1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*****************************************************************************
3 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets
4 *
5 * PPPoX --- Generic PPP encapsulation socket family
6 * PPPoL2TP --- PPP over L2TP (RFC 2661)
7 *
8 * Version: 2.0.0
9 *
10 * Authors: James Chapman (jchapman@katalix.com)
11 *
12 * Based on original work by Martijn van Oosterhout <kleptog@svana.org>
13 *
14 * License:
15 */
16
17 /* This driver handles only L2TP data frames; control frames are handled by a
18 * userspace application.
19 *
20 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and
21 * attaches it to a bound UDP socket with local tunnel_id / session_id and
22 * peer tunnel_id / session_id set. Data can then be sent or received using
23 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket
24 * can be read or modified using ioctl() or [gs]etsockopt() calls.
25 *
26 * When a PPPoL2TP socket is connected with local and peer session_id values
27 * zero, the socket is treated as a special tunnel management socket.
28 *
29 * Here's example userspace code to create a socket for sending/receiving data
30 * over an L2TP session:-
31 *
32 * struct sockaddr_pppol2tp sax;
33 * int fd;
34 * int session_fd;
35 *
36 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
37 *
38 * sax.sa_family = AF_PPPOX;
39 * sax.sa_protocol = PX_PROTO_OL2TP;
40 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket
41 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr;
42 * sax.pppol2tp.addr.sin_port = addr->sin_port;
43 * sax.pppol2tp.addr.sin_family = AF_INET;
44 * sax.pppol2tp.s_tunnel = tunnel_id;
45 * sax.pppol2tp.s_session = session_id;
46 * sax.pppol2tp.d_tunnel = peer_tunnel_id;
47 * sax.pppol2tp.d_session = peer_session_id;
48 *
49 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax));
50 *
51 * A pppd plugin that allows PPP traffic to be carried over L2TP using
52 * this driver is available from the OpenL2TP project at
53 * http://openl2tp.sourceforge.net.
54 */
55
56 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
57
58 #include <linux/module.h>
59 #include <linux/string.h>
60 #include <linux/list.h>
61 #include <linux/uaccess.h>
62 #include <linux/uio.h>
63
64 #include <linux/kernel.h>
65 #include <linux/spinlock.h>
66 #include <linux/kthread.h>
67 #include <linux/sched.h>
68 #include <linux/slab.h>
69 #include <linux/errno.h>
70 #include <linux/jiffies.h>
71
72 #include <linux/netdevice.h>
73 #include <linux/net.h>
74 #include <linux/inetdevice.h>
75 #include <linux/skbuff.h>
76 #include <linux/init.h>
77 #include <linux/ip.h>
78 #include <linux/udp.h>
79 #include <linux/if_pppox.h>
80 #include <linux/if_pppol2tp.h>
81 #include <net/sock.h>
82 #include <linux/ppp_channel.h>
83 #include <linux/ppp_defs.h>
84 #include <linux/ppp-ioctl.h>
85 #include <linux/file.h>
86 #include <linux/hash.h>
87 #include <linux/sort.h>
88 #include <linux/proc_fs.h>
89 #include <linux/l2tp.h>
90 #include <linux/nsproxy.h>
91 #include <net/net_namespace.h>
92 #include <net/netns/generic.h>
93 #include <net/ip.h>
94 #include <net/udp.h>
95 #include <net/inet_common.h>
96
97 #include <asm/byteorder.h>
98 #include <linux/atomic.h>
99
100 #include "l2tp_core.h"
101
102 #define PPPOL2TP_DRV_VERSION "V2.0"
103
104 /* Space for UDP, L2TP and PPP headers */
105 #define PPPOL2TP_HEADER_OVERHEAD 40
106
107 /* Number of bytes to build transmit L2TP headers.
108 * Unfortunately the size is different depending on whether sequence numbers
109 * are enabled.
110 */
111 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10
112 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6
113
114 /* Private data of each session. This data lives at the end of struct
115 * l2tp_session, referenced via session->priv[].
116 */
117 struct pppol2tp_session {
118 int owner; /* pid that opened the socket */
119
120 struct mutex sk_lock; /* Protects .sk */
121 struct sock __rcu *sk; /* Pointer to the session PPPoX socket */
122 struct sock *__sk; /* Copy of .sk, for cleanup */
123 };
124
125 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);
126
127 static const struct ppp_channel_ops pppol2tp_chan_ops = {
128 .start_xmit = pppol2tp_xmit,
129 };
130
131 static const struct proto_ops pppol2tp_ops;
132
133 /* Retrieves the pppol2tp socket associated to a session. */
pppol2tp_session_get_sock(struct l2tp_session * session)134 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session)
135 {
136 struct pppol2tp_session *ps = l2tp_session_priv(session);
137
138 return rcu_dereference(ps->sk);
139 }
140
141 /* Helpers to obtain tunnel/session contexts from sockets.
142 */
pppol2tp_sock_to_session(struct sock * sk)143 static struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk)
144 {
145 struct l2tp_session *session;
146
147 if (!sk)
148 return NULL;
149
150 rcu_read_lock();
151 session = rcu_dereference_sk_user_data(sk);
152 if (session && refcount_inc_not_zero(&session->ref_count)) {
153 rcu_read_unlock();
154 WARN_ON_ONCE(session->magic != L2TP_SESSION_MAGIC);
155 return session;
156 }
157 rcu_read_unlock();
158
159 return NULL;
160 }
161
162 /*****************************************************************************
163 * Receive data handling
164 *****************************************************************************/
165
166 /* Receive message. This is the recvmsg for the PPPoL2TP socket.
167 */
pppol2tp_recvmsg(struct socket * sock,struct msghdr * msg,size_t len,int flags)168 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg,
169 size_t len, int flags)
170 {
171 int err;
172 struct sk_buff *skb;
173 struct sock *sk = sock->sk;
174
175 err = -EIO;
176 if (sk->sk_state & PPPOX_BOUND)
177 goto end;
178
179 err = 0;
180 skb = skb_recv_datagram(sk, flags, &err);
181 if (!skb)
182 goto end;
183
184 if (len > skb->len)
185 len = skb->len;
186 else if (len < skb->len)
187 msg->msg_flags |= MSG_TRUNC;
188
189 err = skb_copy_datagram_msg(skb, 0, msg, len);
190 if (likely(err == 0))
191 err = len;
192
193 kfree_skb(skb);
194 end:
195 return err;
196 }
197
pppol2tp_recv(struct l2tp_session * session,struct sk_buff * skb,int data_len)198 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len)
199 {
200 struct sock *sk;
201
202 /* If the socket is bound, send it in to PPP's input queue. Otherwise
203 * queue it on the session socket.
204 */
205 rcu_read_lock();
206 sk = pppol2tp_session_get_sock(session);
207 if (!sk)
208 goto no_sock;
209
210 /* If the first two bytes are 0xFF03, consider that it is the PPP's
211 * Address and Control fields and skip them. The L2TP module has always
212 * worked this way, although, in theory, the use of these fields should
213 * be negotiated and handled at the PPP layer. These fields are
214 * constant: 0xFF is the All-Stations Address and 0x03 the Unnumbered
215 * Information command with Poll/Final bit set to zero (RFC 1662).
216 */
217 if (pskb_may_pull(skb, 2) && skb->data[0] == PPP_ALLSTATIONS &&
218 skb->data[1] == PPP_UI)
219 skb_pull(skb, 2);
220
221 if (sk->sk_state & PPPOX_BOUND) {
222 struct pppox_sock *po;
223
224 po = pppox_sk(sk);
225 ppp_input(&po->chan, skb);
226 } else {
227 if (sock_queue_rcv_skb(sk, skb) < 0) {
228 atomic_long_inc(&session->stats.rx_errors);
229 kfree_skb(skb);
230 }
231 }
232 rcu_read_unlock();
233
234 return;
235
236 no_sock:
237 rcu_read_unlock();
238 pr_warn_ratelimited("%s: no socket in recv\n", session->name);
239 kfree_skb(skb);
240 }
241
242 /************************************************************************
243 * Transmit handling
244 ***********************************************************************/
245
246 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here
247 * when a user application does a sendmsg() on the session socket. L2TP and
248 * PPP headers must be inserted into the user's data.
249 */
pppol2tp_sendmsg(struct socket * sock,struct msghdr * m,size_t total_len)250 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
251 size_t total_len)
252 {
253 struct sock *sk = sock->sk;
254 struct sk_buff *skb;
255 int error;
256 struct l2tp_session *session;
257 struct l2tp_tunnel *tunnel;
258 int uhlen;
259
260 error = -ENOTCONN;
261 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
262 goto error;
263
264 /* Get session and tunnel contexts */
265 error = -EBADF;
266 session = pppol2tp_sock_to_session(sk);
267 if (!session)
268 goto error;
269
270 tunnel = session->tunnel;
271
272 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
273
274 /* Allocate a socket buffer */
275 error = -ENOMEM;
276 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) +
277 uhlen + session->hdr_len +
278 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
279 0, GFP_KERNEL);
280 if (!skb)
281 goto error_put_sess;
282
283 /* Reserve space for headers. */
284 skb_reserve(skb, NET_SKB_PAD);
285 skb_reset_network_header(skb);
286 skb_reserve(skb, sizeof(struct iphdr));
287 skb_reset_transport_header(skb);
288 skb_reserve(skb, uhlen);
289
290 /* Add PPP header */
291 skb->data[0] = PPP_ALLSTATIONS;
292 skb->data[1] = PPP_UI;
293 skb_put(skb, 2);
294
295 /* Copy user data into skb */
296 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len);
297 if (error < 0) {
298 kfree_skb(skb);
299 goto error_put_sess;
300 }
301
302 local_bh_disable();
303 l2tp_xmit_skb(session, skb);
304 local_bh_enable();
305
306 l2tp_session_put(session);
307
308 return total_len;
309
310 error_put_sess:
311 l2tp_session_put(session);
312 error:
313 return error;
314 }
315
316 /* Transmit function called by generic PPP driver. Sends PPP frame
317 * over PPPoL2TP socket.
318 *
319 * This is almost the same as pppol2tp_sendmsg(), but rather than
320 * being called with a msghdr from userspace, it is called with a skb
321 * from the kernel.
322 *
323 * The supplied skb from ppp doesn't have enough headroom for the
324 * insertion of L2TP, UDP and IP headers so we need to allocate more
325 * headroom in the skb. This will create a cloned skb. But we must be
326 * careful in the error case because the caller will expect to free
327 * the skb it supplied, not our cloned skb. So we take care to always
328 * leave the original skb unfreed if we return an error.
329 */
pppol2tp_xmit(struct ppp_channel * chan,struct sk_buff * skb)330 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
331 {
332 struct sock *sk = (struct sock *)chan->private;
333 struct l2tp_session *session;
334 struct l2tp_tunnel *tunnel;
335 int uhlen, headroom;
336
337 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
338 goto abort;
339
340 /* Get session and tunnel contexts from the socket */
341 session = pppol2tp_sock_to_session(sk);
342 if (!session)
343 goto abort;
344
345 tunnel = session->tunnel;
346
347 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
348 headroom = NET_SKB_PAD +
349 sizeof(struct iphdr) + /* IP header */
350 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */
351 session->hdr_len + /* L2TP header */
352 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
353 if (skb_cow_head(skb, headroom))
354 goto abort_put_sess;
355
356 /* Setup PPP header */
357 __skb_push(skb, 2);
358 skb->data[0] = PPP_ALLSTATIONS;
359 skb->data[1] = PPP_UI;
360
361 local_bh_disable();
362 l2tp_xmit_skb(session, skb);
363 local_bh_enable();
364
365 l2tp_session_put(session);
366
367 return 1;
368
369 abort_put_sess:
370 l2tp_session_put(session);
371 abort:
372 /* Free the original skb */
373 kfree_skb(skb);
374 return 1;
375 }
376
377 /*****************************************************************************
378 * Session (and tunnel control) socket create/destroy.
379 *****************************************************************************/
380
381 /* Really kill the session socket. (Called from sock_put() if
382 * refcnt == 0.)
383 */
pppol2tp_session_destruct(struct sock * sk)384 static void pppol2tp_session_destruct(struct sock *sk)
385 {
386 skb_queue_purge(&sk->sk_receive_queue);
387 skb_queue_purge(&sk->sk_write_queue);
388 }
389
pppol2tp_session_close(struct l2tp_session * session)390 static void pppol2tp_session_close(struct l2tp_session *session)
391 {
392 struct pppol2tp_session *ps;
393
394 ps = l2tp_session_priv(session);
395 mutex_lock(&ps->sk_lock);
396 ps->__sk = rcu_dereference_protected(ps->sk,
397 lockdep_is_held(&ps->sk_lock));
398 RCU_INIT_POINTER(ps->sk, NULL);
399 mutex_unlock(&ps->sk_lock);
400 if (ps->__sk) {
401 /* detach socket */
402 rcu_assign_sk_user_data(ps->__sk, NULL);
403 sock_put(ps->__sk);
404
405 /* drop ref taken when we referenced socket via sk_user_data */
406 l2tp_session_put(session);
407 }
408 }
409
410 /* Called when the PPPoX socket (session) is closed.
411 */
pppol2tp_release(struct socket * sock)412 static int pppol2tp_release(struct socket *sock)
413 {
414 struct sock *sk = sock->sk;
415 struct l2tp_session *session;
416 int error;
417
418 if (!sk)
419 return 0;
420
421 error = -EBADF;
422 lock_sock(sk);
423 if (sock_flag(sk, SOCK_DEAD) != 0)
424 goto error;
425
426 pppox_unbind_sock(sk);
427
428 /* Signal the death of the socket. */
429 sk->sk_state = PPPOX_DEAD;
430 sock_orphan(sk);
431 sock->sk = NULL;
432
433 session = pppol2tp_sock_to_session(sk);
434 if (session) {
435 l2tp_session_delete(session);
436 /* drop ref taken by pppol2tp_sock_to_session */
437 l2tp_session_put(session);
438 }
439
440 release_sock(sk);
441
442 sock_put(sk);
443
444 return 0;
445
446 error:
447 release_sock(sk);
448 return error;
449 }
450
451 static struct proto pppol2tp_sk_proto = {
452 .name = "PPPOL2TP",
453 .owner = THIS_MODULE,
454 .obj_size = sizeof(struct pppox_sock),
455 };
456
pppol2tp_backlog_recv(struct sock * sk,struct sk_buff * skb)457 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb)
458 {
459 int rc;
460
461 rc = l2tp_udp_encap_recv(sk, skb);
462 if (rc)
463 kfree_skb(skb);
464
465 return NET_RX_SUCCESS;
466 }
467
468 /* socket() handler. Initialize a new struct sock.
469 */
pppol2tp_create(struct net * net,struct socket * sock,int kern)470 static int pppol2tp_create(struct net *net, struct socket *sock, int kern)
471 {
472 int error = -ENOMEM;
473 struct sock *sk;
474
475 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern);
476 if (!sk)
477 goto out;
478
479 sock_init_data(sock, sk);
480 sock_set_flag(sk, SOCK_RCU_FREE);
481
482 sock->state = SS_UNCONNECTED;
483 sock->ops = &pppol2tp_ops;
484
485 sk->sk_backlog_rcv = pppol2tp_backlog_recv;
486 sk->sk_protocol = PX_PROTO_OL2TP;
487 sk->sk_family = PF_PPPOX;
488 sk->sk_state = PPPOX_NONE;
489 sk->sk_type = SOCK_STREAM;
490 sk->sk_destruct = pppol2tp_session_destruct;
491
492 error = 0;
493
494 out:
495 return error;
496 }
497
pppol2tp_show(struct seq_file * m,void * arg)498 static void pppol2tp_show(struct seq_file *m, void *arg)
499 {
500 struct l2tp_session *session = arg;
501 struct sock *sk;
502
503 rcu_read_lock();
504 sk = pppol2tp_session_get_sock(session);
505 if (sk) {
506 struct pppox_sock *po = pppox_sk(sk);
507
508 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan));
509 }
510 rcu_read_unlock();
511 }
512
pppol2tp_session_init(struct l2tp_session * session)513 static void pppol2tp_session_init(struct l2tp_session *session)
514 {
515 struct pppol2tp_session *ps;
516
517 session->recv_skb = pppol2tp_recv;
518 session->session_close = pppol2tp_session_close;
519 if (IS_ENABLED(CONFIG_L2TP_DEBUGFS))
520 session->show = pppol2tp_show;
521
522 ps = l2tp_session_priv(session);
523 mutex_init(&ps->sk_lock);
524 ps->owner = current->pid;
525 }
526
527 struct l2tp_connect_info {
528 u8 version;
529 int fd;
530 u32 tunnel_id;
531 u32 peer_tunnel_id;
532 u32 session_id;
533 u32 peer_session_id;
534 };
535
pppol2tp_sockaddr_get_info(const void * sa,int sa_len,struct l2tp_connect_info * info)536 static int pppol2tp_sockaddr_get_info(const void *sa, int sa_len,
537 struct l2tp_connect_info *info)
538 {
539 switch (sa_len) {
540 case sizeof(struct sockaddr_pppol2tp):
541 {
542 const struct sockaddr_pppol2tp *sa_v2in4 = sa;
543
544 if (sa_v2in4->sa_protocol != PX_PROTO_OL2TP)
545 return -EINVAL;
546
547 info->version = 2;
548 info->fd = sa_v2in4->pppol2tp.fd;
549 info->tunnel_id = sa_v2in4->pppol2tp.s_tunnel;
550 info->peer_tunnel_id = sa_v2in4->pppol2tp.d_tunnel;
551 info->session_id = sa_v2in4->pppol2tp.s_session;
552 info->peer_session_id = sa_v2in4->pppol2tp.d_session;
553
554 break;
555 }
556 case sizeof(struct sockaddr_pppol2tpv3):
557 {
558 const struct sockaddr_pppol2tpv3 *sa_v3in4 = sa;
559
560 if (sa_v3in4->sa_protocol != PX_PROTO_OL2TP)
561 return -EINVAL;
562
563 info->version = 3;
564 info->fd = sa_v3in4->pppol2tp.fd;
565 info->tunnel_id = sa_v3in4->pppol2tp.s_tunnel;
566 info->peer_tunnel_id = sa_v3in4->pppol2tp.d_tunnel;
567 info->session_id = sa_v3in4->pppol2tp.s_session;
568 info->peer_session_id = sa_v3in4->pppol2tp.d_session;
569
570 break;
571 }
572 case sizeof(struct sockaddr_pppol2tpin6):
573 {
574 const struct sockaddr_pppol2tpin6 *sa_v2in6 = sa;
575
576 if (sa_v2in6->sa_protocol != PX_PROTO_OL2TP)
577 return -EINVAL;
578
579 info->version = 2;
580 info->fd = sa_v2in6->pppol2tp.fd;
581 info->tunnel_id = sa_v2in6->pppol2tp.s_tunnel;
582 info->peer_tunnel_id = sa_v2in6->pppol2tp.d_tunnel;
583 info->session_id = sa_v2in6->pppol2tp.s_session;
584 info->peer_session_id = sa_v2in6->pppol2tp.d_session;
585
586 break;
587 }
588 case sizeof(struct sockaddr_pppol2tpv3in6):
589 {
590 const struct sockaddr_pppol2tpv3in6 *sa_v3in6 = sa;
591
592 if (sa_v3in6->sa_protocol != PX_PROTO_OL2TP)
593 return -EINVAL;
594
595 info->version = 3;
596 info->fd = sa_v3in6->pppol2tp.fd;
597 info->tunnel_id = sa_v3in6->pppol2tp.s_tunnel;
598 info->peer_tunnel_id = sa_v3in6->pppol2tp.d_tunnel;
599 info->session_id = sa_v3in6->pppol2tp.s_session;
600 info->peer_session_id = sa_v3in6->pppol2tp.d_session;
601
602 break;
603 }
604 default:
605 return -EINVAL;
606 }
607
608 return 0;
609 }
610
611 /* Rough estimation of the maximum payload size a tunnel can transmit without
612 * fragmenting at the lower IP layer. Assumes L2TPv2 with sequence
613 * numbers and no IP option. Not quite accurate, but the result is mostly
614 * unused anyway.
615 */
pppol2tp_tunnel_mtu(const struct l2tp_tunnel * tunnel)616 static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel)
617 {
618 int mtu;
619
620 mtu = l2tp_tunnel_dst_mtu(tunnel);
621 if (mtu <= PPPOL2TP_HEADER_OVERHEAD)
622 return 1500 - PPPOL2TP_HEADER_OVERHEAD;
623
624 return mtu - PPPOL2TP_HEADER_OVERHEAD;
625 }
626
pppol2tp_tunnel_get(struct net * net,const struct l2tp_connect_info * info,bool * new_tunnel)627 static struct l2tp_tunnel *pppol2tp_tunnel_get(struct net *net,
628 const struct l2tp_connect_info *info,
629 bool *new_tunnel)
630 {
631 struct l2tp_tunnel *tunnel;
632 int error;
633
634 *new_tunnel = false;
635
636 tunnel = l2tp_tunnel_get(net, info->tunnel_id);
637
638 /* Special case: create tunnel context if session_id and
639 * peer_session_id is 0. Otherwise look up tunnel using supplied
640 * tunnel id.
641 */
642 if (!info->session_id && !info->peer_session_id) {
643 if (!tunnel) {
644 struct l2tp_tunnel_cfg tcfg = {
645 .encap = L2TP_ENCAPTYPE_UDP,
646 };
647
648 /* Prevent l2tp_tunnel_register() from trying to set up
649 * a kernel socket.
650 */
651 if (info->fd < 0)
652 return ERR_PTR(-EBADF);
653
654 error = l2tp_tunnel_create(info->fd,
655 info->version,
656 info->tunnel_id,
657 info->peer_tunnel_id, &tcfg,
658 &tunnel);
659 if (error < 0)
660 return ERR_PTR(error);
661
662 refcount_inc(&tunnel->ref_count);
663 error = l2tp_tunnel_register(tunnel, net, &tcfg);
664 if (error < 0) {
665 kfree(tunnel);
666 return ERR_PTR(error);
667 }
668
669 *new_tunnel = true;
670 }
671 } else {
672 /* Error if we can't find the tunnel */
673 if (!tunnel)
674 return ERR_PTR(-ENOENT);
675
676 /* Error if socket is not prepped */
677 if (!tunnel->sock) {
678 l2tp_tunnel_put(tunnel);
679 return ERR_PTR(-ENOENT);
680 }
681 }
682
683 return tunnel;
684 }
685
686 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
687 */
pppol2tp_connect(struct socket * sock,struct sockaddr_unsized * uservaddr,int sockaddr_len,int flags)688 static int pppol2tp_connect(struct socket *sock, struct sockaddr_unsized *uservaddr,
689 int sockaddr_len, int flags)
690 {
691 struct sock *sk = sock->sk;
692 struct pppox_sock *po = pppox_sk(sk);
693 struct l2tp_session *session = NULL;
694 struct l2tp_connect_info info;
695 struct l2tp_tunnel *tunnel;
696 struct pppol2tp_session *ps;
697 struct l2tp_session_cfg cfg = { 0, };
698 bool drop_refcnt = false;
699 bool new_session = false;
700 bool new_tunnel = false;
701 int error;
702
703 error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info);
704 if (error < 0)
705 return error;
706
707 /* Don't bind if tunnel_id is 0 */
708 if (!info.tunnel_id)
709 return -EINVAL;
710
711 tunnel = pppol2tp_tunnel_get(sock_net(sk), &info, &new_tunnel);
712 if (IS_ERR(tunnel))
713 return PTR_ERR(tunnel);
714
715 lock_sock(sk);
716
717 /* Check for already bound sockets */
718 error = -EBUSY;
719 if (sk->sk_state & PPPOX_CONNECTED)
720 goto end;
721
722 /* We don't supporting rebinding anyway */
723 error = -EALREADY;
724 if (sk->sk_user_data)
725 goto end; /* socket is already attached */
726
727 if (tunnel->peer_tunnel_id == 0)
728 tunnel->peer_tunnel_id = info.peer_tunnel_id;
729
730 session = l2tp_session_get(sock_net(sk), tunnel->sock, tunnel->version,
731 info.tunnel_id, info.session_id);
732 if (session) {
733 drop_refcnt = true;
734
735 if (session->pwtype != L2TP_PWTYPE_PPP) {
736 error = -EPROTOTYPE;
737 goto end;
738 }
739
740 ps = l2tp_session_priv(session);
741
742 /* Using a pre-existing session is fine as long as it hasn't
743 * been connected yet.
744 */
745 mutex_lock(&ps->sk_lock);
746 if (rcu_dereference_protected(ps->sk,
747 lockdep_is_held(&ps->sk_lock)) ||
748 ps->__sk) {
749 mutex_unlock(&ps->sk_lock);
750 error = -EEXIST;
751 goto end;
752 }
753 } else {
754 cfg.pw_type = L2TP_PWTYPE_PPP;
755
756 session = l2tp_session_create(sizeof(struct pppol2tp_session),
757 tunnel, info.session_id,
758 info.peer_session_id, &cfg);
759 if (IS_ERR(session)) {
760 error = PTR_ERR(session);
761 goto end;
762 }
763
764 drop_refcnt = true;
765
766 pppol2tp_session_init(session);
767 ps = l2tp_session_priv(session);
768 refcount_inc(&session->ref_count);
769
770 mutex_lock(&ps->sk_lock);
771 error = l2tp_session_register(session, tunnel);
772 if (error < 0) {
773 mutex_unlock(&ps->sk_lock);
774 l2tp_session_put(session);
775 goto end;
776 }
777
778 new_session = true;
779 }
780
781 /* Special case: if source & dest session_id == 0x0000, this
782 * socket is being created to manage the tunnel. Just set up
783 * the internal context for use by ioctl() and sockopt()
784 * handlers.
785 */
786 if (session->session_id == 0 && session->peer_session_id == 0) {
787 error = 0;
788 goto out_no_ppp;
789 }
790
791 /* Reserve enough headroom for the L2TP header with sequence numbers,
792 * which is the largest possible. This is used by the PPP layer to set
793 * the net device's hard_header_len at registration, which must be
794 * sufficient regardless of whether sequence numbers are enabled later.
795 */
796 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_SEQ;
797
798 po->chan.private = sk;
799 po->chan.ops = &pppol2tp_chan_ops;
800 po->chan.mtu = pppol2tp_tunnel_mtu(tunnel);
801 po->chan.direct_xmit = true;
802
803 error = ppp_register_net_channel(sock_net(sk), &po->chan);
804 if (error) {
805 mutex_unlock(&ps->sk_lock);
806 goto end;
807 }
808
809 out_no_ppp:
810 /* This is how we get the session context from the socket. */
811 sock_hold(sk);
812 rcu_assign_sk_user_data(sk, session);
813 rcu_assign_pointer(ps->sk, sk);
814 mutex_unlock(&ps->sk_lock);
815
816 /* Keep the reference we've grabbed on the session: sk doesn't expect
817 * the session to disappear. pppol2tp_session_close() is responsible
818 * for dropping it.
819 */
820 drop_refcnt = false;
821
822 sk->sk_state = PPPOX_CONNECTED;
823
824 end:
825 if (error) {
826 if (new_session)
827 l2tp_session_delete(session);
828 if (new_tunnel)
829 l2tp_tunnel_delete(tunnel);
830 }
831 if (drop_refcnt)
832 l2tp_session_put(session);
833 l2tp_tunnel_put(tunnel);
834 release_sock(sk);
835
836 return error;
837 }
838
839 #ifdef CONFIG_L2TP_V3
840
841 /* Called when creating sessions via the netlink interface. */
pppol2tp_session_create(struct net * net,struct l2tp_tunnel * tunnel,u32 session_id,u32 peer_session_id,struct l2tp_session_cfg * cfg)842 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel,
843 u32 session_id, u32 peer_session_id,
844 struct l2tp_session_cfg *cfg)
845 {
846 int error;
847 struct l2tp_session *session;
848
849 /* Error if tunnel socket is not prepped */
850 if (!tunnel->sock) {
851 error = -ENOENT;
852 goto err;
853 }
854
855 /* Allocate and initialize a new session context. */
856 session = l2tp_session_create(sizeof(struct pppol2tp_session),
857 tunnel, session_id,
858 peer_session_id, cfg);
859 if (IS_ERR(session)) {
860 error = PTR_ERR(session);
861 goto err;
862 }
863
864 pppol2tp_session_init(session);
865
866 error = l2tp_session_register(session, tunnel);
867 if (error < 0)
868 goto err_sess;
869
870 return 0;
871
872 err_sess:
873 l2tp_session_put(session);
874 err:
875 return error;
876 }
877
878 #endif /* CONFIG_L2TP_V3 */
879
880 /* getname() support.
881 */
pppol2tp_getname(struct socket * sock,struct sockaddr * uaddr,int peer)882 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
883 int peer)
884 {
885 int len = 0;
886 int error = 0;
887 struct l2tp_session *session;
888 struct l2tp_tunnel *tunnel;
889 struct sock *sk = sock->sk;
890 struct inet_sock *inet;
891 struct pppol2tp_session *pls;
892
893 error = -ENOTCONN;
894 if (!sk)
895 goto end;
896 if (!(sk->sk_state & PPPOX_CONNECTED))
897 goto end;
898
899 error = -EBADF;
900 session = pppol2tp_sock_to_session(sk);
901 if (!session)
902 goto end;
903
904 pls = l2tp_session_priv(session);
905 tunnel = session->tunnel;
906
907 inet = inet_sk(tunnel->sock);
908 if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET) {
909 struct sockaddr_pppol2tp sp;
910
911 len = sizeof(sp);
912 memset(&sp, 0, len);
913 sp.sa_family = AF_PPPOX;
914 sp.sa_protocol = PX_PROTO_OL2TP;
915 sp.pppol2tp.fd = tunnel->fd;
916 sp.pppol2tp.pid = pls->owner;
917 sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
918 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
919 sp.pppol2tp.s_session = session->session_id;
920 sp.pppol2tp.d_session = session->peer_session_id;
921 sp.pppol2tp.addr.sin_family = AF_INET;
922 sp.pppol2tp.addr.sin_port = inet->inet_dport;
923 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
924 memcpy(uaddr, &sp, len);
925 #if IS_ENABLED(CONFIG_IPV6)
926 } else if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET6) {
927 struct sockaddr_pppol2tpin6 sp;
928
929 len = sizeof(sp);
930 memset(&sp, 0, len);
931 sp.sa_family = AF_PPPOX;
932 sp.sa_protocol = PX_PROTO_OL2TP;
933 sp.pppol2tp.fd = tunnel->fd;
934 sp.pppol2tp.pid = pls->owner;
935 sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
936 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
937 sp.pppol2tp.s_session = session->session_id;
938 sp.pppol2tp.d_session = session->peer_session_id;
939 sp.pppol2tp.addr.sin6_family = AF_INET6;
940 sp.pppol2tp.addr.sin6_port = inet->inet_dport;
941 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
942 sizeof(tunnel->sock->sk_v6_daddr));
943 memcpy(uaddr, &sp, len);
944 } else if (tunnel->version == 3 && tunnel->sock->sk_family == AF_INET6) {
945 struct sockaddr_pppol2tpv3in6 sp;
946
947 len = sizeof(sp);
948 memset(&sp, 0, len);
949 sp.sa_family = AF_PPPOX;
950 sp.sa_protocol = PX_PROTO_OL2TP;
951 sp.pppol2tp.fd = tunnel->fd;
952 sp.pppol2tp.pid = pls->owner;
953 sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
954 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
955 sp.pppol2tp.s_session = session->session_id;
956 sp.pppol2tp.d_session = session->peer_session_id;
957 sp.pppol2tp.addr.sin6_family = AF_INET6;
958 sp.pppol2tp.addr.sin6_port = inet->inet_dport;
959 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
960 sizeof(tunnel->sock->sk_v6_daddr));
961 memcpy(uaddr, &sp, len);
962 #endif
963 } else if (tunnel->version == 3) {
964 struct sockaddr_pppol2tpv3 sp;
965
966 len = sizeof(sp);
967 memset(&sp, 0, len);
968 sp.sa_family = AF_PPPOX;
969 sp.sa_protocol = PX_PROTO_OL2TP;
970 sp.pppol2tp.fd = tunnel->fd;
971 sp.pppol2tp.pid = pls->owner;
972 sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
973 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
974 sp.pppol2tp.s_session = session->session_id;
975 sp.pppol2tp.d_session = session->peer_session_id;
976 sp.pppol2tp.addr.sin_family = AF_INET;
977 sp.pppol2tp.addr.sin_port = inet->inet_dport;
978 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
979 memcpy(uaddr, &sp, len);
980 }
981
982 error = len;
983
984 l2tp_session_put(session);
985 end:
986 return error;
987 }
988
989 /****************************************************************************
990 * ioctl() handlers.
991 *
992 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
993 * sockets. However, in order to control kernel tunnel features, we allow
994 * userspace to create a special "tunnel" PPPoX socket which is used for
995 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow
996 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl()
997 * calls.
998 ****************************************************************************/
999
pppol2tp_copy_stats(struct pppol2tp_ioc_stats * dest,const struct l2tp_stats * stats)1000 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest,
1001 const struct l2tp_stats *stats)
1002 {
1003 memset(dest, 0, sizeof(*dest));
1004
1005 dest->tx_packets = atomic_long_read(&stats->tx_packets);
1006 dest->tx_bytes = atomic_long_read(&stats->tx_bytes);
1007 dest->tx_errors = atomic_long_read(&stats->tx_errors);
1008 dest->rx_packets = atomic_long_read(&stats->rx_packets);
1009 dest->rx_bytes = atomic_long_read(&stats->rx_bytes);
1010 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards);
1011 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets);
1012 dest->rx_errors = atomic_long_read(&stats->rx_errors);
1013 }
1014
pppol2tp_tunnel_copy_stats(struct pppol2tp_ioc_stats * stats,struct l2tp_tunnel * tunnel)1015 static int pppol2tp_tunnel_copy_stats(struct pppol2tp_ioc_stats *stats,
1016 struct l2tp_tunnel *tunnel)
1017 {
1018 struct l2tp_session *session;
1019
1020 if (!stats->session_id) {
1021 pppol2tp_copy_stats(stats, &tunnel->stats);
1022 return 0;
1023 }
1024
1025 /* If session_id is set, search the corresponding session in the
1026 * context of this tunnel and record the session's statistics.
1027 */
1028 session = l2tp_session_get(tunnel->l2tp_net, tunnel->sock, tunnel->version,
1029 tunnel->tunnel_id, stats->session_id);
1030 if (!session)
1031 return -EBADR;
1032
1033 if (session->pwtype != L2TP_PWTYPE_PPP) {
1034 l2tp_session_put(session);
1035 return -EBADR;
1036 }
1037
1038 pppol2tp_copy_stats(stats, &session->stats);
1039 l2tp_session_put(session);
1040
1041 return 0;
1042 }
1043
pppol2tp_ioctl(struct socket * sock,unsigned int cmd,unsigned long arg)1044 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
1045 unsigned long arg)
1046 {
1047 struct pppol2tp_ioc_stats stats;
1048 struct l2tp_session *session;
1049 int err = 0;
1050
1051 session = pppol2tp_sock_to_session(sock->sk);
1052
1053 /* Validate session presence and magic integrity ONLY for commands
1054 * that belong to L2TP and require a valid session.
1055 */
1056 switch (cmd) {
1057 case PPPIOCGMRU:
1058 case PPPIOCGFLAGS:
1059 case PPPIOCSMRU:
1060 case PPPIOCSFLAGS:
1061 case PPPIOCGL2TPSTATS:
1062 if (!session)
1063 return -ENOTCONN;
1064
1065 if (session->magic != L2TP_SESSION_MAGIC) {
1066 l2tp_session_put(session);
1067 return -EBADF;
1068 }
1069 break;
1070 default:
1071 break;
1072 }
1073
1074 switch (cmd) {
1075 case PPPIOCGMRU:
1076 case PPPIOCGFLAGS:
1077 /* Not defined for tunnels */
1078 if (!session->session_id && !session->peer_session_id) {
1079 err = -ENOSYS;
1080 break;
1081 }
1082
1083 if (put_user(0, (int __user *)arg)) {
1084 err = -EFAULT;
1085 break;
1086 }
1087 break;
1088
1089 case PPPIOCSMRU:
1090 case PPPIOCSFLAGS:
1091 /* Not defined for tunnels */
1092 if (!session->session_id && !session->peer_session_id) {
1093 err = -ENOSYS;
1094 break;
1095 }
1096
1097 if (!access_ok((int __user *)arg, sizeof(int))) {
1098 err = -EFAULT;
1099 break;
1100 }
1101 break;
1102
1103 case PPPIOCGL2TPSTATS:
1104 /* Session 0 represents the parent tunnel */
1105 if (!session->session_id && !session->peer_session_id) {
1106 u32 session_id;
1107
1108 if (copy_from_user(&stats, (void __user *)arg,
1109 sizeof(stats))) {
1110 err = -EFAULT;
1111 break;
1112 }
1113
1114 session_id = stats.session_id;
1115 err = pppol2tp_tunnel_copy_stats(&stats,
1116 session->tunnel);
1117 if (err < 0)
1118 break;
1119
1120 stats.session_id = session_id;
1121 } else {
1122 pppol2tp_copy_stats(&stats, &session->stats);
1123 stats.session_id = session->session_id;
1124 }
1125 stats.tunnel_id = session->tunnel->tunnel_id;
1126 stats.using_ipsec = l2tp_tunnel_uses_xfrm(session->tunnel);
1127
1128 if (copy_to_user((void __user *)arg, &stats, sizeof(stats))) {
1129 err = -EFAULT;
1130 break;
1131 }
1132 break;
1133
1134 default:
1135 err = -ENOIOCTLCMD;
1136 break;
1137 }
1138
1139 if (session)
1140 l2tp_session_put(session);
1141
1142 return err;
1143 }
1144
1145 /*****************************************************************************
1146 * setsockopt() / getsockopt() support.
1147 *
1148 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
1149 * sockets. In order to control kernel tunnel features, we allow userspace to
1150 * create a special "tunnel" PPPoX socket which is used for control only.
1151 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user
1152 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls.
1153 *****************************************************************************/
1154
1155 /* Tunnel setsockopt() helper.
1156 */
pppol2tp_tunnel_setsockopt(struct sock * sk,struct l2tp_tunnel * tunnel,int optname,int val)1157 static int pppol2tp_tunnel_setsockopt(struct sock *sk,
1158 struct l2tp_tunnel *tunnel,
1159 int optname, int val)
1160 {
1161 int err = 0;
1162
1163 switch (optname) {
1164 case PPPOL2TP_SO_DEBUG:
1165 /* Tunnel debug flags option is deprecated */
1166 break;
1167
1168 default:
1169 err = -ENOPROTOOPT;
1170 break;
1171 }
1172
1173 return err;
1174 }
1175
1176 /* Session setsockopt helper.
1177 */
pppol2tp_session_setsockopt(struct sock * sk,struct l2tp_session * session,int optname,int val)1178 static int pppol2tp_session_setsockopt(struct sock *sk,
1179 struct l2tp_session *session,
1180 int optname, int val)
1181 {
1182 int err = 0;
1183
1184 switch (optname) {
1185 case PPPOL2TP_SO_RECVSEQ:
1186 if (val != 0 && val != 1) {
1187 err = -EINVAL;
1188 break;
1189 }
1190 session->recv_seq = !!val;
1191 break;
1192
1193 case PPPOL2TP_SO_SENDSEQ:
1194 if (val != 0 && val != 1) {
1195 err = -EINVAL;
1196 break;
1197 }
1198 session->send_seq = !!val;
1199 l2tp_session_set_header_len(session, session->tunnel->version,
1200 session->tunnel->encap);
1201 break;
1202
1203 case PPPOL2TP_SO_LNSMODE:
1204 if (val != 0 && val != 1) {
1205 err = -EINVAL;
1206 break;
1207 }
1208 session->lns_mode = !!val;
1209 break;
1210
1211 case PPPOL2TP_SO_DEBUG:
1212 /* Session debug flags option is deprecated */
1213 break;
1214
1215 case PPPOL2TP_SO_REORDERTO:
1216 session->reorder_timeout = msecs_to_jiffies(val);
1217 break;
1218
1219 default:
1220 err = -ENOPROTOOPT;
1221 break;
1222 }
1223
1224 return err;
1225 }
1226
1227 /* Main setsockopt() entry point.
1228 * Does API checks, then calls either the tunnel or session setsockopt
1229 * handler, according to whether the PPPoL2TP socket is a for a regular
1230 * session or the special tunnel type.
1231 */
pppol2tp_setsockopt(struct socket * sock,int level,int optname,sockptr_t optval,unsigned int optlen)1232 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
1233 sockptr_t optval, unsigned int optlen)
1234 {
1235 struct sock *sk = sock->sk;
1236 struct l2tp_session *session;
1237 struct l2tp_tunnel *tunnel;
1238 int val;
1239 int err;
1240
1241 if (level != SOL_PPPOL2TP)
1242 return -EINVAL;
1243
1244 if (optlen < sizeof(int))
1245 return -EINVAL;
1246
1247 if (copy_from_sockptr(&val, optval, sizeof(int)))
1248 return -EFAULT;
1249
1250 err = -ENOTCONN;
1251 if (!sk->sk_user_data)
1252 goto end;
1253
1254 /* Get session context from the socket */
1255 err = -EBADF;
1256 session = pppol2tp_sock_to_session(sk);
1257 if (!session)
1258 goto end;
1259
1260 /* Special case: if session_id == 0x0000, treat as operation on tunnel
1261 */
1262 if (session->session_id == 0 && session->peer_session_id == 0) {
1263 tunnel = session->tunnel;
1264 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
1265 } else {
1266 err = pppol2tp_session_setsockopt(sk, session, optname, val);
1267 }
1268
1269 l2tp_session_put(session);
1270 end:
1271 return err;
1272 }
1273
1274 /* Tunnel getsockopt helper. Called with sock locked.
1275 */
pppol2tp_tunnel_getsockopt(struct sock * sk,struct l2tp_tunnel * tunnel,int optname,int * val)1276 static int pppol2tp_tunnel_getsockopt(struct sock *sk,
1277 struct l2tp_tunnel *tunnel,
1278 int optname, int *val)
1279 {
1280 int err = 0;
1281
1282 switch (optname) {
1283 case PPPOL2TP_SO_DEBUG:
1284 /* Tunnel debug flags option is deprecated */
1285 *val = 0;
1286 break;
1287
1288 default:
1289 err = -ENOPROTOOPT;
1290 break;
1291 }
1292
1293 return err;
1294 }
1295
1296 /* Session getsockopt helper. Called with sock locked.
1297 */
pppol2tp_session_getsockopt(struct sock * sk,struct l2tp_session * session,int optname,int * val)1298 static int pppol2tp_session_getsockopt(struct sock *sk,
1299 struct l2tp_session *session,
1300 int optname, int *val)
1301 {
1302 int err = 0;
1303
1304 switch (optname) {
1305 case PPPOL2TP_SO_RECVSEQ:
1306 *val = session->recv_seq;
1307 break;
1308
1309 case PPPOL2TP_SO_SENDSEQ:
1310 *val = session->send_seq;
1311 break;
1312
1313 case PPPOL2TP_SO_LNSMODE:
1314 *val = session->lns_mode;
1315 break;
1316
1317 case PPPOL2TP_SO_DEBUG:
1318 /* Session debug flags option is deprecated */
1319 *val = 0;
1320 break;
1321
1322 case PPPOL2TP_SO_REORDERTO:
1323 *val = (int)jiffies_to_msecs(session->reorder_timeout);
1324 break;
1325
1326 default:
1327 err = -ENOPROTOOPT;
1328 }
1329
1330 return err;
1331 }
1332
1333 /* Main getsockopt() entry point.
1334 * Does API checks, then calls either the tunnel or session getsockopt
1335 * handler, according to whether the PPPoX socket is a for a regular session
1336 * or the special tunnel type.
1337 */
pppol2tp_getsockopt(struct socket * sock,int level,int optname,sockopt_t * opt)1338 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
1339 sockopt_t *opt)
1340 {
1341 struct sock *sk = sock->sk;
1342 struct l2tp_session *session;
1343 struct l2tp_tunnel *tunnel;
1344 int val, len;
1345 int err;
1346
1347 if (level != SOL_PPPOL2TP)
1348 return -EINVAL;
1349
1350 len = opt->optlen;
1351 if (len < 0)
1352 return -EINVAL;
1353
1354 len = min_t(unsigned int, len, sizeof(int));
1355
1356 err = -ENOTCONN;
1357 if (!sk->sk_user_data)
1358 goto end;
1359
1360 /* Get the session context */
1361 err = -EBADF;
1362 session = pppol2tp_sock_to_session(sk);
1363 if (!session)
1364 goto end;
1365
1366 /* Special case: if session_id == 0x0000, treat as operation on tunnel */
1367 if (session->session_id == 0 && session->peer_session_id == 0) {
1368 tunnel = session->tunnel;
1369 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
1370 if (err)
1371 goto end_put_sess;
1372 } else {
1373 err = pppol2tp_session_getsockopt(sk, session, optname, &val);
1374 if (err)
1375 goto end_put_sess;
1376 }
1377
1378 opt->optlen = len;
1379 if (copy_to_iter(&val, len, &opt->iter_out) != len)
1380 err = -EFAULT;
1381
1382 end_put_sess:
1383 l2tp_session_put(session);
1384 end:
1385 return err;
1386 }
1387
1388 /*****************************************************************************
1389 * /proc filesystem for debug
1390 * Since the original pppol2tp driver provided /proc/net/pppol2tp for
1391 * L2TPv2, we dump only L2TPv2 tunnels and sessions here.
1392 *****************************************************************************/
1393
1394 #ifdef CONFIG_PROC_FS
1395
1396 struct pppol2tp_seq_data {
1397 struct seq_net_private p;
1398 unsigned long tkey; /* lookup key of current tunnel */
1399 unsigned long skey; /* lookup key of current session */
1400 struct l2tp_tunnel *tunnel;
1401 struct l2tp_session *session; /* NULL means get next tunnel */
1402 };
1403
pppol2tp_next_tunnel(struct net * net,struct pppol2tp_seq_data * pd)1404 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
1405 {
1406 /* Drop reference taken during previous invocation */
1407 if (pd->tunnel)
1408 l2tp_tunnel_put(pd->tunnel);
1409
1410 for (;;) {
1411 pd->tunnel = l2tp_tunnel_get_next(net, &pd->tkey);
1412 pd->tkey++;
1413
1414 /* Only accept L2TPv2 tunnels */
1415 if (!pd->tunnel || pd->tunnel->version == 2)
1416 return;
1417
1418 l2tp_tunnel_put(pd->tunnel);
1419 }
1420 }
1421
pppol2tp_next_session(struct net * net,struct pppol2tp_seq_data * pd)1422 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
1423 {
1424 /* Drop reference taken during previous invocation */
1425 if (pd->session)
1426 l2tp_session_put(pd->session);
1427
1428 pd->session = l2tp_session_get_next(net, pd->tunnel->sock,
1429 pd->tunnel->version,
1430 pd->tunnel->tunnel_id, &pd->skey);
1431 pd->skey++;
1432
1433 if (!pd->session) {
1434 pd->skey = 0;
1435 pppol2tp_next_tunnel(net, pd);
1436 }
1437 }
1438
pppol2tp_seq_start(struct seq_file * m,loff_t * offs)1439 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs)
1440 {
1441 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN;
1442 loff_t pos = *offs;
1443 struct net *net;
1444
1445 if (!pos)
1446 goto out;
1447
1448 if (WARN_ON(!m->private)) {
1449 pd = NULL;
1450 goto out;
1451 }
1452
1453 pd = m->private;
1454 net = seq_file_net(m);
1455
1456 if (!pd->tunnel)
1457 pppol2tp_next_tunnel(net, pd);
1458 else
1459 pppol2tp_next_session(net, pd);
1460
1461 /* NULL tunnel and session indicates end of list */
1462 if (!pd->tunnel && !pd->session)
1463 pd = NULL;
1464
1465 out:
1466 return pd;
1467 }
1468
pppol2tp_seq_next(struct seq_file * m,void * v,loff_t * pos)1469 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos)
1470 {
1471 (*pos)++;
1472 return NULL;
1473 }
1474
pppol2tp_seq_stop(struct seq_file * p,void * v)1475 static void pppol2tp_seq_stop(struct seq_file *p, void *v)
1476 {
1477 struct pppol2tp_seq_data *pd = v;
1478
1479 if (!pd || pd == SEQ_START_TOKEN)
1480 return;
1481
1482 /* Drop reference taken by last invocation of pppol2tp_next_session()
1483 * or pppol2tp_next_tunnel().
1484 */
1485 if (pd->session) {
1486 l2tp_session_put(pd->session);
1487 pd->session = NULL;
1488 }
1489 if (pd->tunnel) {
1490 l2tp_tunnel_put(pd->tunnel);
1491 pd->tunnel = NULL;
1492 }
1493 }
1494
pppol2tp_seq_tunnel_show(struct seq_file * m,void * v)1495 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
1496 {
1497 struct l2tp_tunnel *tunnel = v;
1498
1499 seq_printf(m, "\nTUNNEL '%s', %c %d\n",
1500 tunnel->name,
1501 tunnel->sock ? 'Y' : 'N',
1502 refcount_read(&tunnel->ref_count) - 1);
1503 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n",
1504 0,
1505 atomic_long_read(&tunnel->stats.tx_packets),
1506 atomic_long_read(&tunnel->stats.tx_bytes),
1507 atomic_long_read(&tunnel->stats.tx_errors),
1508 atomic_long_read(&tunnel->stats.rx_packets),
1509 atomic_long_read(&tunnel->stats.rx_bytes),
1510 atomic_long_read(&tunnel->stats.rx_errors));
1511 }
1512
pppol2tp_seq_session_show(struct seq_file * m,void * v)1513 static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
1514 {
1515 struct l2tp_session *session = v;
1516 struct l2tp_tunnel *tunnel = session->tunnel;
1517 unsigned char state;
1518 char user_data_ok;
1519 struct sock *sk;
1520 u32 ip = 0;
1521 u16 port = 0;
1522
1523 if (tunnel->sock) {
1524 struct inet_sock *inet = inet_sk(tunnel->sock);
1525
1526 ip = ntohl(inet->inet_saddr);
1527 port = ntohs(inet->inet_sport);
1528 }
1529
1530 rcu_read_lock();
1531 sk = pppol2tp_session_get_sock(session);
1532 if (sk) {
1533 state = sk->sk_state;
1534 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N';
1535 } else {
1536 state = 0;
1537 user_data_ok = 'N';
1538 }
1539
1540 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> %04X/%04X %d %c\n",
1541 session->name, ip, port,
1542 tunnel->tunnel_id,
1543 session->session_id,
1544 tunnel->peer_tunnel_id,
1545 session->peer_session_id,
1546 state, user_data_ok);
1547 seq_printf(m, " 0/0/%c/%c/%s %08x %u\n",
1548 session->recv_seq ? 'R' : '-',
1549 session->send_seq ? 'S' : '-',
1550 session->lns_mode ? "LNS" : "LAC",
1551 0,
1552 jiffies_to_msecs(session->reorder_timeout));
1553 seq_printf(m, " %u/%u %ld/%ld/%ld %ld/%ld/%ld\n",
1554 session->nr, session->ns,
1555 atomic_long_read(&session->stats.tx_packets),
1556 atomic_long_read(&session->stats.tx_bytes),
1557 atomic_long_read(&session->stats.tx_errors),
1558 atomic_long_read(&session->stats.rx_packets),
1559 atomic_long_read(&session->stats.rx_bytes),
1560 atomic_long_read(&session->stats.rx_errors));
1561
1562 if (sk) {
1563 struct pppox_sock *po = pppox_sk(sk);
1564
1565 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan));
1566 }
1567 rcu_read_unlock();
1568 }
1569
pppol2tp_seq_show(struct seq_file * m,void * v)1570 static int pppol2tp_seq_show(struct seq_file *m, void *v)
1571 {
1572 struct pppol2tp_seq_data *pd = v;
1573
1574 /* display header on line 1 */
1575 if (v == SEQ_START_TOKEN) {
1576 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n");
1577 seq_puts(m, "TUNNEL name, user-data-ok session-count\n");
1578 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1579 seq_puts(m, " SESSION name, addr/port src-tid/sid dest-tid/sid state user-data-ok\n");
1580 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n");
1581 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1582 goto out;
1583 }
1584
1585 if (!pd->session)
1586 pppol2tp_seq_tunnel_show(m, pd->tunnel);
1587 else
1588 pppol2tp_seq_session_show(m, pd->session);
1589
1590 out:
1591 return 0;
1592 }
1593
1594 static const struct seq_operations pppol2tp_seq_ops = {
1595 .start = pppol2tp_seq_start,
1596 .next = pppol2tp_seq_next,
1597 .stop = pppol2tp_seq_stop,
1598 .show = pppol2tp_seq_show,
1599 };
1600
pppol2tp_proc_open(struct inode * inode,struct file * file)1601 static int pppol2tp_proc_open(struct inode *inode, struct file *file)
1602 {
1603 struct net *net = pde_data(inode);
1604 struct pppol2tp_seq_data *pd;
1605
1606 net = maybe_get_net(net);
1607 if (!net)
1608 return -ENXIO;
1609
1610 pd = __seq_open_private(file, &pppol2tp_seq_ops, sizeof(*pd));
1611 if (!pd) {
1612 put_net(net);
1613 return -ENOMEM;
1614 }
1615
1616 #ifdef CONFIG_NET_NS
1617 pd->p.net = net;
1618 netns_tracker_alloc(net, &pd->p.ns_tracker, GFP_KERNEL);
1619 #endif
1620 return 0;
1621 }
1622
pppol2tp_proc_release(struct inode * inode,struct file * file)1623 static int pppol2tp_proc_release(struct inode *inode, struct file *file)
1624 {
1625 struct seq_file *seq = file->private_data;
1626 struct pppol2tp_seq_data *pd = seq->private;
1627
1628 if (pd->session)
1629 l2tp_session_put(pd->session);
1630 if (pd->tunnel)
1631 l2tp_tunnel_put(pd->tunnel);
1632
1633 #ifdef CONFIG_NET_NS
1634 put_net_track(pd->p.net, &pd->p.ns_tracker);
1635 #else
1636 put_net(&init_net);
1637 #endif
1638 return seq_release_private(inode, file);
1639 }
1640
1641 static const struct proc_ops pppol2tp_proc_ops = {
1642 .proc_open = pppol2tp_proc_open,
1643 .proc_read = seq_read,
1644 .proc_lseek = seq_lseek,
1645 .proc_release = pppol2tp_proc_release,
1646 };
1647
1648 /*****************************************************************************
1649 * Network namespace
1650 *****************************************************************************/
1651
pppol2tp_init_net(struct net * net)1652 static __net_init int pppol2tp_init_net(struct net *net)
1653 {
1654 struct proc_dir_entry *pde;
1655 int err = 0;
1656
1657 pde = proc_create_data("pppol2tp", 0444, net->proc_net,
1658 &pppol2tp_proc_ops, net);
1659 if (!pde) {
1660 err = -ENOMEM;
1661 goto out;
1662 }
1663
1664 out:
1665 return err;
1666 }
1667
pppol2tp_exit_net(struct net * net)1668 static __net_exit void pppol2tp_exit_net(struct net *net)
1669 {
1670 remove_proc_entry("pppol2tp", net->proc_net);
1671 }
1672
1673 #endif /* CONFIG_PROC_FS */
1674
1675 static struct pernet_operations pppol2tp_net_ops = {
1676 #ifdef CONFIG_PROC_FS
1677 .init = pppol2tp_init_net,
1678 .exit = pppol2tp_exit_net,
1679 #endif
1680 };
1681
1682 /*****************************************************************************
1683 * Init and cleanup
1684 *****************************************************************************/
1685
1686 static const struct proto_ops pppol2tp_ops = {
1687 .family = AF_PPPOX,
1688 .owner = THIS_MODULE,
1689 .release = pppol2tp_release,
1690 .bind = sock_no_bind,
1691 .connect = pppol2tp_connect,
1692 .socketpair = sock_no_socketpair,
1693 .accept = sock_no_accept,
1694 .getname = pppol2tp_getname,
1695 .poll = datagram_poll,
1696 .listen = sock_no_listen,
1697 .shutdown = sock_no_shutdown,
1698 .setsockopt = pppol2tp_setsockopt,
1699 .getsockopt_iter = pppol2tp_getsockopt,
1700 .sendmsg = pppol2tp_sendmsg,
1701 .recvmsg = pppol2tp_recvmsg,
1702 .mmap = sock_no_mmap,
1703 .ioctl = pppox_ioctl,
1704 #ifdef CONFIG_COMPAT
1705 .compat_ioctl = pppox_compat_ioctl,
1706 #endif
1707 };
1708
1709 static const struct pppox_proto pppol2tp_proto = {
1710 .create = pppol2tp_create,
1711 .ioctl = pppol2tp_ioctl,
1712 .owner = THIS_MODULE,
1713 };
1714
1715 #ifdef CONFIG_L2TP_V3
1716
1717 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = {
1718 .session_create = pppol2tp_session_create,
1719 .session_delete = l2tp_session_delete,
1720 };
1721
1722 #endif /* CONFIG_L2TP_V3 */
1723
pppol2tp_init(void)1724 static int __init pppol2tp_init(void)
1725 {
1726 int err;
1727
1728 err = register_pernet_device(&pppol2tp_net_ops);
1729 if (err)
1730 goto out;
1731
1732 err = proto_register(&pppol2tp_sk_proto, 0);
1733 if (err)
1734 goto out_unregister_pppol2tp_pernet;
1735
1736 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto);
1737 if (err)
1738 goto out_unregister_pppol2tp_proto;
1739
1740 #ifdef CONFIG_L2TP_V3
1741 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops);
1742 if (err)
1743 goto out_unregister_pppox;
1744 #endif
1745
1746 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION);
1747
1748 out:
1749 return err;
1750
1751 #ifdef CONFIG_L2TP_V3
1752 out_unregister_pppox:
1753 unregister_pppox_proto(PX_PROTO_OL2TP);
1754 #endif
1755 out_unregister_pppol2tp_proto:
1756 proto_unregister(&pppol2tp_sk_proto);
1757 out_unregister_pppol2tp_pernet:
1758 unregister_pernet_device(&pppol2tp_net_ops);
1759 goto out;
1760 }
1761
pppol2tp_exit(void)1762 static void __exit pppol2tp_exit(void)
1763 {
1764 #ifdef CONFIG_L2TP_V3
1765 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP);
1766 #endif
1767 unregister_pppox_proto(PX_PROTO_OL2TP);
1768 proto_unregister(&pppol2tp_sk_proto);
1769 unregister_pernet_device(&pppol2tp_net_ops);
1770 }
1771
1772 module_init(pppol2tp_init);
1773 module_exit(pppol2tp_exit);
1774
1775 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1776 MODULE_DESCRIPTION("PPP over L2TP over UDP");
1777 MODULE_LICENSE("GPL");
1778 MODULE_VERSION(PPPOL2TP_DRV_VERSION);
1779 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP);
1780 MODULE_ALIAS_L2TP_PWTYPE(7);
1781