1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /***************************************************************************** 3 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets 4 * 5 * PPPoX --- Generic PPP encapsulation socket family 6 * PPPoL2TP --- PPP over L2TP (RFC 2661) 7 * 8 * Version: 2.0.0 9 * 10 * Authors: James Chapman (jchapman@katalix.com) 11 * 12 * Based on original work by Martijn van Oosterhout <kleptog@svana.org> 13 * 14 * License: 15 */ 16 17 /* This driver handles only L2TP data frames; control frames are handled by a 18 * userspace application. 19 * 20 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and 21 * attaches it to a bound UDP socket with local tunnel_id / session_id and 22 * peer tunnel_id / session_id set. Data can then be sent or received using 23 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket 24 * can be read or modified using ioctl() or [gs]etsockopt() calls. 25 * 26 * When a PPPoL2TP socket is connected with local and peer session_id values 27 * zero, the socket is treated as a special tunnel management socket. 28 * 29 * Here's example userspace code to create a socket for sending/receiving data 30 * over an L2TP session:- 31 * 32 * struct sockaddr_pppol2tp sax; 33 * int fd; 34 * int session_fd; 35 * 36 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); 37 * 38 * sax.sa_family = AF_PPPOX; 39 * sax.sa_protocol = PX_PROTO_OL2TP; 40 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket 41 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr; 42 * sax.pppol2tp.addr.sin_port = addr->sin_port; 43 * sax.pppol2tp.addr.sin_family = AF_INET; 44 * sax.pppol2tp.s_tunnel = tunnel_id; 45 * sax.pppol2tp.s_session = session_id; 46 * sax.pppol2tp.d_tunnel = peer_tunnel_id; 47 * sax.pppol2tp.d_session = peer_session_id; 48 * 49 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax)); 50 * 51 * A pppd plugin that allows PPP traffic to be carried over L2TP using 52 * this driver is available from the OpenL2TP project at 53 * http://openl2tp.sourceforge.net. 54 */ 55 56 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 57 58 #include <linux/module.h> 59 #include <linux/string.h> 60 #include <linux/list.h> 61 #include <linux/uaccess.h> 62 63 #include <linux/kernel.h> 64 #include <linux/spinlock.h> 65 #include <linux/kthread.h> 66 #include <linux/sched.h> 67 #include <linux/slab.h> 68 #include <linux/errno.h> 69 #include <linux/jiffies.h> 70 71 #include <linux/netdevice.h> 72 #include <linux/net.h> 73 #include <linux/inetdevice.h> 74 #include <linux/skbuff.h> 75 #include <linux/init.h> 76 #include <linux/ip.h> 77 #include <linux/udp.h> 78 #include <linux/if_pppox.h> 79 #include <linux/if_pppol2tp.h> 80 #include <net/sock.h> 81 #include <linux/ppp_channel.h> 82 #include <linux/ppp_defs.h> 83 #include <linux/ppp-ioctl.h> 84 #include <linux/file.h> 85 #include <linux/hash.h> 86 #include <linux/sort.h> 87 #include <linux/proc_fs.h> 88 #include <linux/l2tp.h> 89 #include <linux/nsproxy.h> 90 #include <net/net_namespace.h> 91 #include <net/netns/generic.h> 92 #include <net/ip.h> 93 #include <net/udp.h> 94 #include <net/inet_common.h> 95 96 #include <asm/byteorder.h> 97 #include <linux/atomic.h> 98 99 #include "l2tp_core.h" 100 101 #define PPPOL2TP_DRV_VERSION "V2.0" 102 103 /* Space for UDP, L2TP and PPP headers */ 104 #define PPPOL2TP_HEADER_OVERHEAD 40 105 106 /* Number of bytes to build transmit L2TP headers. 107 * Unfortunately the size is different depending on whether sequence numbers 108 * are enabled. 109 */ 110 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10 111 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6 112 113 /* Private data of each session. This data lives at the end of struct 114 * l2tp_session, referenced via session->priv[]. 115 */ 116 struct pppol2tp_session { 117 int owner; /* pid that opened the socket */ 118 119 struct mutex sk_lock; /* Protects .sk */ 120 struct sock __rcu *sk; /* Pointer to the session PPPoX socket */ 121 struct sock *__sk; /* Copy of .sk, for cleanup */ 122 struct rcu_head rcu; /* For asynchronous release */ 123 }; 124 125 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb); 126 127 static const struct ppp_channel_ops pppol2tp_chan_ops = { 128 .start_xmit = pppol2tp_xmit, 129 }; 130 131 static const struct proto_ops pppol2tp_ops; 132 133 /* Retrieves the pppol2tp socket associated to a session. 134 * A reference is held on the returned socket, so this function must be paired 135 * with sock_put(). 136 */ 137 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) 138 { 139 struct pppol2tp_session *ps = l2tp_session_priv(session); 140 struct sock *sk; 141 142 rcu_read_lock(); 143 sk = rcu_dereference(ps->sk); 144 if (sk) 145 sock_hold(sk); 146 rcu_read_unlock(); 147 148 return sk; 149 } 150 151 /* Helpers to obtain tunnel/session contexts from sockets. 152 */ 153 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) 154 { 155 struct l2tp_session *session; 156 157 if (!sk) 158 return NULL; 159 160 sock_hold(sk); 161 session = (struct l2tp_session *)(sk->sk_user_data); 162 if (!session) { 163 sock_put(sk); 164 goto out; 165 } 166 if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) { 167 session = NULL; 168 sock_put(sk); 169 goto out; 170 } 171 172 out: 173 return session; 174 } 175 176 /***************************************************************************** 177 * Receive data handling 178 *****************************************************************************/ 179 180 /* Receive message. This is the recvmsg for the PPPoL2TP socket. 181 */ 182 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, 183 size_t len, int flags) 184 { 185 int err; 186 struct sk_buff *skb; 187 struct sock *sk = sock->sk; 188 189 err = -EIO; 190 if (sk->sk_state & PPPOX_BOUND) 191 goto end; 192 193 err = 0; 194 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 195 flags & MSG_DONTWAIT, &err); 196 if (!skb) 197 goto end; 198 199 if (len > skb->len) 200 len = skb->len; 201 else if (len < skb->len) 202 msg->msg_flags |= MSG_TRUNC; 203 204 err = skb_copy_datagram_msg(skb, 0, msg, len); 205 if (likely(err == 0)) 206 err = len; 207 208 kfree_skb(skb); 209 end: 210 return err; 211 } 212 213 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) 214 { 215 struct pppol2tp_session *ps = l2tp_session_priv(session); 216 struct sock *sk = NULL; 217 218 /* If the socket is bound, send it in to PPP's input queue. Otherwise 219 * queue it on the session socket. 220 */ 221 rcu_read_lock(); 222 sk = rcu_dereference(ps->sk); 223 if (!sk) 224 goto no_sock; 225 226 /* If the first two bytes are 0xFF03, consider that it is the PPP's 227 * Address and Control fields and skip them. The L2TP module has always 228 * worked this way, although, in theory, the use of these fields should 229 * be negociated and handled at the PPP layer. These fields are 230 * constant: 0xFF is the All-Stations Address and 0x03 the Unnumbered 231 * Information command with Poll/Final bit set to zero (RFC 1662). 232 */ 233 if (pskb_may_pull(skb, 2) && skb->data[0] == PPP_ALLSTATIONS && 234 skb->data[1] == PPP_UI) 235 skb_pull(skb, 2); 236 237 if (sk->sk_state & PPPOX_BOUND) { 238 struct pppox_sock *po; 239 240 po = pppox_sk(sk); 241 ppp_input(&po->chan, skb); 242 } else { 243 if (sock_queue_rcv_skb(sk, skb) < 0) { 244 atomic_long_inc(&session->stats.rx_errors); 245 kfree_skb(skb); 246 } 247 } 248 rcu_read_unlock(); 249 250 return; 251 252 no_sock: 253 rcu_read_unlock(); 254 pr_warn_ratelimited("%s: no socket in recv\n", session->name); 255 kfree_skb(skb); 256 } 257 258 /************************************************************************ 259 * Transmit handling 260 ***********************************************************************/ 261 262 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here 263 * when a user application does a sendmsg() on the session socket. L2TP and 264 * PPP headers must be inserted into the user's data. 265 */ 266 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m, 267 size_t total_len) 268 { 269 struct sock *sk = sock->sk; 270 struct sk_buff *skb; 271 int error; 272 struct l2tp_session *session; 273 struct l2tp_tunnel *tunnel; 274 int uhlen; 275 276 error = -ENOTCONN; 277 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 278 goto error; 279 280 /* Get session and tunnel contexts */ 281 error = -EBADF; 282 session = pppol2tp_sock_to_session(sk); 283 if (!session) 284 goto error; 285 286 tunnel = session->tunnel; 287 288 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 289 290 /* Allocate a socket buffer */ 291 error = -ENOMEM; 292 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 293 uhlen + session->hdr_len + 294 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 295 0, GFP_KERNEL); 296 if (!skb) 297 goto error_put_sess; 298 299 /* Reserve space for headers. */ 300 skb_reserve(skb, NET_SKB_PAD); 301 skb_reset_network_header(skb); 302 skb_reserve(skb, sizeof(struct iphdr)); 303 skb_reset_transport_header(skb); 304 skb_reserve(skb, uhlen); 305 306 /* Add PPP header */ 307 skb->data[0] = PPP_ALLSTATIONS; 308 skb->data[1] = PPP_UI; 309 skb_put(skb, 2); 310 311 /* Copy user data into skb */ 312 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len); 313 if (error < 0) { 314 kfree_skb(skb); 315 goto error_put_sess; 316 } 317 318 local_bh_disable(); 319 l2tp_xmit_skb(session, skb); 320 local_bh_enable(); 321 322 sock_put(sk); 323 324 return total_len; 325 326 error_put_sess: 327 sock_put(sk); 328 error: 329 return error; 330 } 331 332 /* Transmit function called by generic PPP driver. Sends PPP frame 333 * over PPPoL2TP socket. 334 * 335 * This is almost the same as pppol2tp_sendmsg(), but rather than 336 * being called with a msghdr from userspace, it is called with a skb 337 * from the kernel. 338 * 339 * The supplied skb from ppp doesn't have enough headroom for the 340 * insertion of L2TP, UDP and IP headers so we need to allocate more 341 * headroom in the skb. This will create a cloned skb. But we must be 342 * careful in the error case because the caller will expect to free 343 * the skb it supplied, not our cloned skb. So we take care to always 344 * leave the original skb unfreed if we return an error. 345 */ 346 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) 347 { 348 struct sock *sk = (struct sock *)chan->private; 349 struct l2tp_session *session; 350 struct l2tp_tunnel *tunnel; 351 int uhlen, headroom; 352 353 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 354 goto abort; 355 356 /* Get session and tunnel contexts from the socket */ 357 session = pppol2tp_sock_to_session(sk); 358 if (!session) 359 goto abort; 360 361 tunnel = session->tunnel; 362 363 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 364 headroom = NET_SKB_PAD + 365 sizeof(struct iphdr) + /* IP header */ 366 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */ 367 session->hdr_len + /* L2TP header */ 368 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 369 if (skb_cow_head(skb, headroom)) 370 goto abort_put_sess; 371 372 /* Setup PPP header */ 373 __skb_push(skb, 2); 374 skb->data[0] = PPP_ALLSTATIONS; 375 skb->data[1] = PPP_UI; 376 377 local_bh_disable(); 378 l2tp_xmit_skb(session, skb); 379 local_bh_enable(); 380 381 sock_put(sk); 382 383 return 1; 384 385 abort_put_sess: 386 sock_put(sk); 387 abort: 388 /* Free the original skb */ 389 kfree_skb(skb); 390 return 1; 391 } 392 393 /***************************************************************************** 394 * Session (and tunnel control) socket create/destroy. 395 *****************************************************************************/ 396 397 static void pppol2tp_put_sk(struct rcu_head *head) 398 { 399 struct pppol2tp_session *ps; 400 401 ps = container_of(head, typeof(*ps), rcu); 402 sock_put(ps->__sk); 403 } 404 405 /* Really kill the session socket. (Called from sock_put() if 406 * refcnt == 0.) 407 */ 408 static void pppol2tp_session_destruct(struct sock *sk) 409 { 410 struct l2tp_session *session = sk->sk_user_data; 411 412 skb_queue_purge(&sk->sk_receive_queue); 413 skb_queue_purge(&sk->sk_write_queue); 414 415 if (session) { 416 sk->sk_user_data = NULL; 417 if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) 418 return; 419 l2tp_session_dec_refcount(session); 420 } 421 } 422 423 /* Called when the PPPoX socket (session) is closed. 424 */ 425 static int pppol2tp_release(struct socket *sock) 426 { 427 struct sock *sk = sock->sk; 428 struct l2tp_session *session; 429 int error; 430 431 if (!sk) 432 return 0; 433 434 error = -EBADF; 435 lock_sock(sk); 436 if (sock_flag(sk, SOCK_DEAD) != 0) 437 goto error; 438 439 pppox_unbind_sock(sk); 440 441 /* Signal the death of the socket. */ 442 sk->sk_state = PPPOX_DEAD; 443 sock_orphan(sk); 444 sock->sk = NULL; 445 446 session = pppol2tp_sock_to_session(sk); 447 if (session) { 448 struct pppol2tp_session *ps; 449 450 l2tp_session_delete(session); 451 452 ps = l2tp_session_priv(session); 453 mutex_lock(&ps->sk_lock); 454 ps->__sk = rcu_dereference_protected(ps->sk, 455 lockdep_is_held(&ps->sk_lock)); 456 RCU_INIT_POINTER(ps->sk, NULL); 457 mutex_unlock(&ps->sk_lock); 458 call_rcu(&ps->rcu, pppol2tp_put_sk); 459 460 /* Rely on the sock_put() call at the end of the function for 461 * dropping the reference held by pppol2tp_sock_to_session(). 462 * The last reference will be dropped by pppol2tp_put_sk(). 463 */ 464 } 465 466 release_sock(sk); 467 468 /* This will delete the session context via 469 * pppol2tp_session_destruct() if the socket's refcnt drops to 470 * zero. 471 */ 472 sock_put(sk); 473 474 return 0; 475 476 error: 477 release_sock(sk); 478 return error; 479 } 480 481 static struct proto pppol2tp_sk_proto = { 482 .name = "PPPOL2TP", 483 .owner = THIS_MODULE, 484 .obj_size = sizeof(struct pppox_sock), 485 }; 486 487 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb) 488 { 489 int rc; 490 491 rc = l2tp_udp_encap_recv(sk, skb); 492 if (rc) 493 kfree_skb(skb); 494 495 return NET_RX_SUCCESS; 496 } 497 498 /* socket() handler. Initialize a new struct sock. 499 */ 500 static int pppol2tp_create(struct net *net, struct socket *sock, int kern) 501 { 502 int error = -ENOMEM; 503 struct sock *sk; 504 505 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern); 506 if (!sk) 507 goto out; 508 509 sock_init_data(sock, sk); 510 511 sock->state = SS_UNCONNECTED; 512 sock->ops = &pppol2tp_ops; 513 514 sk->sk_backlog_rcv = pppol2tp_backlog_recv; 515 sk->sk_protocol = PX_PROTO_OL2TP; 516 sk->sk_family = PF_PPPOX; 517 sk->sk_state = PPPOX_NONE; 518 sk->sk_type = SOCK_STREAM; 519 sk->sk_destruct = pppol2tp_session_destruct; 520 521 error = 0; 522 523 out: 524 return error; 525 } 526 527 static void pppol2tp_show(struct seq_file *m, void *arg) 528 { 529 struct l2tp_session *session = arg; 530 struct sock *sk; 531 532 sk = pppol2tp_session_get_sock(session); 533 if (sk) { 534 struct pppox_sock *po = pppox_sk(sk); 535 536 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 537 sock_put(sk); 538 } 539 } 540 541 static void pppol2tp_session_init(struct l2tp_session *session) 542 { 543 struct pppol2tp_session *ps; 544 545 session->recv_skb = pppol2tp_recv; 546 if (IS_ENABLED(CONFIG_L2TP_DEBUGFS)) 547 session->show = pppol2tp_show; 548 549 ps = l2tp_session_priv(session); 550 mutex_init(&ps->sk_lock); 551 ps->owner = current->pid; 552 } 553 554 struct l2tp_connect_info { 555 u8 version; 556 int fd; 557 u32 tunnel_id; 558 u32 peer_tunnel_id; 559 u32 session_id; 560 u32 peer_session_id; 561 }; 562 563 static int pppol2tp_sockaddr_get_info(const void *sa, int sa_len, 564 struct l2tp_connect_info *info) 565 { 566 switch (sa_len) { 567 case sizeof(struct sockaddr_pppol2tp): 568 { 569 const struct sockaddr_pppol2tp *sa_v2in4 = sa; 570 571 if (sa_v2in4->sa_protocol != PX_PROTO_OL2TP) 572 return -EINVAL; 573 574 info->version = 2; 575 info->fd = sa_v2in4->pppol2tp.fd; 576 info->tunnel_id = sa_v2in4->pppol2tp.s_tunnel; 577 info->peer_tunnel_id = sa_v2in4->pppol2tp.d_tunnel; 578 info->session_id = sa_v2in4->pppol2tp.s_session; 579 info->peer_session_id = sa_v2in4->pppol2tp.d_session; 580 581 break; 582 } 583 case sizeof(struct sockaddr_pppol2tpv3): 584 { 585 const struct sockaddr_pppol2tpv3 *sa_v3in4 = sa; 586 587 if (sa_v3in4->sa_protocol != PX_PROTO_OL2TP) 588 return -EINVAL; 589 590 info->version = 3; 591 info->fd = sa_v3in4->pppol2tp.fd; 592 info->tunnel_id = sa_v3in4->pppol2tp.s_tunnel; 593 info->peer_tunnel_id = sa_v3in4->pppol2tp.d_tunnel; 594 info->session_id = sa_v3in4->pppol2tp.s_session; 595 info->peer_session_id = sa_v3in4->pppol2tp.d_session; 596 597 break; 598 } 599 case sizeof(struct sockaddr_pppol2tpin6): 600 { 601 const struct sockaddr_pppol2tpin6 *sa_v2in6 = sa; 602 603 if (sa_v2in6->sa_protocol != PX_PROTO_OL2TP) 604 return -EINVAL; 605 606 info->version = 2; 607 info->fd = sa_v2in6->pppol2tp.fd; 608 info->tunnel_id = sa_v2in6->pppol2tp.s_tunnel; 609 info->peer_tunnel_id = sa_v2in6->pppol2tp.d_tunnel; 610 info->session_id = sa_v2in6->pppol2tp.s_session; 611 info->peer_session_id = sa_v2in6->pppol2tp.d_session; 612 613 break; 614 } 615 case sizeof(struct sockaddr_pppol2tpv3in6): 616 { 617 const struct sockaddr_pppol2tpv3in6 *sa_v3in6 = sa; 618 619 if (sa_v3in6->sa_protocol != PX_PROTO_OL2TP) 620 return -EINVAL; 621 622 info->version = 3; 623 info->fd = sa_v3in6->pppol2tp.fd; 624 info->tunnel_id = sa_v3in6->pppol2tp.s_tunnel; 625 info->peer_tunnel_id = sa_v3in6->pppol2tp.d_tunnel; 626 info->session_id = sa_v3in6->pppol2tp.s_session; 627 info->peer_session_id = sa_v3in6->pppol2tp.d_session; 628 629 break; 630 } 631 default: 632 return -EINVAL; 633 } 634 635 return 0; 636 } 637 638 /* Rough estimation of the maximum payload size a tunnel can transmit without 639 * fragmenting at the lower IP layer. Assumes L2TPv2 with sequence 640 * numbers and no IP option. Not quite accurate, but the result is mostly 641 * unused anyway. 642 */ 643 static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel) 644 { 645 int mtu; 646 647 mtu = l2tp_tunnel_dst_mtu(tunnel); 648 if (mtu <= PPPOL2TP_HEADER_OVERHEAD) 649 return 1500 - PPPOL2TP_HEADER_OVERHEAD; 650 651 return mtu - PPPOL2TP_HEADER_OVERHEAD; 652 } 653 654 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket 655 */ 656 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 657 int sockaddr_len, int flags) 658 { 659 struct sock *sk = sock->sk; 660 struct pppox_sock *po = pppox_sk(sk); 661 struct l2tp_session *session = NULL; 662 struct l2tp_connect_info info; 663 struct l2tp_tunnel *tunnel; 664 struct pppol2tp_session *ps; 665 struct l2tp_session_cfg cfg = { 0, }; 666 bool drop_refcnt = false; 667 bool drop_tunnel = false; 668 bool new_session = false; 669 bool new_tunnel = false; 670 int error; 671 672 error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info); 673 if (error < 0) 674 return error; 675 676 lock_sock(sk); 677 678 /* Check for already bound sockets */ 679 error = -EBUSY; 680 if (sk->sk_state & PPPOX_CONNECTED) 681 goto end; 682 683 /* We don't supporting rebinding anyway */ 684 error = -EALREADY; 685 if (sk->sk_user_data) 686 goto end; /* socket is already attached */ 687 688 /* Don't bind if tunnel_id is 0 */ 689 error = -EINVAL; 690 if (!info.tunnel_id) 691 goto end; 692 693 tunnel = l2tp_tunnel_get(sock_net(sk), info.tunnel_id); 694 if (tunnel) 695 drop_tunnel = true; 696 697 /* Special case: create tunnel context if session_id and 698 * peer_session_id is 0. Otherwise look up tunnel using supplied 699 * tunnel id. 700 */ 701 if (!info.session_id && !info.peer_session_id) { 702 if (!tunnel) { 703 struct l2tp_tunnel_cfg tcfg = { 704 .encap = L2TP_ENCAPTYPE_UDP, 705 }; 706 707 /* Prevent l2tp_tunnel_register() from trying to set up 708 * a kernel socket. 709 */ 710 if (info.fd < 0) { 711 error = -EBADF; 712 goto end; 713 } 714 715 error = l2tp_tunnel_create(info.fd, 716 info.version, 717 info.tunnel_id, 718 info.peer_tunnel_id, &tcfg, 719 &tunnel); 720 if (error < 0) 721 goto end; 722 723 l2tp_tunnel_inc_refcount(tunnel); 724 error = l2tp_tunnel_register(tunnel, sock_net(sk), 725 &tcfg); 726 if (error < 0) { 727 kfree(tunnel); 728 goto end; 729 } 730 drop_tunnel = true; 731 new_tunnel = true; 732 } 733 } else { 734 /* Error if we can't find the tunnel */ 735 error = -ENOENT; 736 if (!tunnel) 737 goto end; 738 739 /* Error if socket is not prepped */ 740 if (!tunnel->sock) 741 goto end; 742 } 743 744 if (tunnel->peer_tunnel_id == 0) 745 tunnel->peer_tunnel_id = info.peer_tunnel_id; 746 747 session = l2tp_tunnel_get_session(tunnel, info.session_id); 748 if (session) { 749 drop_refcnt = true; 750 751 if (session->pwtype != L2TP_PWTYPE_PPP) { 752 error = -EPROTOTYPE; 753 goto end; 754 } 755 756 ps = l2tp_session_priv(session); 757 758 /* Using a pre-existing session is fine as long as it hasn't 759 * been connected yet. 760 */ 761 mutex_lock(&ps->sk_lock); 762 if (rcu_dereference_protected(ps->sk, 763 lockdep_is_held(&ps->sk_lock)) || 764 ps->__sk) { 765 mutex_unlock(&ps->sk_lock); 766 error = -EEXIST; 767 goto end; 768 } 769 } else { 770 cfg.pw_type = L2TP_PWTYPE_PPP; 771 772 session = l2tp_session_create(sizeof(struct pppol2tp_session), 773 tunnel, info.session_id, 774 info.peer_session_id, &cfg); 775 if (IS_ERR(session)) { 776 error = PTR_ERR(session); 777 goto end; 778 } 779 780 pppol2tp_session_init(session); 781 ps = l2tp_session_priv(session); 782 l2tp_session_inc_refcount(session); 783 784 mutex_lock(&ps->sk_lock); 785 error = l2tp_session_register(session, tunnel); 786 if (error < 0) { 787 mutex_unlock(&ps->sk_lock); 788 kfree(session); 789 goto end; 790 } 791 drop_refcnt = true; 792 new_session = true; 793 } 794 795 /* Special case: if source & dest session_id == 0x0000, this 796 * socket is being created to manage the tunnel. Just set up 797 * the internal context for use by ioctl() and sockopt() 798 * handlers. 799 */ 800 if (session->session_id == 0 && session->peer_session_id == 0) { 801 error = 0; 802 goto out_no_ppp; 803 } 804 805 /* The only header we need to worry about is the L2TP 806 * header. This size is different depending on whether 807 * sequence numbers are enabled for the data channel. 808 */ 809 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 810 811 po->chan.private = sk; 812 po->chan.ops = &pppol2tp_chan_ops; 813 po->chan.mtu = pppol2tp_tunnel_mtu(tunnel); 814 815 error = ppp_register_net_channel(sock_net(sk), &po->chan); 816 if (error) { 817 mutex_unlock(&ps->sk_lock); 818 goto end; 819 } 820 821 out_no_ppp: 822 /* This is how we get the session context from the socket. */ 823 sk->sk_user_data = session; 824 rcu_assign_pointer(ps->sk, sk); 825 mutex_unlock(&ps->sk_lock); 826 827 /* Keep the reference we've grabbed on the session: sk doesn't expect 828 * the session to disappear. pppol2tp_session_destruct() is responsible 829 * for dropping it. 830 */ 831 drop_refcnt = false; 832 833 sk->sk_state = PPPOX_CONNECTED; 834 835 end: 836 if (error) { 837 if (new_session) 838 l2tp_session_delete(session); 839 if (new_tunnel) 840 l2tp_tunnel_delete(tunnel); 841 } 842 if (drop_refcnt) 843 l2tp_session_dec_refcount(session); 844 if (drop_tunnel) 845 l2tp_tunnel_dec_refcount(tunnel); 846 release_sock(sk); 847 848 return error; 849 } 850 851 #ifdef CONFIG_L2TP_V3 852 853 /* Called when creating sessions via the netlink interface. */ 854 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, 855 u32 session_id, u32 peer_session_id, 856 struct l2tp_session_cfg *cfg) 857 { 858 int error; 859 struct l2tp_session *session; 860 861 /* Error if tunnel socket is not prepped */ 862 if (!tunnel->sock) { 863 error = -ENOENT; 864 goto err; 865 } 866 867 /* Allocate and initialize a new session context. */ 868 session = l2tp_session_create(sizeof(struct pppol2tp_session), 869 tunnel, session_id, 870 peer_session_id, cfg); 871 if (IS_ERR(session)) { 872 error = PTR_ERR(session); 873 goto err; 874 } 875 876 pppol2tp_session_init(session); 877 878 error = l2tp_session_register(session, tunnel); 879 if (error < 0) 880 goto err_sess; 881 882 return 0; 883 884 err_sess: 885 kfree(session); 886 err: 887 return error; 888 } 889 890 #endif /* CONFIG_L2TP_V3 */ 891 892 /* getname() support. 893 */ 894 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr, 895 int peer) 896 { 897 int len = 0; 898 int error = 0; 899 struct l2tp_session *session; 900 struct l2tp_tunnel *tunnel; 901 struct sock *sk = sock->sk; 902 struct inet_sock *inet; 903 struct pppol2tp_session *pls; 904 905 error = -ENOTCONN; 906 if (!sk) 907 goto end; 908 if (!(sk->sk_state & PPPOX_CONNECTED)) 909 goto end; 910 911 error = -EBADF; 912 session = pppol2tp_sock_to_session(sk); 913 if (!session) 914 goto end; 915 916 pls = l2tp_session_priv(session); 917 tunnel = session->tunnel; 918 919 inet = inet_sk(tunnel->sock); 920 if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET) { 921 struct sockaddr_pppol2tp sp; 922 923 len = sizeof(sp); 924 memset(&sp, 0, len); 925 sp.sa_family = AF_PPPOX; 926 sp.sa_protocol = PX_PROTO_OL2TP; 927 sp.pppol2tp.fd = tunnel->fd; 928 sp.pppol2tp.pid = pls->owner; 929 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 930 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 931 sp.pppol2tp.s_session = session->session_id; 932 sp.pppol2tp.d_session = session->peer_session_id; 933 sp.pppol2tp.addr.sin_family = AF_INET; 934 sp.pppol2tp.addr.sin_port = inet->inet_dport; 935 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 936 memcpy(uaddr, &sp, len); 937 #if IS_ENABLED(CONFIG_IPV6) 938 } else if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET6) { 939 struct sockaddr_pppol2tpin6 sp; 940 941 len = sizeof(sp); 942 memset(&sp, 0, len); 943 sp.sa_family = AF_PPPOX; 944 sp.sa_protocol = PX_PROTO_OL2TP; 945 sp.pppol2tp.fd = tunnel->fd; 946 sp.pppol2tp.pid = pls->owner; 947 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 948 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 949 sp.pppol2tp.s_session = session->session_id; 950 sp.pppol2tp.d_session = session->peer_session_id; 951 sp.pppol2tp.addr.sin6_family = AF_INET6; 952 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 953 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 954 sizeof(tunnel->sock->sk_v6_daddr)); 955 memcpy(uaddr, &sp, len); 956 } else if (tunnel->version == 3 && tunnel->sock->sk_family == AF_INET6) { 957 struct sockaddr_pppol2tpv3in6 sp; 958 959 len = sizeof(sp); 960 memset(&sp, 0, len); 961 sp.sa_family = AF_PPPOX; 962 sp.sa_protocol = PX_PROTO_OL2TP; 963 sp.pppol2tp.fd = tunnel->fd; 964 sp.pppol2tp.pid = pls->owner; 965 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 966 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 967 sp.pppol2tp.s_session = session->session_id; 968 sp.pppol2tp.d_session = session->peer_session_id; 969 sp.pppol2tp.addr.sin6_family = AF_INET6; 970 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 971 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 972 sizeof(tunnel->sock->sk_v6_daddr)); 973 memcpy(uaddr, &sp, len); 974 #endif 975 } else if (tunnel->version == 3) { 976 struct sockaddr_pppol2tpv3 sp; 977 978 len = sizeof(sp); 979 memset(&sp, 0, len); 980 sp.sa_family = AF_PPPOX; 981 sp.sa_protocol = PX_PROTO_OL2TP; 982 sp.pppol2tp.fd = tunnel->fd; 983 sp.pppol2tp.pid = pls->owner; 984 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 985 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 986 sp.pppol2tp.s_session = session->session_id; 987 sp.pppol2tp.d_session = session->peer_session_id; 988 sp.pppol2tp.addr.sin_family = AF_INET; 989 sp.pppol2tp.addr.sin_port = inet->inet_dport; 990 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 991 memcpy(uaddr, &sp, len); 992 } 993 994 error = len; 995 996 sock_put(sk); 997 end: 998 return error; 999 } 1000 1001 /**************************************************************************** 1002 * ioctl() handlers. 1003 * 1004 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1005 * sockets. However, in order to control kernel tunnel features, we allow 1006 * userspace to create a special "tunnel" PPPoX socket which is used for 1007 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow 1008 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl() 1009 * calls. 1010 ****************************************************************************/ 1011 1012 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest, 1013 const struct l2tp_stats *stats) 1014 { 1015 memset(dest, 0, sizeof(*dest)); 1016 1017 dest->tx_packets = atomic_long_read(&stats->tx_packets); 1018 dest->tx_bytes = atomic_long_read(&stats->tx_bytes); 1019 dest->tx_errors = atomic_long_read(&stats->tx_errors); 1020 dest->rx_packets = atomic_long_read(&stats->rx_packets); 1021 dest->rx_bytes = atomic_long_read(&stats->rx_bytes); 1022 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards); 1023 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets); 1024 dest->rx_errors = atomic_long_read(&stats->rx_errors); 1025 } 1026 1027 static int pppol2tp_tunnel_copy_stats(struct pppol2tp_ioc_stats *stats, 1028 struct l2tp_tunnel *tunnel) 1029 { 1030 struct l2tp_session *session; 1031 1032 if (!stats->session_id) { 1033 pppol2tp_copy_stats(stats, &tunnel->stats); 1034 return 0; 1035 } 1036 1037 /* If session_id is set, search the corresponding session in the 1038 * context of this tunnel and record the session's statistics. 1039 */ 1040 session = l2tp_tunnel_get_session(tunnel, stats->session_id); 1041 if (!session) 1042 return -EBADR; 1043 1044 if (session->pwtype != L2TP_PWTYPE_PPP) { 1045 l2tp_session_dec_refcount(session); 1046 return -EBADR; 1047 } 1048 1049 pppol2tp_copy_stats(stats, &session->stats); 1050 l2tp_session_dec_refcount(session); 1051 1052 return 0; 1053 } 1054 1055 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, 1056 unsigned long arg) 1057 { 1058 struct pppol2tp_ioc_stats stats; 1059 struct l2tp_session *session; 1060 1061 switch (cmd) { 1062 case PPPIOCGMRU: 1063 case PPPIOCGFLAGS: 1064 session = sock->sk->sk_user_data; 1065 if (!session) 1066 return -ENOTCONN; 1067 1068 /* Not defined for tunnels */ 1069 if (!session->session_id && !session->peer_session_id) 1070 return -ENOSYS; 1071 1072 if (put_user(0, (int __user *)arg)) 1073 return -EFAULT; 1074 break; 1075 1076 case PPPIOCSMRU: 1077 case PPPIOCSFLAGS: 1078 session = sock->sk->sk_user_data; 1079 if (!session) 1080 return -ENOTCONN; 1081 1082 /* Not defined for tunnels */ 1083 if (!session->session_id && !session->peer_session_id) 1084 return -ENOSYS; 1085 1086 if (!access_ok((int __user *)arg, sizeof(int))) 1087 return -EFAULT; 1088 break; 1089 1090 case PPPIOCGL2TPSTATS: 1091 session = sock->sk->sk_user_data; 1092 if (!session) 1093 return -ENOTCONN; 1094 1095 /* Session 0 represents the parent tunnel */ 1096 if (!session->session_id && !session->peer_session_id) { 1097 u32 session_id; 1098 int err; 1099 1100 if (copy_from_user(&stats, (void __user *)arg, 1101 sizeof(stats))) 1102 return -EFAULT; 1103 1104 session_id = stats.session_id; 1105 err = pppol2tp_tunnel_copy_stats(&stats, 1106 session->tunnel); 1107 if (err < 0) 1108 return err; 1109 1110 stats.session_id = session_id; 1111 } else { 1112 pppol2tp_copy_stats(&stats, &session->stats); 1113 stats.session_id = session->session_id; 1114 } 1115 stats.tunnel_id = session->tunnel->tunnel_id; 1116 stats.using_ipsec = l2tp_tunnel_uses_xfrm(session->tunnel); 1117 1118 if (copy_to_user((void __user *)arg, &stats, sizeof(stats))) 1119 return -EFAULT; 1120 break; 1121 1122 default: 1123 return -ENOIOCTLCMD; 1124 } 1125 1126 return 0; 1127 } 1128 1129 /***************************************************************************** 1130 * setsockopt() / getsockopt() support. 1131 * 1132 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1133 * sockets. In order to control kernel tunnel features, we allow userspace to 1134 * create a special "tunnel" PPPoX socket which is used for control only. 1135 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user 1136 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls. 1137 *****************************************************************************/ 1138 1139 /* Tunnel setsockopt() helper. 1140 */ 1141 static int pppol2tp_tunnel_setsockopt(struct sock *sk, 1142 struct l2tp_tunnel *tunnel, 1143 int optname, int val) 1144 { 1145 int err = 0; 1146 1147 switch (optname) { 1148 case PPPOL2TP_SO_DEBUG: 1149 /* Tunnel debug flags option is deprecated */ 1150 break; 1151 1152 default: 1153 err = -ENOPROTOOPT; 1154 break; 1155 } 1156 1157 return err; 1158 } 1159 1160 /* Session setsockopt helper. 1161 */ 1162 static int pppol2tp_session_setsockopt(struct sock *sk, 1163 struct l2tp_session *session, 1164 int optname, int val) 1165 { 1166 int err = 0; 1167 1168 switch (optname) { 1169 case PPPOL2TP_SO_RECVSEQ: 1170 if (val != 0 && val != 1) { 1171 err = -EINVAL; 1172 break; 1173 } 1174 session->recv_seq = !!val; 1175 break; 1176 1177 case PPPOL2TP_SO_SENDSEQ: 1178 if (val != 0 && val != 1) { 1179 err = -EINVAL; 1180 break; 1181 } 1182 session->send_seq = !!val; 1183 { 1184 struct pppox_sock *po = pppox_sk(sk); 1185 1186 po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ : 1187 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 1188 } 1189 l2tp_session_set_header_len(session, session->tunnel->version); 1190 break; 1191 1192 case PPPOL2TP_SO_LNSMODE: 1193 if (val != 0 && val != 1) { 1194 err = -EINVAL; 1195 break; 1196 } 1197 session->lns_mode = !!val; 1198 break; 1199 1200 case PPPOL2TP_SO_DEBUG: 1201 /* Session debug flags option is deprecated */ 1202 break; 1203 1204 case PPPOL2TP_SO_REORDERTO: 1205 session->reorder_timeout = msecs_to_jiffies(val); 1206 break; 1207 1208 default: 1209 err = -ENOPROTOOPT; 1210 break; 1211 } 1212 1213 return err; 1214 } 1215 1216 /* Main setsockopt() entry point. 1217 * Does API checks, then calls either the tunnel or session setsockopt 1218 * handler, according to whether the PPPoL2TP socket is a for a regular 1219 * session or the special tunnel type. 1220 */ 1221 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, 1222 sockptr_t optval, unsigned int optlen) 1223 { 1224 struct sock *sk = sock->sk; 1225 struct l2tp_session *session; 1226 struct l2tp_tunnel *tunnel; 1227 int val; 1228 int err; 1229 1230 if (level != SOL_PPPOL2TP) 1231 return -EINVAL; 1232 1233 if (optlen < sizeof(int)) 1234 return -EINVAL; 1235 1236 if (copy_from_sockptr(&val, optval, sizeof(int))) 1237 return -EFAULT; 1238 1239 err = -ENOTCONN; 1240 if (!sk->sk_user_data) 1241 goto end; 1242 1243 /* Get session context from the socket */ 1244 err = -EBADF; 1245 session = pppol2tp_sock_to_session(sk); 1246 if (!session) 1247 goto end; 1248 1249 /* Special case: if session_id == 0x0000, treat as operation on tunnel 1250 */ 1251 if (session->session_id == 0 && session->peer_session_id == 0) { 1252 tunnel = session->tunnel; 1253 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val); 1254 } else { 1255 err = pppol2tp_session_setsockopt(sk, session, optname, val); 1256 } 1257 1258 sock_put(sk); 1259 end: 1260 return err; 1261 } 1262 1263 /* Tunnel getsockopt helper. Called with sock locked. 1264 */ 1265 static int pppol2tp_tunnel_getsockopt(struct sock *sk, 1266 struct l2tp_tunnel *tunnel, 1267 int optname, int *val) 1268 { 1269 int err = 0; 1270 1271 switch (optname) { 1272 case PPPOL2TP_SO_DEBUG: 1273 /* Tunnel debug flags option is deprecated */ 1274 *val = 0; 1275 break; 1276 1277 default: 1278 err = -ENOPROTOOPT; 1279 break; 1280 } 1281 1282 return err; 1283 } 1284 1285 /* Session getsockopt helper. Called with sock locked. 1286 */ 1287 static int pppol2tp_session_getsockopt(struct sock *sk, 1288 struct l2tp_session *session, 1289 int optname, int *val) 1290 { 1291 int err = 0; 1292 1293 switch (optname) { 1294 case PPPOL2TP_SO_RECVSEQ: 1295 *val = session->recv_seq; 1296 break; 1297 1298 case PPPOL2TP_SO_SENDSEQ: 1299 *val = session->send_seq; 1300 break; 1301 1302 case PPPOL2TP_SO_LNSMODE: 1303 *val = session->lns_mode; 1304 break; 1305 1306 case PPPOL2TP_SO_DEBUG: 1307 /* Session debug flags option is deprecated */ 1308 *val = 0; 1309 break; 1310 1311 case PPPOL2TP_SO_REORDERTO: 1312 *val = (int)jiffies_to_msecs(session->reorder_timeout); 1313 break; 1314 1315 default: 1316 err = -ENOPROTOOPT; 1317 } 1318 1319 return err; 1320 } 1321 1322 /* Main getsockopt() entry point. 1323 * Does API checks, then calls either the tunnel or session getsockopt 1324 * handler, according to whether the PPPoX socket is a for a regular session 1325 * or the special tunnel type. 1326 */ 1327 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, 1328 char __user *optval, int __user *optlen) 1329 { 1330 struct sock *sk = sock->sk; 1331 struct l2tp_session *session; 1332 struct l2tp_tunnel *tunnel; 1333 int val, len; 1334 int err; 1335 1336 if (level != SOL_PPPOL2TP) 1337 return -EINVAL; 1338 1339 if (get_user(len, optlen)) 1340 return -EFAULT; 1341 1342 len = min_t(unsigned int, len, sizeof(int)); 1343 1344 if (len < 0) 1345 return -EINVAL; 1346 1347 err = -ENOTCONN; 1348 if (!sk->sk_user_data) 1349 goto end; 1350 1351 /* Get the session context */ 1352 err = -EBADF; 1353 session = pppol2tp_sock_to_session(sk); 1354 if (!session) 1355 goto end; 1356 1357 /* Special case: if session_id == 0x0000, treat as operation on tunnel */ 1358 if (session->session_id == 0 && session->peer_session_id == 0) { 1359 tunnel = session->tunnel; 1360 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val); 1361 if (err) 1362 goto end_put_sess; 1363 } else { 1364 err = pppol2tp_session_getsockopt(sk, session, optname, &val); 1365 if (err) 1366 goto end_put_sess; 1367 } 1368 1369 err = -EFAULT; 1370 if (put_user(len, optlen)) 1371 goto end_put_sess; 1372 1373 if (copy_to_user((void __user *)optval, &val, len)) 1374 goto end_put_sess; 1375 1376 err = 0; 1377 1378 end_put_sess: 1379 sock_put(sk); 1380 end: 1381 return err; 1382 } 1383 1384 /***************************************************************************** 1385 * /proc filesystem for debug 1386 * Since the original pppol2tp driver provided /proc/net/pppol2tp for 1387 * L2TPv2, we dump only L2TPv2 tunnels and sessions here. 1388 *****************************************************************************/ 1389 1390 static unsigned int pppol2tp_net_id; 1391 1392 #ifdef CONFIG_PROC_FS 1393 1394 struct pppol2tp_seq_data { 1395 struct seq_net_private p; 1396 int tunnel_idx; /* current tunnel */ 1397 int session_idx; /* index of session within current tunnel */ 1398 struct l2tp_tunnel *tunnel; 1399 struct l2tp_session *session; /* NULL means get next tunnel */ 1400 }; 1401 1402 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) 1403 { 1404 /* Drop reference taken during previous invocation */ 1405 if (pd->tunnel) 1406 l2tp_tunnel_dec_refcount(pd->tunnel); 1407 1408 for (;;) { 1409 pd->tunnel = l2tp_tunnel_get_nth(net, pd->tunnel_idx); 1410 pd->tunnel_idx++; 1411 1412 /* Only accept L2TPv2 tunnels */ 1413 if (!pd->tunnel || pd->tunnel->version == 2) 1414 return; 1415 1416 l2tp_tunnel_dec_refcount(pd->tunnel); 1417 } 1418 } 1419 1420 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) 1421 { 1422 /* Drop reference taken during previous invocation */ 1423 if (pd->session) 1424 l2tp_session_dec_refcount(pd->session); 1425 1426 pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx); 1427 pd->session_idx++; 1428 1429 if (!pd->session) { 1430 pd->session_idx = 0; 1431 pppol2tp_next_tunnel(net, pd); 1432 } 1433 } 1434 1435 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs) 1436 { 1437 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN; 1438 loff_t pos = *offs; 1439 struct net *net; 1440 1441 if (!pos) 1442 goto out; 1443 1444 if (WARN_ON(!m->private)) { 1445 pd = NULL; 1446 goto out; 1447 } 1448 1449 pd = m->private; 1450 net = seq_file_net(m); 1451 1452 if (!pd->tunnel) 1453 pppol2tp_next_tunnel(net, pd); 1454 else 1455 pppol2tp_next_session(net, pd); 1456 1457 /* NULL tunnel and session indicates end of list */ 1458 if (!pd->tunnel && !pd->session) 1459 pd = NULL; 1460 1461 out: 1462 return pd; 1463 } 1464 1465 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos) 1466 { 1467 (*pos)++; 1468 return NULL; 1469 } 1470 1471 static void pppol2tp_seq_stop(struct seq_file *p, void *v) 1472 { 1473 struct pppol2tp_seq_data *pd = v; 1474 1475 if (!pd || pd == SEQ_START_TOKEN) 1476 return; 1477 1478 /* Drop reference taken by last invocation of pppol2tp_next_session() 1479 * or pppol2tp_next_tunnel(). 1480 */ 1481 if (pd->session) { 1482 l2tp_session_dec_refcount(pd->session); 1483 pd->session = NULL; 1484 } 1485 if (pd->tunnel) { 1486 l2tp_tunnel_dec_refcount(pd->tunnel); 1487 pd->tunnel = NULL; 1488 } 1489 } 1490 1491 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) 1492 { 1493 struct l2tp_tunnel *tunnel = v; 1494 1495 seq_printf(m, "\nTUNNEL '%s', %c %d\n", 1496 tunnel->name, 1497 (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N', 1498 refcount_read(&tunnel->ref_count) - 1); 1499 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n", 1500 0, 1501 atomic_long_read(&tunnel->stats.tx_packets), 1502 atomic_long_read(&tunnel->stats.tx_bytes), 1503 atomic_long_read(&tunnel->stats.tx_errors), 1504 atomic_long_read(&tunnel->stats.rx_packets), 1505 atomic_long_read(&tunnel->stats.rx_bytes), 1506 atomic_long_read(&tunnel->stats.rx_errors)); 1507 } 1508 1509 static void pppol2tp_seq_session_show(struct seq_file *m, void *v) 1510 { 1511 struct l2tp_session *session = v; 1512 struct l2tp_tunnel *tunnel = session->tunnel; 1513 unsigned char state; 1514 char user_data_ok; 1515 struct sock *sk; 1516 u32 ip = 0; 1517 u16 port = 0; 1518 1519 if (tunnel->sock) { 1520 struct inet_sock *inet = inet_sk(tunnel->sock); 1521 1522 ip = ntohl(inet->inet_saddr); 1523 port = ntohs(inet->inet_sport); 1524 } 1525 1526 sk = pppol2tp_session_get_sock(session); 1527 if (sk) { 1528 state = sk->sk_state; 1529 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N'; 1530 } else { 1531 state = 0; 1532 user_data_ok = 'N'; 1533 } 1534 1535 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> %04X/%04X %d %c\n", 1536 session->name, ip, port, 1537 tunnel->tunnel_id, 1538 session->session_id, 1539 tunnel->peer_tunnel_id, 1540 session->peer_session_id, 1541 state, user_data_ok); 1542 seq_printf(m, " 0/0/%c/%c/%s %08x %u\n", 1543 session->recv_seq ? 'R' : '-', 1544 session->send_seq ? 'S' : '-', 1545 session->lns_mode ? "LNS" : "LAC", 1546 0, 1547 jiffies_to_msecs(session->reorder_timeout)); 1548 seq_printf(m, " %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n", 1549 session->nr, session->ns, 1550 atomic_long_read(&session->stats.tx_packets), 1551 atomic_long_read(&session->stats.tx_bytes), 1552 atomic_long_read(&session->stats.tx_errors), 1553 atomic_long_read(&session->stats.rx_packets), 1554 atomic_long_read(&session->stats.rx_bytes), 1555 atomic_long_read(&session->stats.rx_errors)); 1556 1557 if (sk) { 1558 struct pppox_sock *po = pppox_sk(sk); 1559 1560 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 1561 sock_put(sk); 1562 } 1563 } 1564 1565 static int pppol2tp_seq_show(struct seq_file *m, void *v) 1566 { 1567 struct pppol2tp_seq_data *pd = v; 1568 1569 /* display header on line 1 */ 1570 if (v == SEQ_START_TOKEN) { 1571 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n"); 1572 seq_puts(m, "TUNNEL name, user-data-ok session-count\n"); 1573 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1574 seq_puts(m, " SESSION name, addr/port src-tid/sid dest-tid/sid state user-data-ok\n"); 1575 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n"); 1576 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1577 goto out; 1578 } 1579 1580 if (!pd->session) 1581 pppol2tp_seq_tunnel_show(m, pd->tunnel); 1582 else 1583 pppol2tp_seq_session_show(m, pd->session); 1584 1585 out: 1586 return 0; 1587 } 1588 1589 static const struct seq_operations pppol2tp_seq_ops = { 1590 .start = pppol2tp_seq_start, 1591 .next = pppol2tp_seq_next, 1592 .stop = pppol2tp_seq_stop, 1593 .show = pppol2tp_seq_show, 1594 }; 1595 #endif /* CONFIG_PROC_FS */ 1596 1597 /***************************************************************************** 1598 * Network namespace 1599 *****************************************************************************/ 1600 1601 static __net_init int pppol2tp_init_net(struct net *net) 1602 { 1603 struct proc_dir_entry *pde; 1604 int err = 0; 1605 1606 pde = proc_create_net("pppol2tp", 0444, net->proc_net, 1607 &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data)); 1608 if (!pde) { 1609 err = -ENOMEM; 1610 goto out; 1611 } 1612 1613 out: 1614 return err; 1615 } 1616 1617 static __net_exit void pppol2tp_exit_net(struct net *net) 1618 { 1619 remove_proc_entry("pppol2tp", net->proc_net); 1620 } 1621 1622 static struct pernet_operations pppol2tp_net_ops = { 1623 .init = pppol2tp_init_net, 1624 .exit = pppol2tp_exit_net, 1625 .id = &pppol2tp_net_id, 1626 }; 1627 1628 /***************************************************************************** 1629 * Init and cleanup 1630 *****************************************************************************/ 1631 1632 static const struct proto_ops pppol2tp_ops = { 1633 .family = AF_PPPOX, 1634 .owner = THIS_MODULE, 1635 .release = pppol2tp_release, 1636 .bind = sock_no_bind, 1637 .connect = pppol2tp_connect, 1638 .socketpair = sock_no_socketpair, 1639 .accept = sock_no_accept, 1640 .getname = pppol2tp_getname, 1641 .poll = datagram_poll, 1642 .listen = sock_no_listen, 1643 .shutdown = sock_no_shutdown, 1644 .setsockopt = pppol2tp_setsockopt, 1645 .getsockopt = pppol2tp_getsockopt, 1646 .sendmsg = pppol2tp_sendmsg, 1647 .recvmsg = pppol2tp_recvmsg, 1648 .mmap = sock_no_mmap, 1649 .ioctl = pppox_ioctl, 1650 #ifdef CONFIG_COMPAT 1651 .compat_ioctl = pppox_compat_ioctl, 1652 #endif 1653 }; 1654 1655 static const struct pppox_proto pppol2tp_proto = { 1656 .create = pppol2tp_create, 1657 .ioctl = pppol2tp_ioctl, 1658 .owner = THIS_MODULE, 1659 }; 1660 1661 #ifdef CONFIG_L2TP_V3 1662 1663 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = { 1664 .session_create = pppol2tp_session_create, 1665 .session_delete = l2tp_session_delete, 1666 }; 1667 1668 #endif /* CONFIG_L2TP_V3 */ 1669 1670 static int __init pppol2tp_init(void) 1671 { 1672 int err; 1673 1674 err = register_pernet_device(&pppol2tp_net_ops); 1675 if (err) 1676 goto out; 1677 1678 err = proto_register(&pppol2tp_sk_proto, 0); 1679 if (err) 1680 goto out_unregister_pppol2tp_pernet; 1681 1682 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto); 1683 if (err) 1684 goto out_unregister_pppol2tp_proto; 1685 1686 #ifdef CONFIG_L2TP_V3 1687 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops); 1688 if (err) 1689 goto out_unregister_pppox; 1690 #endif 1691 1692 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION); 1693 1694 out: 1695 return err; 1696 1697 #ifdef CONFIG_L2TP_V3 1698 out_unregister_pppox: 1699 unregister_pppox_proto(PX_PROTO_OL2TP); 1700 #endif 1701 out_unregister_pppol2tp_proto: 1702 proto_unregister(&pppol2tp_sk_proto); 1703 out_unregister_pppol2tp_pernet: 1704 unregister_pernet_device(&pppol2tp_net_ops); 1705 goto out; 1706 } 1707 1708 static void __exit pppol2tp_exit(void) 1709 { 1710 #ifdef CONFIG_L2TP_V3 1711 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP); 1712 #endif 1713 unregister_pppox_proto(PX_PROTO_OL2TP); 1714 proto_unregister(&pppol2tp_sk_proto); 1715 unregister_pernet_device(&pppol2tp_net_ops); 1716 } 1717 1718 module_init(pppol2tp_init); 1719 module_exit(pppol2tp_exit); 1720 1721 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1722 MODULE_DESCRIPTION("PPP over L2TP over UDP"); 1723 MODULE_LICENSE("GPL"); 1724 MODULE_VERSION(PPPOL2TP_DRV_VERSION); 1725 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP); 1726 MODULE_ALIAS_L2TP_PWTYPE(7); 1727