1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /***************************************************************************** 3 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets 4 * 5 * PPPoX --- Generic PPP encapsulation socket family 6 * PPPoL2TP --- PPP over L2TP (RFC 2661) 7 * 8 * Version: 2.0.0 9 * 10 * Authors: James Chapman (jchapman@katalix.com) 11 * 12 * Based on original work by Martijn van Oosterhout <kleptog@svana.org> 13 * 14 * License: 15 */ 16 17 /* This driver handles only L2TP data frames; control frames are handled by a 18 * userspace application. 19 * 20 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and 21 * attaches it to a bound UDP socket with local tunnel_id / session_id and 22 * peer tunnel_id / session_id set. Data can then be sent or received using 23 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket 24 * can be read or modified using ioctl() or [gs]etsockopt() calls. 25 * 26 * When a PPPoL2TP socket is connected with local and peer session_id values 27 * zero, the socket is treated as a special tunnel management socket. 28 * 29 * Here's example userspace code to create a socket for sending/receiving data 30 * over an L2TP session:- 31 * 32 * struct sockaddr_pppol2tp sax; 33 * int fd; 34 * int session_fd; 35 * 36 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); 37 * 38 * sax.sa_family = AF_PPPOX; 39 * sax.sa_protocol = PX_PROTO_OL2TP; 40 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket 41 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr; 42 * sax.pppol2tp.addr.sin_port = addr->sin_port; 43 * sax.pppol2tp.addr.sin_family = AF_INET; 44 * sax.pppol2tp.s_tunnel = tunnel_id; 45 * sax.pppol2tp.s_session = session_id; 46 * sax.pppol2tp.d_tunnel = peer_tunnel_id; 47 * sax.pppol2tp.d_session = peer_session_id; 48 * 49 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax)); 50 * 51 * A pppd plugin that allows PPP traffic to be carried over L2TP using 52 * this driver is available from the OpenL2TP project at 53 * http://openl2tp.sourceforge.net. 54 */ 55 56 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 57 58 #include <linux/module.h> 59 #include <linux/string.h> 60 #include <linux/list.h> 61 #include <linux/uaccess.h> 62 63 #include <linux/kernel.h> 64 #include <linux/spinlock.h> 65 #include <linux/kthread.h> 66 #include <linux/sched.h> 67 #include <linux/slab.h> 68 #include <linux/errno.h> 69 #include <linux/jiffies.h> 70 71 #include <linux/netdevice.h> 72 #include <linux/net.h> 73 #include <linux/inetdevice.h> 74 #include <linux/skbuff.h> 75 #include <linux/init.h> 76 #include <linux/ip.h> 77 #include <linux/udp.h> 78 #include <linux/if_pppox.h> 79 #include <linux/if_pppol2tp.h> 80 #include <net/sock.h> 81 #include <linux/ppp_channel.h> 82 #include <linux/ppp_defs.h> 83 #include <linux/ppp-ioctl.h> 84 #include <linux/file.h> 85 #include <linux/hash.h> 86 #include <linux/sort.h> 87 #include <linux/proc_fs.h> 88 #include <linux/l2tp.h> 89 #include <linux/nsproxy.h> 90 #include <net/net_namespace.h> 91 #include <net/netns/generic.h> 92 #include <net/ip.h> 93 #include <net/udp.h> 94 #include <net/inet_common.h> 95 96 #include <asm/byteorder.h> 97 #include <linux/atomic.h> 98 99 #include "l2tp_core.h" 100 101 #define PPPOL2TP_DRV_VERSION "V2.0" 102 103 /* Space for UDP, L2TP and PPP headers */ 104 #define PPPOL2TP_HEADER_OVERHEAD 40 105 106 /* Number of bytes to build transmit L2TP headers. 107 * Unfortunately the size is different depending on whether sequence numbers 108 * are enabled. 109 */ 110 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10 111 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6 112 113 /* Private data of each session. This data lives at the end of struct 114 * l2tp_session, referenced via session->priv[]. 115 */ 116 struct pppol2tp_session { 117 int owner; /* pid that opened the socket */ 118 119 struct mutex sk_lock; /* Protects .sk */ 120 struct sock __rcu *sk; /* Pointer to the session PPPoX socket */ 121 struct sock *__sk; /* Copy of .sk, for cleanup */ 122 }; 123 124 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb); 125 126 static const struct ppp_channel_ops pppol2tp_chan_ops = { 127 .start_xmit = pppol2tp_xmit, 128 }; 129 130 static const struct proto_ops pppol2tp_ops; 131 132 /* Retrieves the pppol2tp socket associated to a session. */ 133 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) 134 { 135 struct pppol2tp_session *ps = l2tp_session_priv(session); 136 137 return rcu_dereference(ps->sk); 138 } 139 140 /* Helpers to obtain tunnel/session contexts from sockets. 141 */ 142 static struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) 143 { 144 struct l2tp_session *session; 145 146 if (!sk) 147 return NULL; 148 149 rcu_read_lock(); 150 session = rcu_dereference_sk_user_data(sk); 151 if (session && refcount_inc_not_zero(&session->ref_count)) { 152 rcu_read_unlock(); 153 WARN_ON_ONCE(session->magic != L2TP_SESSION_MAGIC); 154 return session; 155 } 156 rcu_read_unlock(); 157 158 return NULL; 159 } 160 161 /***************************************************************************** 162 * Receive data handling 163 *****************************************************************************/ 164 165 /* Receive message. This is the recvmsg for the PPPoL2TP socket. 166 */ 167 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, 168 size_t len, int flags) 169 { 170 int err; 171 struct sk_buff *skb; 172 struct sock *sk = sock->sk; 173 174 err = -EIO; 175 if (sk->sk_state & PPPOX_BOUND) 176 goto end; 177 178 err = 0; 179 skb = skb_recv_datagram(sk, flags, &err); 180 if (!skb) 181 goto end; 182 183 if (len > skb->len) 184 len = skb->len; 185 else if (len < skb->len) 186 msg->msg_flags |= MSG_TRUNC; 187 188 err = skb_copy_datagram_msg(skb, 0, msg, len); 189 if (likely(err == 0)) 190 err = len; 191 192 kfree_skb(skb); 193 end: 194 return err; 195 } 196 197 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) 198 { 199 struct sock *sk; 200 201 /* If the socket is bound, send it in to PPP's input queue. Otherwise 202 * queue it on the session socket. 203 */ 204 rcu_read_lock(); 205 sk = pppol2tp_session_get_sock(session); 206 if (!sk) 207 goto no_sock; 208 209 /* If the first two bytes are 0xFF03, consider that it is the PPP's 210 * Address and Control fields and skip them. The L2TP module has always 211 * worked this way, although, in theory, the use of these fields should 212 * be negotiated and handled at the PPP layer. These fields are 213 * constant: 0xFF is the All-Stations Address and 0x03 the Unnumbered 214 * Information command with Poll/Final bit set to zero (RFC 1662). 215 */ 216 if (pskb_may_pull(skb, 2) && skb->data[0] == PPP_ALLSTATIONS && 217 skb->data[1] == PPP_UI) 218 skb_pull(skb, 2); 219 220 if (sk->sk_state & PPPOX_BOUND) { 221 struct pppox_sock *po; 222 223 po = pppox_sk(sk); 224 ppp_input(&po->chan, skb); 225 } else { 226 if (sock_queue_rcv_skb(sk, skb) < 0) { 227 atomic_long_inc(&session->stats.rx_errors); 228 kfree_skb(skb); 229 } 230 } 231 rcu_read_unlock(); 232 233 return; 234 235 no_sock: 236 rcu_read_unlock(); 237 pr_warn_ratelimited("%s: no socket in recv\n", session->name); 238 kfree_skb(skb); 239 } 240 241 /************************************************************************ 242 * Transmit handling 243 ***********************************************************************/ 244 245 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here 246 * when a user application does a sendmsg() on the session socket. L2TP and 247 * PPP headers must be inserted into the user's data. 248 */ 249 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m, 250 size_t total_len) 251 { 252 struct sock *sk = sock->sk; 253 struct sk_buff *skb; 254 int error; 255 struct l2tp_session *session; 256 struct l2tp_tunnel *tunnel; 257 int uhlen; 258 259 error = -ENOTCONN; 260 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 261 goto error; 262 263 /* Get session and tunnel contexts */ 264 error = -EBADF; 265 session = pppol2tp_sock_to_session(sk); 266 if (!session) 267 goto error; 268 269 tunnel = session->tunnel; 270 271 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 272 273 /* Allocate a socket buffer */ 274 error = -ENOMEM; 275 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 276 uhlen + session->hdr_len + 277 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 278 0, GFP_KERNEL); 279 if (!skb) 280 goto error_put_sess; 281 282 /* Reserve space for headers. */ 283 skb_reserve(skb, NET_SKB_PAD); 284 skb_reset_network_header(skb); 285 skb_reserve(skb, sizeof(struct iphdr)); 286 skb_reset_transport_header(skb); 287 skb_reserve(skb, uhlen); 288 289 /* Add PPP header */ 290 skb->data[0] = PPP_ALLSTATIONS; 291 skb->data[1] = PPP_UI; 292 skb_put(skb, 2); 293 294 /* Copy user data into skb */ 295 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len); 296 if (error < 0) { 297 kfree_skb(skb); 298 goto error_put_sess; 299 } 300 301 local_bh_disable(); 302 l2tp_xmit_skb(session, skb); 303 local_bh_enable(); 304 305 l2tp_session_put(session); 306 307 return total_len; 308 309 error_put_sess: 310 l2tp_session_put(session); 311 error: 312 return error; 313 } 314 315 /* Transmit function called by generic PPP driver. Sends PPP frame 316 * over PPPoL2TP socket. 317 * 318 * This is almost the same as pppol2tp_sendmsg(), but rather than 319 * being called with a msghdr from userspace, it is called with a skb 320 * from the kernel. 321 * 322 * The supplied skb from ppp doesn't have enough headroom for the 323 * insertion of L2TP, UDP and IP headers so we need to allocate more 324 * headroom in the skb. This will create a cloned skb. But we must be 325 * careful in the error case because the caller will expect to free 326 * the skb it supplied, not our cloned skb. So we take care to always 327 * leave the original skb unfreed if we return an error. 328 */ 329 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) 330 { 331 struct sock *sk = (struct sock *)chan->private; 332 struct l2tp_session *session; 333 struct l2tp_tunnel *tunnel; 334 int uhlen, headroom; 335 336 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 337 goto abort; 338 339 /* Get session and tunnel contexts from the socket */ 340 session = pppol2tp_sock_to_session(sk); 341 if (!session) 342 goto abort; 343 344 tunnel = session->tunnel; 345 346 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 347 headroom = NET_SKB_PAD + 348 sizeof(struct iphdr) + /* IP header */ 349 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */ 350 session->hdr_len + /* L2TP header */ 351 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 352 if (skb_cow_head(skb, headroom)) 353 goto abort_put_sess; 354 355 /* Setup PPP header */ 356 __skb_push(skb, 2); 357 skb->data[0] = PPP_ALLSTATIONS; 358 skb->data[1] = PPP_UI; 359 360 local_bh_disable(); 361 l2tp_xmit_skb(session, skb); 362 local_bh_enable(); 363 364 l2tp_session_put(session); 365 366 return 1; 367 368 abort_put_sess: 369 l2tp_session_put(session); 370 abort: 371 /* Free the original skb */ 372 kfree_skb(skb); 373 return 1; 374 } 375 376 /***************************************************************************** 377 * Session (and tunnel control) socket create/destroy. 378 *****************************************************************************/ 379 380 /* Really kill the session socket. (Called from sock_put() if 381 * refcnt == 0.) 382 */ 383 static void pppol2tp_session_destruct(struct sock *sk) 384 { 385 skb_queue_purge(&sk->sk_receive_queue); 386 skb_queue_purge(&sk->sk_write_queue); 387 } 388 389 static void pppol2tp_session_close(struct l2tp_session *session) 390 { 391 struct pppol2tp_session *ps; 392 393 ps = l2tp_session_priv(session); 394 mutex_lock(&ps->sk_lock); 395 ps->__sk = rcu_dereference_protected(ps->sk, 396 lockdep_is_held(&ps->sk_lock)); 397 RCU_INIT_POINTER(ps->sk, NULL); 398 mutex_unlock(&ps->sk_lock); 399 if (ps->__sk) { 400 /* detach socket */ 401 rcu_assign_sk_user_data(ps->__sk, NULL); 402 sock_put(ps->__sk); 403 404 /* drop ref taken when we referenced socket via sk_user_data */ 405 l2tp_session_put(session); 406 } 407 } 408 409 /* Called when the PPPoX socket (session) is closed. 410 */ 411 static int pppol2tp_release(struct socket *sock) 412 { 413 struct sock *sk = sock->sk; 414 struct l2tp_session *session; 415 int error; 416 417 if (!sk) 418 return 0; 419 420 error = -EBADF; 421 lock_sock(sk); 422 if (sock_flag(sk, SOCK_DEAD) != 0) 423 goto error; 424 425 pppox_unbind_sock(sk); 426 427 /* Signal the death of the socket. */ 428 sk->sk_state = PPPOX_DEAD; 429 sock_orphan(sk); 430 sock->sk = NULL; 431 432 session = pppol2tp_sock_to_session(sk); 433 if (session) { 434 l2tp_session_delete(session); 435 /* drop ref taken by pppol2tp_sock_to_session */ 436 l2tp_session_put(session); 437 } 438 439 release_sock(sk); 440 441 sock_put(sk); 442 443 return 0; 444 445 error: 446 release_sock(sk); 447 return error; 448 } 449 450 static struct proto pppol2tp_sk_proto = { 451 .name = "PPPOL2TP", 452 .owner = THIS_MODULE, 453 .obj_size = sizeof(struct pppox_sock), 454 }; 455 456 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb) 457 { 458 int rc; 459 460 rc = l2tp_udp_encap_recv(sk, skb); 461 if (rc) 462 kfree_skb(skb); 463 464 return NET_RX_SUCCESS; 465 } 466 467 /* socket() handler. Initialize a new struct sock. 468 */ 469 static int pppol2tp_create(struct net *net, struct socket *sock, int kern) 470 { 471 int error = -ENOMEM; 472 struct sock *sk; 473 474 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern); 475 if (!sk) 476 goto out; 477 478 sock_init_data(sock, sk); 479 sock_set_flag(sk, SOCK_RCU_FREE); 480 481 sock->state = SS_UNCONNECTED; 482 sock->ops = &pppol2tp_ops; 483 484 sk->sk_backlog_rcv = pppol2tp_backlog_recv; 485 sk->sk_protocol = PX_PROTO_OL2TP; 486 sk->sk_family = PF_PPPOX; 487 sk->sk_state = PPPOX_NONE; 488 sk->sk_type = SOCK_STREAM; 489 sk->sk_destruct = pppol2tp_session_destruct; 490 491 error = 0; 492 493 out: 494 return error; 495 } 496 497 static void pppol2tp_show(struct seq_file *m, void *arg) 498 { 499 struct l2tp_session *session = arg; 500 struct sock *sk; 501 502 rcu_read_lock(); 503 sk = pppol2tp_session_get_sock(session); 504 if (sk) { 505 struct pppox_sock *po = pppox_sk(sk); 506 507 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 508 } 509 rcu_read_unlock(); 510 } 511 512 static void pppol2tp_session_init(struct l2tp_session *session) 513 { 514 struct pppol2tp_session *ps; 515 516 session->recv_skb = pppol2tp_recv; 517 session->session_close = pppol2tp_session_close; 518 if (IS_ENABLED(CONFIG_L2TP_DEBUGFS)) 519 session->show = pppol2tp_show; 520 521 ps = l2tp_session_priv(session); 522 mutex_init(&ps->sk_lock); 523 ps->owner = current->pid; 524 } 525 526 struct l2tp_connect_info { 527 u8 version; 528 int fd; 529 u32 tunnel_id; 530 u32 peer_tunnel_id; 531 u32 session_id; 532 u32 peer_session_id; 533 }; 534 535 static int pppol2tp_sockaddr_get_info(const void *sa, int sa_len, 536 struct l2tp_connect_info *info) 537 { 538 switch (sa_len) { 539 case sizeof(struct sockaddr_pppol2tp): 540 { 541 const struct sockaddr_pppol2tp *sa_v2in4 = sa; 542 543 if (sa_v2in4->sa_protocol != PX_PROTO_OL2TP) 544 return -EINVAL; 545 546 info->version = 2; 547 info->fd = sa_v2in4->pppol2tp.fd; 548 info->tunnel_id = sa_v2in4->pppol2tp.s_tunnel; 549 info->peer_tunnel_id = sa_v2in4->pppol2tp.d_tunnel; 550 info->session_id = sa_v2in4->pppol2tp.s_session; 551 info->peer_session_id = sa_v2in4->pppol2tp.d_session; 552 553 break; 554 } 555 case sizeof(struct sockaddr_pppol2tpv3): 556 { 557 const struct sockaddr_pppol2tpv3 *sa_v3in4 = sa; 558 559 if (sa_v3in4->sa_protocol != PX_PROTO_OL2TP) 560 return -EINVAL; 561 562 info->version = 3; 563 info->fd = sa_v3in4->pppol2tp.fd; 564 info->tunnel_id = sa_v3in4->pppol2tp.s_tunnel; 565 info->peer_tunnel_id = sa_v3in4->pppol2tp.d_tunnel; 566 info->session_id = sa_v3in4->pppol2tp.s_session; 567 info->peer_session_id = sa_v3in4->pppol2tp.d_session; 568 569 break; 570 } 571 case sizeof(struct sockaddr_pppol2tpin6): 572 { 573 const struct sockaddr_pppol2tpin6 *sa_v2in6 = sa; 574 575 if (sa_v2in6->sa_protocol != PX_PROTO_OL2TP) 576 return -EINVAL; 577 578 info->version = 2; 579 info->fd = sa_v2in6->pppol2tp.fd; 580 info->tunnel_id = sa_v2in6->pppol2tp.s_tunnel; 581 info->peer_tunnel_id = sa_v2in6->pppol2tp.d_tunnel; 582 info->session_id = sa_v2in6->pppol2tp.s_session; 583 info->peer_session_id = sa_v2in6->pppol2tp.d_session; 584 585 break; 586 } 587 case sizeof(struct sockaddr_pppol2tpv3in6): 588 { 589 const struct sockaddr_pppol2tpv3in6 *sa_v3in6 = sa; 590 591 if (sa_v3in6->sa_protocol != PX_PROTO_OL2TP) 592 return -EINVAL; 593 594 info->version = 3; 595 info->fd = sa_v3in6->pppol2tp.fd; 596 info->tunnel_id = sa_v3in6->pppol2tp.s_tunnel; 597 info->peer_tunnel_id = sa_v3in6->pppol2tp.d_tunnel; 598 info->session_id = sa_v3in6->pppol2tp.s_session; 599 info->peer_session_id = sa_v3in6->pppol2tp.d_session; 600 601 break; 602 } 603 default: 604 return -EINVAL; 605 } 606 607 return 0; 608 } 609 610 /* Rough estimation of the maximum payload size a tunnel can transmit without 611 * fragmenting at the lower IP layer. Assumes L2TPv2 with sequence 612 * numbers and no IP option. Not quite accurate, but the result is mostly 613 * unused anyway. 614 */ 615 static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel) 616 { 617 int mtu; 618 619 mtu = l2tp_tunnel_dst_mtu(tunnel); 620 if (mtu <= PPPOL2TP_HEADER_OVERHEAD) 621 return 1500 - PPPOL2TP_HEADER_OVERHEAD; 622 623 return mtu - PPPOL2TP_HEADER_OVERHEAD; 624 } 625 626 static struct l2tp_tunnel *pppol2tp_tunnel_get(struct net *net, 627 const struct l2tp_connect_info *info, 628 bool *new_tunnel) 629 { 630 struct l2tp_tunnel *tunnel; 631 int error; 632 633 *new_tunnel = false; 634 635 tunnel = l2tp_tunnel_get(net, info->tunnel_id); 636 637 /* Special case: create tunnel context if session_id and 638 * peer_session_id is 0. Otherwise look up tunnel using supplied 639 * tunnel id. 640 */ 641 if (!info->session_id && !info->peer_session_id) { 642 if (!tunnel) { 643 struct l2tp_tunnel_cfg tcfg = { 644 .encap = L2TP_ENCAPTYPE_UDP, 645 }; 646 647 /* Prevent l2tp_tunnel_register() from trying to set up 648 * a kernel socket. 649 */ 650 if (info->fd < 0) 651 return ERR_PTR(-EBADF); 652 653 error = l2tp_tunnel_create(info->fd, 654 info->version, 655 info->tunnel_id, 656 info->peer_tunnel_id, &tcfg, 657 &tunnel); 658 if (error < 0) 659 return ERR_PTR(error); 660 661 refcount_inc(&tunnel->ref_count); 662 error = l2tp_tunnel_register(tunnel, net, &tcfg); 663 if (error < 0) { 664 kfree(tunnel); 665 return ERR_PTR(error); 666 } 667 668 *new_tunnel = true; 669 } 670 } else { 671 /* Error if we can't find the tunnel */ 672 if (!tunnel) 673 return ERR_PTR(-ENOENT); 674 675 /* Error if socket is not prepped */ 676 if (!tunnel->sock) { 677 l2tp_tunnel_put(tunnel); 678 return ERR_PTR(-ENOENT); 679 } 680 } 681 682 return tunnel; 683 } 684 685 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket 686 */ 687 static int pppol2tp_connect(struct socket *sock, struct sockaddr_unsized *uservaddr, 688 int sockaddr_len, int flags) 689 { 690 struct sock *sk = sock->sk; 691 struct pppox_sock *po = pppox_sk(sk); 692 struct l2tp_session *session = NULL; 693 struct l2tp_connect_info info; 694 struct l2tp_tunnel *tunnel; 695 struct pppol2tp_session *ps; 696 struct l2tp_session_cfg cfg = { 0, }; 697 bool drop_refcnt = false; 698 bool new_session = false; 699 bool new_tunnel = false; 700 int error; 701 702 error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info); 703 if (error < 0) 704 return error; 705 706 /* Don't bind if tunnel_id is 0 */ 707 if (!info.tunnel_id) 708 return -EINVAL; 709 710 tunnel = pppol2tp_tunnel_get(sock_net(sk), &info, &new_tunnel); 711 if (IS_ERR(tunnel)) 712 return PTR_ERR(tunnel); 713 714 lock_sock(sk); 715 716 /* Check for already bound sockets */ 717 error = -EBUSY; 718 if (sk->sk_state & PPPOX_CONNECTED) 719 goto end; 720 721 /* We don't supporting rebinding anyway */ 722 error = -EALREADY; 723 if (sk->sk_user_data) 724 goto end; /* socket is already attached */ 725 726 if (tunnel->peer_tunnel_id == 0) 727 tunnel->peer_tunnel_id = info.peer_tunnel_id; 728 729 session = l2tp_session_get(sock_net(sk), tunnel->sock, tunnel->version, 730 info.tunnel_id, info.session_id); 731 if (session) { 732 drop_refcnt = true; 733 734 if (session->pwtype != L2TP_PWTYPE_PPP) { 735 error = -EPROTOTYPE; 736 goto end; 737 } 738 739 ps = l2tp_session_priv(session); 740 741 /* Using a pre-existing session is fine as long as it hasn't 742 * been connected yet. 743 */ 744 mutex_lock(&ps->sk_lock); 745 if (rcu_dereference_protected(ps->sk, 746 lockdep_is_held(&ps->sk_lock)) || 747 ps->__sk) { 748 mutex_unlock(&ps->sk_lock); 749 error = -EEXIST; 750 goto end; 751 } 752 } else { 753 cfg.pw_type = L2TP_PWTYPE_PPP; 754 755 session = l2tp_session_create(sizeof(struct pppol2tp_session), 756 tunnel, info.session_id, 757 info.peer_session_id, &cfg); 758 if (IS_ERR(session)) { 759 error = PTR_ERR(session); 760 goto end; 761 } 762 763 drop_refcnt = true; 764 765 pppol2tp_session_init(session); 766 ps = l2tp_session_priv(session); 767 refcount_inc(&session->ref_count); 768 769 mutex_lock(&ps->sk_lock); 770 error = l2tp_session_register(session, tunnel); 771 if (error < 0) { 772 mutex_unlock(&ps->sk_lock); 773 l2tp_session_put(session); 774 goto end; 775 } 776 777 new_session = true; 778 } 779 780 /* Special case: if source & dest session_id == 0x0000, this 781 * socket is being created to manage the tunnel. Just set up 782 * the internal context for use by ioctl() and sockopt() 783 * handlers. 784 */ 785 if (session->session_id == 0 && session->peer_session_id == 0) { 786 error = 0; 787 goto out_no_ppp; 788 } 789 790 /* Reserve enough headroom for the L2TP header with sequence numbers, 791 * which is the largest possible. This is used by the PPP layer to set 792 * the net device's hard_header_len at registration, which must be 793 * sufficient regardless of whether sequence numbers are enabled later. 794 */ 795 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_SEQ; 796 797 po->chan.private = sk; 798 po->chan.ops = &pppol2tp_chan_ops; 799 po->chan.mtu = pppol2tp_tunnel_mtu(tunnel); 800 po->chan.direct_xmit = true; 801 802 error = ppp_register_net_channel(sock_net(sk), &po->chan); 803 if (error) { 804 mutex_unlock(&ps->sk_lock); 805 goto end; 806 } 807 808 out_no_ppp: 809 /* This is how we get the session context from the socket. */ 810 sock_hold(sk); 811 rcu_assign_sk_user_data(sk, session); 812 rcu_assign_pointer(ps->sk, sk); 813 mutex_unlock(&ps->sk_lock); 814 815 /* Keep the reference we've grabbed on the session: sk doesn't expect 816 * the session to disappear. pppol2tp_session_close() is responsible 817 * for dropping it. 818 */ 819 drop_refcnt = false; 820 821 sk->sk_state = PPPOX_CONNECTED; 822 823 end: 824 if (error) { 825 if (new_session) 826 l2tp_session_delete(session); 827 if (new_tunnel) 828 l2tp_tunnel_delete(tunnel); 829 } 830 if (drop_refcnt) 831 l2tp_session_put(session); 832 l2tp_tunnel_put(tunnel); 833 release_sock(sk); 834 835 return error; 836 } 837 838 #ifdef CONFIG_L2TP_V3 839 840 /* Called when creating sessions via the netlink interface. */ 841 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, 842 u32 session_id, u32 peer_session_id, 843 struct l2tp_session_cfg *cfg) 844 { 845 int error; 846 struct l2tp_session *session; 847 848 /* Error if tunnel socket is not prepped */ 849 if (!tunnel->sock) { 850 error = -ENOENT; 851 goto err; 852 } 853 854 /* Allocate and initialize a new session context. */ 855 session = l2tp_session_create(sizeof(struct pppol2tp_session), 856 tunnel, session_id, 857 peer_session_id, cfg); 858 if (IS_ERR(session)) { 859 error = PTR_ERR(session); 860 goto err; 861 } 862 863 pppol2tp_session_init(session); 864 865 error = l2tp_session_register(session, tunnel); 866 if (error < 0) 867 goto err_sess; 868 869 return 0; 870 871 err_sess: 872 l2tp_session_put(session); 873 err: 874 return error; 875 } 876 877 #endif /* CONFIG_L2TP_V3 */ 878 879 /* getname() support. 880 */ 881 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr, 882 int peer) 883 { 884 int len = 0; 885 int error = 0; 886 struct l2tp_session *session; 887 struct l2tp_tunnel *tunnel; 888 struct sock *sk = sock->sk; 889 struct inet_sock *inet; 890 struct pppol2tp_session *pls; 891 892 error = -ENOTCONN; 893 if (!sk) 894 goto end; 895 if (!(sk->sk_state & PPPOX_CONNECTED)) 896 goto end; 897 898 error = -EBADF; 899 session = pppol2tp_sock_to_session(sk); 900 if (!session) 901 goto end; 902 903 pls = l2tp_session_priv(session); 904 tunnel = session->tunnel; 905 906 inet = inet_sk(tunnel->sock); 907 if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET) { 908 struct sockaddr_pppol2tp sp; 909 910 len = sizeof(sp); 911 memset(&sp, 0, len); 912 sp.sa_family = AF_PPPOX; 913 sp.sa_protocol = PX_PROTO_OL2TP; 914 sp.pppol2tp.fd = tunnel->fd; 915 sp.pppol2tp.pid = pls->owner; 916 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 917 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 918 sp.pppol2tp.s_session = session->session_id; 919 sp.pppol2tp.d_session = session->peer_session_id; 920 sp.pppol2tp.addr.sin_family = AF_INET; 921 sp.pppol2tp.addr.sin_port = inet->inet_dport; 922 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 923 memcpy(uaddr, &sp, len); 924 #if IS_ENABLED(CONFIG_IPV6) 925 } else if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET6) { 926 struct sockaddr_pppol2tpin6 sp; 927 928 len = sizeof(sp); 929 memset(&sp, 0, len); 930 sp.sa_family = AF_PPPOX; 931 sp.sa_protocol = PX_PROTO_OL2TP; 932 sp.pppol2tp.fd = tunnel->fd; 933 sp.pppol2tp.pid = pls->owner; 934 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 935 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 936 sp.pppol2tp.s_session = session->session_id; 937 sp.pppol2tp.d_session = session->peer_session_id; 938 sp.pppol2tp.addr.sin6_family = AF_INET6; 939 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 940 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 941 sizeof(tunnel->sock->sk_v6_daddr)); 942 memcpy(uaddr, &sp, len); 943 } else if (tunnel->version == 3 && tunnel->sock->sk_family == AF_INET6) { 944 struct sockaddr_pppol2tpv3in6 sp; 945 946 len = sizeof(sp); 947 memset(&sp, 0, len); 948 sp.sa_family = AF_PPPOX; 949 sp.sa_protocol = PX_PROTO_OL2TP; 950 sp.pppol2tp.fd = tunnel->fd; 951 sp.pppol2tp.pid = pls->owner; 952 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 953 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 954 sp.pppol2tp.s_session = session->session_id; 955 sp.pppol2tp.d_session = session->peer_session_id; 956 sp.pppol2tp.addr.sin6_family = AF_INET6; 957 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 958 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 959 sizeof(tunnel->sock->sk_v6_daddr)); 960 memcpy(uaddr, &sp, len); 961 #endif 962 } else if (tunnel->version == 3) { 963 struct sockaddr_pppol2tpv3 sp; 964 965 len = sizeof(sp); 966 memset(&sp, 0, len); 967 sp.sa_family = AF_PPPOX; 968 sp.sa_protocol = PX_PROTO_OL2TP; 969 sp.pppol2tp.fd = tunnel->fd; 970 sp.pppol2tp.pid = pls->owner; 971 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 972 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 973 sp.pppol2tp.s_session = session->session_id; 974 sp.pppol2tp.d_session = session->peer_session_id; 975 sp.pppol2tp.addr.sin_family = AF_INET; 976 sp.pppol2tp.addr.sin_port = inet->inet_dport; 977 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 978 memcpy(uaddr, &sp, len); 979 } 980 981 error = len; 982 983 l2tp_session_put(session); 984 end: 985 return error; 986 } 987 988 /**************************************************************************** 989 * ioctl() handlers. 990 * 991 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 992 * sockets. However, in order to control kernel tunnel features, we allow 993 * userspace to create a special "tunnel" PPPoX socket which is used for 994 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow 995 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl() 996 * calls. 997 ****************************************************************************/ 998 999 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest, 1000 const struct l2tp_stats *stats) 1001 { 1002 memset(dest, 0, sizeof(*dest)); 1003 1004 dest->tx_packets = atomic_long_read(&stats->tx_packets); 1005 dest->tx_bytes = atomic_long_read(&stats->tx_bytes); 1006 dest->tx_errors = atomic_long_read(&stats->tx_errors); 1007 dest->rx_packets = atomic_long_read(&stats->rx_packets); 1008 dest->rx_bytes = atomic_long_read(&stats->rx_bytes); 1009 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards); 1010 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets); 1011 dest->rx_errors = atomic_long_read(&stats->rx_errors); 1012 } 1013 1014 static int pppol2tp_tunnel_copy_stats(struct pppol2tp_ioc_stats *stats, 1015 struct l2tp_tunnel *tunnel) 1016 { 1017 struct l2tp_session *session; 1018 1019 if (!stats->session_id) { 1020 pppol2tp_copy_stats(stats, &tunnel->stats); 1021 return 0; 1022 } 1023 1024 /* If session_id is set, search the corresponding session in the 1025 * context of this tunnel and record the session's statistics. 1026 */ 1027 session = l2tp_session_get(tunnel->l2tp_net, tunnel->sock, tunnel->version, 1028 tunnel->tunnel_id, stats->session_id); 1029 if (!session) 1030 return -EBADR; 1031 1032 if (session->pwtype != L2TP_PWTYPE_PPP) { 1033 l2tp_session_put(session); 1034 return -EBADR; 1035 } 1036 1037 pppol2tp_copy_stats(stats, &session->stats); 1038 l2tp_session_put(session); 1039 1040 return 0; 1041 } 1042 1043 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, 1044 unsigned long arg) 1045 { 1046 struct pppol2tp_ioc_stats stats; 1047 struct l2tp_session *session; 1048 int err = 0; 1049 1050 session = pppol2tp_sock_to_session(sock->sk); 1051 1052 /* Validate session presence and magic integrity ONLY for commands 1053 * that belong to L2TP and require a valid session. 1054 */ 1055 switch (cmd) { 1056 case PPPIOCGMRU: 1057 case PPPIOCGFLAGS: 1058 case PPPIOCSMRU: 1059 case PPPIOCSFLAGS: 1060 case PPPIOCGL2TPSTATS: 1061 if (!session) 1062 return -ENOTCONN; 1063 1064 if (session->magic != L2TP_SESSION_MAGIC) { 1065 l2tp_session_put(session); 1066 return -EBADF; 1067 } 1068 break; 1069 default: 1070 break; 1071 } 1072 1073 switch (cmd) { 1074 case PPPIOCGMRU: 1075 case PPPIOCGFLAGS: 1076 /* Not defined for tunnels */ 1077 if (!session->session_id && !session->peer_session_id) { 1078 err = -ENOSYS; 1079 break; 1080 } 1081 1082 if (put_user(0, (int __user *)arg)) { 1083 err = -EFAULT; 1084 break; 1085 } 1086 break; 1087 1088 case PPPIOCSMRU: 1089 case PPPIOCSFLAGS: 1090 /* Not defined for tunnels */ 1091 if (!session->session_id && !session->peer_session_id) { 1092 err = -ENOSYS; 1093 break; 1094 } 1095 1096 if (!access_ok((int __user *)arg, sizeof(int))) { 1097 err = -EFAULT; 1098 break; 1099 } 1100 break; 1101 1102 case PPPIOCGL2TPSTATS: 1103 /* Session 0 represents the parent tunnel */ 1104 if (!session->session_id && !session->peer_session_id) { 1105 u32 session_id; 1106 1107 if (copy_from_user(&stats, (void __user *)arg, 1108 sizeof(stats))) { 1109 err = -EFAULT; 1110 break; 1111 } 1112 1113 session_id = stats.session_id; 1114 err = pppol2tp_tunnel_copy_stats(&stats, 1115 session->tunnel); 1116 if (err < 0) 1117 break; 1118 1119 stats.session_id = session_id; 1120 } else { 1121 pppol2tp_copy_stats(&stats, &session->stats); 1122 stats.session_id = session->session_id; 1123 } 1124 stats.tunnel_id = session->tunnel->tunnel_id; 1125 stats.using_ipsec = l2tp_tunnel_uses_xfrm(session->tunnel); 1126 1127 if (copy_to_user((void __user *)arg, &stats, sizeof(stats))) { 1128 err = -EFAULT; 1129 break; 1130 } 1131 break; 1132 1133 default: 1134 err = -ENOIOCTLCMD; 1135 break; 1136 } 1137 1138 if (session) 1139 l2tp_session_put(session); 1140 1141 return err; 1142 } 1143 1144 /***************************************************************************** 1145 * setsockopt() / getsockopt() support. 1146 * 1147 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1148 * sockets. In order to control kernel tunnel features, we allow userspace to 1149 * create a special "tunnel" PPPoX socket which is used for control only. 1150 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user 1151 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls. 1152 *****************************************************************************/ 1153 1154 /* Tunnel setsockopt() helper. 1155 */ 1156 static int pppol2tp_tunnel_setsockopt(struct sock *sk, 1157 struct l2tp_tunnel *tunnel, 1158 int optname, int val) 1159 { 1160 int err = 0; 1161 1162 switch (optname) { 1163 case PPPOL2TP_SO_DEBUG: 1164 /* Tunnel debug flags option is deprecated */ 1165 break; 1166 1167 default: 1168 err = -ENOPROTOOPT; 1169 break; 1170 } 1171 1172 return err; 1173 } 1174 1175 /* Session setsockopt helper. 1176 */ 1177 static int pppol2tp_session_setsockopt(struct sock *sk, 1178 struct l2tp_session *session, 1179 int optname, int val) 1180 { 1181 int err = 0; 1182 1183 switch (optname) { 1184 case PPPOL2TP_SO_RECVSEQ: 1185 if (val != 0 && val != 1) { 1186 err = -EINVAL; 1187 break; 1188 } 1189 session->recv_seq = !!val; 1190 break; 1191 1192 case PPPOL2TP_SO_SENDSEQ: 1193 if (val != 0 && val != 1) { 1194 err = -EINVAL; 1195 break; 1196 } 1197 session->send_seq = !!val; 1198 l2tp_session_set_header_len(session, session->tunnel->version, 1199 session->tunnel->encap); 1200 break; 1201 1202 case PPPOL2TP_SO_LNSMODE: 1203 if (val != 0 && val != 1) { 1204 err = -EINVAL; 1205 break; 1206 } 1207 session->lns_mode = !!val; 1208 break; 1209 1210 case PPPOL2TP_SO_DEBUG: 1211 /* Session debug flags option is deprecated */ 1212 break; 1213 1214 case PPPOL2TP_SO_REORDERTO: 1215 session->reorder_timeout = msecs_to_jiffies(val); 1216 break; 1217 1218 default: 1219 err = -ENOPROTOOPT; 1220 break; 1221 } 1222 1223 return err; 1224 } 1225 1226 /* Main setsockopt() entry point. 1227 * Does API checks, then calls either the tunnel or session setsockopt 1228 * handler, according to whether the PPPoL2TP socket is a for a regular 1229 * session or the special tunnel type. 1230 */ 1231 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, 1232 sockptr_t optval, unsigned int optlen) 1233 { 1234 struct sock *sk = sock->sk; 1235 struct l2tp_session *session; 1236 struct l2tp_tunnel *tunnel; 1237 int val; 1238 int err; 1239 1240 if (level != SOL_PPPOL2TP) 1241 return -EINVAL; 1242 1243 if (optlen < sizeof(int)) 1244 return -EINVAL; 1245 1246 if (copy_from_sockptr(&val, optval, sizeof(int))) 1247 return -EFAULT; 1248 1249 err = -ENOTCONN; 1250 if (!sk->sk_user_data) 1251 goto end; 1252 1253 /* Get session context from the socket */ 1254 err = -EBADF; 1255 session = pppol2tp_sock_to_session(sk); 1256 if (!session) 1257 goto end; 1258 1259 /* Special case: if session_id == 0x0000, treat as operation on tunnel 1260 */ 1261 if (session->session_id == 0 && session->peer_session_id == 0) { 1262 tunnel = session->tunnel; 1263 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val); 1264 } else { 1265 err = pppol2tp_session_setsockopt(sk, session, optname, val); 1266 } 1267 1268 l2tp_session_put(session); 1269 end: 1270 return err; 1271 } 1272 1273 /* Tunnel getsockopt helper. Called with sock locked. 1274 */ 1275 static int pppol2tp_tunnel_getsockopt(struct sock *sk, 1276 struct l2tp_tunnel *tunnel, 1277 int optname, int *val) 1278 { 1279 int err = 0; 1280 1281 switch (optname) { 1282 case PPPOL2TP_SO_DEBUG: 1283 /* Tunnel debug flags option is deprecated */ 1284 *val = 0; 1285 break; 1286 1287 default: 1288 err = -ENOPROTOOPT; 1289 break; 1290 } 1291 1292 return err; 1293 } 1294 1295 /* Session getsockopt helper. Called with sock locked. 1296 */ 1297 static int pppol2tp_session_getsockopt(struct sock *sk, 1298 struct l2tp_session *session, 1299 int optname, int *val) 1300 { 1301 int err = 0; 1302 1303 switch (optname) { 1304 case PPPOL2TP_SO_RECVSEQ: 1305 *val = session->recv_seq; 1306 break; 1307 1308 case PPPOL2TP_SO_SENDSEQ: 1309 *val = session->send_seq; 1310 break; 1311 1312 case PPPOL2TP_SO_LNSMODE: 1313 *val = session->lns_mode; 1314 break; 1315 1316 case PPPOL2TP_SO_DEBUG: 1317 /* Session debug flags option is deprecated */ 1318 *val = 0; 1319 break; 1320 1321 case PPPOL2TP_SO_REORDERTO: 1322 *val = (int)jiffies_to_msecs(session->reorder_timeout); 1323 break; 1324 1325 default: 1326 err = -ENOPROTOOPT; 1327 } 1328 1329 return err; 1330 } 1331 1332 /* Main getsockopt() entry point. 1333 * Does API checks, then calls either the tunnel or session getsockopt 1334 * handler, according to whether the PPPoX socket is a for a regular session 1335 * or the special tunnel type. 1336 */ 1337 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, 1338 char __user *optval, int __user *optlen) 1339 { 1340 struct sock *sk = sock->sk; 1341 struct l2tp_session *session; 1342 struct l2tp_tunnel *tunnel; 1343 int val, len; 1344 int err; 1345 1346 if (level != SOL_PPPOL2TP) 1347 return -EINVAL; 1348 1349 if (get_user(len, optlen)) 1350 return -EFAULT; 1351 1352 if (len < 0) 1353 return -EINVAL; 1354 1355 len = min_t(unsigned int, len, sizeof(int)); 1356 1357 err = -ENOTCONN; 1358 if (!sk->sk_user_data) 1359 goto end; 1360 1361 /* Get the session context */ 1362 err = -EBADF; 1363 session = pppol2tp_sock_to_session(sk); 1364 if (!session) 1365 goto end; 1366 1367 /* Special case: if session_id == 0x0000, treat as operation on tunnel */ 1368 if (session->session_id == 0 && session->peer_session_id == 0) { 1369 tunnel = session->tunnel; 1370 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val); 1371 if (err) 1372 goto end_put_sess; 1373 } else { 1374 err = pppol2tp_session_getsockopt(sk, session, optname, &val); 1375 if (err) 1376 goto end_put_sess; 1377 } 1378 1379 err = -EFAULT; 1380 if (put_user(len, optlen)) 1381 goto end_put_sess; 1382 1383 if (copy_to_user((void __user *)optval, &val, len)) 1384 goto end_put_sess; 1385 1386 err = 0; 1387 1388 end_put_sess: 1389 l2tp_session_put(session); 1390 end: 1391 return err; 1392 } 1393 1394 /***************************************************************************** 1395 * /proc filesystem for debug 1396 * Since the original pppol2tp driver provided /proc/net/pppol2tp for 1397 * L2TPv2, we dump only L2TPv2 tunnels and sessions here. 1398 *****************************************************************************/ 1399 1400 #ifdef CONFIG_PROC_FS 1401 1402 struct pppol2tp_seq_data { 1403 struct seq_net_private p; 1404 unsigned long tkey; /* lookup key of current tunnel */ 1405 unsigned long skey; /* lookup key of current session */ 1406 struct l2tp_tunnel *tunnel; 1407 struct l2tp_session *session; /* NULL means get next tunnel */ 1408 }; 1409 1410 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) 1411 { 1412 /* Drop reference taken during previous invocation */ 1413 if (pd->tunnel) 1414 l2tp_tunnel_put(pd->tunnel); 1415 1416 for (;;) { 1417 pd->tunnel = l2tp_tunnel_get_next(net, &pd->tkey); 1418 pd->tkey++; 1419 1420 /* Only accept L2TPv2 tunnels */ 1421 if (!pd->tunnel || pd->tunnel->version == 2) 1422 return; 1423 1424 l2tp_tunnel_put(pd->tunnel); 1425 } 1426 } 1427 1428 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) 1429 { 1430 /* Drop reference taken during previous invocation */ 1431 if (pd->session) 1432 l2tp_session_put(pd->session); 1433 1434 pd->session = l2tp_session_get_next(net, pd->tunnel->sock, 1435 pd->tunnel->version, 1436 pd->tunnel->tunnel_id, &pd->skey); 1437 pd->skey++; 1438 1439 if (!pd->session) { 1440 pd->skey = 0; 1441 pppol2tp_next_tunnel(net, pd); 1442 } 1443 } 1444 1445 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs) 1446 { 1447 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN; 1448 loff_t pos = *offs; 1449 struct net *net; 1450 1451 if (!pos) 1452 goto out; 1453 1454 if (WARN_ON(!m->private)) { 1455 pd = NULL; 1456 goto out; 1457 } 1458 1459 pd = m->private; 1460 net = seq_file_net(m); 1461 1462 if (!pd->tunnel) 1463 pppol2tp_next_tunnel(net, pd); 1464 else 1465 pppol2tp_next_session(net, pd); 1466 1467 /* NULL tunnel and session indicates end of list */ 1468 if (!pd->tunnel && !pd->session) 1469 pd = NULL; 1470 1471 out: 1472 return pd; 1473 } 1474 1475 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos) 1476 { 1477 (*pos)++; 1478 return NULL; 1479 } 1480 1481 static void pppol2tp_seq_stop(struct seq_file *p, void *v) 1482 { 1483 struct pppol2tp_seq_data *pd = v; 1484 1485 if (!pd || pd == SEQ_START_TOKEN) 1486 return; 1487 1488 /* Drop reference taken by last invocation of pppol2tp_next_session() 1489 * or pppol2tp_next_tunnel(). 1490 */ 1491 if (pd->session) { 1492 l2tp_session_put(pd->session); 1493 pd->session = NULL; 1494 } 1495 if (pd->tunnel) { 1496 l2tp_tunnel_put(pd->tunnel); 1497 pd->tunnel = NULL; 1498 } 1499 } 1500 1501 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) 1502 { 1503 struct l2tp_tunnel *tunnel = v; 1504 1505 seq_printf(m, "\nTUNNEL '%s', %c %d\n", 1506 tunnel->name, 1507 tunnel->sock ? 'Y' : 'N', 1508 refcount_read(&tunnel->ref_count) - 1); 1509 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n", 1510 0, 1511 atomic_long_read(&tunnel->stats.tx_packets), 1512 atomic_long_read(&tunnel->stats.tx_bytes), 1513 atomic_long_read(&tunnel->stats.tx_errors), 1514 atomic_long_read(&tunnel->stats.rx_packets), 1515 atomic_long_read(&tunnel->stats.rx_bytes), 1516 atomic_long_read(&tunnel->stats.rx_errors)); 1517 } 1518 1519 static void pppol2tp_seq_session_show(struct seq_file *m, void *v) 1520 { 1521 struct l2tp_session *session = v; 1522 struct l2tp_tunnel *tunnel = session->tunnel; 1523 unsigned char state; 1524 char user_data_ok; 1525 struct sock *sk; 1526 u32 ip = 0; 1527 u16 port = 0; 1528 1529 if (tunnel->sock) { 1530 struct inet_sock *inet = inet_sk(tunnel->sock); 1531 1532 ip = ntohl(inet->inet_saddr); 1533 port = ntohs(inet->inet_sport); 1534 } 1535 1536 rcu_read_lock(); 1537 sk = pppol2tp_session_get_sock(session); 1538 if (sk) { 1539 state = sk->sk_state; 1540 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N'; 1541 } else { 1542 state = 0; 1543 user_data_ok = 'N'; 1544 } 1545 1546 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> %04X/%04X %d %c\n", 1547 session->name, ip, port, 1548 tunnel->tunnel_id, 1549 session->session_id, 1550 tunnel->peer_tunnel_id, 1551 session->peer_session_id, 1552 state, user_data_ok); 1553 seq_printf(m, " 0/0/%c/%c/%s %08x %u\n", 1554 session->recv_seq ? 'R' : '-', 1555 session->send_seq ? 'S' : '-', 1556 session->lns_mode ? "LNS" : "LAC", 1557 0, 1558 jiffies_to_msecs(session->reorder_timeout)); 1559 seq_printf(m, " %u/%u %ld/%ld/%ld %ld/%ld/%ld\n", 1560 session->nr, session->ns, 1561 atomic_long_read(&session->stats.tx_packets), 1562 atomic_long_read(&session->stats.tx_bytes), 1563 atomic_long_read(&session->stats.tx_errors), 1564 atomic_long_read(&session->stats.rx_packets), 1565 atomic_long_read(&session->stats.rx_bytes), 1566 atomic_long_read(&session->stats.rx_errors)); 1567 1568 if (sk) { 1569 struct pppox_sock *po = pppox_sk(sk); 1570 1571 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 1572 } 1573 rcu_read_unlock(); 1574 } 1575 1576 static int pppol2tp_seq_show(struct seq_file *m, void *v) 1577 { 1578 struct pppol2tp_seq_data *pd = v; 1579 1580 /* display header on line 1 */ 1581 if (v == SEQ_START_TOKEN) { 1582 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n"); 1583 seq_puts(m, "TUNNEL name, user-data-ok session-count\n"); 1584 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1585 seq_puts(m, " SESSION name, addr/port src-tid/sid dest-tid/sid state user-data-ok\n"); 1586 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n"); 1587 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1588 goto out; 1589 } 1590 1591 if (!pd->session) 1592 pppol2tp_seq_tunnel_show(m, pd->tunnel); 1593 else 1594 pppol2tp_seq_session_show(m, pd->session); 1595 1596 out: 1597 return 0; 1598 } 1599 1600 static const struct seq_operations pppol2tp_seq_ops = { 1601 .start = pppol2tp_seq_start, 1602 .next = pppol2tp_seq_next, 1603 .stop = pppol2tp_seq_stop, 1604 .show = pppol2tp_seq_show, 1605 }; 1606 #endif /* CONFIG_PROC_FS */ 1607 1608 /***************************************************************************** 1609 * Network namespace 1610 *****************************************************************************/ 1611 1612 static __net_init int pppol2tp_init_net(struct net *net) 1613 { 1614 struct proc_dir_entry *pde; 1615 int err = 0; 1616 1617 pde = proc_create_net("pppol2tp", 0444, net->proc_net, 1618 &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data)); 1619 if (!pde) { 1620 err = -ENOMEM; 1621 goto out; 1622 } 1623 1624 out: 1625 return err; 1626 } 1627 1628 static __net_exit void pppol2tp_exit_net(struct net *net) 1629 { 1630 remove_proc_entry("pppol2tp", net->proc_net); 1631 } 1632 1633 static struct pernet_operations pppol2tp_net_ops = { 1634 .init = pppol2tp_init_net, 1635 .exit = pppol2tp_exit_net, 1636 }; 1637 1638 /***************************************************************************** 1639 * Init and cleanup 1640 *****************************************************************************/ 1641 1642 static const struct proto_ops pppol2tp_ops = { 1643 .family = AF_PPPOX, 1644 .owner = THIS_MODULE, 1645 .release = pppol2tp_release, 1646 .bind = sock_no_bind, 1647 .connect = pppol2tp_connect, 1648 .socketpair = sock_no_socketpair, 1649 .accept = sock_no_accept, 1650 .getname = pppol2tp_getname, 1651 .poll = datagram_poll, 1652 .listen = sock_no_listen, 1653 .shutdown = sock_no_shutdown, 1654 .setsockopt = pppol2tp_setsockopt, 1655 .getsockopt = pppol2tp_getsockopt, 1656 .sendmsg = pppol2tp_sendmsg, 1657 .recvmsg = pppol2tp_recvmsg, 1658 .mmap = sock_no_mmap, 1659 .ioctl = pppox_ioctl, 1660 #ifdef CONFIG_COMPAT 1661 .compat_ioctl = pppox_compat_ioctl, 1662 #endif 1663 }; 1664 1665 static const struct pppox_proto pppol2tp_proto = { 1666 .create = pppol2tp_create, 1667 .ioctl = pppol2tp_ioctl, 1668 .owner = THIS_MODULE, 1669 }; 1670 1671 #ifdef CONFIG_L2TP_V3 1672 1673 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = { 1674 .session_create = pppol2tp_session_create, 1675 .session_delete = l2tp_session_delete, 1676 }; 1677 1678 #endif /* CONFIG_L2TP_V3 */ 1679 1680 static int __init pppol2tp_init(void) 1681 { 1682 int err; 1683 1684 err = register_pernet_device(&pppol2tp_net_ops); 1685 if (err) 1686 goto out; 1687 1688 err = proto_register(&pppol2tp_sk_proto, 0); 1689 if (err) 1690 goto out_unregister_pppol2tp_pernet; 1691 1692 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto); 1693 if (err) 1694 goto out_unregister_pppol2tp_proto; 1695 1696 #ifdef CONFIG_L2TP_V3 1697 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops); 1698 if (err) 1699 goto out_unregister_pppox; 1700 #endif 1701 1702 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION); 1703 1704 out: 1705 return err; 1706 1707 #ifdef CONFIG_L2TP_V3 1708 out_unregister_pppox: 1709 unregister_pppox_proto(PX_PROTO_OL2TP); 1710 #endif 1711 out_unregister_pppol2tp_proto: 1712 proto_unregister(&pppol2tp_sk_proto); 1713 out_unregister_pppol2tp_pernet: 1714 unregister_pernet_device(&pppol2tp_net_ops); 1715 goto out; 1716 } 1717 1718 static void __exit pppol2tp_exit(void) 1719 { 1720 #ifdef CONFIG_L2TP_V3 1721 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP); 1722 #endif 1723 unregister_pppox_proto(PX_PROTO_OL2TP); 1724 proto_unregister(&pppol2tp_sk_proto); 1725 unregister_pernet_device(&pppol2tp_net_ops); 1726 } 1727 1728 module_init(pppol2tp_init); 1729 module_exit(pppol2tp_exit); 1730 1731 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1732 MODULE_DESCRIPTION("PPP over L2TP over UDP"); 1733 MODULE_LICENSE("GPL"); 1734 MODULE_VERSION(PPPOL2TP_DRV_VERSION); 1735 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP); 1736 MODULE_ALIAS_L2TP_PWTYPE(7); 1737