> 66 #include <linux/sched.h> 67 #include <linux/slab.h> 68 #include <linux/errno.h> 69 #include <linux/jiffies.h> 70 71 #include <linux/netdevice.h> 72 #include <linux/net.h> 73 #include <linux/inetdevice.h> 74 #include <linux/skbuff.h> 75 #include <linux/init.h> 76 #include <linux/ip.h> 77 #include <linux/udp.h> 78 #include <linux/if_pppox.h> 79 #include <linux/if_pppol2tp.h> 80 #include <net/sock.h> 81 #include <linux/ppp_channel.h> 82 #include <linux/ppp_defs.h> 83 #include <linux/ppp-ioctl.h> 84 #include <linux/file.h> 85 #include <linux/hash.h> 86 #include <linux/sort.h> 87 #include <linux/proc_fs.h> 88 #include <linux/l2tp.h> 89 #include <linux/nsproxy.h> 90 #include <net/net_namespace.h> 91 #include <net/netns/generic.h> 92 #include <net/ip.h> 93 #include <net/udp.h> 94 #include <net/inet_common.h> 95 96 #include <asm/byteorder.h> 97 #include <linux/atomic.h> 98 99 #include "l2tp_core.h" 100 101 #define PPPOL2TP_DRV_VERSION "V2.0" 102 103 /* Space for UDP, L2TP and PPP headers */ 104 #define PPPOL2TP_HEADER_OVERHEAD 40 105 106 /* Number of bytes to build transmit L2TP headers. 107 * Unfortunately the size is different depending on whether sequence numbers 108 * are enabled. 109 */ 110 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10 111 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6 112 113 /* Private data of each session. This data lives at the end of struct 114 * l2tp_session, referenced via session->priv[]. 115 */ 116 struct pppol2tp_session { 117 int owner; /* pid that opened the socket */ 118 119 struct mutex sk_lock; /* Protects .sk */ 120 struct sock __rcu *sk; /* Pointer to the session PPPoX socket */ 121 struct sock *__sk; /* Copy of .sk, for cleanup */ 122 struct rcu_head rcu; /* For asynchronous release */ 123 }; 124 125 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb); 126 127 static const struct ppp_channel_ops pppol2tp_chan_ops = { 128 .start_xmit = pppol2tp_xmit, 129 }; 130 131 static const struct proto_ops pppol2tp_ops; 132 133 /* Retrieves the pppol2tp socket associated to a session. 134 * A reference is held on the returned socket, so this function must be paired 135 * with sock_put(). 136 */ 137 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) 138 { 139 struct pppol2tp_session *ps = l2tp_session_priv(session); 140 struct sock *sk; 141 142 rcu_read_lock(); 143 sk = rcu_dereference(ps->sk); 144 if (sk) 145 sock_hold(sk); 146 rcu_read_unlock(); 147 148 return sk; 149 } 150 151 /* Helpers to obtain tunnel/session contexts from sockets. 152 */ 153 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) 154 { 155 struct l2tp_session *session; 156 157 if (sk == NULL) 158 return NULL; 159 160 sock_hold(sk); 161 session = (struct l2tp_session *)(sk->sk_user_data); 162 if (session == NULL) { 163 sock_put(sk); 164 goto out; 165 } 166 167 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 168 169 out: 170 return session; 171 } 172 173 /***************************************************************************** 174 * Receive data handling 175 *****************************************************************************/ 176 177 /* Receive message. This is the recvmsg for the PPPoL2TP socket. 178 */ 179 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, 180 size_t len, int flags) 181 { 182 int err; 183 struct sk_buff *skb; 184 struct sock *sk = sock->sk; 185 186 err = -EIO; 187 if (sk->sk_state & PPPOX_BOUND) 188 goto end; 189 190 err = 0; 191 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 192 flags & MSG_DONTWAIT, &err); 193 if (!skb) 194 goto end; 195 196 if (len > skb->len) 197 len = skb->len; 198 else if (len < skb->len) 199 msg->msg_flags |= MSG_TRUNC; 200 201 err = skb_copy_datagram_msg(skb, 0, msg, len); 202 if (likely(err == 0)) 203 err = len; 204 205 kfree_skb(skb); 206 end: 207 return err; 208 } 209 210 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) 211 { 212 struct pppol2tp_session *ps = l2tp_session_priv(session); 213 struct sock *sk = NULL; 214 215 /* If the socket is bound, send it in to PPP's input queue. Otherwise 216 * queue it on the session socket. 217 */ 218 rcu_read_lock(); 219 sk = rcu_dereference(ps->sk); 220 if (sk == NULL) 221 goto no_sock; 222 223 /* If the first two bytes are 0xFF03, consider that it is the PPP's 224 * Address and Control fields and skip them. The L2TP module has always 225 * worked this way, although, in theory, the use of these fields should 226 * be negociated and handled at the PPP layer. These fields are 227 * constant: 0xFF is the All-Stations Address and 0x03 the Unnumbered 228 * Information command with Poll/Final bit set to zero (RFC 1662). 229 */ 230 if (pskb_may_pull(skb, 2) && skb->data[0] == PPP_ALLSTATIONS && 231 skb->data[1] == PPP_UI) 232 skb_pull(skb, 2); 233 234 if (sk->sk_state & PPPOX_BOUND) { 235 struct pppox_sock *po; 236 237 l2tp_dbg(session, L2TP_MSG_DATA, 238 "%s: recv %d byte data frame, passing to ppp\n", 239 session->name, data_len); 240 241 po = pppox_sk(sk); 242 ppp_input(&po->chan, skb); 243 } else { 244 l2tp_dbg(session, L2TP_MSG_DATA, 245 "%s: recv %d byte data frame, passing to L2TP socket\n", 246 session->name, data_len); 247 248 if (sock_queue_rcv_skb(sk, skb) < 0) { 249 atomic_long_inc(&session->stats.rx_errors); 250 kfree_skb(skb); 251 } 252 } 253 rcu_read_unlock(); 254 255 return; 256 257 no_sock: 258 rcu_read_unlock(); 259 l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name); 260 kfree_skb(skb); 261 } 262 263 /************************************************************************ 264 * Transmit handling 265 ***********************************************************************/ 266 267 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here 268 * when a user application does a sendmsg() on the session socket. L2TP and 269 * PPP headers must be inserted into the user's data. 270 */ 271 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m, 272 size_t total_len) 273 { 274 struct sock *sk = sock->sk; 275 struct sk_buff *skb; 276 int error; 277 struct l2tp_session *session; 278 struct l2tp_tunnel *tunnel; 279 int uhlen; 280 281 error = -ENOTCONN; 282 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 283 goto error; 284 285 /* Get session and tunnel contexts */ 286 error = -EBADF; 287 session = pppol2tp_sock_to_session(sk); 288 if (session == NULL) 289 goto error; 290 291 tunnel = session->tunnel; 292 293 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 294 295 /* Allocate a socket buffer */ 296 error = -ENOMEM; 297 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 298 uhlen + session->hdr_len + 299 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 300 0, GFP_KERNEL); 301 if (!skb) 302 goto error_put_sess; 303 304 /* Reserve space for headers. */ 305 skb_reserve(skb, NET_SKB_PAD); 306 skb_reset_network_header(skb); 307 skb_reserve(skb, sizeof(struct iphdr)); 308 skb_reset_transport_header(skb); 309 skb_reserve(skb, uhlen); 310 311 /* Add PPP header */ 312 skb->data[0] = PPP_ALLSTATIONS; 313 skb->data[1] = PPP_UI; 314 skb_put(skb, 2); 315 316 /* Copy user data into skb */ 317 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len); 318 if (error < 0) { 319 kfree_skb(skb); 320 goto error_put_sess; 321 } 322 323 local_bh_disable(); 324 l2tp_xmit_skb(session, skb, session->hdr_len); 325 local_bh_enable(); 326 327 sock_put(sk); 328 329 return total_len; 330 331 error_put_sess: 332 sock_put(sk); 333 error: 334 return error; 335 } 336 337 /* Transmit function called by generic PPP driver. Sends PPP frame 338 * over PPPoL2TP socket. 339 * 340 * This is almost the same as pppol2tp_sendmsg(), but rather than 341 * being called with a msghdr from userspace, it is called with a skb 342 * from the kernel. 343 * 344 * The supplied skb from ppp doesn't have enough headroom for the 345 * insertion of L2TP, UDP and IP headers so we need to allocate more 346 * headroom in the skb. This will create a cloned skb. But we must be 347 * careful in the error case because the caller will expect to free 348 * the skb it supplied, not our cloned skb. So we take care to always 349 * leave the original skb unfreed if we return an error. 350 */ 351 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) 352 { 353 struct sock *sk = (struct sock *)chan->private; 354 struct l2tp_session *session; 355 struct l2tp_tunnel *tunnel; 356 int uhlen, headroom; 357 358 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 359 goto abort; 360 361 /* Get session and tunnel contexts from the socket */ 362 session = pppol2tp_sock_to_session(sk); 363 if (session == NULL) 364 goto abort; 365 366 tunnel = session->tunnel; 367 368 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 369 headroom = NET_SKB_PAD + 370 sizeof(struct iphdr) + /* IP header */ 371 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */ 372 session->hdr_len + /* L2TP header */ 373 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 374 if (skb_cow_head(skb, headroom)) 375 goto abort_put_sess; 376 377 /* Setup PPP header */ 378 __skb_push(skb, 2); 379 skb->data[0] = PPP_ALLSTATIONS; 380 skb->data[1] = PPP_UI; 381 382 local_bh_disable(); 383 l2tp_xmit_skb(session, skb, session->hdr_len); 384 local_bh_enable(); 385 386 sock_put(sk); 387 388 return 1; 389 390 abort_put_sess: 391 sock_put(sk); 392 abort: 393 /* Free the original skb */ 394 kfree_skb(skb); 395 return 1; 396 } 397 398 /***************************************************************************** 399 * Session (and tunnel control) socket create/destroy. 400 *****************************************************************************/ 401 402 static void pppol2tp_put_sk(struct rcu_head *head) 403 { 404 struct pppol2tp_session *ps; 405 406 ps = container_of(head, typeof(*ps), rcu); 407 sock_put(ps->__sk); 408 } 409 410 /* Really kill the session socket. (Called from sock_put() if 411 * refcnt == 0.) 412 */ 413 static void pppol2tp_session_destruct(struct sock *sk) 414 { 415 struct l2tp_session *session = sk->sk_user_data; 416 417 skb_queue_purge(&sk->sk_receive_queue); 418 skb_queue_purge(&sk->sk_write_queue); 419 420 if (session) { 421 sk->sk_user_data = NULL; 422 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 423 l2tp_session_dec_refcount(session); 424 } 425 } 426 427 /* Called when the PPPoX socket (session) is closed. 428 */ 429 static int pppol2tp_release(struct socket *sock) 430 { 431 struct sock *sk = sock->sk; 432 struct l2tp_session *session; 433 int error; 434 435 if (!sk) 436 return 0; 437 438 error = -EBADF; 439 lock_sock(sk); 440 if (sock_flag(sk, SOCK_DEAD) != 0) 441 goto error; 442 443 pppox_unbind_sock(sk); 444 445 /* Signal the death of the socket. */ 446 sk->sk_state = PPPOX_DEAD; 447 sock_orphan(sk); 448 sock->sk = NULL; 449 450 session = pppol2tp_sock_to_session(sk); 451 if (session) { 452 struct pppol2tp_session *ps; 453 454 l2tp_session_delete(session); 455 456 ps = l2tp_session_priv(session); 457 mutex_lock(&ps->sk_lock); 458 ps->__sk = rcu_dereference_protected(ps->sk, 459 lockdep_is_held(&ps->sk_lock)); 460 RCU_INIT_POINTER(ps->sk, NULL); 461 mutex_unlock(&ps->sk_lock); 462 call_rcu(&ps->rcu, pppol2tp_put_sk); 463 464 /* Rely on the sock_put() call at the end of the function for 465 * dropping the reference held by pppol2tp_sock_to_session(). 466 * The last reference will be dropped by pppol2tp_put_sk(). 467 */ 468 } 469 470 release_sock(sk); 471 472 /* This will delete the session context via 473 * pppol2tp_session_destruct() if the socket's refcnt drops to 474 * zero. 475 */ 476 sock_put(sk); 477 478 return 0; 479 480 error: 481 release_sock(sk); 482 return error; 483 } 484 485 static struct proto pppol2tp_sk_proto = { 486 .name = "PPPOL2TP", 487 .owner = THIS_MODULE, 488 .obj_size = sizeof(struct pppox_sock), 489 }; 490 491 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb) 492 { 493 int rc; 494 495 rc = l2tp_udp_encap_recv(sk, skb); 496 if (rc) 497 kfree_skb(skb); 498 499 return NET_RX_SUCCESS; 500 } 501 502 /* socket() handler. Initialize a new struct sock. 503 */ 504 static int pppol2tp_create(struct net *net, struct socket *sock, int kern) 505 { 506 int error = -ENOMEM; 507 struct sock *sk; 508 509 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern); 510 if (!sk) 511 goto out; 512 513 sock_init_data(sock, sk); 514 515 sock->state = SS_UNCONNECTED; 516 sock->ops = &pppol2tp_ops; 517 518 sk->sk_backlog_rcv = pppol2tp_backlog_recv; 519 sk->sk_protocol = PX_PROTO_OL2TP; 520 sk->sk_family = PF_PPPOX; 521 sk->sk_state = PPPOX_NONE; 522 sk->sk_type = SOCK_STREAM; 523 sk->sk_destruct = pppol2tp_session_destruct; 524 525 error = 0; 526 527 out: 528 return error; 529 } 530 531 static void pppol2tp_show(struct seq_file *m, void *arg) 532 { 533 struct l2tp_session *session = arg; 534 struct sock *sk; 535 536 sk = pppol2tp_session_get_sock(session); 537 if (sk) { 538 struct pppox_sock *po = pppox_sk(sk); 539 540 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 541 sock_put(sk); 542 } 543 } 544 545 static void pppol2tp_session_init(struct l2tp_session *session) 546 { 547 struct pppol2tp_session *ps; 548 549 session->recv_skb = pppol2tp_recv; 550 if (IS_ENABLED(CONFIG_L2TP_DEBUGFS)) 551 session->show = pppol2tp_show; 552 553 ps = l2tp_session_priv(session); 554 mutex_init(&ps->sk_lock); 555 ps->owner = current->pid; 556 } 557 558 struct l2tp_connect_info { 559 u8 version; 560 int fd; 561 u32 tunnel_id; 562 u32 peer_tunnel_id; 563 u32 session_id; 564 u32 peer_session_id; 565 }; 566 567 static int pppol2tp_sockaddr_get_info(const void *sa, int sa_len, 568 struct l2tp_connect_info *info) 569 { 570 switch (sa_len) { 571 case sizeof(struct sockaddr_pppol2tp): 572 { 573 const struct sockaddr_pppol2tp *sa_v2in4 = sa; 574 575 if (sa_v2in4->sa_protocol != PX_PROTO_OL2TP) 576 return -EINVAL; 577 578 info->version = 2; 579 info->fd = sa_v2in4->pppol2tp.fd; 580 info->tunnel_id = sa_v2in4->pppol2tp.s_tunnel; 581 info->peer_tunnel_id = sa_v2in4->pppol2tp.d_tunnel; 582 info->session_id = sa_v2in4->pppol2tp.s_session; 583 info->peer_session_id = sa_v2in4->pppol2tp.d_session; 584 585 break; 586 } 587 case sizeof(struct sockaddr_pppol2tpv3): 588 { 589 const struct sockaddr_pppol2tpv3 *sa_v3in4 = sa; 590 591 if (sa_v3in4->sa_protocol != PX_PROTO_OL2TP) 592 return -EINVAL; 593 594 info->version = 3; 595 info->fd = sa_v3in4->pppol2tp.fd; 596 info->tunnel_id = sa_v3in4->pppol2tp.s_tunnel; 597 info->peer_tunnel_id = sa_v3in4->pppol2tp.d_tunnel; 598 info->session_id = sa_v3in4->pppol2tp.s_session; 599 info->peer_session_id = sa_v3in4->pppol2tp.d_session; 600 601 break; 602 } 603 case sizeof(struct sockaddr_pppol2tpin6): 604 { 605 const struct sockaddr_pppol2tpin6 *sa_v2in6 = sa; 606 607 if (sa_v2in6->sa_protocol != PX_PROTO_OL2TP) 608 return -EINVAL; 609 610 info->version = 2; 611 info->fd = sa_v2in6->pppol2tp.fd; 612 info->tunnel_id = sa_v2in6->pppol2tp.s_tunnel; 613 info->peer_tunnel_id = sa_v2in6->pppol2tp.d_tunnel; 614 info->session_id = sa_v2in6->pppol2tp.s_session; 615 info->peer_session_id = sa_v2in6->pppol2tp.d_session; 616 617 break; 618 } 619 case sizeof(struct sockaddr_pppol2tpv3in6): 620 { 621 const struct sockaddr_pppol2tpv3in6 *sa_v3in6 = sa; 622 623 if (sa_v3in6->sa_protocol != PX_PROTO_OL2TP) 624 return -EINVAL; 625 626 info->version = 3; 627 info->fd = sa_v3in6->pppol2tp.fd; 628 info->tunnel_id = sa_v3in6->pppol2tp.s_tunnel; 629 info->peer_tunnel_id = sa_v3in6->pppol2tp.d_tunnel; 630 info->session_id = sa_v3in6->pppol2tp.s_session; 631 info->peer_session_id = sa_v3in6->pppol2tp.d_session; 632 633 break; 634 } 635 default: 636 return -EINVAL; 637 } 638 639 return 0; 640 } 641 642 /* Rough estimation of the maximum payload size a tunnel can transmit without 643 * fragmenting at the lower IP layer. Assumes L2TPv2 with sequence 644 * numbers and no IP option. Not quite accurate, but the result is mostly 645 * unused anyway. 646 */ 647 static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel) 648 { 649 int mtu; 650 651 mtu = l2tp_tunnel_dst_mtu(tunnel); 652 if (mtu <= PPPOL2TP_HEADER_OVERHEAD) 653 return 1500 - PPPOL2TP_HEADER_OVERHEAD; 654 655 return mtu - PPPOL2TP_HEADER_OVERHEAD; 656 } 657 658 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket 659 */ 660 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 661 int sockaddr_len, int flags) 662 { 663 struct sock *sk = sock->sk; 664 struct pppox_sock *po = pppox_sk(sk); 665 struct l2tp_session *session = NULL; 666 struct l2tp_connect_info info; 667 struct l2tp_tunnel *tunnel; 668 struct pppol2tp_session *ps; 669 struct l2tp_session_cfg cfg = { 0, }; 670 bool drop_refcnt = false; 671 bool drop_tunnel = false; 672 bool new_session = false; 673 bool new_tunnel = false; 674 int error; 675 676 error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info); 677 if (error < 0) 678 return error; 679 680 lock_sock(sk); 681 682 /* Check for already bound sockets */ 683 error = -EBUSY; 684 if (sk->sk_state & PPPOX_CONNECTED) 685 goto end; 686 687 /* We don't supporting rebinding anyway */ 688 error = -EALREADY; 689 if (sk->sk_user_data) 690 goto end; /* socket is already attached */ 691 692 /* Don't bind if tunnel_id is 0 */ 693 error = -EINVAL; 694 if (!info.tunnel_id) 695 goto end; 696 697 tunnel = l2tp_tunnel_get(sock_net(sk), info.tunnel_id); 698 if (tunnel) 699 drop_tunnel = true; 700 701 /* Special case: create tunnel context if session_id and 702 * peer_session_id is 0. Otherwise look up tunnel using supplied 703 * tunnel id. 704 */ 705 if (!info.session_id && !info.peer_session_id) { 706 if (tunnel == NULL) { 707 struct l2tp_tunnel_cfg tcfg = { 708 .encap = L2TP_ENCAPTYPE_UDP, 709 .debug = 0, 710 }; 711 712 /* Prevent l2tp_tunnel_register() from trying to set up 713 * a kernel socket. 714 */ 715 if (info.fd < 0) { 716 error = -EBADF; 717 goto end; 718 } 719 720 error = l2tp_tunnel_create(sock_net(sk), info.fd, 721 info.version, 722 info.tunnel_id, 723 info.peer_tunnel_id, &tcfg, 724 &tunnel); 725 if (error < 0) 726 goto end; 727 728 l2tp_tunnel_inc_refcount(tunnel); 729 error = l2tp_tunnel_register(tunnel, sock_net(sk), 730 &tcfg); 731 if (error < 0) { 732 kfree(tunnel); 733 goto end; 734 } 735 drop_tunnel = true; 736 new_tunnel = true; 737 } 738 } else { 739 /* Error if we can't find the tunnel */ 740 error = -ENOENT; 741 if (tunnel == NULL) 742 goto end; 743 744 /* Error if socket is not prepped */ 745 if (tunnel->sock == NULL) 746 goto end; 747 } 748 749 if (tunnel->peer_tunnel_id == 0) 750 tunnel->peer_tunnel_id = info.peer_tunnel_id; 751 752 session = l2tp_tunnel_get_session(tunnel, info.session_id); 753 if (session) { 754 drop_refcnt = true; 755 756 if (session->pwtype != L2TP_PWTYPE_PPP) { 757 error = -EPROTOTYPE; 758 goto end; 759 } 760 761 ps = l2tp_session_priv(session); 762 763 /* Using a pre-existing session is fine as long as it hasn't 764 * been connected yet. 765 */ 766 mutex_lock(&ps->sk_lock); 767 if (rcu_dereference_protected(ps->sk, 768 lockdep_is_held(&ps->sk_lock)) || 769 ps->__sk) { 770 mutex_unlock(&ps->sk_lock); 771 error = -EEXIST; 772 goto end; 773 } 774 } else { 775 cfg.pw_type = L2TP_PWTYPE_PPP; 776 777 session = l2tp_session_create(sizeof(struct pppol2tp_session), 778 tunnel, info.session_id, 779 info.peer_session_id, &cfg); 780 if (IS_ERR(session)) { 781 error = PTR_ERR(session); 782 goto end; 783 } 784 785 pppol2tp_session_init(session); 786 ps = l2tp_session_priv(session); 787 l2tp_session_inc_refcount(session); 788 789 mutex_lock(&ps->sk_lock); 790 error = l2tp_session_register(session, tunnel); 791 if (error < 0) { 792 mutex_unlock(&ps->sk_lock); 793 kfree(session); 794 goto end; 795 } 796 drop_refcnt = true; 797 new_session = true; 798 } 799 800 /* Special case: if source & dest session_id == 0x0000, this 801 * socket is being created to manage the tunnel. Just set up 802 * the internal context for use by ioctl() and sockopt() 803 * handlers. 804 */ 805 if ((session->session_id == 0) && 806 (session->peer_session_id == 0)) { 807 error = 0; 808 goto out_no_ppp; 809 } 810 811 /* The only header we need to worry about is the L2TP 812 * header. This size is different depending on whether 813 * sequence numbers are enabled for the data channel. 814 */ 815 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 816 817 po->chan.private = sk; 818 po->chan.ops = &pppol2tp_chan_ops; 819 po->chan.mtu = pppol2tp_tunnel_mtu(tunnel); 820 821 error = ppp_register_net_channel(sock_net(sk), &po->chan); 822 if (error) { 823 mutex_unlock(&ps->sk_lock); 824 goto end; 825 } 826 827 out_no_ppp: 828 /* This is how we get the session context from the socket. */ 829 sk->sk_user_data = session; 830 rcu_assign_pointer(ps->sk, sk); 831 mutex_unlock(&ps->sk_lock); 832 833 /* Keep the reference we've grabbed on the session: sk doesn't expect 834 * the session to disappear. pppol2tp_session_destruct() is responsible 835 * for dropping it. 836 */ 837 drop_refcnt = false; 838 839 sk->sk_state = PPPOX_CONNECTED; 840 l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n", 841 session->name); 842 843 end: 844 if (error) { 845 if (new_session) 846 l2tp_session_delete(session); 847 if (new_tunnel) 848 l2tp_tunnel_delete(tunnel); 849 } 850 if (drop_refcnt) 851 l2tp_session_dec_refcount(session); 852 if (drop_tunnel) 853 l2tp_tunnel_dec_refcount(tunnel); 854 release_sock(sk); 855 856 return error; 857 } 858 859 #ifdef CONFIG_L2TP_V3 860 861 /* Called when creating sessions via the netlink interface. */ 862 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, 863 u32 session_id, u32 peer_session_id, 864 struct l2tp_session_cfg *cfg) 865 { 866 int error; 867 struct l2tp_session *session; 868 869 /* Error if tunnel socket is not prepped */ 870 if (!tunnel->sock) { 871 error = -ENOENT; 872 goto err; 873 } 874 875 /* Allocate and initialize a new session context. */ 876 session = l2tp_session_create(sizeof(struct pppol2tp_session), 877 tunnel, session_id, 878 peer_session_id, cfg); 879 if (IS_ERR(session)) { 880 error = PTR_ERR(session); 881 goto err; 882 } 883 884 pppol2tp_session_init(session); 885 886 error = l2tp_session_register(session, tunnel); 887 if (error < 0) 888 goto err_sess; 889 890 return 0; 891 892 err_sess: 893 kfree(session); 894 err: 895 return error; 896 } 897 898 #endif /* CONFIG_L2TP_V3 */ 899 900 /* getname() support. 901 */ 902 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr, 903 int peer) 904 { 905 int len = 0; 906 int error = 0; 907 struct l2tp_session *session; 908 struct l2tp_tunnel *tunnel; 909 struct sock *sk = sock->sk; 910 struct inet_sock *inet; 911 struct pppol2tp_session *pls; 912 913 error = -ENOTCONN; 914 if (sk == NULL) 915 goto end; 916 if (!(sk->sk_state & PPPOX_CONNECTED)) 917 goto end; 918 919 error = -EBADF; 920 session = pppol2tp_sock_to_session(sk); 921 if (session == NULL) 922 goto end; 923 924 pls = l2tp_session_priv(session); 925 tunnel = session->tunnel; 926 927 inet = inet_sk(tunnel->sock); 928 if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) { 929 struct sockaddr_pppol2tp sp; 930 931 len = sizeof(sp); 932 memset(&sp, 0, len); 933 sp.sa_family = AF_PPPOX; 934 sp.sa_protocol = PX_PROTO_OL2TP; 935 sp.pppol2tp.fd = tunnel->fd; 936 sp.pppol2tp.pid = pls->owner; 937 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 938 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 939 sp.pppol2tp.s_session = session->session_id; 940 sp.pppol2tp.d_session = session->peer_session_id; 941 sp.pppol2tp.addr.sin_family = AF_INET; 942 sp.pppol2tp.addr.sin_port = inet->inet_dport; 943 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 944 memcpy(uaddr, &sp, len); 945 #if IS_ENABLED(CONFIG_IPV6) 946 } else if ((tunnel->version == 2) && 947 (tunnel->sock->sk_family == AF_INET6)) { 948 struct sockaddr_pppol2tpin6 sp; 949 950 len = sizeof(sp); 951 memset(&sp, 0, len); 952 sp.sa_family = AF_PPPOX; 953 sp.sa_protocol = PX_PROTO_OL2TP; 954 sp.pppol2tp.fd = tunnel->fd; 955 sp.pppol2tp.pid = pls->owner; 956 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 957 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 958 sp.pppol2tp.s_session = session->session_id; 959 sp.pppol2tp.d_session = session->peer_session_id; 960 sp.pppol2tp.addr.sin6_family = AF_INET6; 961 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 962 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 963 sizeof(tunnel->sock->sk_v6_daddr)); 964 memcpy(uaddr, &sp, len); 965 } else if ((tunnel->version == 3) && 966 (tunnel->sock->sk_family == AF_INET6)) { 967 struct sockaddr_pppol2tpv3in6 sp; 968 969 len = sizeof(sp); 970 memset(&sp, 0, len); 971 sp.sa_family = AF_PPPOX; 972 sp.sa_protocol = PX_PROTO_OL2TP; 973 sp.pppol2tp.fd = tunnel->fd; 974 sp.pppol2tp.pid = pls->owner; 975 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 976 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 977 sp.pppol2tp.s_session = session->session_id; 978 sp.pppol2tp.d_session = session->peer_session_id; 979 sp.pppol2tp.addr.sin6_family = AF_INET6; 980 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 981 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 982 sizeof(tunnel->sock->sk_v6_daddr)); 983 memcpy(uaddr, &sp, len); 984 #endif 985 } else if (tunnel->version == 3) { 986 struct sockaddr_pppol2tpv3 sp; 987 988 len = sizeof(sp); 989 memset(&sp, 0, len); 990 sp.sa_family = AF_PPPOX; 991 sp.sa_protocol = PX_PROTO_OL2TP; 992 sp.pppol2tp.fd = tunnel->fd; 993 sp.pppol2tp.pid = pls->owner; 994 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 995 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 996 sp.pppol2tp.s_session = session->session_id; 997 sp.pppol2tp.d_session = session->peer_session_id; 998 sp.pppol2tp.addr.sin_family = AF_INET; 999 sp.pppol2tp.addr.sin_port = inet->inet_dport; 1000 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 1001 memcpy(uaddr, &sp, len); 1002 } 1003 1004 error = len; 1005 1006 sock_put(sk); 1007 end: 1008 return error; 1009 } 1010 1011 /**************************************************************************** 1012 * ioctl() handlers. 1013 * 1014 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1015 * sockets. However, in order to control kernel tunnel features, we allow 1016 * userspace to create a special "tunnel" PPPoX socket which is used for 1017 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow 1018 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl() 1019 * calls. 1020 ****************************************************************************/ 1021 1022 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest, 1023 const struct l2tp_stats *stats) 1024 { 1025 memset(dest, 0, sizeof(*dest)); 1026 1027 dest->tx_packets = atomic_long_read(&stats->tx_packets); 1028 dest->tx_bytes = atomic_long_read(&stats->tx_bytes); 1029 dest->tx_errors = atomic_long_read(&stats->tx_errors); 1030 dest->rx_packets = atomic_long_read(&stats->rx_packets); 1031 dest->rx_bytes = atomic_long_read(&stats->rx_bytes); 1032 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards); 1033 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets); 1034 dest->rx_errors = atomic_long_read(&stats->rx_errors); 1035 } 1036 1037 static int pppol2tp_tunnel_copy_stats(struct pppol2tp_ioc_stats *stats, 1038 struct l2tp_tunnel *tunnel) 1039 { 1040 struct l2tp_session *session; 1041 1042 if (!stats->session_id) { 1043 pppol2tp_copy_stats(stats, &tunnel->stats); 1044 return 0; 1045 } 1046 1047 /* If session_id is set, search the corresponding session in the 1048 * context of this tunnel and record the session's statistics. 1049 */ 1050 session = l2tp_tunnel_get_session(tunnel, stats->session_id); 1051 if (!session) 1052 return -EBADR; 1053 1054 if (session->pwtype != L2TP_PWTYPE_PPP) { 1055 l2tp_session_dec_refcount(session); 1056 return -EBADR; 1057 } 1058 1059 pppol2tp_copy_stats(stats, &session->stats); 1060 l2tp_session_dec_refcount(session); 1061 1062 return 0; 1063 } 1064 1065 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, 1066 unsigned long arg) 1067 { 1068 struct pppol2tp_ioc_stats stats; 1069 struct l2tp_session *session; 1070 1071 switch (cmd) { 1072 case PPPIOCGMRU: 1073 case PPPIOCGFLAGS: 1074 session = sock->sk->sk_user_data; 1075 if (!session) 1076 return -ENOTCONN; 1077 1078 /* Not defined for tunnels */ 1079 if (!session->session_id && !session->peer_session_id) 1080 return -ENOSYS; 1081 1082 if (put_user(0, (int __user *)arg)) 1083 return -EFAULT; 1084 break; 1085 1086 case PPPIOCSMRU: 1087 case PPPIOCSFLAGS: 1088 session = sock->sk->sk_user_data; 1089 if (!session) 1090 return -ENOTCONN; 1091 1092 /* Not defined for tunnels */ 1093 if (!session->session_id && !session->peer_session_id) 1094 return -ENOSYS; 1095 1096 if (!access_ok((int __user *)arg, sizeof(int))) 1097 return -EFAULT; 1098 break; 1099 1100 case PPPIOCGL2TPSTATS: 1101 session = sock->sk->sk_user_data; 1102 if (!session) 1103 return -ENOTCONN; 1104 1105 /* Session 0 represents the parent tunnel */ 1106 if (!session->session_id && !session->peer_session_id) { 1107 u32 session_id; 1108 int err; 1109 1110 if (copy_from_user(&stats, (void __user *)arg, 1111 sizeof(stats))) 1112 return -EFAULT; 1113 1114 session_id = stats.session_id; 1115 err = pppol2tp_tunnel_copy_stats(&stats, 1116 session->tunnel); 1117 if (err < 0) 1118 return err; 1119 1120 stats.session_id = session_id; 1121 } else { 1122 pppol2tp_copy_stats(&stats, &session->stats); 1123 stats.session_id = session->session_id; 1124 } 1125 stats.tunnel_id = session->tunnel->tunnel_id; 1126 stats.using_ipsec = l2tp_tunnel_uses_xfrm(session->tunnel); 1127 1128 if (copy_to_user((void __user *)arg, &stats, sizeof(stats))) 1129 return -EFAULT; 1130 break; 1131 1132 default: 1133 return -ENOIOCTLCMD; 1134 } 1135 1136 return 0; 1137 } 1138 1139 /***************************************************************************** 1140 * setsockopt() / getsockopt() support. 1141 * 1142 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1143 * sockets. In order to control kernel tunnel features, we allow userspace to 1144 * create a special "tunnel" PPPoX socket which is used for control only. 1145 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user 1146 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls. 1147 *****************************************************************************/ 1148 1149 /* Tunnel setsockopt() helper. 1150 */ 1151 static int pppol2tp_tunnel_setsockopt(struct sock *sk, 1152 struct l2tp_tunnel *tunnel, 1153 int optname, int val) 1154 { 1155 int err = 0; 1156 1157 switch (optname) { 1158 case PPPOL2TP_SO_DEBUG: 1159 tunnel->debug = val; 1160 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1161 tunnel->name, tunnel->debug); 1162 break; 1163 1164 default: 1165 err = -ENOPROTOOPT; 1166 break; 1167 } 1168 1169 return err; 1170 } 1171 1172 /* Session setsockopt helper. 1173 */ 1174 static int pppol2tp_session_setsockopt(struct sock *sk, 1175 struct l2tp_session *session, 1176 int optname, int val) 1177 { 1178 int err = 0; 1179 1180 switch (optname) { 1181 case PPPOL2TP_SO_RECVSEQ: 1182 if ((val != 0) && (val != 1)) { 1183 err = -EINVAL; 1184 break; 1185 } 1186 session->recv_seq = !!val; 1187 l2tp_info(session, L2TP_MSG_CONTROL, 1188 "%s: set recv_seq=%d\n", 1189 session->name, session->recv_seq); 1190 break; 1191 1192 case PPPOL2TP_SO_SENDSEQ: 1193 if ((val != 0) && (val != 1)) { 1194 err = -EINVAL; 1195 break; 1196 } 1197 session->send_seq = !!val; 1198 { 1199 struct pppox_sock *po = pppox_sk(sk); 1200 1201 po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ : 1202 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 1203 } 1204 l2tp_session_set_header_len(session, session->tunnel->version); 1205 l2tp_info(session, L2TP_MSG_CONTROL, 1206 "%s: set send_seq=%d\n", 1207 session->name, session->send_seq); 1208 break; 1209 1210 case PPPOL2TP_SO_LNSMODE: 1211 if ((val != 0) && (val != 1)) { 1212 err = -EINVAL; 1213 break; 1214 } 1215 session->lns_mode = !!val; 1216 l2tp_info(session, L2TP_MSG_CONTROL, 1217 "%s: set lns_mode=%d\n", 1218 session->name, session->lns_mode); 1219 break; 1220 1221 case PPPOL2TP_SO_DEBUG: 1222 session->debug = val; 1223 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1224 session->name, session->debug); 1225 break; 1226 1227 case PPPOL2TP_SO_REORDERTO: 1228 session->reorder_timeout = msecs_to_jiffies(val); 1229 l2tp_info(session, L2TP_MSG_CONTROL, 1230 "%s: set reorder_timeout=%d\n", 1231 session->name, session->reorder_timeout); 1232 break; 1233 1234 default: 1235 err = -ENOPROTOOPT; 1236 break; 1237 } 1238 1239 return err; 1240 } 1241 1242 /* Main setsockopt() entry point. 1243 * Does API checks, then calls either the tunnel or session setsockopt 1244 * handler, according to whether the PPPoL2TP socket is a for a regular 1245 * session or the special tunnel type. 1246 */ 1247 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, 1248 char __user *optval, unsigned int optlen) 1249 { 1250 struct sock *sk = sock->sk; 1251 struct l2tp_session *session; 1252 struct l2tp_tunnel *tunnel; 1253 int val; 1254 int err; 1255 1256 if (level != SOL_PPPOL2TP) 1257 return -EINVAL; 1258 1259 if (optlen < sizeof(int)) 1260 return -EINVAL; 1261 1262 if (get_user(val, (int __user *)optval)) 1263 return -EFAULT; 1264 1265 err = -ENOTCONN; 1266 if (sk->sk_user_data == NULL) 1267 goto end; 1268 1269 /* Get session context from the socket */ 1270 err = -EBADF; 1271 session = pppol2tp_sock_to_session(sk); 1272 if (session == NULL) 1273 goto end; 1274 1275 /* Special case: if session_id == 0x0000, treat as operation on tunnel 1276 */ 1277 if ((session->session_id == 0) && 1278 (session->peer_session_id == 0)) { 1279 tunnel = session->tunnel; 1280 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val); 1281 } else { 1282 err = pppol2tp_session_setsockopt(sk, session, optname, val); 1283 } 1284 1285 sock_put(sk); 1286 end: 1287 return err; 1288 } 1289 1290 /* Tunnel getsockopt helper. Called with sock locked. 1291 */ 1292 static int pppol2tp_tunnel_getsockopt(struct sock *sk, 1293 struct l2tp_tunnel *tunnel, 1294 int optname, int *val) 1295 { 1296 int err = 0; 1297 1298 switch (optname) { 1299 case PPPOL2TP_SO_DEBUG: 1300 *val = tunnel->debug; 1301 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get debug=%x\n", 1302 tunnel->name, tunnel->debug); 1303 break; 1304 1305 default: 1306 err = -ENOPROTOOPT; 1307 break; 1308 } 1309 1310 return err; 1311 } 1312 1313 /* Session getsockopt helper. Called with sock locked. 1314 */ 1315 static int pppol2tp_session_getsockopt(struct sock *sk, 1316 struct l2tp_session *session, 1317 int optname, int *val) 1318 { 1319 int err = 0; 1320 1321 switch (optname) { 1322 case PPPOL2TP_SO_RECVSEQ: 1323 *val = session->recv_seq; 1324 l2tp_info(session, L2TP_MSG_CONTROL, 1325 "%s: get recv_seq=%d\n", session->name, *val); 1326 break; 1327 1328 case PPPOL2TP_SO_SENDSEQ: 1329 *val = session->send_seq; 1330 l2tp_info(session, L2TP_MSG_CONTROL, 1331 "%s: get send_seq=%d\n", session->name, *val); 1332 break; 1333 1334 case PPPOL2TP_SO_LNSMODE: 1335 *val = session->lns_mode; 1336 l2tp_info(session, L2TP_MSG_CONTROL, 1337 "%s: get lns_mode=%d\n", session->name, *val); 1338 break; 1339 1340 case PPPOL2TP_SO_DEBUG: 1341 *val = session->debug; 1342 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get debug=%d\n", 1343 session->name, *val); 1344 break; 1345 1346 case PPPOL2TP_SO_REORDERTO: 1347 *val = (int)jiffies_to_msecs(session->reorder_timeout); 1348 l2tp_info(session, L2TP_MSG_CONTROL, 1349 "%s: get reorder_timeout=%d\n", session->name, *val); 1350 break; 1351 1352 default: 1353 err = -ENOPROTOOPT; 1354 } 1355 1356 return err; 1357 } 1358 1359 /* Main getsockopt() entry point. 1360 * Does API checks, then calls either the tunnel or session getsockopt 1361 * handler, according to whether the PPPoX socket is a for a regular session 1362 * or the special tunnel type. 1363 */ 1364 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, 1365 char __user *optval, int __user *optlen) 1366 { 1367 struct sock *sk = sock->sk; 1368 struct l2tp_session *session; 1369 struct l2tp_tunnel *tunnel; 1370 int val, len; 1371 int err; 1372 1373 if (level != SOL_PPPOL2TP) 1374 return -EINVAL; 1375 1376 if (get_user(len, optlen)) 1377 return -EFAULT; 1378 1379 len = min_t(unsigned int, len, sizeof(int)); 1380 1381 if (len < 0) 1382 return -EINVAL; 1383 1384 err = -ENOTCONN; 1385 if (sk->sk_user_data == NULL) 1386 goto end; 1387 1388 /* Get the session context */ 1389 err = -EBADF; 1390 session = pppol2tp_sock_to_session(sk); 1391 if (session == NULL) 1392 goto end; 1393 1394 /* Special case: if session_id == 0x0000, treat as operation on tunnel */ 1395 if ((session->session_id == 0) && 1396 (session->peer_session_id == 0)) { 1397 tunnel = session->tunnel; 1398 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val); 1399 if (err) 1400 goto end_put_sess; 1401 } else { 1402 err = pppol2tp_session_getsockopt(sk, session, optname, &val); 1403 if (err) 1404 goto end_put_sess; 1405 } 1406 1407 err = -EFAULT; 1408 if (put_user(len, optlen)) 1409 goto end_put_sess; 1410 1411 if (copy_to_user((void __user *)optval, &val, len)) 1412 goto end_put_sess; 1413 1414 err = 0; 1415 1416 end_put_sess: 1417 sock_put(sk); 1418 end: 1419 return err; 1420 } 1421 1422 /***************************************************************************** 1423 * /proc filesystem for debug 1424 * Since the original pppol2tp driver provided /proc/net/pppol2tp for 1425 * L2TPv2, we dump only L2TPv2 tunnels and sessions here. 1426 *****************************************************************************/ 1427 1428 static unsigned int pppol2tp_net_id; 1429 1430 #ifdef CONFIG_PROC_FS 1431 1432 struct pppol2tp_seq_data { 1433 struct seq_net_private p; 1434 int tunnel_idx; /* current tunnel */ 1435 int session_idx; /* index of session within current tunnel */ 1436 struct l2tp_tunnel *tunnel; 1437 struct l2tp_session *session; /* NULL means get next tunnel */ 1438 }; 1439 1440 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) 1441 { 1442 /* Drop reference taken during previous invocation */ 1443 if (pd->tunnel) 1444 l2tp_tunnel_dec_refcount(pd->tunnel); 1445 1446 for (;;) { 1447 pd->tunnel = l2tp_tunnel_get_nth(net, pd->tunnel_idx); 1448 pd->tunnel_idx++; 1449 1450 /* Only accept L2TPv2 tunnels */ 1451 if (!pd->tunnel || pd->tunnel->version == 2) 1452 return; 1453 1454 l2tp_tunnel_dec_refcount(pd->tunnel); 1455 } 1456 } 1457 1458 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) 1459 { 1460 /* Drop reference taken during previous invocation */ 1461 if (pd->session) 1462 l2tp_session_dec_refcount(pd->session); 1463 1464 pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx); 1465 pd->session_idx++; 1466 1467 if (pd->session == NULL) { 1468 pd->session_idx = 0; 1469 pppol2tp_next_tunnel(net, pd); 1470 } 1471 } 1472 1473 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs) 1474 { 1475 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN; 1476 loff_t pos = *offs; 1477 struct net *net; 1478 1479 if (!pos) 1480 goto out; 1481 1482 BUG_ON(m->private == NULL); 1483 pd = m->private; 1484 net = seq_file_net(m); 1485 1486 if (pd->tunnel == NULL) 1487 pppol2tp_next_tunnel(net, pd); 1488 else 1489 pppol2tp_next_session(net, pd); 1490 1491 /* NULL tunnel and session indicates end of list */ 1492 if ((pd->tunnel == NULL) && (pd->session == NULL)) 1493 pd = NULL; 1494 1495 out: 1496 return pd; 1497 } 1498 1499 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos) 1500 { 1501 (*pos)++; 1502 return NULL; 1503 } 1504 1505 static void pppol2tp_seq_stop(struct seq_file *p, void *v) 1506 { 1507 struct pppol2tp_seq_data *pd = v; 1508 1509 if (!pd || pd == SEQ_START_TOKEN) 1510 return; 1511 1512 /* Drop reference taken by last invocation of pppol2tp_next_session() 1513 * or pppol2tp_next_tunnel(). 1514 */ 1515 if (pd->session) { 1516 l2tp_session_dec_refcount(pd->session); 1517 pd->session = NULL; 1518 } 1519 if (pd->tunnel) { 1520 l2tp_tunnel_dec_refcount(pd->tunnel); 1521 pd->tunnel = NULL; 1522 } 1523 } 1524 1525 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) 1526 { 1527 struct l2tp_tunnel *tunnel = v; 1528 1529 seq_printf(m, "\nTUNNEL '%s', %c %d\n", 1530 tunnel->name, 1531 (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N', 1532 refcount_read(&tunnel->ref_count) - 1); 1533 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n", 1534 tunnel->debug, 1535 atomic_long_read(&tunnel->stats.tx_packets), 1536 atomic_long_read(&tunnel->stats.tx_bytes), 1537 atomic_long_read(&tunnel->stats.tx_errors), 1538 atomic_long_read(&tunnel->stats.rx_packets), 1539 atomic_long_read(&tunnel->stats.rx_bytes), 1540 atomic_long_read(&tunnel->stats.rx_errors)); 1541 } 1542 1543 static void pppol2tp_seq_session_show(struct seq_file *m, void *v) 1544 { 1545 struct l2tp_session *session = v; 1546 struct l2tp_tunnel *tunnel = session->tunnel; 1547 unsigned char state; 1548 char user_data_ok; 1549 struct sock *sk; 1550 u32 ip = 0; 1551 u16 port = 0; 1552 1553 if (tunnel->sock) { 1554 struct inet_sock *inet = inet_sk(tunnel->sock); 1555 1556 ip = ntohl(inet->inet_saddr); 1557 port = ntohs(inet->inet_sport); 1558 } 1559 1560 sk = pppol2tp_session_get_sock(session); 1561 if (sk) { 1562 state = sk->sk_state; 1563 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N'; 1564 } else { 1565 state = 0; 1566 user_data_ok = 'N'; 1567 } 1568 1569 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> %04X/%04X %d %c\n", 1570 session->name, ip, port, 1571 tunnel->tunnel_id, 1572 session->session_id, 1573 tunnel->peer_tunnel_id, 1574 session->peer_session_id, 1575 state, user_data_ok); 1576 seq_printf(m, " 0/0/%c/%c/%s %08x %u\n", 1577 session->recv_seq ? 'R' : '-', 1578 session->send_seq ? 'S' : '-', 1579 session->lns_mode ? "LNS" : "LAC", 1580 session->debug, 1581 jiffies_to_msecs(session->reorder_timeout)); 1582 seq_printf(m, " %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n", 1583 session->nr, session->ns, 1584 atomic_long_read(&session->stats.tx_packets), 1585 atomic_long_read(&session->stats.tx_bytes), 1586 atomic_long_read(&session->stats.tx_errors), 1587 atomic_long_read(&session->stats.rx_packets), 1588 atomic_long_read(&session->stats.rx_bytes), 1589 atomic_long_read(&session->stats.rx_errors)); 1590 1591 if (sk) { 1592 struct pppox_sock *po = pppox_sk(sk); 1593 1594 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 1595 sock_put(sk); 1596 } 1597 } 1598 1599 static int pppol2tp_seq_show(struct seq_file *m, void *v) 1600 { 1601 struct pppol2tp_seq_data *pd = v; 1602 1603 /* display header on line 1 */ 1604 if (v == SEQ_START_TOKEN) { 1605 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n"); 1606 seq_puts(m, "TUNNEL name, user-data-ok session-count\n"); 1607 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1608 seq_puts(m, " SESSION name, addr/port src-tid/sid dest-tid/sid state user-data-ok\n"); 1609 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n"); 1610 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1611 goto out; 1612 } 1613 1614 if (!pd->session) 1615 pppol2tp_seq_tunnel_show(m, pd->tunnel); 1616 else 1617 pppol2tp_seq_session_show(m, pd->session); 1618 1619 out: 1620 return 0; 1621 } 1622 1623 static const struct seq_operations pppol2tp_seq_ops = { 1624 .start = pppol2tp_seq_start, 1625 .next = pppol2tp_seq_next, 1626 .stop = pppol2tp_seq_stop, 1627 .show = pppol2tp_seq_show, 1628 }; 1629 #endif /* CONFIG_PROC_FS */ 1630 1631 /***************************************************************************** 1632 * Network namespace 1633 *****************************************************************************/ 1634 1635 static __net_init int pppol2tp_init_net(struct net *net) 1636 { 1637 struct proc_dir_entry *pde; 1638 int err = 0; 1639 1640 pde = proc_create_net("pppol2tp", 0444, net->proc_net, 1641 &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data)); 1642 if (!pde) { 1643 err = -ENOMEM; 1644 goto out; 1645 } 1646 1647 out: 1648 return err; 1649 } 1650 1651 static __net_exit void pppol2tp_exit_net(struct net *net) 1652 { 1653 remove_proc_entry("pppol2tp", net->proc_net); 1654 } 1655 1656 static struct pernet_operations pppol2tp_net_ops = { 1657 .init = pppol2tp_init_net, 1658 .exit = pppol2tp_exit_net, 1659 .id = &pppol2tp_net_id, 1660 }; 1661 1662 /***************************************************************************** 1663 * Init and cleanup 1664 *****************************************************************************/ 1665 1666 static const struct proto_ops pppol2tp_ops = { 1667 .family = AF_PPPOX, 1668 .owner = THIS_MODULE, 1669 .release = pppol2tp_release, 1670 .bind = sock_no_bind, 1671 .connect = pppol2tp_connect, 1672 .socketpair = sock_no_socketpair, 1673 .accept = sock_no_accept, 1674 .getname = pppol2tp_getname, 1675 .poll = datagram_poll, 1676 .listen = sock_no_listen, 1677 .shutdown = sock_no_shutdown, 1678 .setsockopt = pppol2tp_setsockopt, 1679 .getsockopt = pppol2tp_getsockopt, 1680 .sendmsg = pppol2tp_sendmsg, 1681 .recvmsg = pppol2tp_recvmsg, 1682 .mmap = sock_no_mmap, 1683 .ioctl = pppox_ioctl, 1684 #ifdef CONFIG_COMPAT 1685 .compat_ioctl = pppox_compat_ioctl, 1686 #endif 1687 }; 1688 1689 static const struct pppox_proto pppol2tp_proto = { 1690 .create = pppol2tp_create, 1691 .ioctl = pppol2tp_ioctl, 1692 .owner = THIS_MODULE, 1693 }; 1694 1695 #ifdef CONFIG_L2TP_V3 1696 1697 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = { 1698 .session_create = pppol2tp_session_create, 1699 .session_delete = l2tp_session_delete, 1700 }; 1701 1702 #endif /* CONFIG_L2TP_V3 */ 1703 1704 static int __init pppol2tp_init(void) 1705 { 1706 int err; 1707 1708 err = register_pernet_device(&pppol2tp_net_ops); 1709 if (err) 1710 goto out; 1711 1712 err = proto_register(&pppol2tp_sk_proto, 0); 1713 if (err) 1714 goto out_unregister_pppol2tp_pernet; 1715 1716 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto); 1717 if (err) 1718 goto out_unregister_pppol2tp_proto; 1719 1720 #ifdef CONFIG_L2TP_V3 1721 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops); 1722 if (err) 1723 goto out_unregister_pppox; 1724 #endif 1725 1726 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION); 1727 1728 out: 1729 return err; 1730 1731 #ifdef CONFIG_L2TP_V3 1732 out_unregister_pppox: 1733 unregister_pppox_proto(PX_PROTO_OL2TP); 1734 #endif 1735 out_unregister_pppol2tp_proto: 1736 proto_unregister(&pppol2tp_sk_proto); 1737 out_unregister_pppol2tp_pernet: 1738 unregister_pernet_device(&pppol2tp_net_ops); 1739 goto out; 1740 } 1741 1742 static void __exit pppol2tp_exit(void) 1743 { 1744 #ifdef CONFIG_L2TP_V3 1745 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP); 1746 #endif 1747 unregister_pppox_proto(PX_PROTO_OL2TP); 1748 proto_unregister(&pppol2tp_sk_proto); 1749 unregister_pernet_device(&pppol2tp_net_ops); 1750 } 1751 1752 module_init(pppol2tp_init); 1753 module_exit(pppol2tp_exit); 1754 1755 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1756 MODULE_DESCRIPTION("PPP over L2TP over UDP"); 1757 MODULE_LICENSE("GPL"); 1758 MODULE_VERSION(PPPOL2TP_DRV_VERSION); 1759 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP); 1760 MODULE_ALIAS_L2TP_PWTYPE(7); 1761