1 /***************************************************************************** 2 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets 3 * 4 * PPPoX --- Generic PPP encapsulation socket family 5 * PPPoL2TP --- PPP over L2TP (RFC 2661) 6 * 7 * Version: 2.0.0 8 * 9 * Authors: James Chapman (jchapman@katalix.com) 10 * 11 * Based on original work by Martijn van Oosterhout <kleptog@svana.org> 12 * 13 * License: 14 * This program is free software; you can redistribute it and/or 15 * modify it under the terms of the GNU General Public License 16 * as published by the Free Software Foundation; either version 17 * 2 of the License, or (at your option) any later version. 18 * 19 */ 20 21 /* This driver handles only L2TP data frames; control frames are handled by a 22 * userspace application. 23 * 24 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and 25 * attaches it to a bound UDP socket with local tunnel_id / session_id and 26 * peer tunnel_id / session_id set. Data can then be sent or received using 27 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket 28 * can be read or modified using ioctl() or [gs]etsockopt() calls. 29 * 30 * When a PPPoL2TP socket is connected with local and peer session_id values 31 * zero, the socket is treated as a special tunnel management socket. 32 * 33 * Here's example userspace code to create a socket for sending/receiving data 34 * over an L2TP session:- 35 * 36 * struct sockaddr_pppol2tp sax; 37 * int fd; 38 * int session_fd; 39 * 40 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); 41 * 42 * sax.sa_family = AF_PPPOX; 43 * sax.sa_protocol = PX_PROTO_OL2TP; 44 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket 45 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr; 46 * sax.pppol2tp.addr.sin_port = addr->sin_port; 47 * sax.pppol2tp.addr.sin_family = AF_INET; 48 * sax.pppol2tp.s_tunnel = tunnel_id; 49 * sax.pppol2tp.s_session = session_id; 50 * sax.pppol2tp.d_tunnel = peer_tunnel_id; 51 * sax.pppol2tp.d_session = peer_session_id; 52 * 53 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax)); 54 * 55 * A pppd plugin that allows PPP traffic to be carried over L2TP using 56 * this driver is available from the OpenL2TP project at 57 * http://openl2tp.sourceforge.net. 58 */ 59 60 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 61 62 #include <linux/module.h> 63 #include <linux/string.h> 64 #include <linux/list.h> 65 #include <linux/uaccess.h> 66 67 #include <linux/kernel.h> 68 #include <linux/spinlock.h> 69 #include <linux/kthread.h> 70 #include <linux/sched.h> 71 #include <linux/slab.h> 72 #include <linux/errno.h> 73 #include <linux/jiffies.h> 74 75 #include <linux/netdevice.h> 76 #include <linux/net.h> 77 #include <linux/inetdevice.h> 78 #include <linux/skbuff.h> 79 #include <linux/init.h> 80 #include <linux/ip.h> 81 #include <linux/udp.h> 82 #include <linux/if_pppox.h> 83 #include <linux/if_pppol2tp.h> 84 #include <net/sock.h> 85 #include <linux/ppp_channel.h> 86 #include <linux/ppp_defs.h> 87 #include <linux/ppp-ioctl.h> 88 #include <linux/file.h> 89 #include <linux/hash.h> 90 #include <linux/sort.h> 91 #include <linux/proc_fs.h> 92 #include <linux/l2tp.h> 93 #include <linux/nsproxy.h> 94 #include <net/net_namespace.h> 95 #include <net/netns/generic.h> 96 #include <net/dst.h> 97 #include <net/ip.h> 98 #include <net/udp.h> 99 #include <net/xfrm.h> 100 #include <net/inet_common.h> 101 102 #include <asm/byteorder.h> 103 #include <linux/atomic.h> 104 105 #include "l2tp_core.h" 106 107 #define PPPOL2TP_DRV_VERSION "V2.0" 108 109 /* Space for UDP, L2TP and PPP headers */ 110 #define PPPOL2TP_HEADER_OVERHEAD 40 111 112 /* Number of bytes to build transmit L2TP headers. 113 * Unfortunately the size is different depending on whether sequence numbers 114 * are enabled. 115 */ 116 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10 117 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6 118 119 /* Private data of each session. This data lives at the end of struct 120 * l2tp_session, referenced via session->priv[]. 121 */ 122 struct pppol2tp_session { 123 int owner; /* pid that opened the socket */ 124 125 struct mutex sk_lock; /* Protects .sk */ 126 struct sock __rcu *sk; /* Pointer to the session 127 * PPPoX socket */ 128 struct sock *__sk; /* Copy of .sk, for cleanup */ 129 struct rcu_head rcu; /* For asynchronous release */ 130 int flags; /* accessed by PPPIOCGFLAGS. 131 * Unused. */ 132 }; 133 134 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb); 135 136 static const struct ppp_channel_ops pppol2tp_chan_ops = { 137 .start_xmit = pppol2tp_xmit, 138 }; 139 140 static const struct proto_ops pppol2tp_ops; 141 142 /* Retrieves the pppol2tp socket associated to a session. 143 * A reference is held on the returned socket, so this function must be paired 144 * with sock_put(). 145 */ 146 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) 147 { 148 struct pppol2tp_session *ps = l2tp_session_priv(session); 149 struct sock *sk; 150 151 rcu_read_lock(); 152 sk = rcu_dereference(ps->sk); 153 if (sk) 154 sock_hold(sk); 155 rcu_read_unlock(); 156 157 return sk; 158 } 159 160 /* Helpers to obtain tunnel/session contexts from sockets. 161 */ 162 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) 163 { 164 struct l2tp_session *session; 165 166 if (sk == NULL) 167 return NULL; 168 169 sock_hold(sk); 170 session = (struct l2tp_session *)(sk->sk_user_data); 171 if (session == NULL) { 172 sock_put(sk); 173 goto out; 174 } 175 176 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 177 178 out: 179 return session; 180 } 181 182 /***************************************************************************** 183 * Receive data handling 184 *****************************************************************************/ 185 186 static int pppol2tp_recv_payload_hook(struct sk_buff *skb) 187 { 188 /* Skip PPP header, if present. In testing, Microsoft L2TP clients 189 * don't send the PPP header (PPP header compression enabled), but 190 * other clients can include the header. So we cope with both cases 191 * here. The PPP header is always FF03 when using L2TP. 192 * 193 * Note that skb->data[] isn't dereferenced from a u16 ptr here since 194 * the field may be unaligned. 195 */ 196 if (!pskb_may_pull(skb, 2)) 197 return 1; 198 199 if ((skb->data[0] == PPP_ALLSTATIONS) && (skb->data[1] == PPP_UI)) 200 skb_pull(skb, 2); 201 202 return 0; 203 } 204 205 /* Receive message. This is the recvmsg for the PPPoL2TP socket. 206 */ 207 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, 208 size_t len, int flags) 209 { 210 int err; 211 struct sk_buff *skb; 212 struct sock *sk = sock->sk; 213 214 err = -EIO; 215 if (sk->sk_state & PPPOX_BOUND) 216 goto end; 217 218 err = 0; 219 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 220 flags & MSG_DONTWAIT, &err); 221 if (!skb) 222 goto end; 223 224 if (len > skb->len) 225 len = skb->len; 226 else if (len < skb->len) 227 msg->msg_flags |= MSG_TRUNC; 228 229 err = skb_copy_datagram_msg(skb, 0, msg, len); 230 if (likely(err == 0)) 231 err = len; 232 233 kfree_skb(skb); 234 end: 235 return err; 236 } 237 238 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) 239 { 240 struct pppol2tp_session *ps = l2tp_session_priv(session); 241 struct sock *sk = NULL; 242 243 /* If the socket is bound, send it in to PPP's input queue. Otherwise 244 * queue it on the session socket. 245 */ 246 rcu_read_lock(); 247 sk = rcu_dereference(ps->sk); 248 if (sk == NULL) 249 goto no_sock; 250 251 if (sk->sk_state & PPPOX_BOUND) { 252 struct pppox_sock *po; 253 254 l2tp_dbg(session, L2TP_MSG_DATA, 255 "%s: recv %d byte data frame, passing to ppp\n", 256 session->name, data_len); 257 258 po = pppox_sk(sk); 259 ppp_input(&po->chan, skb); 260 } else { 261 l2tp_dbg(session, L2TP_MSG_DATA, 262 "%s: recv %d byte data frame, passing to L2TP socket\n", 263 session->name, data_len); 264 265 if (sock_queue_rcv_skb(sk, skb) < 0) { 266 atomic_long_inc(&session->stats.rx_errors); 267 kfree_skb(skb); 268 } 269 } 270 rcu_read_unlock(); 271 272 return; 273 274 no_sock: 275 rcu_read_unlock(); 276 l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name); 277 kfree_skb(skb); 278 } 279 280 /************************************************************************ 281 * Transmit handling 282 ***********************************************************************/ 283 284 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here 285 * when a user application does a sendmsg() on the session socket. L2TP and 286 * PPP headers must be inserted into the user's data. 287 */ 288 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m, 289 size_t total_len) 290 { 291 struct sock *sk = sock->sk; 292 struct sk_buff *skb; 293 int error; 294 struct l2tp_session *session; 295 struct l2tp_tunnel *tunnel; 296 int uhlen; 297 298 error = -ENOTCONN; 299 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 300 goto error; 301 302 /* Get session and tunnel contexts */ 303 error = -EBADF; 304 session = pppol2tp_sock_to_session(sk); 305 if (session == NULL) 306 goto error; 307 308 tunnel = session->tunnel; 309 310 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 311 312 /* Allocate a socket buffer */ 313 error = -ENOMEM; 314 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 315 uhlen + session->hdr_len + 316 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 317 0, GFP_KERNEL); 318 if (!skb) 319 goto error_put_sess; 320 321 /* Reserve space for headers. */ 322 skb_reserve(skb, NET_SKB_PAD); 323 skb_reset_network_header(skb); 324 skb_reserve(skb, sizeof(struct iphdr)); 325 skb_reset_transport_header(skb); 326 skb_reserve(skb, uhlen); 327 328 /* Add PPP header */ 329 skb->data[0] = PPP_ALLSTATIONS; 330 skb->data[1] = PPP_UI; 331 skb_put(skb, 2); 332 333 /* Copy user data into skb */ 334 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len); 335 if (error < 0) { 336 kfree_skb(skb); 337 goto error_put_sess; 338 } 339 340 local_bh_disable(); 341 l2tp_xmit_skb(session, skb, session->hdr_len); 342 local_bh_enable(); 343 344 sock_put(sk); 345 346 return total_len; 347 348 error_put_sess: 349 sock_put(sk); 350 error: 351 return error; 352 } 353 354 /* Transmit function called by generic PPP driver. Sends PPP frame 355 * over PPPoL2TP socket. 356 * 357 * This is almost the same as pppol2tp_sendmsg(), but rather than 358 * being called with a msghdr from userspace, it is called with a skb 359 * from the kernel. 360 * 361 * The supplied skb from ppp doesn't have enough headroom for the 362 * insertion of L2TP, UDP and IP headers so we need to allocate more 363 * headroom in the skb. This will create a cloned skb. But we must be 364 * careful in the error case because the caller will expect to free 365 * the skb it supplied, not our cloned skb. So we take care to always 366 * leave the original skb unfreed if we return an error. 367 */ 368 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) 369 { 370 struct sock *sk = (struct sock *) chan->private; 371 struct l2tp_session *session; 372 struct l2tp_tunnel *tunnel; 373 int uhlen, headroom; 374 375 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 376 goto abort; 377 378 /* Get session and tunnel contexts from the socket */ 379 session = pppol2tp_sock_to_session(sk); 380 if (session == NULL) 381 goto abort; 382 383 tunnel = session->tunnel; 384 385 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 386 headroom = NET_SKB_PAD + 387 sizeof(struct iphdr) + /* IP header */ 388 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */ 389 session->hdr_len + /* L2TP header */ 390 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 391 if (skb_cow_head(skb, headroom)) 392 goto abort_put_sess; 393 394 /* Setup PPP header */ 395 __skb_push(skb, 2); 396 skb->data[0] = PPP_ALLSTATIONS; 397 skb->data[1] = PPP_UI; 398 399 local_bh_disable(); 400 l2tp_xmit_skb(session, skb, session->hdr_len); 401 local_bh_enable(); 402 403 sock_put(sk); 404 405 return 1; 406 407 abort_put_sess: 408 sock_put(sk); 409 abort: 410 /* Free the original skb */ 411 kfree_skb(skb); 412 return 1; 413 } 414 415 /***************************************************************************** 416 * Session (and tunnel control) socket create/destroy. 417 *****************************************************************************/ 418 419 static void pppol2tp_put_sk(struct rcu_head *head) 420 { 421 struct pppol2tp_session *ps; 422 423 ps = container_of(head, typeof(*ps), rcu); 424 sock_put(ps->__sk); 425 } 426 427 /* Really kill the session socket. (Called from sock_put() if 428 * refcnt == 0.) 429 */ 430 static void pppol2tp_session_destruct(struct sock *sk) 431 { 432 struct l2tp_session *session = sk->sk_user_data; 433 434 skb_queue_purge(&sk->sk_receive_queue); 435 skb_queue_purge(&sk->sk_write_queue); 436 437 if (session) { 438 sk->sk_user_data = NULL; 439 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 440 l2tp_session_dec_refcount(session); 441 } 442 } 443 444 /* Called when the PPPoX socket (session) is closed. 445 */ 446 static int pppol2tp_release(struct socket *sock) 447 { 448 struct sock *sk = sock->sk; 449 struct l2tp_session *session; 450 int error; 451 452 if (!sk) 453 return 0; 454 455 error = -EBADF; 456 lock_sock(sk); 457 if (sock_flag(sk, SOCK_DEAD) != 0) 458 goto error; 459 460 pppox_unbind_sock(sk); 461 462 /* Signal the death of the socket. */ 463 sk->sk_state = PPPOX_DEAD; 464 sock_orphan(sk); 465 sock->sk = NULL; 466 467 session = pppol2tp_sock_to_session(sk); 468 if (session) { 469 struct pppol2tp_session *ps; 470 471 l2tp_session_delete(session); 472 473 ps = l2tp_session_priv(session); 474 mutex_lock(&ps->sk_lock); 475 ps->__sk = rcu_dereference_protected(ps->sk, 476 lockdep_is_held(&ps->sk_lock)); 477 RCU_INIT_POINTER(ps->sk, NULL); 478 mutex_unlock(&ps->sk_lock); 479 call_rcu(&ps->rcu, pppol2tp_put_sk); 480 481 /* Rely on the sock_put() call at the end of the function for 482 * dropping the reference held by pppol2tp_sock_to_session(). 483 * The last reference will be dropped by pppol2tp_put_sk(). 484 */ 485 } 486 487 release_sock(sk); 488 489 /* This will delete the session context via 490 * pppol2tp_session_destruct() if the socket's refcnt drops to 491 * zero. 492 */ 493 sock_put(sk); 494 495 return 0; 496 497 error: 498 release_sock(sk); 499 return error; 500 } 501 502 static struct proto pppol2tp_sk_proto = { 503 .name = "PPPOL2TP", 504 .owner = THIS_MODULE, 505 .obj_size = sizeof(struct pppox_sock), 506 }; 507 508 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb) 509 { 510 int rc; 511 512 rc = l2tp_udp_encap_recv(sk, skb); 513 if (rc) 514 kfree_skb(skb); 515 516 return NET_RX_SUCCESS; 517 } 518 519 /* socket() handler. Initialize a new struct sock. 520 */ 521 static int pppol2tp_create(struct net *net, struct socket *sock, int kern) 522 { 523 int error = -ENOMEM; 524 struct sock *sk; 525 526 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern); 527 if (!sk) 528 goto out; 529 530 sock_init_data(sock, sk); 531 532 sock->state = SS_UNCONNECTED; 533 sock->ops = &pppol2tp_ops; 534 535 sk->sk_backlog_rcv = pppol2tp_backlog_recv; 536 sk->sk_protocol = PX_PROTO_OL2TP; 537 sk->sk_family = PF_PPPOX; 538 sk->sk_state = PPPOX_NONE; 539 sk->sk_type = SOCK_STREAM; 540 sk->sk_destruct = pppol2tp_session_destruct; 541 542 error = 0; 543 544 out: 545 return error; 546 } 547 548 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 549 static void pppol2tp_show(struct seq_file *m, void *arg) 550 { 551 struct l2tp_session *session = arg; 552 struct sock *sk; 553 554 sk = pppol2tp_session_get_sock(session); 555 if (sk) { 556 struct pppox_sock *po = pppox_sk(sk); 557 558 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 559 sock_put(sk); 560 } 561 } 562 #endif 563 564 static void pppol2tp_session_init(struct l2tp_session *session) 565 { 566 struct pppol2tp_session *ps; 567 struct dst_entry *dst; 568 569 session->recv_skb = pppol2tp_recv; 570 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 571 session->show = pppol2tp_show; 572 #endif 573 574 ps = l2tp_session_priv(session); 575 mutex_init(&ps->sk_lock); 576 ps->owner = current->pid; 577 578 /* If PMTU discovery was enabled, use the MTU that was discovered */ 579 dst = sk_dst_get(session->tunnel->sock); 580 if (dst) { 581 u32 pmtu = dst_mtu(dst); 582 583 if (pmtu) { 584 session->mtu = pmtu - PPPOL2TP_HEADER_OVERHEAD; 585 session->mru = pmtu - PPPOL2TP_HEADER_OVERHEAD; 586 } 587 dst_release(dst); 588 } 589 } 590 591 struct l2tp_connect_info { 592 u8 version; 593 int fd; 594 u32 tunnel_id; 595 u32 peer_tunnel_id; 596 u32 session_id; 597 u32 peer_session_id; 598 }; 599 600 static int pppol2tp_sockaddr_get_info(const void *sa, int sa_len, 601 struct l2tp_connect_info *info) 602 { 603 switch (sa_len) { 604 case sizeof(struct sockaddr_pppol2tp): 605 { 606 const struct sockaddr_pppol2tp *sa_v2in4 = sa; 607 608 if (sa_v2in4->sa_protocol != PX_PROTO_OL2TP) 609 return -EINVAL; 610 611 info->version = 2; 612 info->fd = sa_v2in4->pppol2tp.fd; 613 info->tunnel_id = sa_v2in4->pppol2tp.s_tunnel; 614 info->peer_tunnel_id = sa_v2in4->pppol2tp.d_tunnel; 615 info->session_id = sa_v2in4->pppol2tp.s_session; 616 info->peer_session_id = sa_v2in4->pppol2tp.d_session; 617 618 break; 619 } 620 case sizeof(struct sockaddr_pppol2tpv3): 621 { 622 const struct sockaddr_pppol2tpv3 *sa_v3in4 = sa; 623 624 if (sa_v3in4->sa_protocol != PX_PROTO_OL2TP) 625 return -EINVAL; 626 627 info->version = 3; 628 info->fd = sa_v3in4->pppol2tp.fd; 629 info->tunnel_id = sa_v3in4->pppol2tp.s_tunnel; 630 info->peer_tunnel_id = sa_v3in4->pppol2tp.d_tunnel; 631 info->session_id = sa_v3in4->pppol2tp.s_session; 632 info->peer_session_id = sa_v3in4->pppol2tp.d_session; 633 634 break; 635 } 636 case sizeof(struct sockaddr_pppol2tpin6): 637 { 638 const struct sockaddr_pppol2tpin6 *sa_v2in6 = sa; 639 640 if (sa_v2in6->sa_protocol != PX_PROTO_OL2TP) 641 return -EINVAL; 642 643 info->version = 2; 644 info->fd = sa_v2in6->pppol2tp.fd; 645 info->tunnel_id = sa_v2in6->pppol2tp.s_tunnel; 646 info->peer_tunnel_id = sa_v2in6->pppol2tp.d_tunnel; 647 info->session_id = sa_v2in6->pppol2tp.s_session; 648 info->peer_session_id = sa_v2in6->pppol2tp.d_session; 649 650 break; 651 } 652 case sizeof(struct sockaddr_pppol2tpv3in6): 653 { 654 const struct sockaddr_pppol2tpv3in6 *sa_v3in6 = sa; 655 656 if (sa_v3in6->sa_protocol != PX_PROTO_OL2TP) 657 return -EINVAL; 658 659 info->version = 3; 660 info->fd = sa_v3in6->pppol2tp.fd; 661 info->tunnel_id = sa_v3in6->pppol2tp.s_tunnel; 662 info->peer_tunnel_id = sa_v3in6->pppol2tp.d_tunnel; 663 info->session_id = sa_v3in6->pppol2tp.s_session; 664 info->peer_session_id = sa_v3in6->pppol2tp.d_session; 665 666 break; 667 } 668 default: 669 return -EINVAL; 670 } 671 672 return 0; 673 } 674 675 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket 676 */ 677 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 678 int sockaddr_len, int flags) 679 { 680 struct sock *sk = sock->sk; 681 struct pppox_sock *po = pppox_sk(sk); 682 struct l2tp_session *session = NULL; 683 struct l2tp_connect_info info; 684 struct l2tp_tunnel *tunnel; 685 struct pppol2tp_session *ps; 686 struct l2tp_session_cfg cfg = { 0, }; 687 bool drop_refcnt = false; 688 bool drop_tunnel = false; 689 bool new_session = false; 690 bool new_tunnel = false; 691 int error; 692 693 error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info); 694 if (error < 0) 695 return error; 696 697 lock_sock(sk); 698 699 /* Check for already bound sockets */ 700 error = -EBUSY; 701 if (sk->sk_state & PPPOX_CONNECTED) 702 goto end; 703 704 /* We don't supporting rebinding anyway */ 705 error = -EALREADY; 706 if (sk->sk_user_data) 707 goto end; /* socket is already attached */ 708 709 /* Don't bind if tunnel_id is 0 */ 710 error = -EINVAL; 711 if (!info.tunnel_id) 712 goto end; 713 714 tunnel = l2tp_tunnel_get(sock_net(sk), info.tunnel_id); 715 if (tunnel) 716 drop_tunnel = true; 717 718 /* Special case: create tunnel context if session_id and 719 * peer_session_id is 0. Otherwise look up tunnel using supplied 720 * tunnel id. 721 */ 722 if (!info.session_id && !info.peer_session_id) { 723 if (tunnel == NULL) { 724 struct l2tp_tunnel_cfg tcfg = { 725 .encap = L2TP_ENCAPTYPE_UDP, 726 .debug = 0, 727 }; 728 729 /* Prevent l2tp_tunnel_register() from trying to set up 730 * a kernel socket. 731 */ 732 if (info.fd < 0) { 733 error = -EBADF; 734 goto end; 735 } 736 737 error = l2tp_tunnel_create(sock_net(sk), info.fd, 738 info.version, 739 info.tunnel_id, 740 info.peer_tunnel_id, &tcfg, 741 &tunnel); 742 if (error < 0) 743 goto end; 744 745 l2tp_tunnel_inc_refcount(tunnel); 746 error = l2tp_tunnel_register(tunnel, sock_net(sk), 747 &tcfg); 748 if (error < 0) { 749 kfree(tunnel); 750 goto end; 751 } 752 drop_tunnel = true; 753 new_tunnel = true; 754 } 755 } else { 756 /* Error if we can't find the tunnel */ 757 error = -ENOENT; 758 if (tunnel == NULL) 759 goto end; 760 761 /* Error if socket is not prepped */ 762 if (tunnel->sock == NULL) 763 goto end; 764 } 765 766 if (tunnel->recv_payload_hook == NULL) 767 tunnel->recv_payload_hook = pppol2tp_recv_payload_hook; 768 769 if (tunnel->peer_tunnel_id == 0) 770 tunnel->peer_tunnel_id = info.peer_tunnel_id; 771 772 session = l2tp_session_get(sock_net(sk), tunnel, info.session_id); 773 if (session) { 774 drop_refcnt = true; 775 776 if (session->pwtype != L2TP_PWTYPE_PPP) { 777 error = -EPROTOTYPE; 778 goto end; 779 } 780 781 ps = l2tp_session_priv(session); 782 783 /* Using a pre-existing session is fine as long as it hasn't 784 * been connected yet. 785 */ 786 mutex_lock(&ps->sk_lock); 787 if (rcu_dereference_protected(ps->sk, 788 lockdep_is_held(&ps->sk_lock)) || 789 ps->__sk) { 790 mutex_unlock(&ps->sk_lock); 791 error = -EEXIST; 792 goto end; 793 } 794 } else { 795 /* Default MTU must allow space for UDP/L2TP/PPP headers */ 796 cfg.mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 797 cfg.mru = cfg.mtu; 798 cfg.pw_type = L2TP_PWTYPE_PPP; 799 800 session = l2tp_session_create(sizeof(struct pppol2tp_session), 801 tunnel, info.session_id, 802 info.peer_session_id, &cfg); 803 if (IS_ERR(session)) { 804 error = PTR_ERR(session); 805 goto end; 806 } 807 808 pppol2tp_session_init(session); 809 ps = l2tp_session_priv(session); 810 l2tp_session_inc_refcount(session); 811 812 mutex_lock(&ps->sk_lock); 813 error = l2tp_session_register(session, tunnel); 814 if (error < 0) { 815 mutex_unlock(&ps->sk_lock); 816 kfree(session); 817 goto end; 818 } 819 drop_refcnt = true; 820 new_session = true; 821 } 822 823 /* Special case: if source & dest session_id == 0x0000, this 824 * socket is being created to manage the tunnel. Just set up 825 * the internal context for use by ioctl() and sockopt() 826 * handlers. 827 */ 828 if ((session->session_id == 0) && 829 (session->peer_session_id == 0)) { 830 error = 0; 831 goto out_no_ppp; 832 } 833 834 /* The only header we need to worry about is the L2TP 835 * header. This size is different depending on whether 836 * sequence numbers are enabled for the data channel. 837 */ 838 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 839 840 po->chan.private = sk; 841 po->chan.ops = &pppol2tp_chan_ops; 842 po->chan.mtu = session->mtu; 843 844 error = ppp_register_net_channel(sock_net(sk), &po->chan); 845 if (error) { 846 mutex_unlock(&ps->sk_lock); 847 goto end; 848 } 849 850 out_no_ppp: 851 /* This is how we get the session context from the socket. */ 852 sk->sk_user_data = session; 853 rcu_assign_pointer(ps->sk, sk); 854 mutex_unlock(&ps->sk_lock); 855 856 /* Keep the reference we've grabbed on the session: sk doesn't expect 857 * the session to disappear. pppol2tp_session_destruct() is responsible 858 * for dropping it. 859 */ 860 drop_refcnt = false; 861 862 sk->sk_state = PPPOX_CONNECTED; 863 l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n", 864 session->name); 865 866 end: 867 if (error) { 868 if (new_session) 869 l2tp_session_delete(session); 870 if (new_tunnel) 871 l2tp_tunnel_delete(tunnel); 872 } 873 if (drop_refcnt) 874 l2tp_session_dec_refcount(session); 875 if (drop_tunnel) 876 l2tp_tunnel_dec_refcount(tunnel); 877 release_sock(sk); 878 879 return error; 880 } 881 882 #ifdef CONFIG_L2TP_V3 883 884 /* Called when creating sessions via the netlink interface. */ 885 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, 886 u32 session_id, u32 peer_session_id, 887 struct l2tp_session_cfg *cfg) 888 { 889 int error; 890 struct l2tp_session *session; 891 892 /* Error if tunnel socket is not prepped */ 893 if (!tunnel->sock) { 894 error = -ENOENT; 895 goto err; 896 } 897 898 /* Default MTU values. */ 899 if (cfg->mtu == 0) 900 cfg->mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 901 if (cfg->mru == 0) 902 cfg->mru = cfg->mtu; 903 904 /* Allocate and initialize a new session context. */ 905 session = l2tp_session_create(sizeof(struct pppol2tp_session), 906 tunnel, session_id, 907 peer_session_id, cfg); 908 if (IS_ERR(session)) { 909 error = PTR_ERR(session); 910 goto err; 911 } 912 913 pppol2tp_session_init(session); 914 915 error = l2tp_session_register(session, tunnel); 916 if (error < 0) 917 goto err_sess; 918 919 return 0; 920 921 err_sess: 922 kfree(session); 923 err: 924 return error; 925 } 926 927 #endif /* CONFIG_L2TP_V3 */ 928 929 /* getname() support. 930 */ 931 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr, 932 int peer) 933 { 934 int len = 0; 935 int error = 0; 936 struct l2tp_session *session; 937 struct l2tp_tunnel *tunnel; 938 struct sock *sk = sock->sk; 939 struct inet_sock *inet; 940 struct pppol2tp_session *pls; 941 942 error = -ENOTCONN; 943 if (sk == NULL) 944 goto end; 945 if (!(sk->sk_state & PPPOX_CONNECTED)) 946 goto end; 947 948 error = -EBADF; 949 session = pppol2tp_sock_to_session(sk); 950 if (session == NULL) 951 goto end; 952 953 pls = l2tp_session_priv(session); 954 tunnel = session->tunnel; 955 956 inet = inet_sk(tunnel->sock); 957 if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) { 958 struct sockaddr_pppol2tp sp; 959 len = sizeof(sp); 960 memset(&sp, 0, len); 961 sp.sa_family = AF_PPPOX; 962 sp.sa_protocol = PX_PROTO_OL2TP; 963 sp.pppol2tp.fd = tunnel->fd; 964 sp.pppol2tp.pid = pls->owner; 965 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 966 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 967 sp.pppol2tp.s_session = session->session_id; 968 sp.pppol2tp.d_session = session->peer_session_id; 969 sp.pppol2tp.addr.sin_family = AF_INET; 970 sp.pppol2tp.addr.sin_port = inet->inet_dport; 971 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 972 memcpy(uaddr, &sp, len); 973 #if IS_ENABLED(CONFIG_IPV6) 974 } else if ((tunnel->version == 2) && 975 (tunnel->sock->sk_family == AF_INET6)) { 976 struct sockaddr_pppol2tpin6 sp; 977 978 len = sizeof(sp); 979 memset(&sp, 0, len); 980 sp.sa_family = AF_PPPOX; 981 sp.sa_protocol = PX_PROTO_OL2TP; 982 sp.pppol2tp.fd = tunnel->fd; 983 sp.pppol2tp.pid = pls->owner; 984 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 985 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 986 sp.pppol2tp.s_session = session->session_id; 987 sp.pppol2tp.d_session = session->peer_session_id; 988 sp.pppol2tp.addr.sin6_family = AF_INET6; 989 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 990 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 991 sizeof(tunnel->sock->sk_v6_daddr)); 992 memcpy(uaddr, &sp, len); 993 } else if ((tunnel->version == 3) && 994 (tunnel->sock->sk_family == AF_INET6)) { 995 struct sockaddr_pppol2tpv3in6 sp; 996 997 len = sizeof(sp); 998 memset(&sp, 0, len); 999 sp.sa_family = AF_PPPOX; 1000 sp.sa_protocol = PX_PROTO_OL2TP; 1001 sp.pppol2tp.fd = tunnel->fd; 1002 sp.pppol2tp.pid = pls->owner; 1003 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 1004 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 1005 sp.pppol2tp.s_session = session->session_id; 1006 sp.pppol2tp.d_session = session->peer_session_id; 1007 sp.pppol2tp.addr.sin6_family = AF_INET6; 1008 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 1009 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 1010 sizeof(tunnel->sock->sk_v6_daddr)); 1011 memcpy(uaddr, &sp, len); 1012 #endif 1013 } else if (tunnel->version == 3) { 1014 struct sockaddr_pppol2tpv3 sp; 1015 len = sizeof(sp); 1016 memset(&sp, 0, len); 1017 sp.sa_family = AF_PPPOX; 1018 sp.sa_protocol = PX_PROTO_OL2TP; 1019 sp.pppol2tp.fd = tunnel->fd; 1020 sp.pppol2tp.pid = pls->owner; 1021 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 1022 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 1023 sp.pppol2tp.s_session = session->session_id; 1024 sp.pppol2tp.d_session = session->peer_session_id; 1025 sp.pppol2tp.addr.sin_family = AF_INET; 1026 sp.pppol2tp.addr.sin_port = inet->inet_dport; 1027 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 1028 memcpy(uaddr, &sp, len); 1029 } 1030 1031 error = len; 1032 1033 sock_put(sk); 1034 end: 1035 return error; 1036 } 1037 1038 /**************************************************************************** 1039 * ioctl() handlers. 1040 * 1041 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1042 * sockets. However, in order to control kernel tunnel features, we allow 1043 * userspace to create a special "tunnel" PPPoX socket which is used for 1044 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow 1045 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl() 1046 * calls. 1047 ****************************************************************************/ 1048 1049 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest, 1050 struct l2tp_stats *stats) 1051 { 1052 dest->tx_packets = atomic_long_read(&stats->tx_packets); 1053 dest->tx_bytes = atomic_long_read(&stats->tx_bytes); 1054 dest->tx_errors = atomic_long_read(&stats->tx_errors); 1055 dest->rx_packets = atomic_long_read(&stats->rx_packets); 1056 dest->rx_bytes = atomic_long_read(&stats->rx_bytes); 1057 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards); 1058 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets); 1059 dest->rx_errors = atomic_long_read(&stats->rx_errors); 1060 } 1061 1062 /* Session ioctl helper. 1063 */ 1064 static int pppol2tp_session_ioctl(struct l2tp_session *session, 1065 unsigned int cmd, unsigned long arg) 1066 { 1067 struct ifreq ifr; 1068 int err = 0; 1069 struct sock *sk; 1070 int val = (int) arg; 1071 struct pppol2tp_session *ps = l2tp_session_priv(session); 1072 struct l2tp_tunnel *tunnel = session->tunnel; 1073 struct pppol2tp_ioc_stats stats; 1074 1075 l2tp_dbg(session, L2TP_MSG_CONTROL, 1076 "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n", 1077 session->name, cmd, arg); 1078 1079 sk = pppol2tp_session_get_sock(session); 1080 if (!sk) 1081 return -EBADR; 1082 1083 switch (cmd) { 1084 case SIOCGIFMTU: 1085 err = -ENXIO; 1086 if (!(sk->sk_state & PPPOX_CONNECTED)) 1087 break; 1088 1089 err = -EFAULT; 1090 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1091 break; 1092 ifr.ifr_mtu = session->mtu; 1093 if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq))) 1094 break; 1095 1096 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mtu=%d\n", 1097 session->name, session->mtu); 1098 err = 0; 1099 break; 1100 1101 case SIOCSIFMTU: 1102 err = -ENXIO; 1103 if (!(sk->sk_state & PPPOX_CONNECTED)) 1104 break; 1105 1106 err = -EFAULT; 1107 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1108 break; 1109 1110 session->mtu = ifr.ifr_mtu; 1111 1112 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mtu=%d\n", 1113 session->name, session->mtu); 1114 err = 0; 1115 break; 1116 1117 case PPPIOCGMRU: 1118 err = -ENXIO; 1119 if (!(sk->sk_state & PPPOX_CONNECTED)) 1120 break; 1121 1122 err = -EFAULT; 1123 if (put_user(session->mru, (int __user *) arg)) 1124 break; 1125 1126 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mru=%d\n", 1127 session->name, session->mru); 1128 err = 0; 1129 break; 1130 1131 case PPPIOCSMRU: 1132 err = -ENXIO; 1133 if (!(sk->sk_state & PPPOX_CONNECTED)) 1134 break; 1135 1136 err = -EFAULT; 1137 if (get_user(val, (int __user *) arg)) 1138 break; 1139 1140 session->mru = val; 1141 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mru=%d\n", 1142 session->name, session->mru); 1143 err = 0; 1144 break; 1145 1146 case PPPIOCGFLAGS: 1147 err = -EFAULT; 1148 if (put_user(ps->flags, (int __user *) arg)) 1149 break; 1150 1151 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get flags=%d\n", 1152 session->name, ps->flags); 1153 err = 0; 1154 break; 1155 1156 case PPPIOCSFLAGS: 1157 err = -EFAULT; 1158 if (get_user(val, (int __user *) arg)) 1159 break; 1160 ps->flags = val; 1161 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set flags=%d\n", 1162 session->name, ps->flags); 1163 err = 0; 1164 break; 1165 1166 case PPPIOCGL2TPSTATS: 1167 err = -ENXIO; 1168 if (!(sk->sk_state & PPPOX_CONNECTED)) 1169 break; 1170 1171 memset(&stats, 0, sizeof(stats)); 1172 stats.tunnel_id = tunnel->tunnel_id; 1173 stats.session_id = session->session_id; 1174 pppol2tp_copy_stats(&stats, &session->stats); 1175 if (copy_to_user((void __user *) arg, &stats, 1176 sizeof(stats))) 1177 break; 1178 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1179 session->name); 1180 err = 0; 1181 break; 1182 1183 default: 1184 err = -ENOSYS; 1185 break; 1186 } 1187 1188 sock_put(sk); 1189 1190 return err; 1191 } 1192 1193 /* Tunnel ioctl helper. 1194 * 1195 * Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data 1196 * specifies a session_id, the session ioctl handler is called. This allows an 1197 * application to retrieve session stats via a tunnel socket. 1198 */ 1199 static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel, 1200 unsigned int cmd, unsigned long arg) 1201 { 1202 int err = 0; 1203 struct sock *sk; 1204 struct pppol2tp_ioc_stats stats; 1205 1206 l2tp_dbg(tunnel, L2TP_MSG_CONTROL, 1207 "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n", 1208 tunnel->name, cmd, arg); 1209 1210 sk = tunnel->sock; 1211 sock_hold(sk); 1212 1213 switch (cmd) { 1214 case PPPIOCGL2TPSTATS: 1215 err = -ENXIO; 1216 if (!(sk->sk_state & PPPOX_CONNECTED)) 1217 break; 1218 1219 if (copy_from_user(&stats, (void __user *) arg, 1220 sizeof(stats))) { 1221 err = -EFAULT; 1222 break; 1223 } 1224 if (stats.session_id != 0) { 1225 /* resend to session ioctl handler */ 1226 struct l2tp_session *session = 1227 l2tp_session_get(sock_net(sk), tunnel, 1228 stats.session_id); 1229 1230 if (session && session->pwtype == L2TP_PWTYPE_PPP) { 1231 err = pppol2tp_session_ioctl(session, cmd, 1232 arg); 1233 l2tp_session_dec_refcount(session); 1234 } else { 1235 err = -EBADR; 1236 } 1237 break; 1238 } 1239 #ifdef CONFIG_XFRM 1240 stats.using_ipsec = (sk->sk_policy[0] || sk->sk_policy[1]) ? 1 : 0; 1241 #endif 1242 pppol2tp_copy_stats(&stats, &tunnel->stats); 1243 if (copy_to_user((void __user *) arg, &stats, sizeof(stats))) { 1244 err = -EFAULT; 1245 break; 1246 } 1247 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1248 tunnel->name); 1249 err = 0; 1250 break; 1251 1252 default: 1253 err = -ENOSYS; 1254 break; 1255 } 1256 1257 sock_put(sk); 1258 1259 return err; 1260 } 1261 1262 /* Main ioctl() handler. 1263 * Dispatch to tunnel or session helpers depending on the socket. 1264 */ 1265 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, 1266 unsigned long arg) 1267 { 1268 struct sock *sk = sock->sk; 1269 struct l2tp_session *session; 1270 struct l2tp_tunnel *tunnel; 1271 int err; 1272 1273 if (!sk) 1274 return 0; 1275 1276 err = -EBADF; 1277 if (sock_flag(sk, SOCK_DEAD) != 0) 1278 goto end; 1279 1280 err = -ENOTCONN; 1281 if ((sk->sk_user_data == NULL) || 1282 (!(sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)))) 1283 goto end; 1284 1285 /* Get session context from the socket */ 1286 err = -EBADF; 1287 session = pppol2tp_sock_to_session(sk); 1288 if (session == NULL) 1289 goto end; 1290 1291 /* Special case: if session's session_id is zero, treat ioctl as a 1292 * tunnel ioctl 1293 */ 1294 if ((session->session_id == 0) && 1295 (session->peer_session_id == 0)) { 1296 tunnel = session->tunnel; 1297 err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg); 1298 goto end_put_sess; 1299 } 1300 1301 err = pppol2tp_session_ioctl(session, cmd, arg); 1302 1303 end_put_sess: 1304 sock_put(sk); 1305 end: 1306 return err; 1307 } 1308 1309 /***************************************************************************** 1310 * setsockopt() / getsockopt() support. 1311 * 1312 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1313 * sockets. In order to control kernel tunnel features, we allow userspace to 1314 * create a special "tunnel" PPPoX socket which is used for control only. 1315 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user 1316 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls. 1317 *****************************************************************************/ 1318 1319 /* Tunnel setsockopt() helper. 1320 */ 1321 static int pppol2tp_tunnel_setsockopt(struct sock *sk, 1322 struct l2tp_tunnel *tunnel, 1323 int optname, int val) 1324 { 1325 int err = 0; 1326 1327 switch (optname) { 1328 case PPPOL2TP_SO_DEBUG: 1329 tunnel->debug = val; 1330 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1331 tunnel->name, tunnel->debug); 1332 break; 1333 1334 default: 1335 err = -ENOPROTOOPT; 1336 break; 1337 } 1338 1339 return err; 1340 } 1341 1342 /* Session setsockopt helper. 1343 */ 1344 static int pppol2tp_session_setsockopt(struct sock *sk, 1345 struct l2tp_session *session, 1346 int optname, int val) 1347 { 1348 int err = 0; 1349 1350 switch (optname) { 1351 case PPPOL2TP_SO_RECVSEQ: 1352 if ((val != 0) && (val != 1)) { 1353 err = -EINVAL; 1354 break; 1355 } 1356 session->recv_seq = !!val; 1357 l2tp_info(session, L2TP_MSG_CONTROL, 1358 "%s: set recv_seq=%d\n", 1359 session->name, session->recv_seq); 1360 break; 1361 1362 case PPPOL2TP_SO_SENDSEQ: 1363 if ((val != 0) && (val != 1)) { 1364 err = -EINVAL; 1365 break; 1366 } 1367 session->send_seq = !!val; 1368 { 1369 struct pppox_sock *po = pppox_sk(sk); 1370 1371 po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ : 1372 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 1373 } 1374 l2tp_session_set_header_len(session, session->tunnel->version); 1375 l2tp_info(session, L2TP_MSG_CONTROL, 1376 "%s: set send_seq=%d\n", 1377 session->name, session->send_seq); 1378 break; 1379 1380 case PPPOL2TP_SO_LNSMODE: 1381 if ((val != 0) && (val != 1)) { 1382 err = -EINVAL; 1383 break; 1384 } 1385 session->lns_mode = !!val; 1386 l2tp_info(session, L2TP_MSG_CONTROL, 1387 "%s: set lns_mode=%d\n", 1388 session->name, session->lns_mode); 1389 break; 1390 1391 case PPPOL2TP_SO_DEBUG: 1392 session->debug = val; 1393 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1394 session->name, session->debug); 1395 break; 1396 1397 case PPPOL2TP_SO_REORDERTO: 1398 session->reorder_timeout = msecs_to_jiffies(val); 1399 l2tp_info(session, L2TP_MSG_CONTROL, 1400 "%s: set reorder_timeout=%d\n", 1401 session->name, session->reorder_timeout); 1402 break; 1403 1404 default: 1405 err = -ENOPROTOOPT; 1406 break; 1407 } 1408 1409 return err; 1410 } 1411 1412 /* Main setsockopt() entry point. 1413 * Does API checks, then calls either the tunnel or session setsockopt 1414 * handler, according to whether the PPPoL2TP socket is a for a regular 1415 * session or the special tunnel type. 1416 */ 1417 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, 1418 char __user *optval, unsigned int optlen) 1419 { 1420 struct sock *sk = sock->sk; 1421 struct l2tp_session *session; 1422 struct l2tp_tunnel *tunnel; 1423 int val; 1424 int err; 1425 1426 if (level != SOL_PPPOL2TP) 1427 return -EINVAL; 1428 1429 if (optlen < sizeof(int)) 1430 return -EINVAL; 1431 1432 if (get_user(val, (int __user *)optval)) 1433 return -EFAULT; 1434 1435 err = -ENOTCONN; 1436 if (sk->sk_user_data == NULL) 1437 goto end; 1438 1439 /* Get session context from the socket */ 1440 err = -EBADF; 1441 session = pppol2tp_sock_to_session(sk); 1442 if (session == NULL) 1443 goto end; 1444 1445 /* Special case: if session_id == 0x0000, treat as operation on tunnel 1446 */ 1447 if ((session->session_id == 0) && 1448 (session->peer_session_id == 0)) { 1449 tunnel = session->tunnel; 1450 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val); 1451 } else { 1452 err = pppol2tp_session_setsockopt(sk, session, optname, val); 1453 } 1454 1455 sock_put(sk); 1456 end: 1457 return err; 1458 } 1459 1460 /* Tunnel getsockopt helper. Called with sock locked. 1461 */ 1462 static int pppol2tp_tunnel_getsockopt(struct sock *sk, 1463 struct l2tp_tunnel *tunnel, 1464 int optname, int *val) 1465 { 1466 int err = 0; 1467 1468 switch (optname) { 1469 case PPPOL2TP_SO_DEBUG: 1470 *val = tunnel->debug; 1471 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get debug=%x\n", 1472 tunnel->name, tunnel->debug); 1473 break; 1474 1475 default: 1476 err = -ENOPROTOOPT; 1477 break; 1478 } 1479 1480 return err; 1481 } 1482 1483 /* Session getsockopt helper. Called with sock locked. 1484 */ 1485 static int pppol2tp_session_getsockopt(struct sock *sk, 1486 struct l2tp_session *session, 1487 int optname, int *val) 1488 { 1489 int err = 0; 1490 1491 switch (optname) { 1492 case PPPOL2TP_SO_RECVSEQ: 1493 *val = session->recv_seq; 1494 l2tp_info(session, L2TP_MSG_CONTROL, 1495 "%s: get recv_seq=%d\n", session->name, *val); 1496 break; 1497 1498 case PPPOL2TP_SO_SENDSEQ: 1499 *val = session->send_seq; 1500 l2tp_info(session, L2TP_MSG_CONTROL, 1501 "%s: get send_seq=%d\n", session->name, *val); 1502 break; 1503 1504 case PPPOL2TP_SO_LNSMODE: 1505 *val = session->lns_mode; 1506 l2tp_info(session, L2TP_MSG_CONTROL, 1507 "%s: get lns_mode=%d\n", session->name, *val); 1508 break; 1509 1510 case PPPOL2TP_SO_DEBUG: 1511 *val = session->debug; 1512 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get debug=%d\n", 1513 session->name, *val); 1514 break; 1515 1516 case PPPOL2TP_SO_REORDERTO: 1517 *val = (int) jiffies_to_msecs(session->reorder_timeout); 1518 l2tp_info(session, L2TP_MSG_CONTROL, 1519 "%s: get reorder_timeout=%d\n", session->name, *val); 1520 break; 1521 1522 default: 1523 err = -ENOPROTOOPT; 1524 } 1525 1526 return err; 1527 } 1528 1529 /* Main getsockopt() entry point. 1530 * Does API checks, then calls either the tunnel or session getsockopt 1531 * handler, according to whether the PPPoX socket is a for a regular session 1532 * or the special tunnel type. 1533 */ 1534 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, 1535 char __user *optval, int __user *optlen) 1536 { 1537 struct sock *sk = sock->sk; 1538 struct l2tp_session *session; 1539 struct l2tp_tunnel *tunnel; 1540 int val, len; 1541 int err; 1542 1543 if (level != SOL_PPPOL2TP) 1544 return -EINVAL; 1545 1546 if (get_user(len, optlen)) 1547 return -EFAULT; 1548 1549 len = min_t(unsigned int, len, sizeof(int)); 1550 1551 if (len < 0) 1552 return -EINVAL; 1553 1554 err = -ENOTCONN; 1555 if (sk->sk_user_data == NULL) 1556 goto end; 1557 1558 /* Get the session context */ 1559 err = -EBADF; 1560 session = pppol2tp_sock_to_session(sk); 1561 if (session == NULL) 1562 goto end; 1563 1564 /* Special case: if session_id == 0x0000, treat as operation on tunnel */ 1565 if ((session->session_id == 0) && 1566 (session->peer_session_id == 0)) { 1567 tunnel = session->tunnel; 1568 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val); 1569 if (err) 1570 goto end_put_sess; 1571 } else { 1572 err = pppol2tp_session_getsockopt(sk, session, optname, &val); 1573 if (err) 1574 goto end_put_sess; 1575 } 1576 1577 err = -EFAULT; 1578 if (put_user(len, optlen)) 1579 goto end_put_sess; 1580 1581 if (copy_to_user((void __user *) optval, &val, len)) 1582 goto end_put_sess; 1583 1584 err = 0; 1585 1586 end_put_sess: 1587 sock_put(sk); 1588 end: 1589 return err; 1590 } 1591 1592 /***************************************************************************** 1593 * /proc filesystem for debug 1594 * Since the original pppol2tp driver provided /proc/net/pppol2tp for 1595 * L2TPv2, we dump only L2TPv2 tunnels and sessions here. 1596 *****************************************************************************/ 1597 1598 static unsigned int pppol2tp_net_id; 1599 1600 #ifdef CONFIG_PROC_FS 1601 1602 struct pppol2tp_seq_data { 1603 struct seq_net_private p; 1604 int tunnel_idx; /* current tunnel */ 1605 int session_idx; /* index of session within current tunnel */ 1606 struct l2tp_tunnel *tunnel; 1607 struct l2tp_session *session; /* NULL means get next tunnel */ 1608 }; 1609 1610 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) 1611 { 1612 /* Drop reference taken during previous invocation */ 1613 if (pd->tunnel) 1614 l2tp_tunnel_dec_refcount(pd->tunnel); 1615 1616 for (;;) { 1617 pd->tunnel = l2tp_tunnel_get_nth(net, pd->tunnel_idx); 1618 pd->tunnel_idx++; 1619 1620 /* Only accept L2TPv2 tunnels */ 1621 if (!pd->tunnel || pd->tunnel->version == 2) 1622 return; 1623 1624 l2tp_tunnel_dec_refcount(pd->tunnel); 1625 } 1626 } 1627 1628 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) 1629 { 1630 /* Drop reference taken during previous invocation */ 1631 if (pd->session) 1632 l2tp_session_dec_refcount(pd->session); 1633 1634 pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx); 1635 pd->session_idx++; 1636 1637 if (pd->session == NULL) { 1638 pd->session_idx = 0; 1639 pppol2tp_next_tunnel(net, pd); 1640 } 1641 } 1642 1643 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs) 1644 { 1645 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN; 1646 loff_t pos = *offs; 1647 struct net *net; 1648 1649 if (!pos) 1650 goto out; 1651 1652 BUG_ON(m->private == NULL); 1653 pd = m->private; 1654 net = seq_file_net(m); 1655 1656 if (pd->tunnel == NULL) 1657 pppol2tp_next_tunnel(net, pd); 1658 else 1659 pppol2tp_next_session(net, pd); 1660 1661 /* NULL tunnel and session indicates end of list */ 1662 if ((pd->tunnel == NULL) && (pd->session == NULL)) 1663 pd = NULL; 1664 1665 out: 1666 return pd; 1667 } 1668 1669 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos) 1670 { 1671 (*pos)++; 1672 return NULL; 1673 } 1674 1675 static void pppol2tp_seq_stop(struct seq_file *p, void *v) 1676 { 1677 struct pppol2tp_seq_data *pd = v; 1678 1679 if (!pd || pd == SEQ_START_TOKEN) 1680 return; 1681 1682 /* Drop reference taken by last invocation of pppol2tp_next_session() 1683 * or pppol2tp_next_tunnel(). 1684 */ 1685 if (pd->session) { 1686 l2tp_session_dec_refcount(pd->session); 1687 pd->session = NULL; 1688 } 1689 if (pd->tunnel) { 1690 l2tp_tunnel_dec_refcount(pd->tunnel); 1691 pd->tunnel = NULL; 1692 } 1693 } 1694 1695 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) 1696 { 1697 struct l2tp_tunnel *tunnel = v; 1698 1699 seq_printf(m, "\nTUNNEL '%s', %c %d\n", 1700 tunnel->name, 1701 (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N', 1702 refcount_read(&tunnel->ref_count) - 1); 1703 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n", 1704 tunnel->debug, 1705 atomic_long_read(&tunnel->stats.tx_packets), 1706 atomic_long_read(&tunnel->stats.tx_bytes), 1707 atomic_long_read(&tunnel->stats.tx_errors), 1708 atomic_long_read(&tunnel->stats.rx_packets), 1709 atomic_long_read(&tunnel->stats.rx_bytes), 1710 atomic_long_read(&tunnel->stats.rx_errors)); 1711 } 1712 1713 static void pppol2tp_seq_session_show(struct seq_file *m, void *v) 1714 { 1715 struct l2tp_session *session = v; 1716 struct l2tp_tunnel *tunnel = session->tunnel; 1717 unsigned char state; 1718 char user_data_ok; 1719 struct sock *sk; 1720 u32 ip = 0; 1721 u16 port = 0; 1722 1723 if (tunnel->sock) { 1724 struct inet_sock *inet = inet_sk(tunnel->sock); 1725 ip = ntohl(inet->inet_saddr); 1726 port = ntohs(inet->inet_sport); 1727 } 1728 1729 sk = pppol2tp_session_get_sock(session); 1730 if (sk) { 1731 state = sk->sk_state; 1732 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N'; 1733 } else { 1734 state = 0; 1735 user_data_ok = 'N'; 1736 } 1737 1738 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> " 1739 "%04X/%04X %d %c\n", 1740 session->name, ip, port, 1741 tunnel->tunnel_id, 1742 session->session_id, 1743 tunnel->peer_tunnel_id, 1744 session->peer_session_id, 1745 state, user_data_ok); 1746 seq_printf(m, " %d/%d/%c/%c/%s %08x %u\n", 1747 session->mtu, session->mru, 1748 session->recv_seq ? 'R' : '-', 1749 session->send_seq ? 'S' : '-', 1750 session->lns_mode ? "LNS" : "LAC", 1751 session->debug, 1752 jiffies_to_msecs(session->reorder_timeout)); 1753 seq_printf(m, " %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n", 1754 session->nr, session->ns, 1755 atomic_long_read(&session->stats.tx_packets), 1756 atomic_long_read(&session->stats.tx_bytes), 1757 atomic_long_read(&session->stats.tx_errors), 1758 atomic_long_read(&session->stats.rx_packets), 1759 atomic_long_read(&session->stats.rx_bytes), 1760 atomic_long_read(&session->stats.rx_errors)); 1761 1762 if (sk) { 1763 struct pppox_sock *po = pppox_sk(sk); 1764 1765 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 1766 sock_put(sk); 1767 } 1768 } 1769 1770 static int pppol2tp_seq_show(struct seq_file *m, void *v) 1771 { 1772 struct pppol2tp_seq_data *pd = v; 1773 1774 /* display header on line 1 */ 1775 if (v == SEQ_START_TOKEN) { 1776 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n"); 1777 seq_puts(m, "TUNNEL name, user-data-ok session-count\n"); 1778 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1779 seq_puts(m, " SESSION name, addr/port src-tid/sid " 1780 "dest-tid/sid state user-data-ok\n"); 1781 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n"); 1782 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1783 goto out; 1784 } 1785 1786 if (!pd->session) 1787 pppol2tp_seq_tunnel_show(m, pd->tunnel); 1788 else 1789 pppol2tp_seq_session_show(m, pd->session); 1790 1791 out: 1792 return 0; 1793 } 1794 1795 static const struct seq_operations pppol2tp_seq_ops = { 1796 .start = pppol2tp_seq_start, 1797 .next = pppol2tp_seq_next, 1798 .stop = pppol2tp_seq_stop, 1799 .show = pppol2tp_seq_show, 1800 }; 1801 #endif /* CONFIG_PROC_FS */ 1802 1803 /***************************************************************************** 1804 * Network namespace 1805 *****************************************************************************/ 1806 1807 static __net_init int pppol2tp_init_net(struct net *net) 1808 { 1809 struct proc_dir_entry *pde; 1810 int err = 0; 1811 1812 pde = proc_create_net("pppol2tp", 0444, net->proc_net, 1813 &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data)); 1814 if (!pde) { 1815 err = -ENOMEM; 1816 goto out; 1817 } 1818 1819 out: 1820 return err; 1821 } 1822 1823 static __net_exit void pppol2tp_exit_net(struct net *net) 1824 { 1825 remove_proc_entry("pppol2tp", net->proc_net); 1826 } 1827 1828 static struct pernet_operations pppol2tp_net_ops = { 1829 .init = pppol2tp_init_net, 1830 .exit = pppol2tp_exit_net, 1831 .id = &pppol2tp_net_id, 1832 }; 1833 1834 /***************************************************************************** 1835 * Init and cleanup 1836 *****************************************************************************/ 1837 1838 static const struct proto_ops pppol2tp_ops = { 1839 .family = AF_PPPOX, 1840 .owner = THIS_MODULE, 1841 .release = pppol2tp_release, 1842 .bind = sock_no_bind, 1843 .connect = pppol2tp_connect, 1844 .socketpair = sock_no_socketpair, 1845 .accept = sock_no_accept, 1846 .getname = pppol2tp_getname, 1847 .poll = datagram_poll, 1848 .listen = sock_no_listen, 1849 .shutdown = sock_no_shutdown, 1850 .setsockopt = pppol2tp_setsockopt, 1851 .getsockopt = pppol2tp_getsockopt, 1852 .sendmsg = pppol2tp_sendmsg, 1853 .recvmsg = pppol2tp_recvmsg, 1854 .mmap = sock_no_mmap, 1855 .ioctl = pppox_ioctl, 1856 }; 1857 1858 static const struct pppox_proto pppol2tp_proto = { 1859 .create = pppol2tp_create, 1860 .ioctl = pppol2tp_ioctl, 1861 .owner = THIS_MODULE, 1862 }; 1863 1864 #ifdef CONFIG_L2TP_V3 1865 1866 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = { 1867 .session_create = pppol2tp_session_create, 1868 .session_delete = l2tp_session_delete, 1869 }; 1870 1871 #endif /* CONFIG_L2TP_V3 */ 1872 1873 static int __init pppol2tp_init(void) 1874 { 1875 int err; 1876 1877 err = register_pernet_device(&pppol2tp_net_ops); 1878 if (err) 1879 goto out; 1880 1881 err = proto_register(&pppol2tp_sk_proto, 0); 1882 if (err) 1883 goto out_unregister_pppol2tp_pernet; 1884 1885 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto); 1886 if (err) 1887 goto out_unregister_pppol2tp_proto; 1888 1889 #ifdef CONFIG_L2TP_V3 1890 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops); 1891 if (err) 1892 goto out_unregister_pppox; 1893 #endif 1894 1895 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION); 1896 1897 out: 1898 return err; 1899 1900 #ifdef CONFIG_L2TP_V3 1901 out_unregister_pppox: 1902 unregister_pppox_proto(PX_PROTO_OL2TP); 1903 #endif 1904 out_unregister_pppol2tp_proto: 1905 proto_unregister(&pppol2tp_sk_proto); 1906 out_unregister_pppol2tp_pernet: 1907 unregister_pernet_device(&pppol2tp_net_ops); 1908 goto out; 1909 } 1910 1911 static void __exit pppol2tp_exit(void) 1912 { 1913 #ifdef CONFIG_L2TP_V3 1914 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP); 1915 #endif 1916 unregister_pppox_proto(PX_PROTO_OL2TP); 1917 proto_unregister(&pppol2tp_sk_proto); 1918 unregister_pernet_device(&pppol2tp_net_ops); 1919 } 1920 1921 module_init(pppol2tp_init); 1922 module_exit(pppol2tp_exit); 1923 1924 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1925 MODULE_DESCRIPTION("PPP over L2TP over UDP"); 1926 MODULE_LICENSE("GPL"); 1927 MODULE_VERSION(PPPOL2TP_DRV_VERSION); 1928 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP); 1929 MODULE_ALIAS_L2TP_PWTYPE(7); 1930