1 /***************************************************************************** 2 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets 3 * 4 * PPPoX --- Generic PPP encapsulation socket family 5 * PPPoL2TP --- PPP over L2TP (RFC 2661) 6 * 7 * Version: 2.0.0 8 * 9 * Authors: James Chapman (jchapman@katalix.com) 10 * 11 * Based on original work by Martijn van Oosterhout <kleptog@svana.org> 12 * 13 * License: 14 * This program is free software; you can redistribute it and/or 15 * modify it under the terms of the GNU General Public License 16 * as published by the Free Software Foundation; either version 17 * 2 of the License, or (at your option) any later version. 18 * 19 */ 20 21 /* This driver handles only L2TP data frames; control frames are handled by a 22 * userspace application. 23 * 24 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and 25 * attaches it to a bound UDP socket with local tunnel_id / session_id and 26 * peer tunnel_id / session_id set. Data can then be sent or received using 27 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket 28 * can be read or modified using ioctl() or [gs]etsockopt() calls. 29 * 30 * When a PPPoL2TP socket is connected with local and peer session_id values 31 * zero, the socket is treated as a special tunnel management socket. 32 * 33 * Here's example userspace code to create a socket for sending/receiving data 34 * over an L2TP session:- 35 * 36 * struct sockaddr_pppol2tp sax; 37 * int fd; 38 * int session_fd; 39 * 40 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); 41 * 42 * sax.sa_family = AF_PPPOX; 43 * sax.sa_protocol = PX_PROTO_OL2TP; 44 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket 45 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr; 46 * sax.pppol2tp.addr.sin_port = addr->sin_port; 47 * sax.pppol2tp.addr.sin_family = AF_INET; 48 * sax.pppol2tp.s_tunnel = tunnel_id; 49 * sax.pppol2tp.s_session = session_id; 50 * sax.pppol2tp.d_tunnel = peer_tunnel_id; 51 * sax.pppol2tp.d_session = peer_session_id; 52 * 53 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax)); 54 * 55 * A pppd plugin that allows PPP traffic to be carried over L2TP using 56 * this driver is available from the OpenL2TP project at 57 * http://openl2tp.sourceforge.net. 58 */ 59 60 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 61 62 #include <linux/module.h> 63 #include <linux/string.h> 64 #include <linux/list.h> 65 #include <linux/uaccess.h> 66 67 #include <linux/kernel.h> 68 #include <linux/spinlock.h> 69 #include <linux/kthread.h> 70 #include <linux/sched.h> 71 #include <linux/slab.h> 72 #include <linux/errno.h> 73 #include <linux/jiffies.h> 74 75 #include <linux/netdevice.h> 76 #include <linux/net.h> 77 #include <linux/inetdevice.h> 78 #include <linux/skbuff.h> 79 #include <linux/init.h> 80 #include <linux/ip.h> 81 #include <linux/udp.h> 82 #include <linux/if_pppox.h> 83 #include <linux/if_pppol2tp.h> 84 #include <net/sock.h> 85 #include <linux/ppp_channel.h> 86 #include <linux/ppp_defs.h> 87 #include <linux/ppp-ioctl.h> 88 #include <linux/file.h> 89 #include <linux/hash.h> 90 #include <linux/sort.h> 91 #include <linux/proc_fs.h> 92 #include <linux/l2tp.h> 93 #include <linux/nsproxy.h> 94 #include <net/net_namespace.h> 95 #include <net/netns/generic.h> 96 #include <net/dst.h> 97 #include <net/ip.h> 98 #include <net/udp.h> 99 #include <net/xfrm.h> 100 #include <net/inet_common.h> 101 102 #include <asm/byteorder.h> 103 #include <linux/atomic.h> 104 105 #include "l2tp_core.h" 106 107 #define PPPOL2TP_DRV_VERSION "V2.0" 108 109 /* Space for UDP, L2TP and PPP headers */ 110 #define PPPOL2TP_HEADER_OVERHEAD 40 111 112 /* Number of bytes to build transmit L2TP headers. 113 * Unfortunately the size is different depending on whether sequence numbers 114 * are enabled. 115 */ 116 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10 117 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6 118 119 /* Private data of each session. This data lives at the end of struct 120 * l2tp_session, referenced via session->priv[]. 121 */ 122 struct pppol2tp_session { 123 int owner; /* pid that opened the socket */ 124 125 struct mutex sk_lock; /* Protects .sk */ 126 struct sock __rcu *sk; /* Pointer to the session 127 * PPPoX socket */ 128 struct sock *__sk; /* Copy of .sk, for cleanup */ 129 struct rcu_head rcu; /* For asynchronous release */ 130 struct sock *tunnel_sock; /* Pointer to the tunnel UDP 131 * socket */ 132 int flags; /* accessed by PPPIOCGFLAGS. 133 * Unused. */ 134 }; 135 136 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb); 137 138 static const struct ppp_channel_ops pppol2tp_chan_ops = { 139 .start_xmit = pppol2tp_xmit, 140 }; 141 142 static const struct proto_ops pppol2tp_ops; 143 144 /* Retrieves the pppol2tp socket associated to a session. 145 * A reference is held on the returned socket, so this function must be paired 146 * with sock_put(). 147 */ 148 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) 149 { 150 struct pppol2tp_session *ps = l2tp_session_priv(session); 151 struct sock *sk; 152 153 rcu_read_lock(); 154 sk = rcu_dereference(ps->sk); 155 if (sk) 156 sock_hold(sk); 157 rcu_read_unlock(); 158 159 return sk; 160 } 161 162 /* Helpers to obtain tunnel/session contexts from sockets. 163 */ 164 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) 165 { 166 struct l2tp_session *session; 167 168 if (sk == NULL) 169 return NULL; 170 171 sock_hold(sk); 172 session = (struct l2tp_session *)(sk->sk_user_data); 173 if (session == NULL) { 174 sock_put(sk); 175 goto out; 176 } 177 178 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 179 180 out: 181 return session; 182 } 183 184 /***************************************************************************** 185 * Receive data handling 186 *****************************************************************************/ 187 188 static int pppol2tp_recv_payload_hook(struct sk_buff *skb) 189 { 190 /* Skip PPP header, if present. In testing, Microsoft L2TP clients 191 * don't send the PPP header (PPP header compression enabled), but 192 * other clients can include the header. So we cope with both cases 193 * here. The PPP header is always FF03 when using L2TP. 194 * 195 * Note that skb->data[] isn't dereferenced from a u16 ptr here since 196 * the field may be unaligned. 197 */ 198 if (!pskb_may_pull(skb, 2)) 199 return 1; 200 201 if ((skb->data[0] == PPP_ALLSTATIONS) && (skb->data[1] == PPP_UI)) 202 skb_pull(skb, 2); 203 204 return 0; 205 } 206 207 /* Receive message. This is the recvmsg for the PPPoL2TP socket. 208 */ 209 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, 210 size_t len, int flags) 211 { 212 int err; 213 struct sk_buff *skb; 214 struct sock *sk = sock->sk; 215 216 err = -EIO; 217 if (sk->sk_state & PPPOX_BOUND) 218 goto end; 219 220 err = 0; 221 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 222 flags & MSG_DONTWAIT, &err); 223 if (!skb) 224 goto end; 225 226 if (len > skb->len) 227 len = skb->len; 228 else if (len < skb->len) 229 msg->msg_flags |= MSG_TRUNC; 230 231 err = skb_copy_datagram_msg(skb, 0, msg, len); 232 if (likely(err == 0)) 233 err = len; 234 235 kfree_skb(skb); 236 end: 237 return err; 238 } 239 240 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) 241 { 242 struct pppol2tp_session *ps = l2tp_session_priv(session); 243 struct sock *sk = NULL; 244 245 /* If the socket is bound, send it in to PPP's input queue. Otherwise 246 * queue it on the session socket. 247 */ 248 rcu_read_lock(); 249 sk = rcu_dereference(ps->sk); 250 if (sk == NULL) 251 goto no_sock; 252 253 if (sk->sk_state & PPPOX_BOUND) { 254 struct pppox_sock *po; 255 256 l2tp_dbg(session, L2TP_MSG_DATA, 257 "%s: recv %d byte data frame, passing to ppp\n", 258 session->name, data_len); 259 260 po = pppox_sk(sk); 261 ppp_input(&po->chan, skb); 262 } else { 263 l2tp_dbg(session, L2TP_MSG_DATA, 264 "%s: recv %d byte data frame, passing to L2TP socket\n", 265 session->name, data_len); 266 267 if (sock_queue_rcv_skb(sk, skb) < 0) { 268 atomic_long_inc(&session->stats.rx_errors); 269 kfree_skb(skb); 270 } 271 } 272 rcu_read_unlock(); 273 274 return; 275 276 no_sock: 277 rcu_read_unlock(); 278 l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name); 279 kfree_skb(skb); 280 } 281 282 /************************************************************************ 283 * Transmit handling 284 ***********************************************************************/ 285 286 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here 287 * when a user application does a sendmsg() on the session socket. L2TP and 288 * PPP headers must be inserted into the user's data. 289 */ 290 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m, 291 size_t total_len) 292 { 293 struct sock *sk = sock->sk; 294 struct sk_buff *skb; 295 int error; 296 struct l2tp_session *session; 297 struct l2tp_tunnel *tunnel; 298 struct pppol2tp_session *ps; 299 int uhlen; 300 301 error = -ENOTCONN; 302 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 303 goto error; 304 305 /* Get session and tunnel contexts */ 306 error = -EBADF; 307 session = pppol2tp_sock_to_session(sk); 308 if (session == NULL) 309 goto error; 310 311 ps = l2tp_session_priv(session); 312 tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock); 313 if (tunnel == NULL) 314 goto error_put_sess; 315 316 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 317 318 /* Allocate a socket buffer */ 319 error = -ENOMEM; 320 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 321 uhlen + session->hdr_len + 322 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 323 0, GFP_KERNEL); 324 if (!skb) 325 goto error_put_sess_tun; 326 327 /* Reserve space for headers. */ 328 skb_reserve(skb, NET_SKB_PAD); 329 skb_reset_network_header(skb); 330 skb_reserve(skb, sizeof(struct iphdr)); 331 skb_reset_transport_header(skb); 332 skb_reserve(skb, uhlen); 333 334 /* Add PPP header */ 335 skb->data[0] = PPP_ALLSTATIONS; 336 skb->data[1] = PPP_UI; 337 skb_put(skb, 2); 338 339 /* Copy user data into skb */ 340 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len); 341 if (error < 0) { 342 kfree_skb(skb); 343 goto error_put_sess_tun; 344 } 345 346 local_bh_disable(); 347 l2tp_xmit_skb(session, skb, session->hdr_len); 348 local_bh_enable(); 349 350 sock_put(ps->tunnel_sock); 351 sock_put(sk); 352 353 return total_len; 354 355 error_put_sess_tun: 356 sock_put(ps->tunnel_sock); 357 error_put_sess: 358 sock_put(sk); 359 error: 360 return error; 361 } 362 363 /* Transmit function called by generic PPP driver. Sends PPP frame 364 * over PPPoL2TP socket. 365 * 366 * This is almost the same as pppol2tp_sendmsg(), but rather than 367 * being called with a msghdr from userspace, it is called with a skb 368 * from the kernel. 369 * 370 * The supplied skb from ppp doesn't have enough headroom for the 371 * insertion of L2TP, UDP and IP headers so we need to allocate more 372 * headroom in the skb. This will create a cloned skb. But we must be 373 * careful in the error case because the caller will expect to free 374 * the skb it supplied, not our cloned skb. So we take care to always 375 * leave the original skb unfreed if we return an error. 376 */ 377 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) 378 { 379 struct sock *sk = (struct sock *) chan->private; 380 struct sock *sk_tun; 381 struct l2tp_session *session; 382 struct l2tp_tunnel *tunnel; 383 struct pppol2tp_session *ps; 384 int uhlen, headroom; 385 386 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 387 goto abort; 388 389 /* Get session and tunnel contexts from the socket */ 390 session = pppol2tp_sock_to_session(sk); 391 if (session == NULL) 392 goto abort; 393 394 ps = l2tp_session_priv(session); 395 sk_tun = ps->tunnel_sock; 396 if (sk_tun == NULL) 397 goto abort_put_sess; 398 tunnel = l2tp_sock_to_tunnel(sk_tun); 399 if (tunnel == NULL) 400 goto abort_put_sess; 401 402 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 403 headroom = NET_SKB_PAD + 404 sizeof(struct iphdr) + /* IP header */ 405 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */ 406 session->hdr_len + /* L2TP header */ 407 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 408 if (skb_cow_head(skb, headroom)) 409 goto abort_put_sess_tun; 410 411 /* Setup PPP header */ 412 __skb_push(skb, 2); 413 skb->data[0] = PPP_ALLSTATIONS; 414 skb->data[1] = PPP_UI; 415 416 local_bh_disable(); 417 l2tp_xmit_skb(session, skb, session->hdr_len); 418 local_bh_enable(); 419 420 sock_put(sk_tun); 421 sock_put(sk); 422 return 1; 423 424 abort_put_sess_tun: 425 sock_put(sk_tun); 426 abort_put_sess: 427 sock_put(sk); 428 abort: 429 /* Free the original skb */ 430 kfree_skb(skb); 431 return 1; 432 } 433 434 /***************************************************************************** 435 * Session (and tunnel control) socket create/destroy. 436 *****************************************************************************/ 437 438 /* Called by l2tp_core when a session socket is being closed. 439 */ 440 static void pppol2tp_session_close(struct l2tp_session *session) 441 { 442 struct sock *sk; 443 444 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 445 446 sk = pppol2tp_session_get_sock(session); 447 if (sk) { 448 if (sk->sk_socket) 449 inet_shutdown(sk->sk_socket, SEND_SHUTDOWN); 450 sock_put(sk); 451 } 452 } 453 454 /* Really kill the session socket. (Called from sock_put() if 455 * refcnt == 0.) 456 */ 457 static void pppol2tp_session_destruct(struct sock *sk) 458 { 459 struct l2tp_session *session = sk->sk_user_data; 460 461 skb_queue_purge(&sk->sk_receive_queue); 462 skb_queue_purge(&sk->sk_write_queue); 463 464 if (session) { 465 sk->sk_user_data = NULL; 466 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 467 l2tp_session_dec_refcount(session); 468 } 469 } 470 471 static void pppol2tp_put_sk(struct rcu_head *head) 472 { 473 struct pppol2tp_session *ps; 474 475 ps = container_of(head, typeof(*ps), rcu); 476 sock_put(ps->__sk); 477 } 478 479 /* Called when the PPPoX socket (session) is closed. 480 */ 481 static int pppol2tp_release(struct socket *sock) 482 { 483 struct sock *sk = sock->sk; 484 struct l2tp_session *session; 485 int error; 486 487 if (!sk) 488 return 0; 489 490 error = -EBADF; 491 lock_sock(sk); 492 if (sock_flag(sk, SOCK_DEAD) != 0) 493 goto error; 494 495 pppox_unbind_sock(sk); 496 497 /* Signal the death of the socket. */ 498 sk->sk_state = PPPOX_DEAD; 499 sock_orphan(sk); 500 sock->sk = NULL; 501 502 session = pppol2tp_sock_to_session(sk); 503 504 if (session != NULL) { 505 struct pppol2tp_session *ps; 506 507 l2tp_session_delete(session); 508 509 ps = l2tp_session_priv(session); 510 mutex_lock(&ps->sk_lock); 511 ps->__sk = rcu_dereference_protected(ps->sk, 512 lockdep_is_held(&ps->sk_lock)); 513 RCU_INIT_POINTER(ps->sk, NULL); 514 mutex_unlock(&ps->sk_lock); 515 call_rcu(&ps->rcu, pppol2tp_put_sk); 516 517 /* Rely on the sock_put() call at the end of the function for 518 * dropping the reference held by pppol2tp_sock_to_session(). 519 * The last reference will be dropped by pppol2tp_put_sk(). 520 */ 521 } 522 release_sock(sk); 523 524 /* This will delete the session context via 525 * pppol2tp_session_destruct() if the socket's refcnt drops to 526 * zero. 527 */ 528 sock_put(sk); 529 530 return 0; 531 532 error: 533 release_sock(sk); 534 return error; 535 } 536 537 static struct proto pppol2tp_sk_proto = { 538 .name = "PPPOL2TP", 539 .owner = THIS_MODULE, 540 .obj_size = sizeof(struct pppox_sock), 541 }; 542 543 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb) 544 { 545 int rc; 546 547 rc = l2tp_udp_encap_recv(sk, skb); 548 if (rc) 549 kfree_skb(skb); 550 551 return NET_RX_SUCCESS; 552 } 553 554 /* socket() handler. Initialize a new struct sock. 555 */ 556 static int pppol2tp_create(struct net *net, struct socket *sock, int kern) 557 { 558 int error = -ENOMEM; 559 struct sock *sk; 560 561 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern); 562 if (!sk) 563 goto out; 564 565 sock_init_data(sock, sk); 566 567 sock->state = SS_UNCONNECTED; 568 sock->ops = &pppol2tp_ops; 569 570 sk->sk_backlog_rcv = pppol2tp_backlog_recv; 571 sk->sk_protocol = PX_PROTO_OL2TP; 572 sk->sk_family = PF_PPPOX; 573 sk->sk_state = PPPOX_NONE; 574 sk->sk_type = SOCK_STREAM; 575 sk->sk_destruct = pppol2tp_session_destruct; 576 577 error = 0; 578 579 out: 580 return error; 581 } 582 583 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 584 static void pppol2tp_show(struct seq_file *m, void *arg) 585 { 586 struct l2tp_session *session = arg; 587 struct sock *sk; 588 589 sk = pppol2tp_session_get_sock(session); 590 if (sk) { 591 struct pppox_sock *po = pppox_sk(sk); 592 593 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 594 sock_put(sk); 595 } 596 } 597 #endif 598 599 static void pppol2tp_session_init(struct l2tp_session *session) 600 { 601 struct pppol2tp_session *ps; 602 struct dst_entry *dst; 603 604 session->recv_skb = pppol2tp_recv; 605 session->session_close = pppol2tp_session_close; 606 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 607 session->show = pppol2tp_show; 608 #endif 609 610 ps = l2tp_session_priv(session); 611 mutex_init(&ps->sk_lock); 612 ps->tunnel_sock = session->tunnel->sock; 613 ps->owner = current->pid; 614 615 /* If PMTU discovery was enabled, use the MTU that was discovered */ 616 dst = sk_dst_get(session->tunnel->sock); 617 if (dst) { 618 u32 pmtu = dst_mtu(dst); 619 620 if (pmtu) { 621 session->mtu = pmtu - PPPOL2TP_HEADER_OVERHEAD; 622 session->mru = pmtu - PPPOL2TP_HEADER_OVERHEAD; 623 } 624 dst_release(dst); 625 } 626 } 627 628 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket 629 */ 630 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 631 int sockaddr_len, int flags) 632 { 633 struct sock *sk = sock->sk; 634 struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr; 635 struct pppox_sock *po = pppox_sk(sk); 636 struct l2tp_session *session = NULL; 637 struct l2tp_tunnel *tunnel; 638 struct pppol2tp_session *ps; 639 struct l2tp_session_cfg cfg = { 0, }; 640 int error = 0; 641 u32 tunnel_id, peer_tunnel_id; 642 u32 session_id, peer_session_id; 643 bool drop_refcnt = false; 644 int ver = 2; 645 int fd; 646 647 lock_sock(sk); 648 649 error = -EINVAL; 650 if (sp->sa_protocol != PX_PROTO_OL2TP) 651 goto end; 652 653 /* Check for already bound sockets */ 654 error = -EBUSY; 655 if (sk->sk_state & PPPOX_CONNECTED) 656 goto end; 657 658 /* We don't supporting rebinding anyway */ 659 error = -EALREADY; 660 if (sk->sk_user_data) 661 goto end; /* socket is already attached */ 662 663 /* Get params from socket address. Handle L2TPv2 and L2TPv3. 664 * This is nasty because there are different sockaddr_pppol2tp 665 * structs for L2TPv2, L2TPv3, over IPv4 and IPv6. We use 666 * the sockaddr size to determine which structure the caller 667 * is using. 668 */ 669 peer_tunnel_id = 0; 670 if (sockaddr_len == sizeof(struct sockaddr_pppol2tp)) { 671 fd = sp->pppol2tp.fd; 672 tunnel_id = sp->pppol2tp.s_tunnel; 673 peer_tunnel_id = sp->pppol2tp.d_tunnel; 674 session_id = sp->pppol2tp.s_session; 675 peer_session_id = sp->pppol2tp.d_session; 676 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3)) { 677 struct sockaddr_pppol2tpv3 *sp3 = 678 (struct sockaddr_pppol2tpv3 *) sp; 679 ver = 3; 680 fd = sp3->pppol2tp.fd; 681 tunnel_id = sp3->pppol2tp.s_tunnel; 682 peer_tunnel_id = sp3->pppol2tp.d_tunnel; 683 session_id = sp3->pppol2tp.s_session; 684 peer_session_id = sp3->pppol2tp.d_session; 685 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpin6)) { 686 struct sockaddr_pppol2tpin6 *sp6 = 687 (struct sockaddr_pppol2tpin6 *) sp; 688 fd = sp6->pppol2tp.fd; 689 tunnel_id = sp6->pppol2tp.s_tunnel; 690 peer_tunnel_id = sp6->pppol2tp.d_tunnel; 691 session_id = sp6->pppol2tp.s_session; 692 peer_session_id = sp6->pppol2tp.d_session; 693 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3in6)) { 694 struct sockaddr_pppol2tpv3in6 *sp6 = 695 (struct sockaddr_pppol2tpv3in6 *) sp; 696 ver = 3; 697 fd = sp6->pppol2tp.fd; 698 tunnel_id = sp6->pppol2tp.s_tunnel; 699 peer_tunnel_id = sp6->pppol2tp.d_tunnel; 700 session_id = sp6->pppol2tp.s_session; 701 peer_session_id = sp6->pppol2tp.d_session; 702 } else { 703 error = -EINVAL; 704 goto end; /* bad socket address */ 705 } 706 707 /* Don't bind if tunnel_id is 0 */ 708 error = -EINVAL; 709 if (tunnel_id == 0) 710 goto end; 711 712 tunnel = l2tp_tunnel_find(sock_net(sk), tunnel_id); 713 714 /* Special case: create tunnel context if session_id and 715 * peer_session_id is 0. Otherwise look up tunnel using supplied 716 * tunnel id. 717 */ 718 if ((session_id == 0) && (peer_session_id == 0)) { 719 if (tunnel == NULL) { 720 struct l2tp_tunnel_cfg tcfg = { 721 .encap = L2TP_ENCAPTYPE_UDP, 722 .debug = 0, 723 }; 724 error = l2tp_tunnel_create(sock_net(sk), fd, ver, tunnel_id, peer_tunnel_id, &tcfg, &tunnel); 725 if (error < 0) 726 goto end; 727 } 728 } else { 729 /* Error if we can't find the tunnel */ 730 error = -ENOENT; 731 if (tunnel == NULL) 732 goto end; 733 734 /* Error if socket is not prepped */ 735 if (tunnel->sock == NULL) 736 goto end; 737 } 738 739 if (tunnel->recv_payload_hook == NULL) 740 tunnel->recv_payload_hook = pppol2tp_recv_payload_hook; 741 742 if (tunnel->peer_tunnel_id == 0) 743 tunnel->peer_tunnel_id = peer_tunnel_id; 744 745 session = l2tp_session_get(sock_net(sk), tunnel, session_id); 746 if (session) { 747 drop_refcnt = true; 748 ps = l2tp_session_priv(session); 749 750 /* Using a pre-existing session is fine as long as it hasn't 751 * been connected yet. 752 */ 753 mutex_lock(&ps->sk_lock); 754 if (rcu_dereference_protected(ps->sk, 755 lockdep_is_held(&ps->sk_lock))) { 756 mutex_unlock(&ps->sk_lock); 757 error = -EEXIST; 758 goto end; 759 } 760 761 /* consistency checks */ 762 if (ps->tunnel_sock != tunnel->sock) { 763 mutex_unlock(&ps->sk_lock); 764 error = -EEXIST; 765 goto end; 766 } 767 } else { 768 /* Default MTU must allow space for UDP/L2TP/PPP headers */ 769 cfg.mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 770 cfg.mru = cfg.mtu; 771 772 session = l2tp_session_create(sizeof(struct pppol2tp_session), 773 tunnel, session_id, 774 peer_session_id, &cfg); 775 if (IS_ERR(session)) { 776 error = PTR_ERR(session); 777 goto end; 778 } 779 780 pppol2tp_session_init(session); 781 ps = l2tp_session_priv(session); 782 l2tp_session_inc_refcount(session); 783 784 mutex_lock(&ps->sk_lock); 785 error = l2tp_session_register(session, tunnel); 786 if (error < 0) { 787 mutex_unlock(&ps->sk_lock); 788 kfree(session); 789 goto end; 790 } 791 drop_refcnt = true; 792 } 793 794 /* Special case: if source & dest session_id == 0x0000, this 795 * socket is being created to manage the tunnel. Just set up 796 * the internal context for use by ioctl() and sockopt() 797 * handlers. 798 */ 799 if ((session->session_id == 0) && 800 (session->peer_session_id == 0)) { 801 error = 0; 802 goto out_no_ppp; 803 } 804 805 /* The only header we need to worry about is the L2TP 806 * header. This size is different depending on whether 807 * sequence numbers are enabled for the data channel. 808 */ 809 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 810 811 po->chan.private = sk; 812 po->chan.ops = &pppol2tp_chan_ops; 813 po->chan.mtu = session->mtu; 814 815 error = ppp_register_net_channel(sock_net(sk), &po->chan); 816 if (error) { 817 mutex_unlock(&ps->sk_lock); 818 goto end; 819 } 820 821 out_no_ppp: 822 /* This is how we get the session context from the socket. */ 823 sk->sk_user_data = session; 824 rcu_assign_pointer(ps->sk, sk); 825 mutex_unlock(&ps->sk_lock); 826 827 /* Keep the reference we've grabbed on the session: sk doesn't expect 828 * the session to disappear. pppol2tp_session_destruct() is responsible 829 * for dropping it. 830 */ 831 drop_refcnt = false; 832 833 sk->sk_state = PPPOX_CONNECTED; 834 l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n", 835 session->name); 836 837 end: 838 if (drop_refcnt) 839 l2tp_session_dec_refcount(session); 840 release_sock(sk); 841 842 return error; 843 } 844 845 #ifdef CONFIG_L2TP_V3 846 847 /* Called when creating sessions via the netlink interface. */ 848 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, 849 u32 session_id, u32 peer_session_id, 850 struct l2tp_session_cfg *cfg) 851 { 852 int error; 853 struct l2tp_session *session; 854 855 /* Error if tunnel socket is not prepped */ 856 if (!tunnel->sock) { 857 error = -ENOENT; 858 goto err; 859 } 860 861 /* Default MTU values. */ 862 if (cfg->mtu == 0) 863 cfg->mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 864 if (cfg->mru == 0) 865 cfg->mru = cfg->mtu; 866 867 /* Allocate and initialize a new session context. */ 868 session = l2tp_session_create(sizeof(struct pppol2tp_session), 869 tunnel, session_id, 870 peer_session_id, cfg); 871 if (IS_ERR(session)) { 872 error = PTR_ERR(session); 873 goto err; 874 } 875 876 pppol2tp_session_init(session); 877 878 error = l2tp_session_register(session, tunnel); 879 if (error < 0) 880 goto err_sess; 881 882 return 0; 883 884 err_sess: 885 kfree(session); 886 err: 887 return error; 888 } 889 890 #endif /* CONFIG_L2TP_V3 */ 891 892 /* getname() support. 893 */ 894 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr, 895 int *usockaddr_len, int peer) 896 { 897 int len = 0; 898 int error = 0; 899 struct l2tp_session *session; 900 struct l2tp_tunnel *tunnel; 901 struct sock *sk = sock->sk; 902 struct inet_sock *inet; 903 struct pppol2tp_session *pls; 904 905 error = -ENOTCONN; 906 if (sk == NULL) 907 goto end; 908 if (!(sk->sk_state & PPPOX_CONNECTED)) 909 goto end; 910 911 error = -EBADF; 912 session = pppol2tp_sock_to_session(sk); 913 if (session == NULL) 914 goto end; 915 916 pls = l2tp_session_priv(session); 917 tunnel = l2tp_sock_to_tunnel(pls->tunnel_sock); 918 if (tunnel == NULL) 919 goto end_put_sess; 920 921 inet = inet_sk(tunnel->sock); 922 if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) { 923 struct sockaddr_pppol2tp sp; 924 len = sizeof(sp); 925 memset(&sp, 0, len); 926 sp.sa_family = AF_PPPOX; 927 sp.sa_protocol = PX_PROTO_OL2TP; 928 sp.pppol2tp.fd = tunnel->fd; 929 sp.pppol2tp.pid = pls->owner; 930 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 931 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 932 sp.pppol2tp.s_session = session->session_id; 933 sp.pppol2tp.d_session = session->peer_session_id; 934 sp.pppol2tp.addr.sin_family = AF_INET; 935 sp.pppol2tp.addr.sin_port = inet->inet_dport; 936 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 937 memcpy(uaddr, &sp, len); 938 #if IS_ENABLED(CONFIG_IPV6) 939 } else if ((tunnel->version == 2) && 940 (tunnel->sock->sk_family == AF_INET6)) { 941 struct sockaddr_pppol2tpin6 sp; 942 943 len = sizeof(sp); 944 memset(&sp, 0, len); 945 sp.sa_family = AF_PPPOX; 946 sp.sa_protocol = PX_PROTO_OL2TP; 947 sp.pppol2tp.fd = tunnel->fd; 948 sp.pppol2tp.pid = pls->owner; 949 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 950 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 951 sp.pppol2tp.s_session = session->session_id; 952 sp.pppol2tp.d_session = session->peer_session_id; 953 sp.pppol2tp.addr.sin6_family = AF_INET6; 954 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 955 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 956 sizeof(tunnel->sock->sk_v6_daddr)); 957 memcpy(uaddr, &sp, len); 958 } else if ((tunnel->version == 3) && 959 (tunnel->sock->sk_family == AF_INET6)) { 960 struct sockaddr_pppol2tpv3in6 sp; 961 962 len = sizeof(sp); 963 memset(&sp, 0, len); 964 sp.sa_family = AF_PPPOX; 965 sp.sa_protocol = PX_PROTO_OL2TP; 966 sp.pppol2tp.fd = tunnel->fd; 967 sp.pppol2tp.pid = pls->owner; 968 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 969 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 970 sp.pppol2tp.s_session = session->session_id; 971 sp.pppol2tp.d_session = session->peer_session_id; 972 sp.pppol2tp.addr.sin6_family = AF_INET6; 973 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 974 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 975 sizeof(tunnel->sock->sk_v6_daddr)); 976 memcpy(uaddr, &sp, len); 977 #endif 978 } else if (tunnel->version == 3) { 979 struct sockaddr_pppol2tpv3 sp; 980 len = sizeof(sp); 981 memset(&sp, 0, len); 982 sp.sa_family = AF_PPPOX; 983 sp.sa_protocol = PX_PROTO_OL2TP; 984 sp.pppol2tp.fd = tunnel->fd; 985 sp.pppol2tp.pid = pls->owner; 986 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 987 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 988 sp.pppol2tp.s_session = session->session_id; 989 sp.pppol2tp.d_session = session->peer_session_id; 990 sp.pppol2tp.addr.sin_family = AF_INET; 991 sp.pppol2tp.addr.sin_port = inet->inet_dport; 992 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 993 memcpy(uaddr, &sp, len); 994 } 995 996 *usockaddr_len = len; 997 error = 0; 998 999 sock_put(pls->tunnel_sock); 1000 end_put_sess: 1001 sock_put(sk); 1002 end: 1003 return error; 1004 } 1005 1006 /**************************************************************************** 1007 * ioctl() handlers. 1008 * 1009 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1010 * sockets. However, in order to control kernel tunnel features, we allow 1011 * userspace to create a special "tunnel" PPPoX socket which is used for 1012 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow 1013 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl() 1014 * calls. 1015 ****************************************************************************/ 1016 1017 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest, 1018 struct l2tp_stats *stats) 1019 { 1020 dest->tx_packets = atomic_long_read(&stats->tx_packets); 1021 dest->tx_bytes = atomic_long_read(&stats->tx_bytes); 1022 dest->tx_errors = atomic_long_read(&stats->tx_errors); 1023 dest->rx_packets = atomic_long_read(&stats->rx_packets); 1024 dest->rx_bytes = atomic_long_read(&stats->rx_bytes); 1025 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards); 1026 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets); 1027 dest->rx_errors = atomic_long_read(&stats->rx_errors); 1028 } 1029 1030 /* Session ioctl helper. 1031 */ 1032 static int pppol2tp_session_ioctl(struct l2tp_session *session, 1033 unsigned int cmd, unsigned long arg) 1034 { 1035 struct ifreq ifr; 1036 int err = 0; 1037 struct sock *sk; 1038 int val = (int) arg; 1039 struct pppol2tp_session *ps = l2tp_session_priv(session); 1040 struct l2tp_tunnel *tunnel = session->tunnel; 1041 struct pppol2tp_ioc_stats stats; 1042 1043 l2tp_dbg(session, L2TP_MSG_CONTROL, 1044 "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n", 1045 session->name, cmd, arg); 1046 1047 sk = pppol2tp_session_get_sock(session); 1048 if (!sk) 1049 return -EBADR; 1050 1051 switch (cmd) { 1052 case SIOCGIFMTU: 1053 err = -ENXIO; 1054 if (!(sk->sk_state & PPPOX_CONNECTED)) 1055 break; 1056 1057 err = -EFAULT; 1058 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1059 break; 1060 ifr.ifr_mtu = session->mtu; 1061 if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq))) 1062 break; 1063 1064 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mtu=%d\n", 1065 session->name, session->mtu); 1066 err = 0; 1067 break; 1068 1069 case SIOCSIFMTU: 1070 err = -ENXIO; 1071 if (!(sk->sk_state & PPPOX_CONNECTED)) 1072 break; 1073 1074 err = -EFAULT; 1075 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1076 break; 1077 1078 session->mtu = ifr.ifr_mtu; 1079 1080 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mtu=%d\n", 1081 session->name, session->mtu); 1082 err = 0; 1083 break; 1084 1085 case PPPIOCGMRU: 1086 err = -ENXIO; 1087 if (!(sk->sk_state & PPPOX_CONNECTED)) 1088 break; 1089 1090 err = -EFAULT; 1091 if (put_user(session->mru, (int __user *) arg)) 1092 break; 1093 1094 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mru=%d\n", 1095 session->name, session->mru); 1096 err = 0; 1097 break; 1098 1099 case PPPIOCSMRU: 1100 err = -ENXIO; 1101 if (!(sk->sk_state & PPPOX_CONNECTED)) 1102 break; 1103 1104 err = -EFAULT; 1105 if (get_user(val, (int __user *) arg)) 1106 break; 1107 1108 session->mru = val; 1109 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mru=%d\n", 1110 session->name, session->mru); 1111 err = 0; 1112 break; 1113 1114 case PPPIOCGFLAGS: 1115 err = -EFAULT; 1116 if (put_user(ps->flags, (int __user *) arg)) 1117 break; 1118 1119 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get flags=%d\n", 1120 session->name, ps->flags); 1121 err = 0; 1122 break; 1123 1124 case PPPIOCSFLAGS: 1125 err = -EFAULT; 1126 if (get_user(val, (int __user *) arg)) 1127 break; 1128 ps->flags = val; 1129 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set flags=%d\n", 1130 session->name, ps->flags); 1131 err = 0; 1132 break; 1133 1134 case PPPIOCGL2TPSTATS: 1135 err = -ENXIO; 1136 if (!(sk->sk_state & PPPOX_CONNECTED)) 1137 break; 1138 1139 memset(&stats, 0, sizeof(stats)); 1140 stats.tunnel_id = tunnel->tunnel_id; 1141 stats.session_id = session->session_id; 1142 pppol2tp_copy_stats(&stats, &session->stats); 1143 if (copy_to_user((void __user *) arg, &stats, 1144 sizeof(stats))) 1145 break; 1146 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1147 session->name); 1148 err = 0; 1149 break; 1150 1151 default: 1152 err = -ENOSYS; 1153 break; 1154 } 1155 1156 sock_put(sk); 1157 1158 return err; 1159 } 1160 1161 /* Tunnel ioctl helper. 1162 * 1163 * Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data 1164 * specifies a session_id, the session ioctl handler is called. This allows an 1165 * application to retrieve session stats via a tunnel socket. 1166 */ 1167 static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel, 1168 unsigned int cmd, unsigned long arg) 1169 { 1170 int err = 0; 1171 struct sock *sk; 1172 struct pppol2tp_ioc_stats stats; 1173 1174 l2tp_dbg(tunnel, L2TP_MSG_CONTROL, 1175 "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n", 1176 tunnel->name, cmd, arg); 1177 1178 sk = tunnel->sock; 1179 sock_hold(sk); 1180 1181 switch (cmd) { 1182 case PPPIOCGL2TPSTATS: 1183 err = -ENXIO; 1184 if (!(sk->sk_state & PPPOX_CONNECTED)) 1185 break; 1186 1187 if (copy_from_user(&stats, (void __user *) arg, 1188 sizeof(stats))) { 1189 err = -EFAULT; 1190 break; 1191 } 1192 if (stats.session_id != 0) { 1193 /* resend to session ioctl handler */ 1194 struct l2tp_session *session = 1195 l2tp_session_get(sock_net(sk), tunnel, 1196 stats.session_id); 1197 1198 if (session) { 1199 err = pppol2tp_session_ioctl(session, cmd, 1200 arg); 1201 l2tp_session_dec_refcount(session); 1202 } else { 1203 err = -EBADR; 1204 } 1205 break; 1206 } 1207 #ifdef CONFIG_XFRM 1208 stats.using_ipsec = (sk->sk_policy[0] || sk->sk_policy[1]) ? 1 : 0; 1209 #endif 1210 pppol2tp_copy_stats(&stats, &tunnel->stats); 1211 if (copy_to_user((void __user *) arg, &stats, sizeof(stats))) { 1212 err = -EFAULT; 1213 break; 1214 } 1215 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1216 tunnel->name); 1217 err = 0; 1218 break; 1219 1220 default: 1221 err = -ENOSYS; 1222 break; 1223 } 1224 1225 sock_put(sk); 1226 1227 return err; 1228 } 1229 1230 /* Main ioctl() handler. 1231 * Dispatch to tunnel or session helpers depending on the socket. 1232 */ 1233 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, 1234 unsigned long arg) 1235 { 1236 struct sock *sk = sock->sk; 1237 struct l2tp_session *session; 1238 struct l2tp_tunnel *tunnel; 1239 struct pppol2tp_session *ps; 1240 int err; 1241 1242 if (!sk) 1243 return 0; 1244 1245 err = -EBADF; 1246 if (sock_flag(sk, SOCK_DEAD) != 0) 1247 goto end; 1248 1249 err = -ENOTCONN; 1250 if ((sk->sk_user_data == NULL) || 1251 (!(sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)))) 1252 goto end; 1253 1254 /* Get session context from the socket */ 1255 err = -EBADF; 1256 session = pppol2tp_sock_to_session(sk); 1257 if (session == NULL) 1258 goto end; 1259 1260 /* Special case: if session's session_id is zero, treat ioctl as a 1261 * tunnel ioctl 1262 */ 1263 ps = l2tp_session_priv(session); 1264 if ((session->session_id == 0) && 1265 (session->peer_session_id == 0)) { 1266 err = -EBADF; 1267 tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock); 1268 if (tunnel == NULL) 1269 goto end_put_sess; 1270 1271 err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg); 1272 sock_put(ps->tunnel_sock); 1273 goto end_put_sess; 1274 } 1275 1276 err = pppol2tp_session_ioctl(session, cmd, arg); 1277 1278 end_put_sess: 1279 sock_put(sk); 1280 end: 1281 return err; 1282 } 1283 1284 /***************************************************************************** 1285 * setsockopt() / getsockopt() support. 1286 * 1287 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1288 * sockets. In order to control kernel tunnel features, we allow userspace to 1289 * create a special "tunnel" PPPoX socket which is used for control only. 1290 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user 1291 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls. 1292 *****************************************************************************/ 1293 1294 /* Tunnel setsockopt() helper. 1295 */ 1296 static int pppol2tp_tunnel_setsockopt(struct sock *sk, 1297 struct l2tp_tunnel *tunnel, 1298 int optname, int val) 1299 { 1300 int err = 0; 1301 1302 switch (optname) { 1303 case PPPOL2TP_SO_DEBUG: 1304 tunnel->debug = val; 1305 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1306 tunnel->name, tunnel->debug); 1307 break; 1308 1309 default: 1310 err = -ENOPROTOOPT; 1311 break; 1312 } 1313 1314 return err; 1315 } 1316 1317 /* Session setsockopt helper. 1318 */ 1319 static int pppol2tp_session_setsockopt(struct sock *sk, 1320 struct l2tp_session *session, 1321 int optname, int val) 1322 { 1323 int err = 0; 1324 1325 switch (optname) { 1326 case PPPOL2TP_SO_RECVSEQ: 1327 if ((val != 0) && (val != 1)) { 1328 err = -EINVAL; 1329 break; 1330 } 1331 session->recv_seq = !!val; 1332 l2tp_info(session, L2TP_MSG_CONTROL, 1333 "%s: set recv_seq=%d\n", 1334 session->name, session->recv_seq); 1335 break; 1336 1337 case PPPOL2TP_SO_SENDSEQ: 1338 if ((val != 0) && (val != 1)) { 1339 err = -EINVAL; 1340 break; 1341 } 1342 session->send_seq = !!val; 1343 { 1344 struct pppox_sock *po = pppox_sk(sk); 1345 1346 po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ : 1347 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 1348 } 1349 l2tp_session_set_header_len(session, session->tunnel->version); 1350 l2tp_info(session, L2TP_MSG_CONTROL, 1351 "%s: set send_seq=%d\n", 1352 session->name, session->send_seq); 1353 break; 1354 1355 case PPPOL2TP_SO_LNSMODE: 1356 if ((val != 0) && (val != 1)) { 1357 err = -EINVAL; 1358 break; 1359 } 1360 session->lns_mode = !!val; 1361 l2tp_info(session, L2TP_MSG_CONTROL, 1362 "%s: set lns_mode=%d\n", 1363 session->name, session->lns_mode); 1364 break; 1365 1366 case PPPOL2TP_SO_DEBUG: 1367 session->debug = val; 1368 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1369 session->name, session->debug); 1370 break; 1371 1372 case PPPOL2TP_SO_REORDERTO: 1373 session->reorder_timeout = msecs_to_jiffies(val); 1374 l2tp_info(session, L2TP_MSG_CONTROL, 1375 "%s: set reorder_timeout=%d\n", 1376 session->name, session->reorder_timeout); 1377 break; 1378 1379 default: 1380 err = -ENOPROTOOPT; 1381 break; 1382 } 1383 1384 return err; 1385 } 1386 1387 /* Main setsockopt() entry point. 1388 * Does API checks, then calls either the tunnel or session setsockopt 1389 * handler, according to whether the PPPoL2TP socket is a for a regular 1390 * session or the special tunnel type. 1391 */ 1392 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, 1393 char __user *optval, unsigned int optlen) 1394 { 1395 struct sock *sk = sock->sk; 1396 struct l2tp_session *session; 1397 struct l2tp_tunnel *tunnel; 1398 struct pppol2tp_session *ps; 1399 int val; 1400 int err; 1401 1402 if (level != SOL_PPPOL2TP) 1403 return -EINVAL; 1404 1405 if (optlen < sizeof(int)) 1406 return -EINVAL; 1407 1408 if (get_user(val, (int __user *)optval)) 1409 return -EFAULT; 1410 1411 err = -ENOTCONN; 1412 if (sk->sk_user_data == NULL) 1413 goto end; 1414 1415 /* Get session context from the socket */ 1416 err = -EBADF; 1417 session = pppol2tp_sock_to_session(sk); 1418 if (session == NULL) 1419 goto end; 1420 1421 /* Special case: if session_id == 0x0000, treat as operation on tunnel 1422 */ 1423 ps = l2tp_session_priv(session); 1424 if ((session->session_id == 0) && 1425 (session->peer_session_id == 0)) { 1426 err = -EBADF; 1427 tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock); 1428 if (tunnel == NULL) 1429 goto end_put_sess; 1430 1431 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val); 1432 sock_put(ps->tunnel_sock); 1433 } else 1434 err = pppol2tp_session_setsockopt(sk, session, optname, val); 1435 1436 end_put_sess: 1437 sock_put(sk); 1438 end: 1439 return err; 1440 } 1441 1442 /* Tunnel getsockopt helper. Called with sock locked. 1443 */ 1444 static int pppol2tp_tunnel_getsockopt(struct sock *sk, 1445 struct l2tp_tunnel *tunnel, 1446 int optname, int *val) 1447 { 1448 int err = 0; 1449 1450 switch (optname) { 1451 case PPPOL2TP_SO_DEBUG: 1452 *val = tunnel->debug; 1453 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get debug=%x\n", 1454 tunnel->name, tunnel->debug); 1455 break; 1456 1457 default: 1458 err = -ENOPROTOOPT; 1459 break; 1460 } 1461 1462 return err; 1463 } 1464 1465 /* Session getsockopt helper. Called with sock locked. 1466 */ 1467 static int pppol2tp_session_getsockopt(struct sock *sk, 1468 struct l2tp_session *session, 1469 int optname, int *val) 1470 { 1471 int err = 0; 1472 1473 switch (optname) { 1474 case PPPOL2TP_SO_RECVSEQ: 1475 *val = session->recv_seq; 1476 l2tp_info(session, L2TP_MSG_CONTROL, 1477 "%s: get recv_seq=%d\n", session->name, *val); 1478 break; 1479 1480 case PPPOL2TP_SO_SENDSEQ: 1481 *val = session->send_seq; 1482 l2tp_info(session, L2TP_MSG_CONTROL, 1483 "%s: get send_seq=%d\n", session->name, *val); 1484 break; 1485 1486 case PPPOL2TP_SO_LNSMODE: 1487 *val = session->lns_mode; 1488 l2tp_info(session, L2TP_MSG_CONTROL, 1489 "%s: get lns_mode=%d\n", session->name, *val); 1490 break; 1491 1492 case PPPOL2TP_SO_DEBUG: 1493 *val = session->debug; 1494 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get debug=%d\n", 1495 session->name, *val); 1496 break; 1497 1498 case PPPOL2TP_SO_REORDERTO: 1499 *val = (int) jiffies_to_msecs(session->reorder_timeout); 1500 l2tp_info(session, L2TP_MSG_CONTROL, 1501 "%s: get reorder_timeout=%d\n", session->name, *val); 1502 break; 1503 1504 default: 1505 err = -ENOPROTOOPT; 1506 } 1507 1508 return err; 1509 } 1510 1511 /* Main getsockopt() entry point. 1512 * Does API checks, then calls either the tunnel or session getsockopt 1513 * handler, according to whether the PPPoX socket is a for a regular session 1514 * or the special tunnel type. 1515 */ 1516 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, 1517 char __user *optval, int __user *optlen) 1518 { 1519 struct sock *sk = sock->sk; 1520 struct l2tp_session *session; 1521 struct l2tp_tunnel *tunnel; 1522 int val, len; 1523 int err; 1524 struct pppol2tp_session *ps; 1525 1526 if (level != SOL_PPPOL2TP) 1527 return -EINVAL; 1528 1529 if (get_user(len, optlen)) 1530 return -EFAULT; 1531 1532 len = min_t(unsigned int, len, sizeof(int)); 1533 1534 if (len < 0) 1535 return -EINVAL; 1536 1537 err = -ENOTCONN; 1538 if (sk->sk_user_data == NULL) 1539 goto end; 1540 1541 /* Get the session context */ 1542 err = -EBADF; 1543 session = pppol2tp_sock_to_session(sk); 1544 if (session == NULL) 1545 goto end; 1546 1547 /* Special case: if session_id == 0x0000, treat as operation on tunnel */ 1548 ps = l2tp_session_priv(session); 1549 if ((session->session_id == 0) && 1550 (session->peer_session_id == 0)) { 1551 err = -EBADF; 1552 tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock); 1553 if (tunnel == NULL) 1554 goto end_put_sess; 1555 1556 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val); 1557 sock_put(ps->tunnel_sock); 1558 if (err) 1559 goto end_put_sess; 1560 } else { 1561 err = pppol2tp_session_getsockopt(sk, session, optname, &val); 1562 if (err) 1563 goto end_put_sess; 1564 } 1565 1566 err = -EFAULT; 1567 if (put_user(len, optlen)) 1568 goto end_put_sess; 1569 1570 if (copy_to_user((void __user *) optval, &val, len)) 1571 goto end_put_sess; 1572 1573 err = 0; 1574 1575 end_put_sess: 1576 sock_put(sk); 1577 end: 1578 return err; 1579 } 1580 1581 /***************************************************************************** 1582 * /proc filesystem for debug 1583 * Since the original pppol2tp driver provided /proc/net/pppol2tp for 1584 * L2TPv2, we dump only L2TPv2 tunnels and sessions here. 1585 *****************************************************************************/ 1586 1587 static unsigned int pppol2tp_net_id; 1588 1589 #ifdef CONFIG_PROC_FS 1590 1591 struct pppol2tp_seq_data { 1592 struct seq_net_private p; 1593 int tunnel_idx; /* current tunnel */ 1594 int session_idx; /* index of session within current tunnel */ 1595 struct l2tp_tunnel *tunnel; 1596 struct l2tp_session *session; /* NULL means get next tunnel */ 1597 }; 1598 1599 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) 1600 { 1601 for (;;) { 1602 pd->tunnel = l2tp_tunnel_find_nth(net, pd->tunnel_idx); 1603 pd->tunnel_idx++; 1604 1605 if (pd->tunnel == NULL) 1606 break; 1607 1608 /* Ignore L2TPv3 tunnels */ 1609 if (pd->tunnel->version < 3) 1610 break; 1611 } 1612 } 1613 1614 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) 1615 { 1616 pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx); 1617 pd->session_idx++; 1618 1619 if (pd->session == NULL) { 1620 pd->session_idx = 0; 1621 pppol2tp_next_tunnel(net, pd); 1622 } 1623 } 1624 1625 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs) 1626 { 1627 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN; 1628 loff_t pos = *offs; 1629 struct net *net; 1630 1631 if (!pos) 1632 goto out; 1633 1634 BUG_ON(m->private == NULL); 1635 pd = m->private; 1636 net = seq_file_net(m); 1637 1638 if (pd->tunnel == NULL) 1639 pppol2tp_next_tunnel(net, pd); 1640 else 1641 pppol2tp_next_session(net, pd); 1642 1643 /* NULL tunnel and session indicates end of list */ 1644 if ((pd->tunnel == NULL) && (pd->session == NULL)) 1645 pd = NULL; 1646 1647 out: 1648 return pd; 1649 } 1650 1651 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos) 1652 { 1653 (*pos)++; 1654 return NULL; 1655 } 1656 1657 static void pppol2tp_seq_stop(struct seq_file *p, void *v) 1658 { 1659 /* nothing to do */ 1660 } 1661 1662 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) 1663 { 1664 struct l2tp_tunnel *tunnel = v; 1665 1666 seq_printf(m, "\nTUNNEL '%s', %c %d\n", 1667 tunnel->name, 1668 (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N', 1669 refcount_read(&tunnel->ref_count) - 1); 1670 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n", 1671 tunnel->debug, 1672 atomic_long_read(&tunnel->stats.tx_packets), 1673 atomic_long_read(&tunnel->stats.tx_bytes), 1674 atomic_long_read(&tunnel->stats.tx_errors), 1675 atomic_long_read(&tunnel->stats.rx_packets), 1676 atomic_long_read(&tunnel->stats.rx_bytes), 1677 atomic_long_read(&tunnel->stats.rx_errors)); 1678 } 1679 1680 static void pppol2tp_seq_session_show(struct seq_file *m, void *v) 1681 { 1682 struct l2tp_session *session = v; 1683 struct l2tp_tunnel *tunnel = session->tunnel; 1684 unsigned char state; 1685 char user_data_ok; 1686 struct sock *sk; 1687 u32 ip = 0; 1688 u16 port = 0; 1689 1690 if (tunnel->sock) { 1691 struct inet_sock *inet = inet_sk(tunnel->sock); 1692 ip = ntohl(inet->inet_saddr); 1693 port = ntohs(inet->inet_sport); 1694 } 1695 1696 sk = pppol2tp_session_get_sock(session); 1697 if (sk) { 1698 state = sk->sk_state; 1699 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N'; 1700 } else { 1701 state = 0; 1702 user_data_ok = 'N'; 1703 } 1704 1705 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> " 1706 "%04X/%04X %d %c\n", 1707 session->name, ip, port, 1708 tunnel->tunnel_id, 1709 session->session_id, 1710 tunnel->peer_tunnel_id, 1711 session->peer_session_id, 1712 state, user_data_ok); 1713 seq_printf(m, " %d/%d/%c/%c/%s %08x %u\n", 1714 session->mtu, session->mru, 1715 session->recv_seq ? 'R' : '-', 1716 session->send_seq ? 'S' : '-', 1717 session->lns_mode ? "LNS" : "LAC", 1718 session->debug, 1719 jiffies_to_msecs(session->reorder_timeout)); 1720 seq_printf(m, " %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n", 1721 session->nr, session->ns, 1722 atomic_long_read(&session->stats.tx_packets), 1723 atomic_long_read(&session->stats.tx_bytes), 1724 atomic_long_read(&session->stats.tx_errors), 1725 atomic_long_read(&session->stats.rx_packets), 1726 atomic_long_read(&session->stats.rx_bytes), 1727 atomic_long_read(&session->stats.rx_errors)); 1728 1729 if (sk) { 1730 struct pppox_sock *po = pppox_sk(sk); 1731 1732 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 1733 sock_put(sk); 1734 } 1735 } 1736 1737 static int pppol2tp_seq_show(struct seq_file *m, void *v) 1738 { 1739 struct pppol2tp_seq_data *pd = v; 1740 1741 /* display header on line 1 */ 1742 if (v == SEQ_START_TOKEN) { 1743 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n"); 1744 seq_puts(m, "TUNNEL name, user-data-ok session-count\n"); 1745 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1746 seq_puts(m, " SESSION name, addr/port src-tid/sid " 1747 "dest-tid/sid state user-data-ok\n"); 1748 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n"); 1749 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1750 goto out; 1751 } 1752 1753 /* Show the tunnel or session context. 1754 */ 1755 if (!pd->session) { 1756 pppol2tp_seq_tunnel_show(m, pd->tunnel); 1757 } else { 1758 pppol2tp_seq_session_show(m, pd->session); 1759 l2tp_session_dec_refcount(pd->session); 1760 } 1761 1762 out: 1763 return 0; 1764 } 1765 1766 static const struct seq_operations pppol2tp_seq_ops = { 1767 .start = pppol2tp_seq_start, 1768 .next = pppol2tp_seq_next, 1769 .stop = pppol2tp_seq_stop, 1770 .show = pppol2tp_seq_show, 1771 }; 1772 1773 /* Called when our /proc file is opened. We allocate data for use when 1774 * iterating our tunnel / session contexts and store it in the private 1775 * data of the seq_file. 1776 */ 1777 static int pppol2tp_proc_open(struct inode *inode, struct file *file) 1778 { 1779 return seq_open_net(inode, file, &pppol2tp_seq_ops, 1780 sizeof(struct pppol2tp_seq_data)); 1781 } 1782 1783 static const struct file_operations pppol2tp_proc_fops = { 1784 .owner = THIS_MODULE, 1785 .open = pppol2tp_proc_open, 1786 .read = seq_read, 1787 .llseek = seq_lseek, 1788 .release = seq_release_net, 1789 }; 1790 1791 #endif /* CONFIG_PROC_FS */ 1792 1793 /***************************************************************************** 1794 * Network namespace 1795 *****************************************************************************/ 1796 1797 static __net_init int pppol2tp_init_net(struct net *net) 1798 { 1799 struct proc_dir_entry *pde; 1800 int err = 0; 1801 1802 pde = proc_create("pppol2tp", S_IRUGO, net->proc_net, 1803 &pppol2tp_proc_fops); 1804 if (!pde) { 1805 err = -ENOMEM; 1806 goto out; 1807 } 1808 1809 out: 1810 return err; 1811 } 1812 1813 static __net_exit void pppol2tp_exit_net(struct net *net) 1814 { 1815 remove_proc_entry("pppol2tp", net->proc_net); 1816 } 1817 1818 static struct pernet_operations pppol2tp_net_ops = { 1819 .init = pppol2tp_init_net, 1820 .exit = pppol2tp_exit_net, 1821 .id = &pppol2tp_net_id, 1822 }; 1823 1824 /***************************************************************************** 1825 * Init and cleanup 1826 *****************************************************************************/ 1827 1828 static const struct proto_ops pppol2tp_ops = { 1829 .family = AF_PPPOX, 1830 .owner = THIS_MODULE, 1831 .release = pppol2tp_release, 1832 .bind = sock_no_bind, 1833 .connect = pppol2tp_connect, 1834 .socketpair = sock_no_socketpair, 1835 .accept = sock_no_accept, 1836 .getname = pppol2tp_getname, 1837 .poll = datagram_poll, 1838 .listen = sock_no_listen, 1839 .shutdown = sock_no_shutdown, 1840 .setsockopt = pppol2tp_setsockopt, 1841 .getsockopt = pppol2tp_getsockopt, 1842 .sendmsg = pppol2tp_sendmsg, 1843 .recvmsg = pppol2tp_recvmsg, 1844 .mmap = sock_no_mmap, 1845 .ioctl = pppox_ioctl, 1846 }; 1847 1848 static const struct pppox_proto pppol2tp_proto = { 1849 .create = pppol2tp_create, 1850 .ioctl = pppol2tp_ioctl, 1851 .owner = THIS_MODULE, 1852 }; 1853 1854 #ifdef CONFIG_L2TP_V3 1855 1856 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = { 1857 .session_create = pppol2tp_session_create, 1858 .session_delete = l2tp_session_delete, 1859 }; 1860 1861 #endif /* CONFIG_L2TP_V3 */ 1862 1863 static int __init pppol2tp_init(void) 1864 { 1865 int err; 1866 1867 err = register_pernet_device(&pppol2tp_net_ops); 1868 if (err) 1869 goto out; 1870 1871 err = proto_register(&pppol2tp_sk_proto, 0); 1872 if (err) 1873 goto out_unregister_pppol2tp_pernet; 1874 1875 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto); 1876 if (err) 1877 goto out_unregister_pppol2tp_proto; 1878 1879 #ifdef CONFIG_L2TP_V3 1880 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops); 1881 if (err) 1882 goto out_unregister_pppox; 1883 #endif 1884 1885 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION); 1886 1887 out: 1888 return err; 1889 1890 #ifdef CONFIG_L2TP_V3 1891 out_unregister_pppox: 1892 unregister_pppox_proto(PX_PROTO_OL2TP); 1893 #endif 1894 out_unregister_pppol2tp_proto: 1895 proto_unregister(&pppol2tp_sk_proto); 1896 out_unregister_pppol2tp_pernet: 1897 unregister_pernet_device(&pppol2tp_net_ops); 1898 goto out; 1899 } 1900 1901 static void __exit pppol2tp_exit(void) 1902 { 1903 #ifdef CONFIG_L2TP_V3 1904 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP); 1905 #endif 1906 unregister_pppox_proto(PX_PROTO_OL2TP); 1907 proto_unregister(&pppol2tp_sk_proto); 1908 unregister_pernet_device(&pppol2tp_net_ops); 1909 } 1910 1911 module_init(pppol2tp_init); 1912 module_exit(pppol2tp_exit); 1913 1914 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1915 MODULE_DESCRIPTION("PPP over L2TP over UDP"); 1916 MODULE_LICENSE("GPL"); 1917 MODULE_VERSION(PPPOL2TP_DRV_VERSION); 1918 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP); 1919 MODULE_ALIAS_L2TP_PWTYPE(7); 1920