xref: /linux/net/l2tp/l2tp_ppp.c (revision db6d8d5fdf9537641c76ba7f32e02b4bcc600972)
1 /*****************************************************************************
2  * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets
3  *
4  * PPPoX    --- Generic PPP encapsulation socket family
5  * PPPoL2TP --- PPP over L2TP (RFC 2661)
6  *
7  * Version:	2.0.0
8  *
9  * Authors:	James Chapman (jchapman@katalix.com)
10  *
11  * Based on original work by Martijn van Oosterhout <kleptog@svana.org>
12  *
13  * License:
14  *		This program is free software; you can redistribute it and/or
15  *		modify it under the terms of the GNU General Public License
16  *		as published by the Free Software Foundation; either version
17  *		2 of the License, or (at your option) any later version.
18  *
19  */
20 
21 /* This driver handles only L2TP data frames; control frames are handled by a
22  * userspace application.
23  *
24  * To send data in an L2TP session, userspace opens a PPPoL2TP socket and
25  * attaches it to a bound UDP socket with local tunnel_id / session_id and
26  * peer tunnel_id / session_id set. Data can then be sent or received using
27  * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket
28  * can be read or modified using ioctl() or [gs]etsockopt() calls.
29  *
30  * When a PPPoL2TP socket is connected with local and peer session_id values
31  * zero, the socket is treated as a special tunnel management socket.
32  *
33  * Here's example userspace code to create a socket for sending/receiving data
34  * over an L2TP session:-
35  *
36  *	struct sockaddr_pppol2tp sax;
37  *	int fd;
38  *	int session_fd;
39  *
40  *	fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
41  *
42  *	sax.sa_family = AF_PPPOX;
43  *	sax.sa_protocol = PX_PROTO_OL2TP;
44  *	sax.pppol2tp.fd = tunnel_fd;	// bound UDP socket
45  *	sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr;
46  *	sax.pppol2tp.addr.sin_port = addr->sin_port;
47  *	sax.pppol2tp.addr.sin_family = AF_INET;
48  *	sax.pppol2tp.s_tunnel  = tunnel_id;
49  *	sax.pppol2tp.s_session = session_id;
50  *	sax.pppol2tp.d_tunnel  = peer_tunnel_id;
51  *	sax.pppol2tp.d_session = peer_session_id;
52  *
53  *	session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax));
54  *
55  * A pppd plugin that allows PPP traffic to be carried over L2TP using
56  * this driver is available from the OpenL2TP project at
57  * http://openl2tp.sourceforge.net.
58  */
59 
60 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
61 
62 #include <linux/module.h>
63 #include <linux/string.h>
64 #include <linux/list.h>
65 #include <linux/uaccess.h>
66 
67 #include <linux/kernel.h>
68 #include <linux/spinlock.h>
69 #include <linux/kthread.h>
70 #include <linux/sched.h>
71 #include <linux/slab.h>
72 #include <linux/errno.h>
73 #include <linux/jiffies.h>
74 
75 #include <linux/netdevice.h>
76 #include <linux/net.h>
77 #include <linux/inetdevice.h>
78 #include <linux/skbuff.h>
79 #include <linux/init.h>
80 #include <linux/ip.h>
81 #include <linux/udp.h>
82 #include <linux/if_pppox.h>
83 #include <linux/if_pppol2tp.h>
84 #include <net/sock.h>
85 #include <linux/ppp_channel.h>
86 #include <linux/ppp_defs.h>
87 #include <linux/ppp-ioctl.h>
88 #include <linux/file.h>
89 #include <linux/hash.h>
90 #include <linux/sort.h>
91 #include <linux/proc_fs.h>
92 #include <linux/l2tp.h>
93 #include <linux/nsproxy.h>
94 #include <net/net_namespace.h>
95 #include <net/netns/generic.h>
96 #include <net/dst.h>
97 #include <net/ip.h>
98 #include <net/udp.h>
99 #include <net/xfrm.h>
100 #include <net/inet_common.h>
101 
102 #include <asm/byteorder.h>
103 #include <linux/atomic.h>
104 
105 #include "l2tp_core.h"
106 
107 #define PPPOL2TP_DRV_VERSION	"V2.0"
108 
109 /* Space for UDP, L2TP and PPP headers */
110 #define PPPOL2TP_HEADER_OVERHEAD	40
111 
112 /* Number of bytes to build transmit L2TP headers.
113  * Unfortunately the size is different depending on whether sequence numbers
114  * are enabled.
115  */
116 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ		10
117 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ		6
118 
119 /* Private data of each session. This data lives at the end of struct
120  * l2tp_session, referenced via session->priv[].
121  */
122 struct pppol2tp_session {
123 	int			owner;		/* pid that opened the socket */
124 
125 	struct sock		*sock;		/* Pointer to the session
126 						 * PPPoX socket */
127 	struct sock		*tunnel_sock;	/* Pointer to the tunnel UDP
128 						 * socket */
129 	int			flags;		/* accessed by PPPIOCGFLAGS.
130 						 * Unused. */
131 };
132 
133 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);
134 
135 static const struct ppp_channel_ops pppol2tp_chan_ops = {
136 	.start_xmit =  pppol2tp_xmit,
137 };
138 
139 static const struct proto_ops pppol2tp_ops;
140 
141 /* Helpers to obtain tunnel/session contexts from sockets.
142  */
143 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk)
144 {
145 	struct l2tp_session *session;
146 
147 	if (sk == NULL)
148 		return NULL;
149 
150 	sock_hold(sk);
151 	session = (struct l2tp_session *)(sk->sk_user_data);
152 	if (session == NULL) {
153 		sock_put(sk);
154 		goto out;
155 	}
156 
157 	BUG_ON(session->magic != L2TP_SESSION_MAGIC);
158 
159 out:
160 	return session;
161 }
162 
163 /*****************************************************************************
164  * Receive data handling
165  *****************************************************************************/
166 
167 static int pppol2tp_recv_payload_hook(struct sk_buff *skb)
168 {
169 	/* Skip PPP header, if present.	 In testing, Microsoft L2TP clients
170 	 * don't send the PPP header (PPP header compression enabled), but
171 	 * other clients can include the header. So we cope with both cases
172 	 * here. The PPP header is always FF03 when using L2TP.
173 	 *
174 	 * Note that skb->data[] isn't dereferenced from a u16 ptr here since
175 	 * the field may be unaligned.
176 	 */
177 	if (!pskb_may_pull(skb, 2))
178 		return 1;
179 
180 	if ((skb->data[0] == PPP_ALLSTATIONS) && (skb->data[1] == PPP_UI))
181 		skb_pull(skb, 2);
182 
183 	return 0;
184 }
185 
186 /* Receive message. This is the recvmsg for the PPPoL2TP socket.
187  */
188 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg,
189 			    size_t len, int flags)
190 {
191 	int err;
192 	struct sk_buff *skb;
193 	struct sock *sk = sock->sk;
194 
195 	err = -EIO;
196 	if (sk->sk_state & PPPOX_BOUND)
197 		goto end;
198 
199 	err = 0;
200 	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
201 				flags & MSG_DONTWAIT, &err);
202 	if (!skb)
203 		goto end;
204 
205 	if (len > skb->len)
206 		len = skb->len;
207 	else if (len < skb->len)
208 		msg->msg_flags |= MSG_TRUNC;
209 
210 	err = skb_copy_datagram_msg(skb, 0, msg, len);
211 	if (likely(err == 0))
212 		err = len;
213 
214 	kfree_skb(skb);
215 end:
216 	return err;
217 }
218 
219 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len)
220 {
221 	struct pppol2tp_session *ps = l2tp_session_priv(session);
222 	struct sock *sk = NULL;
223 
224 	/* If the socket is bound, send it in to PPP's input queue. Otherwise
225 	 * queue it on the session socket.
226 	 */
227 	sk = ps->sock;
228 	if (sk == NULL)
229 		goto no_sock;
230 
231 	if (sk->sk_state & PPPOX_BOUND) {
232 		struct pppox_sock *po;
233 
234 		l2tp_dbg(session, PPPOL2TP_MSG_DATA,
235 			 "%s: recv %d byte data frame, passing to ppp\n",
236 			 session->name, data_len);
237 
238 		po = pppox_sk(sk);
239 		ppp_input(&po->chan, skb);
240 	} else {
241 		l2tp_dbg(session, PPPOL2TP_MSG_DATA,
242 			 "%s: recv %d byte data frame, passing to L2TP socket\n",
243 			 session->name, data_len);
244 
245 		if (sock_queue_rcv_skb(sk, skb) < 0) {
246 			atomic_long_inc(&session->stats.rx_errors);
247 			kfree_skb(skb);
248 		}
249 	}
250 
251 	return;
252 
253 no_sock:
254 	l2tp_info(session, PPPOL2TP_MSG_DATA, "%s: no socket\n", session->name);
255 	kfree_skb(skb);
256 }
257 
258 static void pppol2tp_session_sock_hold(struct l2tp_session *session)
259 {
260 	struct pppol2tp_session *ps = l2tp_session_priv(session);
261 
262 	if (ps->sock)
263 		sock_hold(ps->sock);
264 }
265 
266 static void pppol2tp_session_sock_put(struct l2tp_session *session)
267 {
268 	struct pppol2tp_session *ps = l2tp_session_priv(session);
269 
270 	if (ps->sock)
271 		sock_put(ps->sock);
272 }
273 
274 /************************************************************************
275  * Transmit handling
276  ***********************************************************************/
277 
278 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket.  We come here
279  * when a user application does a sendmsg() on the session socket. L2TP and
280  * PPP headers must be inserted into the user's data.
281  */
282 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
283 			    size_t total_len)
284 {
285 	struct sock *sk = sock->sk;
286 	struct sk_buff *skb;
287 	int error;
288 	struct l2tp_session *session;
289 	struct l2tp_tunnel *tunnel;
290 	struct pppol2tp_session *ps;
291 	int uhlen;
292 
293 	error = -ENOTCONN;
294 	if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
295 		goto error;
296 
297 	/* Get session and tunnel contexts */
298 	error = -EBADF;
299 	session = pppol2tp_sock_to_session(sk);
300 	if (session == NULL)
301 		goto error;
302 
303 	ps = l2tp_session_priv(session);
304 	tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
305 	if (tunnel == NULL)
306 		goto error_put_sess;
307 
308 	uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
309 
310 	/* Allocate a socket buffer */
311 	error = -ENOMEM;
312 	skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) +
313 			   uhlen + session->hdr_len +
314 			   2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
315 			   0, GFP_KERNEL);
316 	if (!skb)
317 		goto error_put_sess_tun;
318 
319 	/* Reserve space for headers. */
320 	skb_reserve(skb, NET_SKB_PAD);
321 	skb_reset_network_header(skb);
322 	skb_reserve(skb, sizeof(struct iphdr));
323 	skb_reset_transport_header(skb);
324 	skb_reserve(skb, uhlen);
325 
326 	/* Add PPP header */
327 	skb->data[0] = PPP_ALLSTATIONS;
328 	skb->data[1] = PPP_UI;
329 	skb_put(skb, 2);
330 
331 	/* Copy user data into skb */
332 	error = memcpy_from_msg(skb_put(skb, total_len), m, total_len);
333 	if (error < 0) {
334 		kfree_skb(skb);
335 		goto error_put_sess_tun;
336 	}
337 
338 	local_bh_disable();
339 	l2tp_xmit_skb(session, skb, session->hdr_len);
340 	local_bh_enable();
341 
342 	sock_put(ps->tunnel_sock);
343 	sock_put(sk);
344 
345 	return total_len;
346 
347 error_put_sess_tun:
348 	sock_put(ps->tunnel_sock);
349 error_put_sess:
350 	sock_put(sk);
351 error:
352 	return error;
353 }
354 
355 /* Transmit function called by generic PPP driver.  Sends PPP frame
356  * over PPPoL2TP socket.
357  *
358  * This is almost the same as pppol2tp_sendmsg(), but rather than
359  * being called with a msghdr from userspace, it is called with a skb
360  * from the kernel.
361  *
362  * The supplied skb from ppp doesn't have enough headroom for the
363  * insertion of L2TP, UDP and IP headers so we need to allocate more
364  * headroom in the skb. This will create a cloned skb. But we must be
365  * careful in the error case because the caller will expect to free
366  * the skb it supplied, not our cloned skb. So we take care to always
367  * leave the original skb unfreed if we return an error.
368  */
369 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
370 {
371 	struct sock *sk = (struct sock *) chan->private;
372 	struct sock *sk_tun;
373 	struct l2tp_session *session;
374 	struct l2tp_tunnel *tunnel;
375 	struct pppol2tp_session *ps;
376 	int uhlen, headroom;
377 
378 	if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
379 		goto abort;
380 
381 	/* Get session and tunnel contexts from the socket */
382 	session = pppol2tp_sock_to_session(sk);
383 	if (session == NULL)
384 		goto abort;
385 
386 	ps = l2tp_session_priv(session);
387 	sk_tun = ps->tunnel_sock;
388 	if (sk_tun == NULL)
389 		goto abort_put_sess;
390 	tunnel = l2tp_sock_to_tunnel(sk_tun);
391 	if (tunnel == NULL)
392 		goto abort_put_sess;
393 
394 	uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
395 	headroom = NET_SKB_PAD +
396 		   sizeof(struct iphdr) + /* IP header */
397 		   uhlen +		/* UDP header (if L2TP_ENCAPTYPE_UDP) */
398 		   session->hdr_len +	/* L2TP header */
399 		   2;			/* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
400 	if (skb_cow_head(skb, headroom))
401 		goto abort_put_sess_tun;
402 
403 	/* Setup PPP header */
404 	__skb_push(skb, 2);
405 	skb->data[0] = PPP_ALLSTATIONS;
406 	skb->data[1] = PPP_UI;
407 
408 	local_bh_disable();
409 	l2tp_xmit_skb(session, skb, session->hdr_len);
410 	local_bh_enable();
411 
412 	sock_put(sk_tun);
413 	sock_put(sk);
414 	return 1;
415 
416 abort_put_sess_tun:
417 	sock_put(sk_tun);
418 abort_put_sess:
419 	sock_put(sk);
420 abort:
421 	/* Free the original skb */
422 	kfree_skb(skb);
423 	return 1;
424 }
425 
426 /*****************************************************************************
427  * Session (and tunnel control) socket create/destroy.
428  *****************************************************************************/
429 
430 /* Called by l2tp_core when a session socket is being closed.
431  */
432 static void pppol2tp_session_close(struct l2tp_session *session)
433 {
434 	struct pppol2tp_session *ps = l2tp_session_priv(session);
435 	struct sock *sk = ps->sock;
436 	struct socket *sock = sk->sk_socket;
437 
438 	BUG_ON(session->magic != L2TP_SESSION_MAGIC);
439 
440 	if (sock) {
441 		inet_shutdown(sock, SEND_SHUTDOWN);
442 		/* Don't let the session go away before our socket does */
443 		l2tp_session_inc_refcount(session);
444 	}
445 }
446 
447 /* Really kill the session socket. (Called from sock_put() if
448  * refcnt == 0.)
449  */
450 static void pppol2tp_session_destruct(struct sock *sk)
451 {
452 	struct l2tp_session *session = sk->sk_user_data;
453 	if (session) {
454 		sk->sk_user_data = NULL;
455 		BUG_ON(session->magic != L2TP_SESSION_MAGIC);
456 		l2tp_session_dec_refcount(session);
457 	}
458 }
459 
460 /* Called when the PPPoX socket (session) is closed.
461  */
462 static int pppol2tp_release(struct socket *sock)
463 {
464 	struct sock *sk = sock->sk;
465 	struct l2tp_session *session;
466 	int error;
467 
468 	if (!sk)
469 		return 0;
470 
471 	error = -EBADF;
472 	lock_sock(sk);
473 	if (sock_flag(sk, SOCK_DEAD) != 0)
474 		goto error;
475 
476 	pppox_unbind_sock(sk);
477 
478 	/* Signal the death of the socket. */
479 	sk->sk_state = PPPOX_DEAD;
480 	sock_orphan(sk);
481 	sock->sk = NULL;
482 
483 	session = pppol2tp_sock_to_session(sk);
484 
485 	/* Purge any queued data */
486 	if (session != NULL) {
487 		__l2tp_session_unhash(session);
488 		l2tp_session_queue_purge(session);
489 		sock_put(sk);
490 	}
491 	skb_queue_purge(&sk->sk_receive_queue);
492 	skb_queue_purge(&sk->sk_write_queue);
493 
494 	release_sock(sk);
495 
496 	/* This will delete the session context via
497 	 * pppol2tp_session_destruct() if the socket's refcnt drops to
498 	 * zero.
499 	 */
500 	sock_put(sk);
501 
502 	return 0;
503 
504 error:
505 	release_sock(sk);
506 	return error;
507 }
508 
509 static struct proto pppol2tp_sk_proto = {
510 	.name	  = "PPPOL2TP",
511 	.owner	  = THIS_MODULE,
512 	.obj_size = sizeof(struct pppox_sock),
513 };
514 
515 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb)
516 {
517 	int rc;
518 
519 	rc = l2tp_udp_encap_recv(sk, skb);
520 	if (rc)
521 		kfree_skb(skb);
522 
523 	return NET_RX_SUCCESS;
524 }
525 
526 /* socket() handler. Initialize a new struct sock.
527  */
528 static int pppol2tp_create(struct net *net, struct socket *sock, int kern)
529 {
530 	int error = -ENOMEM;
531 	struct sock *sk;
532 
533 	sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern);
534 	if (!sk)
535 		goto out;
536 
537 	sock_init_data(sock, sk);
538 
539 	sock->state  = SS_UNCONNECTED;
540 	sock->ops    = &pppol2tp_ops;
541 
542 	sk->sk_backlog_rcv = pppol2tp_backlog_recv;
543 	sk->sk_protocol	   = PX_PROTO_OL2TP;
544 	sk->sk_family	   = PF_PPPOX;
545 	sk->sk_state	   = PPPOX_NONE;
546 	sk->sk_type	   = SOCK_STREAM;
547 	sk->sk_destruct	   = pppol2tp_session_destruct;
548 
549 	error = 0;
550 
551 out:
552 	return error;
553 }
554 
555 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS)
556 static void pppol2tp_show(struct seq_file *m, void *arg)
557 {
558 	struct l2tp_session *session = arg;
559 	struct pppol2tp_session *ps = l2tp_session_priv(session);
560 
561 	if (ps) {
562 		struct pppox_sock *po = pppox_sk(ps->sock);
563 		if (po)
564 			seq_printf(m, "   interface %s\n", ppp_dev_name(&po->chan));
565 	}
566 }
567 #endif
568 
569 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
570  */
571 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
572 			    int sockaddr_len, int flags)
573 {
574 	struct sock *sk = sock->sk;
575 	struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr;
576 	struct pppox_sock *po = pppox_sk(sk);
577 	struct l2tp_session *session = NULL;
578 	struct l2tp_tunnel *tunnel;
579 	struct pppol2tp_session *ps;
580 	struct dst_entry *dst;
581 	struct l2tp_session_cfg cfg = { 0, };
582 	int error = 0;
583 	u32 tunnel_id, peer_tunnel_id;
584 	u32 session_id, peer_session_id;
585 	int ver = 2;
586 	int fd;
587 
588 	lock_sock(sk);
589 
590 	error = -EINVAL;
591 	if (sp->sa_protocol != PX_PROTO_OL2TP)
592 		goto end;
593 
594 	/* Check for already bound sockets */
595 	error = -EBUSY;
596 	if (sk->sk_state & PPPOX_CONNECTED)
597 		goto end;
598 
599 	/* We don't supporting rebinding anyway */
600 	error = -EALREADY;
601 	if (sk->sk_user_data)
602 		goto end; /* socket is already attached */
603 
604 	/* Get params from socket address. Handle L2TPv2 and L2TPv3.
605 	 * This is nasty because there are different sockaddr_pppol2tp
606 	 * structs for L2TPv2, L2TPv3, over IPv4 and IPv6. We use
607 	 * the sockaddr size to determine which structure the caller
608 	 * is using.
609 	 */
610 	peer_tunnel_id = 0;
611 	if (sockaddr_len == sizeof(struct sockaddr_pppol2tp)) {
612 		fd = sp->pppol2tp.fd;
613 		tunnel_id = sp->pppol2tp.s_tunnel;
614 		peer_tunnel_id = sp->pppol2tp.d_tunnel;
615 		session_id = sp->pppol2tp.s_session;
616 		peer_session_id = sp->pppol2tp.d_session;
617 	} else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3)) {
618 		struct sockaddr_pppol2tpv3 *sp3 =
619 			(struct sockaddr_pppol2tpv3 *) sp;
620 		ver = 3;
621 		fd = sp3->pppol2tp.fd;
622 		tunnel_id = sp3->pppol2tp.s_tunnel;
623 		peer_tunnel_id = sp3->pppol2tp.d_tunnel;
624 		session_id = sp3->pppol2tp.s_session;
625 		peer_session_id = sp3->pppol2tp.d_session;
626 	} else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpin6)) {
627 		struct sockaddr_pppol2tpin6 *sp6 =
628 			(struct sockaddr_pppol2tpin6 *) sp;
629 		fd = sp6->pppol2tp.fd;
630 		tunnel_id = sp6->pppol2tp.s_tunnel;
631 		peer_tunnel_id = sp6->pppol2tp.d_tunnel;
632 		session_id = sp6->pppol2tp.s_session;
633 		peer_session_id = sp6->pppol2tp.d_session;
634 	} else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3in6)) {
635 		struct sockaddr_pppol2tpv3in6 *sp6 =
636 			(struct sockaddr_pppol2tpv3in6 *) sp;
637 		ver = 3;
638 		fd = sp6->pppol2tp.fd;
639 		tunnel_id = sp6->pppol2tp.s_tunnel;
640 		peer_tunnel_id = sp6->pppol2tp.d_tunnel;
641 		session_id = sp6->pppol2tp.s_session;
642 		peer_session_id = sp6->pppol2tp.d_session;
643 	} else {
644 		error = -EINVAL;
645 		goto end; /* bad socket address */
646 	}
647 
648 	/* Don't bind if tunnel_id is 0 */
649 	error = -EINVAL;
650 	if (tunnel_id == 0)
651 		goto end;
652 
653 	tunnel = l2tp_tunnel_find(sock_net(sk), tunnel_id);
654 
655 	/* Special case: create tunnel context if session_id and
656 	 * peer_session_id is 0. Otherwise look up tunnel using supplied
657 	 * tunnel id.
658 	 */
659 	if ((session_id == 0) && (peer_session_id == 0)) {
660 		if (tunnel == NULL) {
661 			struct l2tp_tunnel_cfg tcfg = {
662 				.encap = L2TP_ENCAPTYPE_UDP,
663 				.debug = 0,
664 			};
665 			error = l2tp_tunnel_create(sock_net(sk), fd, ver, tunnel_id, peer_tunnel_id, &tcfg, &tunnel);
666 			if (error < 0)
667 				goto end;
668 		}
669 	} else {
670 		/* Error if we can't find the tunnel */
671 		error = -ENOENT;
672 		if (tunnel == NULL)
673 			goto end;
674 
675 		/* Error if socket is not prepped */
676 		if (tunnel->sock == NULL)
677 			goto end;
678 	}
679 
680 	if (tunnel->recv_payload_hook == NULL)
681 		tunnel->recv_payload_hook = pppol2tp_recv_payload_hook;
682 
683 	if (tunnel->peer_tunnel_id == 0)
684 		tunnel->peer_tunnel_id = peer_tunnel_id;
685 
686 	/* Create session if it doesn't already exist. We handle the
687 	 * case where a session was previously created by the netlink
688 	 * interface by checking that the session doesn't already have
689 	 * a socket and its tunnel socket are what we expect. If any
690 	 * of those checks fail, return EEXIST to the caller.
691 	 */
692 	session = l2tp_session_find(sock_net(sk), tunnel, session_id);
693 	if (session == NULL) {
694 		/* Default MTU must allow space for UDP/L2TP/PPP
695 		 * headers.
696 		 */
697 		cfg.mtu = cfg.mru = 1500 - PPPOL2TP_HEADER_OVERHEAD;
698 
699 		/* Allocate and initialize a new session context. */
700 		session = l2tp_session_create(sizeof(struct pppol2tp_session),
701 					      tunnel, session_id,
702 					      peer_session_id, &cfg);
703 		if (session == NULL) {
704 			error = -ENOMEM;
705 			goto end;
706 		}
707 	} else {
708 		ps = l2tp_session_priv(session);
709 		error = -EEXIST;
710 		if (ps->sock != NULL)
711 			goto end;
712 
713 		/* consistency checks */
714 		if (ps->tunnel_sock != tunnel->sock)
715 			goto end;
716 	}
717 
718 	/* Associate session with its PPPoL2TP socket */
719 	ps = l2tp_session_priv(session);
720 	ps->owner	     = current->pid;
721 	ps->sock	     = sk;
722 	ps->tunnel_sock = tunnel->sock;
723 
724 	session->recv_skb	= pppol2tp_recv;
725 	session->session_close	= pppol2tp_session_close;
726 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS)
727 	session->show		= pppol2tp_show;
728 #endif
729 
730 	/* We need to know each time a skb is dropped from the reorder
731 	 * queue.
732 	 */
733 	session->ref = pppol2tp_session_sock_hold;
734 	session->deref = pppol2tp_session_sock_put;
735 
736 	/* If PMTU discovery was enabled, use the MTU that was discovered */
737 	dst = sk_dst_get(tunnel->sock);
738 	if (dst != NULL) {
739 		u32 pmtu = dst_mtu(dst);
740 
741 		if (pmtu != 0)
742 			session->mtu = session->mru = pmtu -
743 				PPPOL2TP_HEADER_OVERHEAD;
744 		dst_release(dst);
745 	}
746 
747 	/* Special case: if source & dest session_id == 0x0000, this
748 	 * socket is being created to manage the tunnel. Just set up
749 	 * the internal context for use by ioctl() and sockopt()
750 	 * handlers.
751 	 */
752 	if ((session->session_id == 0) &&
753 	    (session->peer_session_id == 0)) {
754 		error = 0;
755 		goto out_no_ppp;
756 	}
757 
758 	/* The only header we need to worry about is the L2TP
759 	 * header. This size is different depending on whether
760 	 * sequence numbers are enabled for the data channel.
761 	 */
762 	po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
763 
764 	po->chan.private = sk;
765 	po->chan.ops	 = &pppol2tp_chan_ops;
766 	po->chan.mtu	 = session->mtu;
767 
768 	error = ppp_register_net_channel(sock_net(sk), &po->chan);
769 	if (error)
770 		goto end;
771 
772 out_no_ppp:
773 	/* This is how we get the session context from the socket. */
774 	sk->sk_user_data = session;
775 	sk->sk_state = PPPOX_CONNECTED;
776 	l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: created\n",
777 		  session->name);
778 
779 end:
780 	release_sock(sk);
781 
782 	return error;
783 }
784 
785 #ifdef CONFIG_L2TP_V3
786 
787 /* Called when creating sessions via the netlink interface.
788  */
789 static int pppol2tp_session_create(struct net *net, u32 tunnel_id, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
790 {
791 	int error;
792 	struct l2tp_tunnel *tunnel;
793 	struct l2tp_session *session;
794 	struct pppol2tp_session *ps;
795 
796 	tunnel = l2tp_tunnel_find(net, tunnel_id);
797 
798 	/* Error if we can't find the tunnel */
799 	error = -ENOENT;
800 	if (tunnel == NULL)
801 		goto out;
802 
803 	/* Error if tunnel socket is not prepped */
804 	if (tunnel->sock == NULL)
805 		goto out;
806 
807 	/* Check that this session doesn't already exist */
808 	error = -EEXIST;
809 	session = l2tp_session_find(net, tunnel, session_id);
810 	if (session != NULL)
811 		goto out;
812 
813 	/* Default MTU values. */
814 	if (cfg->mtu == 0)
815 		cfg->mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD;
816 	if (cfg->mru == 0)
817 		cfg->mru = cfg->mtu;
818 
819 	/* Allocate and initialize a new session context. */
820 	error = -ENOMEM;
821 	session = l2tp_session_create(sizeof(struct pppol2tp_session),
822 				      tunnel, session_id,
823 				      peer_session_id, cfg);
824 	if (session == NULL)
825 		goto out;
826 
827 	ps = l2tp_session_priv(session);
828 	ps->tunnel_sock = tunnel->sock;
829 
830 	l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: created\n",
831 		  session->name);
832 
833 	error = 0;
834 
835 out:
836 	return error;
837 }
838 
839 #endif /* CONFIG_L2TP_V3 */
840 
841 /* getname() support.
842  */
843 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
844 			    int *usockaddr_len, int peer)
845 {
846 	int len = 0;
847 	int error = 0;
848 	struct l2tp_session *session;
849 	struct l2tp_tunnel *tunnel;
850 	struct sock *sk = sock->sk;
851 	struct inet_sock *inet;
852 	struct pppol2tp_session *pls;
853 
854 	error = -ENOTCONN;
855 	if (sk == NULL)
856 		goto end;
857 	if (!(sk->sk_state & PPPOX_CONNECTED))
858 		goto end;
859 
860 	error = -EBADF;
861 	session = pppol2tp_sock_to_session(sk);
862 	if (session == NULL)
863 		goto end;
864 
865 	pls = l2tp_session_priv(session);
866 	tunnel = l2tp_sock_to_tunnel(pls->tunnel_sock);
867 	if (tunnel == NULL)
868 		goto end_put_sess;
869 
870 	inet = inet_sk(tunnel->sock);
871 	if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) {
872 		struct sockaddr_pppol2tp sp;
873 		len = sizeof(sp);
874 		memset(&sp, 0, len);
875 		sp.sa_family	= AF_PPPOX;
876 		sp.sa_protocol	= PX_PROTO_OL2TP;
877 		sp.pppol2tp.fd  = tunnel->fd;
878 		sp.pppol2tp.pid = pls->owner;
879 		sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
880 		sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
881 		sp.pppol2tp.s_session = session->session_id;
882 		sp.pppol2tp.d_session = session->peer_session_id;
883 		sp.pppol2tp.addr.sin_family = AF_INET;
884 		sp.pppol2tp.addr.sin_port = inet->inet_dport;
885 		sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
886 		memcpy(uaddr, &sp, len);
887 #if IS_ENABLED(CONFIG_IPV6)
888 	} else if ((tunnel->version == 2) &&
889 		   (tunnel->sock->sk_family == AF_INET6)) {
890 		struct sockaddr_pppol2tpin6 sp;
891 
892 		len = sizeof(sp);
893 		memset(&sp, 0, len);
894 		sp.sa_family	= AF_PPPOX;
895 		sp.sa_protocol	= PX_PROTO_OL2TP;
896 		sp.pppol2tp.fd  = tunnel->fd;
897 		sp.pppol2tp.pid = pls->owner;
898 		sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
899 		sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
900 		sp.pppol2tp.s_session = session->session_id;
901 		sp.pppol2tp.d_session = session->peer_session_id;
902 		sp.pppol2tp.addr.sin6_family = AF_INET6;
903 		sp.pppol2tp.addr.sin6_port = inet->inet_dport;
904 		memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
905 		       sizeof(tunnel->sock->sk_v6_daddr));
906 		memcpy(uaddr, &sp, len);
907 	} else if ((tunnel->version == 3) &&
908 		   (tunnel->sock->sk_family == AF_INET6)) {
909 		struct sockaddr_pppol2tpv3in6 sp;
910 
911 		len = sizeof(sp);
912 		memset(&sp, 0, len);
913 		sp.sa_family	= AF_PPPOX;
914 		sp.sa_protocol	= PX_PROTO_OL2TP;
915 		sp.pppol2tp.fd  = tunnel->fd;
916 		sp.pppol2tp.pid = pls->owner;
917 		sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
918 		sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
919 		sp.pppol2tp.s_session = session->session_id;
920 		sp.pppol2tp.d_session = session->peer_session_id;
921 		sp.pppol2tp.addr.sin6_family = AF_INET6;
922 		sp.pppol2tp.addr.sin6_port = inet->inet_dport;
923 		memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
924 		       sizeof(tunnel->sock->sk_v6_daddr));
925 		memcpy(uaddr, &sp, len);
926 #endif
927 	} else if (tunnel->version == 3) {
928 		struct sockaddr_pppol2tpv3 sp;
929 		len = sizeof(sp);
930 		memset(&sp, 0, len);
931 		sp.sa_family	= AF_PPPOX;
932 		sp.sa_protocol	= PX_PROTO_OL2TP;
933 		sp.pppol2tp.fd  = tunnel->fd;
934 		sp.pppol2tp.pid = pls->owner;
935 		sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
936 		sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
937 		sp.pppol2tp.s_session = session->session_id;
938 		sp.pppol2tp.d_session = session->peer_session_id;
939 		sp.pppol2tp.addr.sin_family = AF_INET;
940 		sp.pppol2tp.addr.sin_port = inet->inet_dport;
941 		sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
942 		memcpy(uaddr, &sp, len);
943 	}
944 
945 	*usockaddr_len = len;
946 	error = 0;
947 
948 	sock_put(pls->tunnel_sock);
949 end_put_sess:
950 	sock_put(sk);
951 end:
952 	return error;
953 }
954 
955 /****************************************************************************
956  * ioctl() handlers.
957  *
958  * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
959  * sockets. However, in order to control kernel tunnel features, we allow
960  * userspace to create a special "tunnel" PPPoX socket which is used for
961  * control only.  Tunnel PPPoX sockets have session_id == 0 and simply allow
962  * the user application to issue L2TP setsockopt(), getsockopt() and ioctl()
963  * calls.
964  ****************************************************************************/
965 
966 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest,
967 				struct l2tp_stats *stats)
968 {
969 	dest->tx_packets = atomic_long_read(&stats->tx_packets);
970 	dest->tx_bytes = atomic_long_read(&stats->tx_bytes);
971 	dest->tx_errors = atomic_long_read(&stats->tx_errors);
972 	dest->rx_packets = atomic_long_read(&stats->rx_packets);
973 	dest->rx_bytes = atomic_long_read(&stats->rx_bytes);
974 	dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards);
975 	dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets);
976 	dest->rx_errors = atomic_long_read(&stats->rx_errors);
977 }
978 
979 /* Session ioctl helper.
980  */
981 static int pppol2tp_session_ioctl(struct l2tp_session *session,
982 				  unsigned int cmd, unsigned long arg)
983 {
984 	struct ifreq ifr;
985 	int err = 0;
986 	struct sock *sk;
987 	int val = (int) arg;
988 	struct pppol2tp_session *ps = l2tp_session_priv(session);
989 	struct l2tp_tunnel *tunnel = session->tunnel;
990 	struct pppol2tp_ioc_stats stats;
991 
992 	l2tp_dbg(session, PPPOL2TP_MSG_CONTROL,
993 		 "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n",
994 		 session->name, cmd, arg);
995 
996 	sk = ps->sock;
997 	sock_hold(sk);
998 
999 	switch (cmd) {
1000 	case SIOCGIFMTU:
1001 		err = -ENXIO;
1002 		if (!(sk->sk_state & PPPOX_CONNECTED))
1003 			break;
1004 
1005 		err = -EFAULT;
1006 		if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq)))
1007 			break;
1008 		ifr.ifr_mtu = session->mtu;
1009 		if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq)))
1010 			break;
1011 
1012 		l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: get mtu=%d\n",
1013 			  session->name, session->mtu);
1014 		err = 0;
1015 		break;
1016 
1017 	case SIOCSIFMTU:
1018 		err = -ENXIO;
1019 		if (!(sk->sk_state & PPPOX_CONNECTED))
1020 			break;
1021 
1022 		err = -EFAULT;
1023 		if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq)))
1024 			break;
1025 
1026 		session->mtu = ifr.ifr_mtu;
1027 
1028 		l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: set mtu=%d\n",
1029 			  session->name, session->mtu);
1030 		err = 0;
1031 		break;
1032 
1033 	case PPPIOCGMRU:
1034 		err = -ENXIO;
1035 		if (!(sk->sk_state & PPPOX_CONNECTED))
1036 			break;
1037 
1038 		err = -EFAULT;
1039 		if (put_user(session->mru, (int __user *) arg))
1040 			break;
1041 
1042 		l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: get mru=%d\n",
1043 			  session->name, session->mru);
1044 		err = 0;
1045 		break;
1046 
1047 	case PPPIOCSMRU:
1048 		err = -ENXIO;
1049 		if (!(sk->sk_state & PPPOX_CONNECTED))
1050 			break;
1051 
1052 		err = -EFAULT;
1053 		if (get_user(val, (int __user *) arg))
1054 			break;
1055 
1056 		session->mru = val;
1057 		l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: set mru=%d\n",
1058 			  session->name, session->mru);
1059 		err = 0;
1060 		break;
1061 
1062 	case PPPIOCGFLAGS:
1063 		err = -EFAULT;
1064 		if (put_user(ps->flags, (int __user *) arg))
1065 			break;
1066 
1067 		l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: get flags=%d\n",
1068 			  session->name, ps->flags);
1069 		err = 0;
1070 		break;
1071 
1072 	case PPPIOCSFLAGS:
1073 		err = -EFAULT;
1074 		if (get_user(val, (int __user *) arg))
1075 			break;
1076 		ps->flags = val;
1077 		l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: set flags=%d\n",
1078 			  session->name, ps->flags);
1079 		err = 0;
1080 		break;
1081 
1082 	case PPPIOCGL2TPSTATS:
1083 		err = -ENXIO;
1084 		if (!(sk->sk_state & PPPOX_CONNECTED))
1085 			break;
1086 
1087 		memset(&stats, 0, sizeof(stats));
1088 		stats.tunnel_id = tunnel->tunnel_id;
1089 		stats.session_id = session->session_id;
1090 		pppol2tp_copy_stats(&stats, &session->stats);
1091 		if (copy_to_user((void __user *) arg, &stats,
1092 				 sizeof(stats)))
1093 			break;
1094 		l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: get L2TP stats\n",
1095 			  session->name);
1096 		err = 0;
1097 		break;
1098 
1099 	default:
1100 		err = -ENOSYS;
1101 		break;
1102 	}
1103 
1104 	sock_put(sk);
1105 
1106 	return err;
1107 }
1108 
1109 /* Tunnel ioctl helper.
1110  *
1111  * Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data
1112  * specifies a session_id, the session ioctl handler is called. This allows an
1113  * application to retrieve session stats via a tunnel socket.
1114  */
1115 static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel,
1116 				 unsigned int cmd, unsigned long arg)
1117 {
1118 	int err = 0;
1119 	struct sock *sk;
1120 	struct pppol2tp_ioc_stats stats;
1121 
1122 	l2tp_dbg(tunnel, PPPOL2TP_MSG_CONTROL,
1123 		 "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n",
1124 		 tunnel->name, cmd, arg);
1125 
1126 	sk = tunnel->sock;
1127 	sock_hold(sk);
1128 
1129 	switch (cmd) {
1130 	case PPPIOCGL2TPSTATS:
1131 		err = -ENXIO;
1132 		if (!(sk->sk_state & PPPOX_CONNECTED))
1133 			break;
1134 
1135 		if (copy_from_user(&stats, (void __user *) arg,
1136 				   sizeof(stats))) {
1137 			err = -EFAULT;
1138 			break;
1139 		}
1140 		if (stats.session_id != 0) {
1141 			/* resend to session ioctl handler */
1142 			struct l2tp_session *session =
1143 				l2tp_session_find(sock_net(sk), tunnel, stats.session_id);
1144 			if (session != NULL)
1145 				err = pppol2tp_session_ioctl(session, cmd, arg);
1146 			else
1147 				err = -EBADR;
1148 			break;
1149 		}
1150 #ifdef CONFIG_XFRM
1151 		stats.using_ipsec = (sk->sk_policy[0] || sk->sk_policy[1]) ? 1 : 0;
1152 #endif
1153 		pppol2tp_copy_stats(&stats, &tunnel->stats);
1154 		if (copy_to_user((void __user *) arg, &stats, sizeof(stats))) {
1155 			err = -EFAULT;
1156 			break;
1157 		}
1158 		l2tp_info(tunnel, PPPOL2TP_MSG_CONTROL, "%s: get L2TP stats\n",
1159 			  tunnel->name);
1160 		err = 0;
1161 		break;
1162 
1163 	default:
1164 		err = -ENOSYS;
1165 		break;
1166 	}
1167 
1168 	sock_put(sk);
1169 
1170 	return err;
1171 }
1172 
1173 /* Main ioctl() handler.
1174  * Dispatch to tunnel or session helpers depending on the socket.
1175  */
1176 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
1177 			  unsigned long arg)
1178 {
1179 	struct sock *sk = sock->sk;
1180 	struct l2tp_session *session;
1181 	struct l2tp_tunnel *tunnel;
1182 	struct pppol2tp_session *ps;
1183 	int err;
1184 
1185 	if (!sk)
1186 		return 0;
1187 
1188 	err = -EBADF;
1189 	if (sock_flag(sk, SOCK_DEAD) != 0)
1190 		goto end;
1191 
1192 	err = -ENOTCONN;
1193 	if ((sk->sk_user_data == NULL) ||
1194 	    (!(sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND))))
1195 		goto end;
1196 
1197 	/* Get session context from the socket */
1198 	err = -EBADF;
1199 	session = pppol2tp_sock_to_session(sk);
1200 	if (session == NULL)
1201 		goto end;
1202 
1203 	/* Special case: if session's session_id is zero, treat ioctl as a
1204 	 * tunnel ioctl
1205 	 */
1206 	ps = l2tp_session_priv(session);
1207 	if ((session->session_id == 0) &&
1208 	    (session->peer_session_id == 0)) {
1209 		err = -EBADF;
1210 		tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
1211 		if (tunnel == NULL)
1212 			goto end_put_sess;
1213 
1214 		err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg);
1215 		sock_put(ps->tunnel_sock);
1216 		goto end_put_sess;
1217 	}
1218 
1219 	err = pppol2tp_session_ioctl(session, cmd, arg);
1220 
1221 end_put_sess:
1222 	sock_put(sk);
1223 end:
1224 	return err;
1225 }
1226 
1227 /*****************************************************************************
1228  * setsockopt() / getsockopt() support.
1229  *
1230  * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
1231  * sockets. In order to control kernel tunnel features, we allow userspace to
1232  * create a special "tunnel" PPPoX socket which is used for control only.
1233  * Tunnel PPPoX sockets have session_id == 0 and simply allow the user
1234  * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls.
1235  *****************************************************************************/
1236 
1237 /* Tunnel setsockopt() helper.
1238  */
1239 static int pppol2tp_tunnel_setsockopt(struct sock *sk,
1240 				      struct l2tp_tunnel *tunnel,
1241 				      int optname, int val)
1242 {
1243 	int err = 0;
1244 
1245 	switch (optname) {
1246 	case PPPOL2TP_SO_DEBUG:
1247 		tunnel->debug = val;
1248 		l2tp_info(tunnel, PPPOL2TP_MSG_CONTROL, "%s: set debug=%x\n",
1249 			  tunnel->name, tunnel->debug);
1250 		break;
1251 
1252 	default:
1253 		err = -ENOPROTOOPT;
1254 		break;
1255 	}
1256 
1257 	return err;
1258 }
1259 
1260 /* Session setsockopt helper.
1261  */
1262 static int pppol2tp_session_setsockopt(struct sock *sk,
1263 				       struct l2tp_session *session,
1264 				       int optname, int val)
1265 {
1266 	int err = 0;
1267 	struct pppol2tp_session *ps = l2tp_session_priv(session);
1268 
1269 	switch (optname) {
1270 	case PPPOL2TP_SO_RECVSEQ:
1271 		if ((val != 0) && (val != 1)) {
1272 			err = -EINVAL;
1273 			break;
1274 		}
1275 		session->recv_seq = val ? -1 : 0;
1276 		l2tp_info(session, PPPOL2TP_MSG_CONTROL,
1277 			  "%s: set recv_seq=%d\n",
1278 			  session->name, session->recv_seq);
1279 		break;
1280 
1281 	case PPPOL2TP_SO_SENDSEQ:
1282 		if ((val != 0) && (val != 1)) {
1283 			err = -EINVAL;
1284 			break;
1285 		}
1286 		session->send_seq = val ? -1 : 0;
1287 		{
1288 			struct sock *ssk      = ps->sock;
1289 			struct pppox_sock *po = pppox_sk(ssk);
1290 			po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
1291 				PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
1292 		}
1293 		l2tp_session_set_header_len(session, session->tunnel->version);
1294 		l2tp_info(session, PPPOL2TP_MSG_CONTROL,
1295 			  "%s: set send_seq=%d\n",
1296 			  session->name, session->send_seq);
1297 		break;
1298 
1299 	case PPPOL2TP_SO_LNSMODE:
1300 		if ((val != 0) && (val != 1)) {
1301 			err = -EINVAL;
1302 			break;
1303 		}
1304 		session->lns_mode = val ? -1 : 0;
1305 		l2tp_info(session, PPPOL2TP_MSG_CONTROL,
1306 			  "%s: set lns_mode=%d\n",
1307 			  session->name, session->lns_mode);
1308 		break;
1309 
1310 	case PPPOL2TP_SO_DEBUG:
1311 		session->debug = val;
1312 		l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: set debug=%x\n",
1313 			  session->name, session->debug);
1314 		break;
1315 
1316 	case PPPOL2TP_SO_REORDERTO:
1317 		session->reorder_timeout = msecs_to_jiffies(val);
1318 		l2tp_info(session, PPPOL2TP_MSG_CONTROL,
1319 			  "%s: set reorder_timeout=%d\n",
1320 			  session->name, session->reorder_timeout);
1321 		break;
1322 
1323 	default:
1324 		err = -ENOPROTOOPT;
1325 		break;
1326 	}
1327 
1328 	return err;
1329 }
1330 
1331 /* Main setsockopt() entry point.
1332  * Does API checks, then calls either the tunnel or session setsockopt
1333  * handler, according to whether the PPPoL2TP socket is a for a regular
1334  * session or the special tunnel type.
1335  */
1336 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
1337 			       char __user *optval, unsigned int optlen)
1338 {
1339 	struct sock *sk = sock->sk;
1340 	struct l2tp_session *session;
1341 	struct l2tp_tunnel *tunnel;
1342 	struct pppol2tp_session *ps;
1343 	int val;
1344 	int err;
1345 
1346 	if (level != SOL_PPPOL2TP)
1347 		return -EINVAL;
1348 
1349 	if (optlen < sizeof(int))
1350 		return -EINVAL;
1351 
1352 	if (get_user(val, (int __user *)optval))
1353 		return -EFAULT;
1354 
1355 	err = -ENOTCONN;
1356 	if (sk->sk_user_data == NULL)
1357 		goto end;
1358 
1359 	/* Get session context from the socket */
1360 	err = -EBADF;
1361 	session = pppol2tp_sock_to_session(sk);
1362 	if (session == NULL)
1363 		goto end;
1364 
1365 	/* Special case: if session_id == 0x0000, treat as operation on tunnel
1366 	 */
1367 	ps = l2tp_session_priv(session);
1368 	if ((session->session_id == 0) &&
1369 	    (session->peer_session_id == 0)) {
1370 		err = -EBADF;
1371 		tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
1372 		if (tunnel == NULL)
1373 			goto end_put_sess;
1374 
1375 		err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
1376 		sock_put(ps->tunnel_sock);
1377 	} else
1378 		err = pppol2tp_session_setsockopt(sk, session, optname, val);
1379 
1380 	err = 0;
1381 
1382 end_put_sess:
1383 	sock_put(sk);
1384 end:
1385 	return err;
1386 }
1387 
1388 /* Tunnel getsockopt helper. Called with sock locked.
1389  */
1390 static int pppol2tp_tunnel_getsockopt(struct sock *sk,
1391 				      struct l2tp_tunnel *tunnel,
1392 				      int optname, int *val)
1393 {
1394 	int err = 0;
1395 
1396 	switch (optname) {
1397 	case PPPOL2TP_SO_DEBUG:
1398 		*val = tunnel->debug;
1399 		l2tp_info(tunnel, PPPOL2TP_MSG_CONTROL, "%s: get debug=%x\n",
1400 			  tunnel->name, tunnel->debug);
1401 		break;
1402 
1403 	default:
1404 		err = -ENOPROTOOPT;
1405 		break;
1406 	}
1407 
1408 	return err;
1409 }
1410 
1411 /* Session getsockopt helper. Called with sock locked.
1412  */
1413 static int pppol2tp_session_getsockopt(struct sock *sk,
1414 				       struct l2tp_session *session,
1415 				       int optname, int *val)
1416 {
1417 	int err = 0;
1418 
1419 	switch (optname) {
1420 	case PPPOL2TP_SO_RECVSEQ:
1421 		*val = session->recv_seq;
1422 		l2tp_info(session, PPPOL2TP_MSG_CONTROL,
1423 			  "%s: get recv_seq=%d\n", session->name, *val);
1424 		break;
1425 
1426 	case PPPOL2TP_SO_SENDSEQ:
1427 		*val = session->send_seq;
1428 		l2tp_info(session, PPPOL2TP_MSG_CONTROL,
1429 			  "%s: get send_seq=%d\n", session->name, *val);
1430 		break;
1431 
1432 	case PPPOL2TP_SO_LNSMODE:
1433 		*val = session->lns_mode;
1434 		l2tp_info(session, PPPOL2TP_MSG_CONTROL,
1435 			  "%s: get lns_mode=%d\n", session->name, *val);
1436 		break;
1437 
1438 	case PPPOL2TP_SO_DEBUG:
1439 		*val = session->debug;
1440 		l2tp_info(session, PPPOL2TP_MSG_CONTROL, "%s: get debug=%d\n",
1441 			  session->name, *val);
1442 		break;
1443 
1444 	case PPPOL2TP_SO_REORDERTO:
1445 		*val = (int) jiffies_to_msecs(session->reorder_timeout);
1446 		l2tp_info(session, PPPOL2TP_MSG_CONTROL,
1447 			  "%s: get reorder_timeout=%d\n", session->name, *val);
1448 		break;
1449 
1450 	default:
1451 		err = -ENOPROTOOPT;
1452 	}
1453 
1454 	return err;
1455 }
1456 
1457 /* Main getsockopt() entry point.
1458  * Does API checks, then calls either the tunnel or session getsockopt
1459  * handler, according to whether the PPPoX socket is a for a regular session
1460  * or the special tunnel type.
1461  */
1462 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
1463 			       char __user *optval, int __user *optlen)
1464 {
1465 	struct sock *sk = sock->sk;
1466 	struct l2tp_session *session;
1467 	struct l2tp_tunnel *tunnel;
1468 	int val, len;
1469 	int err;
1470 	struct pppol2tp_session *ps;
1471 
1472 	if (level != SOL_PPPOL2TP)
1473 		return -EINVAL;
1474 
1475 	if (get_user(len, optlen))
1476 		return -EFAULT;
1477 
1478 	len = min_t(unsigned int, len, sizeof(int));
1479 
1480 	if (len < 0)
1481 		return -EINVAL;
1482 
1483 	err = -ENOTCONN;
1484 	if (sk->sk_user_data == NULL)
1485 		goto end;
1486 
1487 	/* Get the session context */
1488 	err = -EBADF;
1489 	session = pppol2tp_sock_to_session(sk);
1490 	if (session == NULL)
1491 		goto end;
1492 
1493 	/* Special case: if session_id == 0x0000, treat as operation on tunnel */
1494 	ps = l2tp_session_priv(session);
1495 	if ((session->session_id == 0) &&
1496 	    (session->peer_session_id == 0)) {
1497 		err = -EBADF;
1498 		tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
1499 		if (tunnel == NULL)
1500 			goto end_put_sess;
1501 
1502 		err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
1503 		sock_put(ps->tunnel_sock);
1504 	} else
1505 		err = pppol2tp_session_getsockopt(sk, session, optname, &val);
1506 
1507 	err = -EFAULT;
1508 	if (put_user(len, optlen))
1509 		goto end_put_sess;
1510 
1511 	if (copy_to_user((void __user *) optval, &val, len))
1512 		goto end_put_sess;
1513 
1514 	err = 0;
1515 
1516 end_put_sess:
1517 	sock_put(sk);
1518 end:
1519 	return err;
1520 }
1521 
1522 /*****************************************************************************
1523  * /proc filesystem for debug
1524  * Since the original pppol2tp driver provided /proc/net/pppol2tp for
1525  * L2TPv2, we dump only L2TPv2 tunnels and sessions here.
1526  *****************************************************************************/
1527 
1528 static unsigned int pppol2tp_net_id;
1529 
1530 #ifdef CONFIG_PROC_FS
1531 
1532 struct pppol2tp_seq_data {
1533 	struct seq_net_private p;
1534 	int tunnel_idx;			/* current tunnel */
1535 	int session_idx;		/* index of session within current tunnel */
1536 	struct l2tp_tunnel *tunnel;
1537 	struct l2tp_session *session;	/* NULL means get next tunnel */
1538 };
1539 
1540 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
1541 {
1542 	for (;;) {
1543 		pd->tunnel = l2tp_tunnel_find_nth(net, pd->tunnel_idx);
1544 		pd->tunnel_idx++;
1545 
1546 		if (pd->tunnel == NULL)
1547 			break;
1548 
1549 		/* Ignore L2TPv3 tunnels */
1550 		if (pd->tunnel->version < 3)
1551 			break;
1552 	}
1553 }
1554 
1555 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
1556 {
1557 	pd->session = l2tp_session_find_nth(pd->tunnel, pd->session_idx);
1558 	pd->session_idx++;
1559 
1560 	if (pd->session == NULL) {
1561 		pd->session_idx = 0;
1562 		pppol2tp_next_tunnel(net, pd);
1563 	}
1564 }
1565 
1566 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs)
1567 {
1568 	struct pppol2tp_seq_data *pd = SEQ_START_TOKEN;
1569 	loff_t pos = *offs;
1570 	struct net *net;
1571 
1572 	if (!pos)
1573 		goto out;
1574 
1575 	BUG_ON(m->private == NULL);
1576 	pd = m->private;
1577 	net = seq_file_net(m);
1578 
1579 	if (pd->tunnel == NULL)
1580 		pppol2tp_next_tunnel(net, pd);
1581 	else
1582 		pppol2tp_next_session(net, pd);
1583 
1584 	/* NULL tunnel and session indicates end of list */
1585 	if ((pd->tunnel == NULL) && (pd->session == NULL))
1586 		pd = NULL;
1587 
1588 out:
1589 	return pd;
1590 }
1591 
1592 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos)
1593 {
1594 	(*pos)++;
1595 	return NULL;
1596 }
1597 
1598 static void pppol2tp_seq_stop(struct seq_file *p, void *v)
1599 {
1600 	/* nothing to do */
1601 }
1602 
1603 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
1604 {
1605 	struct l2tp_tunnel *tunnel = v;
1606 
1607 	seq_printf(m, "\nTUNNEL '%s', %c %d\n",
1608 		   tunnel->name,
1609 		   (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N',
1610 		   atomic_read(&tunnel->ref_count) - 1);
1611 	seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n",
1612 		   tunnel->debug,
1613 		   atomic_long_read(&tunnel->stats.tx_packets),
1614 		   atomic_long_read(&tunnel->stats.tx_bytes),
1615 		   atomic_long_read(&tunnel->stats.tx_errors),
1616 		   atomic_long_read(&tunnel->stats.rx_packets),
1617 		   atomic_long_read(&tunnel->stats.rx_bytes),
1618 		   atomic_long_read(&tunnel->stats.rx_errors));
1619 }
1620 
1621 static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
1622 {
1623 	struct l2tp_session *session = v;
1624 	struct l2tp_tunnel *tunnel = session->tunnel;
1625 	struct pppol2tp_session *ps = l2tp_session_priv(session);
1626 	struct pppox_sock *po = pppox_sk(ps->sock);
1627 	u32 ip = 0;
1628 	u16 port = 0;
1629 
1630 	if (tunnel->sock) {
1631 		struct inet_sock *inet = inet_sk(tunnel->sock);
1632 		ip = ntohl(inet->inet_saddr);
1633 		port = ntohs(inet->inet_sport);
1634 	}
1635 
1636 	seq_printf(m, "  SESSION '%s' %08X/%d %04X/%04X -> "
1637 		   "%04X/%04X %d %c\n",
1638 		   session->name, ip, port,
1639 		   tunnel->tunnel_id,
1640 		   session->session_id,
1641 		   tunnel->peer_tunnel_id,
1642 		   session->peer_session_id,
1643 		   ps->sock->sk_state,
1644 		   (session == ps->sock->sk_user_data) ?
1645 		   'Y' : 'N');
1646 	seq_printf(m, "   %d/%d/%c/%c/%s %08x %u\n",
1647 		   session->mtu, session->mru,
1648 		   session->recv_seq ? 'R' : '-',
1649 		   session->send_seq ? 'S' : '-',
1650 		   session->lns_mode ? "LNS" : "LAC",
1651 		   session->debug,
1652 		   jiffies_to_msecs(session->reorder_timeout));
1653 	seq_printf(m, "   %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n",
1654 		   session->nr, session->ns,
1655 		   atomic_long_read(&session->stats.tx_packets),
1656 		   atomic_long_read(&session->stats.tx_bytes),
1657 		   atomic_long_read(&session->stats.tx_errors),
1658 		   atomic_long_read(&session->stats.rx_packets),
1659 		   atomic_long_read(&session->stats.rx_bytes),
1660 		   atomic_long_read(&session->stats.rx_errors));
1661 
1662 	if (po)
1663 		seq_printf(m, "   interface %s\n", ppp_dev_name(&po->chan));
1664 }
1665 
1666 static int pppol2tp_seq_show(struct seq_file *m, void *v)
1667 {
1668 	struct pppol2tp_seq_data *pd = v;
1669 
1670 	/* display header on line 1 */
1671 	if (v == SEQ_START_TOKEN) {
1672 		seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n");
1673 		seq_puts(m, "TUNNEL name, user-data-ok session-count\n");
1674 		seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1675 		seq_puts(m, "  SESSION name, addr/port src-tid/sid "
1676 			 "dest-tid/sid state user-data-ok\n");
1677 		seq_puts(m, "   mtu/mru/rcvseq/sendseq/lns debug reorderto\n");
1678 		seq_puts(m, "   nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1679 		goto out;
1680 	}
1681 
1682 	/* Show the tunnel or session context.
1683 	 */
1684 	if (pd->session == NULL)
1685 		pppol2tp_seq_tunnel_show(m, pd->tunnel);
1686 	else
1687 		pppol2tp_seq_session_show(m, pd->session);
1688 
1689 out:
1690 	return 0;
1691 }
1692 
1693 static const struct seq_operations pppol2tp_seq_ops = {
1694 	.start		= pppol2tp_seq_start,
1695 	.next		= pppol2tp_seq_next,
1696 	.stop		= pppol2tp_seq_stop,
1697 	.show		= pppol2tp_seq_show,
1698 };
1699 
1700 /* Called when our /proc file is opened. We allocate data for use when
1701  * iterating our tunnel / session contexts and store it in the private
1702  * data of the seq_file.
1703  */
1704 static int pppol2tp_proc_open(struct inode *inode, struct file *file)
1705 {
1706 	return seq_open_net(inode, file, &pppol2tp_seq_ops,
1707 			    sizeof(struct pppol2tp_seq_data));
1708 }
1709 
1710 static const struct file_operations pppol2tp_proc_fops = {
1711 	.owner		= THIS_MODULE,
1712 	.open		= pppol2tp_proc_open,
1713 	.read		= seq_read,
1714 	.llseek		= seq_lseek,
1715 	.release	= seq_release_net,
1716 };
1717 
1718 #endif /* CONFIG_PROC_FS */
1719 
1720 /*****************************************************************************
1721  * Network namespace
1722  *****************************************************************************/
1723 
1724 static __net_init int pppol2tp_init_net(struct net *net)
1725 {
1726 	struct proc_dir_entry *pde;
1727 	int err = 0;
1728 
1729 	pde = proc_create("pppol2tp", S_IRUGO, net->proc_net,
1730 			  &pppol2tp_proc_fops);
1731 	if (!pde) {
1732 		err = -ENOMEM;
1733 		goto out;
1734 	}
1735 
1736 out:
1737 	return err;
1738 }
1739 
1740 static __net_exit void pppol2tp_exit_net(struct net *net)
1741 {
1742 	remove_proc_entry("pppol2tp", net->proc_net);
1743 }
1744 
1745 static struct pernet_operations pppol2tp_net_ops = {
1746 	.init = pppol2tp_init_net,
1747 	.exit = pppol2tp_exit_net,
1748 	.id   = &pppol2tp_net_id,
1749 };
1750 
1751 /*****************************************************************************
1752  * Init and cleanup
1753  *****************************************************************************/
1754 
1755 static const struct proto_ops pppol2tp_ops = {
1756 	.family		= AF_PPPOX,
1757 	.owner		= THIS_MODULE,
1758 	.release	= pppol2tp_release,
1759 	.bind		= sock_no_bind,
1760 	.connect	= pppol2tp_connect,
1761 	.socketpair	= sock_no_socketpair,
1762 	.accept		= sock_no_accept,
1763 	.getname	= pppol2tp_getname,
1764 	.poll		= datagram_poll,
1765 	.listen		= sock_no_listen,
1766 	.shutdown	= sock_no_shutdown,
1767 	.setsockopt	= pppol2tp_setsockopt,
1768 	.getsockopt	= pppol2tp_getsockopt,
1769 	.sendmsg	= pppol2tp_sendmsg,
1770 	.recvmsg	= pppol2tp_recvmsg,
1771 	.mmap		= sock_no_mmap,
1772 	.ioctl		= pppox_ioctl,
1773 };
1774 
1775 static const struct pppox_proto pppol2tp_proto = {
1776 	.create		= pppol2tp_create,
1777 	.ioctl		= pppol2tp_ioctl,
1778 	.owner		= THIS_MODULE,
1779 };
1780 
1781 #ifdef CONFIG_L2TP_V3
1782 
1783 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = {
1784 	.session_create	= pppol2tp_session_create,
1785 	.session_delete	= l2tp_session_delete,
1786 };
1787 
1788 #endif /* CONFIG_L2TP_V3 */
1789 
1790 static int __init pppol2tp_init(void)
1791 {
1792 	int err;
1793 
1794 	err = register_pernet_device(&pppol2tp_net_ops);
1795 	if (err)
1796 		goto out;
1797 
1798 	err = proto_register(&pppol2tp_sk_proto, 0);
1799 	if (err)
1800 		goto out_unregister_pppol2tp_pernet;
1801 
1802 	err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto);
1803 	if (err)
1804 		goto out_unregister_pppol2tp_proto;
1805 
1806 #ifdef CONFIG_L2TP_V3
1807 	err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops);
1808 	if (err)
1809 		goto out_unregister_pppox;
1810 #endif
1811 
1812 	pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION);
1813 
1814 out:
1815 	return err;
1816 
1817 #ifdef CONFIG_L2TP_V3
1818 out_unregister_pppox:
1819 	unregister_pppox_proto(PX_PROTO_OL2TP);
1820 #endif
1821 out_unregister_pppol2tp_proto:
1822 	proto_unregister(&pppol2tp_sk_proto);
1823 out_unregister_pppol2tp_pernet:
1824 	unregister_pernet_device(&pppol2tp_net_ops);
1825 	goto out;
1826 }
1827 
1828 static void __exit pppol2tp_exit(void)
1829 {
1830 #ifdef CONFIG_L2TP_V3
1831 	l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP);
1832 #endif
1833 	unregister_pppox_proto(PX_PROTO_OL2TP);
1834 	proto_unregister(&pppol2tp_sk_proto);
1835 	unregister_pernet_device(&pppol2tp_net_ops);
1836 }
1837 
1838 module_init(pppol2tp_init);
1839 module_exit(pppol2tp_exit);
1840 
1841 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1842 MODULE_DESCRIPTION("PPP over L2TP over UDP");
1843 MODULE_LICENSE("GPL");
1844 MODULE_VERSION(PPPOL2TP_DRV_VERSION);
1845 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP);
1846 MODULE_ALIAS_L2TP_PWTYPE(11);
1847