1 /***************************************************************************** 2 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets 3 * 4 * PPPoX --- Generic PPP encapsulation socket family 5 * PPPoL2TP --- PPP over L2TP (RFC 2661) 6 * 7 * Version: 2.0.0 8 * 9 * Authors: James Chapman (jchapman@katalix.com) 10 * 11 * Based on original work by Martijn van Oosterhout <kleptog@svana.org> 12 * 13 * License: 14 * This program is free software; you can redistribute it and/or 15 * modify it under the terms of the GNU General Public License 16 * as published by the Free Software Foundation; either version 17 * 2 of the License, or (at your option) any later version. 18 * 19 */ 20 21 /* This driver handles only L2TP data frames; control frames are handled by a 22 * userspace application. 23 * 24 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and 25 * attaches it to a bound UDP socket with local tunnel_id / session_id and 26 * peer tunnel_id / session_id set. Data can then be sent or received using 27 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket 28 * can be read or modified using ioctl() or [gs]etsockopt() calls. 29 * 30 * When a PPPoL2TP socket is connected with local and peer session_id values 31 * zero, the socket is treated as a special tunnel management socket. 32 * 33 * Here's example userspace code to create a socket for sending/receiving data 34 * over an L2TP session:- 35 * 36 * struct sockaddr_pppol2tp sax; 37 * int fd; 38 * int session_fd; 39 * 40 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); 41 * 42 * sax.sa_family = AF_PPPOX; 43 * sax.sa_protocol = PX_PROTO_OL2TP; 44 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket 45 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr; 46 * sax.pppol2tp.addr.sin_port = addr->sin_port; 47 * sax.pppol2tp.addr.sin_family = AF_INET; 48 * sax.pppol2tp.s_tunnel = tunnel_id; 49 * sax.pppol2tp.s_session = session_id; 50 * sax.pppol2tp.d_tunnel = peer_tunnel_id; 51 * sax.pppol2tp.d_session = peer_session_id; 52 * 53 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax)); 54 * 55 * A pppd plugin that allows PPP traffic to be carried over L2TP using 56 * this driver is available from the OpenL2TP project at 57 * http://openl2tp.sourceforge.net. 58 */ 59 60 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 61 62 #include <linux/module.h> 63 #include <linux/string.h> 64 #include <linux/list.h> 65 #include <linux/uaccess.h> 66 67 #include <linux/kernel.h> 68 #include <linux/spinlock.h> 69 #include <linux/kthread.h> 70 #include <linux/sched.h> 71 #include <linux/slab.h> 72 #include <linux/errno.h> 73 #include <linux/jiffies.h> 74 75 #include <linux/netdevice.h> 76 #include <linux/net.h> 77 #include <linux/inetdevice.h> 78 #include <linux/skbuff.h> 79 #include <linux/init.h> 80 #include <linux/ip.h> 81 #include <linux/udp.h> 82 #include <linux/if_pppox.h> 83 #include <linux/if_pppol2tp.h> 84 #include <net/sock.h> 85 #include <linux/ppp_channel.h> 86 #include <linux/ppp_defs.h> 87 #include <linux/ppp-ioctl.h> 88 #include <linux/file.h> 89 #include <linux/hash.h> 90 #include <linux/sort.h> 91 #include <linux/proc_fs.h> 92 #include <linux/l2tp.h> 93 #include <linux/nsproxy.h> 94 #include <net/net_namespace.h> 95 #include <net/netns/generic.h> 96 #include <net/dst.h> 97 #include <net/ip.h> 98 #include <net/udp.h> 99 #include <net/xfrm.h> 100 #include <net/inet_common.h> 101 102 #include <asm/byteorder.h> 103 #include <linux/atomic.h> 104 105 #include "l2tp_core.h" 106 107 #define PPPOL2TP_DRV_VERSION "V2.0" 108 109 /* Space for UDP, L2TP and PPP headers */ 110 #define PPPOL2TP_HEADER_OVERHEAD 40 111 112 /* Number of bytes to build transmit L2TP headers. 113 * Unfortunately the size is different depending on whether sequence numbers 114 * are enabled. 115 */ 116 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10 117 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6 118 119 /* Private data of each session. This data lives at the end of struct 120 * l2tp_session, referenced via session->priv[]. 121 */ 122 struct pppol2tp_session { 123 int owner; /* pid that opened the socket */ 124 125 struct mutex sk_lock; /* Protects .sk */ 126 struct sock __rcu *sk; /* Pointer to the session 127 * PPPoX socket */ 128 struct sock *__sk; /* Copy of .sk, for cleanup */ 129 struct rcu_head rcu; /* For asynchronous release */ 130 int flags; /* accessed by PPPIOCGFLAGS. 131 * Unused. */ 132 }; 133 134 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb); 135 136 static const struct ppp_channel_ops pppol2tp_chan_ops = { 137 .start_xmit = pppol2tp_xmit, 138 }; 139 140 static const struct proto_ops pppol2tp_ops; 141 142 /* Retrieves the pppol2tp socket associated to a session. 143 * A reference is held on the returned socket, so this function must be paired 144 * with sock_put(). 145 */ 146 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) 147 { 148 struct pppol2tp_session *ps = l2tp_session_priv(session); 149 struct sock *sk; 150 151 rcu_read_lock(); 152 sk = rcu_dereference(ps->sk); 153 if (sk) 154 sock_hold(sk); 155 rcu_read_unlock(); 156 157 return sk; 158 } 159 160 /* Helpers to obtain tunnel/session contexts from sockets. 161 */ 162 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) 163 { 164 struct l2tp_session *session; 165 166 if (sk == NULL) 167 return NULL; 168 169 sock_hold(sk); 170 session = (struct l2tp_session *)(sk->sk_user_data); 171 if (session == NULL) { 172 sock_put(sk); 173 goto out; 174 } 175 176 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 177 178 out: 179 return session; 180 } 181 182 /***************************************************************************** 183 * Receive data handling 184 *****************************************************************************/ 185 186 static int pppol2tp_recv_payload_hook(struct sk_buff *skb) 187 { 188 /* Skip PPP header, if present. In testing, Microsoft L2TP clients 189 * don't send the PPP header (PPP header compression enabled), but 190 * other clients can include the header. So we cope with both cases 191 * here. The PPP header is always FF03 when using L2TP. 192 * 193 * Note that skb->data[] isn't dereferenced from a u16 ptr here since 194 * the field may be unaligned. 195 */ 196 if (!pskb_may_pull(skb, 2)) 197 return 1; 198 199 if ((skb->data[0] == PPP_ALLSTATIONS) && (skb->data[1] == PPP_UI)) 200 skb_pull(skb, 2); 201 202 return 0; 203 } 204 205 /* Receive message. This is the recvmsg for the PPPoL2TP socket. 206 */ 207 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, 208 size_t len, int flags) 209 { 210 int err; 211 struct sk_buff *skb; 212 struct sock *sk = sock->sk; 213 214 err = -EIO; 215 if (sk->sk_state & PPPOX_BOUND) 216 goto end; 217 218 err = 0; 219 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 220 flags & MSG_DONTWAIT, &err); 221 if (!skb) 222 goto end; 223 224 if (len > skb->len) 225 len = skb->len; 226 else if (len < skb->len) 227 msg->msg_flags |= MSG_TRUNC; 228 229 err = skb_copy_datagram_msg(skb, 0, msg, len); 230 if (likely(err == 0)) 231 err = len; 232 233 kfree_skb(skb); 234 end: 235 return err; 236 } 237 238 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) 239 { 240 struct pppol2tp_session *ps = l2tp_session_priv(session); 241 struct sock *sk = NULL; 242 243 /* If the socket is bound, send it in to PPP's input queue. Otherwise 244 * queue it on the session socket. 245 */ 246 rcu_read_lock(); 247 sk = rcu_dereference(ps->sk); 248 if (sk == NULL) 249 goto no_sock; 250 251 if (sk->sk_state & PPPOX_BOUND) { 252 struct pppox_sock *po; 253 254 l2tp_dbg(session, L2TP_MSG_DATA, 255 "%s: recv %d byte data frame, passing to ppp\n", 256 session->name, data_len); 257 258 po = pppox_sk(sk); 259 ppp_input(&po->chan, skb); 260 } else { 261 l2tp_dbg(session, L2TP_MSG_DATA, 262 "%s: recv %d byte data frame, passing to L2TP socket\n", 263 session->name, data_len); 264 265 if (sock_queue_rcv_skb(sk, skb) < 0) { 266 atomic_long_inc(&session->stats.rx_errors); 267 kfree_skb(skb); 268 } 269 } 270 rcu_read_unlock(); 271 272 return; 273 274 no_sock: 275 rcu_read_unlock(); 276 l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name); 277 kfree_skb(skb); 278 } 279 280 /************************************************************************ 281 * Transmit handling 282 ***********************************************************************/ 283 284 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here 285 * when a user application does a sendmsg() on the session socket. L2TP and 286 * PPP headers must be inserted into the user's data. 287 */ 288 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m, 289 size_t total_len) 290 { 291 struct sock *sk = sock->sk; 292 struct sk_buff *skb; 293 int error; 294 struct l2tp_session *session; 295 struct l2tp_tunnel *tunnel; 296 int uhlen; 297 298 error = -ENOTCONN; 299 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 300 goto error; 301 302 /* Get session and tunnel contexts */ 303 error = -EBADF; 304 session = pppol2tp_sock_to_session(sk); 305 if (session == NULL) 306 goto error; 307 308 tunnel = session->tunnel; 309 310 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 311 312 /* Allocate a socket buffer */ 313 error = -ENOMEM; 314 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 315 uhlen + session->hdr_len + 316 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 317 0, GFP_KERNEL); 318 if (!skb) 319 goto error_put_sess; 320 321 /* Reserve space for headers. */ 322 skb_reserve(skb, NET_SKB_PAD); 323 skb_reset_network_header(skb); 324 skb_reserve(skb, sizeof(struct iphdr)); 325 skb_reset_transport_header(skb); 326 skb_reserve(skb, uhlen); 327 328 /* Add PPP header */ 329 skb->data[0] = PPP_ALLSTATIONS; 330 skb->data[1] = PPP_UI; 331 skb_put(skb, 2); 332 333 /* Copy user data into skb */ 334 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len); 335 if (error < 0) { 336 kfree_skb(skb); 337 goto error_put_sess; 338 } 339 340 local_bh_disable(); 341 l2tp_xmit_skb(session, skb, session->hdr_len); 342 local_bh_enable(); 343 344 sock_put(sk); 345 346 return total_len; 347 348 error_put_sess: 349 sock_put(sk); 350 error: 351 return error; 352 } 353 354 /* Transmit function called by generic PPP driver. Sends PPP frame 355 * over PPPoL2TP socket. 356 * 357 * This is almost the same as pppol2tp_sendmsg(), but rather than 358 * being called with a msghdr from userspace, it is called with a skb 359 * from the kernel. 360 * 361 * The supplied skb from ppp doesn't have enough headroom for the 362 * insertion of L2TP, UDP and IP headers so we need to allocate more 363 * headroom in the skb. This will create a cloned skb. But we must be 364 * careful in the error case because the caller will expect to free 365 * the skb it supplied, not our cloned skb. So we take care to always 366 * leave the original skb unfreed if we return an error. 367 */ 368 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) 369 { 370 struct sock *sk = (struct sock *) chan->private; 371 struct l2tp_session *session; 372 struct l2tp_tunnel *tunnel; 373 int uhlen, headroom; 374 375 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 376 goto abort; 377 378 /* Get session and tunnel contexts from the socket */ 379 session = pppol2tp_sock_to_session(sk); 380 if (session == NULL) 381 goto abort; 382 383 tunnel = session->tunnel; 384 385 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 386 headroom = NET_SKB_PAD + 387 sizeof(struct iphdr) + /* IP header */ 388 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */ 389 session->hdr_len + /* L2TP header */ 390 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 391 if (skb_cow_head(skb, headroom)) 392 goto abort_put_sess; 393 394 /* Setup PPP header */ 395 __skb_push(skb, 2); 396 skb->data[0] = PPP_ALLSTATIONS; 397 skb->data[1] = PPP_UI; 398 399 local_bh_disable(); 400 l2tp_xmit_skb(session, skb, session->hdr_len); 401 local_bh_enable(); 402 403 sock_put(sk); 404 405 return 1; 406 407 abort_put_sess: 408 sock_put(sk); 409 abort: 410 /* Free the original skb */ 411 kfree_skb(skb); 412 return 1; 413 } 414 415 /***************************************************************************** 416 * Session (and tunnel control) socket create/destroy. 417 *****************************************************************************/ 418 419 static void pppol2tp_put_sk(struct rcu_head *head) 420 { 421 struct pppol2tp_session *ps; 422 423 ps = container_of(head, typeof(*ps), rcu); 424 sock_put(ps->__sk); 425 } 426 427 /* Called by l2tp_core when a session socket is being closed. 428 */ 429 static void pppol2tp_session_close(struct l2tp_session *session) 430 { 431 } 432 433 /* Really kill the session socket. (Called from sock_put() if 434 * refcnt == 0.) 435 */ 436 static void pppol2tp_session_destruct(struct sock *sk) 437 { 438 struct l2tp_session *session = sk->sk_user_data; 439 440 skb_queue_purge(&sk->sk_receive_queue); 441 skb_queue_purge(&sk->sk_write_queue); 442 443 if (session) { 444 sk->sk_user_data = NULL; 445 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 446 l2tp_session_dec_refcount(session); 447 } 448 } 449 450 /* Called when the PPPoX socket (session) is closed. 451 */ 452 static int pppol2tp_release(struct socket *sock) 453 { 454 struct sock *sk = sock->sk; 455 struct l2tp_session *session; 456 int error; 457 458 if (!sk) 459 return 0; 460 461 error = -EBADF; 462 lock_sock(sk); 463 if (sock_flag(sk, SOCK_DEAD) != 0) 464 goto error; 465 466 pppox_unbind_sock(sk); 467 468 /* Signal the death of the socket. */ 469 sk->sk_state = PPPOX_DEAD; 470 sock_orphan(sk); 471 sock->sk = NULL; 472 473 session = pppol2tp_sock_to_session(sk); 474 if (session) { 475 struct pppol2tp_session *ps; 476 477 l2tp_session_delete(session); 478 479 ps = l2tp_session_priv(session); 480 mutex_lock(&ps->sk_lock); 481 ps->__sk = rcu_dereference_protected(ps->sk, 482 lockdep_is_held(&ps->sk_lock)); 483 RCU_INIT_POINTER(ps->sk, NULL); 484 mutex_unlock(&ps->sk_lock); 485 call_rcu(&ps->rcu, pppol2tp_put_sk); 486 487 /* Rely on the sock_put() call at the end of the function for 488 * dropping the reference held by pppol2tp_sock_to_session(). 489 * The last reference will be dropped by pppol2tp_put_sk(). 490 */ 491 } 492 493 release_sock(sk); 494 495 /* This will delete the session context via 496 * pppol2tp_session_destruct() if the socket's refcnt drops to 497 * zero. 498 */ 499 sock_put(sk); 500 501 return 0; 502 503 error: 504 release_sock(sk); 505 return error; 506 } 507 508 static struct proto pppol2tp_sk_proto = { 509 .name = "PPPOL2TP", 510 .owner = THIS_MODULE, 511 .obj_size = sizeof(struct pppox_sock), 512 }; 513 514 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb) 515 { 516 int rc; 517 518 rc = l2tp_udp_encap_recv(sk, skb); 519 if (rc) 520 kfree_skb(skb); 521 522 return NET_RX_SUCCESS; 523 } 524 525 /* socket() handler. Initialize a new struct sock. 526 */ 527 static int pppol2tp_create(struct net *net, struct socket *sock, int kern) 528 { 529 int error = -ENOMEM; 530 struct sock *sk; 531 532 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern); 533 if (!sk) 534 goto out; 535 536 sock_init_data(sock, sk); 537 538 sock->state = SS_UNCONNECTED; 539 sock->ops = &pppol2tp_ops; 540 541 sk->sk_backlog_rcv = pppol2tp_backlog_recv; 542 sk->sk_protocol = PX_PROTO_OL2TP; 543 sk->sk_family = PF_PPPOX; 544 sk->sk_state = PPPOX_NONE; 545 sk->sk_type = SOCK_STREAM; 546 sk->sk_destruct = pppol2tp_session_destruct; 547 548 error = 0; 549 550 out: 551 return error; 552 } 553 554 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 555 static void pppol2tp_show(struct seq_file *m, void *arg) 556 { 557 struct l2tp_session *session = arg; 558 struct sock *sk; 559 560 sk = pppol2tp_session_get_sock(session); 561 if (sk) { 562 struct pppox_sock *po = pppox_sk(sk); 563 564 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 565 sock_put(sk); 566 } 567 } 568 #endif 569 570 static void pppol2tp_session_init(struct l2tp_session *session) 571 { 572 struct pppol2tp_session *ps; 573 struct dst_entry *dst; 574 575 session->recv_skb = pppol2tp_recv; 576 session->session_close = pppol2tp_session_close; 577 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 578 session->show = pppol2tp_show; 579 #endif 580 581 ps = l2tp_session_priv(session); 582 mutex_init(&ps->sk_lock); 583 ps->owner = current->pid; 584 585 /* If PMTU discovery was enabled, use the MTU that was discovered */ 586 dst = sk_dst_get(session->tunnel->sock); 587 if (dst) { 588 u32 pmtu = dst_mtu(dst); 589 590 if (pmtu) { 591 session->mtu = pmtu - PPPOL2TP_HEADER_OVERHEAD; 592 session->mru = pmtu - PPPOL2TP_HEADER_OVERHEAD; 593 } 594 dst_release(dst); 595 } 596 } 597 598 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket 599 */ 600 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 601 int sockaddr_len, int flags) 602 { 603 struct sock *sk = sock->sk; 604 struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr; 605 struct pppox_sock *po = pppox_sk(sk); 606 struct l2tp_session *session = NULL; 607 struct l2tp_tunnel *tunnel; 608 struct pppol2tp_session *ps; 609 struct l2tp_session_cfg cfg = { 0, }; 610 int error = 0; 611 u32 tunnel_id, peer_tunnel_id; 612 u32 session_id, peer_session_id; 613 bool drop_refcnt = false; 614 bool drop_tunnel = false; 615 bool new_session = false; 616 bool new_tunnel = false; 617 int ver = 2; 618 int fd; 619 620 lock_sock(sk); 621 622 error = -EINVAL; 623 624 if (sockaddr_len != sizeof(struct sockaddr_pppol2tp) && 625 sockaddr_len != sizeof(struct sockaddr_pppol2tpv3) && 626 sockaddr_len != sizeof(struct sockaddr_pppol2tpin6) && 627 sockaddr_len != sizeof(struct sockaddr_pppol2tpv3in6)) 628 goto end; 629 630 if (sp->sa_protocol != PX_PROTO_OL2TP) 631 goto end; 632 633 /* Check for already bound sockets */ 634 error = -EBUSY; 635 if (sk->sk_state & PPPOX_CONNECTED) 636 goto end; 637 638 /* We don't supporting rebinding anyway */ 639 error = -EALREADY; 640 if (sk->sk_user_data) 641 goto end; /* socket is already attached */ 642 643 /* Get params from socket address. Handle L2TPv2 and L2TPv3. 644 * This is nasty because there are different sockaddr_pppol2tp 645 * structs for L2TPv2, L2TPv3, over IPv4 and IPv6. We use 646 * the sockaddr size to determine which structure the caller 647 * is using. 648 */ 649 peer_tunnel_id = 0; 650 if (sockaddr_len == sizeof(struct sockaddr_pppol2tp)) { 651 fd = sp->pppol2tp.fd; 652 tunnel_id = sp->pppol2tp.s_tunnel; 653 peer_tunnel_id = sp->pppol2tp.d_tunnel; 654 session_id = sp->pppol2tp.s_session; 655 peer_session_id = sp->pppol2tp.d_session; 656 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3)) { 657 struct sockaddr_pppol2tpv3 *sp3 = 658 (struct sockaddr_pppol2tpv3 *) sp; 659 ver = 3; 660 fd = sp3->pppol2tp.fd; 661 tunnel_id = sp3->pppol2tp.s_tunnel; 662 peer_tunnel_id = sp3->pppol2tp.d_tunnel; 663 session_id = sp3->pppol2tp.s_session; 664 peer_session_id = sp3->pppol2tp.d_session; 665 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpin6)) { 666 struct sockaddr_pppol2tpin6 *sp6 = 667 (struct sockaddr_pppol2tpin6 *) sp; 668 fd = sp6->pppol2tp.fd; 669 tunnel_id = sp6->pppol2tp.s_tunnel; 670 peer_tunnel_id = sp6->pppol2tp.d_tunnel; 671 session_id = sp6->pppol2tp.s_session; 672 peer_session_id = sp6->pppol2tp.d_session; 673 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3in6)) { 674 struct sockaddr_pppol2tpv3in6 *sp6 = 675 (struct sockaddr_pppol2tpv3in6 *) sp; 676 ver = 3; 677 fd = sp6->pppol2tp.fd; 678 tunnel_id = sp6->pppol2tp.s_tunnel; 679 peer_tunnel_id = sp6->pppol2tp.d_tunnel; 680 session_id = sp6->pppol2tp.s_session; 681 peer_session_id = sp6->pppol2tp.d_session; 682 } else { 683 error = -EINVAL; 684 goto end; /* bad socket address */ 685 } 686 687 /* Don't bind if tunnel_id is 0 */ 688 error = -EINVAL; 689 if (tunnel_id == 0) 690 goto end; 691 692 tunnel = l2tp_tunnel_get(sock_net(sk), tunnel_id); 693 if (tunnel) 694 drop_tunnel = true; 695 696 /* Special case: create tunnel context if session_id and 697 * peer_session_id is 0. Otherwise look up tunnel using supplied 698 * tunnel id. 699 */ 700 if ((session_id == 0) && (peer_session_id == 0)) { 701 if (tunnel == NULL) { 702 struct l2tp_tunnel_cfg tcfg = { 703 .encap = L2TP_ENCAPTYPE_UDP, 704 .debug = 0, 705 }; 706 707 /* Prevent l2tp_tunnel_register() from trying to set up 708 * a kernel socket. 709 */ 710 if (fd < 0) { 711 error = -EBADF; 712 goto end; 713 } 714 715 error = l2tp_tunnel_create(sock_net(sk), fd, ver, tunnel_id, peer_tunnel_id, &tcfg, &tunnel); 716 if (error < 0) 717 goto end; 718 719 l2tp_tunnel_inc_refcount(tunnel); 720 error = l2tp_tunnel_register(tunnel, sock_net(sk), 721 &tcfg); 722 if (error < 0) { 723 kfree(tunnel); 724 goto end; 725 } 726 drop_tunnel = true; 727 new_tunnel = true; 728 } 729 } else { 730 /* Error if we can't find the tunnel */ 731 error = -ENOENT; 732 if (tunnel == NULL) 733 goto end; 734 735 /* Error if socket is not prepped */ 736 if (tunnel->sock == NULL) 737 goto end; 738 } 739 740 if (tunnel->recv_payload_hook == NULL) 741 tunnel->recv_payload_hook = pppol2tp_recv_payload_hook; 742 743 if (tunnel->peer_tunnel_id == 0) 744 tunnel->peer_tunnel_id = peer_tunnel_id; 745 746 session = l2tp_session_get(sock_net(sk), tunnel, session_id); 747 if (session) { 748 drop_refcnt = true; 749 750 if (session->pwtype != L2TP_PWTYPE_PPP) { 751 error = -EPROTOTYPE; 752 goto end; 753 } 754 755 ps = l2tp_session_priv(session); 756 757 /* Using a pre-existing session is fine as long as it hasn't 758 * been connected yet. 759 */ 760 mutex_lock(&ps->sk_lock); 761 if (rcu_dereference_protected(ps->sk, 762 lockdep_is_held(&ps->sk_lock)) || 763 ps->__sk) { 764 mutex_unlock(&ps->sk_lock); 765 error = -EEXIST; 766 goto end; 767 } 768 } else { 769 /* Default MTU must allow space for UDP/L2TP/PPP headers */ 770 cfg.mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 771 cfg.mru = cfg.mtu; 772 cfg.pw_type = L2TP_PWTYPE_PPP; 773 774 session = l2tp_session_create(sizeof(struct pppol2tp_session), 775 tunnel, session_id, 776 peer_session_id, &cfg); 777 if (IS_ERR(session)) { 778 error = PTR_ERR(session); 779 goto end; 780 } 781 782 pppol2tp_session_init(session); 783 ps = l2tp_session_priv(session); 784 l2tp_session_inc_refcount(session); 785 786 mutex_lock(&ps->sk_lock); 787 error = l2tp_session_register(session, tunnel); 788 if (error < 0) { 789 mutex_unlock(&ps->sk_lock); 790 kfree(session); 791 goto end; 792 } 793 drop_refcnt = true; 794 new_session = true; 795 } 796 797 /* Special case: if source & dest session_id == 0x0000, this 798 * socket is being created to manage the tunnel. Just set up 799 * the internal context for use by ioctl() and sockopt() 800 * handlers. 801 */ 802 if ((session->session_id == 0) && 803 (session->peer_session_id == 0)) { 804 error = 0; 805 goto out_no_ppp; 806 } 807 808 /* The only header we need to worry about is the L2TP 809 * header. This size is different depending on whether 810 * sequence numbers are enabled for the data channel. 811 */ 812 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 813 814 po->chan.private = sk; 815 po->chan.ops = &pppol2tp_chan_ops; 816 po->chan.mtu = session->mtu; 817 818 error = ppp_register_net_channel(sock_net(sk), &po->chan); 819 if (error) { 820 mutex_unlock(&ps->sk_lock); 821 goto end; 822 } 823 824 out_no_ppp: 825 /* This is how we get the session context from the socket. */ 826 sk->sk_user_data = session; 827 rcu_assign_pointer(ps->sk, sk); 828 mutex_unlock(&ps->sk_lock); 829 830 /* Keep the reference we've grabbed on the session: sk doesn't expect 831 * the session to disappear. pppol2tp_session_destruct() is responsible 832 * for dropping it. 833 */ 834 drop_refcnt = false; 835 836 sk->sk_state = PPPOX_CONNECTED; 837 l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n", 838 session->name); 839 840 end: 841 if (error) { 842 if (new_session) 843 l2tp_session_delete(session); 844 if (new_tunnel) 845 l2tp_tunnel_delete(tunnel); 846 } 847 if (drop_refcnt) 848 l2tp_session_dec_refcount(session); 849 if (drop_tunnel) 850 l2tp_tunnel_dec_refcount(tunnel); 851 release_sock(sk); 852 853 return error; 854 } 855 856 #ifdef CONFIG_L2TP_V3 857 858 /* Called when creating sessions via the netlink interface. */ 859 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, 860 u32 session_id, u32 peer_session_id, 861 struct l2tp_session_cfg *cfg) 862 { 863 int error; 864 struct l2tp_session *session; 865 866 /* Error if tunnel socket is not prepped */ 867 if (!tunnel->sock) { 868 error = -ENOENT; 869 goto err; 870 } 871 872 /* Default MTU values. */ 873 if (cfg->mtu == 0) 874 cfg->mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 875 if (cfg->mru == 0) 876 cfg->mru = cfg->mtu; 877 878 /* Allocate and initialize a new session context. */ 879 session = l2tp_session_create(sizeof(struct pppol2tp_session), 880 tunnel, session_id, 881 peer_session_id, cfg); 882 if (IS_ERR(session)) { 883 error = PTR_ERR(session); 884 goto err; 885 } 886 887 pppol2tp_session_init(session); 888 889 error = l2tp_session_register(session, tunnel); 890 if (error < 0) 891 goto err_sess; 892 893 return 0; 894 895 err_sess: 896 kfree(session); 897 err: 898 return error; 899 } 900 901 #endif /* CONFIG_L2TP_V3 */ 902 903 /* getname() support. 904 */ 905 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr, 906 int peer) 907 { 908 int len = 0; 909 int error = 0; 910 struct l2tp_session *session; 911 struct l2tp_tunnel *tunnel; 912 struct sock *sk = sock->sk; 913 struct inet_sock *inet; 914 struct pppol2tp_session *pls; 915 916 error = -ENOTCONN; 917 if (sk == NULL) 918 goto end; 919 if (!(sk->sk_state & PPPOX_CONNECTED)) 920 goto end; 921 922 error = -EBADF; 923 session = pppol2tp_sock_to_session(sk); 924 if (session == NULL) 925 goto end; 926 927 pls = l2tp_session_priv(session); 928 tunnel = session->tunnel; 929 930 inet = inet_sk(tunnel->sock); 931 if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) { 932 struct sockaddr_pppol2tp sp; 933 len = sizeof(sp); 934 memset(&sp, 0, len); 935 sp.sa_family = AF_PPPOX; 936 sp.sa_protocol = PX_PROTO_OL2TP; 937 sp.pppol2tp.fd = tunnel->fd; 938 sp.pppol2tp.pid = pls->owner; 939 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 940 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 941 sp.pppol2tp.s_session = session->session_id; 942 sp.pppol2tp.d_session = session->peer_session_id; 943 sp.pppol2tp.addr.sin_family = AF_INET; 944 sp.pppol2tp.addr.sin_port = inet->inet_dport; 945 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 946 memcpy(uaddr, &sp, len); 947 #if IS_ENABLED(CONFIG_IPV6) 948 } else if ((tunnel->version == 2) && 949 (tunnel->sock->sk_family == AF_INET6)) { 950 struct sockaddr_pppol2tpin6 sp; 951 952 len = sizeof(sp); 953 memset(&sp, 0, len); 954 sp.sa_family = AF_PPPOX; 955 sp.sa_protocol = PX_PROTO_OL2TP; 956 sp.pppol2tp.fd = tunnel->fd; 957 sp.pppol2tp.pid = pls->owner; 958 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 959 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 960 sp.pppol2tp.s_session = session->session_id; 961 sp.pppol2tp.d_session = session->peer_session_id; 962 sp.pppol2tp.addr.sin6_family = AF_INET6; 963 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 964 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 965 sizeof(tunnel->sock->sk_v6_daddr)); 966 memcpy(uaddr, &sp, len); 967 } else if ((tunnel->version == 3) && 968 (tunnel->sock->sk_family == AF_INET6)) { 969 struct sockaddr_pppol2tpv3in6 sp; 970 971 len = sizeof(sp); 972 memset(&sp, 0, len); 973 sp.sa_family = AF_PPPOX; 974 sp.sa_protocol = PX_PROTO_OL2TP; 975 sp.pppol2tp.fd = tunnel->fd; 976 sp.pppol2tp.pid = pls->owner; 977 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 978 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 979 sp.pppol2tp.s_session = session->session_id; 980 sp.pppol2tp.d_session = session->peer_session_id; 981 sp.pppol2tp.addr.sin6_family = AF_INET6; 982 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 983 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 984 sizeof(tunnel->sock->sk_v6_daddr)); 985 memcpy(uaddr, &sp, len); 986 #endif 987 } else if (tunnel->version == 3) { 988 struct sockaddr_pppol2tpv3 sp; 989 len = sizeof(sp); 990 memset(&sp, 0, len); 991 sp.sa_family = AF_PPPOX; 992 sp.sa_protocol = PX_PROTO_OL2TP; 993 sp.pppol2tp.fd = tunnel->fd; 994 sp.pppol2tp.pid = pls->owner; 995 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 996 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 997 sp.pppol2tp.s_session = session->session_id; 998 sp.pppol2tp.d_session = session->peer_session_id; 999 sp.pppol2tp.addr.sin_family = AF_INET; 1000 sp.pppol2tp.addr.sin_port = inet->inet_dport; 1001 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 1002 memcpy(uaddr, &sp, len); 1003 } 1004 1005 error = len; 1006 1007 sock_put(sk); 1008 end: 1009 return error; 1010 } 1011 1012 /**************************************************************************** 1013 * ioctl() handlers. 1014 * 1015 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1016 * sockets. However, in order to control kernel tunnel features, we allow 1017 * userspace to create a special "tunnel" PPPoX socket which is used for 1018 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow 1019 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl() 1020 * calls. 1021 ****************************************************************************/ 1022 1023 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest, 1024 struct l2tp_stats *stats) 1025 { 1026 dest->tx_packets = atomic_long_read(&stats->tx_packets); 1027 dest->tx_bytes = atomic_long_read(&stats->tx_bytes); 1028 dest->tx_errors = atomic_long_read(&stats->tx_errors); 1029 dest->rx_packets = atomic_long_read(&stats->rx_packets); 1030 dest->rx_bytes = atomic_long_read(&stats->rx_bytes); 1031 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards); 1032 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets); 1033 dest->rx_errors = atomic_long_read(&stats->rx_errors); 1034 } 1035 1036 /* Session ioctl helper. 1037 */ 1038 static int pppol2tp_session_ioctl(struct l2tp_session *session, 1039 unsigned int cmd, unsigned long arg) 1040 { 1041 struct ifreq ifr; 1042 int err = 0; 1043 struct sock *sk; 1044 int val = (int) arg; 1045 struct pppol2tp_session *ps = l2tp_session_priv(session); 1046 struct l2tp_tunnel *tunnel = session->tunnel; 1047 struct pppol2tp_ioc_stats stats; 1048 1049 l2tp_dbg(session, L2TP_MSG_CONTROL, 1050 "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n", 1051 session->name, cmd, arg); 1052 1053 sk = pppol2tp_session_get_sock(session); 1054 if (!sk) 1055 return -EBADR; 1056 1057 switch (cmd) { 1058 case SIOCGIFMTU: 1059 err = -ENXIO; 1060 if (!(sk->sk_state & PPPOX_CONNECTED)) 1061 break; 1062 1063 err = -EFAULT; 1064 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1065 break; 1066 ifr.ifr_mtu = session->mtu; 1067 if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq))) 1068 break; 1069 1070 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mtu=%d\n", 1071 session->name, session->mtu); 1072 err = 0; 1073 break; 1074 1075 case SIOCSIFMTU: 1076 err = -ENXIO; 1077 if (!(sk->sk_state & PPPOX_CONNECTED)) 1078 break; 1079 1080 err = -EFAULT; 1081 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1082 break; 1083 1084 session->mtu = ifr.ifr_mtu; 1085 1086 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mtu=%d\n", 1087 session->name, session->mtu); 1088 err = 0; 1089 break; 1090 1091 case PPPIOCGMRU: 1092 err = -ENXIO; 1093 if (!(sk->sk_state & PPPOX_CONNECTED)) 1094 break; 1095 1096 err = -EFAULT; 1097 if (put_user(session->mru, (int __user *) arg)) 1098 break; 1099 1100 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mru=%d\n", 1101 session->name, session->mru); 1102 err = 0; 1103 break; 1104 1105 case PPPIOCSMRU: 1106 err = -ENXIO; 1107 if (!(sk->sk_state & PPPOX_CONNECTED)) 1108 break; 1109 1110 err = -EFAULT; 1111 if (get_user(val, (int __user *) arg)) 1112 break; 1113 1114 session->mru = val; 1115 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mru=%d\n", 1116 session->name, session->mru); 1117 err = 0; 1118 break; 1119 1120 case PPPIOCGFLAGS: 1121 err = -EFAULT; 1122 if (put_user(ps->flags, (int __user *) arg)) 1123 break; 1124 1125 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get flags=%d\n", 1126 session->name, ps->flags); 1127 err = 0; 1128 break; 1129 1130 case PPPIOCSFLAGS: 1131 err = -EFAULT; 1132 if (get_user(val, (int __user *) arg)) 1133 break; 1134 ps->flags = val; 1135 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set flags=%d\n", 1136 session->name, ps->flags); 1137 err = 0; 1138 break; 1139 1140 case PPPIOCGL2TPSTATS: 1141 err = -ENXIO; 1142 if (!(sk->sk_state & PPPOX_CONNECTED)) 1143 break; 1144 1145 memset(&stats, 0, sizeof(stats)); 1146 stats.tunnel_id = tunnel->tunnel_id; 1147 stats.session_id = session->session_id; 1148 pppol2tp_copy_stats(&stats, &session->stats); 1149 if (copy_to_user((void __user *) arg, &stats, 1150 sizeof(stats))) 1151 break; 1152 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1153 session->name); 1154 err = 0; 1155 break; 1156 1157 default: 1158 err = -ENOSYS; 1159 break; 1160 } 1161 1162 sock_put(sk); 1163 1164 return err; 1165 } 1166 1167 /* Tunnel ioctl helper. 1168 * 1169 * Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data 1170 * specifies a session_id, the session ioctl handler is called. This allows an 1171 * application to retrieve session stats via a tunnel socket. 1172 */ 1173 static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel, 1174 unsigned int cmd, unsigned long arg) 1175 { 1176 int err = 0; 1177 struct sock *sk; 1178 struct pppol2tp_ioc_stats stats; 1179 1180 l2tp_dbg(tunnel, L2TP_MSG_CONTROL, 1181 "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n", 1182 tunnel->name, cmd, arg); 1183 1184 sk = tunnel->sock; 1185 sock_hold(sk); 1186 1187 switch (cmd) { 1188 case PPPIOCGL2TPSTATS: 1189 err = -ENXIO; 1190 if (!(sk->sk_state & PPPOX_CONNECTED)) 1191 break; 1192 1193 if (copy_from_user(&stats, (void __user *) arg, 1194 sizeof(stats))) { 1195 err = -EFAULT; 1196 break; 1197 } 1198 if (stats.session_id != 0) { 1199 /* resend to session ioctl handler */ 1200 struct l2tp_session *session = 1201 l2tp_session_get(sock_net(sk), tunnel, 1202 stats.session_id); 1203 1204 if (!session) { 1205 err = -EBADR; 1206 break; 1207 } 1208 if (session->pwtype != L2TP_PWTYPE_PPP) { 1209 l2tp_session_dec_refcount(session); 1210 err = -EBADR; 1211 break; 1212 } 1213 1214 err = pppol2tp_session_ioctl(session, cmd, arg); 1215 l2tp_session_dec_refcount(session); 1216 break; 1217 } 1218 #ifdef CONFIG_XFRM 1219 stats.using_ipsec = (sk->sk_policy[0] || sk->sk_policy[1]) ? 1 : 0; 1220 #endif 1221 pppol2tp_copy_stats(&stats, &tunnel->stats); 1222 if (copy_to_user((void __user *) arg, &stats, sizeof(stats))) { 1223 err = -EFAULT; 1224 break; 1225 } 1226 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1227 tunnel->name); 1228 err = 0; 1229 break; 1230 1231 default: 1232 err = -ENOSYS; 1233 break; 1234 } 1235 1236 sock_put(sk); 1237 1238 return err; 1239 } 1240 1241 /* Main ioctl() handler. 1242 * Dispatch to tunnel or session helpers depending on the socket. 1243 */ 1244 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, 1245 unsigned long arg) 1246 { 1247 struct sock *sk = sock->sk; 1248 struct l2tp_session *session; 1249 struct l2tp_tunnel *tunnel; 1250 int err; 1251 1252 if (!sk) 1253 return 0; 1254 1255 err = -EBADF; 1256 if (sock_flag(sk, SOCK_DEAD) != 0) 1257 goto end; 1258 1259 err = -ENOTCONN; 1260 if ((sk->sk_user_data == NULL) || 1261 (!(sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)))) 1262 goto end; 1263 1264 /* Get session context from the socket */ 1265 err = -EBADF; 1266 session = pppol2tp_sock_to_session(sk); 1267 if (session == NULL) 1268 goto end; 1269 1270 /* Special case: if session's session_id is zero, treat ioctl as a 1271 * tunnel ioctl 1272 */ 1273 if ((session->session_id == 0) && 1274 (session->peer_session_id == 0)) { 1275 tunnel = session->tunnel; 1276 err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg); 1277 goto end_put_sess; 1278 } 1279 1280 err = pppol2tp_session_ioctl(session, cmd, arg); 1281 1282 end_put_sess: 1283 sock_put(sk); 1284 end: 1285 return err; 1286 } 1287 1288 /***************************************************************************** 1289 * setsockopt() / getsockopt() support. 1290 * 1291 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1292 * sockets. In order to control kernel tunnel features, we allow userspace to 1293 * create a special "tunnel" PPPoX socket which is used for control only. 1294 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user 1295 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls. 1296 *****************************************************************************/ 1297 1298 /* Tunnel setsockopt() helper. 1299 */ 1300 static int pppol2tp_tunnel_setsockopt(struct sock *sk, 1301 struct l2tp_tunnel *tunnel, 1302 int optname, int val) 1303 { 1304 int err = 0; 1305 1306 switch (optname) { 1307 case PPPOL2TP_SO_DEBUG: 1308 tunnel->debug = val; 1309 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1310 tunnel->name, tunnel->debug); 1311 break; 1312 1313 default: 1314 err = -ENOPROTOOPT; 1315 break; 1316 } 1317 1318 return err; 1319 } 1320 1321 /* Session setsockopt helper. 1322 */ 1323 static int pppol2tp_session_setsockopt(struct sock *sk, 1324 struct l2tp_session *session, 1325 int optname, int val) 1326 { 1327 int err = 0; 1328 1329 switch (optname) { 1330 case PPPOL2TP_SO_RECVSEQ: 1331 if ((val != 0) && (val != 1)) { 1332 err = -EINVAL; 1333 break; 1334 } 1335 session->recv_seq = !!val; 1336 l2tp_info(session, L2TP_MSG_CONTROL, 1337 "%s: set recv_seq=%d\n", 1338 session->name, session->recv_seq); 1339 break; 1340 1341 case PPPOL2TP_SO_SENDSEQ: 1342 if ((val != 0) && (val != 1)) { 1343 err = -EINVAL; 1344 break; 1345 } 1346 session->send_seq = !!val; 1347 { 1348 struct pppox_sock *po = pppox_sk(sk); 1349 1350 po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ : 1351 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 1352 } 1353 l2tp_session_set_header_len(session, session->tunnel->version); 1354 l2tp_info(session, L2TP_MSG_CONTROL, 1355 "%s: set send_seq=%d\n", 1356 session->name, session->send_seq); 1357 break; 1358 1359 case PPPOL2TP_SO_LNSMODE: 1360 if ((val != 0) && (val != 1)) { 1361 err = -EINVAL; 1362 break; 1363 } 1364 session->lns_mode = !!val; 1365 l2tp_info(session, L2TP_MSG_CONTROL, 1366 "%s: set lns_mode=%d\n", 1367 session->name, session->lns_mode); 1368 break; 1369 1370 case PPPOL2TP_SO_DEBUG: 1371 session->debug = val; 1372 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1373 session->name, session->debug); 1374 break; 1375 1376 case PPPOL2TP_SO_REORDERTO: 1377 session->reorder_timeout = msecs_to_jiffies(val); 1378 l2tp_info(session, L2TP_MSG_CONTROL, 1379 "%s: set reorder_timeout=%d\n", 1380 session->name, session->reorder_timeout); 1381 break; 1382 1383 default: 1384 err = -ENOPROTOOPT; 1385 break; 1386 } 1387 1388 return err; 1389 } 1390 1391 /* Main setsockopt() entry point. 1392 * Does API checks, then calls either the tunnel or session setsockopt 1393 * handler, according to whether the PPPoL2TP socket is a for a regular 1394 * session or the special tunnel type. 1395 */ 1396 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, 1397 char __user *optval, unsigned int optlen) 1398 { 1399 struct sock *sk = sock->sk; 1400 struct l2tp_session *session; 1401 struct l2tp_tunnel *tunnel; 1402 int val; 1403 int err; 1404 1405 if (level != SOL_PPPOL2TP) 1406 return -EINVAL; 1407 1408 if (optlen < sizeof(int)) 1409 return -EINVAL; 1410 1411 if (get_user(val, (int __user *)optval)) 1412 return -EFAULT; 1413 1414 err = -ENOTCONN; 1415 if (sk->sk_user_data == NULL) 1416 goto end; 1417 1418 /* Get session context from the socket */ 1419 err = -EBADF; 1420 session = pppol2tp_sock_to_session(sk); 1421 if (session == NULL) 1422 goto end; 1423 1424 /* Special case: if session_id == 0x0000, treat as operation on tunnel 1425 */ 1426 if ((session->session_id == 0) && 1427 (session->peer_session_id == 0)) { 1428 tunnel = session->tunnel; 1429 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val); 1430 } else { 1431 err = pppol2tp_session_setsockopt(sk, session, optname, val); 1432 } 1433 1434 sock_put(sk); 1435 end: 1436 return err; 1437 } 1438 1439 /* Tunnel getsockopt helper. Called with sock locked. 1440 */ 1441 static int pppol2tp_tunnel_getsockopt(struct sock *sk, 1442 struct l2tp_tunnel *tunnel, 1443 int optname, int *val) 1444 { 1445 int err = 0; 1446 1447 switch (optname) { 1448 case PPPOL2TP_SO_DEBUG: 1449 *val = tunnel->debug; 1450 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get debug=%x\n", 1451 tunnel->name, tunnel->debug); 1452 break; 1453 1454 default: 1455 err = -ENOPROTOOPT; 1456 break; 1457 } 1458 1459 return err; 1460 } 1461 1462 /* Session getsockopt helper. Called with sock locked. 1463 */ 1464 static int pppol2tp_session_getsockopt(struct sock *sk, 1465 struct l2tp_session *session, 1466 int optname, int *val) 1467 { 1468 int err = 0; 1469 1470 switch (optname) { 1471 case PPPOL2TP_SO_RECVSEQ: 1472 *val = session->recv_seq; 1473 l2tp_info(session, L2TP_MSG_CONTROL, 1474 "%s: get recv_seq=%d\n", session->name, *val); 1475 break; 1476 1477 case PPPOL2TP_SO_SENDSEQ: 1478 *val = session->send_seq; 1479 l2tp_info(session, L2TP_MSG_CONTROL, 1480 "%s: get send_seq=%d\n", session->name, *val); 1481 break; 1482 1483 case PPPOL2TP_SO_LNSMODE: 1484 *val = session->lns_mode; 1485 l2tp_info(session, L2TP_MSG_CONTROL, 1486 "%s: get lns_mode=%d\n", session->name, *val); 1487 break; 1488 1489 case PPPOL2TP_SO_DEBUG: 1490 *val = session->debug; 1491 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get debug=%d\n", 1492 session->name, *val); 1493 break; 1494 1495 case PPPOL2TP_SO_REORDERTO: 1496 *val = (int) jiffies_to_msecs(session->reorder_timeout); 1497 l2tp_info(session, L2TP_MSG_CONTROL, 1498 "%s: get reorder_timeout=%d\n", session->name, *val); 1499 break; 1500 1501 default: 1502 err = -ENOPROTOOPT; 1503 } 1504 1505 return err; 1506 } 1507 1508 /* Main getsockopt() entry point. 1509 * Does API checks, then calls either the tunnel or session getsockopt 1510 * handler, according to whether the PPPoX socket is a for a regular session 1511 * or the special tunnel type. 1512 */ 1513 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, 1514 char __user *optval, int __user *optlen) 1515 { 1516 struct sock *sk = sock->sk; 1517 struct l2tp_session *session; 1518 struct l2tp_tunnel *tunnel; 1519 int val, len; 1520 int err; 1521 1522 if (level != SOL_PPPOL2TP) 1523 return -EINVAL; 1524 1525 if (get_user(len, optlen)) 1526 return -EFAULT; 1527 1528 len = min_t(unsigned int, len, sizeof(int)); 1529 1530 if (len < 0) 1531 return -EINVAL; 1532 1533 err = -ENOTCONN; 1534 if (sk->sk_user_data == NULL) 1535 goto end; 1536 1537 /* Get the session context */ 1538 err = -EBADF; 1539 session = pppol2tp_sock_to_session(sk); 1540 if (session == NULL) 1541 goto end; 1542 1543 /* Special case: if session_id == 0x0000, treat as operation on tunnel */ 1544 if ((session->session_id == 0) && 1545 (session->peer_session_id == 0)) { 1546 tunnel = session->tunnel; 1547 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val); 1548 if (err) 1549 goto end_put_sess; 1550 } else { 1551 err = pppol2tp_session_getsockopt(sk, session, optname, &val); 1552 if (err) 1553 goto end_put_sess; 1554 } 1555 1556 err = -EFAULT; 1557 if (put_user(len, optlen)) 1558 goto end_put_sess; 1559 1560 if (copy_to_user((void __user *) optval, &val, len)) 1561 goto end_put_sess; 1562 1563 err = 0; 1564 1565 end_put_sess: 1566 sock_put(sk); 1567 end: 1568 return err; 1569 } 1570 1571 /***************************************************************************** 1572 * /proc filesystem for debug 1573 * Since the original pppol2tp driver provided /proc/net/pppol2tp for 1574 * L2TPv2, we dump only L2TPv2 tunnels and sessions here. 1575 *****************************************************************************/ 1576 1577 static unsigned int pppol2tp_net_id; 1578 1579 #ifdef CONFIG_PROC_FS 1580 1581 struct pppol2tp_seq_data { 1582 struct seq_net_private p; 1583 int tunnel_idx; /* current tunnel */ 1584 int session_idx; /* index of session within current tunnel */ 1585 struct l2tp_tunnel *tunnel; 1586 struct l2tp_session *session; /* NULL means get next tunnel */ 1587 }; 1588 1589 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) 1590 { 1591 /* Drop reference taken during previous invocation */ 1592 if (pd->tunnel) 1593 l2tp_tunnel_dec_refcount(pd->tunnel); 1594 1595 for (;;) { 1596 pd->tunnel = l2tp_tunnel_get_nth(net, pd->tunnel_idx); 1597 pd->tunnel_idx++; 1598 1599 /* Only accept L2TPv2 tunnels */ 1600 if (!pd->tunnel || pd->tunnel->version == 2) 1601 return; 1602 1603 l2tp_tunnel_dec_refcount(pd->tunnel); 1604 } 1605 } 1606 1607 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) 1608 { 1609 /* Drop reference taken during previous invocation */ 1610 if (pd->session) 1611 l2tp_session_dec_refcount(pd->session); 1612 1613 pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx); 1614 pd->session_idx++; 1615 1616 if (pd->session == NULL) { 1617 pd->session_idx = 0; 1618 pppol2tp_next_tunnel(net, pd); 1619 } 1620 } 1621 1622 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs) 1623 { 1624 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN; 1625 loff_t pos = *offs; 1626 struct net *net; 1627 1628 if (!pos) 1629 goto out; 1630 1631 BUG_ON(m->private == NULL); 1632 pd = m->private; 1633 net = seq_file_net(m); 1634 1635 if (pd->tunnel == NULL) 1636 pppol2tp_next_tunnel(net, pd); 1637 else 1638 pppol2tp_next_session(net, pd); 1639 1640 /* NULL tunnel and session indicates end of list */ 1641 if ((pd->tunnel == NULL) && (pd->session == NULL)) 1642 pd = NULL; 1643 1644 out: 1645 return pd; 1646 } 1647 1648 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos) 1649 { 1650 (*pos)++; 1651 return NULL; 1652 } 1653 1654 static void pppol2tp_seq_stop(struct seq_file *p, void *v) 1655 { 1656 struct pppol2tp_seq_data *pd = v; 1657 1658 if (!pd || pd == SEQ_START_TOKEN) 1659 return; 1660 1661 /* Drop reference taken by last invocation of pppol2tp_next_session() 1662 * or pppol2tp_next_tunnel(). 1663 */ 1664 if (pd->session) { 1665 l2tp_session_dec_refcount(pd->session); 1666 pd->session = NULL; 1667 } 1668 if (pd->tunnel) { 1669 l2tp_tunnel_dec_refcount(pd->tunnel); 1670 pd->tunnel = NULL; 1671 } 1672 } 1673 1674 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) 1675 { 1676 struct l2tp_tunnel *tunnel = v; 1677 1678 seq_printf(m, "\nTUNNEL '%s', %c %d\n", 1679 tunnel->name, 1680 (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N', 1681 refcount_read(&tunnel->ref_count) - 1); 1682 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n", 1683 tunnel->debug, 1684 atomic_long_read(&tunnel->stats.tx_packets), 1685 atomic_long_read(&tunnel->stats.tx_bytes), 1686 atomic_long_read(&tunnel->stats.tx_errors), 1687 atomic_long_read(&tunnel->stats.rx_packets), 1688 atomic_long_read(&tunnel->stats.rx_bytes), 1689 atomic_long_read(&tunnel->stats.rx_errors)); 1690 } 1691 1692 static void pppol2tp_seq_session_show(struct seq_file *m, void *v) 1693 { 1694 struct l2tp_session *session = v; 1695 struct l2tp_tunnel *tunnel = session->tunnel; 1696 unsigned char state; 1697 char user_data_ok; 1698 struct sock *sk; 1699 u32 ip = 0; 1700 u16 port = 0; 1701 1702 if (tunnel->sock) { 1703 struct inet_sock *inet = inet_sk(tunnel->sock); 1704 ip = ntohl(inet->inet_saddr); 1705 port = ntohs(inet->inet_sport); 1706 } 1707 1708 sk = pppol2tp_session_get_sock(session); 1709 if (sk) { 1710 state = sk->sk_state; 1711 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N'; 1712 } else { 1713 state = 0; 1714 user_data_ok = 'N'; 1715 } 1716 1717 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> " 1718 "%04X/%04X %d %c\n", 1719 session->name, ip, port, 1720 tunnel->tunnel_id, 1721 session->session_id, 1722 tunnel->peer_tunnel_id, 1723 session->peer_session_id, 1724 state, user_data_ok); 1725 seq_printf(m, " %d/%d/%c/%c/%s %08x %u\n", 1726 session->mtu, session->mru, 1727 session->recv_seq ? 'R' : '-', 1728 session->send_seq ? 'S' : '-', 1729 session->lns_mode ? "LNS" : "LAC", 1730 session->debug, 1731 jiffies_to_msecs(session->reorder_timeout)); 1732 seq_printf(m, " %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n", 1733 session->nr, session->ns, 1734 atomic_long_read(&session->stats.tx_packets), 1735 atomic_long_read(&session->stats.tx_bytes), 1736 atomic_long_read(&session->stats.tx_errors), 1737 atomic_long_read(&session->stats.rx_packets), 1738 atomic_long_read(&session->stats.rx_bytes), 1739 atomic_long_read(&session->stats.rx_errors)); 1740 1741 if (sk) { 1742 struct pppox_sock *po = pppox_sk(sk); 1743 1744 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 1745 sock_put(sk); 1746 } 1747 } 1748 1749 static int pppol2tp_seq_show(struct seq_file *m, void *v) 1750 { 1751 struct pppol2tp_seq_data *pd = v; 1752 1753 /* display header on line 1 */ 1754 if (v == SEQ_START_TOKEN) { 1755 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n"); 1756 seq_puts(m, "TUNNEL name, user-data-ok session-count\n"); 1757 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1758 seq_puts(m, " SESSION name, addr/port src-tid/sid " 1759 "dest-tid/sid state user-data-ok\n"); 1760 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n"); 1761 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1762 goto out; 1763 } 1764 1765 if (!pd->session) 1766 pppol2tp_seq_tunnel_show(m, pd->tunnel); 1767 else 1768 pppol2tp_seq_session_show(m, pd->session); 1769 1770 out: 1771 return 0; 1772 } 1773 1774 static const struct seq_operations pppol2tp_seq_ops = { 1775 .start = pppol2tp_seq_start, 1776 .next = pppol2tp_seq_next, 1777 .stop = pppol2tp_seq_stop, 1778 .show = pppol2tp_seq_show, 1779 }; 1780 #endif /* CONFIG_PROC_FS */ 1781 1782 /***************************************************************************** 1783 * Network namespace 1784 *****************************************************************************/ 1785 1786 static __net_init int pppol2tp_init_net(struct net *net) 1787 { 1788 struct proc_dir_entry *pde; 1789 int err = 0; 1790 1791 pde = proc_create_net("pppol2tp", 0444, net->proc_net, 1792 &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data)); 1793 if (!pde) { 1794 err = -ENOMEM; 1795 goto out; 1796 } 1797 1798 out: 1799 return err; 1800 } 1801 1802 static __net_exit void pppol2tp_exit_net(struct net *net) 1803 { 1804 remove_proc_entry("pppol2tp", net->proc_net); 1805 } 1806 1807 static struct pernet_operations pppol2tp_net_ops = { 1808 .init = pppol2tp_init_net, 1809 .exit = pppol2tp_exit_net, 1810 .id = &pppol2tp_net_id, 1811 }; 1812 1813 /***************************************************************************** 1814 * Init and cleanup 1815 *****************************************************************************/ 1816 1817 static const struct proto_ops pppol2tp_ops = { 1818 .family = AF_PPPOX, 1819 .owner = THIS_MODULE, 1820 .release = pppol2tp_release, 1821 .bind = sock_no_bind, 1822 .connect = pppol2tp_connect, 1823 .socketpair = sock_no_socketpair, 1824 .accept = sock_no_accept, 1825 .getname = pppol2tp_getname, 1826 .poll = datagram_poll, 1827 .listen = sock_no_listen, 1828 .shutdown = sock_no_shutdown, 1829 .setsockopt = pppol2tp_setsockopt, 1830 .getsockopt = pppol2tp_getsockopt, 1831 .sendmsg = pppol2tp_sendmsg, 1832 .recvmsg = pppol2tp_recvmsg, 1833 .mmap = sock_no_mmap, 1834 .ioctl = pppox_ioctl, 1835 }; 1836 1837 static const struct pppox_proto pppol2tp_proto = { 1838 .create = pppol2tp_create, 1839 .ioctl = pppol2tp_ioctl, 1840 .owner = THIS_MODULE, 1841 }; 1842 1843 #ifdef CONFIG_L2TP_V3 1844 1845 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = { 1846 .session_create = pppol2tp_session_create, 1847 .session_delete = l2tp_session_delete, 1848 }; 1849 1850 #endif /* CONFIG_L2TP_V3 */ 1851 1852 static int __init pppol2tp_init(void) 1853 { 1854 int err; 1855 1856 err = register_pernet_device(&pppol2tp_net_ops); 1857 if (err) 1858 goto out; 1859 1860 err = proto_register(&pppol2tp_sk_proto, 0); 1861 if (err) 1862 goto out_unregister_pppol2tp_pernet; 1863 1864 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto); 1865 if (err) 1866 goto out_unregister_pppol2tp_proto; 1867 1868 #ifdef CONFIG_L2TP_V3 1869 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops); 1870 if (err) 1871 goto out_unregister_pppox; 1872 #endif 1873 1874 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION); 1875 1876 out: 1877 return err; 1878 1879 #ifdef CONFIG_L2TP_V3 1880 out_unregister_pppox: 1881 unregister_pppox_proto(PX_PROTO_OL2TP); 1882 #endif 1883 out_unregister_pppol2tp_proto: 1884 proto_unregister(&pppol2tp_sk_proto); 1885 out_unregister_pppol2tp_pernet: 1886 unregister_pernet_device(&pppol2tp_net_ops); 1887 goto out; 1888 } 1889 1890 static void __exit pppol2tp_exit(void) 1891 { 1892 #ifdef CONFIG_L2TP_V3 1893 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP); 1894 #endif 1895 unregister_pppox_proto(PX_PROTO_OL2TP); 1896 proto_unregister(&pppol2tp_sk_proto); 1897 unregister_pernet_device(&pppol2tp_net_ops); 1898 } 1899 1900 module_init(pppol2tp_init); 1901 module_exit(pppol2tp_exit); 1902 1903 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1904 MODULE_DESCRIPTION("PPP over L2TP over UDP"); 1905 MODULE_LICENSE("GPL"); 1906 MODULE_VERSION(PPPOL2TP_DRV_VERSION); 1907 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP); 1908 MODULE_ALIAS_L2TP_PWTYPE(7); 1909