1 /***************************************************************************** 2 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets 3 * 4 * PPPoX --- Generic PPP encapsulation socket family 5 * PPPoL2TP --- PPP over L2TP (RFC 2661) 6 * 7 * Version: 2.0.0 8 * 9 * Authors: James Chapman (jchapman@katalix.com) 10 * 11 * Based on original work by Martijn van Oosterhout <kleptog@svana.org> 12 * 13 * License: 14 * This program is free software; you can redistribute it and/or 15 * modify it under the terms of the GNU General Public License 16 * as published by the Free Software Foundation; either version 17 * 2 of the License, or (at your option) any later version. 18 * 19 */ 20 21 /* This driver handles only L2TP data frames; control frames are handled by a 22 * userspace application. 23 * 24 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and 25 * attaches it to a bound UDP socket with local tunnel_id / session_id and 26 * peer tunnel_id / session_id set. Data can then be sent or received using 27 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket 28 * can be read or modified using ioctl() or [gs]etsockopt() calls. 29 * 30 * When a PPPoL2TP socket is connected with local and peer session_id values 31 * zero, the socket is treated as a special tunnel management socket. 32 * 33 * Here's example userspace code to create a socket for sending/receiving data 34 * over an L2TP session:- 35 * 36 * struct sockaddr_pppol2tp sax; 37 * int fd; 38 * int session_fd; 39 * 40 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); 41 * 42 * sax.sa_family = AF_PPPOX; 43 * sax.sa_protocol = PX_PROTO_OL2TP; 44 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket 45 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr; 46 * sax.pppol2tp.addr.sin_port = addr->sin_port; 47 * sax.pppol2tp.addr.sin_family = AF_INET; 48 * sax.pppol2tp.s_tunnel = tunnel_id; 49 * sax.pppol2tp.s_session = session_id; 50 * sax.pppol2tp.d_tunnel = peer_tunnel_id; 51 * sax.pppol2tp.d_session = peer_session_id; 52 * 53 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax)); 54 * 55 * A pppd plugin that allows PPP traffic to be carried over L2TP using 56 * this driver is available from the OpenL2TP project at 57 * http://openl2tp.sourceforge.net. 58 */ 59 60 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 61 62 #include <linux/module.h> 63 #include <linux/string.h> 64 #include <linux/list.h> 65 #include <linux/uaccess.h> 66 67 #include <linux/kernel.h> 68 #include <linux/spinlock.h> 69 #include <linux/kthread.h> 70 #include <linux/sched.h> 71 #include <linux/slab.h> 72 #include <linux/errno.h> 73 #include <linux/jiffies.h> 74 75 #include <linux/netdevice.h> 76 #include <linux/net.h> 77 #include <linux/inetdevice.h> 78 #include <linux/skbuff.h> 79 #include <linux/init.h> 80 #include <linux/ip.h> 81 #include <linux/udp.h> 82 #include <linux/if_pppox.h> 83 #include <linux/if_pppol2tp.h> 84 #include <net/sock.h> 85 #include <linux/ppp_channel.h> 86 #include <linux/ppp_defs.h> 87 #include <linux/ppp-ioctl.h> 88 #include <linux/file.h> 89 #include <linux/hash.h> 90 #include <linux/sort.h> 91 #include <linux/proc_fs.h> 92 #include <linux/l2tp.h> 93 #include <linux/nsproxy.h> 94 #include <net/net_namespace.h> 95 #include <net/netns/generic.h> 96 #include <net/dst.h> 97 #include <net/ip.h> 98 #include <net/udp.h> 99 #include <net/xfrm.h> 100 #include <net/inet_common.h> 101 102 #include <asm/byteorder.h> 103 #include <linux/atomic.h> 104 105 #include "l2tp_core.h" 106 107 #define PPPOL2TP_DRV_VERSION "V2.0" 108 109 /* Space for UDP, L2TP and PPP headers */ 110 #define PPPOL2TP_HEADER_OVERHEAD 40 111 112 /* Number of bytes to build transmit L2TP headers. 113 * Unfortunately the size is different depending on whether sequence numbers 114 * are enabled. 115 */ 116 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10 117 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6 118 119 /* Private data of each session. This data lives at the end of struct 120 * l2tp_session, referenced via session->priv[]. 121 */ 122 struct pppol2tp_session { 123 int owner; /* pid that opened the socket */ 124 125 struct sock *sock; /* Pointer to the session 126 * PPPoX socket */ 127 struct sock *tunnel_sock; /* Pointer to the tunnel UDP 128 * socket */ 129 int flags; /* accessed by PPPIOCGFLAGS. 130 * Unused. */ 131 }; 132 133 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb); 134 135 static const struct ppp_channel_ops pppol2tp_chan_ops = { 136 .start_xmit = pppol2tp_xmit, 137 }; 138 139 static const struct proto_ops pppol2tp_ops; 140 141 /* Helpers to obtain tunnel/session contexts from sockets. 142 */ 143 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) 144 { 145 struct l2tp_session *session; 146 147 if (sk == NULL) 148 return NULL; 149 150 sock_hold(sk); 151 session = (struct l2tp_session *)(sk->sk_user_data); 152 if (session == NULL) { 153 sock_put(sk); 154 goto out; 155 } 156 157 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 158 159 out: 160 return session; 161 } 162 163 /***************************************************************************** 164 * Receive data handling 165 *****************************************************************************/ 166 167 static int pppol2tp_recv_payload_hook(struct sk_buff *skb) 168 { 169 /* Skip PPP header, if present. In testing, Microsoft L2TP clients 170 * don't send the PPP header (PPP header compression enabled), but 171 * other clients can include the header. So we cope with both cases 172 * here. The PPP header is always FF03 when using L2TP. 173 * 174 * Note that skb->data[] isn't dereferenced from a u16 ptr here since 175 * the field may be unaligned. 176 */ 177 if (!pskb_may_pull(skb, 2)) 178 return 1; 179 180 if ((skb->data[0] == PPP_ALLSTATIONS) && (skb->data[1] == PPP_UI)) 181 skb_pull(skb, 2); 182 183 return 0; 184 } 185 186 /* Receive message. This is the recvmsg for the PPPoL2TP socket. 187 */ 188 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, 189 size_t len, int flags) 190 { 191 int err; 192 struct sk_buff *skb; 193 struct sock *sk = sock->sk; 194 195 err = -EIO; 196 if (sk->sk_state & PPPOX_BOUND) 197 goto end; 198 199 err = 0; 200 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 201 flags & MSG_DONTWAIT, &err); 202 if (!skb) 203 goto end; 204 205 if (len > skb->len) 206 len = skb->len; 207 else if (len < skb->len) 208 msg->msg_flags |= MSG_TRUNC; 209 210 err = skb_copy_datagram_msg(skb, 0, msg, len); 211 if (likely(err == 0)) 212 err = len; 213 214 kfree_skb(skb); 215 end: 216 return err; 217 } 218 219 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) 220 { 221 struct pppol2tp_session *ps = l2tp_session_priv(session); 222 struct sock *sk = NULL; 223 224 /* If the socket is bound, send it in to PPP's input queue. Otherwise 225 * queue it on the session socket. 226 */ 227 sk = ps->sock; 228 if (sk == NULL) 229 goto no_sock; 230 231 if (sk->sk_state & PPPOX_BOUND) { 232 struct pppox_sock *po; 233 234 l2tp_dbg(session, L2TP_MSG_DATA, 235 "%s: recv %d byte data frame, passing to ppp\n", 236 session->name, data_len); 237 238 po = pppox_sk(sk); 239 ppp_input(&po->chan, skb); 240 } else { 241 l2tp_dbg(session, L2TP_MSG_DATA, 242 "%s: recv %d byte data frame, passing to L2TP socket\n", 243 session->name, data_len); 244 245 if (sock_queue_rcv_skb(sk, skb) < 0) { 246 atomic_long_inc(&session->stats.rx_errors); 247 kfree_skb(skb); 248 } 249 } 250 251 return; 252 253 no_sock: 254 l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name); 255 kfree_skb(skb); 256 } 257 258 static void pppol2tp_session_sock_hold(struct l2tp_session *session) 259 { 260 struct pppol2tp_session *ps = l2tp_session_priv(session); 261 262 if (ps->sock) 263 sock_hold(ps->sock); 264 } 265 266 static void pppol2tp_session_sock_put(struct l2tp_session *session) 267 { 268 struct pppol2tp_session *ps = l2tp_session_priv(session); 269 270 if (ps->sock) 271 sock_put(ps->sock); 272 } 273 274 /************************************************************************ 275 * Transmit handling 276 ***********************************************************************/ 277 278 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here 279 * when a user application does a sendmsg() on the session socket. L2TP and 280 * PPP headers must be inserted into the user's data. 281 */ 282 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m, 283 size_t total_len) 284 { 285 struct sock *sk = sock->sk; 286 struct sk_buff *skb; 287 int error; 288 struct l2tp_session *session; 289 struct l2tp_tunnel *tunnel; 290 struct pppol2tp_session *ps; 291 int uhlen; 292 293 error = -ENOTCONN; 294 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 295 goto error; 296 297 /* Get session and tunnel contexts */ 298 error = -EBADF; 299 session = pppol2tp_sock_to_session(sk); 300 if (session == NULL) 301 goto error; 302 303 ps = l2tp_session_priv(session); 304 tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock); 305 if (tunnel == NULL) 306 goto error_put_sess; 307 308 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 309 310 /* Allocate a socket buffer */ 311 error = -ENOMEM; 312 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 313 uhlen + session->hdr_len + 314 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 315 0, GFP_KERNEL); 316 if (!skb) 317 goto error_put_sess_tun; 318 319 /* Reserve space for headers. */ 320 skb_reserve(skb, NET_SKB_PAD); 321 skb_reset_network_header(skb); 322 skb_reserve(skb, sizeof(struct iphdr)); 323 skb_reset_transport_header(skb); 324 skb_reserve(skb, uhlen); 325 326 /* Add PPP header */ 327 skb->data[0] = PPP_ALLSTATIONS; 328 skb->data[1] = PPP_UI; 329 skb_put(skb, 2); 330 331 /* Copy user data into skb */ 332 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len); 333 if (error < 0) { 334 kfree_skb(skb); 335 goto error_put_sess_tun; 336 } 337 338 local_bh_disable(); 339 l2tp_xmit_skb(session, skb, session->hdr_len); 340 local_bh_enable(); 341 342 sock_put(ps->tunnel_sock); 343 sock_put(sk); 344 345 return total_len; 346 347 error_put_sess_tun: 348 sock_put(ps->tunnel_sock); 349 error_put_sess: 350 sock_put(sk); 351 error: 352 return error; 353 } 354 355 /* Transmit function called by generic PPP driver. Sends PPP frame 356 * over PPPoL2TP socket. 357 * 358 * This is almost the same as pppol2tp_sendmsg(), but rather than 359 * being called with a msghdr from userspace, it is called with a skb 360 * from the kernel. 361 * 362 * The supplied skb from ppp doesn't have enough headroom for the 363 * insertion of L2TP, UDP and IP headers so we need to allocate more 364 * headroom in the skb. This will create a cloned skb. But we must be 365 * careful in the error case because the caller will expect to free 366 * the skb it supplied, not our cloned skb. So we take care to always 367 * leave the original skb unfreed if we return an error. 368 */ 369 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) 370 { 371 struct sock *sk = (struct sock *) chan->private; 372 struct sock *sk_tun; 373 struct l2tp_session *session; 374 struct l2tp_tunnel *tunnel; 375 struct pppol2tp_session *ps; 376 int uhlen, headroom; 377 378 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 379 goto abort; 380 381 /* Get session and tunnel contexts from the socket */ 382 session = pppol2tp_sock_to_session(sk); 383 if (session == NULL) 384 goto abort; 385 386 ps = l2tp_session_priv(session); 387 sk_tun = ps->tunnel_sock; 388 if (sk_tun == NULL) 389 goto abort_put_sess; 390 tunnel = l2tp_sock_to_tunnel(sk_tun); 391 if (tunnel == NULL) 392 goto abort_put_sess; 393 394 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 395 headroom = NET_SKB_PAD + 396 sizeof(struct iphdr) + /* IP header */ 397 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */ 398 session->hdr_len + /* L2TP header */ 399 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 400 if (skb_cow_head(skb, headroom)) 401 goto abort_put_sess_tun; 402 403 /* Setup PPP header */ 404 __skb_push(skb, 2); 405 skb->data[0] = PPP_ALLSTATIONS; 406 skb->data[1] = PPP_UI; 407 408 local_bh_disable(); 409 l2tp_xmit_skb(session, skb, session->hdr_len); 410 local_bh_enable(); 411 412 sock_put(sk_tun); 413 sock_put(sk); 414 return 1; 415 416 abort_put_sess_tun: 417 sock_put(sk_tun); 418 abort_put_sess: 419 sock_put(sk); 420 abort: 421 /* Free the original skb */ 422 kfree_skb(skb); 423 return 1; 424 } 425 426 /***************************************************************************** 427 * Session (and tunnel control) socket create/destroy. 428 *****************************************************************************/ 429 430 /* Called by l2tp_core when a session socket is being closed. 431 */ 432 static void pppol2tp_session_close(struct l2tp_session *session) 433 { 434 struct pppol2tp_session *ps = l2tp_session_priv(session); 435 struct sock *sk = ps->sock; 436 struct socket *sock = sk->sk_socket; 437 438 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 439 440 if (sock) 441 inet_shutdown(sock, SEND_SHUTDOWN); 442 443 /* Don't let the session go away before our socket does */ 444 l2tp_session_inc_refcount(session); 445 } 446 447 /* Really kill the session socket. (Called from sock_put() if 448 * refcnt == 0.) 449 */ 450 static void pppol2tp_session_destruct(struct sock *sk) 451 { 452 struct l2tp_session *session = sk->sk_user_data; 453 454 skb_queue_purge(&sk->sk_receive_queue); 455 skb_queue_purge(&sk->sk_write_queue); 456 457 if (session) { 458 sk->sk_user_data = NULL; 459 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 460 l2tp_session_dec_refcount(session); 461 } 462 } 463 464 /* Called when the PPPoX socket (session) is closed. 465 */ 466 static int pppol2tp_release(struct socket *sock) 467 { 468 struct sock *sk = sock->sk; 469 struct l2tp_session *session; 470 int error; 471 472 if (!sk) 473 return 0; 474 475 error = -EBADF; 476 lock_sock(sk); 477 if (sock_flag(sk, SOCK_DEAD) != 0) 478 goto error; 479 480 pppox_unbind_sock(sk); 481 482 /* Signal the death of the socket. */ 483 sk->sk_state = PPPOX_DEAD; 484 sock_orphan(sk); 485 sock->sk = NULL; 486 487 session = pppol2tp_sock_to_session(sk); 488 489 /* Purge any queued data */ 490 if (session != NULL) { 491 __l2tp_session_unhash(session); 492 l2tp_session_queue_purge(session); 493 sock_put(sk); 494 } 495 release_sock(sk); 496 497 /* This will delete the session context via 498 * pppol2tp_session_destruct() if the socket's refcnt drops to 499 * zero. 500 */ 501 sock_put(sk); 502 503 return 0; 504 505 error: 506 release_sock(sk); 507 return error; 508 } 509 510 static struct proto pppol2tp_sk_proto = { 511 .name = "PPPOL2TP", 512 .owner = THIS_MODULE, 513 .obj_size = sizeof(struct pppox_sock), 514 }; 515 516 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb) 517 { 518 int rc; 519 520 rc = l2tp_udp_encap_recv(sk, skb); 521 if (rc) 522 kfree_skb(skb); 523 524 return NET_RX_SUCCESS; 525 } 526 527 /* socket() handler. Initialize a new struct sock. 528 */ 529 static int pppol2tp_create(struct net *net, struct socket *sock, int kern) 530 { 531 int error = -ENOMEM; 532 struct sock *sk; 533 534 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern); 535 if (!sk) 536 goto out; 537 538 sock_init_data(sock, sk); 539 540 sock->state = SS_UNCONNECTED; 541 sock->ops = &pppol2tp_ops; 542 543 sk->sk_backlog_rcv = pppol2tp_backlog_recv; 544 sk->sk_protocol = PX_PROTO_OL2TP; 545 sk->sk_family = PF_PPPOX; 546 sk->sk_state = PPPOX_NONE; 547 sk->sk_type = SOCK_STREAM; 548 sk->sk_destruct = pppol2tp_session_destruct; 549 550 error = 0; 551 552 out: 553 return error; 554 } 555 556 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 557 static void pppol2tp_show(struct seq_file *m, void *arg) 558 { 559 struct l2tp_session *session = arg; 560 struct pppol2tp_session *ps = l2tp_session_priv(session); 561 562 if (ps) { 563 struct pppox_sock *po = pppox_sk(ps->sock); 564 if (po) 565 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 566 } 567 } 568 #endif 569 570 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket 571 */ 572 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 573 int sockaddr_len, int flags) 574 { 575 struct sock *sk = sock->sk; 576 struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr; 577 struct pppox_sock *po = pppox_sk(sk); 578 struct l2tp_session *session = NULL; 579 struct l2tp_tunnel *tunnel; 580 struct pppol2tp_session *ps; 581 struct dst_entry *dst; 582 struct l2tp_session_cfg cfg = { 0, }; 583 int error = 0; 584 u32 tunnel_id, peer_tunnel_id; 585 u32 session_id, peer_session_id; 586 bool drop_refcnt = false; 587 int ver = 2; 588 int fd; 589 590 lock_sock(sk); 591 592 error = -EINVAL; 593 if (sp->sa_protocol != PX_PROTO_OL2TP) 594 goto end; 595 596 /* Check for already bound sockets */ 597 error = -EBUSY; 598 if (sk->sk_state & PPPOX_CONNECTED) 599 goto end; 600 601 /* We don't supporting rebinding anyway */ 602 error = -EALREADY; 603 if (sk->sk_user_data) 604 goto end; /* socket is already attached */ 605 606 /* Get params from socket address. Handle L2TPv2 and L2TPv3. 607 * This is nasty because there are different sockaddr_pppol2tp 608 * structs for L2TPv2, L2TPv3, over IPv4 and IPv6. We use 609 * the sockaddr size to determine which structure the caller 610 * is using. 611 */ 612 peer_tunnel_id = 0; 613 if (sockaddr_len == sizeof(struct sockaddr_pppol2tp)) { 614 fd = sp->pppol2tp.fd; 615 tunnel_id = sp->pppol2tp.s_tunnel; 616 peer_tunnel_id = sp->pppol2tp.d_tunnel; 617 session_id = sp->pppol2tp.s_session; 618 peer_session_id = sp->pppol2tp.d_session; 619 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3)) { 620 struct sockaddr_pppol2tpv3 *sp3 = 621 (struct sockaddr_pppol2tpv3 *) sp; 622 ver = 3; 623 fd = sp3->pppol2tp.fd; 624 tunnel_id = sp3->pppol2tp.s_tunnel; 625 peer_tunnel_id = sp3->pppol2tp.d_tunnel; 626 session_id = sp3->pppol2tp.s_session; 627 peer_session_id = sp3->pppol2tp.d_session; 628 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpin6)) { 629 struct sockaddr_pppol2tpin6 *sp6 = 630 (struct sockaddr_pppol2tpin6 *) sp; 631 fd = sp6->pppol2tp.fd; 632 tunnel_id = sp6->pppol2tp.s_tunnel; 633 peer_tunnel_id = sp6->pppol2tp.d_tunnel; 634 session_id = sp6->pppol2tp.s_session; 635 peer_session_id = sp6->pppol2tp.d_session; 636 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3in6)) { 637 struct sockaddr_pppol2tpv3in6 *sp6 = 638 (struct sockaddr_pppol2tpv3in6 *) sp; 639 ver = 3; 640 fd = sp6->pppol2tp.fd; 641 tunnel_id = sp6->pppol2tp.s_tunnel; 642 peer_tunnel_id = sp6->pppol2tp.d_tunnel; 643 session_id = sp6->pppol2tp.s_session; 644 peer_session_id = sp6->pppol2tp.d_session; 645 } else { 646 error = -EINVAL; 647 goto end; /* bad socket address */ 648 } 649 650 /* Don't bind if tunnel_id is 0 */ 651 error = -EINVAL; 652 if (tunnel_id == 0) 653 goto end; 654 655 tunnel = l2tp_tunnel_find(sock_net(sk), tunnel_id); 656 657 /* Special case: create tunnel context if session_id and 658 * peer_session_id is 0. Otherwise look up tunnel using supplied 659 * tunnel id. 660 */ 661 if ((session_id == 0) && (peer_session_id == 0)) { 662 if (tunnel == NULL) { 663 struct l2tp_tunnel_cfg tcfg = { 664 .encap = L2TP_ENCAPTYPE_UDP, 665 .debug = 0, 666 }; 667 error = l2tp_tunnel_create(sock_net(sk), fd, ver, tunnel_id, peer_tunnel_id, &tcfg, &tunnel); 668 if (error < 0) 669 goto end; 670 } 671 } else { 672 /* Error if we can't find the tunnel */ 673 error = -ENOENT; 674 if (tunnel == NULL) 675 goto end; 676 677 /* Error if socket is not prepped */ 678 if (tunnel->sock == NULL) 679 goto end; 680 } 681 682 if (tunnel->recv_payload_hook == NULL) 683 tunnel->recv_payload_hook = pppol2tp_recv_payload_hook; 684 685 if (tunnel->peer_tunnel_id == 0) 686 tunnel->peer_tunnel_id = peer_tunnel_id; 687 688 session = l2tp_session_get(sock_net(sk), tunnel, session_id, false); 689 if (session) { 690 drop_refcnt = true; 691 ps = l2tp_session_priv(session); 692 693 /* Using a pre-existing session is fine as long as it hasn't 694 * been connected yet. 695 */ 696 if (ps->sock) { 697 error = -EEXIST; 698 goto end; 699 } 700 701 /* consistency checks */ 702 if (ps->tunnel_sock != tunnel->sock) { 703 error = -EEXIST; 704 goto end; 705 } 706 } else { 707 /* Default MTU must allow space for UDP/L2TP/PPP headers */ 708 cfg.mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 709 cfg.mru = cfg.mtu; 710 711 session = l2tp_session_create(sizeof(struct pppol2tp_session), 712 tunnel, session_id, 713 peer_session_id, &cfg); 714 if (IS_ERR(session)) { 715 error = PTR_ERR(session); 716 goto end; 717 } 718 } 719 720 /* Associate session with its PPPoL2TP socket */ 721 ps = l2tp_session_priv(session); 722 ps->owner = current->pid; 723 ps->sock = sk; 724 ps->tunnel_sock = tunnel->sock; 725 726 session->recv_skb = pppol2tp_recv; 727 session->session_close = pppol2tp_session_close; 728 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 729 session->show = pppol2tp_show; 730 #endif 731 732 /* We need to know each time a skb is dropped from the reorder 733 * queue. 734 */ 735 session->ref = pppol2tp_session_sock_hold; 736 session->deref = pppol2tp_session_sock_put; 737 738 /* If PMTU discovery was enabled, use the MTU that was discovered */ 739 dst = sk_dst_get(tunnel->sock); 740 if (dst != NULL) { 741 u32 pmtu = dst_mtu(dst); 742 743 if (pmtu != 0) 744 session->mtu = session->mru = pmtu - 745 PPPOL2TP_HEADER_OVERHEAD; 746 dst_release(dst); 747 } 748 749 /* Special case: if source & dest session_id == 0x0000, this 750 * socket is being created to manage the tunnel. Just set up 751 * the internal context for use by ioctl() and sockopt() 752 * handlers. 753 */ 754 if ((session->session_id == 0) && 755 (session->peer_session_id == 0)) { 756 error = 0; 757 goto out_no_ppp; 758 } 759 760 /* The only header we need to worry about is the L2TP 761 * header. This size is different depending on whether 762 * sequence numbers are enabled for the data channel. 763 */ 764 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 765 766 po->chan.private = sk; 767 po->chan.ops = &pppol2tp_chan_ops; 768 po->chan.mtu = session->mtu; 769 770 error = ppp_register_net_channel(sock_net(sk), &po->chan); 771 if (error) 772 goto end; 773 774 out_no_ppp: 775 /* This is how we get the session context from the socket. */ 776 sk->sk_user_data = session; 777 sk->sk_state = PPPOX_CONNECTED; 778 l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n", 779 session->name); 780 781 end: 782 if (drop_refcnt) 783 l2tp_session_dec_refcount(session); 784 release_sock(sk); 785 786 return error; 787 } 788 789 #ifdef CONFIG_L2TP_V3 790 791 /* Called when creating sessions via the netlink interface. */ 792 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, 793 u32 session_id, u32 peer_session_id, 794 struct l2tp_session_cfg *cfg) 795 { 796 int error; 797 struct l2tp_session *session; 798 struct pppol2tp_session *ps; 799 800 /* Error if tunnel socket is not prepped */ 801 if (!tunnel->sock) { 802 error = -ENOENT; 803 goto out; 804 } 805 806 /* Default MTU values. */ 807 if (cfg->mtu == 0) 808 cfg->mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 809 if (cfg->mru == 0) 810 cfg->mru = cfg->mtu; 811 812 /* Allocate and initialize a new session context. */ 813 session = l2tp_session_create(sizeof(struct pppol2tp_session), 814 tunnel, session_id, 815 peer_session_id, cfg); 816 if (IS_ERR(session)) { 817 error = PTR_ERR(session); 818 goto out; 819 } 820 821 ps = l2tp_session_priv(session); 822 ps->tunnel_sock = tunnel->sock; 823 824 l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n", 825 session->name); 826 827 error = 0; 828 829 out: 830 return error; 831 } 832 833 #endif /* CONFIG_L2TP_V3 */ 834 835 /* getname() support. 836 */ 837 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr, 838 int *usockaddr_len, int peer) 839 { 840 int len = 0; 841 int error = 0; 842 struct l2tp_session *session; 843 struct l2tp_tunnel *tunnel; 844 struct sock *sk = sock->sk; 845 struct inet_sock *inet; 846 struct pppol2tp_session *pls; 847 848 error = -ENOTCONN; 849 if (sk == NULL) 850 goto end; 851 if (!(sk->sk_state & PPPOX_CONNECTED)) 852 goto end; 853 854 error = -EBADF; 855 session = pppol2tp_sock_to_session(sk); 856 if (session == NULL) 857 goto end; 858 859 pls = l2tp_session_priv(session); 860 tunnel = l2tp_sock_to_tunnel(pls->tunnel_sock); 861 if (tunnel == NULL) 862 goto end_put_sess; 863 864 inet = inet_sk(tunnel->sock); 865 if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) { 866 struct sockaddr_pppol2tp sp; 867 len = sizeof(sp); 868 memset(&sp, 0, len); 869 sp.sa_family = AF_PPPOX; 870 sp.sa_protocol = PX_PROTO_OL2TP; 871 sp.pppol2tp.fd = tunnel->fd; 872 sp.pppol2tp.pid = pls->owner; 873 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 874 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 875 sp.pppol2tp.s_session = session->session_id; 876 sp.pppol2tp.d_session = session->peer_session_id; 877 sp.pppol2tp.addr.sin_family = AF_INET; 878 sp.pppol2tp.addr.sin_port = inet->inet_dport; 879 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 880 memcpy(uaddr, &sp, len); 881 #if IS_ENABLED(CONFIG_IPV6) 882 } else if ((tunnel->version == 2) && 883 (tunnel->sock->sk_family == AF_INET6)) { 884 struct sockaddr_pppol2tpin6 sp; 885 886 len = sizeof(sp); 887 memset(&sp, 0, len); 888 sp.sa_family = AF_PPPOX; 889 sp.sa_protocol = PX_PROTO_OL2TP; 890 sp.pppol2tp.fd = tunnel->fd; 891 sp.pppol2tp.pid = pls->owner; 892 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 893 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 894 sp.pppol2tp.s_session = session->session_id; 895 sp.pppol2tp.d_session = session->peer_session_id; 896 sp.pppol2tp.addr.sin6_family = AF_INET6; 897 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 898 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 899 sizeof(tunnel->sock->sk_v6_daddr)); 900 memcpy(uaddr, &sp, len); 901 } else if ((tunnel->version == 3) && 902 (tunnel->sock->sk_family == AF_INET6)) { 903 struct sockaddr_pppol2tpv3in6 sp; 904 905 len = sizeof(sp); 906 memset(&sp, 0, len); 907 sp.sa_family = AF_PPPOX; 908 sp.sa_protocol = PX_PROTO_OL2TP; 909 sp.pppol2tp.fd = tunnel->fd; 910 sp.pppol2tp.pid = pls->owner; 911 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 912 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 913 sp.pppol2tp.s_session = session->session_id; 914 sp.pppol2tp.d_session = session->peer_session_id; 915 sp.pppol2tp.addr.sin6_family = AF_INET6; 916 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 917 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 918 sizeof(tunnel->sock->sk_v6_daddr)); 919 memcpy(uaddr, &sp, len); 920 #endif 921 } else if (tunnel->version == 3) { 922 struct sockaddr_pppol2tpv3 sp; 923 len = sizeof(sp); 924 memset(&sp, 0, len); 925 sp.sa_family = AF_PPPOX; 926 sp.sa_protocol = PX_PROTO_OL2TP; 927 sp.pppol2tp.fd = tunnel->fd; 928 sp.pppol2tp.pid = pls->owner; 929 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 930 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 931 sp.pppol2tp.s_session = session->session_id; 932 sp.pppol2tp.d_session = session->peer_session_id; 933 sp.pppol2tp.addr.sin_family = AF_INET; 934 sp.pppol2tp.addr.sin_port = inet->inet_dport; 935 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 936 memcpy(uaddr, &sp, len); 937 } 938 939 *usockaddr_len = len; 940 error = 0; 941 942 sock_put(pls->tunnel_sock); 943 end_put_sess: 944 sock_put(sk); 945 end: 946 return error; 947 } 948 949 /**************************************************************************** 950 * ioctl() handlers. 951 * 952 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 953 * sockets. However, in order to control kernel tunnel features, we allow 954 * userspace to create a special "tunnel" PPPoX socket which is used for 955 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow 956 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl() 957 * calls. 958 ****************************************************************************/ 959 960 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest, 961 struct l2tp_stats *stats) 962 { 963 dest->tx_packets = atomic_long_read(&stats->tx_packets); 964 dest->tx_bytes = atomic_long_read(&stats->tx_bytes); 965 dest->tx_errors = atomic_long_read(&stats->tx_errors); 966 dest->rx_packets = atomic_long_read(&stats->rx_packets); 967 dest->rx_bytes = atomic_long_read(&stats->rx_bytes); 968 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards); 969 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets); 970 dest->rx_errors = atomic_long_read(&stats->rx_errors); 971 } 972 973 /* Session ioctl helper. 974 */ 975 static int pppol2tp_session_ioctl(struct l2tp_session *session, 976 unsigned int cmd, unsigned long arg) 977 { 978 struct ifreq ifr; 979 int err = 0; 980 struct sock *sk; 981 int val = (int) arg; 982 struct pppol2tp_session *ps = l2tp_session_priv(session); 983 struct l2tp_tunnel *tunnel = session->tunnel; 984 struct pppol2tp_ioc_stats stats; 985 986 l2tp_dbg(session, L2TP_MSG_CONTROL, 987 "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n", 988 session->name, cmd, arg); 989 990 sk = ps->sock; 991 if (!sk) 992 return -EBADR; 993 994 sock_hold(sk); 995 996 switch (cmd) { 997 case SIOCGIFMTU: 998 err = -ENXIO; 999 if (!(sk->sk_state & PPPOX_CONNECTED)) 1000 break; 1001 1002 err = -EFAULT; 1003 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1004 break; 1005 ifr.ifr_mtu = session->mtu; 1006 if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq))) 1007 break; 1008 1009 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mtu=%d\n", 1010 session->name, session->mtu); 1011 err = 0; 1012 break; 1013 1014 case SIOCSIFMTU: 1015 err = -ENXIO; 1016 if (!(sk->sk_state & PPPOX_CONNECTED)) 1017 break; 1018 1019 err = -EFAULT; 1020 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1021 break; 1022 1023 session->mtu = ifr.ifr_mtu; 1024 1025 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mtu=%d\n", 1026 session->name, session->mtu); 1027 err = 0; 1028 break; 1029 1030 case PPPIOCGMRU: 1031 err = -ENXIO; 1032 if (!(sk->sk_state & PPPOX_CONNECTED)) 1033 break; 1034 1035 err = -EFAULT; 1036 if (put_user(session->mru, (int __user *) arg)) 1037 break; 1038 1039 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mru=%d\n", 1040 session->name, session->mru); 1041 err = 0; 1042 break; 1043 1044 case PPPIOCSMRU: 1045 err = -ENXIO; 1046 if (!(sk->sk_state & PPPOX_CONNECTED)) 1047 break; 1048 1049 err = -EFAULT; 1050 if (get_user(val, (int __user *) arg)) 1051 break; 1052 1053 session->mru = val; 1054 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mru=%d\n", 1055 session->name, session->mru); 1056 err = 0; 1057 break; 1058 1059 case PPPIOCGFLAGS: 1060 err = -EFAULT; 1061 if (put_user(ps->flags, (int __user *) arg)) 1062 break; 1063 1064 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get flags=%d\n", 1065 session->name, ps->flags); 1066 err = 0; 1067 break; 1068 1069 case PPPIOCSFLAGS: 1070 err = -EFAULT; 1071 if (get_user(val, (int __user *) arg)) 1072 break; 1073 ps->flags = val; 1074 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set flags=%d\n", 1075 session->name, ps->flags); 1076 err = 0; 1077 break; 1078 1079 case PPPIOCGL2TPSTATS: 1080 err = -ENXIO; 1081 if (!(sk->sk_state & PPPOX_CONNECTED)) 1082 break; 1083 1084 memset(&stats, 0, sizeof(stats)); 1085 stats.tunnel_id = tunnel->tunnel_id; 1086 stats.session_id = session->session_id; 1087 pppol2tp_copy_stats(&stats, &session->stats); 1088 if (copy_to_user((void __user *) arg, &stats, 1089 sizeof(stats))) 1090 break; 1091 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1092 session->name); 1093 err = 0; 1094 break; 1095 1096 default: 1097 err = -ENOSYS; 1098 break; 1099 } 1100 1101 sock_put(sk); 1102 1103 return err; 1104 } 1105 1106 /* Tunnel ioctl helper. 1107 * 1108 * Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data 1109 * specifies a session_id, the session ioctl handler is called. This allows an 1110 * application to retrieve session stats via a tunnel socket. 1111 */ 1112 static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel, 1113 unsigned int cmd, unsigned long arg) 1114 { 1115 int err = 0; 1116 struct sock *sk; 1117 struct pppol2tp_ioc_stats stats; 1118 1119 l2tp_dbg(tunnel, L2TP_MSG_CONTROL, 1120 "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n", 1121 tunnel->name, cmd, arg); 1122 1123 sk = tunnel->sock; 1124 sock_hold(sk); 1125 1126 switch (cmd) { 1127 case PPPIOCGL2TPSTATS: 1128 err = -ENXIO; 1129 if (!(sk->sk_state & PPPOX_CONNECTED)) 1130 break; 1131 1132 if (copy_from_user(&stats, (void __user *) arg, 1133 sizeof(stats))) { 1134 err = -EFAULT; 1135 break; 1136 } 1137 if (stats.session_id != 0) { 1138 /* resend to session ioctl handler */ 1139 struct l2tp_session *session = 1140 l2tp_session_get(sock_net(sk), tunnel, 1141 stats.session_id, true); 1142 1143 if (session) { 1144 err = pppol2tp_session_ioctl(session, cmd, 1145 arg); 1146 if (session->deref) 1147 session->deref(session); 1148 l2tp_session_dec_refcount(session); 1149 } else { 1150 err = -EBADR; 1151 } 1152 break; 1153 } 1154 #ifdef CONFIG_XFRM 1155 stats.using_ipsec = (sk->sk_policy[0] || sk->sk_policy[1]) ? 1 : 0; 1156 #endif 1157 pppol2tp_copy_stats(&stats, &tunnel->stats); 1158 if (copy_to_user((void __user *) arg, &stats, sizeof(stats))) { 1159 err = -EFAULT; 1160 break; 1161 } 1162 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1163 tunnel->name); 1164 err = 0; 1165 break; 1166 1167 default: 1168 err = -ENOSYS; 1169 break; 1170 } 1171 1172 sock_put(sk); 1173 1174 return err; 1175 } 1176 1177 /* Main ioctl() handler. 1178 * Dispatch to tunnel or session helpers depending on the socket. 1179 */ 1180 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, 1181 unsigned long arg) 1182 { 1183 struct sock *sk = sock->sk; 1184 struct l2tp_session *session; 1185 struct l2tp_tunnel *tunnel; 1186 struct pppol2tp_session *ps; 1187 int err; 1188 1189 if (!sk) 1190 return 0; 1191 1192 err = -EBADF; 1193 if (sock_flag(sk, SOCK_DEAD) != 0) 1194 goto end; 1195 1196 err = -ENOTCONN; 1197 if ((sk->sk_user_data == NULL) || 1198 (!(sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)))) 1199 goto end; 1200 1201 /* Get session context from the socket */ 1202 err = -EBADF; 1203 session = pppol2tp_sock_to_session(sk); 1204 if (session == NULL) 1205 goto end; 1206 1207 /* Special case: if session's session_id is zero, treat ioctl as a 1208 * tunnel ioctl 1209 */ 1210 ps = l2tp_session_priv(session); 1211 if ((session->session_id == 0) && 1212 (session->peer_session_id == 0)) { 1213 err = -EBADF; 1214 tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock); 1215 if (tunnel == NULL) 1216 goto end_put_sess; 1217 1218 err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg); 1219 sock_put(ps->tunnel_sock); 1220 goto end_put_sess; 1221 } 1222 1223 err = pppol2tp_session_ioctl(session, cmd, arg); 1224 1225 end_put_sess: 1226 sock_put(sk); 1227 end: 1228 return err; 1229 } 1230 1231 /***************************************************************************** 1232 * setsockopt() / getsockopt() support. 1233 * 1234 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1235 * sockets. In order to control kernel tunnel features, we allow userspace to 1236 * create a special "tunnel" PPPoX socket which is used for control only. 1237 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user 1238 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls. 1239 *****************************************************************************/ 1240 1241 /* Tunnel setsockopt() helper. 1242 */ 1243 static int pppol2tp_tunnel_setsockopt(struct sock *sk, 1244 struct l2tp_tunnel *tunnel, 1245 int optname, int val) 1246 { 1247 int err = 0; 1248 1249 switch (optname) { 1250 case PPPOL2TP_SO_DEBUG: 1251 tunnel->debug = val; 1252 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1253 tunnel->name, tunnel->debug); 1254 break; 1255 1256 default: 1257 err = -ENOPROTOOPT; 1258 break; 1259 } 1260 1261 return err; 1262 } 1263 1264 /* Session setsockopt helper. 1265 */ 1266 static int pppol2tp_session_setsockopt(struct sock *sk, 1267 struct l2tp_session *session, 1268 int optname, int val) 1269 { 1270 int err = 0; 1271 struct pppol2tp_session *ps = l2tp_session_priv(session); 1272 1273 switch (optname) { 1274 case PPPOL2TP_SO_RECVSEQ: 1275 if ((val != 0) && (val != 1)) { 1276 err = -EINVAL; 1277 break; 1278 } 1279 session->recv_seq = !!val; 1280 l2tp_info(session, L2TP_MSG_CONTROL, 1281 "%s: set recv_seq=%d\n", 1282 session->name, session->recv_seq); 1283 break; 1284 1285 case PPPOL2TP_SO_SENDSEQ: 1286 if ((val != 0) && (val != 1)) { 1287 err = -EINVAL; 1288 break; 1289 } 1290 session->send_seq = !!val; 1291 { 1292 struct sock *ssk = ps->sock; 1293 struct pppox_sock *po = pppox_sk(ssk); 1294 po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ : 1295 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 1296 } 1297 l2tp_session_set_header_len(session, session->tunnel->version); 1298 l2tp_info(session, L2TP_MSG_CONTROL, 1299 "%s: set send_seq=%d\n", 1300 session->name, session->send_seq); 1301 break; 1302 1303 case PPPOL2TP_SO_LNSMODE: 1304 if ((val != 0) && (val != 1)) { 1305 err = -EINVAL; 1306 break; 1307 } 1308 session->lns_mode = !!val; 1309 l2tp_info(session, L2TP_MSG_CONTROL, 1310 "%s: set lns_mode=%d\n", 1311 session->name, session->lns_mode); 1312 break; 1313 1314 case PPPOL2TP_SO_DEBUG: 1315 session->debug = val; 1316 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1317 session->name, session->debug); 1318 break; 1319 1320 case PPPOL2TP_SO_REORDERTO: 1321 session->reorder_timeout = msecs_to_jiffies(val); 1322 l2tp_info(session, L2TP_MSG_CONTROL, 1323 "%s: set reorder_timeout=%d\n", 1324 session->name, session->reorder_timeout); 1325 break; 1326 1327 default: 1328 err = -ENOPROTOOPT; 1329 break; 1330 } 1331 1332 return err; 1333 } 1334 1335 /* Main setsockopt() entry point. 1336 * Does API checks, then calls either the tunnel or session setsockopt 1337 * handler, according to whether the PPPoL2TP socket is a for a regular 1338 * session or the special tunnel type. 1339 */ 1340 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, 1341 char __user *optval, unsigned int optlen) 1342 { 1343 struct sock *sk = sock->sk; 1344 struct l2tp_session *session; 1345 struct l2tp_tunnel *tunnel; 1346 struct pppol2tp_session *ps; 1347 int val; 1348 int err; 1349 1350 if (level != SOL_PPPOL2TP) 1351 return -EINVAL; 1352 1353 if (optlen < sizeof(int)) 1354 return -EINVAL; 1355 1356 if (get_user(val, (int __user *)optval)) 1357 return -EFAULT; 1358 1359 err = -ENOTCONN; 1360 if (sk->sk_user_data == NULL) 1361 goto end; 1362 1363 /* Get session context from the socket */ 1364 err = -EBADF; 1365 session = pppol2tp_sock_to_session(sk); 1366 if (session == NULL) 1367 goto end; 1368 1369 /* Special case: if session_id == 0x0000, treat as operation on tunnel 1370 */ 1371 ps = l2tp_session_priv(session); 1372 if ((session->session_id == 0) && 1373 (session->peer_session_id == 0)) { 1374 err = -EBADF; 1375 tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock); 1376 if (tunnel == NULL) 1377 goto end_put_sess; 1378 1379 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val); 1380 sock_put(ps->tunnel_sock); 1381 } else 1382 err = pppol2tp_session_setsockopt(sk, session, optname, val); 1383 1384 end_put_sess: 1385 sock_put(sk); 1386 end: 1387 return err; 1388 } 1389 1390 /* Tunnel getsockopt helper. Called with sock locked. 1391 */ 1392 static int pppol2tp_tunnel_getsockopt(struct sock *sk, 1393 struct l2tp_tunnel *tunnel, 1394 int optname, int *val) 1395 { 1396 int err = 0; 1397 1398 switch (optname) { 1399 case PPPOL2TP_SO_DEBUG: 1400 *val = tunnel->debug; 1401 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get debug=%x\n", 1402 tunnel->name, tunnel->debug); 1403 break; 1404 1405 default: 1406 err = -ENOPROTOOPT; 1407 break; 1408 } 1409 1410 return err; 1411 } 1412 1413 /* Session getsockopt helper. Called with sock locked. 1414 */ 1415 static int pppol2tp_session_getsockopt(struct sock *sk, 1416 struct l2tp_session *session, 1417 int optname, int *val) 1418 { 1419 int err = 0; 1420 1421 switch (optname) { 1422 case PPPOL2TP_SO_RECVSEQ: 1423 *val = session->recv_seq; 1424 l2tp_info(session, L2TP_MSG_CONTROL, 1425 "%s: get recv_seq=%d\n", session->name, *val); 1426 break; 1427 1428 case PPPOL2TP_SO_SENDSEQ: 1429 *val = session->send_seq; 1430 l2tp_info(session, L2TP_MSG_CONTROL, 1431 "%s: get send_seq=%d\n", session->name, *val); 1432 break; 1433 1434 case PPPOL2TP_SO_LNSMODE: 1435 *val = session->lns_mode; 1436 l2tp_info(session, L2TP_MSG_CONTROL, 1437 "%s: get lns_mode=%d\n", session->name, *val); 1438 break; 1439 1440 case PPPOL2TP_SO_DEBUG: 1441 *val = session->debug; 1442 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get debug=%d\n", 1443 session->name, *val); 1444 break; 1445 1446 case PPPOL2TP_SO_REORDERTO: 1447 *val = (int) jiffies_to_msecs(session->reorder_timeout); 1448 l2tp_info(session, L2TP_MSG_CONTROL, 1449 "%s: get reorder_timeout=%d\n", session->name, *val); 1450 break; 1451 1452 default: 1453 err = -ENOPROTOOPT; 1454 } 1455 1456 return err; 1457 } 1458 1459 /* Main getsockopt() entry point. 1460 * Does API checks, then calls either the tunnel or session getsockopt 1461 * handler, according to whether the PPPoX socket is a for a regular session 1462 * or the special tunnel type. 1463 */ 1464 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, 1465 char __user *optval, int __user *optlen) 1466 { 1467 struct sock *sk = sock->sk; 1468 struct l2tp_session *session; 1469 struct l2tp_tunnel *tunnel; 1470 int val, len; 1471 int err; 1472 struct pppol2tp_session *ps; 1473 1474 if (level != SOL_PPPOL2TP) 1475 return -EINVAL; 1476 1477 if (get_user(len, optlen)) 1478 return -EFAULT; 1479 1480 len = min_t(unsigned int, len, sizeof(int)); 1481 1482 if (len < 0) 1483 return -EINVAL; 1484 1485 err = -ENOTCONN; 1486 if (sk->sk_user_data == NULL) 1487 goto end; 1488 1489 /* Get the session context */ 1490 err = -EBADF; 1491 session = pppol2tp_sock_to_session(sk); 1492 if (session == NULL) 1493 goto end; 1494 1495 /* Special case: if session_id == 0x0000, treat as operation on tunnel */ 1496 ps = l2tp_session_priv(session); 1497 if ((session->session_id == 0) && 1498 (session->peer_session_id == 0)) { 1499 err = -EBADF; 1500 tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock); 1501 if (tunnel == NULL) 1502 goto end_put_sess; 1503 1504 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val); 1505 sock_put(ps->tunnel_sock); 1506 if (err) 1507 goto end_put_sess; 1508 } else { 1509 err = pppol2tp_session_getsockopt(sk, session, optname, &val); 1510 if (err) 1511 goto end_put_sess; 1512 } 1513 1514 err = -EFAULT; 1515 if (put_user(len, optlen)) 1516 goto end_put_sess; 1517 1518 if (copy_to_user((void __user *) optval, &val, len)) 1519 goto end_put_sess; 1520 1521 err = 0; 1522 1523 end_put_sess: 1524 sock_put(sk); 1525 end: 1526 return err; 1527 } 1528 1529 /***************************************************************************** 1530 * /proc filesystem for debug 1531 * Since the original pppol2tp driver provided /proc/net/pppol2tp for 1532 * L2TPv2, we dump only L2TPv2 tunnels and sessions here. 1533 *****************************************************************************/ 1534 1535 static unsigned int pppol2tp_net_id; 1536 1537 #ifdef CONFIG_PROC_FS 1538 1539 struct pppol2tp_seq_data { 1540 struct seq_net_private p; 1541 int tunnel_idx; /* current tunnel */ 1542 int session_idx; /* index of session within current tunnel */ 1543 struct l2tp_tunnel *tunnel; 1544 struct l2tp_session *session; /* NULL means get next tunnel */ 1545 }; 1546 1547 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) 1548 { 1549 for (;;) { 1550 pd->tunnel = l2tp_tunnel_find_nth(net, pd->tunnel_idx); 1551 pd->tunnel_idx++; 1552 1553 if (pd->tunnel == NULL) 1554 break; 1555 1556 /* Ignore L2TPv3 tunnels */ 1557 if (pd->tunnel->version < 3) 1558 break; 1559 } 1560 } 1561 1562 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) 1563 { 1564 pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true); 1565 pd->session_idx++; 1566 1567 if (pd->session == NULL) { 1568 pd->session_idx = 0; 1569 pppol2tp_next_tunnel(net, pd); 1570 } 1571 } 1572 1573 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs) 1574 { 1575 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN; 1576 loff_t pos = *offs; 1577 struct net *net; 1578 1579 if (!pos) 1580 goto out; 1581 1582 BUG_ON(m->private == NULL); 1583 pd = m->private; 1584 net = seq_file_net(m); 1585 1586 if (pd->tunnel == NULL) 1587 pppol2tp_next_tunnel(net, pd); 1588 else 1589 pppol2tp_next_session(net, pd); 1590 1591 /* NULL tunnel and session indicates end of list */ 1592 if ((pd->tunnel == NULL) && (pd->session == NULL)) 1593 pd = NULL; 1594 1595 out: 1596 return pd; 1597 } 1598 1599 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos) 1600 { 1601 (*pos)++; 1602 return NULL; 1603 } 1604 1605 static void pppol2tp_seq_stop(struct seq_file *p, void *v) 1606 { 1607 /* nothing to do */ 1608 } 1609 1610 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) 1611 { 1612 struct l2tp_tunnel *tunnel = v; 1613 1614 seq_printf(m, "\nTUNNEL '%s', %c %d\n", 1615 tunnel->name, 1616 (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N', 1617 refcount_read(&tunnel->ref_count) - 1); 1618 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n", 1619 tunnel->debug, 1620 atomic_long_read(&tunnel->stats.tx_packets), 1621 atomic_long_read(&tunnel->stats.tx_bytes), 1622 atomic_long_read(&tunnel->stats.tx_errors), 1623 atomic_long_read(&tunnel->stats.rx_packets), 1624 atomic_long_read(&tunnel->stats.rx_bytes), 1625 atomic_long_read(&tunnel->stats.rx_errors)); 1626 } 1627 1628 static void pppol2tp_seq_session_show(struct seq_file *m, void *v) 1629 { 1630 struct l2tp_session *session = v; 1631 struct l2tp_tunnel *tunnel = session->tunnel; 1632 struct pppol2tp_session *ps = l2tp_session_priv(session); 1633 struct pppox_sock *po = pppox_sk(ps->sock); 1634 u32 ip = 0; 1635 u16 port = 0; 1636 1637 if (tunnel->sock) { 1638 struct inet_sock *inet = inet_sk(tunnel->sock); 1639 ip = ntohl(inet->inet_saddr); 1640 port = ntohs(inet->inet_sport); 1641 } 1642 1643 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> " 1644 "%04X/%04X %d %c\n", 1645 session->name, ip, port, 1646 tunnel->tunnel_id, 1647 session->session_id, 1648 tunnel->peer_tunnel_id, 1649 session->peer_session_id, 1650 ps->sock->sk_state, 1651 (session == ps->sock->sk_user_data) ? 1652 'Y' : 'N'); 1653 seq_printf(m, " %d/%d/%c/%c/%s %08x %u\n", 1654 session->mtu, session->mru, 1655 session->recv_seq ? 'R' : '-', 1656 session->send_seq ? 'S' : '-', 1657 session->lns_mode ? "LNS" : "LAC", 1658 session->debug, 1659 jiffies_to_msecs(session->reorder_timeout)); 1660 seq_printf(m, " %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n", 1661 session->nr, session->ns, 1662 atomic_long_read(&session->stats.tx_packets), 1663 atomic_long_read(&session->stats.tx_bytes), 1664 atomic_long_read(&session->stats.tx_errors), 1665 atomic_long_read(&session->stats.rx_packets), 1666 atomic_long_read(&session->stats.rx_bytes), 1667 atomic_long_read(&session->stats.rx_errors)); 1668 1669 if (po) 1670 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 1671 } 1672 1673 static int pppol2tp_seq_show(struct seq_file *m, void *v) 1674 { 1675 struct pppol2tp_seq_data *pd = v; 1676 1677 /* display header on line 1 */ 1678 if (v == SEQ_START_TOKEN) { 1679 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n"); 1680 seq_puts(m, "TUNNEL name, user-data-ok session-count\n"); 1681 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1682 seq_puts(m, " SESSION name, addr/port src-tid/sid " 1683 "dest-tid/sid state user-data-ok\n"); 1684 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n"); 1685 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1686 goto out; 1687 } 1688 1689 /* Show the tunnel or session context. 1690 */ 1691 if (!pd->session) { 1692 pppol2tp_seq_tunnel_show(m, pd->tunnel); 1693 } else { 1694 pppol2tp_seq_session_show(m, pd->session); 1695 if (pd->session->deref) 1696 pd->session->deref(pd->session); 1697 l2tp_session_dec_refcount(pd->session); 1698 } 1699 1700 out: 1701 return 0; 1702 } 1703 1704 static const struct seq_operations pppol2tp_seq_ops = { 1705 .start = pppol2tp_seq_start, 1706 .next = pppol2tp_seq_next, 1707 .stop = pppol2tp_seq_stop, 1708 .show = pppol2tp_seq_show, 1709 }; 1710 1711 /* Called when our /proc file is opened. We allocate data for use when 1712 * iterating our tunnel / session contexts and store it in the private 1713 * data of the seq_file. 1714 */ 1715 static int pppol2tp_proc_open(struct inode *inode, struct file *file) 1716 { 1717 return seq_open_net(inode, file, &pppol2tp_seq_ops, 1718 sizeof(struct pppol2tp_seq_data)); 1719 } 1720 1721 static const struct file_operations pppol2tp_proc_fops = { 1722 .owner = THIS_MODULE, 1723 .open = pppol2tp_proc_open, 1724 .read = seq_read, 1725 .llseek = seq_lseek, 1726 .release = seq_release_net, 1727 }; 1728 1729 #endif /* CONFIG_PROC_FS */ 1730 1731 /***************************************************************************** 1732 * Network namespace 1733 *****************************************************************************/ 1734 1735 static __net_init int pppol2tp_init_net(struct net *net) 1736 { 1737 struct proc_dir_entry *pde; 1738 int err = 0; 1739 1740 pde = proc_create("pppol2tp", S_IRUGO, net->proc_net, 1741 &pppol2tp_proc_fops); 1742 if (!pde) { 1743 err = -ENOMEM; 1744 goto out; 1745 } 1746 1747 out: 1748 return err; 1749 } 1750 1751 static __net_exit void pppol2tp_exit_net(struct net *net) 1752 { 1753 remove_proc_entry("pppol2tp", net->proc_net); 1754 } 1755 1756 static struct pernet_operations pppol2tp_net_ops = { 1757 .init = pppol2tp_init_net, 1758 .exit = pppol2tp_exit_net, 1759 .id = &pppol2tp_net_id, 1760 }; 1761 1762 /***************************************************************************** 1763 * Init and cleanup 1764 *****************************************************************************/ 1765 1766 static const struct proto_ops pppol2tp_ops = { 1767 .family = AF_PPPOX, 1768 .owner = THIS_MODULE, 1769 .release = pppol2tp_release, 1770 .bind = sock_no_bind, 1771 .connect = pppol2tp_connect, 1772 .socketpair = sock_no_socketpair, 1773 .accept = sock_no_accept, 1774 .getname = pppol2tp_getname, 1775 .poll = datagram_poll, 1776 .listen = sock_no_listen, 1777 .shutdown = sock_no_shutdown, 1778 .setsockopt = pppol2tp_setsockopt, 1779 .getsockopt = pppol2tp_getsockopt, 1780 .sendmsg = pppol2tp_sendmsg, 1781 .recvmsg = pppol2tp_recvmsg, 1782 .mmap = sock_no_mmap, 1783 .ioctl = pppox_ioctl, 1784 }; 1785 1786 static const struct pppox_proto pppol2tp_proto = { 1787 .create = pppol2tp_create, 1788 .ioctl = pppol2tp_ioctl, 1789 .owner = THIS_MODULE, 1790 }; 1791 1792 #ifdef CONFIG_L2TP_V3 1793 1794 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = { 1795 .session_create = pppol2tp_session_create, 1796 .session_delete = l2tp_session_delete, 1797 }; 1798 1799 #endif /* CONFIG_L2TP_V3 */ 1800 1801 static int __init pppol2tp_init(void) 1802 { 1803 int err; 1804 1805 err = register_pernet_device(&pppol2tp_net_ops); 1806 if (err) 1807 goto out; 1808 1809 err = proto_register(&pppol2tp_sk_proto, 0); 1810 if (err) 1811 goto out_unregister_pppol2tp_pernet; 1812 1813 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto); 1814 if (err) 1815 goto out_unregister_pppol2tp_proto; 1816 1817 #ifdef CONFIG_L2TP_V3 1818 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops); 1819 if (err) 1820 goto out_unregister_pppox; 1821 #endif 1822 1823 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION); 1824 1825 out: 1826 return err; 1827 1828 #ifdef CONFIG_L2TP_V3 1829 out_unregister_pppox: 1830 unregister_pppox_proto(PX_PROTO_OL2TP); 1831 #endif 1832 out_unregister_pppol2tp_proto: 1833 proto_unregister(&pppol2tp_sk_proto); 1834 out_unregister_pppol2tp_pernet: 1835 unregister_pernet_device(&pppol2tp_net_ops); 1836 goto out; 1837 } 1838 1839 static void __exit pppol2tp_exit(void) 1840 { 1841 #ifdef CONFIG_L2TP_V3 1842 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP); 1843 #endif 1844 unregister_pppox_proto(PX_PROTO_OL2TP); 1845 proto_unregister(&pppol2tp_sk_proto); 1846 unregister_pernet_device(&pppol2tp_net_ops); 1847 } 1848 1849 module_init(pppol2tp_init); 1850 module_exit(pppol2tp_exit); 1851 1852 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1853 MODULE_DESCRIPTION("PPP over L2TP over UDP"); 1854 MODULE_LICENSE("GPL"); 1855 MODULE_VERSION(PPPOL2TP_DRV_VERSION); 1856 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP); 1857 MODULE_ALIAS_L2TP_PWTYPE(7); 1858