1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /***************************************************************************** 3 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets 4 * 5 * PPPoX --- Generic PPP encapsulation socket family 6 * PPPoL2TP --- PPP over L2TP (RFC 2661) 7 * 8 * Version: 2.0.0 9 * 10 * Authors: James Chapman (jchapman@katalix.com) 11 * 12 * Based on original work by Martijn van Oosterhout <kleptog@svana.org> 13 * 14 * License: 15 */ 16 17 /* This driver handles only L2TP data frames; control frames are handled by a 18 * userspace application. 19 * 20 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and 21 * attaches it to a bound UDP socket with local tunnel_id / session_id and 22 * peer tunnel_id / session_id set. Data can then be sent or received using 23 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket 24 * can be read or modified using ioctl() or [gs]etsockopt() calls. 25 * 26 * When a PPPoL2TP socket is connected with local and peer session_id values 27 * zero, the socket is treated as a special tunnel management socket. 28 * 29 * Here's example userspace code to create a socket for sending/receiving data 30 * over an L2TP session:- 31 * 32 * struct sockaddr_pppol2tp sax; 33 * int fd; 34 * int session_fd; 35 * 36 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); 37 * 38 * sax.sa_family = AF_PPPOX; 39 * sax.sa_protocol = PX_PROTO_OL2TP; 40 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket 41 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr; 42 * sax.pppol2tp.addr.sin_port = addr->sin_port; 43 * sax.pppol2tp.addr.sin_family = AF_INET; 44 * sax.pppol2tp.s_tunnel = tunnel_id; 45 * sax.pppol2tp.s_session = session_id; 46 * sax.pppol2tp.d_tunnel = peer_tunnel_id; 47 * sax.pppol2tp.d_session = peer_session_id; 48 * 49 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax)); 50 * 51 * A pppd plugin that allows PPP traffic to be carried over L2TP using 52 * this driver is available from the OpenL2TP project at 53 * http://openl2tp.sourceforge.net. 54 */ 55 56 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 57 58 #include <linux/module.h> 59 #include <linux/string.h> 60 #include <linux/list.h> 61 #include <linux/uaccess.h> 62 #include <linux/uio.h> 63 64 #include <linux/kernel.h> 65 #include <linux/spinlock.h> 66 #include <linux/kthread.h> 67 #include <linux/sched.h> 68 #include <linux/slab.h> 69 #include <linux/errno.h> 70 #include <linux/jiffies.h> 71 72 #include <linux/netdevice.h> 73 #include <linux/net.h> 74 #include <linux/inetdevice.h> 75 #include <linux/skbuff.h> 76 #include <linux/init.h> 77 #include <linux/ip.h> 78 #include <linux/udp.h> 79 #include <linux/if_pppox.h> 80 #include <linux/if_pppol2tp.h> 81 #include <net/sock.h> 82 #include <linux/ppp_channel.h> 83 #include <linux/ppp_defs.h> 84 #include <linux/ppp-ioctl.h> 85 #include <linux/file.h> 86 #include <linux/hash.h> 87 #include <linux/sort.h> 88 #include <linux/proc_fs.h> 89 #include <linux/l2tp.h> 90 #include <linux/nsproxy.h> 91 #include <net/net_namespace.h> 92 #include <net/netns/generic.h> 93 #include <net/ip.h> 94 #include <net/udp.h> 95 #include <net/inet_common.h> 96 97 #include <asm/byteorder.h> 98 #include <linux/atomic.h> 99 100 #include "l2tp_core.h" 101 102 #define PPPOL2TP_DRV_VERSION "V2.0" 103 104 /* Space for UDP, L2TP and PPP headers */ 105 #define PPPOL2TP_HEADER_OVERHEAD 40 106 107 /* Number of bytes to build transmit L2TP headers. 108 * Unfortunately the size is different depending on whether sequence numbers 109 * are enabled. 110 */ 111 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10 112 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6 113 114 /* Private data of each session. This data lives at the end of struct 115 * l2tp_session, referenced via session->priv[]. 116 */ 117 struct pppol2tp_session { 118 int owner; /* pid that opened the socket */ 119 120 struct mutex sk_lock; /* Protects .sk */ 121 struct sock __rcu *sk; /* Pointer to the session PPPoX socket */ 122 struct sock *__sk; /* Copy of .sk, for cleanup */ 123 }; 124 125 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb); 126 127 static const struct ppp_channel_ops pppol2tp_chan_ops = { 128 .start_xmit = pppol2tp_xmit, 129 }; 130 131 static const struct proto_ops pppol2tp_ops; 132 133 /* Retrieves the pppol2tp socket associated to a session. */ 134 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) 135 { 136 struct pppol2tp_session *ps = l2tp_session_priv(session); 137 138 return rcu_dereference(ps->sk); 139 } 140 141 /* Helpers to obtain tunnel/session contexts from sockets. 142 */ 143 static struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) 144 { 145 struct l2tp_session *session; 146 147 if (!sk) 148 return NULL; 149 150 rcu_read_lock(); 151 session = rcu_dereference_sk_user_data(sk); 152 if (session && refcount_inc_not_zero(&session->ref_count)) { 153 rcu_read_unlock(); 154 WARN_ON_ONCE(session->magic != L2TP_SESSION_MAGIC); 155 return session; 156 } 157 rcu_read_unlock(); 158 159 return NULL; 160 } 161 162 /***************************************************************************** 163 * Receive data handling 164 *****************************************************************************/ 165 166 /* Receive message. This is the recvmsg for the PPPoL2TP socket. 167 */ 168 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, 169 size_t len, int flags) 170 { 171 int err; 172 struct sk_buff *skb; 173 struct sock *sk = sock->sk; 174 175 err = -EIO; 176 if (sk->sk_state & PPPOX_BOUND) 177 goto end; 178 179 err = 0; 180 skb = skb_recv_datagram(sk, flags, &err); 181 if (!skb) 182 goto end; 183 184 if (len > skb->len) 185 len = skb->len; 186 else if (len < skb->len) 187 msg->msg_flags |= MSG_TRUNC; 188 189 err = skb_copy_datagram_msg(skb, 0, msg, len); 190 if (likely(err == 0)) 191 err = len; 192 193 kfree_skb(skb); 194 end: 195 return err; 196 } 197 198 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) 199 { 200 struct sock *sk; 201 202 /* If the socket is bound, send it in to PPP's input queue. Otherwise 203 * queue it on the session socket. 204 */ 205 rcu_read_lock(); 206 sk = pppol2tp_session_get_sock(session); 207 if (!sk) 208 goto no_sock; 209 210 /* If the first two bytes are 0xFF03, consider that it is the PPP's 211 * Address and Control fields and skip them. The L2TP module has always 212 * worked this way, although, in theory, the use of these fields should 213 * be negotiated and handled at the PPP layer. These fields are 214 * constant: 0xFF is the All-Stations Address and 0x03 the Unnumbered 215 * Information command with Poll/Final bit set to zero (RFC 1662). 216 */ 217 if (pskb_may_pull(skb, 2) && skb->data[0] == PPP_ALLSTATIONS && 218 skb->data[1] == PPP_UI) 219 skb_pull(skb, 2); 220 221 if (sk->sk_state & PPPOX_BOUND) { 222 struct pppox_sock *po; 223 224 po = pppox_sk(sk); 225 ppp_input(&po->chan, skb); 226 } else { 227 if (sock_queue_rcv_skb(sk, skb) < 0) { 228 atomic_long_inc(&session->stats.rx_errors); 229 kfree_skb(skb); 230 } 231 } 232 rcu_read_unlock(); 233 234 return; 235 236 no_sock: 237 rcu_read_unlock(); 238 pr_warn_ratelimited("%s: no socket in recv\n", session->name); 239 kfree_skb(skb); 240 } 241 242 /************************************************************************ 243 * Transmit handling 244 ***********************************************************************/ 245 246 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here 247 * when a user application does a sendmsg() on the session socket. L2TP and 248 * PPP headers must be inserted into the user's data. 249 */ 250 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m, 251 size_t total_len) 252 { 253 struct sock *sk = sock->sk; 254 struct sk_buff *skb; 255 int error; 256 struct l2tp_session *session; 257 struct l2tp_tunnel *tunnel; 258 int uhlen; 259 260 error = -ENOTCONN; 261 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 262 goto error; 263 264 /* Get session and tunnel contexts */ 265 error = -EBADF; 266 session = pppol2tp_sock_to_session(sk); 267 if (!session) 268 goto error; 269 270 tunnel = session->tunnel; 271 272 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 273 274 /* Allocate a socket buffer */ 275 error = -ENOMEM; 276 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 277 uhlen + session->hdr_len + 278 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 279 0, GFP_KERNEL); 280 if (!skb) 281 goto error_put_sess; 282 283 /* Reserve space for headers. */ 284 skb_reserve(skb, NET_SKB_PAD); 285 skb_reset_network_header(skb); 286 skb_reserve(skb, sizeof(struct iphdr)); 287 skb_reset_transport_header(skb); 288 skb_reserve(skb, uhlen); 289 290 /* Add PPP header */ 291 skb->data[0] = PPP_ALLSTATIONS; 292 skb->data[1] = PPP_UI; 293 skb_put(skb, 2); 294 295 /* Copy user data into skb */ 296 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len); 297 if (error < 0) { 298 kfree_skb(skb); 299 goto error_put_sess; 300 } 301 302 local_bh_disable(); 303 l2tp_xmit_skb(session, skb); 304 local_bh_enable(); 305 306 l2tp_session_put(session); 307 308 return total_len; 309 310 error_put_sess: 311 l2tp_session_put(session); 312 error: 313 return error; 314 } 315 316 /* Transmit function called by generic PPP driver. Sends PPP frame 317 * over PPPoL2TP socket. 318 * 319 * This is almost the same as pppol2tp_sendmsg(), but rather than 320 * being called with a msghdr from userspace, it is called with a skb 321 * from the kernel. 322 * 323 * The supplied skb from ppp doesn't have enough headroom for the 324 * insertion of L2TP, UDP and IP headers so we need to allocate more 325 * headroom in the skb. This will create a cloned skb. But we must be 326 * careful in the error case because the caller will expect to free 327 * the skb it supplied, not our cloned skb. So we take care to always 328 * leave the original skb unfreed if we return an error. 329 */ 330 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) 331 { 332 struct sock *sk = (struct sock *)chan->private; 333 struct l2tp_session *session; 334 struct l2tp_tunnel *tunnel; 335 int uhlen, headroom; 336 337 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 338 goto abort; 339 340 /* Get session and tunnel contexts from the socket */ 341 session = pppol2tp_sock_to_session(sk); 342 if (!session) 343 goto abort; 344 345 tunnel = session->tunnel; 346 347 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 348 headroom = NET_SKB_PAD + 349 sizeof(struct iphdr) + /* IP header */ 350 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */ 351 session->hdr_len + /* L2TP header */ 352 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 353 if (skb_cow_head(skb, headroom)) 354 goto abort_put_sess; 355 356 /* Setup PPP header */ 357 __skb_push(skb, 2); 358 skb->data[0] = PPP_ALLSTATIONS; 359 skb->data[1] = PPP_UI; 360 361 local_bh_disable(); 362 l2tp_xmit_skb(session, skb); 363 local_bh_enable(); 364 365 l2tp_session_put(session); 366 367 return 1; 368 369 abort_put_sess: 370 l2tp_session_put(session); 371 abort: 372 /* Free the original skb */ 373 kfree_skb(skb); 374 return 1; 375 } 376 377 /***************************************************************************** 378 * Session (and tunnel control) socket create/destroy. 379 *****************************************************************************/ 380 381 /* Really kill the session socket. (Called from sock_put() if 382 * refcnt == 0.) 383 */ 384 static void pppol2tp_session_destruct(struct sock *sk) 385 { 386 skb_queue_purge(&sk->sk_receive_queue); 387 skb_queue_purge(&sk->sk_write_queue); 388 } 389 390 static void pppol2tp_session_close(struct l2tp_session *session) 391 { 392 struct pppol2tp_session *ps; 393 394 ps = l2tp_session_priv(session); 395 mutex_lock(&ps->sk_lock); 396 ps->__sk = rcu_dereference_protected(ps->sk, 397 lockdep_is_held(&ps->sk_lock)); 398 RCU_INIT_POINTER(ps->sk, NULL); 399 mutex_unlock(&ps->sk_lock); 400 if (ps->__sk) { 401 /* detach socket */ 402 rcu_assign_sk_user_data(ps->__sk, NULL); 403 sock_put(ps->__sk); 404 405 /* drop ref taken when we referenced socket via sk_user_data */ 406 l2tp_session_put(session); 407 } 408 } 409 410 /* Called when the PPPoX socket (session) is closed. 411 */ 412 static int pppol2tp_release(struct socket *sock) 413 { 414 struct sock *sk = sock->sk; 415 struct l2tp_session *session; 416 int error; 417 418 if (!sk) 419 return 0; 420 421 error = -EBADF; 422 lock_sock(sk); 423 if (sock_flag(sk, SOCK_DEAD) != 0) 424 goto error; 425 426 pppox_unbind_sock(sk); 427 428 /* Signal the death of the socket. */ 429 sk->sk_state = PPPOX_DEAD; 430 sock_orphan(sk); 431 sock->sk = NULL; 432 433 session = pppol2tp_sock_to_session(sk); 434 if (session) { 435 l2tp_session_delete(session); 436 /* drop ref taken by pppol2tp_sock_to_session */ 437 l2tp_session_put(session); 438 } 439 440 release_sock(sk); 441 442 sock_put(sk); 443 444 return 0; 445 446 error: 447 release_sock(sk); 448 return error; 449 } 450 451 static struct proto pppol2tp_sk_proto = { 452 .name = "PPPOL2TP", 453 .owner = THIS_MODULE, 454 .obj_size = sizeof(struct pppox_sock), 455 }; 456 457 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb) 458 { 459 int rc; 460 461 rc = l2tp_udp_encap_recv(sk, skb); 462 if (rc) 463 kfree_skb(skb); 464 465 return NET_RX_SUCCESS; 466 } 467 468 /* socket() handler. Initialize a new struct sock. 469 */ 470 static int pppol2tp_create(struct net *net, struct socket *sock, int kern) 471 { 472 int error = -ENOMEM; 473 struct sock *sk; 474 475 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern); 476 if (!sk) 477 goto out; 478 479 sock_init_data(sock, sk); 480 sock_set_flag(sk, SOCK_RCU_FREE); 481 482 sock->state = SS_UNCONNECTED; 483 sock->ops = &pppol2tp_ops; 484 485 sk->sk_backlog_rcv = pppol2tp_backlog_recv; 486 sk->sk_protocol = PX_PROTO_OL2TP; 487 sk->sk_family = PF_PPPOX; 488 sk->sk_state = PPPOX_NONE; 489 sk->sk_type = SOCK_STREAM; 490 sk->sk_destruct = pppol2tp_session_destruct; 491 492 error = 0; 493 494 out: 495 return error; 496 } 497 498 static void pppol2tp_show(struct seq_file *m, void *arg) 499 { 500 struct l2tp_session *session = arg; 501 struct sock *sk; 502 503 rcu_read_lock(); 504 sk = pppol2tp_session_get_sock(session); 505 if (sk) { 506 struct pppox_sock *po = pppox_sk(sk); 507 508 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 509 } 510 rcu_read_unlock(); 511 } 512 513 static void pppol2tp_session_init(struct l2tp_session *session) 514 { 515 struct pppol2tp_session *ps; 516 517 session->recv_skb = pppol2tp_recv; 518 session->session_close = pppol2tp_session_close; 519 if (IS_ENABLED(CONFIG_L2TP_DEBUGFS)) 520 session->show = pppol2tp_show; 521 522 ps = l2tp_session_priv(session); 523 mutex_init(&ps->sk_lock); 524 ps->owner = current->pid; 525 } 526 527 struct l2tp_connect_info { 528 u8 version; 529 int fd; 530 u32 tunnel_id; 531 u32 peer_tunnel_id; 532 u32 session_id; 533 u32 peer_session_id; 534 }; 535 536 static int pppol2tp_sockaddr_get_info(const void *sa, int sa_len, 537 struct l2tp_connect_info *info) 538 { 539 switch (sa_len) { 540 case sizeof(struct sockaddr_pppol2tp): 541 { 542 const struct sockaddr_pppol2tp *sa_v2in4 = sa; 543 544 if (sa_v2in4->sa_protocol != PX_PROTO_OL2TP) 545 return -EINVAL; 546 547 info->version = 2; 548 info->fd = sa_v2in4->pppol2tp.fd; 549 info->tunnel_id = sa_v2in4->pppol2tp.s_tunnel; 550 info->peer_tunnel_id = sa_v2in4->pppol2tp.d_tunnel; 551 info->session_id = sa_v2in4->pppol2tp.s_session; 552 info->peer_session_id = sa_v2in4->pppol2tp.d_session; 553 554 break; 555 } 556 case sizeof(struct sockaddr_pppol2tpv3): 557 { 558 const struct sockaddr_pppol2tpv3 *sa_v3in4 = sa; 559 560 if (sa_v3in4->sa_protocol != PX_PROTO_OL2TP) 561 return -EINVAL; 562 563 info->version = 3; 564 info->fd = sa_v3in4->pppol2tp.fd; 565 info->tunnel_id = sa_v3in4->pppol2tp.s_tunnel; 566 info->peer_tunnel_id = sa_v3in4->pppol2tp.d_tunnel; 567 info->session_id = sa_v3in4->pppol2tp.s_session; 568 info->peer_session_id = sa_v3in4->pppol2tp.d_session; 569 570 break; 571 } 572 case sizeof(struct sockaddr_pppol2tpin6): 573 { 574 const struct sockaddr_pppol2tpin6 *sa_v2in6 = sa; 575 576 if (sa_v2in6->sa_protocol != PX_PROTO_OL2TP) 577 return -EINVAL; 578 579 info->version = 2; 580 info->fd = sa_v2in6->pppol2tp.fd; 581 info->tunnel_id = sa_v2in6->pppol2tp.s_tunnel; 582 info->peer_tunnel_id = sa_v2in6->pppol2tp.d_tunnel; 583 info->session_id = sa_v2in6->pppol2tp.s_session; 584 info->peer_session_id = sa_v2in6->pppol2tp.d_session; 585 586 break; 587 } 588 case sizeof(struct sockaddr_pppol2tpv3in6): 589 { 590 const struct sockaddr_pppol2tpv3in6 *sa_v3in6 = sa; 591 592 if (sa_v3in6->sa_protocol != PX_PROTO_OL2TP) 593 return -EINVAL; 594 595 info->version = 3; 596 info->fd = sa_v3in6->pppol2tp.fd; 597 info->tunnel_id = sa_v3in6->pppol2tp.s_tunnel; 598 info->peer_tunnel_id = sa_v3in6->pppol2tp.d_tunnel; 599 info->session_id = sa_v3in6->pppol2tp.s_session; 600 info->peer_session_id = sa_v3in6->pppol2tp.d_session; 601 602 break; 603 } 604 default: 605 return -EINVAL; 606 } 607 608 return 0; 609 } 610 611 /* Rough estimation of the maximum payload size a tunnel can transmit without 612 * fragmenting at the lower IP layer. Assumes L2TPv2 with sequence 613 * numbers and no IP option. Not quite accurate, but the result is mostly 614 * unused anyway. 615 */ 616 static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel) 617 { 618 int mtu; 619 620 mtu = l2tp_tunnel_dst_mtu(tunnel); 621 if (mtu <= PPPOL2TP_HEADER_OVERHEAD) 622 return 1500 - PPPOL2TP_HEADER_OVERHEAD; 623 624 return mtu - PPPOL2TP_HEADER_OVERHEAD; 625 } 626 627 static struct l2tp_tunnel *pppol2tp_tunnel_get(struct net *net, 628 const struct l2tp_connect_info *info, 629 bool *new_tunnel) 630 { 631 struct l2tp_tunnel *tunnel; 632 int error; 633 634 *new_tunnel = false; 635 636 tunnel = l2tp_tunnel_get(net, info->tunnel_id); 637 638 /* Special case: create tunnel context if session_id and 639 * peer_session_id is 0. Otherwise look up tunnel using supplied 640 * tunnel id. 641 */ 642 if (!info->session_id && !info->peer_session_id) { 643 if (!tunnel) { 644 struct l2tp_tunnel_cfg tcfg = { 645 .encap = L2TP_ENCAPTYPE_UDP, 646 }; 647 648 /* Prevent l2tp_tunnel_register() from trying to set up 649 * a kernel socket. 650 */ 651 if (info->fd < 0) 652 return ERR_PTR(-EBADF); 653 654 error = l2tp_tunnel_create(info->fd, 655 info->version, 656 info->tunnel_id, 657 info->peer_tunnel_id, &tcfg, 658 &tunnel); 659 if (error < 0) 660 return ERR_PTR(error); 661 662 refcount_inc(&tunnel->ref_count); 663 error = l2tp_tunnel_register(tunnel, net, &tcfg); 664 if (error < 0) { 665 kfree(tunnel); 666 return ERR_PTR(error); 667 } 668 669 *new_tunnel = true; 670 } 671 } else { 672 /* Error if we can't find the tunnel */ 673 if (!tunnel) 674 return ERR_PTR(-ENOENT); 675 676 /* Error if socket is not prepped */ 677 if (!tunnel->sock) { 678 l2tp_tunnel_put(tunnel); 679 return ERR_PTR(-ENOENT); 680 } 681 } 682 683 return tunnel; 684 } 685 686 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket 687 */ 688 static int pppol2tp_connect(struct socket *sock, struct sockaddr_unsized *uservaddr, 689 int sockaddr_len, int flags) 690 { 691 struct sock *sk = sock->sk; 692 struct pppox_sock *po = pppox_sk(sk); 693 struct l2tp_session *session = NULL; 694 struct l2tp_connect_info info; 695 struct l2tp_tunnel *tunnel; 696 struct pppol2tp_session *ps; 697 struct l2tp_session_cfg cfg = { 0, }; 698 bool drop_refcnt = false; 699 bool new_session = false; 700 bool new_tunnel = false; 701 int error; 702 703 error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info); 704 if (error < 0) 705 return error; 706 707 /* Don't bind if tunnel_id is 0 */ 708 if (!info.tunnel_id) 709 return -EINVAL; 710 711 tunnel = pppol2tp_tunnel_get(sock_net(sk), &info, &new_tunnel); 712 if (IS_ERR(tunnel)) 713 return PTR_ERR(tunnel); 714 715 lock_sock(sk); 716 717 /* Check for already bound sockets */ 718 error = -EBUSY; 719 if (sk->sk_state & PPPOX_CONNECTED) 720 goto end; 721 722 /* We don't supporting rebinding anyway */ 723 error = -EALREADY; 724 if (sk->sk_user_data) 725 goto end; /* socket is already attached */ 726 727 if (tunnel->peer_tunnel_id == 0) 728 tunnel->peer_tunnel_id = info.peer_tunnel_id; 729 730 session = l2tp_session_get(sock_net(sk), tunnel->sock, tunnel->version, 731 info.tunnel_id, info.session_id); 732 if (session) { 733 drop_refcnt = true; 734 735 if (session->pwtype != L2TP_PWTYPE_PPP) { 736 error = -EPROTOTYPE; 737 goto end; 738 } 739 740 ps = l2tp_session_priv(session); 741 742 /* Using a pre-existing session is fine as long as it hasn't 743 * been connected yet. 744 */ 745 mutex_lock(&ps->sk_lock); 746 if (rcu_dereference_protected(ps->sk, 747 lockdep_is_held(&ps->sk_lock)) || 748 ps->__sk) { 749 mutex_unlock(&ps->sk_lock); 750 error = -EEXIST; 751 goto end; 752 } 753 } else { 754 cfg.pw_type = L2TP_PWTYPE_PPP; 755 756 session = l2tp_session_create(sizeof(struct pppol2tp_session), 757 tunnel, info.session_id, 758 info.peer_session_id, &cfg); 759 if (IS_ERR(session)) { 760 error = PTR_ERR(session); 761 goto end; 762 } 763 764 drop_refcnt = true; 765 766 pppol2tp_session_init(session); 767 ps = l2tp_session_priv(session); 768 refcount_inc(&session->ref_count); 769 770 mutex_lock(&ps->sk_lock); 771 error = l2tp_session_register(session, tunnel); 772 if (error < 0) { 773 mutex_unlock(&ps->sk_lock); 774 l2tp_session_put(session); 775 goto end; 776 } 777 778 new_session = true; 779 } 780 781 /* Special case: if source & dest session_id == 0x0000, this 782 * socket is being created to manage the tunnel. Just set up 783 * the internal context for use by ioctl() and sockopt() 784 * handlers. 785 */ 786 if (session->session_id == 0 && session->peer_session_id == 0) { 787 error = 0; 788 goto out_no_ppp; 789 } 790 791 /* Reserve enough headroom for the L2TP header with sequence numbers, 792 * which is the largest possible. This is used by the PPP layer to set 793 * the net device's hard_header_len at registration, which must be 794 * sufficient regardless of whether sequence numbers are enabled later. 795 */ 796 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_SEQ; 797 798 po->chan.private = sk; 799 po->chan.ops = &pppol2tp_chan_ops; 800 po->chan.mtu = pppol2tp_tunnel_mtu(tunnel); 801 po->chan.direct_xmit = true; 802 803 error = ppp_register_net_channel(sock_net(sk), &po->chan); 804 if (error) { 805 mutex_unlock(&ps->sk_lock); 806 goto end; 807 } 808 809 out_no_ppp: 810 /* This is how we get the session context from the socket. */ 811 sock_hold(sk); 812 rcu_assign_sk_user_data(sk, session); 813 rcu_assign_pointer(ps->sk, sk); 814 mutex_unlock(&ps->sk_lock); 815 816 /* Keep the reference we've grabbed on the session: sk doesn't expect 817 * the session to disappear. pppol2tp_session_close() is responsible 818 * for dropping it. 819 */ 820 drop_refcnt = false; 821 822 sk->sk_state = PPPOX_CONNECTED; 823 824 end: 825 if (error) { 826 if (new_session) 827 l2tp_session_delete(session); 828 if (new_tunnel) 829 l2tp_tunnel_delete(tunnel); 830 } 831 if (drop_refcnt) 832 l2tp_session_put(session); 833 l2tp_tunnel_put(tunnel); 834 release_sock(sk); 835 836 return error; 837 } 838 839 #ifdef CONFIG_L2TP_V3 840 841 /* Called when creating sessions via the netlink interface. */ 842 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, 843 u32 session_id, u32 peer_session_id, 844 struct l2tp_session_cfg *cfg) 845 { 846 int error; 847 struct l2tp_session *session; 848 849 /* Error if tunnel socket is not prepped */ 850 if (!tunnel->sock) { 851 error = -ENOENT; 852 goto err; 853 } 854 855 /* Allocate and initialize a new session context. */ 856 session = l2tp_session_create(sizeof(struct pppol2tp_session), 857 tunnel, session_id, 858 peer_session_id, cfg); 859 if (IS_ERR(session)) { 860 error = PTR_ERR(session); 861 goto err; 862 } 863 864 pppol2tp_session_init(session); 865 866 error = l2tp_session_register(session, tunnel); 867 if (error < 0) 868 goto err_sess; 869 870 return 0; 871 872 err_sess: 873 l2tp_session_put(session); 874 err: 875 return error; 876 } 877 878 #endif /* CONFIG_L2TP_V3 */ 879 880 /* getname() support. 881 */ 882 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr, 883 int peer) 884 { 885 int len = 0; 886 int error = 0; 887 struct l2tp_session *session; 888 struct l2tp_tunnel *tunnel; 889 struct sock *sk = sock->sk; 890 struct inet_sock *inet; 891 struct pppol2tp_session *pls; 892 893 error = -ENOTCONN; 894 if (!sk) 895 goto end; 896 if (!(sk->sk_state & PPPOX_CONNECTED)) 897 goto end; 898 899 error = -EBADF; 900 session = pppol2tp_sock_to_session(sk); 901 if (!session) 902 goto end; 903 904 pls = l2tp_session_priv(session); 905 tunnel = session->tunnel; 906 907 inet = inet_sk(tunnel->sock); 908 if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET) { 909 struct sockaddr_pppol2tp sp; 910 911 len = sizeof(sp); 912 memset(&sp, 0, len); 913 sp.sa_family = AF_PPPOX; 914 sp.sa_protocol = PX_PROTO_OL2TP; 915 sp.pppol2tp.fd = tunnel->fd; 916 sp.pppol2tp.pid = pls->owner; 917 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 918 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 919 sp.pppol2tp.s_session = session->session_id; 920 sp.pppol2tp.d_session = session->peer_session_id; 921 sp.pppol2tp.addr.sin_family = AF_INET; 922 sp.pppol2tp.addr.sin_port = inet->inet_dport; 923 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 924 memcpy(uaddr, &sp, len); 925 #if IS_ENABLED(CONFIG_IPV6) 926 } else if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET6) { 927 struct sockaddr_pppol2tpin6 sp; 928 929 len = sizeof(sp); 930 memset(&sp, 0, len); 931 sp.sa_family = AF_PPPOX; 932 sp.sa_protocol = PX_PROTO_OL2TP; 933 sp.pppol2tp.fd = tunnel->fd; 934 sp.pppol2tp.pid = pls->owner; 935 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 936 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 937 sp.pppol2tp.s_session = session->session_id; 938 sp.pppol2tp.d_session = session->peer_session_id; 939 sp.pppol2tp.addr.sin6_family = AF_INET6; 940 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 941 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 942 sizeof(tunnel->sock->sk_v6_daddr)); 943 memcpy(uaddr, &sp, len); 944 } else if (tunnel->version == 3 && tunnel->sock->sk_family == AF_INET6) { 945 struct sockaddr_pppol2tpv3in6 sp; 946 947 len = sizeof(sp); 948 memset(&sp, 0, len); 949 sp.sa_family = AF_PPPOX; 950 sp.sa_protocol = PX_PROTO_OL2TP; 951 sp.pppol2tp.fd = tunnel->fd; 952 sp.pppol2tp.pid = pls->owner; 953 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 954 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 955 sp.pppol2tp.s_session = session->session_id; 956 sp.pppol2tp.d_session = session->peer_session_id; 957 sp.pppol2tp.addr.sin6_family = AF_INET6; 958 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 959 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 960 sizeof(tunnel->sock->sk_v6_daddr)); 961 memcpy(uaddr, &sp, len); 962 #endif 963 } else if (tunnel->version == 3) { 964 struct sockaddr_pppol2tpv3 sp; 965 966 len = sizeof(sp); 967 memset(&sp, 0, len); 968 sp.sa_family = AF_PPPOX; 969 sp.sa_protocol = PX_PROTO_OL2TP; 970 sp.pppol2tp.fd = tunnel->fd; 971 sp.pppol2tp.pid = pls->owner; 972 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 973 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 974 sp.pppol2tp.s_session = session->session_id; 975 sp.pppol2tp.d_session = session->peer_session_id; 976 sp.pppol2tp.addr.sin_family = AF_INET; 977 sp.pppol2tp.addr.sin_port = inet->inet_dport; 978 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 979 memcpy(uaddr, &sp, len); 980 } 981 982 error = len; 983 984 l2tp_session_put(session); 985 end: 986 return error; 987 } 988 989 /**************************************************************************** 990 * ioctl() handlers. 991 * 992 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 993 * sockets. However, in order to control kernel tunnel features, we allow 994 * userspace to create a special "tunnel" PPPoX socket which is used for 995 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow 996 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl() 997 * calls. 998 ****************************************************************************/ 999 1000 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest, 1001 const struct l2tp_stats *stats) 1002 { 1003 memset(dest, 0, sizeof(*dest)); 1004 1005 dest->tx_packets = atomic_long_read(&stats->tx_packets); 1006 dest->tx_bytes = atomic_long_read(&stats->tx_bytes); 1007 dest->tx_errors = atomic_long_read(&stats->tx_errors); 1008 dest->rx_packets = atomic_long_read(&stats->rx_packets); 1009 dest->rx_bytes = atomic_long_read(&stats->rx_bytes); 1010 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards); 1011 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets); 1012 dest->rx_errors = atomic_long_read(&stats->rx_errors); 1013 } 1014 1015 static int pppol2tp_tunnel_copy_stats(struct pppol2tp_ioc_stats *stats, 1016 struct l2tp_tunnel *tunnel) 1017 { 1018 struct l2tp_session *session; 1019 1020 if (!stats->session_id) { 1021 pppol2tp_copy_stats(stats, &tunnel->stats); 1022 return 0; 1023 } 1024 1025 /* If session_id is set, search the corresponding session in the 1026 * context of this tunnel and record the session's statistics. 1027 */ 1028 session = l2tp_session_get(tunnel->l2tp_net, tunnel->sock, tunnel->version, 1029 tunnel->tunnel_id, stats->session_id); 1030 if (!session) 1031 return -EBADR; 1032 1033 if (session->pwtype != L2TP_PWTYPE_PPP) { 1034 l2tp_session_put(session); 1035 return -EBADR; 1036 } 1037 1038 pppol2tp_copy_stats(stats, &session->stats); 1039 l2tp_session_put(session); 1040 1041 return 0; 1042 } 1043 1044 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, 1045 unsigned long arg) 1046 { 1047 struct pppol2tp_ioc_stats stats; 1048 struct l2tp_session *session; 1049 int err = 0; 1050 1051 session = pppol2tp_sock_to_session(sock->sk); 1052 1053 /* Validate session presence and magic integrity ONLY for commands 1054 * that belong to L2TP and require a valid session. 1055 */ 1056 switch (cmd) { 1057 case PPPIOCGMRU: 1058 case PPPIOCGFLAGS: 1059 case PPPIOCSMRU: 1060 case PPPIOCSFLAGS: 1061 case PPPIOCGL2TPSTATS: 1062 if (!session) 1063 return -ENOTCONN; 1064 1065 if (session->magic != L2TP_SESSION_MAGIC) { 1066 l2tp_session_put(session); 1067 return -EBADF; 1068 } 1069 break; 1070 default: 1071 break; 1072 } 1073 1074 switch (cmd) { 1075 case PPPIOCGMRU: 1076 case PPPIOCGFLAGS: 1077 /* Not defined for tunnels */ 1078 if (!session->session_id && !session->peer_session_id) { 1079 err = -ENOSYS; 1080 break; 1081 } 1082 1083 if (put_user(0, (int __user *)arg)) { 1084 err = -EFAULT; 1085 break; 1086 } 1087 break; 1088 1089 case PPPIOCSMRU: 1090 case PPPIOCSFLAGS: 1091 /* Not defined for tunnels */ 1092 if (!session->session_id && !session->peer_session_id) { 1093 err = -ENOSYS; 1094 break; 1095 } 1096 1097 if (!access_ok((int __user *)arg, sizeof(int))) { 1098 err = -EFAULT; 1099 break; 1100 } 1101 break; 1102 1103 case PPPIOCGL2TPSTATS: 1104 /* Session 0 represents the parent tunnel */ 1105 if (!session->session_id && !session->peer_session_id) { 1106 u32 session_id; 1107 1108 if (copy_from_user(&stats, (void __user *)arg, 1109 sizeof(stats))) { 1110 err = -EFAULT; 1111 break; 1112 } 1113 1114 session_id = stats.session_id; 1115 err = pppol2tp_tunnel_copy_stats(&stats, 1116 session->tunnel); 1117 if (err < 0) 1118 break; 1119 1120 stats.session_id = session_id; 1121 } else { 1122 pppol2tp_copy_stats(&stats, &session->stats); 1123 stats.session_id = session->session_id; 1124 } 1125 stats.tunnel_id = session->tunnel->tunnel_id; 1126 stats.using_ipsec = l2tp_tunnel_uses_xfrm(session->tunnel); 1127 1128 if (copy_to_user((void __user *)arg, &stats, sizeof(stats))) { 1129 err = -EFAULT; 1130 break; 1131 } 1132 break; 1133 1134 default: 1135 err = -ENOIOCTLCMD; 1136 break; 1137 } 1138 1139 if (session) 1140 l2tp_session_put(session); 1141 1142 return err; 1143 } 1144 1145 /***************************************************************************** 1146 * setsockopt() / getsockopt() support. 1147 * 1148 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1149 * sockets. In order to control kernel tunnel features, we allow userspace to 1150 * create a special "tunnel" PPPoX socket which is used for control only. 1151 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user 1152 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls. 1153 *****************************************************************************/ 1154 1155 /* Tunnel setsockopt() helper. 1156 */ 1157 static int pppol2tp_tunnel_setsockopt(struct sock *sk, 1158 struct l2tp_tunnel *tunnel, 1159 int optname, int val) 1160 { 1161 int err = 0; 1162 1163 switch (optname) { 1164 case PPPOL2TP_SO_DEBUG: 1165 /* Tunnel debug flags option is deprecated */ 1166 break; 1167 1168 default: 1169 err = -ENOPROTOOPT; 1170 break; 1171 } 1172 1173 return err; 1174 } 1175 1176 /* Session setsockopt helper. 1177 */ 1178 static int pppol2tp_session_setsockopt(struct sock *sk, 1179 struct l2tp_session *session, 1180 int optname, int val) 1181 { 1182 int err = 0; 1183 1184 switch (optname) { 1185 case PPPOL2TP_SO_RECVSEQ: 1186 if (val != 0 && val != 1) { 1187 err = -EINVAL; 1188 break; 1189 } 1190 session->recv_seq = !!val; 1191 break; 1192 1193 case PPPOL2TP_SO_SENDSEQ: 1194 if (val != 0 && val != 1) { 1195 err = -EINVAL; 1196 break; 1197 } 1198 session->send_seq = !!val; 1199 l2tp_session_set_header_len(session, session->tunnel->version, 1200 session->tunnel->encap); 1201 break; 1202 1203 case PPPOL2TP_SO_LNSMODE: 1204 if (val != 0 && val != 1) { 1205 err = -EINVAL; 1206 break; 1207 } 1208 session->lns_mode = !!val; 1209 break; 1210 1211 case PPPOL2TP_SO_DEBUG: 1212 /* Session debug flags option is deprecated */ 1213 break; 1214 1215 case PPPOL2TP_SO_REORDERTO: 1216 session->reorder_timeout = msecs_to_jiffies(val); 1217 break; 1218 1219 default: 1220 err = -ENOPROTOOPT; 1221 break; 1222 } 1223 1224 return err; 1225 } 1226 1227 /* Main setsockopt() entry point. 1228 * Does API checks, then calls either the tunnel or session setsockopt 1229 * handler, according to whether the PPPoL2TP socket is a for a regular 1230 * session or the special tunnel type. 1231 */ 1232 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, 1233 sockptr_t optval, unsigned int optlen) 1234 { 1235 struct sock *sk = sock->sk; 1236 struct l2tp_session *session; 1237 struct l2tp_tunnel *tunnel; 1238 int val; 1239 int err; 1240 1241 if (level != SOL_PPPOL2TP) 1242 return -EINVAL; 1243 1244 if (optlen < sizeof(int)) 1245 return -EINVAL; 1246 1247 if (copy_from_sockptr(&val, optval, sizeof(int))) 1248 return -EFAULT; 1249 1250 err = -ENOTCONN; 1251 if (!sk->sk_user_data) 1252 goto end; 1253 1254 /* Get session context from the socket */ 1255 err = -EBADF; 1256 session = pppol2tp_sock_to_session(sk); 1257 if (!session) 1258 goto end; 1259 1260 /* Special case: if session_id == 0x0000, treat as operation on tunnel 1261 */ 1262 if (session->session_id == 0 && session->peer_session_id == 0) { 1263 tunnel = session->tunnel; 1264 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val); 1265 } else { 1266 err = pppol2tp_session_setsockopt(sk, session, optname, val); 1267 } 1268 1269 l2tp_session_put(session); 1270 end: 1271 return err; 1272 } 1273 1274 /* Tunnel getsockopt helper. Called with sock locked. 1275 */ 1276 static int pppol2tp_tunnel_getsockopt(struct sock *sk, 1277 struct l2tp_tunnel *tunnel, 1278 int optname, int *val) 1279 { 1280 int err = 0; 1281 1282 switch (optname) { 1283 case PPPOL2TP_SO_DEBUG: 1284 /* Tunnel debug flags option is deprecated */ 1285 *val = 0; 1286 break; 1287 1288 default: 1289 err = -ENOPROTOOPT; 1290 break; 1291 } 1292 1293 return err; 1294 } 1295 1296 /* Session getsockopt helper. Called with sock locked. 1297 */ 1298 static int pppol2tp_session_getsockopt(struct sock *sk, 1299 struct l2tp_session *session, 1300 int optname, int *val) 1301 { 1302 int err = 0; 1303 1304 switch (optname) { 1305 case PPPOL2TP_SO_RECVSEQ: 1306 *val = session->recv_seq; 1307 break; 1308 1309 case PPPOL2TP_SO_SENDSEQ: 1310 *val = session->send_seq; 1311 break; 1312 1313 case PPPOL2TP_SO_LNSMODE: 1314 *val = session->lns_mode; 1315 break; 1316 1317 case PPPOL2TP_SO_DEBUG: 1318 /* Session debug flags option is deprecated */ 1319 *val = 0; 1320 break; 1321 1322 case PPPOL2TP_SO_REORDERTO: 1323 *val = (int)jiffies_to_msecs(session->reorder_timeout); 1324 break; 1325 1326 default: 1327 err = -ENOPROTOOPT; 1328 } 1329 1330 return err; 1331 } 1332 1333 /* Main getsockopt() entry point. 1334 * Does API checks, then calls either the tunnel or session getsockopt 1335 * handler, according to whether the PPPoX socket is a for a regular session 1336 * or the special tunnel type. 1337 */ 1338 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, 1339 sockopt_t *opt) 1340 { 1341 struct sock *sk = sock->sk; 1342 struct l2tp_session *session; 1343 struct l2tp_tunnel *tunnel; 1344 int val, len; 1345 int err; 1346 1347 if (level != SOL_PPPOL2TP) 1348 return -EINVAL; 1349 1350 len = opt->optlen; 1351 if (len < 0) 1352 return -EINVAL; 1353 1354 len = min_t(unsigned int, len, sizeof(int)); 1355 1356 err = -ENOTCONN; 1357 if (!sk->sk_user_data) 1358 goto end; 1359 1360 /* Get the session context */ 1361 err = -EBADF; 1362 session = pppol2tp_sock_to_session(sk); 1363 if (!session) 1364 goto end; 1365 1366 /* Special case: if session_id == 0x0000, treat as operation on tunnel */ 1367 if (session->session_id == 0 && session->peer_session_id == 0) { 1368 tunnel = session->tunnel; 1369 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val); 1370 if (err) 1371 goto end_put_sess; 1372 } else { 1373 err = pppol2tp_session_getsockopt(sk, session, optname, &val); 1374 if (err) 1375 goto end_put_sess; 1376 } 1377 1378 opt->optlen = len; 1379 if (copy_to_iter(&val, len, &opt->iter_out) != len) 1380 err = -EFAULT; 1381 1382 end_put_sess: 1383 l2tp_session_put(session); 1384 end: 1385 return err; 1386 } 1387 1388 /***************************************************************************** 1389 * /proc filesystem for debug 1390 * Since the original pppol2tp driver provided /proc/net/pppol2tp for 1391 * L2TPv2, we dump only L2TPv2 tunnels and sessions here. 1392 *****************************************************************************/ 1393 1394 #ifdef CONFIG_PROC_FS 1395 1396 struct pppol2tp_seq_data { 1397 struct seq_net_private p; 1398 unsigned long tkey; /* lookup key of current tunnel */ 1399 unsigned long skey; /* lookup key of current session */ 1400 struct l2tp_tunnel *tunnel; 1401 struct l2tp_session *session; /* NULL means get next tunnel */ 1402 }; 1403 1404 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) 1405 { 1406 /* Drop reference taken during previous invocation */ 1407 if (pd->tunnel) 1408 l2tp_tunnel_put(pd->tunnel); 1409 1410 for (;;) { 1411 pd->tunnel = l2tp_tunnel_get_next(net, &pd->tkey); 1412 pd->tkey++; 1413 1414 /* Only accept L2TPv2 tunnels */ 1415 if (!pd->tunnel || pd->tunnel->version == 2) 1416 return; 1417 1418 l2tp_tunnel_put(pd->tunnel); 1419 } 1420 } 1421 1422 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) 1423 { 1424 /* Drop reference taken during previous invocation */ 1425 if (pd->session) 1426 l2tp_session_put(pd->session); 1427 1428 pd->session = l2tp_session_get_next(net, pd->tunnel->sock, 1429 pd->tunnel->version, 1430 pd->tunnel->tunnel_id, &pd->skey); 1431 pd->skey++; 1432 1433 if (!pd->session) { 1434 pd->skey = 0; 1435 pppol2tp_next_tunnel(net, pd); 1436 } 1437 } 1438 1439 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs) 1440 { 1441 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN; 1442 loff_t pos = *offs; 1443 struct net *net; 1444 1445 if (!pos) 1446 goto out; 1447 1448 if (WARN_ON(!m->private)) { 1449 pd = NULL; 1450 goto out; 1451 } 1452 1453 pd = m->private; 1454 net = seq_file_net(m); 1455 1456 if (!pd->tunnel) 1457 pppol2tp_next_tunnel(net, pd); 1458 else 1459 pppol2tp_next_session(net, pd); 1460 1461 /* NULL tunnel and session indicates end of list */ 1462 if (!pd->tunnel && !pd->session) 1463 pd = NULL; 1464 1465 out: 1466 return pd; 1467 } 1468 1469 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos) 1470 { 1471 (*pos)++; 1472 return NULL; 1473 } 1474 1475 static void pppol2tp_seq_stop(struct seq_file *p, void *v) 1476 { 1477 struct pppol2tp_seq_data *pd = v; 1478 1479 if (!pd || pd == SEQ_START_TOKEN) 1480 return; 1481 1482 /* Drop reference taken by last invocation of pppol2tp_next_session() 1483 * or pppol2tp_next_tunnel(). 1484 */ 1485 if (pd->session) { 1486 l2tp_session_put(pd->session); 1487 pd->session = NULL; 1488 } 1489 if (pd->tunnel) { 1490 l2tp_tunnel_put(pd->tunnel); 1491 pd->tunnel = NULL; 1492 } 1493 } 1494 1495 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) 1496 { 1497 struct l2tp_tunnel *tunnel = v; 1498 1499 seq_printf(m, "\nTUNNEL '%s', %c %d\n", 1500 tunnel->name, 1501 tunnel->sock ? 'Y' : 'N', 1502 refcount_read(&tunnel->ref_count) - 1); 1503 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n", 1504 0, 1505 atomic_long_read(&tunnel->stats.tx_packets), 1506 atomic_long_read(&tunnel->stats.tx_bytes), 1507 atomic_long_read(&tunnel->stats.tx_errors), 1508 atomic_long_read(&tunnel->stats.rx_packets), 1509 atomic_long_read(&tunnel->stats.rx_bytes), 1510 atomic_long_read(&tunnel->stats.rx_errors)); 1511 } 1512 1513 static void pppol2tp_seq_session_show(struct seq_file *m, void *v) 1514 { 1515 struct l2tp_session *session = v; 1516 struct l2tp_tunnel *tunnel = session->tunnel; 1517 unsigned char state; 1518 char user_data_ok; 1519 struct sock *sk; 1520 u32 ip = 0; 1521 u16 port = 0; 1522 1523 if (tunnel->sock) { 1524 struct inet_sock *inet = inet_sk(tunnel->sock); 1525 1526 ip = ntohl(inet->inet_saddr); 1527 port = ntohs(inet->inet_sport); 1528 } 1529 1530 rcu_read_lock(); 1531 sk = pppol2tp_session_get_sock(session); 1532 if (sk) { 1533 state = sk->sk_state; 1534 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N'; 1535 } else { 1536 state = 0; 1537 user_data_ok = 'N'; 1538 } 1539 1540 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> %04X/%04X %d %c\n", 1541 session->name, ip, port, 1542 tunnel->tunnel_id, 1543 session->session_id, 1544 tunnel->peer_tunnel_id, 1545 session->peer_session_id, 1546 state, user_data_ok); 1547 seq_printf(m, " 0/0/%c/%c/%s %08x %u\n", 1548 session->recv_seq ? 'R' : '-', 1549 session->send_seq ? 'S' : '-', 1550 session->lns_mode ? "LNS" : "LAC", 1551 0, 1552 jiffies_to_msecs(session->reorder_timeout)); 1553 seq_printf(m, " %u/%u %ld/%ld/%ld %ld/%ld/%ld\n", 1554 session->nr, session->ns, 1555 atomic_long_read(&session->stats.tx_packets), 1556 atomic_long_read(&session->stats.tx_bytes), 1557 atomic_long_read(&session->stats.tx_errors), 1558 atomic_long_read(&session->stats.rx_packets), 1559 atomic_long_read(&session->stats.rx_bytes), 1560 atomic_long_read(&session->stats.rx_errors)); 1561 1562 if (sk) { 1563 struct pppox_sock *po = pppox_sk(sk); 1564 1565 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 1566 } 1567 rcu_read_unlock(); 1568 } 1569 1570 static int pppol2tp_seq_show(struct seq_file *m, void *v) 1571 { 1572 struct pppol2tp_seq_data *pd = v; 1573 1574 /* display header on line 1 */ 1575 if (v == SEQ_START_TOKEN) { 1576 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n"); 1577 seq_puts(m, "TUNNEL name, user-data-ok session-count\n"); 1578 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1579 seq_puts(m, " SESSION name, addr/port src-tid/sid dest-tid/sid state user-data-ok\n"); 1580 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n"); 1581 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1582 goto out; 1583 } 1584 1585 if (!pd->session) 1586 pppol2tp_seq_tunnel_show(m, pd->tunnel); 1587 else 1588 pppol2tp_seq_session_show(m, pd->session); 1589 1590 out: 1591 return 0; 1592 } 1593 1594 static const struct seq_operations pppol2tp_seq_ops = { 1595 .start = pppol2tp_seq_start, 1596 .next = pppol2tp_seq_next, 1597 .stop = pppol2tp_seq_stop, 1598 .show = pppol2tp_seq_show, 1599 }; 1600 #endif /* CONFIG_PROC_FS */ 1601 1602 /***************************************************************************** 1603 * Network namespace 1604 *****************************************************************************/ 1605 1606 static __net_init int pppol2tp_init_net(struct net *net) 1607 { 1608 struct proc_dir_entry *pde; 1609 int err = 0; 1610 1611 pde = proc_create_net("pppol2tp", 0444, net->proc_net, 1612 &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data)); 1613 if (!pde) { 1614 err = -ENOMEM; 1615 goto out; 1616 } 1617 1618 out: 1619 return err; 1620 } 1621 1622 static __net_exit void pppol2tp_exit_net(struct net *net) 1623 { 1624 remove_proc_entry("pppol2tp", net->proc_net); 1625 } 1626 1627 static struct pernet_operations pppol2tp_net_ops = { 1628 .init = pppol2tp_init_net, 1629 .exit = pppol2tp_exit_net, 1630 }; 1631 1632 /***************************************************************************** 1633 * Init and cleanup 1634 *****************************************************************************/ 1635 1636 static const struct proto_ops pppol2tp_ops = { 1637 .family = AF_PPPOX, 1638 .owner = THIS_MODULE, 1639 .release = pppol2tp_release, 1640 .bind = sock_no_bind, 1641 .connect = pppol2tp_connect, 1642 .socketpair = sock_no_socketpair, 1643 .accept = sock_no_accept, 1644 .getname = pppol2tp_getname, 1645 .poll = datagram_poll, 1646 .listen = sock_no_listen, 1647 .shutdown = sock_no_shutdown, 1648 .setsockopt = pppol2tp_setsockopt, 1649 .getsockopt_iter = pppol2tp_getsockopt, 1650 .sendmsg = pppol2tp_sendmsg, 1651 .recvmsg = pppol2tp_recvmsg, 1652 .mmap = sock_no_mmap, 1653 .ioctl = pppox_ioctl, 1654 #ifdef CONFIG_COMPAT 1655 .compat_ioctl = pppox_compat_ioctl, 1656 #endif 1657 }; 1658 1659 static const struct pppox_proto pppol2tp_proto = { 1660 .create = pppol2tp_create, 1661 .ioctl = pppol2tp_ioctl, 1662 .owner = THIS_MODULE, 1663 }; 1664 1665 #ifdef CONFIG_L2TP_V3 1666 1667 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = { 1668 .session_create = pppol2tp_session_create, 1669 .session_delete = l2tp_session_delete, 1670 }; 1671 1672 #endif /* CONFIG_L2TP_V3 */ 1673 1674 static int __init pppol2tp_init(void) 1675 { 1676 int err; 1677 1678 err = register_pernet_device(&pppol2tp_net_ops); 1679 if (err) 1680 goto out; 1681 1682 err = proto_register(&pppol2tp_sk_proto, 0); 1683 if (err) 1684 goto out_unregister_pppol2tp_pernet; 1685 1686 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto); 1687 if (err) 1688 goto out_unregister_pppol2tp_proto; 1689 1690 #ifdef CONFIG_L2TP_V3 1691 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops); 1692 if (err) 1693 goto out_unregister_pppox; 1694 #endif 1695 1696 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION); 1697 1698 out: 1699 return err; 1700 1701 #ifdef CONFIG_L2TP_V3 1702 out_unregister_pppox: 1703 unregister_pppox_proto(PX_PROTO_OL2TP); 1704 #endif 1705 out_unregister_pppol2tp_proto: 1706 proto_unregister(&pppol2tp_sk_proto); 1707 out_unregister_pppol2tp_pernet: 1708 unregister_pernet_device(&pppol2tp_net_ops); 1709 goto out; 1710 } 1711 1712 static void __exit pppol2tp_exit(void) 1713 { 1714 #ifdef CONFIG_L2TP_V3 1715 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP); 1716 #endif 1717 unregister_pppox_proto(PX_PROTO_OL2TP); 1718 proto_unregister(&pppol2tp_sk_proto); 1719 unregister_pernet_device(&pppol2tp_net_ops); 1720 } 1721 1722 module_init(pppol2tp_init); 1723 module_exit(pppol2tp_exit); 1724 1725 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1726 MODULE_DESCRIPTION("PPP over L2TP over UDP"); 1727 MODULE_LICENSE("GPL"); 1728 MODULE_VERSION(PPPOL2TP_DRV_VERSION); 1729 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP); 1730 MODULE_ALIAS_L2TP_PWTYPE(7); 1731