1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /***************************************************************************** 3 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets 4 * 5 * PPPoX --- Generic PPP encapsulation socket family 6 * PPPoL2TP --- PPP over L2TP (RFC 2661) 7 * 8 * Version: 2.0.0 9 * 10 * Authors: James Chapman (jchapman@katalix.com) 11 * 12 * Based on original work by Martijn van Oosterhout <kleptog@svana.org> 13 * 14 * License: 15 */ 16 17 /* This driver handles only L2TP data frames; control frames are handled by a 18 * userspace application. 19 * 20 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and 21 * attaches it to a bound UDP socket with local tunnel_id / session_id and 22 * peer tunnel_id / session_id set. Data can then be sent or received using 23 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket 24 * can be read or modified using ioctl() or [gs]etsockopt() calls. 25 * 26 * When a PPPoL2TP socket is connected with local and peer session_id values 27 * zero, the socket is treated as a special tunnel management socket. 28 * 29 * Here's example userspace code to create a socket for sending/receiving data 30 * over an L2TP session:- 31 * 32 * struct sockaddr_pppol2tp sax; 33 * int fd; 34 * int session_fd; 35 * 36 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); 37 * 38 * sax.sa_family = AF_PPPOX; 39 * sax.sa_protocol = PX_PROTO_OL2TP; 40 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket 41 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr; 42 * sax.pppol2tp.addr.sin_port = addr->sin_port; 43 * sax.pppol2tp.addr.sin_family = AF_INET; 44 * sax.pppol2tp.s_tunnel = tunnel_id; 45 * sax.pppol2tp.s_session = session_id; 46 * sax.pppol2tp.d_tunnel = peer_tunnel_id; 47 * sax.pppol2tp.d_session = peer_session_id; 48 * 49 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax)); 50 * 51 * A pppd plugin that allows PPP traffic to be carried over L2TP using 52 * this driver is available from the OpenL2TP project at 53 * http://openl2tp.sourceforge.net. 54 */ 55 56 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 57 58 #include <linux/module.h> 59 #include <linux/string.h> 60 #include <linux/list.h> 61 #include <linux/uaccess.h> 62 63 #include <linux/kernel.h> 64 #include <linux/spinlock.h> 65 #include <linux/kthread.h> 66 #include <linux/sched.h> 67 #include <linux/slab.h> 68 #include <linux/errno.h> 69 #include <linux/jiffies.h> 70 71 #include <linux/netdevice.h> 72 #include <linux/net.h> 73 #include <linux/inetdevice.h> 74 #include <linux/skbuff.h> 75 #include <linux/init.h> 76 #include <linux/ip.h> 77 #include <linux/udp.h> 78 #include <linux/if_pppox.h> 79 #include <linux/if_pppol2tp.h> 80 #include <net/sock.h> 81 #include <linux/ppp_channel.h> 82 #include <linux/ppp_defs.h> 83 #include <linux/ppp-ioctl.h> 84 #include <linux/file.h> 85 #include <linux/hash.h> 86 #include <linux/sort.h> 87 #include <linux/proc_fs.h> 88 #include <linux/l2tp.h> 89 #include <linux/nsproxy.h> 90 #include <net/net_namespace.h> 91 #include <net/netns/generic.h> 92 #include <net/ip.h> 93 #include <net/udp.h> 94 #include <net/inet_common.h> 95 96 #include <asm/byteorder.h> 97 #include <linux/atomic.h> 98 99 #include "l2tp_core.h" 100 101 #define PPPOL2TP_DRV_VERSION "V2.0" 102 103 /* Space for UDP, L2TP and PPP headers */ 104 #define PPPOL2TP_HEADER_OVERHEAD 40 105 106 /* Number of bytes to build transmit L2TP headers. 107 * Unfortunately the size is different depending on whether sequence numbers 108 * are enabled. 109 */ 110 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10 111 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6 112 113 /* Private data of each session. This data lives at the end of struct 114 * l2tp_session, referenced via session->priv[]. 115 */ 116 struct pppol2tp_session { 117 int owner; /* pid that opened the socket */ 118 119 struct mutex sk_lock; /* Protects .sk */ 120 struct sock __rcu *sk; /* Pointer to the session PPPoX socket */ 121 struct sock *__sk; /* Copy of .sk, for cleanup */ 122 struct rcu_head rcu; /* For asynchronous release */ 123 }; 124 125 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb); 126 127 static const struct ppp_channel_ops pppol2tp_chan_ops = { 128 .start_xmit = pppol2tp_xmit, 129 }; 130 131 static const struct proto_ops pppol2tp_ops; 132 133 /* Retrieves the pppol2tp socket associated to a session. 134 * A reference is held on the returned socket, so this function must be paired 135 * with sock_put(). 136 */ 137 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) 138 { 139 struct pppol2tp_session *ps = l2tp_session_priv(session); 140 struct sock *sk; 141 142 rcu_read_lock(); 143 sk = rcu_dereference(ps->sk); 144 if (sk) 145 sock_hold(sk); 146 rcu_read_unlock(); 147 148 return sk; 149 } 150 151 /* Helpers to obtain tunnel/session contexts from sockets. 152 */ 153 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) 154 { 155 struct l2tp_session *session; 156 157 if (!sk) 158 return NULL; 159 160 sock_hold(sk); 161 session = (struct l2tp_session *)(sk->sk_user_data); 162 if (!session) { 163 sock_put(sk); 164 goto out; 165 } 166 if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) { 167 session = NULL; 168 sock_put(sk); 169 goto out; 170 } 171 172 out: 173 return session; 174 } 175 176 /***************************************************************************** 177 * Receive data handling 178 *****************************************************************************/ 179 180 /* Receive message. This is the recvmsg for the PPPoL2TP socket. 181 */ 182 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, 183 size_t len, int flags) 184 { 185 int err; 186 struct sk_buff *skb; 187 struct sock *sk = sock->sk; 188 189 err = -EIO; 190 if (sk->sk_state & PPPOX_BOUND) 191 goto end; 192 193 err = 0; 194 skb = skb_recv_datagram(sk, flags, &err); 195 if (!skb) 196 goto end; 197 198 if (len > skb->len) 199 len = skb->len; 200 else if (len < skb->len) 201 msg->msg_flags |= MSG_TRUNC; 202 203 err = skb_copy_datagram_msg(skb, 0, msg, len); 204 if (likely(err == 0)) 205 err = len; 206 207 kfree_skb(skb); 208 end: 209 return err; 210 } 211 212 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) 213 { 214 struct pppol2tp_session *ps = l2tp_session_priv(session); 215 struct sock *sk = NULL; 216 217 /* If the socket is bound, send it in to PPP's input queue. Otherwise 218 * queue it on the session socket. 219 */ 220 rcu_read_lock(); 221 sk = rcu_dereference(ps->sk); 222 if (!sk) 223 goto no_sock; 224 225 /* If the first two bytes are 0xFF03, consider that it is the PPP's 226 * Address and Control fields and skip them. The L2TP module has always 227 * worked this way, although, in theory, the use of these fields should 228 * be negotiated and handled at the PPP layer. These fields are 229 * constant: 0xFF is the All-Stations Address and 0x03 the Unnumbered 230 * Information command with Poll/Final bit set to zero (RFC 1662). 231 */ 232 if (pskb_may_pull(skb, 2) && skb->data[0] == PPP_ALLSTATIONS && 233 skb->data[1] == PPP_UI) 234 skb_pull(skb, 2); 235 236 if (sk->sk_state & PPPOX_BOUND) { 237 struct pppox_sock *po; 238 239 po = pppox_sk(sk); 240 ppp_input(&po->chan, skb); 241 } else { 242 if (sock_queue_rcv_skb(sk, skb) < 0) { 243 atomic_long_inc(&session->stats.rx_errors); 244 kfree_skb(skb); 245 } 246 } 247 rcu_read_unlock(); 248 249 return; 250 251 no_sock: 252 rcu_read_unlock(); 253 pr_warn_ratelimited("%s: no socket in recv\n", session->name); 254 kfree_skb(skb); 255 } 256 257 /************************************************************************ 258 * Transmit handling 259 ***********************************************************************/ 260 261 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here 262 * when a user application does a sendmsg() on the session socket. L2TP and 263 * PPP headers must be inserted into the user's data. 264 */ 265 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m, 266 size_t total_len) 267 { 268 struct sock *sk = sock->sk; 269 struct sk_buff *skb; 270 int error; 271 struct l2tp_session *session; 272 struct l2tp_tunnel *tunnel; 273 int uhlen; 274 275 error = -ENOTCONN; 276 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 277 goto error; 278 279 /* Get session and tunnel contexts */ 280 error = -EBADF; 281 session = pppol2tp_sock_to_session(sk); 282 if (!session) 283 goto error; 284 285 tunnel = session->tunnel; 286 287 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 288 289 /* Allocate a socket buffer */ 290 error = -ENOMEM; 291 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 292 uhlen + session->hdr_len + 293 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 294 0, GFP_KERNEL); 295 if (!skb) 296 goto error_put_sess; 297 298 /* Reserve space for headers. */ 299 skb_reserve(skb, NET_SKB_PAD); 300 skb_reset_network_header(skb); 301 skb_reserve(skb, sizeof(struct iphdr)); 302 skb_reset_transport_header(skb); 303 skb_reserve(skb, uhlen); 304 305 /* Add PPP header */ 306 skb->data[0] = PPP_ALLSTATIONS; 307 skb->data[1] = PPP_UI; 308 skb_put(skb, 2); 309 310 /* Copy user data into skb */ 311 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len); 312 if (error < 0) { 313 kfree_skb(skb); 314 goto error_put_sess; 315 } 316 317 local_bh_disable(); 318 l2tp_xmit_skb(session, skb); 319 local_bh_enable(); 320 321 sock_put(sk); 322 323 return total_len; 324 325 error_put_sess: 326 sock_put(sk); 327 error: 328 return error; 329 } 330 331 /* Transmit function called by generic PPP driver. Sends PPP frame 332 * over PPPoL2TP socket. 333 * 334 * This is almost the same as pppol2tp_sendmsg(), but rather than 335 * being called with a msghdr from userspace, it is called with a skb 336 * from the kernel. 337 * 338 * The supplied skb from ppp doesn't have enough headroom for the 339 * insertion of L2TP, UDP and IP headers so we need to allocate more 340 * headroom in the skb. This will create a cloned skb. But we must be 341 * careful in the error case because the caller will expect to free 342 * the skb it supplied, not our cloned skb. So we take care to always 343 * leave the original skb unfreed if we return an error. 344 */ 345 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) 346 { 347 struct sock *sk = (struct sock *)chan->private; 348 struct l2tp_session *session; 349 struct l2tp_tunnel *tunnel; 350 int uhlen, headroom; 351 352 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 353 goto abort; 354 355 /* Get session and tunnel contexts from the socket */ 356 session = pppol2tp_sock_to_session(sk); 357 if (!session) 358 goto abort; 359 360 tunnel = session->tunnel; 361 362 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 363 headroom = NET_SKB_PAD + 364 sizeof(struct iphdr) + /* IP header */ 365 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */ 366 session->hdr_len + /* L2TP header */ 367 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 368 if (skb_cow_head(skb, headroom)) 369 goto abort_put_sess; 370 371 /* Setup PPP header */ 372 __skb_push(skb, 2); 373 skb->data[0] = PPP_ALLSTATIONS; 374 skb->data[1] = PPP_UI; 375 376 local_bh_disable(); 377 l2tp_xmit_skb(session, skb); 378 local_bh_enable(); 379 380 sock_put(sk); 381 382 return 1; 383 384 abort_put_sess: 385 sock_put(sk); 386 abort: 387 /* Free the original skb */ 388 kfree_skb(skb); 389 return 1; 390 } 391 392 /***************************************************************************** 393 * Session (and tunnel control) socket create/destroy. 394 *****************************************************************************/ 395 396 static void pppol2tp_put_sk(struct rcu_head *head) 397 { 398 struct pppol2tp_session *ps; 399 400 ps = container_of(head, typeof(*ps), rcu); 401 sock_put(ps->__sk); 402 } 403 404 /* Really kill the session socket. (Called from sock_put() if 405 * refcnt == 0.) 406 */ 407 static void pppol2tp_session_destruct(struct sock *sk) 408 { 409 struct l2tp_session *session = sk->sk_user_data; 410 411 skb_queue_purge(&sk->sk_receive_queue); 412 skb_queue_purge(&sk->sk_write_queue); 413 414 if (session) { 415 sk->sk_user_data = NULL; 416 if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) 417 return; 418 l2tp_session_dec_refcount(session); 419 } 420 } 421 422 /* Called when the PPPoX socket (session) is closed. 423 */ 424 static int pppol2tp_release(struct socket *sock) 425 { 426 struct sock *sk = sock->sk; 427 struct l2tp_session *session; 428 int error; 429 430 if (!sk) 431 return 0; 432 433 error = -EBADF; 434 lock_sock(sk); 435 if (sock_flag(sk, SOCK_DEAD) != 0) 436 goto error; 437 438 pppox_unbind_sock(sk); 439 440 /* Signal the death of the socket. */ 441 sk->sk_state = PPPOX_DEAD; 442 sock_orphan(sk); 443 sock->sk = NULL; 444 445 session = pppol2tp_sock_to_session(sk); 446 if (session) { 447 struct pppol2tp_session *ps; 448 449 l2tp_session_delete(session); 450 451 ps = l2tp_session_priv(session); 452 mutex_lock(&ps->sk_lock); 453 ps->__sk = rcu_dereference_protected(ps->sk, 454 lockdep_is_held(&ps->sk_lock)); 455 RCU_INIT_POINTER(ps->sk, NULL); 456 mutex_unlock(&ps->sk_lock); 457 call_rcu(&ps->rcu, pppol2tp_put_sk); 458 459 /* Rely on the sock_put() call at the end of the function for 460 * dropping the reference held by pppol2tp_sock_to_session(). 461 * The last reference will be dropped by pppol2tp_put_sk(). 462 */ 463 } 464 465 release_sock(sk); 466 467 /* This will delete the session context via 468 * pppol2tp_session_destruct() if the socket's refcnt drops to 469 * zero. 470 */ 471 sock_put(sk); 472 473 return 0; 474 475 error: 476 release_sock(sk); 477 return error; 478 } 479 480 static struct proto pppol2tp_sk_proto = { 481 .name = "PPPOL2TP", 482 .owner = THIS_MODULE, 483 .obj_size = sizeof(struct pppox_sock), 484 }; 485 486 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb) 487 { 488 int rc; 489 490 rc = l2tp_udp_encap_recv(sk, skb); 491 if (rc) 492 kfree_skb(skb); 493 494 return NET_RX_SUCCESS; 495 } 496 497 /* socket() handler. Initialize a new struct sock. 498 */ 499 static int pppol2tp_create(struct net *net, struct socket *sock, int kern) 500 { 501 int error = -ENOMEM; 502 struct sock *sk; 503 504 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern); 505 if (!sk) 506 goto out; 507 508 sock_init_data(sock, sk); 509 510 sock->state = SS_UNCONNECTED; 511 sock->ops = &pppol2tp_ops; 512 513 sk->sk_backlog_rcv = pppol2tp_backlog_recv; 514 sk->sk_protocol = PX_PROTO_OL2TP; 515 sk->sk_family = PF_PPPOX; 516 sk->sk_state = PPPOX_NONE; 517 sk->sk_type = SOCK_STREAM; 518 sk->sk_destruct = pppol2tp_session_destruct; 519 520 error = 0; 521 522 out: 523 return error; 524 } 525 526 static void pppol2tp_show(struct seq_file *m, void *arg) 527 { 528 struct l2tp_session *session = arg; 529 struct sock *sk; 530 531 sk = pppol2tp_session_get_sock(session); 532 if (sk) { 533 struct pppox_sock *po = pppox_sk(sk); 534 535 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 536 sock_put(sk); 537 } 538 } 539 540 static void pppol2tp_session_init(struct l2tp_session *session) 541 { 542 struct pppol2tp_session *ps; 543 544 session->recv_skb = pppol2tp_recv; 545 if (IS_ENABLED(CONFIG_L2TP_DEBUGFS)) 546 session->show = pppol2tp_show; 547 548 ps = l2tp_session_priv(session); 549 mutex_init(&ps->sk_lock); 550 ps->owner = current->pid; 551 } 552 553 struct l2tp_connect_info { 554 u8 version; 555 int fd; 556 u32 tunnel_id; 557 u32 peer_tunnel_id; 558 u32 session_id; 559 u32 peer_session_id; 560 }; 561 562 static int pppol2tp_sockaddr_get_info(const void *sa, int sa_len, 563 struct l2tp_connect_info *info) 564 { 565 switch (sa_len) { 566 case sizeof(struct sockaddr_pppol2tp): 567 { 568 const struct sockaddr_pppol2tp *sa_v2in4 = sa; 569 570 if (sa_v2in4->sa_protocol != PX_PROTO_OL2TP) 571 return -EINVAL; 572 573 info->version = 2; 574 info->fd = sa_v2in4->pppol2tp.fd; 575 info->tunnel_id = sa_v2in4->pppol2tp.s_tunnel; 576 info->peer_tunnel_id = sa_v2in4->pppol2tp.d_tunnel; 577 info->session_id = sa_v2in4->pppol2tp.s_session; 578 info->peer_session_id = sa_v2in4->pppol2tp.d_session; 579 580 break; 581 } 582 case sizeof(struct sockaddr_pppol2tpv3): 583 { 584 const struct sockaddr_pppol2tpv3 *sa_v3in4 = sa; 585 586 if (sa_v3in4->sa_protocol != PX_PROTO_OL2TP) 587 return -EINVAL; 588 589 info->version = 3; 590 info->fd = sa_v3in4->pppol2tp.fd; 591 info->tunnel_id = sa_v3in4->pppol2tp.s_tunnel; 592 info->peer_tunnel_id = sa_v3in4->pppol2tp.d_tunnel; 593 info->session_id = sa_v3in4->pppol2tp.s_session; 594 info->peer_session_id = sa_v3in4->pppol2tp.d_session; 595 596 break; 597 } 598 case sizeof(struct sockaddr_pppol2tpin6): 599 { 600 const struct sockaddr_pppol2tpin6 *sa_v2in6 = sa; 601 602 if (sa_v2in6->sa_protocol != PX_PROTO_OL2TP) 603 return -EINVAL; 604 605 info->version = 2; 606 info->fd = sa_v2in6->pppol2tp.fd; 607 info->tunnel_id = sa_v2in6->pppol2tp.s_tunnel; 608 info->peer_tunnel_id = sa_v2in6->pppol2tp.d_tunnel; 609 info->session_id = sa_v2in6->pppol2tp.s_session; 610 info->peer_session_id = sa_v2in6->pppol2tp.d_session; 611 612 break; 613 } 614 case sizeof(struct sockaddr_pppol2tpv3in6): 615 { 616 const struct sockaddr_pppol2tpv3in6 *sa_v3in6 = sa; 617 618 if (sa_v3in6->sa_protocol != PX_PROTO_OL2TP) 619 return -EINVAL; 620 621 info->version = 3; 622 info->fd = sa_v3in6->pppol2tp.fd; 623 info->tunnel_id = sa_v3in6->pppol2tp.s_tunnel; 624 info->peer_tunnel_id = sa_v3in6->pppol2tp.d_tunnel; 625 info->session_id = sa_v3in6->pppol2tp.s_session; 626 info->peer_session_id = sa_v3in6->pppol2tp.d_session; 627 628 break; 629 } 630 default: 631 return -EINVAL; 632 } 633 634 return 0; 635 } 636 637 /* Rough estimation of the maximum payload size a tunnel can transmit without 638 * fragmenting at the lower IP layer. Assumes L2TPv2 with sequence 639 * numbers and no IP option. Not quite accurate, but the result is mostly 640 * unused anyway. 641 */ 642 static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel) 643 { 644 int mtu; 645 646 mtu = l2tp_tunnel_dst_mtu(tunnel); 647 if (mtu <= PPPOL2TP_HEADER_OVERHEAD) 648 return 1500 - PPPOL2TP_HEADER_OVERHEAD; 649 650 return mtu - PPPOL2TP_HEADER_OVERHEAD; 651 } 652 653 static struct l2tp_tunnel *pppol2tp_tunnel_get(struct net *net, 654 const struct l2tp_connect_info *info, 655 bool *new_tunnel) 656 { 657 struct l2tp_tunnel *tunnel; 658 int error; 659 660 *new_tunnel = false; 661 662 tunnel = l2tp_tunnel_get(net, info->tunnel_id); 663 664 /* Special case: create tunnel context if session_id and 665 * peer_session_id is 0. Otherwise look up tunnel using supplied 666 * tunnel id. 667 */ 668 if (!info->session_id && !info->peer_session_id) { 669 if (!tunnel) { 670 struct l2tp_tunnel_cfg tcfg = { 671 .encap = L2TP_ENCAPTYPE_UDP, 672 }; 673 674 /* Prevent l2tp_tunnel_register() from trying to set up 675 * a kernel socket. 676 */ 677 if (info->fd < 0) 678 return ERR_PTR(-EBADF); 679 680 error = l2tp_tunnel_create(info->fd, 681 info->version, 682 info->tunnel_id, 683 info->peer_tunnel_id, &tcfg, 684 &tunnel); 685 if (error < 0) 686 return ERR_PTR(error); 687 688 l2tp_tunnel_inc_refcount(tunnel); 689 error = l2tp_tunnel_register(tunnel, net, &tcfg); 690 if (error < 0) { 691 kfree(tunnel); 692 return ERR_PTR(error); 693 } 694 695 *new_tunnel = true; 696 } 697 } else { 698 /* Error if we can't find the tunnel */ 699 if (!tunnel) 700 return ERR_PTR(-ENOENT); 701 702 /* Error if socket is not prepped */ 703 if (!tunnel->sock) { 704 l2tp_tunnel_dec_refcount(tunnel); 705 return ERR_PTR(-ENOENT); 706 } 707 } 708 709 return tunnel; 710 } 711 712 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket 713 */ 714 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 715 int sockaddr_len, int flags) 716 { 717 struct sock *sk = sock->sk; 718 struct pppox_sock *po = pppox_sk(sk); 719 struct l2tp_session *session = NULL; 720 struct l2tp_connect_info info; 721 struct l2tp_tunnel *tunnel; 722 struct pppol2tp_session *ps; 723 struct l2tp_session_cfg cfg = { 0, }; 724 bool drop_refcnt = false; 725 bool new_session = false; 726 bool new_tunnel = false; 727 int error; 728 729 error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info); 730 if (error < 0) 731 return error; 732 733 /* Don't bind if tunnel_id is 0 */ 734 if (!info.tunnel_id) 735 return -EINVAL; 736 737 tunnel = pppol2tp_tunnel_get(sock_net(sk), &info, &new_tunnel); 738 if (IS_ERR(tunnel)) 739 return PTR_ERR(tunnel); 740 741 lock_sock(sk); 742 743 /* Check for already bound sockets */ 744 error = -EBUSY; 745 if (sk->sk_state & PPPOX_CONNECTED) 746 goto end; 747 748 /* We don't supporting rebinding anyway */ 749 error = -EALREADY; 750 if (sk->sk_user_data) 751 goto end; /* socket is already attached */ 752 753 if (tunnel->peer_tunnel_id == 0) 754 tunnel->peer_tunnel_id = info.peer_tunnel_id; 755 756 session = l2tp_session_get(sock_net(sk), tunnel->sock, tunnel->version, 757 info.tunnel_id, info.session_id); 758 if (session) { 759 drop_refcnt = true; 760 761 if (session->pwtype != L2TP_PWTYPE_PPP) { 762 error = -EPROTOTYPE; 763 goto end; 764 } 765 766 ps = l2tp_session_priv(session); 767 768 /* Using a pre-existing session is fine as long as it hasn't 769 * been connected yet. 770 */ 771 mutex_lock(&ps->sk_lock); 772 if (rcu_dereference_protected(ps->sk, 773 lockdep_is_held(&ps->sk_lock)) || 774 ps->__sk) { 775 mutex_unlock(&ps->sk_lock); 776 error = -EEXIST; 777 goto end; 778 } 779 } else { 780 cfg.pw_type = L2TP_PWTYPE_PPP; 781 782 session = l2tp_session_create(sizeof(struct pppol2tp_session), 783 tunnel, info.session_id, 784 info.peer_session_id, &cfg); 785 if (IS_ERR(session)) { 786 error = PTR_ERR(session); 787 goto end; 788 } 789 790 pppol2tp_session_init(session); 791 ps = l2tp_session_priv(session); 792 l2tp_session_inc_refcount(session); 793 794 mutex_lock(&ps->sk_lock); 795 error = l2tp_session_register(session, tunnel); 796 if (error < 0) { 797 mutex_unlock(&ps->sk_lock); 798 kfree(session); 799 goto end; 800 } 801 drop_refcnt = true; 802 new_session = true; 803 } 804 805 /* Special case: if source & dest session_id == 0x0000, this 806 * socket is being created to manage the tunnel. Just set up 807 * the internal context for use by ioctl() and sockopt() 808 * handlers. 809 */ 810 if (session->session_id == 0 && session->peer_session_id == 0) { 811 error = 0; 812 goto out_no_ppp; 813 } 814 815 /* The only header we need to worry about is the L2TP 816 * header. This size is different depending on whether 817 * sequence numbers are enabled for the data channel. 818 */ 819 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 820 821 po->chan.private = sk; 822 po->chan.ops = &pppol2tp_chan_ops; 823 po->chan.mtu = pppol2tp_tunnel_mtu(tunnel); 824 825 error = ppp_register_net_channel(sock_net(sk), &po->chan); 826 if (error) { 827 mutex_unlock(&ps->sk_lock); 828 goto end; 829 } 830 831 out_no_ppp: 832 /* This is how we get the session context from the socket. */ 833 sk->sk_user_data = session; 834 rcu_assign_pointer(ps->sk, sk); 835 mutex_unlock(&ps->sk_lock); 836 837 /* Keep the reference we've grabbed on the session: sk doesn't expect 838 * the session to disappear. pppol2tp_session_destruct() is responsible 839 * for dropping it. 840 */ 841 drop_refcnt = false; 842 843 sk->sk_state = PPPOX_CONNECTED; 844 845 end: 846 if (error) { 847 if (new_session) 848 l2tp_session_delete(session); 849 if (new_tunnel) 850 l2tp_tunnel_delete(tunnel); 851 } 852 if (drop_refcnt) 853 l2tp_session_dec_refcount(session); 854 l2tp_tunnel_dec_refcount(tunnel); 855 release_sock(sk); 856 857 return error; 858 } 859 860 #ifdef CONFIG_L2TP_V3 861 862 /* Called when creating sessions via the netlink interface. */ 863 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, 864 u32 session_id, u32 peer_session_id, 865 struct l2tp_session_cfg *cfg) 866 { 867 int error; 868 struct l2tp_session *session; 869 870 /* Error if tunnel socket is not prepped */ 871 if (!tunnel->sock) { 872 error = -ENOENT; 873 goto err; 874 } 875 876 /* Allocate and initialize a new session context. */ 877 session = l2tp_session_create(sizeof(struct pppol2tp_session), 878 tunnel, session_id, 879 peer_session_id, cfg); 880 if (IS_ERR(session)) { 881 error = PTR_ERR(session); 882 goto err; 883 } 884 885 pppol2tp_session_init(session); 886 887 error = l2tp_session_register(session, tunnel); 888 if (error < 0) 889 goto err_sess; 890 891 return 0; 892 893 err_sess: 894 kfree(session); 895 err: 896 return error; 897 } 898 899 #endif /* CONFIG_L2TP_V3 */ 900 901 /* getname() support. 902 */ 903 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr, 904 int peer) 905 { 906 int len = 0; 907 int error = 0; 908 struct l2tp_session *session; 909 struct l2tp_tunnel *tunnel; 910 struct sock *sk = sock->sk; 911 struct inet_sock *inet; 912 struct pppol2tp_session *pls; 913 914 error = -ENOTCONN; 915 if (!sk) 916 goto end; 917 if (!(sk->sk_state & PPPOX_CONNECTED)) 918 goto end; 919 920 error = -EBADF; 921 session = pppol2tp_sock_to_session(sk); 922 if (!session) 923 goto end; 924 925 pls = l2tp_session_priv(session); 926 tunnel = session->tunnel; 927 928 inet = inet_sk(tunnel->sock); 929 if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET) { 930 struct sockaddr_pppol2tp sp; 931 932 len = sizeof(sp); 933 memset(&sp, 0, len); 934 sp.sa_family = AF_PPPOX; 935 sp.sa_protocol = PX_PROTO_OL2TP; 936 sp.pppol2tp.fd = tunnel->fd; 937 sp.pppol2tp.pid = pls->owner; 938 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 939 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 940 sp.pppol2tp.s_session = session->session_id; 941 sp.pppol2tp.d_session = session->peer_session_id; 942 sp.pppol2tp.addr.sin_family = AF_INET; 943 sp.pppol2tp.addr.sin_port = inet->inet_dport; 944 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 945 memcpy(uaddr, &sp, len); 946 #if IS_ENABLED(CONFIG_IPV6) 947 } else if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET6) { 948 struct sockaddr_pppol2tpin6 sp; 949 950 len = sizeof(sp); 951 memset(&sp, 0, len); 952 sp.sa_family = AF_PPPOX; 953 sp.sa_protocol = PX_PROTO_OL2TP; 954 sp.pppol2tp.fd = tunnel->fd; 955 sp.pppol2tp.pid = pls->owner; 956 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 957 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 958 sp.pppol2tp.s_session = session->session_id; 959 sp.pppol2tp.d_session = session->peer_session_id; 960 sp.pppol2tp.addr.sin6_family = AF_INET6; 961 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 962 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 963 sizeof(tunnel->sock->sk_v6_daddr)); 964 memcpy(uaddr, &sp, len); 965 } else if (tunnel->version == 3 && tunnel->sock->sk_family == AF_INET6) { 966 struct sockaddr_pppol2tpv3in6 sp; 967 968 len = sizeof(sp); 969 memset(&sp, 0, len); 970 sp.sa_family = AF_PPPOX; 971 sp.sa_protocol = PX_PROTO_OL2TP; 972 sp.pppol2tp.fd = tunnel->fd; 973 sp.pppol2tp.pid = pls->owner; 974 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 975 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 976 sp.pppol2tp.s_session = session->session_id; 977 sp.pppol2tp.d_session = session->peer_session_id; 978 sp.pppol2tp.addr.sin6_family = AF_INET6; 979 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 980 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 981 sizeof(tunnel->sock->sk_v6_daddr)); 982 memcpy(uaddr, &sp, len); 983 #endif 984 } else if (tunnel->version == 3) { 985 struct sockaddr_pppol2tpv3 sp; 986 987 len = sizeof(sp); 988 memset(&sp, 0, len); 989 sp.sa_family = AF_PPPOX; 990 sp.sa_protocol = PX_PROTO_OL2TP; 991 sp.pppol2tp.fd = tunnel->fd; 992 sp.pppol2tp.pid = pls->owner; 993 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 994 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 995 sp.pppol2tp.s_session = session->session_id; 996 sp.pppol2tp.d_session = session->peer_session_id; 997 sp.pppol2tp.addr.sin_family = AF_INET; 998 sp.pppol2tp.addr.sin_port = inet->inet_dport; 999 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 1000 memcpy(uaddr, &sp, len); 1001 } 1002 1003 error = len; 1004 1005 sock_put(sk); 1006 end: 1007 return error; 1008 } 1009 1010 /**************************************************************************** 1011 * ioctl() handlers. 1012 * 1013 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1014 * sockets. However, in order to control kernel tunnel features, we allow 1015 * userspace to create a special "tunnel" PPPoX socket which is used for 1016 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow 1017 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl() 1018 * calls. 1019 ****************************************************************************/ 1020 1021 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest, 1022 const struct l2tp_stats *stats) 1023 { 1024 memset(dest, 0, sizeof(*dest)); 1025 1026 dest->tx_packets = atomic_long_read(&stats->tx_packets); 1027 dest->tx_bytes = atomic_long_read(&stats->tx_bytes); 1028 dest->tx_errors = atomic_long_read(&stats->tx_errors); 1029 dest->rx_packets = atomic_long_read(&stats->rx_packets); 1030 dest->rx_bytes = atomic_long_read(&stats->rx_bytes); 1031 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards); 1032 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets); 1033 dest->rx_errors = atomic_long_read(&stats->rx_errors); 1034 } 1035 1036 static int pppol2tp_tunnel_copy_stats(struct pppol2tp_ioc_stats *stats, 1037 struct l2tp_tunnel *tunnel) 1038 { 1039 struct l2tp_session *session; 1040 1041 if (!stats->session_id) { 1042 pppol2tp_copy_stats(stats, &tunnel->stats); 1043 return 0; 1044 } 1045 1046 /* If session_id is set, search the corresponding session in the 1047 * context of this tunnel and record the session's statistics. 1048 */ 1049 session = l2tp_session_get(tunnel->l2tp_net, tunnel->sock, tunnel->version, 1050 tunnel->tunnel_id, stats->session_id); 1051 if (!session) 1052 return -EBADR; 1053 1054 if (session->pwtype != L2TP_PWTYPE_PPP) { 1055 l2tp_session_dec_refcount(session); 1056 return -EBADR; 1057 } 1058 1059 pppol2tp_copy_stats(stats, &session->stats); 1060 l2tp_session_dec_refcount(session); 1061 1062 return 0; 1063 } 1064 1065 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, 1066 unsigned long arg) 1067 { 1068 struct pppol2tp_ioc_stats stats; 1069 struct l2tp_session *session; 1070 1071 switch (cmd) { 1072 case PPPIOCGMRU: 1073 case PPPIOCGFLAGS: 1074 session = sock->sk->sk_user_data; 1075 if (!session) 1076 return -ENOTCONN; 1077 1078 if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) 1079 return -EBADF; 1080 1081 /* Not defined for tunnels */ 1082 if (!session->session_id && !session->peer_session_id) 1083 return -ENOSYS; 1084 1085 if (put_user(0, (int __user *)arg)) 1086 return -EFAULT; 1087 break; 1088 1089 case PPPIOCSMRU: 1090 case PPPIOCSFLAGS: 1091 session = sock->sk->sk_user_data; 1092 if (!session) 1093 return -ENOTCONN; 1094 1095 if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) 1096 return -EBADF; 1097 1098 /* Not defined for tunnels */ 1099 if (!session->session_id && !session->peer_session_id) 1100 return -ENOSYS; 1101 1102 if (!access_ok((int __user *)arg, sizeof(int))) 1103 return -EFAULT; 1104 break; 1105 1106 case PPPIOCGL2TPSTATS: 1107 session = sock->sk->sk_user_data; 1108 if (!session) 1109 return -ENOTCONN; 1110 1111 if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) 1112 return -EBADF; 1113 1114 /* Session 0 represents the parent tunnel */ 1115 if (!session->session_id && !session->peer_session_id) { 1116 u32 session_id; 1117 int err; 1118 1119 if (copy_from_user(&stats, (void __user *)arg, 1120 sizeof(stats))) 1121 return -EFAULT; 1122 1123 session_id = stats.session_id; 1124 err = pppol2tp_tunnel_copy_stats(&stats, 1125 session->tunnel); 1126 if (err < 0) 1127 return err; 1128 1129 stats.session_id = session_id; 1130 } else { 1131 pppol2tp_copy_stats(&stats, &session->stats); 1132 stats.session_id = session->session_id; 1133 } 1134 stats.tunnel_id = session->tunnel->tunnel_id; 1135 stats.using_ipsec = l2tp_tunnel_uses_xfrm(session->tunnel); 1136 1137 if (copy_to_user((void __user *)arg, &stats, sizeof(stats))) 1138 return -EFAULT; 1139 break; 1140 1141 default: 1142 return -ENOIOCTLCMD; 1143 } 1144 1145 return 0; 1146 } 1147 1148 /***************************************************************************** 1149 * setsockopt() / getsockopt() support. 1150 * 1151 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1152 * sockets. In order to control kernel tunnel features, we allow userspace to 1153 * create a special "tunnel" PPPoX socket which is used for control only. 1154 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user 1155 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls. 1156 *****************************************************************************/ 1157 1158 /* Tunnel setsockopt() helper. 1159 */ 1160 static int pppol2tp_tunnel_setsockopt(struct sock *sk, 1161 struct l2tp_tunnel *tunnel, 1162 int optname, int val) 1163 { 1164 int err = 0; 1165 1166 switch (optname) { 1167 case PPPOL2TP_SO_DEBUG: 1168 /* Tunnel debug flags option is deprecated */ 1169 break; 1170 1171 default: 1172 err = -ENOPROTOOPT; 1173 break; 1174 } 1175 1176 return err; 1177 } 1178 1179 /* Session setsockopt helper. 1180 */ 1181 static int pppol2tp_session_setsockopt(struct sock *sk, 1182 struct l2tp_session *session, 1183 int optname, int val) 1184 { 1185 int err = 0; 1186 1187 switch (optname) { 1188 case PPPOL2TP_SO_RECVSEQ: 1189 if (val != 0 && val != 1) { 1190 err = -EINVAL; 1191 break; 1192 } 1193 session->recv_seq = !!val; 1194 break; 1195 1196 case PPPOL2TP_SO_SENDSEQ: 1197 if (val != 0 && val != 1) { 1198 err = -EINVAL; 1199 break; 1200 } 1201 session->send_seq = !!val; 1202 { 1203 struct pppox_sock *po = pppox_sk(sk); 1204 1205 po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ : 1206 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 1207 } 1208 l2tp_session_set_header_len(session, session->tunnel->version); 1209 break; 1210 1211 case PPPOL2TP_SO_LNSMODE: 1212 if (val != 0 && val != 1) { 1213 err = -EINVAL; 1214 break; 1215 } 1216 session->lns_mode = !!val; 1217 break; 1218 1219 case PPPOL2TP_SO_DEBUG: 1220 /* Session debug flags option is deprecated */ 1221 break; 1222 1223 case PPPOL2TP_SO_REORDERTO: 1224 session->reorder_timeout = msecs_to_jiffies(val); 1225 break; 1226 1227 default: 1228 err = -ENOPROTOOPT; 1229 break; 1230 } 1231 1232 return err; 1233 } 1234 1235 /* Main setsockopt() entry point. 1236 * Does API checks, then calls either the tunnel or session setsockopt 1237 * handler, according to whether the PPPoL2TP socket is a for a regular 1238 * session or the special tunnel type. 1239 */ 1240 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, 1241 sockptr_t optval, unsigned int optlen) 1242 { 1243 struct sock *sk = sock->sk; 1244 struct l2tp_session *session; 1245 struct l2tp_tunnel *tunnel; 1246 int val; 1247 int err; 1248 1249 if (level != SOL_PPPOL2TP) 1250 return -EINVAL; 1251 1252 if (optlen < sizeof(int)) 1253 return -EINVAL; 1254 1255 if (copy_from_sockptr(&val, optval, sizeof(int))) 1256 return -EFAULT; 1257 1258 err = -ENOTCONN; 1259 if (!sk->sk_user_data) 1260 goto end; 1261 1262 /* Get session context from the socket */ 1263 err = -EBADF; 1264 session = pppol2tp_sock_to_session(sk); 1265 if (!session) 1266 goto end; 1267 1268 /* Special case: if session_id == 0x0000, treat as operation on tunnel 1269 */ 1270 if (session->session_id == 0 && session->peer_session_id == 0) { 1271 tunnel = session->tunnel; 1272 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val); 1273 } else { 1274 err = pppol2tp_session_setsockopt(sk, session, optname, val); 1275 } 1276 1277 sock_put(sk); 1278 end: 1279 return err; 1280 } 1281 1282 /* Tunnel getsockopt helper. Called with sock locked. 1283 */ 1284 static int pppol2tp_tunnel_getsockopt(struct sock *sk, 1285 struct l2tp_tunnel *tunnel, 1286 int optname, int *val) 1287 { 1288 int err = 0; 1289 1290 switch (optname) { 1291 case PPPOL2TP_SO_DEBUG: 1292 /* Tunnel debug flags option is deprecated */ 1293 *val = 0; 1294 break; 1295 1296 default: 1297 err = -ENOPROTOOPT; 1298 break; 1299 } 1300 1301 return err; 1302 } 1303 1304 /* Session getsockopt helper. Called with sock locked. 1305 */ 1306 static int pppol2tp_session_getsockopt(struct sock *sk, 1307 struct l2tp_session *session, 1308 int optname, int *val) 1309 { 1310 int err = 0; 1311 1312 switch (optname) { 1313 case PPPOL2TP_SO_RECVSEQ: 1314 *val = session->recv_seq; 1315 break; 1316 1317 case PPPOL2TP_SO_SENDSEQ: 1318 *val = session->send_seq; 1319 break; 1320 1321 case PPPOL2TP_SO_LNSMODE: 1322 *val = session->lns_mode; 1323 break; 1324 1325 case PPPOL2TP_SO_DEBUG: 1326 /* Session debug flags option is deprecated */ 1327 *val = 0; 1328 break; 1329 1330 case PPPOL2TP_SO_REORDERTO: 1331 *val = (int)jiffies_to_msecs(session->reorder_timeout); 1332 break; 1333 1334 default: 1335 err = -ENOPROTOOPT; 1336 } 1337 1338 return err; 1339 } 1340 1341 /* Main getsockopt() entry point. 1342 * Does API checks, then calls either the tunnel or session getsockopt 1343 * handler, according to whether the PPPoX socket is a for a regular session 1344 * or the special tunnel type. 1345 */ 1346 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, 1347 char __user *optval, int __user *optlen) 1348 { 1349 struct sock *sk = sock->sk; 1350 struct l2tp_session *session; 1351 struct l2tp_tunnel *tunnel; 1352 int val, len; 1353 int err; 1354 1355 if (level != SOL_PPPOL2TP) 1356 return -EINVAL; 1357 1358 if (get_user(len, optlen)) 1359 return -EFAULT; 1360 1361 if (len < 0) 1362 return -EINVAL; 1363 1364 len = min_t(unsigned int, len, sizeof(int)); 1365 1366 err = -ENOTCONN; 1367 if (!sk->sk_user_data) 1368 goto end; 1369 1370 /* Get the session context */ 1371 err = -EBADF; 1372 session = pppol2tp_sock_to_session(sk); 1373 if (!session) 1374 goto end; 1375 1376 /* Special case: if session_id == 0x0000, treat as operation on tunnel */ 1377 if (session->session_id == 0 && session->peer_session_id == 0) { 1378 tunnel = session->tunnel; 1379 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val); 1380 if (err) 1381 goto end_put_sess; 1382 } else { 1383 err = pppol2tp_session_getsockopt(sk, session, optname, &val); 1384 if (err) 1385 goto end_put_sess; 1386 } 1387 1388 err = -EFAULT; 1389 if (put_user(len, optlen)) 1390 goto end_put_sess; 1391 1392 if (copy_to_user((void __user *)optval, &val, len)) 1393 goto end_put_sess; 1394 1395 err = 0; 1396 1397 end_put_sess: 1398 sock_put(sk); 1399 end: 1400 return err; 1401 } 1402 1403 /***************************************************************************** 1404 * /proc filesystem for debug 1405 * Since the original pppol2tp driver provided /proc/net/pppol2tp for 1406 * L2TPv2, we dump only L2TPv2 tunnels and sessions here. 1407 *****************************************************************************/ 1408 1409 static unsigned int pppol2tp_net_id; 1410 1411 #ifdef CONFIG_PROC_FS 1412 1413 struct pppol2tp_seq_data { 1414 struct seq_net_private p; 1415 int tunnel_idx; /* current tunnel */ 1416 int session_idx; /* index of session within current tunnel */ 1417 struct l2tp_tunnel *tunnel; 1418 struct l2tp_session *session; /* NULL means get next tunnel */ 1419 }; 1420 1421 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) 1422 { 1423 /* Drop reference taken during previous invocation */ 1424 if (pd->tunnel) 1425 l2tp_tunnel_dec_refcount(pd->tunnel); 1426 1427 for (;;) { 1428 pd->tunnel = l2tp_tunnel_get_nth(net, pd->tunnel_idx); 1429 pd->tunnel_idx++; 1430 1431 /* Only accept L2TPv2 tunnels */ 1432 if (!pd->tunnel || pd->tunnel->version == 2) 1433 return; 1434 1435 l2tp_tunnel_dec_refcount(pd->tunnel); 1436 } 1437 } 1438 1439 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) 1440 { 1441 /* Drop reference taken during previous invocation */ 1442 if (pd->session) 1443 l2tp_session_dec_refcount(pd->session); 1444 1445 pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx); 1446 pd->session_idx++; 1447 1448 if (!pd->session) { 1449 pd->session_idx = 0; 1450 pppol2tp_next_tunnel(net, pd); 1451 } 1452 } 1453 1454 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs) 1455 { 1456 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN; 1457 loff_t pos = *offs; 1458 struct net *net; 1459 1460 if (!pos) 1461 goto out; 1462 1463 if (WARN_ON(!m->private)) { 1464 pd = NULL; 1465 goto out; 1466 } 1467 1468 pd = m->private; 1469 net = seq_file_net(m); 1470 1471 if (!pd->tunnel) 1472 pppol2tp_next_tunnel(net, pd); 1473 else 1474 pppol2tp_next_session(net, pd); 1475 1476 /* NULL tunnel and session indicates end of list */ 1477 if (!pd->tunnel && !pd->session) 1478 pd = NULL; 1479 1480 out: 1481 return pd; 1482 } 1483 1484 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos) 1485 { 1486 (*pos)++; 1487 return NULL; 1488 } 1489 1490 static void pppol2tp_seq_stop(struct seq_file *p, void *v) 1491 { 1492 struct pppol2tp_seq_data *pd = v; 1493 1494 if (!pd || pd == SEQ_START_TOKEN) 1495 return; 1496 1497 /* Drop reference taken by last invocation of pppol2tp_next_session() 1498 * or pppol2tp_next_tunnel(). 1499 */ 1500 if (pd->session) { 1501 l2tp_session_dec_refcount(pd->session); 1502 pd->session = NULL; 1503 } 1504 if (pd->tunnel) { 1505 l2tp_tunnel_dec_refcount(pd->tunnel); 1506 pd->tunnel = NULL; 1507 } 1508 } 1509 1510 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) 1511 { 1512 struct l2tp_tunnel *tunnel = v; 1513 1514 seq_printf(m, "\nTUNNEL '%s', %c %d\n", 1515 tunnel->name, 1516 (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N', 1517 refcount_read(&tunnel->ref_count) - 1); 1518 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n", 1519 0, 1520 atomic_long_read(&tunnel->stats.tx_packets), 1521 atomic_long_read(&tunnel->stats.tx_bytes), 1522 atomic_long_read(&tunnel->stats.tx_errors), 1523 atomic_long_read(&tunnel->stats.rx_packets), 1524 atomic_long_read(&tunnel->stats.rx_bytes), 1525 atomic_long_read(&tunnel->stats.rx_errors)); 1526 } 1527 1528 static void pppol2tp_seq_session_show(struct seq_file *m, void *v) 1529 { 1530 struct l2tp_session *session = v; 1531 struct l2tp_tunnel *tunnel = session->tunnel; 1532 unsigned char state; 1533 char user_data_ok; 1534 struct sock *sk; 1535 u32 ip = 0; 1536 u16 port = 0; 1537 1538 if (tunnel->sock) { 1539 struct inet_sock *inet = inet_sk(tunnel->sock); 1540 1541 ip = ntohl(inet->inet_saddr); 1542 port = ntohs(inet->inet_sport); 1543 } 1544 1545 sk = pppol2tp_session_get_sock(session); 1546 if (sk) { 1547 state = sk->sk_state; 1548 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N'; 1549 } else { 1550 state = 0; 1551 user_data_ok = 'N'; 1552 } 1553 1554 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> %04X/%04X %d %c\n", 1555 session->name, ip, port, 1556 tunnel->tunnel_id, 1557 session->session_id, 1558 tunnel->peer_tunnel_id, 1559 session->peer_session_id, 1560 state, user_data_ok); 1561 seq_printf(m, " 0/0/%c/%c/%s %08x %u\n", 1562 session->recv_seq ? 'R' : '-', 1563 session->send_seq ? 'S' : '-', 1564 session->lns_mode ? "LNS" : "LAC", 1565 0, 1566 jiffies_to_msecs(session->reorder_timeout)); 1567 seq_printf(m, " %u/%u %ld/%ld/%ld %ld/%ld/%ld\n", 1568 session->nr, session->ns, 1569 atomic_long_read(&session->stats.tx_packets), 1570 atomic_long_read(&session->stats.tx_bytes), 1571 atomic_long_read(&session->stats.tx_errors), 1572 atomic_long_read(&session->stats.rx_packets), 1573 atomic_long_read(&session->stats.rx_bytes), 1574 atomic_long_read(&session->stats.rx_errors)); 1575 1576 if (sk) { 1577 struct pppox_sock *po = pppox_sk(sk); 1578 1579 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 1580 sock_put(sk); 1581 } 1582 } 1583 1584 static int pppol2tp_seq_show(struct seq_file *m, void *v) 1585 { 1586 struct pppol2tp_seq_data *pd = v; 1587 1588 /* display header on line 1 */ 1589 if (v == SEQ_START_TOKEN) { 1590 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n"); 1591 seq_puts(m, "TUNNEL name, user-data-ok session-count\n"); 1592 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1593 seq_puts(m, " SESSION name, addr/port src-tid/sid dest-tid/sid state user-data-ok\n"); 1594 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n"); 1595 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1596 goto out; 1597 } 1598 1599 if (!pd->session) 1600 pppol2tp_seq_tunnel_show(m, pd->tunnel); 1601 else 1602 pppol2tp_seq_session_show(m, pd->session); 1603 1604 out: 1605 return 0; 1606 } 1607 1608 static const struct seq_operations pppol2tp_seq_ops = { 1609 .start = pppol2tp_seq_start, 1610 .next = pppol2tp_seq_next, 1611 .stop = pppol2tp_seq_stop, 1612 .show = pppol2tp_seq_show, 1613 }; 1614 #endif /* CONFIG_PROC_FS */ 1615 1616 /***************************************************************************** 1617 * Network namespace 1618 *****************************************************************************/ 1619 1620 static __net_init int pppol2tp_init_net(struct net *net) 1621 { 1622 struct proc_dir_entry *pde; 1623 int err = 0; 1624 1625 pde = proc_create_net("pppol2tp", 0444, net->proc_net, 1626 &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data)); 1627 if (!pde) { 1628 err = -ENOMEM; 1629 goto out; 1630 } 1631 1632 out: 1633 return err; 1634 } 1635 1636 static __net_exit void pppol2tp_exit_net(struct net *net) 1637 { 1638 remove_proc_entry("pppol2tp", net->proc_net); 1639 } 1640 1641 static struct pernet_operations pppol2tp_net_ops = { 1642 .init = pppol2tp_init_net, 1643 .exit = pppol2tp_exit_net, 1644 .id = &pppol2tp_net_id, 1645 }; 1646 1647 /***************************************************************************** 1648 * Init and cleanup 1649 *****************************************************************************/ 1650 1651 static const struct proto_ops pppol2tp_ops = { 1652 .family = AF_PPPOX, 1653 .owner = THIS_MODULE, 1654 .release = pppol2tp_release, 1655 .bind = sock_no_bind, 1656 .connect = pppol2tp_connect, 1657 .socketpair = sock_no_socketpair, 1658 .accept = sock_no_accept, 1659 .getname = pppol2tp_getname, 1660 .poll = datagram_poll, 1661 .listen = sock_no_listen, 1662 .shutdown = sock_no_shutdown, 1663 .setsockopt = pppol2tp_setsockopt, 1664 .getsockopt = pppol2tp_getsockopt, 1665 .sendmsg = pppol2tp_sendmsg, 1666 .recvmsg = pppol2tp_recvmsg, 1667 .mmap = sock_no_mmap, 1668 .ioctl = pppox_ioctl, 1669 #ifdef CONFIG_COMPAT 1670 .compat_ioctl = pppox_compat_ioctl, 1671 #endif 1672 }; 1673 1674 static const struct pppox_proto pppol2tp_proto = { 1675 .create = pppol2tp_create, 1676 .ioctl = pppol2tp_ioctl, 1677 .owner = THIS_MODULE, 1678 }; 1679 1680 #ifdef CONFIG_L2TP_V3 1681 1682 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = { 1683 .session_create = pppol2tp_session_create, 1684 .session_delete = l2tp_session_delete, 1685 }; 1686 1687 #endif /* CONFIG_L2TP_V3 */ 1688 1689 static int __init pppol2tp_init(void) 1690 { 1691 int err; 1692 1693 err = register_pernet_device(&pppol2tp_net_ops); 1694 if (err) 1695 goto out; 1696 1697 err = proto_register(&pppol2tp_sk_proto, 0); 1698 if (err) 1699 goto out_unregister_pppol2tp_pernet; 1700 1701 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto); 1702 if (err) 1703 goto out_unregister_pppol2tp_proto; 1704 1705 #ifdef CONFIG_L2TP_V3 1706 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops); 1707 if (err) 1708 goto out_unregister_pppox; 1709 #endif 1710 1711 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION); 1712 1713 out: 1714 return err; 1715 1716 #ifdef CONFIG_L2TP_V3 1717 out_unregister_pppox: 1718 unregister_pppox_proto(PX_PROTO_OL2TP); 1719 #endif 1720 out_unregister_pppol2tp_proto: 1721 proto_unregister(&pppol2tp_sk_proto); 1722 out_unregister_pppol2tp_pernet: 1723 unregister_pernet_device(&pppol2tp_net_ops); 1724 goto out; 1725 } 1726 1727 static void __exit pppol2tp_exit(void) 1728 { 1729 #ifdef CONFIG_L2TP_V3 1730 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP); 1731 #endif 1732 unregister_pppox_proto(PX_PROTO_OL2TP); 1733 proto_unregister(&pppol2tp_sk_proto); 1734 unregister_pernet_device(&pppol2tp_net_ops); 1735 } 1736 1737 module_init(pppol2tp_init); 1738 module_exit(pppol2tp_exit); 1739 1740 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1741 MODULE_DESCRIPTION("PPP over L2TP over UDP"); 1742 MODULE_LICENSE("GPL"); 1743 MODULE_VERSION(PPPOL2TP_DRV_VERSION); 1744 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP); 1745 MODULE_ALIAS_L2TP_PWTYPE(7); 1746