1 /***************************************************************************** 2 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets 3 * 4 * PPPoX --- Generic PPP encapsulation socket family 5 * PPPoL2TP --- PPP over L2TP (RFC 2661) 6 * 7 * Version: 2.0.0 8 * 9 * Authors: James Chapman (jchapman@katalix.com) 10 * 11 * Based on original work by Martijn van Oosterhout <kleptog@svana.org> 12 * 13 * License: 14 * This program is free software; you can redistribute it and/or 15 * modify it under the terms of the GNU General Public License 16 * as published by the Free Software Foundation; either version 17 * 2 of the License, or (at your option) any later version. 18 * 19 */ 20 21 /* This driver handles only L2TP data frames; control frames are handled by a 22 * userspace application. 23 * 24 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and 25 * attaches it to a bound UDP socket with local tunnel_id / session_id and 26 * peer tunnel_id / session_id set. Data can then be sent or received using 27 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket 28 * can be read or modified using ioctl() or [gs]etsockopt() calls. 29 * 30 * When a PPPoL2TP socket is connected with local and peer session_id values 31 * zero, the socket is treated as a special tunnel management socket. 32 * 33 * Here's example userspace code to create a socket for sending/receiving data 34 * over an L2TP session:- 35 * 36 * struct sockaddr_pppol2tp sax; 37 * int fd; 38 * int session_fd; 39 * 40 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); 41 * 42 * sax.sa_family = AF_PPPOX; 43 * sax.sa_protocol = PX_PROTO_OL2TP; 44 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket 45 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr; 46 * sax.pppol2tp.addr.sin_port = addr->sin_port; 47 * sax.pppol2tp.addr.sin_family = AF_INET; 48 * sax.pppol2tp.s_tunnel = tunnel_id; 49 * sax.pppol2tp.s_session = session_id; 50 * sax.pppol2tp.d_tunnel = peer_tunnel_id; 51 * sax.pppol2tp.d_session = peer_session_id; 52 * 53 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax)); 54 * 55 * A pppd plugin that allows PPP traffic to be carried over L2TP using 56 * this driver is available from the OpenL2TP project at 57 * http://openl2tp.sourceforge.net. 58 */ 59 60 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 61 62 #include <linux/module.h> 63 #include <linux/string.h> 64 #include <linux/list.h> 65 #include <linux/uaccess.h> 66 67 #include <linux/kernel.h> 68 #include <linux/spinlock.h> 69 #include <linux/kthread.h> 70 #include <linux/sched.h> 71 #include <linux/slab.h> 72 #include <linux/errno.h> 73 #include <linux/jiffies.h> 74 75 #include <linux/netdevice.h> 76 #include <linux/net.h> 77 #include <linux/inetdevice.h> 78 #include <linux/skbuff.h> 79 #include <linux/init.h> 80 #include <linux/ip.h> 81 #include <linux/udp.h> 82 #include <linux/if_pppox.h> 83 #include <linux/if_pppol2tp.h> 84 #include <net/sock.h> 85 #include <linux/ppp_channel.h> 86 #include <linux/ppp_defs.h> 87 #include <linux/ppp-ioctl.h> 88 #include <linux/file.h> 89 #include <linux/hash.h> 90 #include <linux/sort.h> 91 #include <linux/proc_fs.h> 92 #include <linux/l2tp.h> 93 #include <linux/nsproxy.h> 94 #include <net/net_namespace.h> 95 #include <net/netns/generic.h> 96 #include <net/dst.h> 97 #include <net/ip.h> 98 #include <net/udp.h> 99 #include <net/xfrm.h> 100 #include <net/inet_common.h> 101 102 #include <asm/byteorder.h> 103 #include <linux/atomic.h> 104 105 #include "l2tp_core.h" 106 107 #define PPPOL2TP_DRV_VERSION "V2.0" 108 109 /* Space for UDP, L2TP and PPP headers */ 110 #define PPPOL2TP_HEADER_OVERHEAD 40 111 112 /* Number of bytes to build transmit L2TP headers. 113 * Unfortunately the size is different depending on whether sequence numbers 114 * are enabled. 115 */ 116 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10 117 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6 118 119 /* Private data of each session. This data lives at the end of struct 120 * l2tp_session, referenced via session->priv[]. 121 */ 122 struct pppol2tp_session { 123 int owner; /* pid that opened the socket */ 124 125 struct mutex sk_lock; /* Protects .sk */ 126 struct sock __rcu *sk; /* Pointer to the session 127 * PPPoX socket */ 128 struct sock *__sk; /* Copy of .sk, for cleanup */ 129 struct rcu_head rcu; /* For asynchronous release */ 130 struct sock *tunnel_sock; /* Pointer to the tunnel UDP 131 * socket */ 132 int flags; /* accessed by PPPIOCGFLAGS. 133 * Unused. */ 134 }; 135 136 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb); 137 138 static const struct ppp_channel_ops pppol2tp_chan_ops = { 139 .start_xmit = pppol2tp_xmit, 140 }; 141 142 static const struct proto_ops pppol2tp_ops; 143 144 /* Retrieves the pppol2tp socket associated to a session. 145 * A reference is held on the returned socket, so this function must be paired 146 * with sock_put(). 147 */ 148 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) 149 { 150 struct pppol2tp_session *ps = l2tp_session_priv(session); 151 struct sock *sk; 152 153 rcu_read_lock(); 154 sk = rcu_dereference(ps->sk); 155 if (sk) 156 sock_hold(sk); 157 rcu_read_unlock(); 158 159 return sk; 160 } 161 162 /* Helpers to obtain tunnel/session contexts from sockets. 163 */ 164 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) 165 { 166 struct l2tp_session *session; 167 168 if (sk == NULL) 169 return NULL; 170 171 sock_hold(sk); 172 session = (struct l2tp_session *)(sk->sk_user_data); 173 if (session == NULL) { 174 sock_put(sk); 175 goto out; 176 } 177 178 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 179 180 out: 181 return session; 182 } 183 184 /***************************************************************************** 185 * Receive data handling 186 *****************************************************************************/ 187 188 static int pppol2tp_recv_payload_hook(struct sk_buff *skb) 189 { 190 /* Skip PPP header, if present. In testing, Microsoft L2TP clients 191 * don't send the PPP header (PPP header compression enabled), but 192 * other clients can include the header. So we cope with both cases 193 * here. The PPP header is always FF03 when using L2TP. 194 * 195 * Note that skb->data[] isn't dereferenced from a u16 ptr here since 196 * the field may be unaligned. 197 */ 198 if (!pskb_may_pull(skb, 2)) 199 return 1; 200 201 if ((skb->data[0] == PPP_ALLSTATIONS) && (skb->data[1] == PPP_UI)) 202 skb_pull(skb, 2); 203 204 return 0; 205 } 206 207 /* Receive message. This is the recvmsg for the PPPoL2TP socket. 208 */ 209 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, 210 size_t len, int flags) 211 { 212 int err; 213 struct sk_buff *skb; 214 struct sock *sk = sock->sk; 215 216 err = -EIO; 217 if (sk->sk_state & PPPOX_BOUND) 218 goto end; 219 220 err = 0; 221 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 222 flags & MSG_DONTWAIT, &err); 223 if (!skb) 224 goto end; 225 226 if (len > skb->len) 227 len = skb->len; 228 else if (len < skb->len) 229 msg->msg_flags |= MSG_TRUNC; 230 231 err = skb_copy_datagram_msg(skb, 0, msg, len); 232 if (likely(err == 0)) 233 err = len; 234 235 kfree_skb(skb); 236 end: 237 return err; 238 } 239 240 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) 241 { 242 struct pppol2tp_session *ps = l2tp_session_priv(session); 243 struct sock *sk = NULL; 244 245 /* If the socket is bound, send it in to PPP's input queue. Otherwise 246 * queue it on the session socket. 247 */ 248 rcu_read_lock(); 249 sk = rcu_dereference(ps->sk); 250 if (sk == NULL) 251 goto no_sock; 252 253 if (sk->sk_state & PPPOX_BOUND) { 254 struct pppox_sock *po; 255 256 l2tp_dbg(session, L2TP_MSG_DATA, 257 "%s: recv %d byte data frame, passing to ppp\n", 258 session->name, data_len); 259 260 po = pppox_sk(sk); 261 ppp_input(&po->chan, skb); 262 } else { 263 l2tp_dbg(session, L2TP_MSG_DATA, 264 "%s: recv %d byte data frame, passing to L2TP socket\n", 265 session->name, data_len); 266 267 if (sock_queue_rcv_skb(sk, skb) < 0) { 268 atomic_long_inc(&session->stats.rx_errors); 269 kfree_skb(skb); 270 } 271 } 272 rcu_read_unlock(); 273 274 return; 275 276 no_sock: 277 rcu_read_unlock(); 278 l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name); 279 kfree_skb(skb); 280 } 281 282 /************************************************************************ 283 * Transmit handling 284 ***********************************************************************/ 285 286 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here 287 * when a user application does a sendmsg() on the session socket. L2TP and 288 * PPP headers must be inserted into the user's data. 289 */ 290 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m, 291 size_t total_len) 292 { 293 struct sock *sk = sock->sk; 294 struct sk_buff *skb; 295 int error; 296 struct l2tp_session *session; 297 struct l2tp_tunnel *tunnel; 298 struct pppol2tp_session *ps; 299 int uhlen; 300 301 error = -ENOTCONN; 302 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 303 goto error; 304 305 /* Get session and tunnel contexts */ 306 error = -EBADF; 307 session = pppol2tp_sock_to_session(sk); 308 if (session == NULL) 309 goto error; 310 311 ps = l2tp_session_priv(session); 312 tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock); 313 if (tunnel == NULL) 314 goto error_put_sess; 315 316 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 317 318 /* Allocate a socket buffer */ 319 error = -ENOMEM; 320 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 321 uhlen + session->hdr_len + 322 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 323 0, GFP_KERNEL); 324 if (!skb) 325 goto error_put_sess_tun; 326 327 /* Reserve space for headers. */ 328 skb_reserve(skb, NET_SKB_PAD); 329 skb_reset_network_header(skb); 330 skb_reserve(skb, sizeof(struct iphdr)); 331 skb_reset_transport_header(skb); 332 skb_reserve(skb, uhlen); 333 334 /* Add PPP header */ 335 skb->data[0] = PPP_ALLSTATIONS; 336 skb->data[1] = PPP_UI; 337 skb_put(skb, 2); 338 339 /* Copy user data into skb */ 340 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len); 341 if (error < 0) { 342 kfree_skb(skb); 343 goto error_put_sess_tun; 344 } 345 346 local_bh_disable(); 347 l2tp_xmit_skb(session, skb, session->hdr_len); 348 local_bh_enable(); 349 350 sock_put(ps->tunnel_sock); 351 sock_put(sk); 352 353 return total_len; 354 355 error_put_sess_tun: 356 sock_put(ps->tunnel_sock); 357 error_put_sess: 358 sock_put(sk); 359 error: 360 return error; 361 } 362 363 /* Transmit function called by generic PPP driver. Sends PPP frame 364 * over PPPoL2TP socket. 365 * 366 * This is almost the same as pppol2tp_sendmsg(), but rather than 367 * being called with a msghdr from userspace, it is called with a skb 368 * from the kernel. 369 * 370 * The supplied skb from ppp doesn't have enough headroom for the 371 * insertion of L2TP, UDP and IP headers so we need to allocate more 372 * headroom in the skb. This will create a cloned skb. But we must be 373 * careful in the error case because the caller will expect to free 374 * the skb it supplied, not our cloned skb. So we take care to always 375 * leave the original skb unfreed if we return an error. 376 */ 377 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) 378 { 379 struct sock *sk = (struct sock *) chan->private; 380 struct sock *sk_tun; 381 struct l2tp_session *session; 382 struct l2tp_tunnel *tunnel; 383 struct pppol2tp_session *ps; 384 int uhlen, headroom; 385 386 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 387 goto abort; 388 389 /* Get session and tunnel contexts from the socket */ 390 session = pppol2tp_sock_to_session(sk); 391 if (session == NULL) 392 goto abort; 393 394 ps = l2tp_session_priv(session); 395 sk_tun = ps->tunnel_sock; 396 if (sk_tun == NULL) 397 goto abort_put_sess; 398 tunnel = l2tp_sock_to_tunnel(sk_tun); 399 if (tunnel == NULL) 400 goto abort_put_sess; 401 402 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 403 headroom = NET_SKB_PAD + 404 sizeof(struct iphdr) + /* IP header */ 405 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */ 406 session->hdr_len + /* L2TP header */ 407 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 408 if (skb_cow_head(skb, headroom)) 409 goto abort_put_sess_tun; 410 411 /* Setup PPP header */ 412 __skb_push(skb, 2); 413 skb->data[0] = PPP_ALLSTATIONS; 414 skb->data[1] = PPP_UI; 415 416 local_bh_disable(); 417 l2tp_xmit_skb(session, skb, session->hdr_len); 418 local_bh_enable(); 419 420 sock_put(sk_tun); 421 sock_put(sk); 422 return 1; 423 424 abort_put_sess_tun: 425 sock_put(sk_tun); 426 abort_put_sess: 427 sock_put(sk); 428 abort: 429 /* Free the original skb */ 430 kfree_skb(skb); 431 return 1; 432 } 433 434 /***************************************************************************** 435 * Session (and tunnel control) socket create/destroy. 436 *****************************************************************************/ 437 438 /* Called by l2tp_core when a session socket is being closed. 439 */ 440 static void pppol2tp_session_close(struct l2tp_session *session) 441 { 442 struct sock *sk; 443 444 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 445 446 sk = pppol2tp_session_get_sock(session); 447 if (sk) { 448 if (sk->sk_socket) 449 inet_shutdown(sk->sk_socket, SEND_SHUTDOWN); 450 sock_put(sk); 451 } 452 } 453 454 /* Really kill the session socket. (Called from sock_put() if 455 * refcnt == 0.) 456 */ 457 static void pppol2tp_session_destruct(struct sock *sk) 458 { 459 struct l2tp_session *session = sk->sk_user_data; 460 461 skb_queue_purge(&sk->sk_receive_queue); 462 skb_queue_purge(&sk->sk_write_queue); 463 464 if (session) { 465 sk->sk_user_data = NULL; 466 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 467 l2tp_session_dec_refcount(session); 468 } 469 } 470 471 static void pppol2tp_put_sk(struct rcu_head *head) 472 { 473 struct pppol2tp_session *ps; 474 475 ps = container_of(head, typeof(*ps), rcu); 476 sock_put(ps->__sk); 477 } 478 479 /* Called when the PPPoX socket (session) is closed. 480 */ 481 static int pppol2tp_release(struct socket *sock) 482 { 483 struct sock *sk = sock->sk; 484 struct l2tp_session *session; 485 int error; 486 487 if (!sk) 488 return 0; 489 490 error = -EBADF; 491 lock_sock(sk); 492 if (sock_flag(sk, SOCK_DEAD) != 0) 493 goto error; 494 495 pppox_unbind_sock(sk); 496 497 /* Signal the death of the socket. */ 498 sk->sk_state = PPPOX_DEAD; 499 sock_orphan(sk); 500 sock->sk = NULL; 501 502 session = pppol2tp_sock_to_session(sk); 503 504 if (session != NULL) { 505 struct pppol2tp_session *ps; 506 507 l2tp_session_delete(session); 508 509 ps = l2tp_session_priv(session); 510 mutex_lock(&ps->sk_lock); 511 ps->__sk = rcu_dereference_protected(ps->sk, 512 lockdep_is_held(&ps->sk_lock)); 513 RCU_INIT_POINTER(ps->sk, NULL); 514 mutex_unlock(&ps->sk_lock); 515 call_rcu(&ps->rcu, pppol2tp_put_sk); 516 517 /* Rely on the sock_put() call at the end of the function for 518 * dropping the reference held by pppol2tp_sock_to_session(). 519 * The last reference will be dropped by pppol2tp_put_sk(). 520 */ 521 } 522 release_sock(sk); 523 524 /* This will delete the session context via 525 * pppol2tp_session_destruct() if the socket's refcnt drops to 526 * zero. 527 */ 528 sock_put(sk); 529 530 return 0; 531 532 error: 533 release_sock(sk); 534 return error; 535 } 536 537 static struct proto pppol2tp_sk_proto = { 538 .name = "PPPOL2TP", 539 .owner = THIS_MODULE, 540 .obj_size = sizeof(struct pppox_sock), 541 }; 542 543 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb) 544 { 545 int rc; 546 547 rc = l2tp_udp_encap_recv(sk, skb); 548 if (rc) 549 kfree_skb(skb); 550 551 return NET_RX_SUCCESS; 552 } 553 554 /* socket() handler. Initialize a new struct sock. 555 */ 556 static int pppol2tp_create(struct net *net, struct socket *sock, int kern) 557 { 558 int error = -ENOMEM; 559 struct sock *sk; 560 561 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern); 562 if (!sk) 563 goto out; 564 565 sock_init_data(sock, sk); 566 567 sock->state = SS_UNCONNECTED; 568 sock->ops = &pppol2tp_ops; 569 570 sk->sk_backlog_rcv = pppol2tp_backlog_recv; 571 sk->sk_protocol = PX_PROTO_OL2TP; 572 sk->sk_family = PF_PPPOX; 573 sk->sk_state = PPPOX_NONE; 574 sk->sk_type = SOCK_STREAM; 575 sk->sk_destruct = pppol2tp_session_destruct; 576 577 error = 0; 578 579 out: 580 return error; 581 } 582 583 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 584 static void pppol2tp_show(struct seq_file *m, void *arg) 585 { 586 struct l2tp_session *session = arg; 587 struct sock *sk; 588 589 sk = pppol2tp_session_get_sock(session); 590 if (sk) { 591 struct pppox_sock *po = pppox_sk(sk); 592 593 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 594 sock_put(sk); 595 } 596 } 597 #endif 598 599 static void pppol2tp_session_init(struct l2tp_session *session) 600 { 601 struct pppol2tp_session *ps; 602 struct dst_entry *dst; 603 604 session->recv_skb = pppol2tp_recv; 605 session->session_close = pppol2tp_session_close; 606 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 607 session->show = pppol2tp_show; 608 #endif 609 610 ps = l2tp_session_priv(session); 611 mutex_init(&ps->sk_lock); 612 ps->tunnel_sock = session->tunnel->sock; 613 ps->owner = current->pid; 614 615 /* If PMTU discovery was enabled, use the MTU that was discovered */ 616 dst = sk_dst_get(session->tunnel->sock); 617 if (dst) { 618 u32 pmtu = dst_mtu(dst); 619 620 if (pmtu) { 621 session->mtu = pmtu - PPPOL2TP_HEADER_OVERHEAD; 622 session->mru = pmtu - PPPOL2TP_HEADER_OVERHEAD; 623 } 624 dst_release(dst); 625 } 626 } 627 628 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket 629 */ 630 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 631 int sockaddr_len, int flags) 632 { 633 struct sock *sk = sock->sk; 634 struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr; 635 struct pppox_sock *po = pppox_sk(sk); 636 struct l2tp_session *session = NULL; 637 struct l2tp_tunnel *tunnel; 638 struct pppol2tp_session *ps; 639 struct l2tp_session_cfg cfg = { 0, }; 640 int error = 0; 641 u32 tunnel_id, peer_tunnel_id; 642 u32 session_id, peer_session_id; 643 bool drop_refcnt = false; 644 bool drop_tunnel = false; 645 int ver = 2; 646 int fd; 647 648 lock_sock(sk); 649 650 error = -EINVAL; 651 if (sp->sa_protocol != PX_PROTO_OL2TP) 652 goto end; 653 654 /* Check for already bound sockets */ 655 error = -EBUSY; 656 if (sk->sk_state & PPPOX_CONNECTED) 657 goto end; 658 659 /* We don't supporting rebinding anyway */ 660 error = -EALREADY; 661 if (sk->sk_user_data) 662 goto end; /* socket is already attached */ 663 664 /* Get params from socket address. Handle L2TPv2 and L2TPv3. 665 * This is nasty because there are different sockaddr_pppol2tp 666 * structs for L2TPv2, L2TPv3, over IPv4 and IPv6. We use 667 * the sockaddr size to determine which structure the caller 668 * is using. 669 */ 670 peer_tunnel_id = 0; 671 if (sockaddr_len == sizeof(struct sockaddr_pppol2tp)) { 672 fd = sp->pppol2tp.fd; 673 tunnel_id = sp->pppol2tp.s_tunnel; 674 peer_tunnel_id = sp->pppol2tp.d_tunnel; 675 session_id = sp->pppol2tp.s_session; 676 peer_session_id = sp->pppol2tp.d_session; 677 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3)) { 678 struct sockaddr_pppol2tpv3 *sp3 = 679 (struct sockaddr_pppol2tpv3 *) sp; 680 ver = 3; 681 fd = sp3->pppol2tp.fd; 682 tunnel_id = sp3->pppol2tp.s_tunnel; 683 peer_tunnel_id = sp3->pppol2tp.d_tunnel; 684 session_id = sp3->pppol2tp.s_session; 685 peer_session_id = sp3->pppol2tp.d_session; 686 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpin6)) { 687 struct sockaddr_pppol2tpin6 *sp6 = 688 (struct sockaddr_pppol2tpin6 *) sp; 689 fd = sp6->pppol2tp.fd; 690 tunnel_id = sp6->pppol2tp.s_tunnel; 691 peer_tunnel_id = sp6->pppol2tp.d_tunnel; 692 session_id = sp6->pppol2tp.s_session; 693 peer_session_id = sp6->pppol2tp.d_session; 694 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3in6)) { 695 struct sockaddr_pppol2tpv3in6 *sp6 = 696 (struct sockaddr_pppol2tpv3in6 *) sp; 697 ver = 3; 698 fd = sp6->pppol2tp.fd; 699 tunnel_id = sp6->pppol2tp.s_tunnel; 700 peer_tunnel_id = sp6->pppol2tp.d_tunnel; 701 session_id = sp6->pppol2tp.s_session; 702 peer_session_id = sp6->pppol2tp.d_session; 703 } else { 704 error = -EINVAL; 705 goto end; /* bad socket address */ 706 } 707 708 /* Don't bind if tunnel_id is 0 */ 709 error = -EINVAL; 710 if (tunnel_id == 0) 711 goto end; 712 713 tunnel = l2tp_tunnel_get(sock_net(sk), tunnel_id); 714 if (tunnel) 715 drop_tunnel = true; 716 717 /* Special case: create tunnel context if session_id and 718 * peer_session_id is 0. Otherwise look up tunnel using supplied 719 * tunnel id. 720 */ 721 if ((session_id == 0) && (peer_session_id == 0)) { 722 if (tunnel == NULL) { 723 struct l2tp_tunnel_cfg tcfg = { 724 .encap = L2TP_ENCAPTYPE_UDP, 725 .debug = 0, 726 }; 727 error = l2tp_tunnel_create(sock_net(sk), fd, ver, tunnel_id, peer_tunnel_id, &tcfg, &tunnel); 728 if (error < 0) 729 goto end; 730 } 731 } else { 732 /* Error if we can't find the tunnel */ 733 error = -ENOENT; 734 if (tunnel == NULL) 735 goto end; 736 737 /* Error if socket is not prepped */ 738 if (tunnel->sock == NULL) 739 goto end; 740 } 741 742 if (tunnel->recv_payload_hook == NULL) 743 tunnel->recv_payload_hook = pppol2tp_recv_payload_hook; 744 745 if (tunnel->peer_tunnel_id == 0) 746 tunnel->peer_tunnel_id = peer_tunnel_id; 747 748 session = l2tp_session_get(sock_net(sk), tunnel, session_id); 749 if (session) { 750 drop_refcnt = true; 751 ps = l2tp_session_priv(session); 752 753 /* Using a pre-existing session is fine as long as it hasn't 754 * been connected yet. 755 */ 756 mutex_lock(&ps->sk_lock); 757 if (rcu_dereference_protected(ps->sk, 758 lockdep_is_held(&ps->sk_lock))) { 759 mutex_unlock(&ps->sk_lock); 760 error = -EEXIST; 761 goto end; 762 } 763 764 /* consistency checks */ 765 if (ps->tunnel_sock != tunnel->sock) { 766 mutex_unlock(&ps->sk_lock); 767 error = -EEXIST; 768 goto end; 769 } 770 } else { 771 /* Default MTU must allow space for UDP/L2TP/PPP headers */ 772 cfg.mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 773 cfg.mru = cfg.mtu; 774 775 session = l2tp_session_create(sizeof(struct pppol2tp_session), 776 tunnel, session_id, 777 peer_session_id, &cfg); 778 if (IS_ERR(session)) { 779 error = PTR_ERR(session); 780 goto end; 781 } 782 783 pppol2tp_session_init(session); 784 ps = l2tp_session_priv(session); 785 l2tp_session_inc_refcount(session); 786 787 mutex_lock(&ps->sk_lock); 788 error = l2tp_session_register(session, tunnel); 789 if (error < 0) { 790 mutex_unlock(&ps->sk_lock); 791 kfree(session); 792 goto end; 793 } 794 drop_refcnt = true; 795 } 796 797 /* Special case: if source & dest session_id == 0x0000, this 798 * socket is being created to manage the tunnel. Just set up 799 * the internal context for use by ioctl() and sockopt() 800 * handlers. 801 */ 802 if ((session->session_id == 0) && 803 (session->peer_session_id == 0)) { 804 error = 0; 805 goto out_no_ppp; 806 } 807 808 /* The only header we need to worry about is the L2TP 809 * header. This size is different depending on whether 810 * sequence numbers are enabled for the data channel. 811 */ 812 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 813 814 po->chan.private = sk; 815 po->chan.ops = &pppol2tp_chan_ops; 816 po->chan.mtu = session->mtu; 817 818 error = ppp_register_net_channel(sock_net(sk), &po->chan); 819 if (error) { 820 mutex_unlock(&ps->sk_lock); 821 goto end; 822 } 823 824 out_no_ppp: 825 /* This is how we get the session context from the socket. */ 826 sk->sk_user_data = session; 827 rcu_assign_pointer(ps->sk, sk); 828 mutex_unlock(&ps->sk_lock); 829 830 /* Keep the reference we've grabbed on the session: sk doesn't expect 831 * the session to disappear. pppol2tp_session_destruct() is responsible 832 * for dropping it. 833 */ 834 drop_refcnt = false; 835 836 sk->sk_state = PPPOX_CONNECTED; 837 l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n", 838 session->name); 839 840 end: 841 if (drop_refcnt) 842 l2tp_session_dec_refcount(session); 843 if (drop_tunnel) 844 l2tp_tunnel_dec_refcount(tunnel); 845 release_sock(sk); 846 847 return error; 848 } 849 850 #ifdef CONFIG_L2TP_V3 851 852 /* Called when creating sessions via the netlink interface. */ 853 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, 854 u32 session_id, u32 peer_session_id, 855 struct l2tp_session_cfg *cfg) 856 { 857 int error; 858 struct l2tp_session *session; 859 860 /* Error if tunnel socket is not prepped */ 861 if (!tunnel->sock) { 862 error = -ENOENT; 863 goto err; 864 } 865 866 /* Default MTU values. */ 867 if (cfg->mtu == 0) 868 cfg->mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 869 if (cfg->mru == 0) 870 cfg->mru = cfg->mtu; 871 872 /* Allocate and initialize a new session context. */ 873 session = l2tp_session_create(sizeof(struct pppol2tp_session), 874 tunnel, session_id, 875 peer_session_id, cfg); 876 if (IS_ERR(session)) { 877 error = PTR_ERR(session); 878 goto err; 879 } 880 881 pppol2tp_session_init(session); 882 883 error = l2tp_session_register(session, tunnel); 884 if (error < 0) 885 goto err_sess; 886 887 return 0; 888 889 err_sess: 890 kfree(session); 891 err: 892 return error; 893 } 894 895 #endif /* CONFIG_L2TP_V3 */ 896 897 /* getname() support. 898 */ 899 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr, 900 int *usockaddr_len, int peer) 901 { 902 int len = 0; 903 int error = 0; 904 struct l2tp_session *session; 905 struct l2tp_tunnel *tunnel; 906 struct sock *sk = sock->sk; 907 struct inet_sock *inet; 908 struct pppol2tp_session *pls; 909 910 error = -ENOTCONN; 911 if (sk == NULL) 912 goto end; 913 if (!(sk->sk_state & PPPOX_CONNECTED)) 914 goto end; 915 916 error = -EBADF; 917 session = pppol2tp_sock_to_session(sk); 918 if (session == NULL) 919 goto end; 920 921 pls = l2tp_session_priv(session); 922 tunnel = l2tp_sock_to_tunnel(pls->tunnel_sock); 923 if (tunnel == NULL) 924 goto end_put_sess; 925 926 inet = inet_sk(tunnel->sock); 927 if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) { 928 struct sockaddr_pppol2tp sp; 929 len = sizeof(sp); 930 memset(&sp, 0, len); 931 sp.sa_family = AF_PPPOX; 932 sp.sa_protocol = PX_PROTO_OL2TP; 933 sp.pppol2tp.fd = tunnel->fd; 934 sp.pppol2tp.pid = pls->owner; 935 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 936 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 937 sp.pppol2tp.s_session = session->session_id; 938 sp.pppol2tp.d_session = session->peer_session_id; 939 sp.pppol2tp.addr.sin_family = AF_INET; 940 sp.pppol2tp.addr.sin_port = inet->inet_dport; 941 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 942 memcpy(uaddr, &sp, len); 943 #if IS_ENABLED(CONFIG_IPV6) 944 } else if ((tunnel->version == 2) && 945 (tunnel->sock->sk_family == AF_INET6)) { 946 struct sockaddr_pppol2tpin6 sp; 947 948 len = sizeof(sp); 949 memset(&sp, 0, len); 950 sp.sa_family = AF_PPPOX; 951 sp.sa_protocol = PX_PROTO_OL2TP; 952 sp.pppol2tp.fd = tunnel->fd; 953 sp.pppol2tp.pid = pls->owner; 954 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 955 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 956 sp.pppol2tp.s_session = session->session_id; 957 sp.pppol2tp.d_session = session->peer_session_id; 958 sp.pppol2tp.addr.sin6_family = AF_INET6; 959 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 960 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 961 sizeof(tunnel->sock->sk_v6_daddr)); 962 memcpy(uaddr, &sp, len); 963 } else if ((tunnel->version == 3) && 964 (tunnel->sock->sk_family == AF_INET6)) { 965 struct sockaddr_pppol2tpv3in6 sp; 966 967 len = sizeof(sp); 968 memset(&sp, 0, len); 969 sp.sa_family = AF_PPPOX; 970 sp.sa_protocol = PX_PROTO_OL2TP; 971 sp.pppol2tp.fd = tunnel->fd; 972 sp.pppol2tp.pid = pls->owner; 973 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 974 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 975 sp.pppol2tp.s_session = session->session_id; 976 sp.pppol2tp.d_session = session->peer_session_id; 977 sp.pppol2tp.addr.sin6_family = AF_INET6; 978 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 979 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 980 sizeof(tunnel->sock->sk_v6_daddr)); 981 memcpy(uaddr, &sp, len); 982 #endif 983 } else if (tunnel->version == 3) { 984 struct sockaddr_pppol2tpv3 sp; 985 len = sizeof(sp); 986 memset(&sp, 0, len); 987 sp.sa_family = AF_PPPOX; 988 sp.sa_protocol = PX_PROTO_OL2TP; 989 sp.pppol2tp.fd = tunnel->fd; 990 sp.pppol2tp.pid = pls->owner; 991 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 992 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 993 sp.pppol2tp.s_session = session->session_id; 994 sp.pppol2tp.d_session = session->peer_session_id; 995 sp.pppol2tp.addr.sin_family = AF_INET; 996 sp.pppol2tp.addr.sin_port = inet->inet_dport; 997 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 998 memcpy(uaddr, &sp, len); 999 } 1000 1001 *usockaddr_len = len; 1002 error = 0; 1003 1004 sock_put(pls->tunnel_sock); 1005 end_put_sess: 1006 sock_put(sk); 1007 end: 1008 return error; 1009 } 1010 1011 /**************************************************************************** 1012 * ioctl() handlers. 1013 * 1014 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1015 * sockets. However, in order to control kernel tunnel features, we allow 1016 * userspace to create a special "tunnel" PPPoX socket which is used for 1017 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow 1018 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl() 1019 * calls. 1020 ****************************************************************************/ 1021 1022 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest, 1023 struct l2tp_stats *stats) 1024 { 1025 dest->tx_packets = atomic_long_read(&stats->tx_packets); 1026 dest->tx_bytes = atomic_long_read(&stats->tx_bytes); 1027 dest->tx_errors = atomic_long_read(&stats->tx_errors); 1028 dest->rx_packets = atomic_long_read(&stats->rx_packets); 1029 dest->rx_bytes = atomic_long_read(&stats->rx_bytes); 1030 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards); 1031 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets); 1032 dest->rx_errors = atomic_long_read(&stats->rx_errors); 1033 } 1034 1035 /* Session ioctl helper. 1036 */ 1037 static int pppol2tp_session_ioctl(struct l2tp_session *session, 1038 unsigned int cmd, unsigned long arg) 1039 { 1040 struct ifreq ifr; 1041 int err = 0; 1042 struct sock *sk; 1043 int val = (int) arg; 1044 struct pppol2tp_session *ps = l2tp_session_priv(session); 1045 struct l2tp_tunnel *tunnel = session->tunnel; 1046 struct pppol2tp_ioc_stats stats; 1047 1048 l2tp_dbg(session, L2TP_MSG_CONTROL, 1049 "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n", 1050 session->name, cmd, arg); 1051 1052 sk = pppol2tp_session_get_sock(session); 1053 if (!sk) 1054 return -EBADR; 1055 1056 switch (cmd) { 1057 case SIOCGIFMTU: 1058 err = -ENXIO; 1059 if (!(sk->sk_state & PPPOX_CONNECTED)) 1060 break; 1061 1062 err = -EFAULT; 1063 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1064 break; 1065 ifr.ifr_mtu = session->mtu; 1066 if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq))) 1067 break; 1068 1069 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mtu=%d\n", 1070 session->name, session->mtu); 1071 err = 0; 1072 break; 1073 1074 case SIOCSIFMTU: 1075 err = -ENXIO; 1076 if (!(sk->sk_state & PPPOX_CONNECTED)) 1077 break; 1078 1079 err = -EFAULT; 1080 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1081 break; 1082 1083 session->mtu = ifr.ifr_mtu; 1084 1085 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mtu=%d\n", 1086 session->name, session->mtu); 1087 err = 0; 1088 break; 1089 1090 case PPPIOCGMRU: 1091 err = -ENXIO; 1092 if (!(sk->sk_state & PPPOX_CONNECTED)) 1093 break; 1094 1095 err = -EFAULT; 1096 if (put_user(session->mru, (int __user *) arg)) 1097 break; 1098 1099 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mru=%d\n", 1100 session->name, session->mru); 1101 err = 0; 1102 break; 1103 1104 case PPPIOCSMRU: 1105 err = -ENXIO; 1106 if (!(sk->sk_state & PPPOX_CONNECTED)) 1107 break; 1108 1109 err = -EFAULT; 1110 if (get_user(val, (int __user *) arg)) 1111 break; 1112 1113 session->mru = val; 1114 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mru=%d\n", 1115 session->name, session->mru); 1116 err = 0; 1117 break; 1118 1119 case PPPIOCGFLAGS: 1120 err = -EFAULT; 1121 if (put_user(ps->flags, (int __user *) arg)) 1122 break; 1123 1124 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get flags=%d\n", 1125 session->name, ps->flags); 1126 err = 0; 1127 break; 1128 1129 case PPPIOCSFLAGS: 1130 err = -EFAULT; 1131 if (get_user(val, (int __user *) arg)) 1132 break; 1133 ps->flags = val; 1134 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set flags=%d\n", 1135 session->name, ps->flags); 1136 err = 0; 1137 break; 1138 1139 case PPPIOCGL2TPSTATS: 1140 err = -ENXIO; 1141 if (!(sk->sk_state & PPPOX_CONNECTED)) 1142 break; 1143 1144 memset(&stats, 0, sizeof(stats)); 1145 stats.tunnel_id = tunnel->tunnel_id; 1146 stats.session_id = session->session_id; 1147 pppol2tp_copy_stats(&stats, &session->stats); 1148 if (copy_to_user((void __user *) arg, &stats, 1149 sizeof(stats))) 1150 break; 1151 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1152 session->name); 1153 err = 0; 1154 break; 1155 1156 default: 1157 err = -ENOSYS; 1158 break; 1159 } 1160 1161 sock_put(sk); 1162 1163 return err; 1164 } 1165 1166 /* Tunnel ioctl helper. 1167 * 1168 * Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data 1169 * specifies a session_id, the session ioctl handler is called. This allows an 1170 * application to retrieve session stats via a tunnel socket. 1171 */ 1172 static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel, 1173 unsigned int cmd, unsigned long arg) 1174 { 1175 int err = 0; 1176 struct sock *sk; 1177 struct pppol2tp_ioc_stats stats; 1178 1179 l2tp_dbg(tunnel, L2TP_MSG_CONTROL, 1180 "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n", 1181 tunnel->name, cmd, arg); 1182 1183 sk = tunnel->sock; 1184 sock_hold(sk); 1185 1186 switch (cmd) { 1187 case PPPIOCGL2TPSTATS: 1188 err = -ENXIO; 1189 if (!(sk->sk_state & PPPOX_CONNECTED)) 1190 break; 1191 1192 if (copy_from_user(&stats, (void __user *) arg, 1193 sizeof(stats))) { 1194 err = -EFAULT; 1195 break; 1196 } 1197 if (stats.session_id != 0) { 1198 /* resend to session ioctl handler */ 1199 struct l2tp_session *session = 1200 l2tp_session_get(sock_net(sk), tunnel, 1201 stats.session_id); 1202 1203 if (session) { 1204 err = pppol2tp_session_ioctl(session, cmd, 1205 arg); 1206 l2tp_session_dec_refcount(session); 1207 } else { 1208 err = -EBADR; 1209 } 1210 break; 1211 } 1212 #ifdef CONFIG_XFRM 1213 stats.using_ipsec = (sk->sk_policy[0] || sk->sk_policy[1]) ? 1 : 0; 1214 #endif 1215 pppol2tp_copy_stats(&stats, &tunnel->stats); 1216 if (copy_to_user((void __user *) arg, &stats, sizeof(stats))) { 1217 err = -EFAULT; 1218 break; 1219 } 1220 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1221 tunnel->name); 1222 err = 0; 1223 break; 1224 1225 default: 1226 err = -ENOSYS; 1227 break; 1228 } 1229 1230 sock_put(sk); 1231 1232 return err; 1233 } 1234 1235 /* Main ioctl() handler. 1236 * Dispatch to tunnel or session helpers depending on the socket. 1237 */ 1238 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, 1239 unsigned long arg) 1240 { 1241 struct sock *sk = sock->sk; 1242 struct l2tp_session *session; 1243 struct l2tp_tunnel *tunnel; 1244 struct pppol2tp_session *ps; 1245 int err; 1246 1247 if (!sk) 1248 return 0; 1249 1250 err = -EBADF; 1251 if (sock_flag(sk, SOCK_DEAD) != 0) 1252 goto end; 1253 1254 err = -ENOTCONN; 1255 if ((sk->sk_user_data == NULL) || 1256 (!(sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)))) 1257 goto end; 1258 1259 /* Get session context from the socket */ 1260 err = -EBADF; 1261 session = pppol2tp_sock_to_session(sk); 1262 if (session == NULL) 1263 goto end; 1264 1265 /* Special case: if session's session_id is zero, treat ioctl as a 1266 * tunnel ioctl 1267 */ 1268 ps = l2tp_session_priv(session); 1269 if ((session->session_id == 0) && 1270 (session->peer_session_id == 0)) { 1271 err = -EBADF; 1272 tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock); 1273 if (tunnel == NULL) 1274 goto end_put_sess; 1275 1276 err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg); 1277 sock_put(ps->tunnel_sock); 1278 goto end_put_sess; 1279 } 1280 1281 err = pppol2tp_session_ioctl(session, cmd, arg); 1282 1283 end_put_sess: 1284 sock_put(sk); 1285 end: 1286 return err; 1287 } 1288 1289 /***************************************************************************** 1290 * setsockopt() / getsockopt() support. 1291 * 1292 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1293 * sockets. In order to control kernel tunnel features, we allow userspace to 1294 * create a special "tunnel" PPPoX socket which is used for control only. 1295 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user 1296 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls. 1297 *****************************************************************************/ 1298 1299 /* Tunnel setsockopt() helper. 1300 */ 1301 static int pppol2tp_tunnel_setsockopt(struct sock *sk, 1302 struct l2tp_tunnel *tunnel, 1303 int optname, int val) 1304 { 1305 int err = 0; 1306 1307 switch (optname) { 1308 case PPPOL2TP_SO_DEBUG: 1309 tunnel->debug = val; 1310 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1311 tunnel->name, tunnel->debug); 1312 break; 1313 1314 default: 1315 err = -ENOPROTOOPT; 1316 break; 1317 } 1318 1319 return err; 1320 } 1321 1322 /* Session setsockopt helper. 1323 */ 1324 static int pppol2tp_session_setsockopt(struct sock *sk, 1325 struct l2tp_session *session, 1326 int optname, int val) 1327 { 1328 int err = 0; 1329 1330 switch (optname) { 1331 case PPPOL2TP_SO_RECVSEQ: 1332 if ((val != 0) && (val != 1)) { 1333 err = -EINVAL; 1334 break; 1335 } 1336 session->recv_seq = !!val; 1337 l2tp_info(session, L2TP_MSG_CONTROL, 1338 "%s: set recv_seq=%d\n", 1339 session->name, session->recv_seq); 1340 break; 1341 1342 case PPPOL2TP_SO_SENDSEQ: 1343 if ((val != 0) && (val != 1)) { 1344 err = -EINVAL; 1345 break; 1346 } 1347 session->send_seq = !!val; 1348 { 1349 struct pppox_sock *po = pppox_sk(sk); 1350 1351 po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ : 1352 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 1353 } 1354 l2tp_session_set_header_len(session, session->tunnel->version); 1355 l2tp_info(session, L2TP_MSG_CONTROL, 1356 "%s: set send_seq=%d\n", 1357 session->name, session->send_seq); 1358 break; 1359 1360 case PPPOL2TP_SO_LNSMODE: 1361 if ((val != 0) && (val != 1)) { 1362 err = -EINVAL; 1363 break; 1364 } 1365 session->lns_mode = !!val; 1366 l2tp_info(session, L2TP_MSG_CONTROL, 1367 "%s: set lns_mode=%d\n", 1368 session->name, session->lns_mode); 1369 break; 1370 1371 case PPPOL2TP_SO_DEBUG: 1372 session->debug = val; 1373 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1374 session->name, session->debug); 1375 break; 1376 1377 case PPPOL2TP_SO_REORDERTO: 1378 session->reorder_timeout = msecs_to_jiffies(val); 1379 l2tp_info(session, L2TP_MSG_CONTROL, 1380 "%s: set reorder_timeout=%d\n", 1381 session->name, session->reorder_timeout); 1382 break; 1383 1384 default: 1385 err = -ENOPROTOOPT; 1386 break; 1387 } 1388 1389 return err; 1390 } 1391 1392 /* Main setsockopt() entry point. 1393 * Does API checks, then calls either the tunnel or session setsockopt 1394 * handler, according to whether the PPPoL2TP socket is a for a regular 1395 * session or the special tunnel type. 1396 */ 1397 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, 1398 char __user *optval, unsigned int optlen) 1399 { 1400 struct sock *sk = sock->sk; 1401 struct l2tp_session *session; 1402 struct l2tp_tunnel *tunnel; 1403 struct pppol2tp_session *ps; 1404 int val; 1405 int err; 1406 1407 if (level != SOL_PPPOL2TP) 1408 return -EINVAL; 1409 1410 if (optlen < sizeof(int)) 1411 return -EINVAL; 1412 1413 if (get_user(val, (int __user *)optval)) 1414 return -EFAULT; 1415 1416 err = -ENOTCONN; 1417 if (sk->sk_user_data == NULL) 1418 goto end; 1419 1420 /* Get session context from the socket */ 1421 err = -EBADF; 1422 session = pppol2tp_sock_to_session(sk); 1423 if (session == NULL) 1424 goto end; 1425 1426 /* Special case: if session_id == 0x0000, treat as operation on tunnel 1427 */ 1428 ps = l2tp_session_priv(session); 1429 if ((session->session_id == 0) && 1430 (session->peer_session_id == 0)) { 1431 err = -EBADF; 1432 tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock); 1433 if (tunnel == NULL) 1434 goto end_put_sess; 1435 1436 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val); 1437 sock_put(ps->tunnel_sock); 1438 } else 1439 err = pppol2tp_session_setsockopt(sk, session, optname, val); 1440 1441 end_put_sess: 1442 sock_put(sk); 1443 end: 1444 return err; 1445 } 1446 1447 /* Tunnel getsockopt helper. Called with sock locked. 1448 */ 1449 static int pppol2tp_tunnel_getsockopt(struct sock *sk, 1450 struct l2tp_tunnel *tunnel, 1451 int optname, int *val) 1452 { 1453 int err = 0; 1454 1455 switch (optname) { 1456 case PPPOL2TP_SO_DEBUG: 1457 *val = tunnel->debug; 1458 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get debug=%x\n", 1459 tunnel->name, tunnel->debug); 1460 break; 1461 1462 default: 1463 err = -ENOPROTOOPT; 1464 break; 1465 } 1466 1467 return err; 1468 } 1469 1470 /* Session getsockopt helper. Called with sock locked. 1471 */ 1472 static int pppol2tp_session_getsockopt(struct sock *sk, 1473 struct l2tp_session *session, 1474 int optname, int *val) 1475 { 1476 int err = 0; 1477 1478 switch (optname) { 1479 case PPPOL2TP_SO_RECVSEQ: 1480 *val = session->recv_seq; 1481 l2tp_info(session, L2TP_MSG_CONTROL, 1482 "%s: get recv_seq=%d\n", session->name, *val); 1483 break; 1484 1485 case PPPOL2TP_SO_SENDSEQ: 1486 *val = session->send_seq; 1487 l2tp_info(session, L2TP_MSG_CONTROL, 1488 "%s: get send_seq=%d\n", session->name, *val); 1489 break; 1490 1491 case PPPOL2TP_SO_LNSMODE: 1492 *val = session->lns_mode; 1493 l2tp_info(session, L2TP_MSG_CONTROL, 1494 "%s: get lns_mode=%d\n", session->name, *val); 1495 break; 1496 1497 case PPPOL2TP_SO_DEBUG: 1498 *val = session->debug; 1499 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get debug=%d\n", 1500 session->name, *val); 1501 break; 1502 1503 case PPPOL2TP_SO_REORDERTO: 1504 *val = (int) jiffies_to_msecs(session->reorder_timeout); 1505 l2tp_info(session, L2TP_MSG_CONTROL, 1506 "%s: get reorder_timeout=%d\n", session->name, *val); 1507 break; 1508 1509 default: 1510 err = -ENOPROTOOPT; 1511 } 1512 1513 return err; 1514 } 1515 1516 /* Main getsockopt() entry point. 1517 * Does API checks, then calls either the tunnel or session getsockopt 1518 * handler, according to whether the PPPoX socket is a for a regular session 1519 * or the special tunnel type. 1520 */ 1521 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, 1522 char __user *optval, int __user *optlen) 1523 { 1524 struct sock *sk = sock->sk; 1525 struct l2tp_session *session; 1526 struct l2tp_tunnel *tunnel; 1527 int val, len; 1528 int err; 1529 struct pppol2tp_session *ps; 1530 1531 if (level != SOL_PPPOL2TP) 1532 return -EINVAL; 1533 1534 if (get_user(len, optlen)) 1535 return -EFAULT; 1536 1537 len = min_t(unsigned int, len, sizeof(int)); 1538 1539 if (len < 0) 1540 return -EINVAL; 1541 1542 err = -ENOTCONN; 1543 if (sk->sk_user_data == NULL) 1544 goto end; 1545 1546 /* Get the session context */ 1547 err = -EBADF; 1548 session = pppol2tp_sock_to_session(sk); 1549 if (session == NULL) 1550 goto end; 1551 1552 /* Special case: if session_id == 0x0000, treat as operation on tunnel */ 1553 ps = l2tp_session_priv(session); 1554 if ((session->session_id == 0) && 1555 (session->peer_session_id == 0)) { 1556 err = -EBADF; 1557 tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock); 1558 if (tunnel == NULL) 1559 goto end_put_sess; 1560 1561 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val); 1562 sock_put(ps->tunnel_sock); 1563 if (err) 1564 goto end_put_sess; 1565 } else { 1566 err = pppol2tp_session_getsockopt(sk, session, optname, &val); 1567 if (err) 1568 goto end_put_sess; 1569 } 1570 1571 err = -EFAULT; 1572 if (put_user(len, optlen)) 1573 goto end_put_sess; 1574 1575 if (copy_to_user((void __user *) optval, &val, len)) 1576 goto end_put_sess; 1577 1578 err = 0; 1579 1580 end_put_sess: 1581 sock_put(sk); 1582 end: 1583 return err; 1584 } 1585 1586 /***************************************************************************** 1587 * /proc filesystem for debug 1588 * Since the original pppol2tp driver provided /proc/net/pppol2tp for 1589 * L2TPv2, we dump only L2TPv2 tunnels and sessions here. 1590 *****************************************************************************/ 1591 1592 static unsigned int pppol2tp_net_id; 1593 1594 #ifdef CONFIG_PROC_FS 1595 1596 struct pppol2tp_seq_data { 1597 struct seq_net_private p; 1598 int tunnel_idx; /* current tunnel */ 1599 int session_idx; /* index of session within current tunnel */ 1600 struct l2tp_tunnel *tunnel; 1601 struct l2tp_session *session; /* NULL means get next tunnel */ 1602 }; 1603 1604 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) 1605 { 1606 for (;;) { 1607 pd->tunnel = l2tp_tunnel_find_nth(net, pd->tunnel_idx); 1608 pd->tunnel_idx++; 1609 1610 if (pd->tunnel == NULL) 1611 break; 1612 1613 /* Ignore L2TPv3 tunnels */ 1614 if (pd->tunnel->version < 3) 1615 break; 1616 } 1617 } 1618 1619 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) 1620 { 1621 pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx); 1622 pd->session_idx++; 1623 1624 if (pd->session == NULL) { 1625 pd->session_idx = 0; 1626 pppol2tp_next_tunnel(net, pd); 1627 } 1628 } 1629 1630 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs) 1631 { 1632 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN; 1633 loff_t pos = *offs; 1634 struct net *net; 1635 1636 if (!pos) 1637 goto out; 1638 1639 BUG_ON(m->private == NULL); 1640 pd = m->private; 1641 net = seq_file_net(m); 1642 1643 if (pd->tunnel == NULL) 1644 pppol2tp_next_tunnel(net, pd); 1645 else 1646 pppol2tp_next_session(net, pd); 1647 1648 /* NULL tunnel and session indicates end of list */ 1649 if ((pd->tunnel == NULL) && (pd->session == NULL)) 1650 pd = NULL; 1651 1652 out: 1653 return pd; 1654 } 1655 1656 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos) 1657 { 1658 (*pos)++; 1659 return NULL; 1660 } 1661 1662 static void pppol2tp_seq_stop(struct seq_file *p, void *v) 1663 { 1664 /* nothing to do */ 1665 } 1666 1667 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) 1668 { 1669 struct l2tp_tunnel *tunnel = v; 1670 1671 seq_printf(m, "\nTUNNEL '%s', %c %d\n", 1672 tunnel->name, 1673 (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N', 1674 refcount_read(&tunnel->ref_count) - 1); 1675 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n", 1676 tunnel->debug, 1677 atomic_long_read(&tunnel->stats.tx_packets), 1678 atomic_long_read(&tunnel->stats.tx_bytes), 1679 atomic_long_read(&tunnel->stats.tx_errors), 1680 atomic_long_read(&tunnel->stats.rx_packets), 1681 atomic_long_read(&tunnel->stats.rx_bytes), 1682 atomic_long_read(&tunnel->stats.rx_errors)); 1683 } 1684 1685 static void pppol2tp_seq_session_show(struct seq_file *m, void *v) 1686 { 1687 struct l2tp_session *session = v; 1688 struct l2tp_tunnel *tunnel = session->tunnel; 1689 unsigned char state; 1690 char user_data_ok; 1691 struct sock *sk; 1692 u32 ip = 0; 1693 u16 port = 0; 1694 1695 if (tunnel->sock) { 1696 struct inet_sock *inet = inet_sk(tunnel->sock); 1697 ip = ntohl(inet->inet_saddr); 1698 port = ntohs(inet->inet_sport); 1699 } 1700 1701 sk = pppol2tp_session_get_sock(session); 1702 if (sk) { 1703 state = sk->sk_state; 1704 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N'; 1705 } else { 1706 state = 0; 1707 user_data_ok = 'N'; 1708 } 1709 1710 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> " 1711 "%04X/%04X %d %c\n", 1712 session->name, ip, port, 1713 tunnel->tunnel_id, 1714 session->session_id, 1715 tunnel->peer_tunnel_id, 1716 session->peer_session_id, 1717 state, user_data_ok); 1718 seq_printf(m, " %d/%d/%c/%c/%s %08x %u\n", 1719 session->mtu, session->mru, 1720 session->recv_seq ? 'R' : '-', 1721 session->send_seq ? 'S' : '-', 1722 session->lns_mode ? "LNS" : "LAC", 1723 session->debug, 1724 jiffies_to_msecs(session->reorder_timeout)); 1725 seq_printf(m, " %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n", 1726 session->nr, session->ns, 1727 atomic_long_read(&session->stats.tx_packets), 1728 atomic_long_read(&session->stats.tx_bytes), 1729 atomic_long_read(&session->stats.tx_errors), 1730 atomic_long_read(&session->stats.rx_packets), 1731 atomic_long_read(&session->stats.rx_bytes), 1732 atomic_long_read(&session->stats.rx_errors)); 1733 1734 if (sk) { 1735 struct pppox_sock *po = pppox_sk(sk); 1736 1737 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 1738 sock_put(sk); 1739 } 1740 } 1741 1742 static int pppol2tp_seq_show(struct seq_file *m, void *v) 1743 { 1744 struct pppol2tp_seq_data *pd = v; 1745 1746 /* display header on line 1 */ 1747 if (v == SEQ_START_TOKEN) { 1748 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n"); 1749 seq_puts(m, "TUNNEL name, user-data-ok session-count\n"); 1750 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1751 seq_puts(m, " SESSION name, addr/port src-tid/sid " 1752 "dest-tid/sid state user-data-ok\n"); 1753 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n"); 1754 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1755 goto out; 1756 } 1757 1758 /* Show the tunnel or session context. 1759 */ 1760 if (!pd->session) { 1761 pppol2tp_seq_tunnel_show(m, pd->tunnel); 1762 } else { 1763 pppol2tp_seq_session_show(m, pd->session); 1764 l2tp_session_dec_refcount(pd->session); 1765 } 1766 1767 out: 1768 return 0; 1769 } 1770 1771 static const struct seq_operations pppol2tp_seq_ops = { 1772 .start = pppol2tp_seq_start, 1773 .next = pppol2tp_seq_next, 1774 .stop = pppol2tp_seq_stop, 1775 .show = pppol2tp_seq_show, 1776 }; 1777 1778 /* Called when our /proc file is opened. We allocate data for use when 1779 * iterating our tunnel / session contexts and store it in the private 1780 * data of the seq_file. 1781 */ 1782 static int pppol2tp_proc_open(struct inode *inode, struct file *file) 1783 { 1784 return seq_open_net(inode, file, &pppol2tp_seq_ops, 1785 sizeof(struct pppol2tp_seq_data)); 1786 } 1787 1788 static const struct file_operations pppol2tp_proc_fops = { 1789 .owner = THIS_MODULE, 1790 .open = pppol2tp_proc_open, 1791 .read = seq_read, 1792 .llseek = seq_lseek, 1793 .release = seq_release_net, 1794 }; 1795 1796 #endif /* CONFIG_PROC_FS */ 1797 1798 /***************************************************************************** 1799 * Network namespace 1800 *****************************************************************************/ 1801 1802 static __net_init int pppol2tp_init_net(struct net *net) 1803 { 1804 struct proc_dir_entry *pde; 1805 int err = 0; 1806 1807 pde = proc_create("pppol2tp", S_IRUGO, net->proc_net, 1808 &pppol2tp_proc_fops); 1809 if (!pde) { 1810 err = -ENOMEM; 1811 goto out; 1812 } 1813 1814 out: 1815 return err; 1816 } 1817 1818 static __net_exit void pppol2tp_exit_net(struct net *net) 1819 { 1820 remove_proc_entry("pppol2tp", net->proc_net); 1821 } 1822 1823 static struct pernet_operations pppol2tp_net_ops = { 1824 .init = pppol2tp_init_net, 1825 .exit = pppol2tp_exit_net, 1826 .id = &pppol2tp_net_id, 1827 }; 1828 1829 /***************************************************************************** 1830 * Init and cleanup 1831 *****************************************************************************/ 1832 1833 static const struct proto_ops pppol2tp_ops = { 1834 .family = AF_PPPOX, 1835 .owner = THIS_MODULE, 1836 .release = pppol2tp_release, 1837 .bind = sock_no_bind, 1838 .connect = pppol2tp_connect, 1839 .socketpair = sock_no_socketpair, 1840 .accept = sock_no_accept, 1841 .getname = pppol2tp_getname, 1842 .poll = datagram_poll, 1843 .listen = sock_no_listen, 1844 .shutdown = sock_no_shutdown, 1845 .setsockopt = pppol2tp_setsockopt, 1846 .getsockopt = pppol2tp_getsockopt, 1847 .sendmsg = pppol2tp_sendmsg, 1848 .recvmsg = pppol2tp_recvmsg, 1849 .mmap = sock_no_mmap, 1850 .ioctl = pppox_ioctl, 1851 }; 1852 1853 static const struct pppox_proto pppol2tp_proto = { 1854 .create = pppol2tp_create, 1855 .ioctl = pppol2tp_ioctl, 1856 .owner = THIS_MODULE, 1857 }; 1858 1859 #ifdef CONFIG_L2TP_V3 1860 1861 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = { 1862 .session_create = pppol2tp_session_create, 1863 .session_delete = l2tp_session_delete, 1864 }; 1865 1866 #endif /* CONFIG_L2TP_V3 */ 1867 1868 static int __init pppol2tp_init(void) 1869 { 1870 int err; 1871 1872 err = register_pernet_device(&pppol2tp_net_ops); 1873 if (err) 1874 goto out; 1875 1876 err = proto_register(&pppol2tp_sk_proto, 0); 1877 if (err) 1878 goto out_unregister_pppol2tp_pernet; 1879 1880 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto); 1881 if (err) 1882 goto out_unregister_pppol2tp_proto; 1883 1884 #ifdef CONFIG_L2TP_V3 1885 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops); 1886 if (err) 1887 goto out_unregister_pppox; 1888 #endif 1889 1890 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION); 1891 1892 out: 1893 return err; 1894 1895 #ifdef CONFIG_L2TP_V3 1896 out_unregister_pppox: 1897 unregister_pppox_proto(PX_PROTO_OL2TP); 1898 #endif 1899 out_unregister_pppol2tp_proto: 1900 proto_unregister(&pppol2tp_sk_proto); 1901 out_unregister_pppol2tp_pernet: 1902 unregister_pernet_device(&pppol2tp_net_ops); 1903 goto out; 1904 } 1905 1906 static void __exit pppol2tp_exit(void) 1907 { 1908 #ifdef CONFIG_L2TP_V3 1909 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP); 1910 #endif 1911 unregister_pppox_proto(PX_PROTO_OL2TP); 1912 proto_unregister(&pppol2tp_sk_proto); 1913 unregister_pernet_device(&pppol2tp_net_ops); 1914 } 1915 1916 module_init(pppol2tp_init); 1917 module_exit(pppol2tp_exit); 1918 1919 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1920 MODULE_DESCRIPTION("PPP over L2TP over UDP"); 1921 MODULE_LICENSE("GPL"); 1922 MODULE_VERSION(PPPOL2TP_DRV_VERSION); 1923 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP); 1924 MODULE_ALIAS_L2TP_PWTYPE(7); 1925