1 /***************************************************************************** 2 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets 3 * 4 * PPPoX --- Generic PPP encapsulation socket family 5 * PPPoL2TP --- PPP over L2TP (RFC 2661) 6 * 7 * Version: 2.0.0 8 * 9 * Authors: James Chapman (jchapman@katalix.com) 10 * 11 * Based on original work by Martijn van Oosterhout <kleptog@svana.org> 12 * 13 * License: 14 * This program is free software; you can redistribute it and/or 15 * modify it under the terms of the GNU General Public License 16 * as published by the Free Software Foundation; either version 17 * 2 of the License, or (at your option) any later version. 18 * 19 */ 20 21 /* This driver handles only L2TP data frames; control frames are handled by a 22 * userspace application. 23 * 24 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and 25 * attaches it to a bound UDP socket with local tunnel_id / session_id and 26 * peer tunnel_id / session_id set. Data can then be sent or received using 27 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket 28 * can be read or modified using ioctl() or [gs]etsockopt() calls. 29 * 30 * When a PPPoL2TP socket is connected with local and peer session_id values 31 * zero, the socket is treated as a special tunnel management socket. 32 * 33 * Here's example userspace code to create a socket for sending/receiving data 34 * over an L2TP session:- 35 * 36 * struct sockaddr_pppol2tp sax; 37 * int fd; 38 * int session_fd; 39 * 40 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); 41 * 42 * sax.sa_family = AF_PPPOX; 43 * sax.sa_protocol = PX_PROTO_OL2TP; 44 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket 45 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr; 46 * sax.pppol2tp.addr.sin_port = addr->sin_port; 47 * sax.pppol2tp.addr.sin_family = AF_INET; 48 * sax.pppol2tp.s_tunnel = tunnel_id; 49 * sax.pppol2tp.s_session = session_id; 50 * sax.pppol2tp.d_tunnel = peer_tunnel_id; 51 * sax.pppol2tp.d_session = peer_session_id; 52 * 53 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax)); 54 * 55 * A pppd plugin that allows PPP traffic to be carried over L2TP using 56 * this driver is available from the OpenL2TP project at 57 * http://openl2tp.sourceforge.net. 58 */ 59 60 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 61 62 #include <linux/module.h> 63 #include <linux/string.h> 64 #include <linux/list.h> 65 #include <linux/uaccess.h> 66 67 #include <linux/kernel.h> 68 #include <linux/spinlock.h> 69 #include <linux/kthread.h> 70 #include <linux/sched.h> 71 #include <linux/slab.h> 72 #include <linux/errno.h> 73 #include <linux/jiffies.h> 74 75 #include <linux/netdevice.h> 76 #include <linux/net.h> 77 #include <linux/inetdevice.h> 78 #include <linux/skbuff.h> 79 #include <linux/init.h> 80 #include <linux/ip.h> 81 #include <linux/udp.h> 82 #include <linux/if_pppox.h> 83 #include <linux/if_pppol2tp.h> 84 #include <net/sock.h> 85 #include <linux/ppp_channel.h> 86 #include <linux/ppp_defs.h> 87 #include <linux/ppp-ioctl.h> 88 #include <linux/file.h> 89 #include <linux/hash.h> 90 #include <linux/sort.h> 91 #include <linux/proc_fs.h> 92 #include <linux/l2tp.h> 93 #include <linux/nsproxy.h> 94 #include <net/net_namespace.h> 95 #include <net/netns/generic.h> 96 #include <net/dst.h> 97 #include <net/ip.h> 98 #include <net/udp.h> 99 #include <net/xfrm.h> 100 #include <net/inet_common.h> 101 102 #include <asm/byteorder.h> 103 #include <linux/atomic.h> 104 105 #include "l2tp_core.h" 106 107 #define PPPOL2TP_DRV_VERSION "V2.0" 108 109 /* Space for UDP, L2TP and PPP headers */ 110 #define PPPOL2TP_HEADER_OVERHEAD 40 111 112 /* Number of bytes to build transmit L2TP headers. 113 * Unfortunately the size is different depending on whether sequence numbers 114 * are enabled. 115 */ 116 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10 117 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6 118 119 /* Private data of each session. This data lives at the end of struct 120 * l2tp_session, referenced via session->priv[]. 121 */ 122 struct pppol2tp_session { 123 int owner; /* pid that opened the socket */ 124 125 struct mutex sk_lock; /* Protects .sk */ 126 struct sock __rcu *sk; /* Pointer to the session 127 * PPPoX socket */ 128 struct sock *__sk; /* Copy of .sk, for cleanup */ 129 struct rcu_head rcu; /* For asynchronous release */ 130 struct sock *tunnel_sock; /* Pointer to the tunnel UDP 131 * socket */ 132 int flags; /* accessed by PPPIOCGFLAGS. 133 * Unused. */ 134 }; 135 136 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb); 137 138 static const struct ppp_channel_ops pppol2tp_chan_ops = { 139 .start_xmit = pppol2tp_xmit, 140 }; 141 142 static const struct proto_ops pppol2tp_ops; 143 144 /* Retrieves the pppol2tp socket associated to a session. 145 * A reference is held on the returned socket, so this function must be paired 146 * with sock_put(). 147 */ 148 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) 149 { 150 struct pppol2tp_session *ps = l2tp_session_priv(session); 151 struct sock *sk; 152 153 rcu_read_lock(); 154 sk = rcu_dereference(ps->sk); 155 if (sk) 156 sock_hold(sk); 157 rcu_read_unlock(); 158 159 return sk; 160 } 161 162 /* Helpers to obtain tunnel/session contexts from sockets. 163 */ 164 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) 165 { 166 struct l2tp_session *session; 167 168 if (sk == NULL) 169 return NULL; 170 171 sock_hold(sk); 172 session = (struct l2tp_session *)(sk->sk_user_data); 173 if (session == NULL) { 174 sock_put(sk); 175 goto out; 176 } 177 178 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 179 180 out: 181 return session; 182 } 183 184 /***************************************************************************** 185 * Receive data handling 186 *****************************************************************************/ 187 188 static int pppol2tp_recv_payload_hook(struct sk_buff *skb) 189 { 190 /* Skip PPP header, if present. In testing, Microsoft L2TP clients 191 * don't send the PPP header (PPP header compression enabled), but 192 * other clients can include the header. So we cope with both cases 193 * here. The PPP header is always FF03 when using L2TP. 194 * 195 * Note that skb->data[] isn't dereferenced from a u16 ptr here since 196 * the field may be unaligned. 197 */ 198 if (!pskb_may_pull(skb, 2)) 199 return 1; 200 201 if ((skb->data[0] == PPP_ALLSTATIONS) && (skb->data[1] == PPP_UI)) 202 skb_pull(skb, 2); 203 204 return 0; 205 } 206 207 /* Receive message. This is the recvmsg for the PPPoL2TP socket. 208 */ 209 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, 210 size_t len, int flags) 211 { 212 int err; 213 struct sk_buff *skb; 214 struct sock *sk = sock->sk; 215 216 err = -EIO; 217 if (sk->sk_state & PPPOX_BOUND) 218 goto end; 219 220 err = 0; 221 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 222 flags & MSG_DONTWAIT, &err); 223 if (!skb) 224 goto end; 225 226 if (len > skb->len) 227 len = skb->len; 228 else if (len < skb->len) 229 msg->msg_flags |= MSG_TRUNC; 230 231 err = skb_copy_datagram_msg(skb, 0, msg, len); 232 if (likely(err == 0)) 233 err = len; 234 235 kfree_skb(skb); 236 end: 237 return err; 238 } 239 240 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) 241 { 242 struct pppol2tp_session *ps = l2tp_session_priv(session); 243 struct sock *sk = NULL; 244 245 /* If the socket is bound, send it in to PPP's input queue. Otherwise 246 * queue it on the session socket. 247 */ 248 rcu_read_lock(); 249 sk = rcu_dereference(ps->sk); 250 if (sk == NULL) 251 goto no_sock; 252 253 if (sk->sk_state & PPPOX_BOUND) { 254 struct pppox_sock *po; 255 256 l2tp_dbg(session, L2TP_MSG_DATA, 257 "%s: recv %d byte data frame, passing to ppp\n", 258 session->name, data_len); 259 260 po = pppox_sk(sk); 261 ppp_input(&po->chan, skb); 262 } else { 263 l2tp_dbg(session, L2TP_MSG_DATA, 264 "%s: recv %d byte data frame, passing to L2TP socket\n", 265 session->name, data_len); 266 267 if (sock_queue_rcv_skb(sk, skb) < 0) { 268 atomic_long_inc(&session->stats.rx_errors); 269 kfree_skb(skb); 270 } 271 } 272 rcu_read_unlock(); 273 274 return; 275 276 no_sock: 277 rcu_read_unlock(); 278 l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name); 279 kfree_skb(skb); 280 } 281 282 /************************************************************************ 283 * Transmit handling 284 ***********************************************************************/ 285 286 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here 287 * when a user application does a sendmsg() on the session socket. L2TP and 288 * PPP headers must be inserted into the user's data. 289 */ 290 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m, 291 size_t total_len) 292 { 293 struct sock *sk = sock->sk; 294 struct sk_buff *skb; 295 int error; 296 struct l2tp_session *session; 297 struct l2tp_tunnel *tunnel; 298 struct pppol2tp_session *ps; 299 int uhlen; 300 301 error = -ENOTCONN; 302 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 303 goto error; 304 305 /* Get session and tunnel contexts */ 306 error = -EBADF; 307 session = pppol2tp_sock_to_session(sk); 308 if (session == NULL) 309 goto error; 310 311 ps = l2tp_session_priv(session); 312 tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock); 313 if (tunnel == NULL) 314 goto error_put_sess; 315 316 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 317 318 /* Allocate a socket buffer */ 319 error = -ENOMEM; 320 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 321 uhlen + session->hdr_len + 322 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 323 0, GFP_KERNEL); 324 if (!skb) 325 goto error_put_sess_tun; 326 327 /* Reserve space for headers. */ 328 skb_reserve(skb, NET_SKB_PAD); 329 skb_reset_network_header(skb); 330 skb_reserve(skb, sizeof(struct iphdr)); 331 skb_reset_transport_header(skb); 332 skb_reserve(skb, uhlen); 333 334 /* Add PPP header */ 335 skb->data[0] = PPP_ALLSTATIONS; 336 skb->data[1] = PPP_UI; 337 skb_put(skb, 2); 338 339 /* Copy user data into skb */ 340 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len); 341 if (error < 0) { 342 kfree_skb(skb); 343 goto error_put_sess_tun; 344 } 345 346 local_bh_disable(); 347 l2tp_xmit_skb(session, skb, session->hdr_len); 348 local_bh_enable(); 349 350 sock_put(ps->tunnel_sock); 351 sock_put(sk); 352 353 return total_len; 354 355 error_put_sess_tun: 356 sock_put(ps->tunnel_sock); 357 error_put_sess: 358 sock_put(sk); 359 error: 360 return error; 361 } 362 363 /* Transmit function called by generic PPP driver. Sends PPP frame 364 * over PPPoL2TP socket. 365 * 366 * This is almost the same as pppol2tp_sendmsg(), but rather than 367 * being called with a msghdr from userspace, it is called with a skb 368 * from the kernel. 369 * 370 * The supplied skb from ppp doesn't have enough headroom for the 371 * insertion of L2TP, UDP and IP headers so we need to allocate more 372 * headroom in the skb. This will create a cloned skb. But we must be 373 * careful in the error case because the caller will expect to free 374 * the skb it supplied, not our cloned skb. So we take care to always 375 * leave the original skb unfreed if we return an error. 376 */ 377 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) 378 { 379 struct sock *sk = (struct sock *) chan->private; 380 struct sock *sk_tun; 381 struct l2tp_session *session; 382 struct l2tp_tunnel *tunnel; 383 struct pppol2tp_session *ps; 384 int uhlen, headroom; 385 386 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 387 goto abort; 388 389 /* Get session and tunnel contexts from the socket */ 390 session = pppol2tp_sock_to_session(sk); 391 if (session == NULL) 392 goto abort; 393 394 ps = l2tp_session_priv(session); 395 sk_tun = ps->tunnel_sock; 396 if (sk_tun == NULL) 397 goto abort_put_sess; 398 tunnel = l2tp_sock_to_tunnel(sk_tun); 399 if (tunnel == NULL) 400 goto abort_put_sess; 401 402 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 403 headroom = NET_SKB_PAD + 404 sizeof(struct iphdr) + /* IP header */ 405 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */ 406 session->hdr_len + /* L2TP header */ 407 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 408 if (skb_cow_head(skb, headroom)) 409 goto abort_put_sess_tun; 410 411 /* Setup PPP header */ 412 __skb_push(skb, 2); 413 skb->data[0] = PPP_ALLSTATIONS; 414 skb->data[1] = PPP_UI; 415 416 local_bh_disable(); 417 l2tp_xmit_skb(session, skb, session->hdr_len); 418 local_bh_enable(); 419 420 sock_put(sk_tun); 421 sock_put(sk); 422 return 1; 423 424 abort_put_sess_tun: 425 sock_put(sk_tun); 426 abort_put_sess: 427 sock_put(sk); 428 abort: 429 /* Free the original skb */ 430 kfree_skb(skb); 431 return 1; 432 } 433 434 /***************************************************************************** 435 * Session (and tunnel control) socket create/destroy. 436 *****************************************************************************/ 437 438 /* Called by l2tp_core when a session socket is being closed. 439 */ 440 static void pppol2tp_session_close(struct l2tp_session *session) 441 { 442 struct sock *sk; 443 444 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 445 446 sk = pppol2tp_session_get_sock(session); 447 if (sk) { 448 if (sk->sk_socket) 449 inet_shutdown(sk->sk_socket, SEND_SHUTDOWN); 450 sock_put(sk); 451 } 452 } 453 454 /* Really kill the session socket. (Called from sock_put() if 455 * refcnt == 0.) 456 */ 457 static void pppol2tp_session_destruct(struct sock *sk) 458 { 459 struct l2tp_session *session = sk->sk_user_data; 460 461 skb_queue_purge(&sk->sk_receive_queue); 462 skb_queue_purge(&sk->sk_write_queue); 463 464 if (session) { 465 sk->sk_user_data = NULL; 466 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 467 l2tp_session_dec_refcount(session); 468 } 469 } 470 471 static void pppol2tp_put_sk(struct rcu_head *head) 472 { 473 struct pppol2tp_session *ps; 474 475 ps = container_of(head, typeof(*ps), rcu); 476 sock_put(ps->__sk); 477 } 478 479 /* Called when the PPPoX socket (session) is closed. 480 */ 481 static int pppol2tp_release(struct socket *sock) 482 { 483 struct sock *sk = sock->sk; 484 struct l2tp_session *session; 485 int error; 486 487 if (!sk) 488 return 0; 489 490 error = -EBADF; 491 lock_sock(sk); 492 if (sock_flag(sk, SOCK_DEAD) != 0) 493 goto error; 494 495 pppox_unbind_sock(sk); 496 497 /* Signal the death of the socket. */ 498 sk->sk_state = PPPOX_DEAD; 499 sock_orphan(sk); 500 sock->sk = NULL; 501 502 session = pppol2tp_sock_to_session(sk); 503 504 if (session != NULL) { 505 struct pppol2tp_session *ps; 506 507 l2tp_session_delete(session); 508 509 ps = l2tp_session_priv(session); 510 mutex_lock(&ps->sk_lock); 511 ps->__sk = rcu_dereference_protected(ps->sk, 512 lockdep_is_held(&ps->sk_lock)); 513 RCU_INIT_POINTER(ps->sk, NULL); 514 mutex_unlock(&ps->sk_lock); 515 call_rcu(&ps->rcu, pppol2tp_put_sk); 516 517 /* Rely on the sock_put() call at the end of the function for 518 * dropping the reference held by pppol2tp_sock_to_session(). 519 * The last reference will be dropped by pppol2tp_put_sk(). 520 */ 521 } 522 release_sock(sk); 523 524 /* This will delete the session context via 525 * pppol2tp_session_destruct() if the socket's refcnt drops to 526 * zero. 527 */ 528 sock_put(sk); 529 530 return 0; 531 532 error: 533 release_sock(sk); 534 return error; 535 } 536 537 static struct proto pppol2tp_sk_proto = { 538 .name = "PPPOL2TP", 539 .owner = THIS_MODULE, 540 .obj_size = sizeof(struct pppox_sock), 541 }; 542 543 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb) 544 { 545 int rc; 546 547 rc = l2tp_udp_encap_recv(sk, skb); 548 if (rc) 549 kfree_skb(skb); 550 551 return NET_RX_SUCCESS; 552 } 553 554 /* socket() handler. Initialize a new struct sock. 555 */ 556 static int pppol2tp_create(struct net *net, struct socket *sock, int kern) 557 { 558 int error = -ENOMEM; 559 struct sock *sk; 560 561 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern); 562 if (!sk) 563 goto out; 564 565 sock_init_data(sock, sk); 566 567 sock->state = SS_UNCONNECTED; 568 sock->ops = &pppol2tp_ops; 569 570 sk->sk_backlog_rcv = pppol2tp_backlog_recv; 571 sk->sk_protocol = PX_PROTO_OL2TP; 572 sk->sk_family = PF_PPPOX; 573 sk->sk_state = PPPOX_NONE; 574 sk->sk_type = SOCK_STREAM; 575 sk->sk_destruct = pppol2tp_session_destruct; 576 577 error = 0; 578 579 out: 580 return error; 581 } 582 583 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 584 static void pppol2tp_show(struct seq_file *m, void *arg) 585 { 586 struct l2tp_session *session = arg; 587 struct sock *sk; 588 589 sk = pppol2tp_session_get_sock(session); 590 if (sk) { 591 struct pppox_sock *po = pppox_sk(sk); 592 593 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 594 sock_put(sk); 595 } 596 } 597 #endif 598 599 static void pppol2tp_session_init(struct l2tp_session *session) 600 { 601 struct pppol2tp_session *ps; 602 struct dst_entry *dst; 603 604 session->recv_skb = pppol2tp_recv; 605 session->session_close = pppol2tp_session_close; 606 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 607 session->show = pppol2tp_show; 608 #endif 609 610 ps = l2tp_session_priv(session); 611 mutex_init(&ps->sk_lock); 612 ps->tunnel_sock = session->tunnel->sock; 613 ps->owner = current->pid; 614 615 /* If PMTU discovery was enabled, use the MTU that was discovered */ 616 dst = sk_dst_get(session->tunnel->sock); 617 if (dst) { 618 u32 pmtu = dst_mtu(dst); 619 620 if (pmtu) { 621 session->mtu = pmtu - PPPOL2TP_HEADER_OVERHEAD; 622 session->mru = pmtu - PPPOL2TP_HEADER_OVERHEAD; 623 } 624 dst_release(dst); 625 } 626 } 627 628 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket 629 */ 630 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 631 int sockaddr_len, int flags) 632 { 633 struct sock *sk = sock->sk; 634 struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr; 635 struct pppox_sock *po = pppox_sk(sk); 636 struct l2tp_session *session = NULL; 637 struct l2tp_tunnel *tunnel; 638 struct pppol2tp_session *ps; 639 struct l2tp_session_cfg cfg = { 0, }; 640 int error = 0; 641 u32 tunnel_id, peer_tunnel_id; 642 u32 session_id, peer_session_id; 643 bool drop_refcnt = false; 644 int ver = 2; 645 int fd; 646 647 lock_sock(sk); 648 649 error = -EINVAL; 650 if (sp->sa_protocol != PX_PROTO_OL2TP) 651 goto end; 652 653 /* Check for already bound sockets */ 654 error = -EBUSY; 655 if (sk->sk_state & PPPOX_CONNECTED) 656 goto end; 657 658 /* We don't supporting rebinding anyway */ 659 error = -EALREADY; 660 if (sk->sk_user_data) 661 goto end; /* socket is already attached */ 662 663 /* Get params from socket address. Handle L2TPv2 and L2TPv3. 664 * This is nasty because there are different sockaddr_pppol2tp 665 * structs for L2TPv2, L2TPv3, over IPv4 and IPv6. We use 666 * the sockaddr size to determine which structure the caller 667 * is using. 668 */ 669 peer_tunnel_id = 0; 670 if (sockaddr_len == sizeof(struct sockaddr_pppol2tp)) { 671 fd = sp->pppol2tp.fd; 672 tunnel_id = sp->pppol2tp.s_tunnel; 673 peer_tunnel_id = sp->pppol2tp.d_tunnel; 674 session_id = sp->pppol2tp.s_session; 675 peer_session_id = sp->pppol2tp.d_session; 676 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3)) { 677 struct sockaddr_pppol2tpv3 *sp3 = 678 (struct sockaddr_pppol2tpv3 *) sp; 679 ver = 3; 680 fd = sp3->pppol2tp.fd; 681 tunnel_id = sp3->pppol2tp.s_tunnel; 682 peer_tunnel_id = sp3->pppol2tp.d_tunnel; 683 session_id = sp3->pppol2tp.s_session; 684 peer_session_id = sp3->pppol2tp.d_session; 685 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpin6)) { 686 struct sockaddr_pppol2tpin6 *sp6 = 687 (struct sockaddr_pppol2tpin6 *) sp; 688 fd = sp6->pppol2tp.fd; 689 tunnel_id = sp6->pppol2tp.s_tunnel; 690 peer_tunnel_id = sp6->pppol2tp.d_tunnel; 691 session_id = sp6->pppol2tp.s_session; 692 peer_session_id = sp6->pppol2tp.d_session; 693 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3in6)) { 694 struct sockaddr_pppol2tpv3in6 *sp6 = 695 (struct sockaddr_pppol2tpv3in6 *) sp; 696 ver = 3; 697 fd = sp6->pppol2tp.fd; 698 tunnel_id = sp6->pppol2tp.s_tunnel; 699 peer_tunnel_id = sp6->pppol2tp.d_tunnel; 700 session_id = sp6->pppol2tp.s_session; 701 peer_session_id = sp6->pppol2tp.d_session; 702 } else { 703 error = -EINVAL; 704 goto end; /* bad socket address */ 705 } 706 707 /* Don't bind if tunnel_id is 0 */ 708 error = -EINVAL; 709 if (tunnel_id == 0) 710 goto end; 711 712 tunnel = l2tp_tunnel_find(sock_net(sk), tunnel_id); 713 714 /* Special case: create tunnel context if session_id and 715 * peer_session_id is 0. Otherwise look up tunnel using supplied 716 * tunnel id. 717 */ 718 if ((session_id == 0) && (peer_session_id == 0)) { 719 if (tunnel == NULL) { 720 struct l2tp_tunnel_cfg tcfg = { 721 .encap = L2TP_ENCAPTYPE_UDP, 722 .debug = 0, 723 }; 724 error = l2tp_tunnel_create(sock_net(sk), fd, ver, tunnel_id, peer_tunnel_id, &tcfg, &tunnel); 725 if (error < 0) 726 goto end; 727 } 728 } else { 729 /* Error if we can't find the tunnel */ 730 error = -ENOENT; 731 if (tunnel == NULL) 732 goto end; 733 734 /* Error if socket is not prepped */ 735 if (tunnel->sock == NULL) 736 goto end; 737 } 738 739 if (tunnel->recv_payload_hook == NULL) 740 tunnel->recv_payload_hook = pppol2tp_recv_payload_hook; 741 742 if (tunnel->peer_tunnel_id == 0) 743 tunnel->peer_tunnel_id = peer_tunnel_id; 744 745 session = l2tp_session_get(sock_net(sk), tunnel, session_id, false); 746 if (session) { 747 drop_refcnt = true; 748 ps = l2tp_session_priv(session); 749 750 /* Using a pre-existing session is fine as long as it hasn't 751 * been connected yet. 752 */ 753 mutex_lock(&ps->sk_lock); 754 if (rcu_dereference_protected(ps->sk, 755 lockdep_is_held(&ps->sk_lock))) { 756 mutex_unlock(&ps->sk_lock); 757 error = -EEXIST; 758 goto end; 759 } 760 761 /* consistency checks */ 762 if (ps->tunnel_sock != tunnel->sock) { 763 mutex_unlock(&ps->sk_lock); 764 error = -EEXIST; 765 goto end; 766 } 767 } else { 768 /* Default MTU must allow space for UDP/L2TP/PPP headers */ 769 cfg.mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 770 cfg.mru = cfg.mtu; 771 772 session = l2tp_session_create(sizeof(struct pppol2tp_session), 773 tunnel, session_id, 774 peer_session_id, &cfg); 775 if (IS_ERR(session)) { 776 error = PTR_ERR(session); 777 goto end; 778 } 779 780 pppol2tp_session_init(session); 781 ps = l2tp_session_priv(session); 782 l2tp_session_inc_refcount(session); 783 784 mutex_lock(&ps->sk_lock); 785 error = l2tp_session_register(session, tunnel); 786 if (error < 0) { 787 mutex_unlock(&ps->sk_lock); 788 kfree(session); 789 goto end; 790 } 791 drop_refcnt = true; 792 } 793 794 /* Special case: if source & dest session_id == 0x0000, this 795 * socket is being created to manage the tunnel. Just set up 796 * the internal context for use by ioctl() and sockopt() 797 * handlers. 798 */ 799 if ((session->session_id == 0) && 800 (session->peer_session_id == 0)) { 801 error = 0; 802 goto out_no_ppp; 803 } 804 805 /* The only header we need to worry about is the L2TP 806 * header. This size is different depending on whether 807 * sequence numbers are enabled for the data channel. 808 */ 809 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 810 811 po->chan.private = sk; 812 po->chan.ops = &pppol2tp_chan_ops; 813 po->chan.mtu = session->mtu; 814 815 error = ppp_register_net_channel(sock_net(sk), &po->chan); 816 if (error) { 817 mutex_unlock(&ps->sk_lock); 818 goto end; 819 } 820 821 out_no_ppp: 822 /* This is how we get the session context from the socket. */ 823 sk->sk_user_data = session; 824 rcu_assign_pointer(ps->sk, sk); 825 mutex_unlock(&ps->sk_lock); 826 827 /* Keep the reference we've grabbed on the session: sk doesn't expect 828 * the session to disappear. pppol2tp_session_destruct() is responsible 829 * for dropping it. 830 */ 831 drop_refcnt = false; 832 833 sk->sk_state = PPPOX_CONNECTED; 834 l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n", 835 session->name); 836 837 end: 838 if (drop_refcnt) 839 l2tp_session_dec_refcount(session); 840 release_sock(sk); 841 842 return error; 843 } 844 845 #ifdef CONFIG_L2TP_V3 846 847 /* Called when creating sessions via the netlink interface. */ 848 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, 849 u32 session_id, u32 peer_session_id, 850 struct l2tp_session_cfg *cfg) 851 { 852 int error; 853 struct l2tp_session *session; 854 855 /* Error if tunnel socket is not prepped */ 856 if (!tunnel->sock) { 857 error = -ENOENT; 858 goto err; 859 } 860 861 /* Default MTU values. */ 862 if (cfg->mtu == 0) 863 cfg->mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 864 if (cfg->mru == 0) 865 cfg->mru = cfg->mtu; 866 867 /* Allocate and initialize a new session context. */ 868 session = l2tp_session_create(sizeof(struct pppol2tp_session), 869 tunnel, session_id, 870 peer_session_id, cfg); 871 if (IS_ERR(session)) { 872 error = PTR_ERR(session); 873 goto err; 874 } 875 876 pppol2tp_session_init(session); 877 878 error = l2tp_session_register(session, tunnel); 879 if (error < 0) 880 goto err_sess; 881 882 return 0; 883 884 err_sess: 885 kfree(session); 886 err: 887 return error; 888 } 889 890 #endif /* CONFIG_L2TP_V3 */ 891 892 /* getname() support. 893 */ 894 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr, 895 int *usockaddr_len, int peer) 896 { 897 int len = 0; 898 int error = 0; 899 struct l2tp_session *session; 900 struct l2tp_tunnel *tunnel; 901 struct sock *sk = sock->sk; 902 struct inet_sock *inet; 903 struct pppol2tp_session *pls; 904 905 error = -ENOTCONN; 906 if (sk == NULL) 907 goto end; 908 if (!(sk->sk_state & PPPOX_CONNECTED)) 909 goto end; 910 911 error = -EBADF; 912 session = pppol2tp_sock_to_session(sk); 913 if (session == NULL) 914 goto end; 915 916 pls = l2tp_session_priv(session); 917 tunnel = l2tp_sock_to_tunnel(pls->tunnel_sock); 918 if (tunnel == NULL) 919 goto end_put_sess; 920 921 inet = inet_sk(tunnel->sock); 922 if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) { 923 struct sockaddr_pppol2tp sp; 924 len = sizeof(sp); 925 memset(&sp, 0, len); 926 sp.sa_family = AF_PPPOX; 927 sp.sa_protocol = PX_PROTO_OL2TP; 928 sp.pppol2tp.fd = tunnel->fd; 929 sp.pppol2tp.pid = pls->owner; 930 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 931 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 932 sp.pppol2tp.s_session = session->session_id; 933 sp.pppol2tp.d_session = session->peer_session_id; 934 sp.pppol2tp.addr.sin_family = AF_INET; 935 sp.pppol2tp.addr.sin_port = inet->inet_dport; 936 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 937 memcpy(uaddr, &sp, len); 938 #if IS_ENABLED(CONFIG_IPV6) 939 } else if ((tunnel->version == 2) && 940 (tunnel->sock->sk_family == AF_INET6)) { 941 struct sockaddr_pppol2tpin6 sp; 942 943 len = sizeof(sp); 944 memset(&sp, 0, len); 945 sp.sa_family = AF_PPPOX; 946 sp.sa_protocol = PX_PROTO_OL2TP; 947 sp.pppol2tp.fd = tunnel->fd; 948 sp.pppol2tp.pid = pls->owner; 949 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 950 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 951 sp.pppol2tp.s_session = session->session_id; 952 sp.pppol2tp.d_session = session->peer_session_id; 953 sp.pppol2tp.addr.sin6_family = AF_INET6; 954 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 955 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 956 sizeof(tunnel->sock->sk_v6_daddr)); 957 memcpy(uaddr, &sp, len); 958 } else if ((tunnel->version == 3) && 959 (tunnel->sock->sk_family == AF_INET6)) { 960 struct sockaddr_pppol2tpv3in6 sp; 961 962 len = sizeof(sp); 963 memset(&sp, 0, len); 964 sp.sa_family = AF_PPPOX; 965 sp.sa_protocol = PX_PROTO_OL2TP; 966 sp.pppol2tp.fd = tunnel->fd; 967 sp.pppol2tp.pid = pls->owner; 968 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 969 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 970 sp.pppol2tp.s_session = session->session_id; 971 sp.pppol2tp.d_session = session->peer_session_id; 972 sp.pppol2tp.addr.sin6_family = AF_INET6; 973 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 974 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 975 sizeof(tunnel->sock->sk_v6_daddr)); 976 memcpy(uaddr, &sp, len); 977 #endif 978 } else if (tunnel->version == 3) { 979 struct sockaddr_pppol2tpv3 sp; 980 len = sizeof(sp); 981 memset(&sp, 0, len); 982 sp.sa_family = AF_PPPOX; 983 sp.sa_protocol = PX_PROTO_OL2TP; 984 sp.pppol2tp.fd = tunnel->fd; 985 sp.pppol2tp.pid = pls->owner; 986 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 987 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 988 sp.pppol2tp.s_session = session->session_id; 989 sp.pppol2tp.d_session = session->peer_session_id; 990 sp.pppol2tp.addr.sin_family = AF_INET; 991 sp.pppol2tp.addr.sin_port = inet->inet_dport; 992 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 993 memcpy(uaddr, &sp, len); 994 } 995 996 *usockaddr_len = len; 997 error = 0; 998 999 sock_put(pls->tunnel_sock); 1000 end_put_sess: 1001 sock_put(sk); 1002 end: 1003 return error; 1004 } 1005 1006 /**************************************************************************** 1007 * ioctl() handlers. 1008 * 1009 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1010 * sockets. However, in order to control kernel tunnel features, we allow 1011 * userspace to create a special "tunnel" PPPoX socket which is used for 1012 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow 1013 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl() 1014 * calls. 1015 ****************************************************************************/ 1016 1017 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest, 1018 struct l2tp_stats *stats) 1019 { 1020 dest->tx_packets = atomic_long_read(&stats->tx_packets); 1021 dest->tx_bytes = atomic_long_read(&stats->tx_bytes); 1022 dest->tx_errors = atomic_long_read(&stats->tx_errors); 1023 dest->rx_packets = atomic_long_read(&stats->rx_packets); 1024 dest->rx_bytes = atomic_long_read(&stats->rx_bytes); 1025 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards); 1026 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets); 1027 dest->rx_errors = atomic_long_read(&stats->rx_errors); 1028 } 1029 1030 /* Session ioctl helper. 1031 */ 1032 static int pppol2tp_session_ioctl(struct l2tp_session *session, 1033 unsigned int cmd, unsigned long arg) 1034 { 1035 struct ifreq ifr; 1036 int err = 0; 1037 struct sock *sk; 1038 int val = (int) arg; 1039 struct pppol2tp_session *ps = l2tp_session_priv(session); 1040 struct l2tp_tunnel *tunnel = session->tunnel; 1041 struct pppol2tp_ioc_stats stats; 1042 1043 l2tp_dbg(session, L2TP_MSG_CONTROL, 1044 "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n", 1045 session->name, cmd, arg); 1046 1047 sk = pppol2tp_session_get_sock(session); 1048 if (!sk) 1049 return -EBADR; 1050 1051 switch (cmd) { 1052 case SIOCGIFMTU: 1053 err = -ENXIO; 1054 if (!(sk->sk_state & PPPOX_CONNECTED)) 1055 break; 1056 1057 err = -EFAULT; 1058 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1059 break; 1060 ifr.ifr_mtu = session->mtu; 1061 if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq))) 1062 break; 1063 1064 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mtu=%d\n", 1065 session->name, session->mtu); 1066 err = 0; 1067 break; 1068 1069 case SIOCSIFMTU: 1070 err = -ENXIO; 1071 if (!(sk->sk_state & PPPOX_CONNECTED)) 1072 break; 1073 1074 err = -EFAULT; 1075 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1076 break; 1077 1078 session->mtu = ifr.ifr_mtu; 1079 1080 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mtu=%d\n", 1081 session->name, session->mtu); 1082 err = 0; 1083 break; 1084 1085 case PPPIOCGMRU: 1086 err = -ENXIO; 1087 if (!(sk->sk_state & PPPOX_CONNECTED)) 1088 break; 1089 1090 err = -EFAULT; 1091 if (put_user(session->mru, (int __user *) arg)) 1092 break; 1093 1094 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mru=%d\n", 1095 session->name, session->mru); 1096 err = 0; 1097 break; 1098 1099 case PPPIOCSMRU: 1100 err = -ENXIO; 1101 if (!(sk->sk_state & PPPOX_CONNECTED)) 1102 break; 1103 1104 err = -EFAULT; 1105 if (get_user(val, (int __user *) arg)) 1106 break; 1107 1108 session->mru = val; 1109 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mru=%d\n", 1110 session->name, session->mru); 1111 err = 0; 1112 break; 1113 1114 case PPPIOCGFLAGS: 1115 err = -EFAULT; 1116 if (put_user(ps->flags, (int __user *) arg)) 1117 break; 1118 1119 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get flags=%d\n", 1120 session->name, ps->flags); 1121 err = 0; 1122 break; 1123 1124 case PPPIOCSFLAGS: 1125 err = -EFAULT; 1126 if (get_user(val, (int __user *) arg)) 1127 break; 1128 ps->flags = val; 1129 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set flags=%d\n", 1130 session->name, ps->flags); 1131 err = 0; 1132 break; 1133 1134 case PPPIOCGL2TPSTATS: 1135 err = -ENXIO; 1136 if (!(sk->sk_state & PPPOX_CONNECTED)) 1137 break; 1138 1139 memset(&stats, 0, sizeof(stats)); 1140 stats.tunnel_id = tunnel->tunnel_id; 1141 stats.session_id = session->session_id; 1142 pppol2tp_copy_stats(&stats, &session->stats); 1143 if (copy_to_user((void __user *) arg, &stats, 1144 sizeof(stats))) 1145 break; 1146 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1147 session->name); 1148 err = 0; 1149 break; 1150 1151 default: 1152 err = -ENOSYS; 1153 break; 1154 } 1155 1156 sock_put(sk); 1157 1158 return err; 1159 } 1160 1161 /* Tunnel ioctl helper. 1162 * 1163 * Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data 1164 * specifies a session_id, the session ioctl handler is called. This allows an 1165 * application to retrieve session stats via a tunnel socket. 1166 */ 1167 static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel, 1168 unsigned int cmd, unsigned long arg) 1169 { 1170 int err = 0; 1171 struct sock *sk; 1172 struct pppol2tp_ioc_stats stats; 1173 1174 l2tp_dbg(tunnel, L2TP_MSG_CONTROL, 1175 "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n", 1176 tunnel->name, cmd, arg); 1177 1178 sk = tunnel->sock; 1179 sock_hold(sk); 1180 1181 switch (cmd) { 1182 case PPPIOCGL2TPSTATS: 1183 err = -ENXIO; 1184 if (!(sk->sk_state & PPPOX_CONNECTED)) 1185 break; 1186 1187 if (copy_from_user(&stats, (void __user *) arg, 1188 sizeof(stats))) { 1189 err = -EFAULT; 1190 break; 1191 } 1192 if (stats.session_id != 0) { 1193 /* resend to session ioctl handler */ 1194 struct l2tp_session *session = 1195 l2tp_session_get(sock_net(sk), tunnel, 1196 stats.session_id, true); 1197 1198 if (session) { 1199 err = pppol2tp_session_ioctl(session, cmd, 1200 arg); 1201 if (session->deref) 1202 session->deref(session); 1203 l2tp_session_dec_refcount(session); 1204 } else { 1205 err = -EBADR; 1206 } 1207 break; 1208 } 1209 #ifdef CONFIG_XFRM 1210 stats.using_ipsec = (sk->sk_policy[0] || sk->sk_policy[1]) ? 1 : 0; 1211 #endif 1212 pppol2tp_copy_stats(&stats, &tunnel->stats); 1213 if (copy_to_user((void __user *) arg, &stats, sizeof(stats))) { 1214 err = -EFAULT; 1215 break; 1216 } 1217 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1218 tunnel->name); 1219 err = 0; 1220 break; 1221 1222 default: 1223 err = -ENOSYS; 1224 break; 1225 } 1226 1227 sock_put(sk); 1228 1229 return err; 1230 } 1231 1232 /* Main ioctl() handler. 1233 * Dispatch to tunnel or session helpers depending on the socket. 1234 */ 1235 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, 1236 unsigned long arg) 1237 { 1238 struct sock *sk = sock->sk; 1239 struct l2tp_session *session; 1240 struct l2tp_tunnel *tunnel; 1241 struct pppol2tp_session *ps; 1242 int err; 1243 1244 if (!sk) 1245 return 0; 1246 1247 err = -EBADF; 1248 if (sock_flag(sk, SOCK_DEAD) != 0) 1249 goto end; 1250 1251 err = -ENOTCONN; 1252 if ((sk->sk_user_data == NULL) || 1253 (!(sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)))) 1254 goto end; 1255 1256 /* Get session context from the socket */ 1257 err = -EBADF; 1258 session = pppol2tp_sock_to_session(sk); 1259 if (session == NULL) 1260 goto end; 1261 1262 /* Special case: if session's session_id is zero, treat ioctl as a 1263 * tunnel ioctl 1264 */ 1265 ps = l2tp_session_priv(session); 1266 if ((session->session_id == 0) && 1267 (session->peer_session_id == 0)) { 1268 err = -EBADF; 1269 tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock); 1270 if (tunnel == NULL) 1271 goto end_put_sess; 1272 1273 err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg); 1274 sock_put(ps->tunnel_sock); 1275 goto end_put_sess; 1276 } 1277 1278 err = pppol2tp_session_ioctl(session, cmd, arg); 1279 1280 end_put_sess: 1281 sock_put(sk); 1282 end: 1283 return err; 1284 } 1285 1286 /***************************************************************************** 1287 * setsockopt() / getsockopt() support. 1288 * 1289 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1290 * sockets. In order to control kernel tunnel features, we allow userspace to 1291 * create a special "tunnel" PPPoX socket which is used for control only. 1292 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user 1293 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls. 1294 *****************************************************************************/ 1295 1296 /* Tunnel setsockopt() helper. 1297 */ 1298 static int pppol2tp_tunnel_setsockopt(struct sock *sk, 1299 struct l2tp_tunnel *tunnel, 1300 int optname, int val) 1301 { 1302 int err = 0; 1303 1304 switch (optname) { 1305 case PPPOL2TP_SO_DEBUG: 1306 tunnel->debug = val; 1307 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1308 tunnel->name, tunnel->debug); 1309 break; 1310 1311 default: 1312 err = -ENOPROTOOPT; 1313 break; 1314 } 1315 1316 return err; 1317 } 1318 1319 /* Session setsockopt helper. 1320 */ 1321 static int pppol2tp_session_setsockopt(struct sock *sk, 1322 struct l2tp_session *session, 1323 int optname, int val) 1324 { 1325 int err = 0; 1326 1327 switch (optname) { 1328 case PPPOL2TP_SO_RECVSEQ: 1329 if ((val != 0) && (val != 1)) { 1330 err = -EINVAL; 1331 break; 1332 } 1333 session->recv_seq = !!val; 1334 l2tp_info(session, L2TP_MSG_CONTROL, 1335 "%s: set recv_seq=%d\n", 1336 session->name, session->recv_seq); 1337 break; 1338 1339 case PPPOL2TP_SO_SENDSEQ: 1340 if ((val != 0) && (val != 1)) { 1341 err = -EINVAL; 1342 break; 1343 } 1344 session->send_seq = !!val; 1345 { 1346 struct pppox_sock *po = pppox_sk(sk); 1347 1348 po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ : 1349 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 1350 } 1351 l2tp_session_set_header_len(session, session->tunnel->version); 1352 l2tp_info(session, L2TP_MSG_CONTROL, 1353 "%s: set send_seq=%d\n", 1354 session->name, session->send_seq); 1355 break; 1356 1357 case PPPOL2TP_SO_LNSMODE: 1358 if ((val != 0) && (val != 1)) { 1359 err = -EINVAL; 1360 break; 1361 } 1362 session->lns_mode = !!val; 1363 l2tp_info(session, L2TP_MSG_CONTROL, 1364 "%s: set lns_mode=%d\n", 1365 session->name, session->lns_mode); 1366 break; 1367 1368 case PPPOL2TP_SO_DEBUG: 1369 session->debug = val; 1370 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1371 session->name, session->debug); 1372 break; 1373 1374 case PPPOL2TP_SO_REORDERTO: 1375 session->reorder_timeout = msecs_to_jiffies(val); 1376 l2tp_info(session, L2TP_MSG_CONTROL, 1377 "%s: set reorder_timeout=%d\n", 1378 session->name, session->reorder_timeout); 1379 break; 1380 1381 default: 1382 err = -ENOPROTOOPT; 1383 break; 1384 } 1385 1386 return err; 1387 } 1388 1389 /* Main setsockopt() entry point. 1390 * Does API checks, then calls either the tunnel or session setsockopt 1391 * handler, according to whether the PPPoL2TP socket is a for a regular 1392 * session or the special tunnel type. 1393 */ 1394 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, 1395 char __user *optval, unsigned int optlen) 1396 { 1397 struct sock *sk = sock->sk; 1398 struct l2tp_session *session; 1399 struct l2tp_tunnel *tunnel; 1400 struct pppol2tp_session *ps; 1401 int val; 1402 int err; 1403 1404 if (level != SOL_PPPOL2TP) 1405 return -EINVAL; 1406 1407 if (optlen < sizeof(int)) 1408 return -EINVAL; 1409 1410 if (get_user(val, (int __user *)optval)) 1411 return -EFAULT; 1412 1413 err = -ENOTCONN; 1414 if (sk->sk_user_data == NULL) 1415 goto end; 1416 1417 /* Get session context from the socket */ 1418 err = -EBADF; 1419 session = pppol2tp_sock_to_session(sk); 1420 if (session == NULL) 1421 goto end; 1422 1423 /* Special case: if session_id == 0x0000, treat as operation on tunnel 1424 */ 1425 ps = l2tp_session_priv(session); 1426 if ((session->session_id == 0) && 1427 (session->peer_session_id == 0)) { 1428 err = -EBADF; 1429 tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock); 1430 if (tunnel == NULL) 1431 goto end_put_sess; 1432 1433 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val); 1434 sock_put(ps->tunnel_sock); 1435 } else 1436 err = pppol2tp_session_setsockopt(sk, session, optname, val); 1437 1438 end_put_sess: 1439 sock_put(sk); 1440 end: 1441 return err; 1442 } 1443 1444 /* Tunnel getsockopt helper. Called with sock locked. 1445 */ 1446 static int pppol2tp_tunnel_getsockopt(struct sock *sk, 1447 struct l2tp_tunnel *tunnel, 1448 int optname, int *val) 1449 { 1450 int err = 0; 1451 1452 switch (optname) { 1453 case PPPOL2TP_SO_DEBUG: 1454 *val = tunnel->debug; 1455 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get debug=%x\n", 1456 tunnel->name, tunnel->debug); 1457 break; 1458 1459 default: 1460 err = -ENOPROTOOPT; 1461 break; 1462 } 1463 1464 return err; 1465 } 1466 1467 /* Session getsockopt helper. Called with sock locked. 1468 */ 1469 static int pppol2tp_session_getsockopt(struct sock *sk, 1470 struct l2tp_session *session, 1471 int optname, int *val) 1472 { 1473 int err = 0; 1474 1475 switch (optname) { 1476 case PPPOL2TP_SO_RECVSEQ: 1477 *val = session->recv_seq; 1478 l2tp_info(session, L2TP_MSG_CONTROL, 1479 "%s: get recv_seq=%d\n", session->name, *val); 1480 break; 1481 1482 case PPPOL2TP_SO_SENDSEQ: 1483 *val = session->send_seq; 1484 l2tp_info(session, L2TP_MSG_CONTROL, 1485 "%s: get send_seq=%d\n", session->name, *val); 1486 break; 1487 1488 case PPPOL2TP_SO_LNSMODE: 1489 *val = session->lns_mode; 1490 l2tp_info(session, L2TP_MSG_CONTROL, 1491 "%s: get lns_mode=%d\n", session->name, *val); 1492 break; 1493 1494 case PPPOL2TP_SO_DEBUG: 1495 *val = session->debug; 1496 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get debug=%d\n", 1497 session->name, *val); 1498 break; 1499 1500 case PPPOL2TP_SO_REORDERTO: 1501 *val = (int) jiffies_to_msecs(session->reorder_timeout); 1502 l2tp_info(session, L2TP_MSG_CONTROL, 1503 "%s: get reorder_timeout=%d\n", session->name, *val); 1504 break; 1505 1506 default: 1507 err = -ENOPROTOOPT; 1508 } 1509 1510 return err; 1511 } 1512 1513 /* Main getsockopt() entry point. 1514 * Does API checks, then calls either the tunnel or session getsockopt 1515 * handler, according to whether the PPPoX socket is a for a regular session 1516 * or the special tunnel type. 1517 */ 1518 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, 1519 char __user *optval, int __user *optlen) 1520 { 1521 struct sock *sk = sock->sk; 1522 struct l2tp_session *session; 1523 struct l2tp_tunnel *tunnel; 1524 int val, len; 1525 int err; 1526 struct pppol2tp_session *ps; 1527 1528 if (level != SOL_PPPOL2TP) 1529 return -EINVAL; 1530 1531 if (get_user(len, optlen)) 1532 return -EFAULT; 1533 1534 len = min_t(unsigned int, len, sizeof(int)); 1535 1536 if (len < 0) 1537 return -EINVAL; 1538 1539 err = -ENOTCONN; 1540 if (sk->sk_user_data == NULL) 1541 goto end; 1542 1543 /* Get the session context */ 1544 err = -EBADF; 1545 session = pppol2tp_sock_to_session(sk); 1546 if (session == NULL) 1547 goto end; 1548 1549 /* Special case: if session_id == 0x0000, treat as operation on tunnel */ 1550 ps = l2tp_session_priv(session); 1551 if ((session->session_id == 0) && 1552 (session->peer_session_id == 0)) { 1553 err = -EBADF; 1554 tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock); 1555 if (tunnel == NULL) 1556 goto end_put_sess; 1557 1558 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val); 1559 sock_put(ps->tunnel_sock); 1560 if (err) 1561 goto end_put_sess; 1562 } else { 1563 err = pppol2tp_session_getsockopt(sk, session, optname, &val); 1564 if (err) 1565 goto end_put_sess; 1566 } 1567 1568 err = -EFAULT; 1569 if (put_user(len, optlen)) 1570 goto end_put_sess; 1571 1572 if (copy_to_user((void __user *) optval, &val, len)) 1573 goto end_put_sess; 1574 1575 err = 0; 1576 1577 end_put_sess: 1578 sock_put(sk); 1579 end: 1580 return err; 1581 } 1582 1583 /***************************************************************************** 1584 * /proc filesystem for debug 1585 * Since the original pppol2tp driver provided /proc/net/pppol2tp for 1586 * L2TPv2, we dump only L2TPv2 tunnels and sessions here. 1587 *****************************************************************************/ 1588 1589 static unsigned int pppol2tp_net_id; 1590 1591 #ifdef CONFIG_PROC_FS 1592 1593 struct pppol2tp_seq_data { 1594 struct seq_net_private p; 1595 int tunnel_idx; /* current tunnel */ 1596 int session_idx; /* index of session within current tunnel */ 1597 struct l2tp_tunnel *tunnel; 1598 struct l2tp_session *session; /* NULL means get next tunnel */ 1599 }; 1600 1601 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) 1602 { 1603 for (;;) { 1604 pd->tunnel = l2tp_tunnel_find_nth(net, pd->tunnel_idx); 1605 pd->tunnel_idx++; 1606 1607 if (pd->tunnel == NULL) 1608 break; 1609 1610 /* Ignore L2TPv3 tunnels */ 1611 if (pd->tunnel->version < 3) 1612 break; 1613 } 1614 } 1615 1616 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) 1617 { 1618 pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true); 1619 pd->session_idx++; 1620 1621 if (pd->session == NULL) { 1622 pd->session_idx = 0; 1623 pppol2tp_next_tunnel(net, pd); 1624 } 1625 } 1626 1627 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs) 1628 { 1629 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN; 1630 loff_t pos = *offs; 1631 struct net *net; 1632 1633 if (!pos) 1634 goto out; 1635 1636 BUG_ON(m->private == NULL); 1637 pd = m->private; 1638 net = seq_file_net(m); 1639 1640 if (pd->tunnel == NULL) 1641 pppol2tp_next_tunnel(net, pd); 1642 else 1643 pppol2tp_next_session(net, pd); 1644 1645 /* NULL tunnel and session indicates end of list */ 1646 if ((pd->tunnel == NULL) && (pd->session == NULL)) 1647 pd = NULL; 1648 1649 out: 1650 return pd; 1651 } 1652 1653 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos) 1654 { 1655 (*pos)++; 1656 return NULL; 1657 } 1658 1659 static void pppol2tp_seq_stop(struct seq_file *p, void *v) 1660 { 1661 /* nothing to do */ 1662 } 1663 1664 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) 1665 { 1666 struct l2tp_tunnel *tunnel = v; 1667 1668 seq_printf(m, "\nTUNNEL '%s', %c %d\n", 1669 tunnel->name, 1670 (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N', 1671 refcount_read(&tunnel->ref_count) - 1); 1672 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n", 1673 tunnel->debug, 1674 atomic_long_read(&tunnel->stats.tx_packets), 1675 atomic_long_read(&tunnel->stats.tx_bytes), 1676 atomic_long_read(&tunnel->stats.tx_errors), 1677 atomic_long_read(&tunnel->stats.rx_packets), 1678 atomic_long_read(&tunnel->stats.rx_bytes), 1679 atomic_long_read(&tunnel->stats.rx_errors)); 1680 } 1681 1682 static void pppol2tp_seq_session_show(struct seq_file *m, void *v) 1683 { 1684 struct l2tp_session *session = v; 1685 struct l2tp_tunnel *tunnel = session->tunnel; 1686 unsigned char state; 1687 char user_data_ok; 1688 struct sock *sk; 1689 u32 ip = 0; 1690 u16 port = 0; 1691 1692 if (tunnel->sock) { 1693 struct inet_sock *inet = inet_sk(tunnel->sock); 1694 ip = ntohl(inet->inet_saddr); 1695 port = ntohs(inet->inet_sport); 1696 } 1697 1698 sk = pppol2tp_session_get_sock(session); 1699 if (sk) { 1700 state = sk->sk_state; 1701 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N'; 1702 } else { 1703 state = 0; 1704 user_data_ok = 'N'; 1705 } 1706 1707 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> " 1708 "%04X/%04X %d %c\n", 1709 session->name, ip, port, 1710 tunnel->tunnel_id, 1711 session->session_id, 1712 tunnel->peer_tunnel_id, 1713 session->peer_session_id, 1714 state, user_data_ok); 1715 seq_printf(m, " %d/%d/%c/%c/%s %08x %u\n", 1716 session->mtu, session->mru, 1717 session->recv_seq ? 'R' : '-', 1718 session->send_seq ? 'S' : '-', 1719 session->lns_mode ? "LNS" : "LAC", 1720 session->debug, 1721 jiffies_to_msecs(session->reorder_timeout)); 1722 seq_printf(m, " %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n", 1723 session->nr, session->ns, 1724 atomic_long_read(&session->stats.tx_packets), 1725 atomic_long_read(&session->stats.tx_bytes), 1726 atomic_long_read(&session->stats.tx_errors), 1727 atomic_long_read(&session->stats.rx_packets), 1728 atomic_long_read(&session->stats.rx_bytes), 1729 atomic_long_read(&session->stats.rx_errors)); 1730 1731 if (sk) { 1732 struct pppox_sock *po = pppox_sk(sk); 1733 1734 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 1735 sock_put(sk); 1736 } 1737 } 1738 1739 static int pppol2tp_seq_show(struct seq_file *m, void *v) 1740 { 1741 struct pppol2tp_seq_data *pd = v; 1742 1743 /* display header on line 1 */ 1744 if (v == SEQ_START_TOKEN) { 1745 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n"); 1746 seq_puts(m, "TUNNEL name, user-data-ok session-count\n"); 1747 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1748 seq_puts(m, " SESSION name, addr/port src-tid/sid " 1749 "dest-tid/sid state user-data-ok\n"); 1750 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n"); 1751 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1752 goto out; 1753 } 1754 1755 /* Show the tunnel or session context. 1756 */ 1757 if (!pd->session) { 1758 pppol2tp_seq_tunnel_show(m, pd->tunnel); 1759 } else { 1760 pppol2tp_seq_session_show(m, pd->session); 1761 if (pd->session->deref) 1762 pd->session->deref(pd->session); 1763 l2tp_session_dec_refcount(pd->session); 1764 } 1765 1766 out: 1767 return 0; 1768 } 1769 1770 static const struct seq_operations pppol2tp_seq_ops = { 1771 .start = pppol2tp_seq_start, 1772 .next = pppol2tp_seq_next, 1773 .stop = pppol2tp_seq_stop, 1774 .show = pppol2tp_seq_show, 1775 }; 1776 1777 /* Called when our /proc file is opened. We allocate data for use when 1778 * iterating our tunnel / session contexts and store it in the private 1779 * data of the seq_file. 1780 */ 1781 static int pppol2tp_proc_open(struct inode *inode, struct file *file) 1782 { 1783 return seq_open_net(inode, file, &pppol2tp_seq_ops, 1784 sizeof(struct pppol2tp_seq_data)); 1785 } 1786 1787 static const struct file_operations pppol2tp_proc_fops = { 1788 .owner = THIS_MODULE, 1789 .open = pppol2tp_proc_open, 1790 .read = seq_read, 1791 .llseek = seq_lseek, 1792 .release = seq_release_net, 1793 }; 1794 1795 #endif /* CONFIG_PROC_FS */ 1796 1797 /***************************************************************************** 1798 * Network namespace 1799 *****************************************************************************/ 1800 1801 static __net_init int pppol2tp_init_net(struct net *net) 1802 { 1803 struct proc_dir_entry *pde; 1804 int err = 0; 1805 1806 pde = proc_create("pppol2tp", S_IRUGO, net->proc_net, 1807 &pppol2tp_proc_fops); 1808 if (!pde) { 1809 err = -ENOMEM; 1810 goto out; 1811 } 1812 1813 out: 1814 return err; 1815 } 1816 1817 static __net_exit void pppol2tp_exit_net(struct net *net) 1818 { 1819 remove_proc_entry("pppol2tp", net->proc_net); 1820 } 1821 1822 static struct pernet_operations pppol2tp_net_ops = { 1823 .init = pppol2tp_init_net, 1824 .exit = pppol2tp_exit_net, 1825 .id = &pppol2tp_net_id, 1826 }; 1827 1828 /***************************************************************************** 1829 * Init and cleanup 1830 *****************************************************************************/ 1831 1832 static const struct proto_ops pppol2tp_ops = { 1833 .family = AF_PPPOX, 1834 .owner = THIS_MODULE, 1835 .release = pppol2tp_release, 1836 .bind = sock_no_bind, 1837 .connect = pppol2tp_connect, 1838 .socketpair = sock_no_socketpair, 1839 .accept = sock_no_accept, 1840 .getname = pppol2tp_getname, 1841 .poll = datagram_poll, 1842 .listen = sock_no_listen, 1843 .shutdown = sock_no_shutdown, 1844 .setsockopt = pppol2tp_setsockopt, 1845 .getsockopt = pppol2tp_getsockopt, 1846 .sendmsg = pppol2tp_sendmsg, 1847 .recvmsg = pppol2tp_recvmsg, 1848 .mmap = sock_no_mmap, 1849 .ioctl = pppox_ioctl, 1850 }; 1851 1852 static const struct pppox_proto pppol2tp_proto = { 1853 .create = pppol2tp_create, 1854 .ioctl = pppol2tp_ioctl, 1855 .owner = THIS_MODULE, 1856 }; 1857 1858 #ifdef CONFIG_L2TP_V3 1859 1860 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = { 1861 .session_create = pppol2tp_session_create, 1862 .session_delete = l2tp_session_delete, 1863 }; 1864 1865 #endif /* CONFIG_L2TP_V3 */ 1866 1867 static int __init pppol2tp_init(void) 1868 { 1869 int err; 1870 1871 err = register_pernet_device(&pppol2tp_net_ops); 1872 if (err) 1873 goto out; 1874 1875 err = proto_register(&pppol2tp_sk_proto, 0); 1876 if (err) 1877 goto out_unregister_pppol2tp_pernet; 1878 1879 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto); 1880 if (err) 1881 goto out_unregister_pppol2tp_proto; 1882 1883 #ifdef CONFIG_L2TP_V3 1884 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops); 1885 if (err) 1886 goto out_unregister_pppox; 1887 #endif 1888 1889 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION); 1890 1891 out: 1892 return err; 1893 1894 #ifdef CONFIG_L2TP_V3 1895 out_unregister_pppox: 1896 unregister_pppox_proto(PX_PROTO_OL2TP); 1897 #endif 1898 out_unregister_pppol2tp_proto: 1899 proto_unregister(&pppol2tp_sk_proto); 1900 out_unregister_pppol2tp_pernet: 1901 unregister_pernet_device(&pppol2tp_net_ops); 1902 goto out; 1903 } 1904 1905 static void __exit pppol2tp_exit(void) 1906 { 1907 #ifdef CONFIG_L2TP_V3 1908 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP); 1909 #endif 1910 unregister_pppox_proto(PX_PROTO_OL2TP); 1911 proto_unregister(&pppol2tp_sk_proto); 1912 unregister_pernet_device(&pppol2tp_net_ops); 1913 } 1914 1915 module_init(pppol2tp_init); 1916 module_exit(pppol2tp_exit); 1917 1918 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1919 MODULE_DESCRIPTION("PPP over L2TP over UDP"); 1920 MODULE_LICENSE("GPL"); 1921 MODULE_VERSION(PPPOL2TP_DRV_VERSION); 1922 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP); 1923 MODULE_ALIAS_L2TP_PWTYPE(7); 1924