xref: /linux/net/l2tp/l2tp_ppp.c (revision c411ed854584a71b0e86ac3019b60e4789d88086)
1 /*****************************************************************************
2  * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets
3  *
4  * PPPoX    --- Generic PPP encapsulation socket family
5  * PPPoL2TP --- PPP over L2TP (RFC 2661)
6  *
7  * Version:	2.0.0
8  *
9  * Authors:	James Chapman (jchapman@katalix.com)
10  *
11  * Based on original work by Martijn van Oosterhout <kleptog@svana.org>
12  *
13  * License:
14  *		This program is free software; you can redistribute it and/or
15  *		modify it under the terms of the GNU General Public License
16  *		as published by the Free Software Foundation; either version
17  *		2 of the License, or (at your option) any later version.
18  *
19  */
20 
21 /* This driver handles only L2TP data frames; control frames are handled by a
22  * userspace application.
23  *
24  * To send data in an L2TP session, userspace opens a PPPoL2TP socket and
25  * attaches it to a bound UDP socket with local tunnel_id / session_id and
26  * peer tunnel_id / session_id set. Data can then be sent or received using
27  * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket
28  * can be read or modified using ioctl() or [gs]etsockopt() calls.
29  *
30  * When a PPPoL2TP socket is connected with local and peer session_id values
31  * zero, the socket is treated as a special tunnel management socket.
32  *
33  * Here's example userspace code to create a socket for sending/receiving data
34  * over an L2TP session:-
35  *
36  *	struct sockaddr_pppol2tp sax;
37  *	int fd;
38  *	int session_fd;
39  *
40  *	fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
41  *
42  *	sax.sa_family = AF_PPPOX;
43  *	sax.sa_protocol = PX_PROTO_OL2TP;
44  *	sax.pppol2tp.fd = tunnel_fd;	// bound UDP socket
45  *	sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr;
46  *	sax.pppol2tp.addr.sin_port = addr->sin_port;
47  *	sax.pppol2tp.addr.sin_family = AF_INET;
48  *	sax.pppol2tp.s_tunnel  = tunnel_id;
49  *	sax.pppol2tp.s_session = session_id;
50  *	sax.pppol2tp.d_tunnel  = peer_tunnel_id;
51  *	sax.pppol2tp.d_session = peer_session_id;
52  *
53  *	session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax));
54  *
55  * A pppd plugin that allows PPP traffic to be carried over L2TP using
56  * this driver is available from the OpenL2TP project at
57  * http://openl2tp.sourceforge.net.
58  */
59 
60 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
61 
62 #include <linux/module.h>
63 #include <linux/string.h>
64 #include <linux/list.h>
65 #include <linux/uaccess.h>
66 
67 #include <linux/kernel.h>
68 #include <linux/spinlock.h>
69 #include <linux/kthread.h>
70 #include <linux/sched.h>
71 #include <linux/slab.h>
72 #include <linux/errno.h>
73 #include <linux/jiffies.h>
74 
75 #include <linux/netdevice.h>
76 #include <linux/net.h>
77 #include <linux/inetdevice.h>
78 #include <linux/skbuff.h>
79 #include <linux/init.h>
80 #include <linux/ip.h>
81 #include <linux/udp.h>
82 #include <linux/if_pppox.h>
83 #include <linux/if_pppol2tp.h>
84 #include <net/sock.h>
85 #include <linux/ppp_channel.h>
86 #include <linux/ppp_defs.h>
87 #include <linux/ppp-ioctl.h>
88 #include <linux/file.h>
89 #include <linux/hash.h>
90 #include <linux/sort.h>
91 #include <linux/proc_fs.h>
92 #include <linux/l2tp.h>
93 #include <linux/nsproxy.h>
94 #include <net/net_namespace.h>
95 #include <net/netns/generic.h>
96 #include <net/dst.h>
97 #include <net/ip.h>
98 #include <net/udp.h>
99 #include <net/xfrm.h>
100 #include <net/inet_common.h>
101 
102 #include <asm/byteorder.h>
103 #include <linux/atomic.h>
104 
105 #include "l2tp_core.h"
106 
107 #define PPPOL2TP_DRV_VERSION	"V2.0"
108 
109 /* Space for UDP, L2TP and PPP headers */
110 #define PPPOL2TP_HEADER_OVERHEAD	40
111 
112 /* Number of bytes to build transmit L2TP headers.
113  * Unfortunately the size is different depending on whether sequence numbers
114  * are enabled.
115  */
116 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ		10
117 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ		6
118 
119 /* Private data of each session. This data lives at the end of struct
120  * l2tp_session, referenced via session->priv[].
121  */
122 struct pppol2tp_session {
123 	int			owner;		/* pid that opened the socket */
124 
125 	struct sock		*sock;		/* Pointer to the session
126 						 * PPPoX socket */
127 	struct sock		*tunnel_sock;	/* Pointer to the tunnel UDP
128 						 * socket */
129 	int			flags;		/* accessed by PPPIOCGFLAGS.
130 						 * Unused. */
131 };
132 
133 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);
134 
135 static const struct ppp_channel_ops pppol2tp_chan_ops = {
136 	.start_xmit =  pppol2tp_xmit,
137 };
138 
139 static const struct proto_ops pppol2tp_ops;
140 
141 /* Helpers to obtain tunnel/session contexts from sockets.
142  */
143 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk)
144 {
145 	struct l2tp_session *session;
146 
147 	if (sk == NULL)
148 		return NULL;
149 
150 	sock_hold(sk);
151 	session = (struct l2tp_session *)(sk->sk_user_data);
152 	if (session == NULL) {
153 		sock_put(sk);
154 		goto out;
155 	}
156 
157 	BUG_ON(session->magic != L2TP_SESSION_MAGIC);
158 
159 out:
160 	return session;
161 }
162 
163 /*****************************************************************************
164  * Receive data handling
165  *****************************************************************************/
166 
167 static int pppol2tp_recv_payload_hook(struct sk_buff *skb)
168 {
169 	/* Skip PPP header, if present.	 In testing, Microsoft L2TP clients
170 	 * don't send the PPP header (PPP header compression enabled), but
171 	 * other clients can include the header. So we cope with both cases
172 	 * here. The PPP header is always FF03 when using L2TP.
173 	 *
174 	 * Note that skb->data[] isn't dereferenced from a u16 ptr here since
175 	 * the field may be unaligned.
176 	 */
177 	if (!pskb_may_pull(skb, 2))
178 		return 1;
179 
180 	if ((skb->data[0] == PPP_ALLSTATIONS) && (skb->data[1] == PPP_UI))
181 		skb_pull(skb, 2);
182 
183 	return 0;
184 }
185 
186 /* Receive message. This is the recvmsg for the PPPoL2TP socket.
187  */
188 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg,
189 			    size_t len, int flags)
190 {
191 	int err;
192 	struct sk_buff *skb;
193 	struct sock *sk = sock->sk;
194 
195 	err = -EIO;
196 	if (sk->sk_state & PPPOX_BOUND)
197 		goto end;
198 
199 	err = 0;
200 	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
201 				flags & MSG_DONTWAIT, &err);
202 	if (!skb)
203 		goto end;
204 
205 	if (len > skb->len)
206 		len = skb->len;
207 	else if (len < skb->len)
208 		msg->msg_flags |= MSG_TRUNC;
209 
210 	err = skb_copy_datagram_msg(skb, 0, msg, len);
211 	if (likely(err == 0))
212 		err = len;
213 
214 	kfree_skb(skb);
215 end:
216 	return err;
217 }
218 
219 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len)
220 {
221 	struct pppol2tp_session *ps = l2tp_session_priv(session);
222 	struct sock *sk = NULL;
223 
224 	/* If the socket is bound, send it in to PPP's input queue. Otherwise
225 	 * queue it on the session socket.
226 	 */
227 	sk = ps->sock;
228 	if (sk == NULL)
229 		goto no_sock;
230 
231 	if (sk->sk_state & PPPOX_BOUND) {
232 		struct pppox_sock *po;
233 
234 		l2tp_dbg(session, L2TP_MSG_DATA,
235 			 "%s: recv %d byte data frame, passing to ppp\n",
236 			 session->name, data_len);
237 
238 		po = pppox_sk(sk);
239 		ppp_input(&po->chan, skb);
240 	} else {
241 		l2tp_dbg(session, L2TP_MSG_DATA,
242 			 "%s: recv %d byte data frame, passing to L2TP socket\n",
243 			 session->name, data_len);
244 
245 		if (sock_queue_rcv_skb(sk, skb) < 0) {
246 			atomic_long_inc(&session->stats.rx_errors);
247 			kfree_skb(skb);
248 		}
249 	}
250 
251 	return;
252 
253 no_sock:
254 	l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name);
255 	kfree_skb(skb);
256 }
257 
258 static void pppol2tp_session_sock_hold(struct l2tp_session *session)
259 {
260 	struct pppol2tp_session *ps = l2tp_session_priv(session);
261 
262 	if (ps->sock)
263 		sock_hold(ps->sock);
264 }
265 
266 static void pppol2tp_session_sock_put(struct l2tp_session *session)
267 {
268 	struct pppol2tp_session *ps = l2tp_session_priv(session);
269 
270 	if (ps->sock)
271 		sock_put(ps->sock);
272 }
273 
274 /************************************************************************
275  * Transmit handling
276  ***********************************************************************/
277 
278 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket.  We come here
279  * when a user application does a sendmsg() on the session socket. L2TP and
280  * PPP headers must be inserted into the user's data.
281  */
282 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
283 			    size_t total_len)
284 {
285 	struct sock *sk = sock->sk;
286 	struct sk_buff *skb;
287 	int error;
288 	struct l2tp_session *session;
289 	struct l2tp_tunnel *tunnel;
290 	struct pppol2tp_session *ps;
291 	int uhlen;
292 
293 	error = -ENOTCONN;
294 	if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
295 		goto error;
296 
297 	/* Get session and tunnel contexts */
298 	error = -EBADF;
299 	session = pppol2tp_sock_to_session(sk);
300 	if (session == NULL)
301 		goto error;
302 
303 	ps = l2tp_session_priv(session);
304 	tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
305 	if (tunnel == NULL)
306 		goto error_put_sess;
307 
308 	uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
309 
310 	/* Allocate a socket buffer */
311 	error = -ENOMEM;
312 	skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) +
313 			   uhlen + session->hdr_len +
314 			   2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
315 			   0, GFP_KERNEL);
316 	if (!skb)
317 		goto error_put_sess_tun;
318 
319 	/* Reserve space for headers. */
320 	skb_reserve(skb, NET_SKB_PAD);
321 	skb_reset_network_header(skb);
322 	skb_reserve(skb, sizeof(struct iphdr));
323 	skb_reset_transport_header(skb);
324 	skb_reserve(skb, uhlen);
325 
326 	/* Add PPP header */
327 	skb->data[0] = PPP_ALLSTATIONS;
328 	skb->data[1] = PPP_UI;
329 	skb_put(skb, 2);
330 
331 	/* Copy user data into skb */
332 	error = memcpy_from_msg(skb_put(skb, total_len), m, total_len);
333 	if (error < 0) {
334 		kfree_skb(skb);
335 		goto error_put_sess_tun;
336 	}
337 
338 	local_bh_disable();
339 	l2tp_xmit_skb(session, skb, session->hdr_len);
340 	local_bh_enable();
341 
342 	sock_put(ps->tunnel_sock);
343 	sock_put(sk);
344 
345 	return total_len;
346 
347 error_put_sess_tun:
348 	sock_put(ps->tunnel_sock);
349 error_put_sess:
350 	sock_put(sk);
351 error:
352 	return error;
353 }
354 
355 /* Transmit function called by generic PPP driver.  Sends PPP frame
356  * over PPPoL2TP socket.
357  *
358  * This is almost the same as pppol2tp_sendmsg(), but rather than
359  * being called with a msghdr from userspace, it is called with a skb
360  * from the kernel.
361  *
362  * The supplied skb from ppp doesn't have enough headroom for the
363  * insertion of L2TP, UDP and IP headers so we need to allocate more
364  * headroom in the skb. This will create a cloned skb. But we must be
365  * careful in the error case because the caller will expect to free
366  * the skb it supplied, not our cloned skb. So we take care to always
367  * leave the original skb unfreed if we return an error.
368  */
369 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
370 {
371 	struct sock *sk = (struct sock *) chan->private;
372 	struct sock *sk_tun;
373 	struct l2tp_session *session;
374 	struct l2tp_tunnel *tunnel;
375 	struct pppol2tp_session *ps;
376 	int uhlen, headroom;
377 
378 	if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
379 		goto abort;
380 
381 	/* Get session and tunnel contexts from the socket */
382 	session = pppol2tp_sock_to_session(sk);
383 	if (session == NULL)
384 		goto abort;
385 
386 	ps = l2tp_session_priv(session);
387 	sk_tun = ps->tunnel_sock;
388 	if (sk_tun == NULL)
389 		goto abort_put_sess;
390 	tunnel = l2tp_sock_to_tunnel(sk_tun);
391 	if (tunnel == NULL)
392 		goto abort_put_sess;
393 
394 	uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
395 	headroom = NET_SKB_PAD +
396 		   sizeof(struct iphdr) + /* IP header */
397 		   uhlen +		/* UDP header (if L2TP_ENCAPTYPE_UDP) */
398 		   session->hdr_len +	/* L2TP header */
399 		   2;			/* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
400 	if (skb_cow_head(skb, headroom))
401 		goto abort_put_sess_tun;
402 
403 	/* Setup PPP header */
404 	__skb_push(skb, 2);
405 	skb->data[0] = PPP_ALLSTATIONS;
406 	skb->data[1] = PPP_UI;
407 
408 	local_bh_disable();
409 	l2tp_xmit_skb(session, skb, session->hdr_len);
410 	local_bh_enable();
411 
412 	sock_put(sk_tun);
413 	sock_put(sk);
414 	return 1;
415 
416 abort_put_sess_tun:
417 	sock_put(sk_tun);
418 abort_put_sess:
419 	sock_put(sk);
420 abort:
421 	/* Free the original skb */
422 	kfree_skb(skb);
423 	return 1;
424 }
425 
426 /*****************************************************************************
427  * Session (and tunnel control) socket create/destroy.
428  *****************************************************************************/
429 
430 /* Called by l2tp_core when a session socket is being closed.
431  */
432 static void pppol2tp_session_close(struct l2tp_session *session)
433 {
434 	struct pppol2tp_session *ps = l2tp_session_priv(session);
435 	struct sock *sk = ps->sock;
436 	struct socket *sock = sk->sk_socket;
437 
438 	BUG_ON(session->magic != L2TP_SESSION_MAGIC);
439 
440 	if (sock) {
441 		inet_shutdown(sock, SEND_SHUTDOWN);
442 		/* Don't let the session go away before our socket does */
443 		l2tp_session_inc_refcount(session);
444 	}
445 }
446 
447 /* Really kill the session socket. (Called from sock_put() if
448  * refcnt == 0.)
449  */
450 static void pppol2tp_session_destruct(struct sock *sk)
451 {
452 	struct l2tp_session *session = sk->sk_user_data;
453 
454 	skb_queue_purge(&sk->sk_receive_queue);
455 	skb_queue_purge(&sk->sk_write_queue);
456 
457 	if (session) {
458 		sk->sk_user_data = NULL;
459 		BUG_ON(session->magic != L2TP_SESSION_MAGIC);
460 		l2tp_session_dec_refcount(session);
461 	}
462 }
463 
464 /* Called when the PPPoX socket (session) is closed.
465  */
466 static int pppol2tp_release(struct socket *sock)
467 {
468 	struct sock *sk = sock->sk;
469 	struct l2tp_session *session;
470 	int error;
471 
472 	if (!sk)
473 		return 0;
474 
475 	error = -EBADF;
476 	lock_sock(sk);
477 	if (sock_flag(sk, SOCK_DEAD) != 0)
478 		goto error;
479 
480 	pppox_unbind_sock(sk);
481 
482 	/* Signal the death of the socket. */
483 	sk->sk_state = PPPOX_DEAD;
484 	sock_orphan(sk);
485 	sock->sk = NULL;
486 
487 	session = pppol2tp_sock_to_session(sk);
488 
489 	/* Purge any queued data */
490 	if (session != NULL) {
491 		__l2tp_session_unhash(session);
492 		l2tp_session_queue_purge(session);
493 		sock_put(sk);
494 	}
495 	release_sock(sk);
496 
497 	/* This will delete the session context via
498 	 * pppol2tp_session_destruct() if the socket's refcnt drops to
499 	 * zero.
500 	 */
501 	sock_put(sk);
502 
503 	return 0;
504 
505 error:
506 	release_sock(sk);
507 	return error;
508 }
509 
510 static struct proto pppol2tp_sk_proto = {
511 	.name	  = "PPPOL2TP",
512 	.owner	  = THIS_MODULE,
513 	.obj_size = sizeof(struct pppox_sock),
514 };
515 
516 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb)
517 {
518 	int rc;
519 
520 	rc = l2tp_udp_encap_recv(sk, skb);
521 	if (rc)
522 		kfree_skb(skb);
523 
524 	return NET_RX_SUCCESS;
525 }
526 
527 /* socket() handler. Initialize a new struct sock.
528  */
529 static int pppol2tp_create(struct net *net, struct socket *sock, int kern)
530 {
531 	int error = -ENOMEM;
532 	struct sock *sk;
533 
534 	sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern);
535 	if (!sk)
536 		goto out;
537 
538 	sock_init_data(sock, sk);
539 
540 	sock->state  = SS_UNCONNECTED;
541 	sock->ops    = &pppol2tp_ops;
542 
543 	sk->sk_backlog_rcv = pppol2tp_backlog_recv;
544 	sk->sk_protocol	   = PX_PROTO_OL2TP;
545 	sk->sk_family	   = PF_PPPOX;
546 	sk->sk_state	   = PPPOX_NONE;
547 	sk->sk_type	   = SOCK_STREAM;
548 	sk->sk_destruct	   = pppol2tp_session_destruct;
549 
550 	error = 0;
551 
552 out:
553 	return error;
554 }
555 
556 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS)
557 static void pppol2tp_show(struct seq_file *m, void *arg)
558 {
559 	struct l2tp_session *session = arg;
560 	struct pppol2tp_session *ps = l2tp_session_priv(session);
561 
562 	if (ps) {
563 		struct pppox_sock *po = pppox_sk(ps->sock);
564 		if (po)
565 			seq_printf(m, "   interface %s\n", ppp_dev_name(&po->chan));
566 	}
567 }
568 #endif
569 
570 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
571  */
572 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
573 			    int sockaddr_len, int flags)
574 {
575 	struct sock *sk = sock->sk;
576 	struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr;
577 	struct pppox_sock *po = pppox_sk(sk);
578 	struct l2tp_session *session = NULL;
579 	struct l2tp_tunnel *tunnel;
580 	struct pppol2tp_session *ps;
581 	struct dst_entry *dst;
582 	struct l2tp_session_cfg cfg = { 0, };
583 	int error = 0;
584 	u32 tunnel_id, peer_tunnel_id;
585 	u32 session_id, peer_session_id;
586 	bool drop_refcnt = false;
587 	int ver = 2;
588 	int fd;
589 
590 	lock_sock(sk);
591 
592 	error = -EINVAL;
593 	if (sp->sa_protocol != PX_PROTO_OL2TP)
594 		goto end;
595 
596 	/* Check for already bound sockets */
597 	error = -EBUSY;
598 	if (sk->sk_state & PPPOX_CONNECTED)
599 		goto end;
600 
601 	/* We don't supporting rebinding anyway */
602 	error = -EALREADY;
603 	if (sk->sk_user_data)
604 		goto end; /* socket is already attached */
605 
606 	/* Get params from socket address. Handle L2TPv2 and L2TPv3.
607 	 * This is nasty because there are different sockaddr_pppol2tp
608 	 * structs for L2TPv2, L2TPv3, over IPv4 and IPv6. We use
609 	 * the sockaddr size to determine which structure the caller
610 	 * is using.
611 	 */
612 	peer_tunnel_id = 0;
613 	if (sockaddr_len == sizeof(struct sockaddr_pppol2tp)) {
614 		fd = sp->pppol2tp.fd;
615 		tunnel_id = sp->pppol2tp.s_tunnel;
616 		peer_tunnel_id = sp->pppol2tp.d_tunnel;
617 		session_id = sp->pppol2tp.s_session;
618 		peer_session_id = sp->pppol2tp.d_session;
619 	} else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3)) {
620 		struct sockaddr_pppol2tpv3 *sp3 =
621 			(struct sockaddr_pppol2tpv3 *) sp;
622 		ver = 3;
623 		fd = sp3->pppol2tp.fd;
624 		tunnel_id = sp3->pppol2tp.s_tunnel;
625 		peer_tunnel_id = sp3->pppol2tp.d_tunnel;
626 		session_id = sp3->pppol2tp.s_session;
627 		peer_session_id = sp3->pppol2tp.d_session;
628 	} else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpin6)) {
629 		struct sockaddr_pppol2tpin6 *sp6 =
630 			(struct sockaddr_pppol2tpin6 *) sp;
631 		fd = sp6->pppol2tp.fd;
632 		tunnel_id = sp6->pppol2tp.s_tunnel;
633 		peer_tunnel_id = sp6->pppol2tp.d_tunnel;
634 		session_id = sp6->pppol2tp.s_session;
635 		peer_session_id = sp6->pppol2tp.d_session;
636 	} else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3in6)) {
637 		struct sockaddr_pppol2tpv3in6 *sp6 =
638 			(struct sockaddr_pppol2tpv3in6 *) sp;
639 		ver = 3;
640 		fd = sp6->pppol2tp.fd;
641 		tunnel_id = sp6->pppol2tp.s_tunnel;
642 		peer_tunnel_id = sp6->pppol2tp.d_tunnel;
643 		session_id = sp6->pppol2tp.s_session;
644 		peer_session_id = sp6->pppol2tp.d_session;
645 	} else {
646 		error = -EINVAL;
647 		goto end; /* bad socket address */
648 	}
649 
650 	/* Don't bind if tunnel_id is 0 */
651 	error = -EINVAL;
652 	if (tunnel_id == 0)
653 		goto end;
654 
655 	tunnel = l2tp_tunnel_find(sock_net(sk), tunnel_id);
656 
657 	/* Special case: create tunnel context if session_id and
658 	 * peer_session_id is 0. Otherwise look up tunnel using supplied
659 	 * tunnel id.
660 	 */
661 	if ((session_id == 0) && (peer_session_id == 0)) {
662 		if (tunnel == NULL) {
663 			struct l2tp_tunnel_cfg tcfg = {
664 				.encap = L2TP_ENCAPTYPE_UDP,
665 				.debug = 0,
666 			};
667 			error = l2tp_tunnel_create(sock_net(sk), fd, ver, tunnel_id, peer_tunnel_id, &tcfg, &tunnel);
668 			if (error < 0)
669 				goto end;
670 		}
671 	} else {
672 		/* Error if we can't find the tunnel */
673 		error = -ENOENT;
674 		if (tunnel == NULL)
675 			goto end;
676 
677 		/* Error if socket is not prepped */
678 		if (tunnel->sock == NULL)
679 			goto end;
680 	}
681 
682 	if (tunnel->recv_payload_hook == NULL)
683 		tunnel->recv_payload_hook = pppol2tp_recv_payload_hook;
684 
685 	if (tunnel->peer_tunnel_id == 0)
686 		tunnel->peer_tunnel_id = peer_tunnel_id;
687 
688 	session = l2tp_session_get(sock_net(sk), tunnel, session_id, false);
689 	if (session) {
690 		drop_refcnt = true;
691 		ps = l2tp_session_priv(session);
692 
693 		/* Using a pre-existing session is fine as long as it hasn't
694 		 * been connected yet.
695 		 */
696 		if (ps->sock) {
697 			error = -EEXIST;
698 			goto end;
699 		}
700 
701 		/* consistency checks */
702 		if (ps->tunnel_sock != tunnel->sock) {
703 			error = -EEXIST;
704 			goto end;
705 		}
706 	} else {
707 		/* Default MTU must allow space for UDP/L2TP/PPP headers */
708 		cfg.mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD;
709 		cfg.mru = cfg.mtu;
710 
711 		session = l2tp_session_create(sizeof(struct pppol2tp_session),
712 					      tunnel, session_id,
713 					      peer_session_id, &cfg);
714 		if (IS_ERR(session)) {
715 			error = PTR_ERR(session);
716 			goto end;
717 		}
718 	}
719 
720 	/* Associate session with its PPPoL2TP socket */
721 	ps = l2tp_session_priv(session);
722 	ps->owner	     = current->pid;
723 	ps->sock	     = sk;
724 	ps->tunnel_sock = tunnel->sock;
725 
726 	session->recv_skb	= pppol2tp_recv;
727 	session->session_close	= pppol2tp_session_close;
728 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS)
729 	session->show		= pppol2tp_show;
730 #endif
731 
732 	/* We need to know each time a skb is dropped from the reorder
733 	 * queue.
734 	 */
735 	session->ref = pppol2tp_session_sock_hold;
736 	session->deref = pppol2tp_session_sock_put;
737 
738 	/* If PMTU discovery was enabled, use the MTU that was discovered */
739 	dst = sk_dst_get(tunnel->sock);
740 	if (dst != NULL) {
741 		u32 pmtu = dst_mtu(dst);
742 
743 		if (pmtu != 0)
744 			session->mtu = session->mru = pmtu -
745 				PPPOL2TP_HEADER_OVERHEAD;
746 		dst_release(dst);
747 	}
748 
749 	/* Special case: if source & dest session_id == 0x0000, this
750 	 * socket is being created to manage the tunnel. Just set up
751 	 * the internal context for use by ioctl() and sockopt()
752 	 * handlers.
753 	 */
754 	if ((session->session_id == 0) &&
755 	    (session->peer_session_id == 0)) {
756 		error = 0;
757 		goto out_no_ppp;
758 	}
759 
760 	/* The only header we need to worry about is the L2TP
761 	 * header. This size is different depending on whether
762 	 * sequence numbers are enabled for the data channel.
763 	 */
764 	po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
765 
766 	po->chan.private = sk;
767 	po->chan.ops	 = &pppol2tp_chan_ops;
768 	po->chan.mtu	 = session->mtu;
769 
770 	error = ppp_register_net_channel(sock_net(sk), &po->chan);
771 	if (error)
772 		goto end;
773 
774 out_no_ppp:
775 	/* This is how we get the session context from the socket. */
776 	sk->sk_user_data = session;
777 	sk->sk_state = PPPOX_CONNECTED;
778 	l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n",
779 		  session->name);
780 
781 end:
782 	if (drop_refcnt)
783 		l2tp_session_dec_refcount(session);
784 	release_sock(sk);
785 
786 	return error;
787 }
788 
789 #ifdef CONFIG_L2TP_V3
790 
791 /* Called when creating sessions via the netlink interface.
792  */
793 static int pppol2tp_session_create(struct net *net, u32 tunnel_id, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
794 {
795 	int error;
796 	struct l2tp_tunnel *tunnel;
797 	struct l2tp_session *session;
798 	struct pppol2tp_session *ps;
799 
800 	tunnel = l2tp_tunnel_find(net, tunnel_id);
801 
802 	/* Error if we can't find the tunnel */
803 	error = -ENOENT;
804 	if (tunnel == NULL)
805 		goto out;
806 
807 	/* Error if tunnel socket is not prepped */
808 	if (tunnel->sock == NULL)
809 		goto out;
810 
811 	/* Default MTU values. */
812 	if (cfg->mtu == 0)
813 		cfg->mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD;
814 	if (cfg->mru == 0)
815 		cfg->mru = cfg->mtu;
816 
817 	/* Allocate and initialize a new session context. */
818 	session = l2tp_session_create(sizeof(struct pppol2tp_session),
819 				      tunnel, session_id,
820 				      peer_session_id, cfg);
821 	if (IS_ERR(session)) {
822 		error = PTR_ERR(session);
823 		goto out;
824 	}
825 
826 	ps = l2tp_session_priv(session);
827 	ps->tunnel_sock = tunnel->sock;
828 
829 	l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n",
830 		  session->name);
831 
832 	error = 0;
833 
834 out:
835 	return error;
836 }
837 
838 #endif /* CONFIG_L2TP_V3 */
839 
840 /* getname() support.
841  */
842 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
843 			    int *usockaddr_len, int peer)
844 {
845 	int len = 0;
846 	int error = 0;
847 	struct l2tp_session *session;
848 	struct l2tp_tunnel *tunnel;
849 	struct sock *sk = sock->sk;
850 	struct inet_sock *inet;
851 	struct pppol2tp_session *pls;
852 
853 	error = -ENOTCONN;
854 	if (sk == NULL)
855 		goto end;
856 	if (!(sk->sk_state & PPPOX_CONNECTED))
857 		goto end;
858 
859 	error = -EBADF;
860 	session = pppol2tp_sock_to_session(sk);
861 	if (session == NULL)
862 		goto end;
863 
864 	pls = l2tp_session_priv(session);
865 	tunnel = l2tp_sock_to_tunnel(pls->tunnel_sock);
866 	if (tunnel == NULL)
867 		goto end_put_sess;
868 
869 	inet = inet_sk(tunnel->sock);
870 	if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) {
871 		struct sockaddr_pppol2tp sp;
872 		len = sizeof(sp);
873 		memset(&sp, 0, len);
874 		sp.sa_family	= AF_PPPOX;
875 		sp.sa_protocol	= PX_PROTO_OL2TP;
876 		sp.pppol2tp.fd  = tunnel->fd;
877 		sp.pppol2tp.pid = pls->owner;
878 		sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
879 		sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
880 		sp.pppol2tp.s_session = session->session_id;
881 		sp.pppol2tp.d_session = session->peer_session_id;
882 		sp.pppol2tp.addr.sin_family = AF_INET;
883 		sp.pppol2tp.addr.sin_port = inet->inet_dport;
884 		sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
885 		memcpy(uaddr, &sp, len);
886 #if IS_ENABLED(CONFIG_IPV6)
887 	} else if ((tunnel->version == 2) &&
888 		   (tunnel->sock->sk_family == AF_INET6)) {
889 		struct sockaddr_pppol2tpin6 sp;
890 
891 		len = sizeof(sp);
892 		memset(&sp, 0, len);
893 		sp.sa_family	= AF_PPPOX;
894 		sp.sa_protocol	= PX_PROTO_OL2TP;
895 		sp.pppol2tp.fd  = tunnel->fd;
896 		sp.pppol2tp.pid = pls->owner;
897 		sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
898 		sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
899 		sp.pppol2tp.s_session = session->session_id;
900 		sp.pppol2tp.d_session = session->peer_session_id;
901 		sp.pppol2tp.addr.sin6_family = AF_INET6;
902 		sp.pppol2tp.addr.sin6_port = inet->inet_dport;
903 		memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
904 		       sizeof(tunnel->sock->sk_v6_daddr));
905 		memcpy(uaddr, &sp, len);
906 	} else if ((tunnel->version == 3) &&
907 		   (tunnel->sock->sk_family == AF_INET6)) {
908 		struct sockaddr_pppol2tpv3in6 sp;
909 
910 		len = sizeof(sp);
911 		memset(&sp, 0, len);
912 		sp.sa_family	= AF_PPPOX;
913 		sp.sa_protocol	= PX_PROTO_OL2TP;
914 		sp.pppol2tp.fd  = tunnel->fd;
915 		sp.pppol2tp.pid = pls->owner;
916 		sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
917 		sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
918 		sp.pppol2tp.s_session = session->session_id;
919 		sp.pppol2tp.d_session = session->peer_session_id;
920 		sp.pppol2tp.addr.sin6_family = AF_INET6;
921 		sp.pppol2tp.addr.sin6_port = inet->inet_dport;
922 		memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
923 		       sizeof(tunnel->sock->sk_v6_daddr));
924 		memcpy(uaddr, &sp, len);
925 #endif
926 	} else if (tunnel->version == 3) {
927 		struct sockaddr_pppol2tpv3 sp;
928 		len = sizeof(sp);
929 		memset(&sp, 0, len);
930 		sp.sa_family	= AF_PPPOX;
931 		sp.sa_protocol	= PX_PROTO_OL2TP;
932 		sp.pppol2tp.fd  = tunnel->fd;
933 		sp.pppol2tp.pid = pls->owner;
934 		sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
935 		sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
936 		sp.pppol2tp.s_session = session->session_id;
937 		sp.pppol2tp.d_session = session->peer_session_id;
938 		sp.pppol2tp.addr.sin_family = AF_INET;
939 		sp.pppol2tp.addr.sin_port = inet->inet_dport;
940 		sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
941 		memcpy(uaddr, &sp, len);
942 	}
943 
944 	*usockaddr_len = len;
945 	error = 0;
946 
947 	sock_put(pls->tunnel_sock);
948 end_put_sess:
949 	sock_put(sk);
950 end:
951 	return error;
952 }
953 
954 /****************************************************************************
955  * ioctl() handlers.
956  *
957  * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
958  * sockets. However, in order to control kernel tunnel features, we allow
959  * userspace to create a special "tunnel" PPPoX socket which is used for
960  * control only.  Tunnel PPPoX sockets have session_id == 0 and simply allow
961  * the user application to issue L2TP setsockopt(), getsockopt() and ioctl()
962  * calls.
963  ****************************************************************************/
964 
965 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest,
966 				struct l2tp_stats *stats)
967 {
968 	dest->tx_packets = atomic_long_read(&stats->tx_packets);
969 	dest->tx_bytes = atomic_long_read(&stats->tx_bytes);
970 	dest->tx_errors = atomic_long_read(&stats->tx_errors);
971 	dest->rx_packets = atomic_long_read(&stats->rx_packets);
972 	dest->rx_bytes = atomic_long_read(&stats->rx_bytes);
973 	dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards);
974 	dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets);
975 	dest->rx_errors = atomic_long_read(&stats->rx_errors);
976 }
977 
978 /* Session ioctl helper.
979  */
980 static int pppol2tp_session_ioctl(struct l2tp_session *session,
981 				  unsigned int cmd, unsigned long arg)
982 {
983 	struct ifreq ifr;
984 	int err = 0;
985 	struct sock *sk;
986 	int val = (int) arg;
987 	struct pppol2tp_session *ps = l2tp_session_priv(session);
988 	struct l2tp_tunnel *tunnel = session->tunnel;
989 	struct pppol2tp_ioc_stats stats;
990 
991 	l2tp_dbg(session, L2TP_MSG_CONTROL,
992 		 "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n",
993 		 session->name, cmd, arg);
994 
995 	sk = ps->sock;
996 	sock_hold(sk);
997 
998 	switch (cmd) {
999 	case SIOCGIFMTU:
1000 		err = -ENXIO;
1001 		if (!(sk->sk_state & PPPOX_CONNECTED))
1002 			break;
1003 
1004 		err = -EFAULT;
1005 		if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq)))
1006 			break;
1007 		ifr.ifr_mtu = session->mtu;
1008 		if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq)))
1009 			break;
1010 
1011 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mtu=%d\n",
1012 			  session->name, session->mtu);
1013 		err = 0;
1014 		break;
1015 
1016 	case SIOCSIFMTU:
1017 		err = -ENXIO;
1018 		if (!(sk->sk_state & PPPOX_CONNECTED))
1019 			break;
1020 
1021 		err = -EFAULT;
1022 		if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq)))
1023 			break;
1024 
1025 		session->mtu = ifr.ifr_mtu;
1026 
1027 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mtu=%d\n",
1028 			  session->name, session->mtu);
1029 		err = 0;
1030 		break;
1031 
1032 	case PPPIOCGMRU:
1033 		err = -ENXIO;
1034 		if (!(sk->sk_state & PPPOX_CONNECTED))
1035 			break;
1036 
1037 		err = -EFAULT;
1038 		if (put_user(session->mru, (int __user *) arg))
1039 			break;
1040 
1041 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mru=%d\n",
1042 			  session->name, session->mru);
1043 		err = 0;
1044 		break;
1045 
1046 	case PPPIOCSMRU:
1047 		err = -ENXIO;
1048 		if (!(sk->sk_state & PPPOX_CONNECTED))
1049 			break;
1050 
1051 		err = -EFAULT;
1052 		if (get_user(val, (int __user *) arg))
1053 			break;
1054 
1055 		session->mru = val;
1056 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mru=%d\n",
1057 			  session->name, session->mru);
1058 		err = 0;
1059 		break;
1060 
1061 	case PPPIOCGFLAGS:
1062 		err = -EFAULT;
1063 		if (put_user(ps->flags, (int __user *) arg))
1064 			break;
1065 
1066 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: get flags=%d\n",
1067 			  session->name, ps->flags);
1068 		err = 0;
1069 		break;
1070 
1071 	case PPPIOCSFLAGS:
1072 		err = -EFAULT;
1073 		if (get_user(val, (int __user *) arg))
1074 			break;
1075 		ps->flags = val;
1076 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: set flags=%d\n",
1077 			  session->name, ps->flags);
1078 		err = 0;
1079 		break;
1080 
1081 	case PPPIOCGL2TPSTATS:
1082 		err = -ENXIO;
1083 		if (!(sk->sk_state & PPPOX_CONNECTED))
1084 			break;
1085 
1086 		memset(&stats, 0, sizeof(stats));
1087 		stats.tunnel_id = tunnel->tunnel_id;
1088 		stats.session_id = session->session_id;
1089 		pppol2tp_copy_stats(&stats, &session->stats);
1090 		if (copy_to_user((void __user *) arg, &stats,
1091 				 sizeof(stats)))
1092 			break;
1093 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: get L2TP stats\n",
1094 			  session->name);
1095 		err = 0;
1096 		break;
1097 
1098 	default:
1099 		err = -ENOSYS;
1100 		break;
1101 	}
1102 
1103 	sock_put(sk);
1104 
1105 	return err;
1106 }
1107 
1108 /* Tunnel ioctl helper.
1109  *
1110  * Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data
1111  * specifies a session_id, the session ioctl handler is called. This allows an
1112  * application to retrieve session stats via a tunnel socket.
1113  */
1114 static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel,
1115 				 unsigned int cmd, unsigned long arg)
1116 {
1117 	int err = 0;
1118 	struct sock *sk;
1119 	struct pppol2tp_ioc_stats stats;
1120 
1121 	l2tp_dbg(tunnel, L2TP_MSG_CONTROL,
1122 		 "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n",
1123 		 tunnel->name, cmd, arg);
1124 
1125 	sk = tunnel->sock;
1126 	sock_hold(sk);
1127 
1128 	switch (cmd) {
1129 	case PPPIOCGL2TPSTATS:
1130 		err = -ENXIO;
1131 		if (!(sk->sk_state & PPPOX_CONNECTED))
1132 			break;
1133 
1134 		if (copy_from_user(&stats, (void __user *) arg,
1135 				   sizeof(stats))) {
1136 			err = -EFAULT;
1137 			break;
1138 		}
1139 		if (stats.session_id != 0) {
1140 			/* resend to session ioctl handler */
1141 			struct l2tp_session *session =
1142 				l2tp_session_get(sock_net(sk), tunnel,
1143 						 stats.session_id, true);
1144 
1145 			if (session) {
1146 				err = pppol2tp_session_ioctl(session, cmd,
1147 							     arg);
1148 				if (session->deref)
1149 					session->deref(session);
1150 				l2tp_session_dec_refcount(session);
1151 			} else {
1152 				err = -EBADR;
1153 			}
1154 			break;
1155 		}
1156 #ifdef CONFIG_XFRM
1157 		stats.using_ipsec = (sk->sk_policy[0] || sk->sk_policy[1]) ? 1 : 0;
1158 #endif
1159 		pppol2tp_copy_stats(&stats, &tunnel->stats);
1160 		if (copy_to_user((void __user *) arg, &stats, sizeof(stats))) {
1161 			err = -EFAULT;
1162 			break;
1163 		}
1164 		l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get L2TP stats\n",
1165 			  tunnel->name);
1166 		err = 0;
1167 		break;
1168 
1169 	default:
1170 		err = -ENOSYS;
1171 		break;
1172 	}
1173 
1174 	sock_put(sk);
1175 
1176 	return err;
1177 }
1178 
1179 /* Main ioctl() handler.
1180  * Dispatch to tunnel or session helpers depending on the socket.
1181  */
1182 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
1183 			  unsigned long arg)
1184 {
1185 	struct sock *sk = sock->sk;
1186 	struct l2tp_session *session;
1187 	struct l2tp_tunnel *tunnel;
1188 	struct pppol2tp_session *ps;
1189 	int err;
1190 
1191 	if (!sk)
1192 		return 0;
1193 
1194 	err = -EBADF;
1195 	if (sock_flag(sk, SOCK_DEAD) != 0)
1196 		goto end;
1197 
1198 	err = -ENOTCONN;
1199 	if ((sk->sk_user_data == NULL) ||
1200 	    (!(sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND))))
1201 		goto end;
1202 
1203 	/* Get session context from the socket */
1204 	err = -EBADF;
1205 	session = pppol2tp_sock_to_session(sk);
1206 	if (session == NULL)
1207 		goto end;
1208 
1209 	/* Special case: if session's session_id is zero, treat ioctl as a
1210 	 * tunnel ioctl
1211 	 */
1212 	ps = l2tp_session_priv(session);
1213 	if ((session->session_id == 0) &&
1214 	    (session->peer_session_id == 0)) {
1215 		err = -EBADF;
1216 		tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
1217 		if (tunnel == NULL)
1218 			goto end_put_sess;
1219 
1220 		err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg);
1221 		sock_put(ps->tunnel_sock);
1222 		goto end_put_sess;
1223 	}
1224 
1225 	err = pppol2tp_session_ioctl(session, cmd, arg);
1226 
1227 end_put_sess:
1228 	sock_put(sk);
1229 end:
1230 	return err;
1231 }
1232 
1233 /*****************************************************************************
1234  * setsockopt() / getsockopt() support.
1235  *
1236  * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
1237  * sockets. In order to control kernel tunnel features, we allow userspace to
1238  * create a special "tunnel" PPPoX socket which is used for control only.
1239  * Tunnel PPPoX sockets have session_id == 0 and simply allow the user
1240  * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls.
1241  *****************************************************************************/
1242 
1243 /* Tunnel setsockopt() helper.
1244  */
1245 static int pppol2tp_tunnel_setsockopt(struct sock *sk,
1246 				      struct l2tp_tunnel *tunnel,
1247 				      int optname, int val)
1248 {
1249 	int err = 0;
1250 
1251 	switch (optname) {
1252 	case PPPOL2TP_SO_DEBUG:
1253 		tunnel->debug = val;
1254 		l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: set debug=%x\n",
1255 			  tunnel->name, tunnel->debug);
1256 		break;
1257 
1258 	default:
1259 		err = -ENOPROTOOPT;
1260 		break;
1261 	}
1262 
1263 	return err;
1264 }
1265 
1266 /* Session setsockopt helper.
1267  */
1268 static int pppol2tp_session_setsockopt(struct sock *sk,
1269 				       struct l2tp_session *session,
1270 				       int optname, int val)
1271 {
1272 	int err = 0;
1273 	struct pppol2tp_session *ps = l2tp_session_priv(session);
1274 
1275 	switch (optname) {
1276 	case PPPOL2TP_SO_RECVSEQ:
1277 		if ((val != 0) && (val != 1)) {
1278 			err = -EINVAL;
1279 			break;
1280 		}
1281 		session->recv_seq = !!val;
1282 		l2tp_info(session, L2TP_MSG_CONTROL,
1283 			  "%s: set recv_seq=%d\n",
1284 			  session->name, session->recv_seq);
1285 		break;
1286 
1287 	case PPPOL2TP_SO_SENDSEQ:
1288 		if ((val != 0) && (val != 1)) {
1289 			err = -EINVAL;
1290 			break;
1291 		}
1292 		session->send_seq = !!val;
1293 		{
1294 			struct sock *ssk      = ps->sock;
1295 			struct pppox_sock *po = pppox_sk(ssk);
1296 			po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
1297 				PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
1298 		}
1299 		l2tp_session_set_header_len(session, session->tunnel->version);
1300 		l2tp_info(session, L2TP_MSG_CONTROL,
1301 			  "%s: set send_seq=%d\n",
1302 			  session->name, session->send_seq);
1303 		break;
1304 
1305 	case PPPOL2TP_SO_LNSMODE:
1306 		if ((val != 0) && (val != 1)) {
1307 			err = -EINVAL;
1308 			break;
1309 		}
1310 		session->lns_mode = !!val;
1311 		l2tp_info(session, L2TP_MSG_CONTROL,
1312 			  "%s: set lns_mode=%d\n",
1313 			  session->name, session->lns_mode);
1314 		break;
1315 
1316 	case PPPOL2TP_SO_DEBUG:
1317 		session->debug = val;
1318 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: set debug=%x\n",
1319 			  session->name, session->debug);
1320 		break;
1321 
1322 	case PPPOL2TP_SO_REORDERTO:
1323 		session->reorder_timeout = msecs_to_jiffies(val);
1324 		l2tp_info(session, L2TP_MSG_CONTROL,
1325 			  "%s: set reorder_timeout=%d\n",
1326 			  session->name, session->reorder_timeout);
1327 		break;
1328 
1329 	default:
1330 		err = -ENOPROTOOPT;
1331 		break;
1332 	}
1333 
1334 	return err;
1335 }
1336 
1337 /* Main setsockopt() entry point.
1338  * Does API checks, then calls either the tunnel or session setsockopt
1339  * handler, according to whether the PPPoL2TP socket is a for a regular
1340  * session or the special tunnel type.
1341  */
1342 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
1343 			       char __user *optval, unsigned int optlen)
1344 {
1345 	struct sock *sk = sock->sk;
1346 	struct l2tp_session *session;
1347 	struct l2tp_tunnel *tunnel;
1348 	struct pppol2tp_session *ps;
1349 	int val;
1350 	int err;
1351 
1352 	if (level != SOL_PPPOL2TP)
1353 		return -EINVAL;
1354 
1355 	if (optlen < sizeof(int))
1356 		return -EINVAL;
1357 
1358 	if (get_user(val, (int __user *)optval))
1359 		return -EFAULT;
1360 
1361 	err = -ENOTCONN;
1362 	if (sk->sk_user_data == NULL)
1363 		goto end;
1364 
1365 	/* Get session context from the socket */
1366 	err = -EBADF;
1367 	session = pppol2tp_sock_to_session(sk);
1368 	if (session == NULL)
1369 		goto end;
1370 
1371 	/* Special case: if session_id == 0x0000, treat as operation on tunnel
1372 	 */
1373 	ps = l2tp_session_priv(session);
1374 	if ((session->session_id == 0) &&
1375 	    (session->peer_session_id == 0)) {
1376 		err = -EBADF;
1377 		tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
1378 		if (tunnel == NULL)
1379 			goto end_put_sess;
1380 
1381 		err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
1382 		sock_put(ps->tunnel_sock);
1383 	} else
1384 		err = pppol2tp_session_setsockopt(sk, session, optname, val);
1385 
1386 end_put_sess:
1387 	sock_put(sk);
1388 end:
1389 	return err;
1390 }
1391 
1392 /* Tunnel getsockopt helper. Called with sock locked.
1393  */
1394 static int pppol2tp_tunnel_getsockopt(struct sock *sk,
1395 				      struct l2tp_tunnel *tunnel,
1396 				      int optname, int *val)
1397 {
1398 	int err = 0;
1399 
1400 	switch (optname) {
1401 	case PPPOL2TP_SO_DEBUG:
1402 		*val = tunnel->debug;
1403 		l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get debug=%x\n",
1404 			  tunnel->name, tunnel->debug);
1405 		break;
1406 
1407 	default:
1408 		err = -ENOPROTOOPT;
1409 		break;
1410 	}
1411 
1412 	return err;
1413 }
1414 
1415 /* Session getsockopt helper. Called with sock locked.
1416  */
1417 static int pppol2tp_session_getsockopt(struct sock *sk,
1418 				       struct l2tp_session *session,
1419 				       int optname, int *val)
1420 {
1421 	int err = 0;
1422 
1423 	switch (optname) {
1424 	case PPPOL2TP_SO_RECVSEQ:
1425 		*val = session->recv_seq;
1426 		l2tp_info(session, L2TP_MSG_CONTROL,
1427 			  "%s: get recv_seq=%d\n", session->name, *val);
1428 		break;
1429 
1430 	case PPPOL2TP_SO_SENDSEQ:
1431 		*val = session->send_seq;
1432 		l2tp_info(session, L2TP_MSG_CONTROL,
1433 			  "%s: get send_seq=%d\n", session->name, *val);
1434 		break;
1435 
1436 	case PPPOL2TP_SO_LNSMODE:
1437 		*val = session->lns_mode;
1438 		l2tp_info(session, L2TP_MSG_CONTROL,
1439 			  "%s: get lns_mode=%d\n", session->name, *val);
1440 		break;
1441 
1442 	case PPPOL2TP_SO_DEBUG:
1443 		*val = session->debug;
1444 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: get debug=%d\n",
1445 			  session->name, *val);
1446 		break;
1447 
1448 	case PPPOL2TP_SO_REORDERTO:
1449 		*val = (int) jiffies_to_msecs(session->reorder_timeout);
1450 		l2tp_info(session, L2TP_MSG_CONTROL,
1451 			  "%s: get reorder_timeout=%d\n", session->name, *val);
1452 		break;
1453 
1454 	default:
1455 		err = -ENOPROTOOPT;
1456 	}
1457 
1458 	return err;
1459 }
1460 
1461 /* Main getsockopt() entry point.
1462  * Does API checks, then calls either the tunnel or session getsockopt
1463  * handler, according to whether the PPPoX socket is a for a regular session
1464  * or the special tunnel type.
1465  */
1466 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
1467 			       char __user *optval, int __user *optlen)
1468 {
1469 	struct sock *sk = sock->sk;
1470 	struct l2tp_session *session;
1471 	struct l2tp_tunnel *tunnel;
1472 	int val, len;
1473 	int err;
1474 	struct pppol2tp_session *ps;
1475 
1476 	if (level != SOL_PPPOL2TP)
1477 		return -EINVAL;
1478 
1479 	if (get_user(len, optlen))
1480 		return -EFAULT;
1481 
1482 	len = min_t(unsigned int, len, sizeof(int));
1483 
1484 	if (len < 0)
1485 		return -EINVAL;
1486 
1487 	err = -ENOTCONN;
1488 	if (sk->sk_user_data == NULL)
1489 		goto end;
1490 
1491 	/* Get the session context */
1492 	err = -EBADF;
1493 	session = pppol2tp_sock_to_session(sk);
1494 	if (session == NULL)
1495 		goto end;
1496 
1497 	/* Special case: if session_id == 0x0000, treat as operation on tunnel */
1498 	ps = l2tp_session_priv(session);
1499 	if ((session->session_id == 0) &&
1500 	    (session->peer_session_id == 0)) {
1501 		err = -EBADF;
1502 		tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
1503 		if (tunnel == NULL)
1504 			goto end_put_sess;
1505 
1506 		err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
1507 		sock_put(ps->tunnel_sock);
1508 		if (err)
1509 			goto end_put_sess;
1510 	} else {
1511 		err = pppol2tp_session_getsockopt(sk, session, optname, &val);
1512 		if (err)
1513 			goto end_put_sess;
1514 	}
1515 
1516 	err = -EFAULT;
1517 	if (put_user(len, optlen))
1518 		goto end_put_sess;
1519 
1520 	if (copy_to_user((void __user *) optval, &val, len))
1521 		goto end_put_sess;
1522 
1523 	err = 0;
1524 
1525 end_put_sess:
1526 	sock_put(sk);
1527 end:
1528 	return err;
1529 }
1530 
1531 /*****************************************************************************
1532  * /proc filesystem for debug
1533  * Since the original pppol2tp driver provided /proc/net/pppol2tp for
1534  * L2TPv2, we dump only L2TPv2 tunnels and sessions here.
1535  *****************************************************************************/
1536 
1537 static unsigned int pppol2tp_net_id;
1538 
1539 #ifdef CONFIG_PROC_FS
1540 
1541 struct pppol2tp_seq_data {
1542 	struct seq_net_private p;
1543 	int tunnel_idx;			/* current tunnel */
1544 	int session_idx;		/* index of session within current tunnel */
1545 	struct l2tp_tunnel *tunnel;
1546 	struct l2tp_session *session;	/* NULL means get next tunnel */
1547 };
1548 
1549 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
1550 {
1551 	for (;;) {
1552 		pd->tunnel = l2tp_tunnel_find_nth(net, pd->tunnel_idx);
1553 		pd->tunnel_idx++;
1554 
1555 		if (pd->tunnel == NULL)
1556 			break;
1557 
1558 		/* Ignore L2TPv3 tunnels */
1559 		if (pd->tunnel->version < 3)
1560 			break;
1561 	}
1562 }
1563 
1564 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
1565 {
1566 	pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true);
1567 	pd->session_idx++;
1568 
1569 	if (pd->session == NULL) {
1570 		pd->session_idx = 0;
1571 		pppol2tp_next_tunnel(net, pd);
1572 	}
1573 }
1574 
1575 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs)
1576 {
1577 	struct pppol2tp_seq_data *pd = SEQ_START_TOKEN;
1578 	loff_t pos = *offs;
1579 	struct net *net;
1580 
1581 	if (!pos)
1582 		goto out;
1583 
1584 	BUG_ON(m->private == NULL);
1585 	pd = m->private;
1586 	net = seq_file_net(m);
1587 
1588 	if (pd->tunnel == NULL)
1589 		pppol2tp_next_tunnel(net, pd);
1590 	else
1591 		pppol2tp_next_session(net, pd);
1592 
1593 	/* NULL tunnel and session indicates end of list */
1594 	if ((pd->tunnel == NULL) && (pd->session == NULL))
1595 		pd = NULL;
1596 
1597 out:
1598 	return pd;
1599 }
1600 
1601 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos)
1602 {
1603 	(*pos)++;
1604 	return NULL;
1605 }
1606 
1607 static void pppol2tp_seq_stop(struct seq_file *p, void *v)
1608 {
1609 	/* nothing to do */
1610 }
1611 
1612 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
1613 {
1614 	struct l2tp_tunnel *tunnel = v;
1615 
1616 	seq_printf(m, "\nTUNNEL '%s', %c %d\n",
1617 		   tunnel->name,
1618 		   (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N',
1619 		   refcount_read(&tunnel->ref_count) - 1);
1620 	seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n",
1621 		   tunnel->debug,
1622 		   atomic_long_read(&tunnel->stats.tx_packets),
1623 		   atomic_long_read(&tunnel->stats.tx_bytes),
1624 		   atomic_long_read(&tunnel->stats.tx_errors),
1625 		   atomic_long_read(&tunnel->stats.rx_packets),
1626 		   atomic_long_read(&tunnel->stats.rx_bytes),
1627 		   atomic_long_read(&tunnel->stats.rx_errors));
1628 }
1629 
1630 static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
1631 {
1632 	struct l2tp_session *session = v;
1633 	struct l2tp_tunnel *tunnel = session->tunnel;
1634 	struct pppol2tp_session *ps = l2tp_session_priv(session);
1635 	struct pppox_sock *po = pppox_sk(ps->sock);
1636 	u32 ip = 0;
1637 	u16 port = 0;
1638 
1639 	if (tunnel->sock) {
1640 		struct inet_sock *inet = inet_sk(tunnel->sock);
1641 		ip = ntohl(inet->inet_saddr);
1642 		port = ntohs(inet->inet_sport);
1643 	}
1644 
1645 	seq_printf(m, "  SESSION '%s' %08X/%d %04X/%04X -> "
1646 		   "%04X/%04X %d %c\n",
1647 		   session->name, ip, port,
1648 		   tunnel->tunnel_id,
1649 		   session->session_id,
1650 		   tunnel->peer_tunnel_id,
1651 		   session->peer_session_id,
1652 		   ps->sock->sk_state,
1653 		   (session == ps->sock->sk_user_data) ?
1654 		   'Y' : 'N');
1655 	seq_printf(m, "   %d/%d/%c/%c/%s %08x %u\n",
1656 		   session->mtu, session->mru,
1657 		   session->recv_seq ? 'R' : '-',
1658 		   session->send_seq ? 'S' : '-',
1659 		   session->lns_mode ? "LNS" : "LAC",
1660 		   session->debug,
1661 		   jiffies_to_msecs(session->reorder_timeout));
1662 	seq_printf(m, "   %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n",
1663 		   session->nr, session->ns,
1664 		   atomic_long_read(&session->stats.tx_packets),
1665 		   atomic_long_read(&session->stats.tx_bytes),
1666 		   atomic_long_read(&session->stats.tx_errors),
1667 		   atomic_long_read(&session->stats.rx_packets),
1668 		   atomic_long_read(&session->stats.rx_bytes),
1669 		   atomic_long_read(&session->stats.rx_errors));
1670 
1671 	if (po)
1672 		seq_printf(m, "   interface %s\n", ppp_dev_name(&po->chan));
1673 }
1674 
1675 static int pppol2tp_seq_show(struct seq_file *m, void *v)
1676 {
1677 	struct pppol2tp_seq_data *pd = v;
1678 
1679 	/* display header on line 1 */
1680 	if (v == SEQ_START_TOKEN) {
1681 		seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n");
1682 		seq_puts(m, "TUNNEL name, user-data-ok session-count\n");
1683 		seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1684 		seq_puts(m, "  SESSION name, addr/port src-tid/sid "
1685 			 "dest-tid/sid state user-data-ok\n");
1686 		seq_puts(m, "   mtu/mru/rcvseq/sendseq/lns debug reorderto\n");
1687 		seq_puts(m, "   nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1688 		goto out;
1689 	}
1690 
1691 	/* Show the tunnel or session context.
1692 	 */
1693 	if (!pd->session) {
1694 		pppol2tp_seq_tunnel_show(m, pd->tunnel);
1695 	} else {
1696 		pppol2tp_seq_session_show(m, pd->session);
1697 		if (pd->session->deref)
1698 			pd->session->deref(pd->session);
1699 		l2tp_session_dec_refcount(pd->session);
1700 	}
1701 
1702 out:
1703 	return 0;
1704 }
1705 
1706 static const struct seq_operations pppol2tp_seq_ops = {
1707 	.start		= pppol2tp_seq_start,
1708 	.next		= pppol2tp_seq_next,
1709 	.stop		= pppol2tp_seq_stop,
1710 	.show		= pppol2tp_seq_show,
1711 };
1712 
1713 /* Called when our /proc file is opened. We allocate data for use when
1714  * iterating our tunnel / session contexts and store it in the private
1715  * data of the seq_file.
1716  */
1717 static int pppol2tp_proc_open(struct inode *inode, struct file *file)
1718 {
1719 	return seq_open_net(inode, file, &pppol2tp_seq_ops,
1720 			    sizeof(struct pppol2tp_seq_data));
1721 }
1722 
1723 static const struct file_operations pppol2tp_proc_fops = {
1724 	.owner		= THIS_MODULE,
1725 	.open		= pppol2tp_proc_open,
1726 	.read		= seq_read,
1727 	.llseek		= seq_lseek,
1728 	.release	= seq_release_net,
1729 };
1730 
1731 #endif /* CONFIG_PROC_FS */
1732 
1733 /*****************************************************************************
1734  * Network namespace
1735  *****************************************************************************/
1736 
1737 static __net_init int pppol2tp_init_net(struct net *net)
1738 {
1739 	struct proc_dir_entry *pde;
1740 	int err = 0;
1741 
1742 	pde = proc_create("pppol2tp", S_IRUGO, net->proc_net,
1743 			  &pppol2tp_proc_fops);
1744 	if (!pde) {
1745 		err = -ENOMEM;
1746 		goto out;
1747 	}
1748 
1749 out:
1750 	return err;
1751 }
1752 
1753 static __net_exit void pppol2tp_exit_net(struct net *net)
1754 {
1755 	remove_proc_entry("pppol2tp", net->proc_net);
1756 }
1757 
1758 static struct pernet_operations pppol2tp_net_ops = {
1759 	.init = pppol2tp_init_net,
1760 	.exit = pppol2tp_exit_net,
1761 	.id   = &pppol2tp_net_id,
1762 };
1763 
1764 /*****************************************************************************
1765  * Init and cleanup
1766  *****************************************************************************/
1767 
1768 static const struct proto_ops pppol2tp_ops = {
1769 	.family		= AF_PPPOX,
1770 	.owner		= THIS_MODULE,
1771 	.release	= pppol2tp_release,
1772 	.bind		= sock_no_bind,
1773 	.connect	= pppol2tp_connect,
1774 	.socketpair	= sock_no_socketpair,
1775 	.accept		= sock_no_accept,
1776 	.getname	= pppol2tp_getname,
1777 	.poll		= datagram_poll,
1778 	.listen		= sock_no_listen,
1779 	.shutdown	= sock_no_shutdown,
1780 	.setsockopt	= pppol2tp_setsockopt,
1781 	.getsockopt	= pppol2tp_getsockopt,
1782 	.sendmsg	= pppol2tp_sendmsg,
1783 	.recvmsg	= pppol2tp_recvmsg,
1784 	.mmap		= sock_no_mmap,
1785 	.ioctl		= pppox_ioctl,
1786 };
1787 
1788 static const struct pppox_proto pppol2tp_proto = {
1789 	.create		= pppol2tp_create,
1790 	.ioctl		= pppol2tp_ioctl,
1791 	.owner		= THIS_MODULE,
1792 };
1793 
1794 #ifdef CONFIG_L2TP_V3
1795 
1796 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = {
1797 	.session_create	= pppol2tp_session_create,
1798 	.session_delete	= l2tp_session_delete,
1799 };
1800 
1801 #endif /* CONFIG_L2TP_V3 */
1802 
1803 static int __init pppol2tp_init(void)
1804 {
1805 	int err;
1806 
1807 	err = register_pernet_device(&pppol2tp_net_ops);
1808 	if (err)
1809 		goto out;
1810 
1811 	err = proto_register(&pppol2tp_sk_proto, 0);
1812 	if (err)
1813 		goto out_unregister_pppol2tp_pernet;
1814 
1815 	err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto);
1816 	if (err)
1817 		goto out_unregister_pppol2tp_proto;
1818 
1819 #ifdef CONFIG_L2TP_V3
1820 	err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops);
1821 	if (err)
1822 		goto out_unregister_pppox;
1823 #endif
1824 
1825 	pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION);
1826 
1827 out:
1828 	return err;
1829 
1830 #ifdef CONFIG_L2TP_V3
1831 out_unregister_pppox:
1832 	unregister_pppox_proto(PX_PROTO_OL2TP);
1833 #endif
1834 out_unregister_pppol2tp_proto:
1835 	proto_unregister(&pppol2tp_sk_proto);
1836 out_unregister_pppol2tp_pernet:
1837 	unregister_pernet_device(&pppol2tp_net_ops);
1838 	goto out;
1839 }
1840 
1841 static void __exit pppol2tp_exit(void)
1842 {
1843 #ifdef CONFIG_L2TP_V3
1844 	l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP);
1845 #endif
1846 	unregister_pppox_proto(PX_PROTO_OL2TP);
1847 	proto_unregister(&pppol2tp_sk_proto);
1848 	unregister_pernet_device(&pppol2tp_net_ops);
1849 }
1850 
1851 module_init(pppol2tp_init);
1852 module_exit(pppol2tp_exit);
1853 
1854 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1855 MODULE_DESCRIPTION("PPP over L2TP over UDP");
1856 MODULE_LICENSE("GPL");
1857 MODULE_VERSION(PPPOL2TP_DRV_VERSION);
1858 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP);
1859 MODULE_ALIAS_L2TP_PWTYPE(7);
1860