1 /***************************************************************************** 2 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets 3 * 4 * PPPoX --- Generic PPP encapsulation socket family 5 * PPPoL2TP --- PPP over L2TP (RFC 2661) 6 * 7 * Version: 2.0.0 8 * 9 * Authors: James Chapman (jchapman@katalix.com) 10 * 11 * Based on original work by Martijn van Oosterhout <kleptog@svana.org> 12 * 13 * License: 14 * This program is free software; you can redistribute it and/or 15 * modify it under the terms of the GNU General Public License 16 * as published by the Free Software Foundation; either version 17 * 2 of the License, or (at your option) any later version. 18 * 19 */ 20 21 /* This driver handles only L2TP data frames; control frames are handled by a 22 * userspace application. 23 * 24 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and 25 * attaches it to a bound UDP socket with local tunnel_id / session_id and 26 * peer tunnel_id / session_id set. Data can then be sent or received using 27 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket 28 * can be read or modified using ioctl() or [gs]etsockopt() calls. 29 * 30 * When a PPPoL2TP socket is connected with local and peer session_id values 31 * zero, the socket is treated as a special tunnel management socket. 32 * 33 * Here's example userspace code to create a socket for sending/receiving data 34 * over an L2TP session:- 35 * 36 * struct sockaddr_pppol2tp sax; 37 * int fd; 38 * int session_fd; 39 * 40 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); 41 * 42 * sax.sa_family = AF_PPPOX; 43 * sax.sa_protocol = PX_PROTO_OL2TP; 44 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket 45 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr; 46 * sax.pppol2tp.addr.sin_port = addr->sin_port; 47 * sax.pppol2tp.addr.sin_family = AF_INET; 48 * sax.pppol2tp.s_tunnel = tunnel_id; 49 * sax.pppol2tp.s_session = session_id; 50 * sax.pppol2tp.d_tunnel = peer_tunnel_id; 51 * sax.pppol2tp.d_session = peer_session_id; 52 * 53 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax)); 54 * 55 * A pppd plugin that allows PPP traffic to be carried over L2TP using 56 * this driver is available from the OpenL2TP project at 57 * http://openl2tp.sourceforge.net. 58 */ 59 60 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 61 62 #include <linux/module.h> 63 #include <linux/string.h> 64 #include <linux/list.h> 65 #include <linux/uaccess.h> 66 67 #include <linux/kernel.h> 68 #include <linux/spinlock.h> 69 #include <linux/kthread.h> 70 #include <linux/sched.h> 71 #include <linux/slab.h> 72 #include <linux/errno.h> 73 #include <linux/jiffies.h> 74 75 #include <linux/netdevice.h> 76 #include <linux/net.h> 77 #include <linux/inetdevice.h> 78 #include <linux/skbuff.h> 79 #include <linux/init.h> 80 #include <linux/ip.h> 81 #include <linux/udp.h> 82 #include <linux/if_pppox.h> 83 #include <linux/if_pppol2tp.h> 84 #include <net/sock.h> 85 #include <linux/ppp_channel.h> 86 #include <linux/ppp_defs.h> 87 #include <linux/ppp-ioctl.h> 88 #include <linux/file.h> 89 #include <linux/hash.h> 90 #include <linux/sort.h> 91 #include <linux/proc_fs.h> 92 #include <linux/l2tp.h> 93 #include <linux/nsproxy.h> 94 #include <net/net_namespace.h> 95 #include <net/netns/generic.h> 96 #include <net/dst.h> 97 #include <net/ip.h> 98 #include <net/udp.h> 99 #include <net/xfrm.h> 100 #include <net/inet_common.h> 101 102 #include <asm/byteorder.h> 103 #include <linux/atomic.h> 104 105 #include "l2tp_core.h" 106 107 #define PPPOL2TP_DRV_VERSION "V2.0" 108 109 /* Space for UDP, L2TP and PPP headers */ 110 #define PPPOL2TP_HEADER_OVERHEAD 40 111 112 /* Number of bytes to build transmit L2TP headers. 113 * Unfortunately the size is different depending on whether sequence numbers 114 * are enabled. 115 */ 116 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10 117 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6 118 119 /* Private data of each session. This data lives at the end of struct 120 * l2tp_session, referenced via session->priv[]. 121 */ 122 struct pppol2tp_session { 123 int owner; /* pid that opened the socket */ 124 125 struct mutex sk_lock; /* Protects .sk */ 126 struct sock __rcu *sk; /* Pointer to the session 127 * PPPoX socket */ 128 struct sock *__sk; /* Copy of .sk, for cleanup */ 129 struct rcu_head rcu; /* For asynchronous release */ 130 int flags; /* accessed by PPPIOCGFLAGS. 131 * Unused. */ 132 }; 133 134 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb); 135 136 static const struct ppp_channel_ops pppol2tp_chan_ops = { 137 .start_xmit = pppol2tp_xmit, 138 }; 139 140 static const struct proto_ops pppol2tp_ops; 141 142 /* Retrieves the pppol2tp socket associated to a session. 143 * A reference is held on the returned socket, so this function must be paired 144 * with sock_put(). 145 */ 146 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) 147 { 148 struct pppol2tp_session *ps = l2tp_session_priv(session); 149 struct sock *sk; 150 151 rcu_read_lock(); 152 sk = rcu_dereference(ps->sk); 153 if (sk) 154 sock_hold(sk); 155 rcu_read_unlock(); 156 157 return sk; 158 } 159 160 /* Helpers to obtain tunnel/session contexts from sockets. 161 */ 162 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) 163 { 164 struct l2tp_session *session; 165 166 if (sk == NULL) 167 return NULL; 168 169 sock_hold(sk); 170 session = (struct l2tp_session *)(sk->sk_user_data); 171 if (session == NULL) { 172 sock_put(sk); 173 goto out; 174 } 175 176 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 177 178 out: 179 return session; 180 } 181 182 /***************************************************************************** 183 * Receive data handling 184 *****************************************************************************/ 185 186 static int pppol2tp_recv_payload_hook(struct sk_buff *skb) 187 { 188 /* Skip PPP header, if present. In testing, Microsoft L2TP clients 189 * don't send the PPP header (PPP header compression enabled), but 190 * other clients can include the header. So we cope with both cases 191 * here. The PPP header is always FF03 when using L2TP. 192 * 193 * Note that skb->data[] isn't dereferenced from a u16 ptr here since 194 * the field may be unaligned. 195 */ 196 if (!pskb_may_pull(skb, 2)) 197 return 1; 198 199 if ((skb->data[0] == PPP_ALLSTATIONS) && (skb->data[1] == PPP_UI)) 200 skb_pull(skb, 2); 201 202 return 0; 203 } 204 205 /* Receive message. This is the recvmsg for the PPPoL2TP socket. 206 */ 207 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, 208 size_t len, int flags) 209 { 210 int err; 211 struct sk_buff *skb; 212 struct sock *sk = sock->sk; 213 214 err = -EIO; 215 if (sk->sk_state & PPPOX_BOUND) 216 goto end; 217 218 err = 0; 219 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 220 flags & MSG_DONTWAIT, &err); 221 if (!skb) 222 goto end; 223 224 if (len > skb->len) 225 len = skb->len; 226 else if (len < skb->len) 227 msg->msg_flags |= MSG_TRUNC; 228 229 err = skb_copy_datagram_msg(skb, 0, msg, len); 230 if (likely(err == 0)) 231 err = len; 232 233 kfree_skb(skb); 234 end: 235 return err; 236 } 237 238 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) 239 { 240 struct pppol2tp_session *ps = l2tp_session_priv(session); 241 struct sock *sk = NULL; 242 243 /* If the socket is bound, send it in to PPP's input queue. Otherwise 244 * queue it on the session socket. 245 */ 246 rcu_read_lock(); 247 sk = rcu_dereference(ps->sk); 248 if (sk == NULL) 249 goto no_sock; 250 251 if (sk->sk_state & PPPOX_BOUND) { 252 struct pppox_sock *po; 253 254 l2tp_dbg(session, L2TP_MSG_DATA, 255 "%s: recv %d byte data frame, passing to ppp\n", 256 session->name, data_len); 257 258 po = pppox_sk(sk); 259 ppp_input(&po->chan, skb); 260 } else { 261 l2tp_dbg(session, L2TP_MSG_DATA, 262 "%s: recv %d byte data frame, passing to L2TP socket\n", 263 session->name, data_len); 264 265 if (sock_queue_rcv_skb(sk, skb) < 0) { 266 atomic_long_inc(&session->stats.rx_errors); 267 kfree_skb(skb); 268 } 269 } 270 rcu_read_unlock(); 271 272 return; 273 274 no_sock: 275 rcu_read_unlock(); 276 l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name); 277 kfree_skb(skb); 278 } 279 280 /************************************************************************ 281 * Transmit handling 282 ***********************************************************************/ 283 284 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here 285 * when a user application does a sendmsg() on the session socket. L2TP and 286 * PPP headers must be inserted into the user's data. 287 */ 288 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m, 289 size_t total_len) 290 { 291 struct sock *sk = sock->sk; 292 struct sk_buff *skb; 293 int error; 294 struct l2tp_session *session; 295 struct l2tp_tunnel *tunnel; 296 int uhlen; 297 298 error = -ENOTCONN; 299 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 300 goto error; 301 302 /* Get session and tunnel contexts */ 303 error = -EBADF; 304 session = pppol2tp_sock_to_session(sk); 305 if (session == NULL) 306 goto error; 307 308 tunnel = session->tunnel; 309 310 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 311 312 /* Allocate a socket buffer */ 313 error = -ENOMEM; 314 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 315 uhlen + session->hdr_len + 316 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 317 0, GFP_KERNEL); 318 if (!skb) 319 goto error_put_sess; 320 321 /* Reserve space for headers. */ 322 skb_reserve(skb, NET_SKB_PAD); 323 skb_reset_network_header(skb); 324 skb_reserve(skb, sizeof(struct iphdr)); 325 skb_reset_transport_header(skb); 326 skb_reserve(skb, uhlen); 327 328 /* Add PPP header */ 329 skb->data[0] = PPP_ALLSTATIONS; 330 skb->data[1] = PPP_UI; 331 skb_put(skb, 2); 332 333 /* Copy user data into skb */ 334 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len); 335 if (error < 0) { 336 kfree_skb(skb); 337 goto error_put_sess; 338 } 339 340 local_bh_disable(); 341 l2tp_xmit_skb(session, skb, session->hdr_len); 342 local_bh_enable(); 343 344 sock_put(sk); 345 346 return total_len; 347 348 error_put_sess: 349 sock_put(sk); 350 error: 351 return error; 352 } 353 354 /* Transmit function called by generic PPP driver. Sends PPP frame 355 * over PPPoL2TP socket. 356 * 357 * This is almost the same as pppol2tp_sendmsg(), but rather than 358 * being called with a msghdr from userspace, it is called with a skb 359 * from the kernel. 360 * 361 * The supplied skb from ppp doesn't have enough headroom for the 362 * insertion of L2TP, UDP and IP headers so we need to allocate more 363 * headroom in the skb. This will create a cloned skb. But we must be 364 * careful in the error case because the caller will expect to free 365 * the skb it supplied, not our cloned skb. So we take care to always 366 * leave the original skb unfreed if we return an error. 367 */ 368 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) 369 { 370 struct sock *sk = (struct sock *) chan->private; 371 struct l2tp_session *session; 372 struct l2tp_tunnel *tunnel; 373 int uhlen, headroom; 374 375 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 376 goto abort; 377 378 /* Get session and tunnel contexts from the socket */ 379 session = pppol2tp_sock_to_session(sk); 380 if (session == NULL) 381 goto abort; 382 383 tunnel = session->tunnel; 384 385 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 386 headroom = NET_SKB_PAD + 387 sizeof(struct iphdr) + /* IP header */ 388 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */ 389 session->hdr_len + /* L2TP header */ 390 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 391 if (skb_cow_head(skb, headroom)) 392 goto abort_put_sess; 393 394 /* Setup PPP header */ 395 __skb_push(skb, 2); 396 skb->data[0] = PPP_ALLSTATIONS; 397 skb->data[1] = PPP_UI; 398 399 local_bh_disable(); 400 l2tp_xmit_skb(session, skb, session->hdr_len); 401 local_bh_enable(); 402 403 sock_put(sk); 404 405 return 1; 406 407 abort_put_sess: 408 sock_put(sk); 409 abort: 410 /* Free the original skb */ 411 kfree_skb(skb); 412 return 1; 413 } 414 415 /***************************************************************************** 416 * Session (and tunnel control) socket create/destroy. 417 *****************************************************************************/ 418 419 /* Called by l2tp_core when a session socket is being closed. 420 */ 421 static void pppol2tp_session_close(struct l2tp_session *session) 422 { 423 struct sock *sk; 424 425 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 426 427 sk = pppol2tp_session_get_sock(session); 428 if (sk) { 429 if (sk->sk_socket) 430 inet_shutdown(sk->sk_socket, SEND_SHUTDOWN); 431 sock_put(sk); 432 } 433 } 434 435 /* Really kill the session socket. (Called from sock_put() if 436 * refcnt == 0.) 437 */ 438 static void pppol2tp_session_destruct(struct sock *sk) 439 { 440 struct l2tp_session *session = sk->sk_user_data; 441 442 skb_queue_purge(&sk->sk_receive_queue); 443 skb_queue_purge(&sk->sk_write_queue); 444 445 if (session) { 446 sk->sk_user_data = NULL; 447 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 448 l2tp_session_dec_refcount(session); 449 } 450 } 451 452 static void pppol2tp_put_sk(struct rcu_head *head) 453 { 454 struct pppol2tp_session *ps; 455 456 ps = container_of(head, typeof(*ps), rcu); 457 sock_put(ps->__sk); 458 } 459 460 /* Called when the PPPoX socket (session) is closed. 461 */ 462 static int pppol2tp_release(struct socket *sock) 463 { 464 struct sock *sk = sock->sk; 465 struct l2tp_session *session; 466 int error; 467 468 if (!sk) 469 return 0; 470 471 error = -EBADF; 472 lock_sock(sk); 473 if (sock_flag(sk, SOCK_DEAD) != 0) 474 goto error; 475 476 pppox_unbind_sock(sk); 477 478 /* Signal the death of the socket. */ 479 sk->sk_state = PPPOX_DEAD; 480 sock_orphan(sk); 481 sock->sk = NULL; 482 483 session = pppol2tp_sock_to_session(sk); 484 485 if (session != NULL) { 486 struct pppol2tp_session *ps; 487 488 l2tp_session_delete(session); 489 490 ps = l2tp_session_priv(session); 491 mutex_lock(&ps->sk_lock); 492 ps->__sk = rcu_dereference_protected(ps->sk, 493 lockdep_is_held(&ps->sk_lock)); 494 RCU_INIT_POINTER(ps->sk, NULL); 495 mutex_unlock(&ps->sk_lock); 496 call_rcu(&ps->rcu, pppol2tp_put_sk); 497 498 /* Rely on the sock_put() call at the end of the function for 499 * dropping the reference held by pppol2tp_sock_to_session(). 500 * The last reference will be dropped by pppol2tp_put_sk(). 501 */ 502 } 503 release_sock(sk); 504 505 /* This will delete the session context via 506 * pppol2tp_session_destruct() if the socket's refcnt drops to 507 * zero. 508 */ 509 sock_put(sk); 510 511 return 0; 512 513 error: 514 release_sock(sk); 515 return error; 516 } 517 518 static struct proto pppol2tp_sk_proto = { 519 .name = "PPPOL2TP", 520 .owner = THIS_MODULE, 521 .obj_size = sizeof(struct pppox_sock), 522 }; 523 524 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb) 525 { 526 int rc; 527 528 rc = l2tp_udp_encap_recv(sk, skb); 529 if (rc) 530 kfree_skb(skb); 531 532 return NET_RX_SUCCESS; 533 } 534 535 /* socket() handler. Initialize a new struct sock. 536 */ 537 static int pppol2tp_create(struct net *net, struct socket *sock, int kern) 538 { 539 int error = -ENOMEM; 540 struct sock *sk; 541 542 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern); 543 if (!sk) 544 goto out; 545 546 sock_init_data(sock, sk); 547 548 sock->state = SS_UNCONNECTED; 549 sock->ops = &pppol2tp_ops; 550 551 sk->sk_backlog_rcv = pppol2tp_backlog_recv; 552 sk->sk_protocol = PX_PROTO_OL2TP; 553 sk->sk_family = PF_PPPOX; 554 sk->sk_state = PPPOX_NONE; 555 sk->sk_type = SOCK_STREAM; 556 sk->sk_destruct = pppol2tp_session_destruct; 557 558 error = 0; 559 560 out: 561 return error; 562 } 563 564 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 565 static void pppol2tp_show(struct seq_file *m, void *arg) 566 { 567 struct l2tp_session *session = arg; 568 struct sock *sk; 569 570 sk = pppol2tp_session_get_sock(session); 571 if (sk) { 572 struct pppox_sock *po = pppox_sk(sk); 573 574 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 575 sock_put(sk); 576 } 577 } 578 #endif 579 580 static void pppol2tp_session_init(struct l2tp_session *session) 581 { 582 struct pppol2tp_session *ps; 583 struct dst_entry *dst; 584 585 session->recv_skb = pppol2tp_recv; 586 session->session_close = pppol2tp_session_close; 587 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 588 session->show = pppol2tp_show; 589 #endif 590 591 ps = l2tp_session_priv(session); 592 mutex_init(&ps->sk_lock); 593 ps->owner = current->pid; 594 595 /* If PMTU discovery was enabled, use the MTU that was discovered */ 596 dst = sk_dst_get(session->tunnel->sock); 597 if (dst) { 598 u32 pmtu = dst_mtu(dst); 599 600 if (pmtu) { 601 session->mtu = pmtu - PPPOL2TP_HEADER_OVERHEAD; 602 session->mru = pmtu - PPPOL2TP_HEADER_OVERHEAD; 603 } 604 dst_release(dst); 605 } 606 } 607 608 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket 609 */ 610 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 611 int sockaddr_len, int flags) 612 { 613 struct sock *sk = sock->sk; 614 struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr; 615 struct pppox_sock *po = pppox_sk(sk); 616 struct l2tp_session *session = NULL; 617 struct l2tp_tunnel *tunnel; 618 struct pppol2tp_session *ps; 619 struct l2tp_session_cfg cfg = { 0, }; 620 int error = 0; 621 u32 tunnel_id, peer_tunnel_id; 622 u32 session_id, peer_session_id; 623 bool drop_refcnt = false; 624 bool drop_tunnel = false; 625 int ver = 2; 626 int fd; 627 628 lock_sock(sk); 629 630 error = -EINVAL; 631 if (sp->sa_protocol != PX_PROTO_OL2TP) 632 goto end; 633 634 /* Check for already bound sockets */ 635 error = -EBUSY; 636 if (sk->sk_state & PPPOX_CONNECTED) 637 goto end; 638 639 /* We don't supporting rebinding anyway */ 640 error = -EALREADY; 641 if (sk->sk_user_data) 642 goto end; /* socket is already attached */ 643 644 /* Get params from socket address. Handle L2TPv2 and L2TPv3. 645 * This is nasty because there are different sockaddr_pppol2tp 646 * structs for L2TPv2, L2TPv3, over IPv4 and IPv6. We use 647 * the sockaddr size to determine which structure the caller 648 * is using. 649 */ 650 peer_tunnel_id = 0; 651 if (sockaddr_len == sizeof(struct sockaddr_pppol2tp)) { 652 fd = sp->pppol2tp.fd; 653 tunnel_id = sp->pppol2tp.s_tunnel; 654 peer_tunnel_id = sp->pppol2tp.d_tunnel; 655 session_id = sp->pppol2tp.s_session; 656 peer_session_id = sp->pppol2tp.d_session; 657 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3)) { 658 struct sockaddr_pppol2tpv3 *sp3 = 659 (struct sockaddr_pppol2tpv3 *) sp; 660 ver = 3; 661 fd = sp3->pppol2tp.fd; 662 tunnel_id = sp3->pppol2tp.s_tunnel; 663 peer_tunnel_id = sp3->pppol2tp.d_tunnel; 664 session_id = sp3->pppol2tp.s_session; 665 peer_session_id = sp3->pppol2tp.d_session; 666 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpin6)) { 667 struct sockaddr_pppol2tpin6 *sp6 = 668 (struct sockaddr_pppol2tpin6 *) sp; 669 fd = sp6->pppol2tp.fd; 670 tunnel_id = sp6->pppol2tp.s_tunnel; 671 peer_tunnel_id = sp6->pppol2tp.d_tunnel; 672 session_id = sp6->pppol2tp.s_session; 673 peer_session_id = sp6->pppol2tp.d_session; 674 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3in6)) { 675 struct sockaddr_pppol2tpv3in6 *sp6 = 676 (struct sockaddr_pppol2tpv3in6 *) sp; 677 ver = 3; 678 fd = sp6->pppol2tp.fd; 679 tunnel_id = sp6->pppol2tp.s_tunnel; 680 peer_tunnel_id = sp6->pppol2tp.d_tunnel; 681 session_id = sp6->pppol2tp.s_session; 682 peer_session_id = sp6->pppol2tp.d_session; 683 } else { 684 error = -EINVAL; 685 goto end; /* bad socket address */ 686 } 687 688 /* Don't bind if tunnel_id is 0 */ 689 error = -EINVAL; 690 if (tunnel_id == 0) 691 goto end; 692 693 tunnel = l2tp_tunnel_get(sock_net(sk), tunnel_id); 694 if (tunnel) 695 drop_tunnel = true; 696 697 /* Special case: create tunnel context if session_id and 698 * peer_session_id is 0. Otherwise look up tunnel using supplied 699 * tunnel id. 700 */ 701 if ((session_id == 0) && (peer_session_id == 0)) { 702 if (tunnel == NULL) { 703 struct l2tp_tunnel_cfg tcfg = { 704 .encap = L2TP_ENCAPTYPE_UDP, 705 .debug = 0, 706 }; 707 error = l2tp_tunnel_create(sock_net(sk), fd, ver, tunnel_id, peer_tunnel_id, &tcfg, &tunnel); 708 if (error < 0) 709 goto end; 710 } 711 } else { 712 /* Error if we can't find the tunnel */ 713 error = -ENOENT; 714 if (tunnel == NULL) 715 goto end; 716 717 /* Error if socket is not prepped */ 718 if (tunnel->sock == NULL) 719 goto end; 720 } 721 722 if (tunnel->recv_payload_hook == NULL) 723 tunnel->recv_payload_hook = pppol2tp_recv_payload_hook; 724 725 if (tunnel->peer_tunnel_id == 0) 726 tunnel->peer_tunnel_id = peer_tunnel_id; 727 728 session = l2tp_session_get(sock_net(sk), tunnel, session_id); 729 if (session) { 730 drop_refcnt = true; 731 ps = l2tp_session_priv(session); 732 733 /* Using a pre-existing session is fine as long as it hasn't 734 * been connected yet. 735 */ 736 mutex_lock(&ps->sk_lock); 737 if (rcu_dereference_protected(ps->sk, 738 lockdep_is_held(&ps->sk_lock))) { 739 mutex_unlock(&ps->sk_lock); 740 error = -EEXIST; 741 goto end; 742 } 743 } else { 744 /* Default MTU must allow space for UDP/L2TP/PPP headers */ 745 cfg.mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 746 cfg.mru = cfg.mtu; 747 748 session = l2tp_session_create(sizeof(struct pppol2tp_session), 749 tunnel, session_id, 750 peer_session_id, &cfg); 751 if (IS_ERR(session)) { 752 error = PTR_ERR(session); 753 goto end; 754 } 755 756 pppol2tp_session_init(session); 757 ps = l2tp_session_priv(session); 758 l2tp_session_inc_refcount(session); 759 760 mutex_lock(&ps->sk_lock); 761 error = l2tp_session_register(session, tunnel); 762 if (error < 0) { 763 mutex_unlock(&ps->sk_lock); 764 kfree(session); 765 goto end; 766 } 767 drop_refcnt = true; 768 } 769 770 /* Special case: if source & dest session_id == 0x0000, this 771 * socket is being created to manage the tunnel. Just set up 772 * the internal context for use by ioctl() and sockopt() 773 * handlers. 774 */ 775 if ((session->session_id == 0) && 776 (session->peer_session_id == 0)) { 777 error = 0; 778 goto out_no_ppp; 779 } 780 781 /* The only header we need to worry about is the L2TP 782 * header. This size is different depending on whether 783 * sequence numbers are enabled for the data channel. 784 */ 785 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 786 787 po->chan.private = sk; 788 po->chan.ops = &pppol2tp_chan_ops; 789 po->chan.mtu = session->mtu; 790 791 error = ppp_register_net_channel(sock_net(sk), &po->chan); 792 if (error) { 793 mutex_unlock(&ps->sk_lock); 794 goto end; 795 } 796 797 out_no_ppp: 798 /* This is how we get the session context from the socket. */ 799 sk->sk_user_data = session; 800 rcu_assign_pointer(ps->sk, sk); 801 mutex_unlock(&ps->sk_lock); 802 803 /* Keep the reference we've grabbed on the session: sk doesn't expect 804 * the session to disappear. pppol2tp_session_destruct() is responsible 805 * for dropping it. 806 */ 807 drop_refcnt = false; 808 809 sk->sk_state = PPPOX_CONNECTED; 810 l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n", 811 session->name); 812 813 end: 814 if (drop_refcnt) 815 l2tp_session_dec_refcount(session); 816 if (drop_tunnel) 817 l2tp_tunnel_dec_refcount(tunnel); 818 release_sock(sk); 819 820 return error; 821 } 822 823 #ifdef CONFIG_L2TP_V3 824 825 /* Called when creating sessions via the netlink interface. */ 826 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, 827 u32 session_id, u32 peer_session_id, 828 struct l2tp_session_cfg *cfg) 829 { 830 int error; 831 struct l2tp_session *session; 832 833 /* Error if tunnel socket is not prepped */ 834 if (!tunnel->sock) { 835 error = -ENOENT; 836 goto err; 837 } 838 839 /* Default MTU values. */ 840 if (cfg->mtu == 0) 841 cfg->mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 842 if (cfg->mru == 0) 843 cfg->mru = cfg->mtu; 844 845 /* Allocate and initialize a new session context. */ 846 session = l2tp_session_create(sizeof(struct pppol2tp_session), 847 tunnel, session_id, 848 peer_session_id, cfg); 849 if (IS_ERR(session)) { 850 error = PTR_ERR(session); 851 goto err; 852 } 853 854 pppol2tp_session_init(session); 855 856 error = l2tp_session_register(session, tunnel); 857 if (error < 0) 858 goto err_sess; 859 860 return 0; 861 862 err_sess: 863 kfree(session); 864 err: 865 return error; 866 } 867 868 #endif /* CONFIG_L2TP_V3 */ 869 870 /* getname() support. 871 */ 872 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr, 873 int *usockaddr_len, int peer) 874 { 875 int len = 0; 876 int error = 0; 877 struct l2tp_session *session; 878 struct l2tp_tunnel *tunnel; 879 struct sock *sk = sock->sk; 880 struct inet_sock *inet; 881 struct pppol2tp_session *pls; 882 883 error = -ENOTCONN; 884 if (sk == NULL) 885 goto end; 886 if (!(sk->sk_state & PPPOX_CONNECTED)) 887 goto end; 888 889 error = -EBADF; 890 session = pppol2tp_sock_to_session(sk); 891 if (session == NULL) 892 goto end; 893 894 pls = l2tp_session_priv(session); 895 tunnel = session->tunnel; 896 897 inet = inet_sk(tunnel->sock); 898 if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) { 899 struct sockaddr_pppol2tp sp; 900 len = sizeof(sp); 901 memset(&sp, 0, len); 902 sp.sa_family = AF_PPPOX; 903 sp.sa_protocol = PX_PROTO_OL2TP; 904 sp.pppol2tp.fd = tunnel->fd; 905 sp.pppol2tp.pid = pls->owner; 906 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 907 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 908 sp.pppol2tp.s_session = session->session_id; 909 sp.pppol2tp.d_session = session->peer_session_id; 910 sp.pppol2tp.addr.sin_family = AF_INET; 911 sp.pppol2tp.addr.sin_port = inet->inet_dport; 912 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 913 memcpy(uaddr, &sp, len); 914 #if IS_ENABLED(CONFIG_IPV6) 915 } else if ((tunnel->version == 2) && 916 (tunnel->sock->sk_family == AF_INET6)) { 917 struct sockaddr_pppol2tpin6 sp; 918 919 len = sizeof(sp); 920 memset(&sp, 0, len); 921 sp.sa_family = AF_PPPOX; 922 sp.sa_protocol = PX_PROTO_OL2TP; 923 sp.pppol2tp.fd = tunnel->fd; 924 sp.pppol2tp.pid = pls->owner; 925 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 926 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 927 sp.pppol2tp.s_session = session->session_id; 928 sp.pppol2tp.d_session = session->peer_session_id; 929 sp.pppol2tp.addr.sin6_family = AF_INET6; 930 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 931 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 932 sizeof(tunnel->sock->sk_v6_daddr)); 933 memcpy(uaddr, &sp, len); 934 } else if ((tunnel->version == 3) && 935 (tunnel->sock->sk_family == AF_INET6)) { 936 struct sockaddr_pppol2tpv3in6 sp; 937 938 len = sizeof(sp); 939 memset(&sp, 0, len); 940 sp.sa_family = AF_PPPOX; 941 sp.sa_protocol = PX_PROTO_OL2TP; 942 sp.pppol2tp.fd = tunnel->fd; 943 sp.pppol2tp.pid = pls->owner; 944 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 945 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 946 sp.pppol2tp.s_session = session->session_id; 947 sp.pppol2tp.d_session = session->peer_session_id; 948 sp.pppol2tp.addr.sin6_family = AF_INET6; 949 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 950 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 951 sizeof(tunnel->sock->sk_v6_daddr)); 952 memcpy(uaddr, &sp, len); 953 #endif 954 } else if (tunnel->version == 3) { 955 struct sockaddr_pppol2tpv3 sp; 956 len = sizeof(sp); 957 memset(&sp, 0, len); 958 sp.sa_family = AF_PPPOX; 959 sp.sa_protocol = PX_PROTO_OL2TP; 960 sp.pppol2tp.fd = tunnel->fd; 961 sp.pppol2tp.pid = pls->owner; 962 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 963 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 964 sp.pppol2tp.s_session = session->session_id; 965 sp.pppol2tp.d_session = session->peer_session_id; 966 sp.pppol2tp.addr.sin_family = AF_INET; 967 sp.pppol2tp.addr.sin_port = inet->inet_dport; 968 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 969 memcpy(uaddr, &sp, len); 970 } 971 972 *usockaddr_len = len; 973 error = 0; 974 975 sock_put(sk); 976 end: 977 return error; 978 } 979 980 /**************************************************************************** 981 * ioctl() handlers. 982 * 983 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 984 * sockets. However, in order to control kernel tunnel features, we allow 985 * userspace to create a special "tunnel" PPPoX socket which is used for 986 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow 987 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl() 988 * calls. 989 ****************************************************************************/ 990 991 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest, 992 struct l2tp_stats *stats) 993 { 994 dest->tx_packets = atomic_long_read(&stats->tx_packets); 995 dest->tx_bytes = atomic_long_read(&stats->tx_bytes); 996 dest->tx_errors = atomic_long_read(&stats->tx_errors); 997 dest->rx_packets = atomic_long_read(&stats->rx_packets); 998 dest->rx_bytes = atomic_long_read(&stats->rx_bytes); 999 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards); 1000 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets); 1001 dest->rx_errors = atomic_long_read(&stats->rx_errors); 1002 } 1003 1004 /* Session ioctl helper. 1005 */ 1006 static int pppol2tp_session_ioctl(struct l2tp_session *session, 1007 unsigned int cmd, unsigned long arg) 1008 { 1009 struct ifreq ifr; 1010 int err = 0; 1011 struct sock *sk; 1012 int val = (int) arg; 1013 struct pppol2tp_session *ps = l2tp_session_priv(session); 1014 struct l2tp_tunnel *tunnel = session->tunnel; 1015 struct pppol2tp_ioc_stats stats; 1016 1017 l2tp_dbg(session, L2TP_MSG_CONTROL, 1018 "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n", 1019 session->name, cmd, arg); 1020 1021 sk = pppol2tp_session_get_sock(session); 1022 if (!sk) 1023 return -EBADR; 1024 1025 switch (cmd) { 1026 case SIOCGIFMTU: 1027 err = -ENXIO; 1028 if (!(sk->sk_state & PPPOX_CONNECTED)) 1029 break; 1030 1031 err = -EFAULT; 1032 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1033 break; 1034 ifr.ifr_mtu = session->mtu; 1035 if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq))) 1036 break; 1037 1038 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mtu=%d\n", 1039 session->name, session->mtu); 1040 err = 0; 1041 break; 1042 1043 case SIOCSIFMTU: 1044 err = -ENXIO; 1045 if (!(sk->sk_state & PPPOX_CONNECTED)) 1046 break; 1047 1048 err = -EFAULT; 1049 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1050 break; 1051 1052 session->mtu = ifr.ifr_mtu; 1053 1054 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mtu=%d\n", 1055 session->name, session->mtu); 1056 err = 0; 1057 break; 1058 1059 case PPPIOCGMRU: 1060 err = -ENXIO; 1061 if (!(sk->sk_state & PPPOX_CONNECTED)) 1062 break; 1063 1064 err = -EFAULT; 1065 if (put_user(session->mru, (int __user *) arg)) 1066 break; 1067 1068 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mru=%d\n", 1069 session->name, session->mru); 1070 err = 0; 1071 break; 1072 1073 case PPPIOCSMRU: 1074 err = -ENXIO; 1075 if (!(sk->sk_state & PPPOX_CONNECTED)) 1076 break; 1077 1078 err = -EFAULT; 1079 if (get_user(val, (int __user *) arg)) 1080 break; 1081 1082 session->mru = val; 1083 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mru=%d\n", 1084 session->name, session->mru); 1085 err = 0; 1086 break; 1087 1088 case PPPIOCGFLAGS: 1089 err = -EFAULT; 1090 if (put_user(ps->flags, (int __user *) arg)) 1091 break; 1092 1093 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get flags=%d\n", 1094 session->name, ps->flags); 1095 err = 0; 1096 break; 1097 1098 case PPPIOCSFLAGS: 1099 err = -EFAULT; 1100 if (get_user(val, (int __user *) arg)) 1101 break; 1102 ps->flags = val; 1103 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set flags=%d\n", 1104 session->name, ps->flags); 1105 err = 0; 1106 break; 1107 1108 case PPPIOCGL2TPSTATS: 1109 err = -ENXIO; 1110 if (!(sk->sk_state & PPPOX_CONNECTED)) 1111 break; 1112 1113 memset(&stats, 0, sizeof(stats)); 1114 stats.tunnel_id = tunnel->tunnel_id; 1115 stats.session_id = session->session_id; 1116 pppol2tp_copy_stats(&stats, &session->stats); 1117 if (copy_to_user((void __user *) arg, &stats, 1118 sizeof(stats))) 1119 break; 1120 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1121 session->name); 1122 err = 0; 1123 break; 1124 1125 default: 1126 err = -ENOSYS; 1127 break; 1128 } 1129 1130 sock_put(sk); 1131 1132 return err; 1133 } 1134 1135 /* Tunnel ioctl helper. 1136 * 1137 * Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data 1138 * specifies a session_id, the session ioctl handler is called. This allows an 1139 * application to retrieve session stats via a tunnel socket. 1140 */ 1141 static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel, 1142 unsigned int cmd, unsigned long arg) 1143 { 1144 int err = 0; 1145 struct sock *sk; 1146 struct pppol2tp_ioc_stats stats; 1147 1148 l2tp_dbg(tunnel, L2TP_MSG_CONTROL, 1149 "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n", 1150 tunnel->name, cmd, arg); 1151 1152 sk = tunnel->sock; 1153 sock_hold(sk); 1154 1155 switch (cmd) { 1156 case PPPIOCGL2TPSTATS: 1157 err = -ENXIO; 1158 if (!(sk->sk_state & PPPOX_CONNECTED)) 1159 break; 1160 1161 if (copy_from_user(&stats, (void __user *) arg, 1162 sizeof(stats))) { 1163 err = -EFAULT; 1164 break; 1165 } 1166 if (stats.session_id != 0) { 1167 /* resend to session ioctl handler */ 1168 struct l2tp_session *session = 1169 l2tp_session_get(sock_net(sk), tunnel, 1170 stats.session_id); 1171 1172 if (session) { 1173 err = pppol2tp_session_ioctl(session, cmd, 1174 arg); 1175 l2tp_session_dec_refcount(session); 1176 } else { 1177 err = -EBADR; 1178 } 1179 break; 1180 } 1181 #ifdef CONFIG_XFRM 1182 stats.using_ipsec = (sk->sk_policy[0] || sk->sk_policy[1]) ? 1 : 0; 1183 #endif 1184 pppol2tp_copy_stats(&stats, &tunnel->stats); 1185 if (copy_to_user((void __user *) arg, &stats, sizeof(stats))) { 1186 err = -EFAULT; 1187 break; 1188 } 1189 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1190 tunnel->name); 1191 err = 0; 1192 break; 1193 1194 default: 1195 err = -ENOSYS; 1196 break; 1197 } 1198 1199 sock_put(sk); 1200 1201 return err; 1202 } 1203 1204 /* Main ioctl() handler. 1205 * Dispatch to tunnel or session helpers depending on the socket. 1206 */ 1207 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, 1208 unsigned long arg) 1209 { 1210 struct sock *sk = sock->sk; 1211 struct l2tp_session *session; 1212 struct l2tp_tunnel *tunnel; 1213 int err; 1214 1215 if (!sk) 1216 return 0; 1217 1218 err = -EBADF; 1219 if (sock_flag(sk, SOCK_DEAD) != 0) 1220 goto end; 1221 1222 err = -ENOTCONN; 1223 if ((sk->sk_user_data == NULL) || 1224 (!(sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)))) 1225 goto end; 1226 1227 /* Get session context from the socket */ 1228 err = -EBADF; 1229 session = pppol2tp_sock_to_session(sk); 1230 if (session == NULL) 1231 goto end; 1232 1233 /* Special case: if session's session_id is zero, treat ioctl as a 1234 * tunnel ioctl 1235 */ 1236 if ((session->session_id == 0) && 1237 (session->peer_session_id == 0)) { 1238 tunnel = session->tunnel; 1239 err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg); 1240 goto end_put_sess; 1241 } 1242 1243 err = pppol2tp_session_ioctl(session, cmd, arg); 1244 1245 end_put_sess: 1246 sock_put(sk); 1247 end: 1248 return err; 1249 } 1250 1251 /***************************************************************************** 1252 * setsockopt() / getsockopt() support. 1253 * 1254 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1255 * sockets. In order to control kernel tunnel features, we allow userspace to 1256 * create a special "tunnel" PPPoX socket which is used for control only. 1257 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user 1258 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls. 1259 *****************************************************************************/ 1260 1261 /* Tunnel setsockopt() helper. 1262 */ 1263 static int pppol2tp_tunnel_setsockopt(struct sock *sk, 1264 struct l2tp_tunnel *tunnel, 1265 int optname, int val) 1266 { 1267 int err = 0; 1268 1269 switch (optname) { 1270 case PPPOL2TP_SO_DEBUG: 1271 tunnel->debug = val; 1272 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1273 tunnel->name, tunnel->debug); 1274 break; 1275 1276 default: 1277 err = -ENOPROTOOPT; 1278 break; 1279 } 1280 1281 return err; 1282 } 1283 1284 /* Session setsockopt helper. 1285 */ 1286 static int pppol2tp_session_setsockopt(struct sock *sk, 1287 struct l2tp_session *session, 1288 int optname, int val) 1289 { 1290 int err = 0; 1291 1292 switch (optname) { 1293 case PPPOL2TP_SO_RECVSEQ: 1294 if ((val != 0) && (val != 1)) { 1295 err = -EINVAL; 1296 break; 1297 } 1298 session->recv_seq = !!val; 1299 l2tp_info(session, L2TP_MSG_CONTROL, 1300 "%s: set recv_seq=%d\n", 1301 session->name, session->recv_seq); 1302 break; 1303 1304 case PPPOL2TP_SO_SENDSEQ: 1305 if ((val != 0) && (val != 1)) { 1306 err = -EINVAL; 1307 break; 1308 } 1309 session->send_seq = !!val; 1310 { 1311 struct pppox_sock *po = pppox_sk(sk); 1312 1313 po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ : 1314 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 1315 } 1316 l2tp_session_set_header_len(session, session->tunnel->version); 1317 l2tp_info(session, L2TP_MSG_CONTROL, 1318 "%s: set send_seq=%d\n", 1319 session->name, session->send_seq); 1320 break; 1321 1322 case PPPOL2TP_SO_LNSMODE: 1323 if ((val != 0) && (val != 1)) { 1324 err = -EINVAL; 1325 break; 1326 } 1327 session->lns_mode = !!val; 1328 l2tp_info(session, L2TP_MSG_CONTROL, 1329 "%s: set lns_mode=%d\n", 1330 session->name, session->lns_mode); 1331 break; 1332 1333 case PPPOL2TP_SO_DEBUG: 1334 session->debug = val; 1335 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1336 session->name, session->debug); 1337 break; 1338 1339 case PPPOL2TP_SO_REORDERTO: 1340 session->reorder_timeout = msecs_to_jiffies(val); 1341 l2tp_info(session, L2TP_MSG_CONTROL, 1342 "%s: set reorder_timeout=%d\n", 1343 session->name, session->reorder_timeout); 1344 break; 1345 1346 default: 1347 err = -ENOPROTOOPT; 1348 break; 1349 } 1350 1351 return err; 1352 } 1353 1354 /* Main setsockopt() entry point. 1355 * Does API checks, then calls either the tunnel or session setsockopt 1356 * handler, according to whether the PPPoL2TP socket is a for a regular 1357 * session or the special tunnel type. 1358 */ 1359 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, 1360 char __user *optval, unsigned int optlen) 1361 { 1362 struct sock *sk = sock->sk; 1363 struct l2tp_session *session; 1364 struct l2tp_tunnel *tunnel; 1365 int val; 1366 int err; 1367 1368 if (level != SOL_PPPOL2TP) 1369 return -EINVAL; 1370 1371 if (optlen < sizeof(int)) 1372 return -EINVAL; 1373 1374 if (get_user(val, (int __user *)optval)) 1375 return -EFAULT; 1376 1377 err = -ENOTCONN; 1378 if (sk->sk_user_data == NULL) 1379 goto end; 1380 1381 /* Get session context from the socket */ 1382 err = -EBADF; 1383 session = pppol2tp_sock_to_session(sk); 1384 if (session == NULL) 1385 goto end; 1386 1387 /* Special case: if session_id == 0x0000, treat as operation on tunnel 1388 */ 1389 if ((session->session_id == 0) && 1390 (session->peer_session_id == 0)) { 1391 tunnel = session->tunnel; 1392 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val); 1393 } else { 1394 err = pppol2tp_session_setsockopt(sk, session, optname, val); 1395 } 1396 1397 sock_put(sk); 1398 end: 1399 return err; 1400 } 1401 1402 /* Tunnel getsockopt helper. Called with sock locked. 1403 */ 1404 static int pppol2tp_tunnel_getsockopt(struct sock *sk, 1405 struct l2tp_tunnel *tunnel, 1406 int optname, int *val) 1407 { 1408 int err = 0; 1409 1410 switch (optname) { 1411 case PPPOL2TP_SO_DEBUG: 1412 *val = tunnel->debug; 1413 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get debug=%x\n", 1414 tunnel->name, tunnel->debug); 1415 break; 1416 1417 default: 1418 err = -ENOPROTOOPT; 1419 break; 1420 } 1421 1422 return err; 1423 } 1424 1425 /* Session getsockopt helper. Called with sock locked. 1426 */ 1427 static int pppol2tp_session_getsockopt(struct sock *sk, 1428 struct l2tp_session *session, 1429 int optname, int *val) 1430 { 1431 int err = 0; 1432 1433 switch (optname) { 1434 case PPPOL2TP_SO_RECVSEQ: 1435 *val = session->recv_seq; 1436 l2tp_info(session, L2TP_MSG_CONTROL, 1437 "%s: get recv_seq=%d\n", session->name, *val); 1438 break; 1439 1440 case PPPOL2TP_SO_SENDSEQ: 1441 *val = session->send_seq; 1442 l2tp_info(session, L2TP_MSG_CONTROL, 1443 "%s: get send_seq=%d\n", session->name, *val); 1444 break; 1445 1446 case PPPOL2TP_SO_LNSMODE: 1447 *val = session->lns_mode; 1448 l2tp_info(session, L2TP_MSG_CONTROL, 1449 "%s: get lns_mode=%d\n", session->name, *val); 1450 break; 1451 1452 case PPPOL2TP_SO_DEBUG: 1453 *val = session->debug; 1454 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get debug=%d\n", 1455 session->name, *val); 1456 break; 1457 1458 case PPPOL2TP_SO_REORDERTO: 1459 *val = (int) jiffies_to_msecs(session->reorder_timeout); 1460 l2tp_info(session, L2TP_MSG_CONTROL, 1461 "%s: get reorder_timeout=%d\n", session->name, *val); 1462 break; 1463 1464 default: 1465 err = -ENOPROTOOPT; 1466 } 1467 1468 return err; 1469 } 1470 1471 /* Main getsockopt() entry point. 1472 * Does API checks, then calls either the tunnel or session getsockopt 1473 * handler, according to whether the PPPoX socket is a for a regular session 1474 * or the special tunnel type. 1475 */ 1476 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, 1477 char __user *optval, int __user *optlen) 1478 { 1479 struct sock *sk = sock->sk; 1480 struct l2tp_session *session; 1481 struct l2tp_tunnel *tunnel; 1482 int val, len; 1483 int err; 1484 1485 if (level != SOL_PPPOL2TP) 1486 return -EINVAL; 1487 1488 if (get_user(len, optlen)) 1489 return -EFAULT; 1490 1491 len = min_t(unsigned int, len, sizeof(int)); 1492 1493 if (len < 0) 1494 return -EINVAL; 1495 1496 err = -ENOTCONN; 1497 if (sk->sk_user_data == NULL) 1498 goto end; 1499 1500 /* Get the session context */ 1501 err = -EBADF; 1502 session = pppol2tp_sock_to_session(sk); 1503 if (session == NULL) 1504 goto end; 1505 1506 /* Special case: if session_id == 0x0000, treat as operation on tunnel */ 1507 if ((session->session_id == 0) && 1508 (session->peer_session_id == 0)) { 1509 tunnel = session->tunnel; 1510 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val); 1511 if (err) 1512 goto end_put_sess; 1513 } else { 1514 err = pppol2tp_session_getsockopt(sk, session, optname, &val); 1515 if (err) 1516 goto end_put_sess; 1517 } 1518 1519 err = -EFAULT; 1520 if (put_user(len, optlen)) 1521 goto end_put_sess; 1522 1523 if (copy_to_user((void __user *) optval, &val, len)) 1524 goto end_put_sess; 1525 1526 err = 0; 1527 1528 end_put_sess: 1529 sock_put(sk); 1530 end: 1531 return err; 1532 } 1533 1534 /***************************************************************************** 1535 * /proc filesystem for debug 1536 * Since the original pppol2tp driver provided /proc/net/pppol2tp for 1537 * L2TPv2, we dump only L2TPv2 tunnels and sessions here. 1538 *****************************************************************************/ 1539 1540 static unsigned int pppol2tp_net_id; 1541 1542 #ifdef CONFIG_PROC_FS 1543 1544 struct pppol2tp_seq_data { 1545 struct seq_net_private p; 1546 int tunnel_idx; /* current tunnel */ 1547 int session_idx; /* index of session within current tunnel */ 1548 struct l2tp_tunnel *tunnel; 1549 struct l2tp_session *session; /* NULL means get next tunnel */ 1550 }; 1551 1552 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) 1553 { 1554 for (;;) { 1555 pd->tunnel = l2tp_tunnel_find_nth(net, pd->tunnel_idx); 1556 pd->tunnel_idx++; 1557 1558 if (pd->tunnel == NULL) 1559 break; 1560 1561 /* Ignore L2TPv3 tunnels */ 1562 if (pd->tunnel->version < 3) 1563 break; 1564 } 1565 } 1566 1567 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) 1568 { 1569 pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx); 1570 pd->session_idx++; 1571 1572 if (pd->session == NULL) { 1573 pd->session_idx = 0; 1574 pppol2tp_next_tunnel(net, pd); 1575 } 1576 } 1577 1578 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs) 1579 { 1580 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN; 1581 loff_t pos = *offs; 1582 struct net *net; 1583 1584 if (!pos) 1585 goto out; 1586 1587 BUG_ON(m->private == NULL); 1588 pd = m->private; 1589 net = seq_file_net(m); 1590 1591 if (pd->tunnel == NULL) 1592 pppol2tp_next_tunnel(net, pd); 1593 else 1594 pppol2tp_next_session(net, pd); 1595 1596 /* NULL tunnel and session indicates end of list */ 1597 if ((pd->tunnel == NULL) && (pd->session == NULL)) 1598 pd = NULL; 1599 1600 out: 1601 return pd; 1602 } 1603 1604 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos) 1605 { 1606 (*pos)++; 1607 return NULL; 1608 } 1609 1610 static void pppol2tp_seq_stop(struct seq_file *p, void *v) 1611 { 1612 /* nothing to do */ 1613 } 1614 1615 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) 1616 { 1617 struct l2tp_tunnel *tunnel = v; 1618 1619 seq_printf(m, "\nTUNNEL '%s', %c %d\n", 1620 tunnel->name, 1621 (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N', 1622 refcount_read(&tunnel->ref_count) - 1); 1623 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n", 1624 tunnel->debug, 1625 atomic_long_read(&tunnel->stats.tx_packets), 1626 atomic_long_read(&tunnel->stats.tx_bytes), 1627 atomic_long_read(&tunnel->stats.tx_errors), 1628 atomic_long_read(&tunnel->stats.rx_packets), 1629 atomic_long_read(&tunnel->stats.rx_bytes), 1630 atomic_long_read(&tunnel->stats.rx_errors)); 1631 } 1632 1633 static void pppol2tp_seq_session_show(struct seq_file *m, void *v) 1634 { 1635 struct l2tp_session *session = v; 1636 struct l2tp_tunnel *tunnel = session->tunnel; 1637 unsigned char state; 1638 char user_data_ok; 1639 struct sock *sk; 1640 u32 ip = 0; 1641 u16 port = 0; 1642 1643 if (tunnel->sock) { 1644 struct inet_sock *inet = inet_sk(tunnel->sock); 1645 ip = ntohl(inet->inet_saddr); 1646 port = ntohs(inet->inet_sport); 1647 } 1648 1649 sk = pppol2tp_session_get_sock(session); 1650 if (sk) { 1651 state = sk->sk_state; 1652 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N'; 1653 } else { 1654 state = 0; 1655 user_data_ok = 'N'; 1656 } 1657 1658 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> " 1659 "%04X/%04X %d %c\n", 1660 session->name, ip, port, 1661 tunnel->tunnel_id, 1662 session->session_id, 1663 tunnel->peer_tunnel_id, 1664 session->peer_session_id, 1665 state, user_data_ok); 1666 seq_printf(m, " %d/%d/%c/%c/%s %08x %u\n", 1667 session->mtu, session->mru, 1668 session->recv_seq ? 'R' : '-', 1669 session->send_seq ? 'S' : '-', 1670 session->lns_mode ? "LNS" : "LAC", 1671 session->debug, 1672 jiffies_to_msecs(session->reorder_timeout)); 1673 seq_printf(m, " %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n", 1674 session->nr, session->ns, 1675 atomic_long_read(&session->stats.tx_packets), 1676 atomic_long_read(&session->stats.tx_bytes), 1677 atomic_long_read(&session->stats.tx_errors), 1678 atomic_long_read(&session->stats.rx_packets), 1679 atomic_long_read(&session->stats.rx_bytes), 1680 atomic_long_read(&session->stats.rx_errors)); 1681 1682 if (sk) { 1683 struct pppox_sock *po = pppox_sk(sk); 1684 1685 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 1686 sock_put(sk); 1687 } 1688 } 1689 1690 static int pppol2tp_seq_show(struct seq_file *m, void *v) 1691 { 1692 struct pppol2tp_seq_data *pd = v; 1693 1694 /* display header on line 1 */ 1695 if (v == SEQ_START_TOKEN) { 1696 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n"); 1697 seq_puts(m, "TUNNEL name, user-data-ok session-count\n"); 1698 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1699 seq_puts(m, " SESSION name, addr/port src-tid/sid " 1700 "dest-tid/sid state user-data-ok\n"); 1701 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n"); 1702 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1703 goto out; 1704 } 1705 1706 /* Show the tunnel or session context. 1707 */ 1708 if (!pd->session) { 1709 pppol2tp_seq_tunnel_show(m, pd->tunnel); 1710 } else { 1711 pppol2tp_seq_session_show(m, pd->session); 1712 l2tp_session_dec_refcount(pd->session); 1713 } 1714 1715 out: 1716 return 0; 1717 } 1718 1719 static const struct seq_operations pppol2tp_seq_ops = { 1720 .start = pppol2tp_seq_start, 1721 .next = pppol2tp_seq_next, 1722 .stop = pppol2tp_seq_stop, 1723 .show = pppol2tp_seq_show, 1724 }; 1725 1726 /* Called when our /proc file is opened. We allocate data for use when 1727 * iterating our tunnel / session contexts and store it in the private 1728 * data of the seq_file. 1729 */ 1730 static int pppol2tp_proc_open(struct inode *inode, struct file *file) 1731 { 1732 return seq_open_net(inode, file, &pppol2tp_seq_ops, 1733 sizeof(struct pppol2tp_seq_data)); 1734 } 1735 1736 static const struct file_operations pppol2tp_proc_fops = { 1737 .open = pppol2tp_proc_open, 1738 .read = seq_read, 1739 .llseek = seq_lseek, 1740 .release = seq_release_net, 1741 }; 1742 1743 #endif /* CONFIG_PROC_FS */ 1744 1745 /***************************************************************************** 1746 * Network namespace 1747 *****************************************************************************/ 1748 1749 static __net_init int pppol2tp_init_net(struct net *net) 1750 { 1751 struct proc_dir_entry *pde; 1752 int err = 0; 1753 1754 pde = proc_create("pppol2tp", S_IRUGO, net->proc_net, 1755 &pppol2tp_proc_fops); 1756 if (!pde) { 1757 err = -ENOMEM; 1758 goto out; 1759 } 1760 1761 out: 1762 return err; 1763 } 1764 1765 static __net_exit void pppol2tp_exit_net(struct net *net) 1766 { 1767 remove_proc_entry("pppol2tp", net->proc_net); 1768 } 1769 1770 static struct pernet_operations pppol2tp_net_ops = { 1771 .init = pppol2tp_init_net, 1772 .exit = pppol2tp_exit_net, 1773 .id = &pppol2tp_net_id, 1774 }; 1775 1776 /***************************************************************************** 1777 * Init and cleanup 1778 *****************************************************************************/ 1779 1780 static const struct proto_ops pppol2tp_ops = { 1781 .family = AF_PPPOX, 1782 .owner = THIS_MODULE, 1783 .release = pppol2tp_release, 1784 .bind = sock_no_bind, 1785 .connect = pppol2tp_connect, 1786 .socketpair = sock_no_socketpair, 1787 .accept = sock_no_accept, 1788 .getname = pppol2tp_getname, 1789 .poll = datagram_poll, 1790 .listen = sock_no_listen, 1791 .shutdown = sock_no_shutdown, 1792 .setsockopt = pppol2tp_setsockopt, 1793 .getsockopt = pppol2tp_getsockopt, 1794 .sendmsg = pppol2tp_sendmsg, 1795 .recvmsg = pppol2tp_recvmsg, 1796 .mmap = sock_no_mmap, 1797 .ioctl = pppox_ioctl, 1798 }; 1799 1800 static const struct pppox_proto pppol2tp_proto = { 1801 .create = pppol2tp_create, 1802 .ioctl = pppol2tp_ioctl, 1803 .owner = THIS_MODULE, 1804 }; 1805 1806 #ifdef CONFIG_L2TP_V3 1807 1808 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = { 1809 .session_create = pppol2tp_session_create, 1810 .session_delete = l2tp_session_delete, 1811 }; 1812 1813 #endif /* CONFIG_L2TP_V3 */ 1814 1815 static int __init pppol2tp_init(void) 1816 { 1817 int err; 1818 1819 err = register_pernet_device(&pppol2tp_net_ops); 1820 if (err) 1821 goto out; 1822 1823 err = proto_register(&pppol2tp_sk_proto, 0); 1824 if (err) 1825 goto out_unregister_pppol2tp_pernet; 1826 1827 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto); 1828 if (err) 1829 goto out_unregister_pppol2tp_proto; 1830 1831 #ifdef CONFIG_L2TP_V3 1832 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops); 1833 if (err) 1834 goto out_unregister_pppox; 1835 #endif 1836 1837 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION); 1838 1839 out: 1840 return err; 1841 1842 #ifdef CONFIG_L2TP_V3 1843 out_unregister_pppox: 1844 unregister_pppox_proto(PX_PROTO_OL2TP); 1845 #endif 1846 out_unregister_pppol2tp_proto: 1847 proto_unregister(&pppol2tp_sk_proto); 1848 out_unregister_pppol2tp_pernet: 1849 unregister_pernet_device(&pppol2tp_net_ops); 1850 goto out; 1851 } 1852 1853 static void __exit pppol2tp_exit(void) 1854 { 1855 #ifdef CONFIG_L2TP_V3 1856 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP); 1857 #endif 1858 unregister_pppox_proto(PX_PROTO_OL2TP); 1859 proto_unregister(&pppol2tp_sk_proto); 1860 unregister_pernet_device(&pppol2tp_net_ops); 1861 } 1862 1863 module_init(pppol2tp_init); 1864 module_exit(pppol2tp_exit); 1865 1866 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1867 MODULE_DESCRIPTION("PPP over L2TP over UDP"); 1868 MODULE_LICENSE("GPL"); 1869 MODULE_VERSION(PPPOL2TP_DRV_VERSION); 1870 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP); 1871 MODULE_ALIAS_L2TP_PWTYPE(7); 1872