1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /***************************************************************************** 3 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets 4 * 5 * PPPoX --- Generic PPP encapsulation socket family 6 * PPPoL2TP --- PPP over L2TP (RFC 2661) 7 * 8 * Version: 2.0.0 9 * 10 * Authors: James Chapman (jchapman@katalix.com) 11 * 12 * Based on original work by Martijn van Oosterhout <kleptog@svana.org> 13 * 14 * License: 15 */ 16 17 /* This driver handles only L2TP data frames; control frames are handled by a 18 * userspace application. 19 * 20 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and 21 * attaches it to a bound UDP socket with local tunnel_id / session_id and 22 * peer tunnel_id / session_id set. Data can then be sent or received using 23 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket 24 * can be read or modified using ioctl() or [gs]etsockopt() calls. 25 * 26 * When a PPPoL2TP socket is connected with local and peer session_id values 27 * zero, the socket is treated as a special tunnel management socket. 28 * 29 * Here's example userspace code to create a socket for sending/receiving data 30 * over an L2TP session:- 31 * 32 * struct sockaddr_pppol2tp sax; 33 * int fd; 34 * int session_fd; 35 * 36 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); 37 * 38 * sax.sa_family = AF_PPPOX; 39 * sax.sa_protocol = PX_PROTO_OL2TP; 40 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket 41 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr; 42 * sax.pppol2tp.addr.sin_port = addr->sin_port; 43 * sax.pppol2tp.addr.sin_family = AF_INET; 44 * sax.pppol2tp.s_tunnel = tunnel_id; 45 * sax.pppol2tp.s_session = session_id; 46 * sax.pppol2tp.d_tunnel = peer_tunnel_id; 47 * sax.pppol2tp.d_session = peer_session_id; 48 * 49 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax)); 50 * 51 * A pppd plugin that allows PPP traffic to be carried over L2TP using 52 * this driver is available from the OpenL2TP project at 53 * http://openl2tp.sourceforge.net. 54 */ 55 56 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 57 58 #include <linux/module.h> 59 #include <linux/string.h> 60 #include <linux/list.h> 61 #include <linux/uaccess.h> 62 63 #include <linux/kernel.h> 64 #include <linux/spinlock.h> 65 #include <linux/kthread.h> 66 #include <linux/sched.h> 67 #include <linux/slab.h> 68 #include <linux/errno.h> 69 #include <linux/jiffies.h> 70 71 #include <linux/netdevice.h> 72 #include <linux/net.h> 73 #include <linux/inetdevice.h> 74 #include <linux/skbuff.h> 75 #include <linux/init.h> 76 #include <linux/ip.h> 77 #include <linux/udp.h> 78 #include <linux/if_pppox.h> 79 #include <linux/if_pppol2tp.h> 80 #include <net/sock.h> 81 #include <linux/ppp_channel.h> 82 #include <linux/ppp_defs.h> 83 #include <linux/ppp-ioctl.h> 84 #include <linux/file.h> 85 #include <linux/hash.h> 86 #include <linux/sort.h> 87 #include <linux/proc_fs.h> 88 #include <linux/l2tp.h> 89 #include <linux/nsproxy.h> 90 #include <net/net_namespace.h> 91 #include <net/netns/generic.h> 92 #include <net/ip.h> 93 #include <net/udp.h> 94 #include <net/inet_common.h> 95 96 #include <asm/byteorder.h> 97 #include <linux/atomic.h> 98 99 #include "l2tp_core.h" 100 101 #define PPPOL2TP_DRV_VERSION "V2.0" 102 103 /* Space for UDP, L2TP and PPP headers */ 104 #define PPPOL2TP_HEADER_OVERHEAD 40 105 106 /* Number of bytes to build transmit L2TP headers. 107 * Unfortunately the size is different depending on whether sequence numbers 108 * are enabled. 109 */ 110 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10 111 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6 112 113 /* Private data of each session. This data lives at the end of struct 114 * l2tp_session, referenced via session->priv[]. 115 */ 116 struct pppol2tp_session { 117 int owner; /* pid that opened the socket */ 118 119 struct mutex sk_lock; /* Protects .sk */ 120 struct sock __rcu *sk; /* Pointer to the session PPPoX socket */ 121 struct sock *__sk; /* Copy of .sk, for cleanup */ 122 struct rcu_head rcu; /* For asynchronous release */ 123 }; 124 125 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb); 126 127 static const struct ppp_channel_ops pppol2tp_chan_ops = { 128 .start_xmit = pppol2tp_xmit, 129 }; 130 131 static const struct proto_ops pppol2tp_ops; 132 133 /* Retrieves the pppol2tp socket associated to a session. 134 * A reference is held on the returned socket, so this function must be paired 135 * with sock_put(). 136 */ 137 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) 138 { 139 struct pppol2tp_session *ps = l2tp_session_priv(session); 140 struct sock *sk; 141 142 rcu_read_lock(); 143 sk = rcu_dereference(ps->sk); 144 if (sk) 145 sock_hold(sk); 146 rcu_read_unlock(); 147 148 return sk; 149 } 150 151 /* Helpers to obtain tunnel/session contexts from sockets. 152 */ 153 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) 154 { 155 struct l2tp_session *session; 156 157 if (!sk) 158 return NULL; 159 160 sock_hold(sk); 161 session = (struct l2tp_session *)(sk->sk_user_data); 162 if (!session) { 163 sock_put(sk); 164 goto out; 165 } 166 if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) { 167 session = NULL; 168 sock_put(sk); 169 goto out; 170 } 171 172 out: 173 return session; 174 } 175 176 /***************************************************************************** 177 * Receive data handling 178 *****************************************************************************/ 179 180 /* Receive message. This is the recvmsg for the PPPoL2TP socket. 181 */ 182 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, 183 size_t len, int flags) 184 { 185 int err; 186 struct sk_buff *skb; 187 struct sock *sk = sock->sk; 188 189 err = -EIO; 190 if (sk->sk_state & PPPOX_BOUND) 191 goto end; 192 193 err = 0; 194 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 195 flags & MSG_DONTWAIT, &err); 196 if (!skb) 197 goto end; 198 199 if (len > skb->len) 200 len = skb->len; 201 else if (len < skb->len) 202 msg->msg_flags |= MSG_TRUNC; 203 204 err = skb_copy_datagram_msg(skb, 0, msg, len); 205 if (likely(err == 0)) 206 err = len; 207 208 kfree_skb(skb); 209 end: 210 return err; 211 } 212 213 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) 214 { 215 struct pppol2tp_session *ps = l2tp_session_priv(session); 216 struct sock *sk = NULL; 217 218 /* If the socket is bound, send it in to PPP's input queue. Otherwise 219 * queue it on the session socket. 220 */ 221 rcu_read_lock(); 222 sk = rcu_dereference(ps->sk); 223 if (!sk) 224 goto no_sock; 225 226 /* If the first two bytes are 0xFF03, consider that it is the PPP's 227 * Address and Control fields and skip them. The L2TP module has always 228 * worked this way, although, in theory, the use of these fields should 229 * be negociated and handled at the PPP layer. These fields are 230 * constant: 0xFF is the All-Stations Address and 0x03 the Unnumbered 231 * Information command with Poll/Final bit set to zero (RFC 1662). 232 */ 233 if (pskb_may_pull(skb, 2) && skb->data[0] == PPP_ALLSTATIONS && 234 skb->data[1] == PPP_UI) 235 skb_pull(skb, 2); 236 237 if (sk->sk_state & PPPOX_BOUND) { 238 struct pppox_sock *po; 239 240 l2tp_dbg(session, L2TP_MSG_DATA, 241 "%s: recv %d byte data frame, passing to ppp\n", 242 session->name, data_len); 243 244 po = pppox_sk(sk); 245 ppp_input(&po->chan, skb); 246 } else { 247 l2tp_dbg(session, L2TP_MSG_DATA, 248 "%s: recv %d byte data frame, passing to L2TP socket\n", 249 session->name, data_len); 250 251 if (sock_queue_rcv_skb(sk, skb) < 0) { 252 atomic_long_inc(&session->stats.rx_errors); 253 kfree_skb(skb); 254 } 255 } 256 rcu_read_unlock(); 257 258 return; 259 260 no_sock: 261 rcu_read_unlock(); 262 l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name); 263 kfree_skb(skb); 264 } 265 266 /************************************************************************ 267 * Transmit handling 268 ***********************************************************************/ 269 270 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here 271 * when a user application does a sendmsg() on the session socket. L2TP and 272 * PPP headers must be inserted into the user's data. 273 */ 274 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m, 275 size_t total_len) 276 { 277 struct sock *sk = sock->sk; 278 struct sk_buff *skb; 279 int error; 280 struct l2tp_session *session; 281 struct l2tp_tunnel *tunnel; 282 int uhlen; 283 284 error = -ENOTCONN; 285 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 286 goto error; 287 288 /* Get session and tunnel contexts */ 289 error = -EBADF; 290 session = pppol2tp_sock_to_session(sk); 291 if (!session) 292 goto error; 293 294 tunnel = session->tunnel; 295 296 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 297 298 /* Allocate a socket buffer */ 299 error = -ENOMEM; 300 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 301 uhlen + session->hdr_len + 302 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 303 0, GFP_KERNEL); 304 if (!skb) 305 goto error_put_sess; 306 307 /* Reserve space for headers. */ 308 skb_reserve(skb, NET_SKB_PAD); 309 skb_reset_network_header(skb); 310 skb_reserve(skb, sizeof(struct iphdr)); 311 skb_reset_transport_header(skb); 312 skb_reserve(skb, uhlen); 313 314 /* Add PPP header */ 315 skb->data[0] = PPP_ALLSTATIONS; 316 skb->data[1] = PPP_UI; 317 skb_put(skb, 2); 318 319 /* Copy user data into skb */ 320 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len); 321 if (error < 0) { 322 kfree_skb(skb); 323 goto error_put_sess; 324 } 325 326 local_bh_disable(); 327 l2tp_xmit_skb(session, skb, session->hdr_len); 328 local_bh_enable(); 329 330 sock_put(sk); 331 332 return total_len; 333 334 error_put_sess: 335 sock_put(sk); 336 error: 337 return error; 338 } 339 340 /* Transmit function called by generic PPP driver. Sends PPP frame 341 * over PPPoL2TP socket. 342 * 343 * This is almost the same as pppol2tp_sendmsg(), but rather than 344 * being called with a msghdr from userspace, it is called with a skb 345 * from the kernel. 346 * 347 * The supplied skb from ppp doesn't have enough headroom for the 348 * insertion of L2TP, UDP and IP headers so we need to allocate more 349 * headroom in the skb. This will create a cloned skb. But we must be 350 * careful in the error case because the caller will expect to free 351 * the skb it supplied, not our cloned skb. So we take care to always 352 * leave the original skb unfreed if we return an error. 353 */ 354 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) 355 { 356 struct sock *sk = (struct sock *)chan->private; 357 struct l2tp_session *session; 358 struct l2tp_tunnel *tunnel; 359 int uhlen, headroom; 360 361 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 362 goto abort; 363 364 /* Get session and tunnel contexts from the socket */ 365 session = pppol2tp_sock_to_session(sk); 366 if (!session) 367 goto abort; 368 369 tunnel = session->tunnel; 370 371 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 372 headroom = NET_SKB_PAD + 373 sizeof(struct iphdr) + /* IP header */ 374 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */ 375 session->hdr_len + /* L2TP header */ 376 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 377 if (skb_cow_head(skb, headroom)) 378 goto abort_put_sess; 379 380 /* Setup PPP header */ 381 __skb_push(skb, 2); 382 skb->data[0] = PPP_ALLSTATIONS; 383 skb->data[1] = PPP_UI; 384 385 local_bh_disable(); 386 l2tp_xmit_skb(session, skb, session->hdr_len); 387 local_bh_enable(); 388 389 sock_put(sk); 390 391 return 1; 392 393 abort_put_sess: 394 sock_put(sk); 395 abort: 396 /* Free the original skb */ 397 kfree_skb(skb); 398 return 1; 399 } 400 401 /***************************************************************************** 402 * Session (and tunnel control) socket create/destroy. 403 *****************************************************************************/ 404 405 static void pppol2tp_put_sk(struct rcu_head *head) 406 { 407 struct pppol2tp_session *ps; 408 409 ps = container_of(head, typeof(*ps), rcu); 410 sock_put(ps->__sk); 411 } 412 413 /* Really kill the session socket. (Called from sock_put() if 414 * refcnt == 0.) 415 */ 416 static void pppol2tp_session_destruct(struct sock *sk) 417 { 418 struct l2tp_session *session = sk->sk_user_data; 419 420 skb_queue_purge(&sk->sk_receive_queue); 421 skb_queue_purge(&sk->sk_write_queue); 422 423 if (session) { 424 sk->sk_user_data = NULL; 425 if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) 426 return; 427 l2tp_session_dec_refcount(session); 428 } 429 } 430 431 /* Called when the PPPoX socket (session) is closed. 432 */ 433 static int pppol2tp_release(struct socket *sock) 434 { 435 struct sock *sk = sock->sk; 436 struct l2tp_session *session; 437 int error; 438 439 if (!sk) 440 return 0; 441 442 error = -EBADF; 443 lock_sock(sk); 444 if (sock_flag(sk, SOCK_DEAD) != 0) 445 goto error; 446 447 pppox_unbind_sock(sk); 448 449 /* Signal the death of the socket. */ 450 sk->sk_state = PPPOX_DEAD; 451 sock_orphan(sk); 452 sock->sk = NULL; 453 454 session = pppol2tp_sock_to_session(sk); 455 if (session) { 456 struct pppol2tp_session *ps; 457 458 l2tp_session_delete(session); 459 460 ps = l2tp_session_priv(session); 461 mutex_lock(&ps->sk_lock); 462 ps->__sk = rcu_dereference_protected(ps->sk, 463 lockdep_is_held(&ps->sk_lock)); 464 RCU_INIT_POINTER(ps->sk, NULL); 465 mutex_unlock(&ps->sk_lock); 466 call_rcu(&ps->rcu, pppol2tp_put_sk); 467 468 /* Rely on the sock_put() call at the end of the function for 469 * dropping the reference held by pppol2tp_sock_to_session(). 470 * The last reference will be dropped by pppol2tp_put_sk(). 471 */ 472 } 473 474 release_sock(sk); 475 476 /* This will delete the session context via 477 * pppol2tp_session_destruct() if the socket's refcnt drops to 478 * zero. 479 */ 480 sock_put(sk); 481 482 return 0; 483 484 error: 485 release_sock(sk); 486 return error; 487 } 488 489 static struct proto pppol2tp_sk_proto = { 490 .name = "PPPOL2TP", 491 .owner = THIS_MODULE, 492 .obj_size = sizeof(struct pppox_sock), 493 }; 494 495 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb) 496 { 497 int rc; 498 499 rc = l2tp_udp_encap_recv(sk, skb); 500 if (rc) 501 kfree_skb(skb); 502 503 return NET_RX_SUCCESS; 504 } 505 506 /* socket() handler. Initialize a new struct sock. 507 */ 508 static int pppol2tp_create(struct net *net, struct socket *sock, int kern) 509 { 510 int error = -ENOMEM; 511 struct sock *sk; 512 513 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern); 514 if (!sk) 515 goto out; 516 517 sock_init_data(sock, sk); 518 519 sock->state = SS_UNCONNECTED; 520 sock->ops = &pppol2tp_ops; 521 522 sk->sk_backlog_rcv = pppol2tp_backlog_recv; 523 sk->sk_protocol = PX_PROTO_OL2TP; 524 sk->sk_family = PF_PPPOX; 525 sk->sk_state = PPPOX_NONE; 526 sk->sk_type = SOCK_STREAM; 527 sk->sk_destruct = pppol2tp_session_destruct; 528 529 error = 0; 530 531 out: 532 return error; 533 } 534 535 static void pppol2tp_show(struct seq_file *m, void *arg) 536 { 537 struct l2tp_session *session = arg; 538 struct sock *sk; 539 540 sk = pppol2tp_session_get_sock(session); 541 if (sk) { 542 struct pppox_sock *po = pppox_sk(sk); 543 544 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 545 sock_put(sk); 546 } 547 } 548 549 static void pppol2tp_session_init(struct l2tp_session *session) 550 { 551 struct pppol2tp_session *ps; 552 553 session->recv_skb = pppol2tp_recv; 554 if (IS_ENABLED(CONFIG_L2TP_DEBUGFS)) 555 session->show = pppol2tp_show; 556 557 ps = l2tp_session_priv(session); 558 mutex_init(&ps->sk_lock); 559 ps->owner = current->pid; 560 } 561 562 struct l2tp_connect_info { 563 u8 version; 564 int fd; 565 u32 tunnel_id; 566 u32 peer_tunnel_id; 567 u32 session_id; 568 u32 peer_session_id; 569 }; 570 571 static int pppol2tp_sockaddr_get_info(const void *sa, int sa_len, 572 struct l2tp_connect_info *info) 573 { 574 switch (sa_len) { 575 case sizeof(struct sockaddr_pppol2tp): 576 { 577 const struct sockaddr_pppol2tp *sa_v2in4 = sa; 578 579 if (sa_v2in4->sa_protocol != PX_PROTO_OL2TP) 580 return -EINVAL; 581 582 info->version = 2; 583 info->fd = sa_v2in4->pppol2tp.fd; 584 info->tunnel_id = sa_v2in4->pppol2tp.s_tunnel; 585 info->peer_tunnel_id = sa_v2in4->pppol2tp.d_tunnel; 586 info->session_id = sa_v2in4->pppol2tp.s_session; 587 info->peer_session_id = sa_v2in4->pppol2tp.d_session; 588 589 break; 590 } 591 case sizeof(struct sockaddr_pppol2tpv3): 592 { 593 const struct sockaddr_pppol2tpv3 *sa_v3in4 = sa; 594 595 if (sa_v3in4->sa_protocol != PX_PROTO_OL2TP) 596 return -EINVAL; 597 598 info->version = 3; 599 info->fd = sa_v3in4->pppol2tp.fd; 600 info->tunnel_id = sa_v3in4->pppol2tp.s_tunnel; 601 info->peer_tunnel_id = sa_v3in4->pppol2tp.d_tunnel; 602 info->session_id = sa_v3in4->pppol2tp.s_session; 603 info->peer_session_id = sa_v3in4->pppol2tp.d_session; 604 605 break; 606 } 607 case sizeof(struct sockaddr_pppol2tpin6): 608 { 609 const struct sockaddr_pppol2tpin6 *sa_v2in6 = sa; 610 611 if (sa_v2in6->sa_protocol != PX_PROTO_OL2TP) 612 return -EINVAL; 613 614 info->version = 2; 615 info->fd = sa_v2in6->pppol2tp.fd; 616 info->tunnel_id = sa_v2in6->pppol2tp.s_tunnel; 617 info->peer_tunnel_id = sa_v2in6->pppol2tp.d_tunnel; 618 info->session_id = sa_v2in6->pppol2tp.s_session; 619 info->peer_session_id = sa_v2in6->pppol2tp.d_session; 620 621 break; 622 } 623 case sizeof(struct sockaddr_pppol2tpv3in6): 624 { 625 const struct sockaddr_pppol2tpv3in6 *sa_v3in6 = sa; 626 627 if (sa_v3in6->sa_protocol != PX_PROTO_OL2TP) 628 return -EINVAL; 629 630 info->version = 3; 631 info->fd = sa_v3in6->pppol2tp.fd; 632 info->tunnel_id = sa_v3in6->pppol2tp.s_tunnel; 633 info->peer_tunnel_id = sa_v3in6->pppol2tp.d_tunnel; 634 info->session_id = sa_v3in6->pppol2tp.s_session; 635 info->peer_session_id = sa_v3in6->pppol2tp.d_session; 636 637 break; 638 } 639 default: 640 return -EINVAL; 641 } 642 643 return 0; 644 } 645 646 /* Rough estimation of the maximum payload size a tunnel can transmit without 647 * fragmenting at the lower IP layer. Assumes L2TPv2 with sequence 648 * numbers and no IP option. Not quite accurate, but the result is mostly 649 * unused anyway. 650 */ 651 static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel) 652 { 653 int mtu; 654 655 mtu = l2tp_tunnel_dst_mtu(tunnel); 656 if (mtu <= PPPOL2TP_HEADER_OVERHEAD) 657 return 1500 - PPPOL2TP_HEADER_OVERHEAD; 658 659 return mtu - PPPOL2TP_HEADER_OVERHEAD; 660 } 661 662 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket 663 */ 664 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 665 int sockaddr_len, int flags) 666 { 667 struct sock *sk = sock->sk; 668 struct pppox_sock *po = pppox_sk(sk); 669 struct l2tp_session *session = NULL; 670 struct l2tp_connect_info info; 671 struct l2tp_tunnel *tunnel; 672 struct pppol2tp_session *ps; 673 struct l2tp_session_cfg cfg = { 0, }; 674 bool drop_refcnt = false; 675 bool drop_tunnel = false; 676 bool new_session = false; 677 bool new_tunnel = false; 678 int error; 679 680 error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info); 681 if (error < 0) 682 return error; 683 684 lock_sock(sk); 685 686 /* Check for already bound sockets */ 687 error = -EBUSY; 688 if (sk->sk_state & PPPOX_CONNECTED) 689 goto end; 690 691 /* We don't supporting rebinding anyway */ 692 error = -EALREADY; 693 if (sk->sk_user_data) 694 goto end; /* socket is already attached */ 695 696 /* Don't bind if tunnel_id is 0 */ 697 error = -EINVAL; 698 if (!info.tunnel_id) 699 goto end; 700 701 tunnel = l2tp_tunnel_get(sock_net(sk), info.tunnel_id); 702 if (tunnel) 703 drop_tunnel = true; 704 705 /* Special case: create tunnel context if session_id and 706 * peer_session_id is 0. Otherwise look up tunnel using supplied 707 * tunnel id. 708 */ 709 if (!info.session_id && !info.peer_session_id) { 710 if (!tunnel) { 711 struct l2tp_tunnel_cfg tcfg = { 712 .encap = L2TP_ENCAPTYPE_UDP, 713 .debug = 0, 714 }; 715 716 /* Prevent l2tp_tunnel_register() from trying to set up 717 * a kernel socket. 718 */ 719 if (info.fd < 0) { 720 error = -EBADF; 721 goto end; 722 } 723 724 error = l2tp_tunnel_create(sock_net(sk), info.fd, 725 info.version, 726 info.tunnel_id, 727 info.peer_tunnel_id, &tcfg, 728 &tunnel); 729 if (error < 0) 730 goto end; 731 732 l2tp_tunnel_inc_refcount(tunnel); 733 error = l2tp_tunnel_register(tunnel, sock_net(sk), 734 &tcfg); 735 if (error < 0) { 736 kfree(tunnel); 737 goto end; 738 } 739 drop_tunnel = true; 740 new_tunnel = true; 741 } 742 } else { 743 /* Error if we can't find the tunnel */ 744 error = -ENOENT; 745 if (!tunnel) 746 goto end; 747 748 /* Error if socket is not prepped */ 749 if (!tunnel->sock) 750 goto end; 751 } 752 753 if (tunnel->peer_tunnel_id == 0) 754 tunnel->peer_tunnel_id = info.peer_tunnel_id; 755 756 session = l2tp_tunnel_get_session(tunnel, info.session_id); 757 if (session) { 758 drop_refcnt = true; 759 760 if (session->pwtype != L2TP_PWTYPE_PPP) { 761 error = -EPROTOTYPE; 762 goto end; 763 } 764 765 ps = l2tp_session_priv(session); 766 767 /* Using a pre-existing session is fine as long as it hasn't 768 * been connected yet. 769 */ 770 mutex_lock(&ps->sk_lock); 771 if (rcu_dereference_protected(ps->sk, 772 lockdep_is_held(&ps->sk_lock)) || 773 ps->__sk) { 774 mutex_unlock(&ps->sk_lock); 775 error = -EEXIST; 776 goto end; 777 } 778 } else { 779 cfg.pw_type = L2TP_PWTYPE_PPP; 780 781 session = l2tp_session_create(sizeof(struct pppol2tp_session), 782 tunnel, info.session_id, 783 info.peer_session_id, &cfg); 784 if (IS_ERR(session)) { 785 error = PTR_ERR(session); 786 goto end; 787 } 788 789 pppol2tp_session_init(session); 790 ps = l2tp_session_priv(session); 791 l2tp_session_inc_refcount(session); 792 793 mutex_lock(&ps->sk_lock); 794 error = l2tp_session_register(session, tunnel); 795 if (error < 0) { 796 mutex_unlock(&ps->sk_lock); 797 kfree(session); 798 goto end; 799 } 800 drop_refcnt = true; 801 new_session = true; 802 } 803 804 /* Special case: if source & dest session_id == 0x0000, this 805 * socket is being created to manage the tunnel. Just set up 806 * the internal context for use by ioctl() and sockopt() 807 * handlers. 808 */ 809 if (session->session_id == 0 && session->peer_session_id == 0) { 810 error = 0; 811 goto out_no_ppp; 812 } 813 814 /* The only header we need to worry about is the L2TP 815 * header. This size is different depending on whether 816 * sequence numbers are enabled for the data channel. 817 */ 818 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 819 820 po->chan.private = sk; 821 po->chan.ops = &pppol2tp_chan_ops; 822 po->chan.mtu = pppol2tp_tunnel_mtu(tunnel); 823 824 error = ppp_register_net_channel(sock_net(sk), &po->chan); 825 if (error) { 826 mutex_unlock(&ps->sk_lock); 827 goto end; 828 } 829 830 out_no_ppp: 831 /* This is how we get the session context from the socket. */ 832 sk->sk_user_data = session; 833 rcu_assign_pointer(ps->sk, sk); 834 mutex_unlock(&ps->sk_lock); 835 836 /* Keep the reference we've grabbed on the session: sk doesn't expect 837 * the session to disappear. pppol2tp_session_destruct() is responsible 838 * for dropping it. 839 */ 840 drop_refcnt = false; 841 842 sk->sk_state = PPPOX_CONNECTED; 843 l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n", 844 session->name); 845 846 end: 847 if (error) { 848 if (new_session) 849 l2tp_session_delete(session); 850 if (new_tunnel) 851 l2tp_tunnel_delete(tunnel); 852 } 853 if (drop_refcnt) 854 l2tp_session_dec_refcount(session); 855 if (drop_tunnel) 856 l2tp_tunnel_dec_refcount(tunnel); 857 release_sock(sk); 858 859 return error; 860 } 861 862 #ifdef CONFIG_L2TP_V3 863 864 /* Called when creating sessions via the netlink interface. */ 865 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, 866 u32 session_id, u32 peer_session_id, 867 struct l2tp_session_cfg *cfg) 868 { 869 int error; 870 struct l2tp_session *session; 871 872 /* Error if tunnel socket is not prepped */ 873 if (!tunnel->sock) { 874 error = -ENOENT; 875 goto err; 876 } 877 878 /* Allocate and initialize a new session context. */ 879 session = l2tp_session_create(sizeof(struct pppol2tp_session), 880 tunnel, session_id, 881 peer_session_id, cfg); 882 if (IS_ERR(session)) { 883 error = PTR_ERR(session); 884 goto err; 885 } 886 887 pppol2tp_session_init(session); 888 889 error = l2tp_session_register(session, tunnel); 890 if (error < 0) 891 goto err_sess; 892 893 return 0; 894 895 err_sess: 896 kfree(session); 897 err: 898 return error; 899 } 900 901 #endif /* CONFIG_L2TP_V3 */ 902 903 /* getname() support. 904 */ 905 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr, 906 int peer) 907 { 908 int len = 0; 909 int error = 0; 910 struct l2tp_session *session; 911 struct l2tp_tunnel *tunnel; 912 struct sock *sk = sock->sk; 913 struct inet_sock *inet; 914 struct pppol2tp_session *pls; 915 916 error = -ENOTCONN; 917 if (!sk) 918 goto end; 919 if (!(sk->sk_state & PPPOX_CONNECTED)) 920 goto end; 921 922 error = -EBADF; 923 session = pppol2tp_sock_to_session(sk); 924 if (!session) 925 goto end; 926 927 pls = l2tp_session_priv(session); 928 tunnel = session->tunnel; 929 930 inet = inet_sk(tunnel->sock); 931 if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET) { 932 struct sockaddr_pppol2tp sp; 933 934 len = sizeof(sp); 935 memset(&sp, 0, len); 936 sp.sa_family = AF_PPPOX; 937 sp.sa_protocol = PX_PROTO_OL2TP; 938 sp.pppol2tp.fd = tunnel->fd; 939 sp.pppol2tp.pid = pls->owner; 940 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 941 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 942 sp.pppol2tp.s_session = session->session_id; 943 sp.pppol2tp.d_session = session->peer_session_id; 944 sp.pppol2tp.addr.sin_family = AF_INET; 945 sp.pppol2tp.addr.sin_port = inet->inet_dport; 946 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 947 memcpy(uaddr, &sp, len); 948 #if IS_ENABLED(CONFIG_IPV6) 949 } else if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET6) { 950 struct sockaddr_pppol2tpin6 sp; 951 952 len = sizeof(sp); 953 memset(&sp, 0, len); 954 sp.sa_family = AF_PPPOX; 955 sp.sa_protocol = PX_PROTO_OL2TP; 956 sp.pppol2tp.fd = tunnel->fd; 957 sp.pppol2tp.pid = pls->owner; 958 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 959 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 960 sp.pppol2tp.s_session = session->session_id; 961 sp.pppol2tp.d_session = session->peer_session_id; 962 sp.pppol2tp.addr.sin6_family = AF_INET6; 963 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 964 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 965 sizeof(tunnel->sock->sk_v6_daddr)); 966 memcpy(uaddr, &sp, len); 967 } else if (tunnel->version == 3 && tunnel->sock->sk_family == AF_INET6) { 968 struct sockaddr_pppol2tpv3in6 sp; 969 970 len = sizeof(sp); 971 memset(&sp, 0, len); 972 sp.sa_family = AF_PPPOX; 973 sp.sa_protocol = PX_PROTO_OL2TP; 974 sp.pppol2tp.fd = tunnel->fd; 975 sp.pppol2tp.pid = pls->owner; 976 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 977 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 978 sp.pppol2tp.s_session = session->session_id; 979 sp.pppol2tp.d_session = session->peer_session_id; 980 sp.pppol2tp.addr.sin6_family = AF_INET6; 981 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 982 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 983 sizeof(tunnel->sock->sk_v6_daddr)); 984 memcpy(uaddr, &sp, len); 985 #endif 986 } else if (tunnel->version == 3) { 987 struct sockaddr_pppol2tpv3 sp; 988 989 len = sizeof(sp); 990 memset(&sp, 0, len); 991 sp.sa_family = AF_PPPOX; 992 sp.sa_protocol = PX_PROTO_OL2TP; 993 sp.pppol2tp.fd = tunnel->fd; 994 sp.pppol2tp.pid = pls->owner; 995 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 996 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 997 sp.pppol2tp.s_session = session->session_id; 998 sp.pppol2tp.d_session = session->peer_session_id; 999 sp.pppol2tp.addr.sin_family = AF_INET; 1000 sp.pppol2tp.addr.sin_port = inet->inet_dport; 1001 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 1002 memcpy(uaddr, &sp, len); 1003 } 1004 1005 error = len; 1006 1007 sock_put(sk); 1008 end: 1009 return error; 1010 } 1011 1012 /**************************************************************************** 1013 * ioctl() handlers. 1014 * 1015 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1016 * sockets. However, in order to control kernel tunnel features, we allow 1017 * userspace to create a special "tunnel" PPPoX socket which is used for 1018 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow 1019 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl() 1020 * calls. 1021 ****************************************************************************/ 1022 1023 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest, 1024 const struct l2tp_stats *stats) 1025 { 1026 memset(dest, 0, sizeof(*dest)); 1027 1028 dest->tx_packets = atomic_long_read(&stats->tx_packets); 1029 dest->tx_bytes = atomic_long_read(&stats->tx_bytes); 1030 dest->tx_errors = atomic_long_read(&stats->tx_errors); 1031 dest->rx_packets = atomic_long_read(&stats->rx_packets); 1032 dest->rx_bytes = atomic_long_read(&stats->rx_bytes); 1033 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards); 1034 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets); 1035 dest->rx_errors = atomic_long_read(&stats->rx_errors); 1036 } 1037 1038 static int pppol2tp_tunnel_copy_stats(struct pppol2tp_ioc_stats *stats, 1039 struct l2tp_tunnel *tunnel) 1040 { 1041 struct l2tp_session *session; 1042 1043 if (!stats->session_id) { 1044 pppol2tp_copy_stats(stats, &tunnel->stats); 1045 return 0; 1046 } 1047 1048 /* If session_id is set, search the corresponding session in the 1049 * context of this tunnel and record the session's statistics. 1050 */ 1051 session = l2tp_tunnel_get_session(tunnel, stats->session_id); 1052 if (!session) 1053 return -EBADR; 1054 1055 if (session->pwtype != L2TP_PWTYPE_PPP) { 1056 l2tp_session_dec_refcount(session); 1057 return -EBADR; 1058 } 1059 1060 pppol2tp_copy_stats(stats, &session->stats); 1061 l2tp_session_dec_refcount(session); 1062 1063 return 0; 1064 } 1065 1066 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, 1067 unsigned long arg) 1068 { 1069 struct pppol2tp_ioc_stats stats; 1070 struct l2tp_session *session; 1071 1072 switch (cmd) { 1073 case PPPIOCGMRU: 1074 case PPPIOCGFLAGS: 1075 session = sock->sk->sk_user_data; 1076 if (!session) 1077 return -ENOTCONN; 1078 1079 /* Not defined for tunnels */ 1080 if (!session->session_id && !session->peer_session_id) 1081 return -ENOSYS; 1082 1083 if (put_user(0, (int __user *)arg)) 1084 return -EFAULT; 1085 break; 1086 1087 case PPPIOCSMRU: 1088 case PPPIOCSFLAGS: 1089 session = sock->sk->sk_user_data; 1090 if (!session) 1091 return -ENOTCONN; 1092 1093 /* Not defined for tunnels */ 1094 if (!session->session_id && !session->peer_session_id) 1095 return -ENOSYS; 1096 1097 if (!access_ok((int __user *)arg, sizeof(int))) 1098 return -EFAULT; 1099 break; 1100 1101 case PPPIOCGL2TPSTATS: 1102 session = sock->sk->sk_user_data; 1103 if (!session) 1104 return -ENOTCONN; 1105 1106 /* Session 0 represents the parent tunnel */ 1107 if (!session->session_id && !session->peer_session_id) { 1108 u32 session_id; 1109 int err; 1110 1111 if (copy_from_user(&stats, (void __user *)arg, 1112 sizeof(stats))) 1113 return -EFAULT; 1114 1115 session_id = stats.session_id; 1116 err = pppol2tp_tunnel_copy_stats(&stats, 1117 session->tunnel); 1118 if (err < 0) 1119 return err; 1120 1121 stats.session_id = session_id; 1122 } else { 1123 pppol2tp_copy_stats(&stats, &session->stats); 1124 stats.session_id = session->session_id; 1125 } 1126 stats.tunnel_id = session->tunnel->tunnel_id; 1127 stats.using_ipsec = l2tp_tunnel_uses_xfrm(session->tunnel); 1128 1129 if (copy_to_user((void __user *)arg, &stats, sizeof(stats))) 1130 return -EFAULT; 1131 break; 1132 1133 default: 1134 return -ENOIOCTLCMD; 1135 } 1136 1137 return 0; 1138 } 1139 1140 /***************************************************************************** 1141 * setsockopt() / getsockopt() support. 1142 * 1143 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1144 * sockets. In order to control kernel tunnel features, we allow userspace to 1145 * create a special "tunnel" PPPoX socket which is used for control only. 1146 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user 1147 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls. 1148 *****************************************************************************/ 1149 1150 /* Tunnel setsockopt() helper. 1151 */ 1152 static int pppol2tp_tunnel_setsockopt(struct sock *sk, 1153 struct l2tp_tunnel *tunnel, 1154 int optname, int val) 1155 { 1156 int err = 0; 1157 1158 switch (optname) { 1159 case PPPOL2TP_SO_DEBUG: 1160 tunnel->debug = val; 1161 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1162 tunnel->name, tunnel->debug); 1163 break; 1164 1165 default: 1166 err = -ENOPROTOOPT; 1167 break; 1168 } 1169 1170 return err; 1171 } 1172 1173 /* Session setsockopt helper. 1174 */ 1175 static int pppol2tp_session_setsockopt(struct sock *sk, 1176 struct l2tp_session *session, 1177 int optname, int val) 1178 { 1179 int err = 0; 1180 1181 switch (optname) { 1182 case PPPOL2TP_SO_RECVSEQ: 1183 if (val != 0 && val != 1) { 1184 err = -EINVAL; 1185 break; 1186 } 1187 session->recv_seq = !!val; 1188 l2tp_info(session, L2TP_MSG_CONTROL, 1189 "%s: set recv_seq=%d\n", 1190 session->name, session->recv_seq); 1191 break; 1192 1193 case PPPOL2TP_SO_SENDSEQ: 1194 if (val != 0 && val != 1) { 1195 err = -EINVAL; 1196 break; 1197 } 1198 session->send_seq = !!val; 1199 { 1200 struct pppox_sock *po = pppox_sk(sk); 1201 1202 po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ : 1203 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 1204 } 1205 l2tp_session_set_header_len(session, session->tunnel->version); 1206 l2tp_info(session, L2TP_MSG_CONTROL, 1207 "%s: set send_seq=%d\n", 1208 session->name, session->send_seq); 1209 break; 1210 1211 case PPPOL2TP_SO_LNSMODE: 1212 if (val != 0 && val != 1) { 1213 err = -EINVAL; 1214 break; 1215 } 1216 session->lns_mode = !!val; 1217 l2tp_info(session, L2TP_MSG_CONTROL, 1218 "%s: set lns_mode=%d\n", 1219 session->name, session->lns_mode); 1220 break; 1221 1222 case PPPOL2TP_SO_DEBUG: 1223 session->debug = val; 1224 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1225 session->name, session->debug); 1226 break; 1227 1228 case PPPOL2TP_SO_REORDERTO: 1229 session->reorder_timeout = msecs_to_jiffies(val); 1230 l2tp_info(session, L2TP_MSG_CONTROL, 1231 "%s: set reorder_timeout=%d\n", 1232 session->name, session->reorder_timeout); 1233 break; 1234 1235 default: 1236 err = -ENOPROTOOPT; 1237 break; 1238 } 1239 1240 return err; 1241 } 1242 1243 /* Main setsockopt() entry point. 1244 * Does API checks, then calls either the tunnel or session setsockopt 1245 * handler, according to whether the PPPoL2TP socket is a for a regular 1246 * session or the special tunnel type. 1247 */ 1248 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, 1249 sockptr_t optval, unsigned int optlen) 1250 { 1251 struct sock *sk = sock->sk; 1252 struct l2tp_session *session; 1253 struct l2tp_tunnel *tunnel; 1254 int val; 1255 int err; 1256 1257 if (level != SOL_PPPOL2TP) 1258 return -EINVAL; 1259 1260 if (optlen < sizeof(int)) 1261 return -EINVAL; 1262 1263 if (copy_from_sockptr(&val, optval, sizeof(int))) 1264 return -EFAULT; 1265 1266 err = -ENOTCONN; 1267 if (!sk->sk_user_data) 1268 goto end; 1269 1270 /* Get session context from the socket */ 1271 err = -EBADF; 1272 session = pppol2tp_sock_to_session(sk); 1273 if (!session) 1274 goto end; 1275 1276 /* Special case: if session_id == 0x0000, treat as operation on tunnel 1277 */ 1278 if (session->session_id == 0 && session->peer_session_id == 0) { 1279 tunnel = session->tunnel; 1280 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val); 1281 } else { 1282 err = pppol2tp_session_setsockopt(sk, session, optname, val); 1283 } 1284 1285 sock_put(sk); 1286 end: 1287 return err; 1288 } 1289 1290 /* Tunnel getsockopt helper. Called with sock locked. 1291 */ 1292 static int pppol2tp_tunnel_getsockopt(struct sock *sk, 1293 struct l2tp_tunnel *tunnel, 1294 int optname, int *val) 1295 { 1296 int err = 0; 1297 1298 switch (optname) { 1299 case PPPOL2TP_SO_DEBUG: 1300 *val = tunnel->debug; 1301 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get debug=%x\n", 1302 tunnel->name, tunnel->debug); 1303 break; 1304 1305 default: 1306 err = -ENOPROTOOPT; 1307 break; 1308 } 1309 1310 return err; 1311 } 1312 1313 /* Session getsockopt helper. Called with sock locked. 1314 */ 1315 static int pppol2tp_session_getsockopt(struct sock *sk, 1316 struct l2tp_session *session, 1317 int optname, int *val) 1318 { 1319 int err = 0; 1320 1321 switch (optname) { 1322 case PPPOL2TP_SO_RECVSEQ: 1323 *val = session->recv_seq; 1324 l2tp_info(session, L2TP_MSG_CONTROL, 1325 "%s: get recv_seq=%d\n", session->name, *val); 1326 break; 1327 1328 case PPPOL2TP_SO_SENDSEQ: 1329 *val = session->send_seq; 1330 l2tp_info(session, L2TP_MSG_CONTROL, 1331 "%s: get send_seq=%d\n", session->name, *val); 1332 break; 1333 1334 case PPPOL2TP_SO_LNSMODE: 1335 *val = session->lns_mode; 1336 l2tp_info(session, L2TP_MSG_CONTROL, 1337 "%s: get lns_mode=%d\n", session->name, *val); 1338 break; 1339 1340 case PPPOL2TP_SO_DEBUG: 1341 *val = session->debug; 1342 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get debug=%d\n", 1343 session->name, *val); 1344 break; 1345 1346 case PPPOL2TP_SO_REORDERTO: 1347 *val = (int)jiffies_to_msecs(session->reorder_timeout); 1348 l2tp_info(session, L2TP_MSG_CONTROL, 1349 "%s: get reorder_timeout=%d\n", session->name, *val); 1350 break; 1351 1352 default: 1353 err = -ENOPROTOOPT; 1354 } 1355 1356 return err; 1357 } 1358 1359 /* Main getsockopt() entry point. 1360 * Does API checks, then calls either the tunnel or session getsockopt 1361 * handler, according to whether the PPPoX socket is a for a regular session 1362 * or the special tunnel type. 1363 */ 1364 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, 1365 char __user *optval, int __user *optlen) 1366 { 1367 struct sock *sk = sock->sk; 1368 struct l2tp_session *session; 1369 struct l2tp_tunnel *tunnel; 1370 int val, len; 1371 int err; 1372 1373 if (level != SOL_PPPOL2TP) 1374 return -EINVAL; 1375 1376 if (get_user(len, optlen)) 1377 return -EFAULT; 1378 1379 len = min_t(unsigned int, len, sizeof(int)); 1380 1381 if (len < 0) 1382 return -EINVAL; 1383 1384 err = -ENOTCONN; 1385 if (!sk->sk_user_data) 1386 goto end; 1387 1388 /* Get the session context */ 1389 err = -EBADF; 1390 session = pppol2tp_sock_to_session(sk); 1391 if (!session) 1392 goto end; 1393 1394 /* Special case: if session_id == 0x0000, treat as operation on tunnel */ 1395 if (session->session_id == 0 && session->peer_session_id == 0) { 1396 tunnel = session->tunnel; 1397 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val); 1398 if (err) 1399 goto end_put_sess; 1400 } else { 1401 err = pppol2tp_session_getsockopt(sk, session, optname, &val); 1402 if (err) 1403 goto end_put_sess; 1404 } 1405 1406 err = -EFAULT; 1407 if (put_user(len, optlen)) 1408 goto end_put_sess; 1409 1410 if (copy_to_user((void __user *)optval, &val, len)) 1411 goto end_put_sess; 1412 1413 err = 0; 1414 1415 end_put_sess: 1416 sock_put(sk); 1417 end: 1418 return err; 1419 } 1420 1421 /***************************************************************************** 1422 * /proc filesystem for debug 1423 * Since the original pppol2tp driver provided /proc/net/pppol2tp for 1424 * L2TPv2, we dump only L2TPv2 tunnels and sessions here. 1425 *****************************************************************************/ 1426 1427 static unsigned int pppol2tp_net_id; 1428 1429 #ifdef CONFIG_PROC_FS 1430 1431 struct pppol2tp_seq_data { 1432 struct seq_net_private p; 1433 int tunnel_idx; /* current tunnel */ 1434 int session_idx; /* index of session within current tunnel */ 1435 struct l2tp_tunnel *tunnel; 1436 struct l2tp_session *session; /* NULL means get next tunnel */ 1437 }; 1438 1439 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) 1440 { 1441 /* Drop reference taken during previous invocation */ 1442 if (pd->tunnel) 1443 l2tp_tunnel_dec_refcount(pd->tunnel); 1444 1445 for (;;) { 1446 pd->tunnel = l2tp_tunnel_get_nth(net, pd->tunnel_idx); 1447 pd->tunnel_idx++; 1448 1449 /* Only accept L2TPv2 tunnels */ 1450 if (!pd->tunnel || pd->tunnel->version == 2) 1451 return; 1452 1453 l2tp_tunnel_dec_refcount(pd->tunnel); 1454 } 1455 } 1456 1457 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) 1458 { 1459 /* Drop reference taken during previous invocation */ 1460 if (pd->session) 1461 l2tp_session_dec_refcount(pd->session); 1462 1463 pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx); 1464 pd->session_idx++; 1465 1466 if (!pd->session) { 1467 pd->session_idx = 0; 1468 pppol2tp_next_tunnel(net, pd); 1469 } 1470 } 1471 1472 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs) 1473 { 1474 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN; 1475 loff_t pos = *offs; 1476 struct net *net; 1477 1478 if (!pos) 1479 goto out; 1480 1481 if (WARN_ON(!m->private)) { 1482 pd = NULL; 1483 goto out; 1484 } 1485 1486 pd = m->private; 1487 net = seq_file_net(m); 1488 1489 if (!pd->tunnel) 1490 pppol2tp_next_tunnel(net, pd); 1491 else 1492 pppol2tp_next_session(net, pd); 1493 1494 /* NULL tunnel and session indicates end of list */ 1495 if (!pd->tunnel && !pd->session) 1496 pd = NULL; 1497 1498 out: 1499 return pd; 1500 } 1501 1502 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos) 1503 { 1504 (*pos)++; 1505 return NULL; 1506 } 1507 1508 static void pppol2tp_seq_stop(struct seq_file *p, void *v) 1509 { 1510 struct pppol2tp_seq_data *pd = v; 1511 1512 if (!pd || pd == SEQ_START_TOKEN) 1513 return; 1514 1515 /* Drop reference taken by last invocation of pppol2tp_next_session() 1516 * or pppol2tp_next_tunnel(). 1517 */ 1518 if (pd->session) { 1519 l2tp_session_dec_refcount(pd->session); 1520 pd->session = NULL; 1521 } 1522 if (pd->tunnel) { 1523 l2tp_tunnel_dec_refcount(pd->tunnel); 1524 pd->tunnel = NULL; 1525 } 1526 } 1527 1528 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) 1529 { 1530 struct l2tp_tunnel *tunnel = v; 1531 1532 seq_printf(m, "\nTUNNEL '%s', %c %d\n", 1533 tunnel->name, 1534 (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N', 1535 refcount_read(&tunnel->ref_count) - 1); 1536 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n", 1537 tunnel->debug, 1538 atomic_long_read(&tunnel->stats.tx_packets), 1539 atomic_long_read(&tunnel->stats.tx_bytes), 1540 atomic_long_read(&tunnel->stats.tx_errors), 1541 atomic_long_read(&tunnel->stats.rx_packets), 1542 atomic_long_read(&tunnel->stats.rx_bytes), 1543 atomic_long_read(&tunnel->stats.rx_errors)); 1544 } 1545 1546 static void pppol2tp_seq_session_show(struct seq_file *m, void *v) 1547 { 1548 struct l2tp_session *session = v; 1549 struct l2tp_tunnel *tunnel = session->tunnel; 1550 unsigned char state; 1551 char user_data_ok; 1552 struct sock *sk; 1553 u32 ip = 0; 1554 u16 port = 0; 1555 1556 if (tunnel->sock) { 1557 struct inet_sock *inet = inet_sk(tunnel->sock); 1558 1559 ip = ntohl(inet->inet_saddr); 1560 port = ntohs(inet->inet_sport); 1561 } 1562 1563 sk = pppol2tp_session_get_sock(session); 1564 if (sk) { 1565 state = sk->sk_state; 1566 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N'; 1567 } else { 1568 state = 0; 1569 user_data_ok = 'N'; 1570 } 1571 1572 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> %04X/%04X %d %c\n", 1573 session->name, ip, port, 1574 tunnel->tunnel_id, 1575 session->session_id, 1576 tunnel->peer_tunnel_id, 1577 session->peer_session_id, 1578 state, user_data_ok); 1579 seq_printf(m, " 0/0/%c/%c/%s %08x %u\n", 1580 session->recv_seq ? 'R' : '-', 1581 session->send_seq ? 'S' : '-', 1582 session->lns_mode ? "LNS" : "LAC", 1583 session->debug, 1584 jiffies_to_msecs(session->reorder_timeout)); 1585 seq_printf(m, " %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n", 1586 session->nr, session->ns, 1587 atomic_long_read(&session->stats.tx_packets), 1588 atomic_long_read(&session->stats.tx_bytes), 1589 atomic_long_read(&session->stats.tx_errors), 1590 atomic_long_read(&session->stats.rx_packets), 1591 atomic_long_read(&session->stats.rx_bytes), 1592 atomic_long_read(&session->stats.rx_errors)); 1593 1594 if (sk) { 1595 struct pppox_sock *po = pppox_sk(sk); 1596 1597 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 1598 sock_put(sk); 1599 } 1600 } 1601 1602 static int pppol2tp_seq_show(struct seq_file *m, void *v) 1603 { 1604 struct pppol2tp_seq_data *pd = v; 1605 1606 /* display header on line 1 */ 1607 if (v == SEQ_START_TOKEN) { 1608 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n"); 1609 seq_puts(m, "TUNNEL name, user-data-ok session-count\n"); 1610 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1611 seq_puts(m, " SESSION name, addr/port src-tid/sid dest-tid/sid state user-data-ok\n"); 1612 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n"); 1613 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1614 goto out; 1615 } 1616 1617 if (!pd->session) 1618 pppol2tp_seq_tunnel_show(m, pd->tunnel); 1619 else 1620 pppol2tp_seq_session_show(m, pd->session); 1621 1622 out: 1623 return 0; 1624 } 1625 1626 static const struct seq_operations pppol2tp_seq_ops = { 1627 .start = pppol2tp_seq_start, 1628 .next = pppol2tp_seq_next, 1629 .stop = pppol2tp_seq_stop, 1630 .show = pppol2tp_seq_show, 1631 }; 1632 #endif /* CONFIG_PROC_FS */ 1633 1634 /***************************************************************************** 1635 * Network namespace 1636 *****************************************************************************/ 1637 1638 static __net_init int pppol2tp_init_net(struct net *net) 1639 { 1640 struct proc_dir_entry *pde; 1641 int err = 0; 1642 1643 pde = proc_create_net("pppol2tp", 0444, net->proc_net, 1644 &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data)); 1645 if (!pde) { 1646 err = -ENOMEM; 1647 goto out; 1648 } 1649 1650 out: 1651 return err; 1652 } 1653 1654 static __net_exit void pppol2tp_exit_net(struct net *net) 1655 { 1656 remove_proc_entry("pppol2tp", net->proc_net); 1657 } 1658 1659 static struct pernet_operations pppol2tp_net_ops = { 1660 .init = pppol2tp_init_net, 1661 .exit = pppol2tp_exit_net, 1662 .id = &pppol2tp_net_id, 1663 }; 1664 1665 /***************************************************************************** 1666 * Init and cleanup 1667 *****************************************************************************/ 1668 1669 static const struct proto_ops pppol2tp_ops = { 1670 .family = AF_PPPOX, 1671 .owner = THIS_MODULE, 1672 .release = pppol2tp_release, 1673 .bind = sock_no_bind, 1674 .connect = pppol2tp_connect, 1675 .socketpair = sock_no_socketpair, 1676 .accept = sock_no_accept, 1677 .getname = pppol2tp_getname, 1678 .poll = datagram_poll, 1679 .listen = sock_no_listen, 1680 .shutdown = sock_no_shutdown, 1681 .setsockopt = pppol2tp_setsockopt, 1682 .getsockopt = pppol2tp_getsockopt, 1683 .sendmsg = pppol2tp_sendmsg, 1684 .recvmsg = pppol2tp_recvmsg, 1685 .mmap = sock_no_mmap, 1686 .ioctl = pppox_ioctl, 1687 #ifdef CONFIG_COMPAT 1688 .compat_ioctl = pppox_compat_ioctl, 1689 #endif 1690 }; 1691 1692 static const struct pppox_proto pppol2tp_proto = { 1693 .create = pppol2tp_create, 1694 .ioctl = pppol2tp_ioctl, 1695 .owner = THIS_MODULE, 1696 }; 1697 1698 #ifdef CONFIG_L2TP_V3 1699 1700 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = { 1701 .session_create = pppol2tp_session_create, 1702 .session_delete = l2tp_session_delete, 1703 }; 1704 1705 #endif /* CONFIG_L2TP_V3 */ 1706 1707 static int __init pppol2tp_init(void) 1708 { 1709 int err; 1710 1711 err = register_pernet_device(&pppol2tp_net_ops); 1712 if (err) 1713 goto out; 1714 1715 err = proto_register(&pppol2tp_sk_proto, 0); 1716 if (err) 1717 goto out_unregister_pppol2tp_pernet; 1718 1719 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto); 1720 if (err) 1721 goto out_unregister_pppol2tp_proto; 1722 1723 #ifdef CONFIG_L2TP_V3 1724 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops); 1725 if (err) 1726 goto out_unregister_pppox; 1727 #endif 1728 1729 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION); 1730 1731 out: 1732 return err; 1733 1734 #ifdef CONFIG_L2TP_V3 1735 out_unregister_pppox: 1736 unregister_pppox_proto(PX_PROTO_OL2TP); 1737 #endif 1738 out_unregister_pppol2tp_proto: 1739 proto_unregister(&pppol2tp_sk_proto); 1740 out_unregister_pppol2tp_pernet: 1741 unregister_pernet_device(&pppol2tp_net_ops); 1742 goto out; 1743 } 1744 1745 static void __exit pppol2tp_exit(void) 1746 { 1747 #ifdef CONFIG_L2TP_V3 1748 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP); 1749 #endif 1750 unregister_pppox_proto(PX_PROTO_OL2TP); 1751 proto_unregister(&pppol2tp_sk_proto); 1752 unregister_pernet_device(&pppol2tp_net_ops); 1753 } 1754 1755 module_init(pppol2tp_init); 1756 module_exit(pppol2tp_exit); 1757 1758 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1759 MODULE_DESCRIPTION("PPP over L2TP over UDP"); 1760 MODULE_LICENSE("GPL"); 1761 MODULE_VERSION(PPPOL2TP_DRV_VERSION); 1762 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP); 1763 MODULE_ALIAS_L2TP_PWTYPE(7); 1764