1 /***************************************************************************** 2 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets 3 * 4 * PPPoX --- Generic PPP encapsulation socket family 5 * PPPoL2TP --- PPP over L2TP (RFC 2661) 6 * 7 * Version: 2.0.0 8 * 9 * Authors: James Chapman (jchapman@katalix.com) 10 * 11 * Based on original work by Martijn van Oosterhout <kleptog@svana.org> 12 * 13 * License: 14 * This program is free software; you can redistribute it and/or 15 * modify it under the terms of the GNU General Public License 16 * as published by the Free Software Foundation; either version 17 * 2 of the License, or (at your option) any later version. 18 * 19 */ 20 21 /* This driver handles only L2TP data frames; control frames are handled by a 22 * userspace application. 23 * 24 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and 25 * attaches it to a bound UDP socket with local tunnel_id / session_id and 26 * peer tunnel_id / session_id set. Data can then be sent or received using 27 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket 28 * can be read or modified using ioctl() or [gs]etsockopt() calls. 29 * 30 * When a PPPoL2TP socket is connected with local and peer session_id values 31 * zero, the socket is treated as a special tunnel management socket. 32 * 33 * Here's example userspace code to create a socket for sending/receiving data 34 * over an L2TP session:- 35 * 36 * struct sockaddr_pppol2tp sax; 37 * int fd; 38 * int session_fd; 39 * 40 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); 41 * 42 * sax.sa_family = AF_PPPOX; 43 * sax.sa_protocol = PX_PROTO_OL2TP; 44 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket 45 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr; 46 * sax.pppol2tp.addr.sin_port = addr->sin_port; 47 * sax.pppol2tp.addr.sin_family = AF_INET; 48 * sax.pppol2tp.s_tunnel = tunnel_id; 49 * sax.pppol2tp.s_session = session_id; 50 * sax.pppol2tp.d_tunnel = peer_tunnel_id; 51 * sax.pppol2tp.d_session = peer_session_id; 52 * 53 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax)); 54 * 55 * A pppd plugin that allows PPP traffic to be carried over L2TP using 56 * this driver is available from the OpenL2TP project at 57 * http://openl2tp.sourceforge.net. 58 */ 59 60 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 61 62 #include <linux/module.h> 63 #include <linux/string.h> 64 #include <linux/list.h> 65 #include <linux/uaccess.h> 66 67 #include <linux/kernel.h> 68 #include <linux/spinlock.h> 69 #include <linux/kthread.h> 70 #include <linux/sched.h> 71 #include <linux/slab.h> 72 #include <linux/errno.h> 73 #include <linux/jiffies.h> 74 75 #include <linux/netdevice.h> 76 #include <linux/net.h> 77 #include <linux/inetdevice.h> 78 #include <linux/skbuff.h> 79 #include <linux/init.h> 80 #include <linux/ip.h> 81 #include <linux/udp.h> 82 #include <linux/if_pppox.h> 83 #include <linux/if_pppol2tp.h> 84 #include <net/sock.h> 85 #include <linux/ppp_channel.h> 86 #include <linux/ppp_defs.h> 87 #include <linux/ppp-ioctl.h> 88 #include <linux/file.h> 89 #include <linux/hash.h> 90 #include <linux/sort.h> 91 #include <linux/proc_fs.h> 92 #include <linux/l2tp.h> 93 #include <linux/nsproxy.h> 94 #include <net/net_namespace.h> 95 #include <net/netns/generic.h> 96 #include <net/dst.h> 97 #include <net/ip.h> 98 #include <net/udp.h> 99 #include <net/xfrm.h> 100 #include <net/inet_common.h> 101 102 #include <asm/byteorder.h> 103 #include <linux/atomic.h> 104 105 #include "l2tp_core.h" 106 107 #define PPPOL2TP_DRV_VERSION "V2.0" 108 109 /* Space for UDP, L2TP and PPP headers */ 110 #define PPPOL2TP_HEADER_OVERHEAD 40 111 112 /* Number of bytes to build transmit L2TP headers. 113 * Unfortunately the size is different depending on whether sequence numbers 114 * are enabled. 115 */ 116 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10 117 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6 118 119 /* Private data of each session. This data lives at the end of struct 120 * l2tp_session, referenced via session->priv[]. 121 */ 122 struct pppol2tp_session { 123 int owner; /* pid that opened the socket */ 124 125 struct mutex sk_lock; /* Protects .sk */ 126 struct sock __rcu *sk; /* Pointer to the session 127 * PPPoX socket */ 128 struct sock *__sk; /* Copy of .sk, for cleanup */ 129 struct rcu_head rcu; /* For asynchronous release */ 130 int flags; /* accessed by PPPIOCGFLAGS. 131 * Unused. */ 132 }; 133 134 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb); 135 136 static const struct ppp_channel_ops pppol2tp_chan_ops = { 137 .start_xmit = pppol2tp_xmit, 138 }; 139 140 static const struct proto_ops pppol2tp_ops; 141 142 /* Retrieves the pppol2tp socket associated to a session. 143 * A reference is held on the returned socket, so this function must be paired 144 * with sock_put(). 145 */ 146 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) 147 { 148 struct pppol2tp_session *ps = l2tp_session_priv(session); 149 struct sock *sk; 150 151 rcu_read_lock(); 152 sk = rcu_dereference(ps->sk); 153 if (sk) 154 sock_hold(sk); 155 rcu_read_unlock(); 156 157 return sk; 158 } 159 160 /* Helpers to obtain tunnel/session contexts from sockets. 161 */ 162 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) 163 { 164 struct l2tp_session *session; 165 166 if (sk == NULL) 167 return NULL; 168 169 sock_hold(sk); 170 session = (struct l2tp_session *)(sk->sk_user_data); 171 if (session == NULL) { 172 sock_put(sk); 173 goto out; 174 } 175 176 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 177 178 out: 179 return session; 180 } 181 182 /***************************************************************************** 183 * Receive data handling 184 *****************************************************************************/ 185 186 static int pppol2tp_recv_payload_hook(struct sk_buff *skb) 187 { 188 /* Skip PPP header, if present. In testing, Microsoft L2TP clients 189 * don't send the PPP header (PPP header compression enabled), but 190 * other clients can include the header. So we cope with both cases 191 * here. The PPP header is always FF03 when using L2TP. 192 * 193 * Note that skb->data[] isn't dereferenced from a u16 ptr here since 194 * the field may be unaligned. 195 */ 196 if (!pskb_may_pull(skb, 2)) 197 return 1; 198 199 if ((skb->data[0] == PPP_ALLSTATIONS) && (skb->data[1] == PPP_UI)) 200 skb_pull(skb, 2); 201 202 return 0; 203 } 204 205 /* Receive message. This is the recvmsg for the PPPoL2TP socket. 206 */ 207 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, 208 size_t len, int flags) 209 { 210 int err; 211 struct sk_buff *skb; 212 struct sock *sk = sock->sk; 213 214 err = -EIO; 215 if (sk->sk_state & PPPOX_BOUND) 216 goto end; 217 218 err = 0; 219 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 220 flags & MSG_DONTWAIT, &err); 221 if (!skb) 222 goto end; 223 224 if (len > skb->len) 225 len = skb->len; 226 else if (len < skb->len) 227 msg->msg_flags |= MSG_TRUNC; 228 229 err = skb_copy_datagram_msg(skb, 0, msg, len); 230 if (likely(err == 0)) 231 err = len; 232 233 kfree_skb(skb); 234 end: 235 return err; 236 } 237 238 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) 239 { 240 struct pppol2tp_session *ps = l2tp_session_priv(session); 241 struct sock *sk = NULL; 242 243 /* If the socket is bound, send it in to PPP's input queue. Otherwise 244 * queue it on the session socket. 245 */ 246 rcu_read_lock(); 247 sk = rcu_dereference(ps->sk); 248 if (sk == NULL) 249 goto no_sock; 250 251 if (sk->sk_state & PPPOX_BOUND) { 252 struct pppox_sock *po; 253 254 l2tp_dbg(session, L2TP_MSG_DATA, 255 "%s: recv %d byte data frame, passing to ppp\n", 256 session->name, data_len); 257 258 po = pppox_sk(sk); 259 ppp_input(&po->chan, skb); 260 } else { 261 l2tp_dbg(session, L2TP_MSG_DATA, 262 "%s: recv %d byte data frame, passing to L2TP socket\n", 263 session->name, data_len); 264 265 if (sock_queue_rcv_skb(sk, skb) < 0) { 266 atomic_long_inc(&session->stats.rx_errors); 267 kfree_skb(skb); 268 } 269 } 270 rcu_read_unlock(); 271 272 return; 273 274 no_sock: 275 rcu_read_unlock(); 276 l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name); 277 kfree_skb(skb); 278 } 279 280 /************************************************************************ 281 * Transmit handling 282 ***********************************************************************/ 283 284 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here 285 * when a user application does a sendmsg() on the session socket. L2TP and 286 * PPP headers must be inserted into the user's data. 287 */ 288 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m, 289 size_t total_len) 290 { 291 struct sock *sk = sock->sk; 292 struct sk_buff *skb; 293 int error; 294 struct l2tp_session *session; 295 struct l2tp_tunnel *tunnel; 296 int uhlen; 297 298 error = -ENOTCONN; 299 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 300 goto error; 301 302 /* Get session and tunnel contexts */ 303 error = -EBADF; 304 session = pppol2tp_sock_to_session(sk); 305 if (session == NULL) 306 goto error; 307 308 tunnel = session->tunnel; 309 310 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 311 312 /* Allocate a socket buffer */ 313 error = -ENOMEM; 314 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 315 uhlen + session->hdr_len + 316 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 317 0, GFP_KERNEL); 318 if (!skb) 319 goto error_put_sess; 320 321 /* Reserve space for headers. */ 322 skb_reserve(skb, NET_SKB_PAD); 323 skb_reset_network_header(skb); 324 skb_reserve(skb, sizeof(struct iphdr)); 325 skb_reset_transport_header(skb); 326 skb_reserve(skb, uhlen); 327 328 /* Add PPP header */ 329 skb->data[0] = PPP_ALLSTATIONS; 330 skb->data[1] = PPP_UI; 331 skb_put(skb, 2); 332 333 /* Copy user data into skb */ 334 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len); 335 if (error < 0) { 336 kfree_skb(skb); 337 goto error_put_sess; 338 } 339 340 local_bh_disable(); 341 l2tp_xmit_skb(session, skb, session->hdr_len); 342 local_bh_enable(); 343 344 sock_put(sk); 345 346 return total_len; 347 348 error_put_sess: 349 sock_put(sk); 350 error: 351 return error; 352 } 353 354 /* Transmit function called by generic PPP driver. Sends PPP frame 355 * over PPPoL2TP socket. 356 * 357 * This is almost the same as pppol2tp_sendmsg(), but rather than 358 * being called with a msghdr from userspace, it is called with a skb 359 * from the kernel. 360 * 361 * The supplied skb from ppp doesn't have enough headroom for the 362 * insertion of L2TP, UDP and IP headers so we need to allocate more 363 * headroom in the skb. This will create a cloned skb. But we must be 364 * careful in the error case because the caller will expect to free 365 * the skb it supplied, not our cloned skb. So we take care to always 366 * leave the original skb unfreed if we return an error. 367 */ 368 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) 369 { 370 struct sock *sk = (struct sock *) chan->private; 371 struct l2tp_session *session; 372 struct l2tp_tunnel *tunnel; 373 int uhlen, headroom; 374 375 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 376 goto abort; 377 378 /* Get session and tunnel contexts from the socket */ 379 session = pppol2tp_sock_to_session(sk); 380 if (session == NULL) 381 goto abort; 382 383 tunnel = session->tunnel; 384 385 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 386 headroom = NET_SKB_PAD + 387 sizeof(struct iphdr) + /* IP header */ 388 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */ 389 session->hdr_len + /* L2TP header */ 390 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 391 if (skb_cow_head(skb, headroom)) 392 goto abort_put_sess; 393 394 /* Setup PPP header */ 395 __skb_push(skb, 2); 396 skb->data[0] = PPP_ALLSTATIONS; 397 skb->data[1] = PPP_UI; 398 399 local_bh_disable(); 400 l2tp_xmit_skb(session, skb, session->hdr_len); 401 local_bh_enable(); 402 403 sock_put(sk); 404 405 return 1; 406 407 abort_put_sess: 408 sock_put(sk); 409 abort: 410 /* Free the original skb */ 411 kfree_skb(skb); 412 return 1; 413 } 414 415 /***************************************************************************** 416 * Session (and tunnel control) socket create/destroy. 417 *****************************************************************************/ 418 419 static void pppol2tp_put_sk(struct rcu_head *head) 420 { 421 struct pppol2tp_session *ps; 422 423 ps = container_of(head, typeof(*ps), rcu); 424 sock_put(ps->__sk); 425 } 426 427 /* Called by l2tp_core when a session socket is being closed. 428 */ 429 static void pppol2tp_session_close(struct l2tp_session *session) 430 { 431 struct pppol2tp_session *ps; 432 433 ps = l2tp_session_priv(session); 434 mutex_lock(&ps->sk_lock); 435 ps->__sk = rcu_dereference_protected(ps->sk, 436 lockdep_is_held(&ps->sk_lock)); 437 RCU_INIT_POINTER(ps->sk, NULL); 438 if (ps->__sk) 439 call_rcu(&ps->rcu, pppol2tp_put_sk); 440 mutex_unlock(&ps->sk_lock); 441 } 442 443 /* Really kill the session socket. (Called from sock_put() if 444 * refcnt == 0.) 445 */ 446 static void pppol2tp_session_destruct(struct sock *sk) 447 { 448 struct l2tp_session *session = sk->sk_user_data; 449 450 skb_queue_purge(&sk->sk_receive_queue); 451 skb_queue_purge(&sk->sk_write_queue); 452 453 if (session) { 454 sk->sk_user_data = NULL; 455 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 456 l2tp_session_dec_refcount(session); 457 } 458 } 459 460 /* Called when the PPPoX socket (session) is closed. 461 */ 462 static int pppol2tp_release(struct socket *sock) 463 { 464 struct sock *sk = sock->sk; 465 struct l2tp_session *session; 466 int error; 467 468 if (!sk) 469 return 0; 470 471 error = -EBADF; 472 lock_sock(sk); 473 if (sock_flag(sk, SOCK_DEAD) != 0) 474 goto error; 475 476 pppox_unbind_sock(sk); 477 478 /* Signal the death of the socket. */ 479 sk->sk_state = PPPOX_DEAD; 480 sock_orphan(sk); 481 sock->sk = NULL; 482 483 /* If the socket is associated with a session, 484 * l2tp_session_delete will call pppol2tp_session_close which 485 * will drop the session's ref on the socket. 486 */ 487 session = pppol2tp_sock_to_session(sk); 488 if (session) { 489 l2tp_session_delete(session); 490 /* drop the ref obtained by pppol2tp_sock_to_session */ 491 sock_put(sk); 492 } 493 494 release_sock(sk); 495 496 /* This will delete the session context via 497 * pppol2tp_session_destruct() if the socket's refcnt drops to 498 * zero. 499 */ 500 sock_put(sk); 501 502 return 0; 503 504 error: 505 release_sock(sk); 506 return error; 507 } 508 509 static struct proto pppol2tp_sk_proto = { 510 .name = "PPPOL2TP", 511 .owner = THIS_MODULE, 512 .obj_size = sizeof(struct pppox_sock), 513 }; 514 515 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb) 516 { 517 int rc; 518 519 rc = l2tp_udp_encap_recv(sk, skb); 520 if (rc) 521 kfree_skb(skb); 522 523 return NET_RX_SUCCESS; 524 } 525 526 /* socket() handler. Initialize a new struct sock. 527 */ 528 static int pppol2tp_create(struct net *net, struct socket *sock, int kern) 529 { 530 int error = -ENOMEM; 531 struct sock *sk; 532 533 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern); 534 if (!sk) 535 goto out; 536 537 sock_init_data(sock, sk); 538 539 sock->state = SS_UNCONNECTED; 540 sock->ops = &pppol2tp_ops; 541 542 sk->sk_backlog_rcv = pppol2tp_backlog_recv; 543 sk->sk_protocol = PX_PROTO_OL2TP; 544 sk->sk_family = PF_PPPOX; 545 sk->sk_state = PPPOX_NONE; 546 sk->sk_type = SOCK_STREAM; 547 sk->sk_destruct = pppol2tp_session_destruct; 548 549 error = 0; 550 551 out: 552 return error; 553 } 554 555 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 556 static void pppol2tp_show(struct seq_file *m, void *arg) 557 { 558 struct l2tp_session *session = arg; 559 struct sock *sk; 560 561 sk = pppol2tp_session_get_sock(session); 562 if (sk) { 563 struct pppox_sock *po = pppox_sk(sk); 564 565 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 566 sock_put(sk); 567 } 568 } 569 #endif 570 571 static void pppol2tp_session_init(struct l2tp_session *session) 572 { 573 struct pppol2tp_session *ps; 574 struct dst_entry *dst; 575 576 session->recv_skb = pppol2tp_recv; 577 session->session_close = pppol2tp_session_close; 578 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 579 session->show = pppol2tp_show; 580 #endif 581 582 ps = l2tp_session_priv(session); 583 mutex_init(&ps->sk_lock); 584 ps->owner = current->pid; 585 586 /* If PMTU discovery was enabled, use the MTU that was discovered */ 587 dst = sk_dst_get(session->tunnel->sock); 588 if (dst) { 589 u32 pmtu = dst_mtu(dst); 590 591 if (pmtu) { 592 session->mtu = pmtu - PPPOL2TP_HEADER_OVERHEAD; 593 session->mru = pmtu - PPPOL2TP_HEADER_OVERHEAD; 594 } 595 dst_release(dst); 596 } 597 } 598 599 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket 600 */ 601 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 602 int sockaddr_len, int flags) 603 { 604 struct sock *sk = sock->sk; 605 struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr; 606 struct pppox_sock *po = pppox_sk(sk); 607 struct l2tp_session *session = NULL; 608 struct l2tp_tunnel *tunnel; 609 struct pppol2tp_session *ps; 610 struct l2tp_session_cfg cfg = { 0, }; 611 int error = 0; 612 u32 tunnel_id, peer_tunnel_id; 613 u32 session_id, peer_session_id; 614 bool drop_refcnt = false; 615 bool drop_tunnel = false; 616 int ver = 2; 617 int fd; 618 619 lock_sock(sk); 620 621 error = -EINVAL; 622 if (sp->sa_protocol != PX_PROTO_OL2TP) 623 goto end; 624 625 /* Check for already bound sockets */ 626 error = -EBUSY; 627 if (sk->sk_state & PPPOX_CONNECTED) 628 goto end; 629 630 /* We don't supporting rebinding anyway */ 631 error = -EALREADY; 632 if (sk->sk_user_data) 633 goto end; /* socket is already attached */ 634 635 /* Get params from socket address. Handle L2TPv2 and L2TPv3. 636 * This is nasty because there are different sockaddr_pppol2tp 637 * structs for L2TPv2, L2TPv3, over IPv4 and IPv6. We use 638 * the sockaddr size to determine which structure the caller 639 * is using. 640 */ 641 peer_tunnel_id = 0; 642 if (sockaddr_len == sizeof(struct sockaddr_pppol2tp)) { 643 fd = sp->pppol2tp.fd; 644 tunnel_id = sp->pppol2tp.s_tunnel; 645 peer_tunnel_id = sp->pppol2tp.d_tunnel; 646 session_id = sp->pppol2tp.s_session; 647 peer_session_id = sp->pppol2tp.d_session; 648 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3)) { 649 struct sockaddr_pppol2tpv3 *sp3 = 650 (struct sockaddr_pppol2tpv3 *) sp; 651 ver = 3; 652 fd = sp3->pppol2tp.fd; 653 tunnel_id = sp3->pppol2tp.s_tunnel; 654 peer_tunnel_id = sp3->pppol2tp.d_tunnel; 655 session_id = sp3->pppol2tp.s_session; 656 peer_session_id = sp3->pppol2tp.d_session; 657 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpin6)) { 658 struct sockaddr_pppol2tpin6 *sp6 = 659 (struct sockaddr_pppol2tpin6 *) sp; 660 fd = sp6->pppol2tp.fd; 661 tunnel_id = sp6->pppol2tp.s_tunnel; 662 peer_tunnel_id = sp6->pppol2tp.d_tunnel; 663 session_id = sp6->pppol2tp.s_session; 664 peer_session_id = sp6->pppol2tp.d_session; 665 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3in6)) { 666 struct sockaddr_pppol2tpv3in6 *sp6 = 667 (struct sockaddr_pppol2tpv3in6 *) sp; 668 ver = 3; 669 fd = sp6->pppol2tp.fd; 670 tunnel_id = sp6->pppol2tp.s_tunnel; 671 peer_tunnel_id = sp6->pppol2tp.d_tunnel; 672 session_id = sp6->pppol2tp.s_session; 673 peer_session_id = sp6->pppol2tp.d_session; 674 } else { 675 error = -EINVAL; 676 goto end; /* bad socket address */ 677 } 678 679 /* Don't bind if tunnel_id is 0 */ 680 error = -EINVAL; 681 if (tunnel_id == 0) 682 goto end; 683 684 tunnel = l2tp_tunnel_get(sock_net(sk), tunnel_id); 685 if (tunnel) 686 drop_tunnel = true; 687 688 /* Special case: create tunnel context if session_id and 689 * peer_session_id is 0. Otherwise look up tunnel using supplied 690 * tunnel id. 691 */ 692 if ((session_id == 0) && (peer_session_id == 0)) { 693 if (tunnel == NULL) { 694 struct l2tp_tunnel_cfg tcfg = { 695 .encap = L2TP_ENCAPTYPE_UDP, 696 .debug = 0, 697 }; 698 error = l2tp_tunnel_create(sock_net(sk), fd, ver, tunnel_id, peer_tunnel_id, &tcfg, &tunnel); 699 if (error < 0) 700 goto end; 701 702 l2tp_tunnel_inc_refcount(tunnel); 703 error = l2tp_tunnel_register(tunnel, sock_net(sk), 704 &tcfg); 705 if (error < 0) { 706 kfree(tunnel); 707 goto end; 708 } 709 drop_tunnel = true; 710 } 711 } else { 712 /* Error if we can't find the tunnel */ 713 error = -ENOENT; 714 if (tunnel == NULL) 715 goto end; 716 717 /* Error if socket is not prepped */ 718 if (tunnel->sock == NULL) 719 goto end; 720 } 721 722 if (tunnel->recv_payload_hook == NULL) 723 tunnel->recv_payload_hook = pppol2tp_recv_payload_hook; 724 725 if (tunnel->peer_tunnel_id == 0) 726 tunnel->peer_tunnel_id = peer_tunnel_id; 727 728 session = l2tp_session_get(sock_net(sk), tunnel, session_id); 729 if (session) { 730 drop_refcnt = true; 731 ps = l2tp_session_priv(session); 732 733 /* Using a pre-existing session is fine as long as it hasn't 734 * been connected yet. 735 */ 736 mutex_lock(&ps->sk_lock); 737 if (rcu_dereference_protected(ps->sk, 738 lockdep_is_held(&ps->sk_lock))) { 739 mutex_unlock(&ps->sk_lock); 740 error = -EEXIST; 741 goto end; 742 } 743 } else { 744 /* Default MTU must allow space for UDP/L2TP/PPP headers */ 745 cfg.mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 746 cfg.mru = cfg.mtu; 747 748 session = l2tp_session_create(sizeof(struct pppol2tp_session), 749 tunnel, session_id, 750 peer_session_id, &cfg); 751 if (IS_ERR(session)) { 752 error = PTR_ERR(session); 753 goto end; 754 } 755 756 pppol2tp_session_init(session); 757 ps = l2tp_session_priv(session); 758 l2tp_session_inc_refcount(session); 759 760 mutex_lock(&ps->sk_lock); 761 error = l2tp_session_register(session, tunnel); 762 if (error < 0) { 763 mutex_unlock(&ps->sk_lock); 764 kfree(session); 765 goto end; 766 } 767 drop_refcnt = true; 768 } 769 770 /* Special case: if source & dest session_id == 0x0000, this 771 * socket is being created to manage the tunnel. Just set up 772 * the internal context for use by ioctl() and sockopt() 773 * handlers. 774 */ 775 if ((session->session_id == 0) && 776 (session->peer_session_id == 0)) { 777 error = 0; 778 goto out_no_ppp; 779 } 780 781 /* The only header we need to worry about is the L2TP 782 * header. This size is different depending on whether 783 * sequence numbers are enabled for the data channel. 784 */ 785 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 786 787 po->chan.private = sk; 788 po->chan.ops = &pppol2tp_chan_ops; 789 po->chan.mtu = session->mtu; 790 791 error = ppp_register_net_channel(sock_net(sk), &po->chan); 792 if (error) { 793 mutex_unlock(&ps->sk_lock); 794 goto end; 795 } 796 797 out_no_ppp: 798 /* This is how we get the session context from the socket. */ 799 sock_hold(sk); 800 sk->sk_user_data = session; 801 rcu_assign_pointer(ps->sk, sk); 802 mutex_unlock(&ps->sk_lock); 803 804 /* Keep the reference we've grabbed on the session: sk doesn't expect 805 * the session to disappear. pppol2tp_session_destruct() is responsible 806 * for dropping it. 807 */ 808 drop_refcnt = false; 809 810 sk->sk_state = PPPOX_CONNECTED; 811 l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n", 812 session->name); 813 814 end: 815 if (drop_refcnt) 816 l2tp_session_dec_refcount(session); 817 if (drop_tunnel) 818 l2tp_tunnel_dec_refcount(tunnel); 819 release_sock(sk); 820 821 return error; 822 } 823 824 #ifdef CONFIG_L2TP_V3 825 826 /* Called when creating sessions via the netlink interface. */ 827 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, 828 u32 session_id, u32 peer_session_id, 829 struct l2tp_session_cfg *cfg) 830 { 831 int error; 832 struct l2tp_session *session; 833 834 /* Error if tunnel socket is not prepped */ 835 if (!tunnel->sock) { 836 error = -ENOENT; 837 goto err; 838 } 839 840 /* Default MTU values. */ 841 if (cfg->mtu == 0) 842 cfg->mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 843 if (cfg->mru == 0) 844 cfg->mru = cfg->mtu; 845 846 /* Allocate and initialize a new session context. */ 847 session = l2tp_session_create(sizeof(struct pppol2tp_session), 848 tunnel, session_id, 849 peer_session_id, cfg); 850 if (IS_ERR(session)) { 851 error = PTR_ERR(session); 852 goto err; 853 } 854 855 pppol2tp_session_init(session); 856 857 error = l2tp_session_register(session, tunnel); 858 if (error < 0) 859 goto err_sess; 860 861 return 0; 862 863 err_sess: 864 kfree(session); 865 err: 866 return error; 867 } 868 869 #endif /* CONFIG_L2TP_V3 */ 870 871 /* getname() support. 872 */ 873 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr, 874 int peer) 875 { 876 int len = 0; 877 int error = 0; 878 struct l2tp_session *session; 879 struct l2tp_tunnel *tunnel; 880 struct sock *sk = sock->sk; 881 struct inet_sock *inet; 882 struct pppol2tp_session *pls; 883 884 error = -ENOTCONN; 885 if (sk == NULL) 886 goto end; 887 if (!(sk->sk_state & PPPOX_CONNECTED)) 888 goto end; 889 890 error = -EBADF; 891 session = pppol2tp_sock_to_session(sk); 892 if (session == NULL) 893 goto end; 894 895 pls = l2tp_session_priv(session); 896 tunnel = session->tunnel; 897 898 inet = inet_sk(tunnel->sock); 899 if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) { 900 struct sockaddr_pppol2tp sp; 901 len = sizeof(sp); 902 memset(&sp, 0, len); 903 sp.sa_family = AF_PPPOX; 904 sp.sa_protocol = PX_PROTO_OL2TP; 905 sp.pppol2tp.fd = tunnel->fd; 906 sp.pppol2tp.pid = pls->owner; 907 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 908 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 909 sp.pppol2tp.s_session = session->session_id; 910 sp.pppol2tp.d_session = session->peer_session_id; 911 sp.pppol2tp.addr.sin_family = AF_INET; 912 sp.pppol2tp.addr.sin_port = inet->inet_dport; 913 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 914 memcpy(uaddr, &sp, len); 915 #if IS_ENABLED(CONFIG_IPV6) 916 } else if ((tunnel->version == 2) && 917 (tunnel->sock->sk_family == AF_INET6)) { 918 struct sockaddr_pppol2tpin6 sp; 919 920 len = sizeof(sp); 921 memset(&sp, 0, len); 922 sp.sa_family = AF_PPPOX; 923 sp.sa_protocol = PX_PROTO_OL2TP; 924 sp.pppol2tp.fd = tunnel->fd; 925 sp.pppol2tp.pid = pls->owner; 926 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 927 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 928 sp.pppol2tp.s_session = session->session_id; 929 sp.pppol2tp.d_session = session->peer_session_id; 930 sp.pppol2tp.addr.sin6_family = AF_INET6; 931 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 932 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 933 sizeof(tunnel->sock->sk_v6_daddr)); 934 memcpy(uaddr, &sp, len); 935 } else if ((tunnel->version == 3) && 936 (tunnel->sock->sk_family == AF_INET6)) { 937 struct sockaddr_pppol2tpv3in6 sp; 938 939 len = sizeof(sp); 940 memset(&sp, 0, len); 941 sp.sa_family = AF_PPPOX; 942 sp.sa_protocol = PX_PROTO_OL2TP; 943 sp.pppol2tp.fd = tunnel->fd; 944 sp.pppol2tp.pid = pls->owner; 945 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 946 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 947 sp.pppol2tp.s_session = session->session_id; 948 sp.pppol2tp.d_session = session->peer_session_id; 949 sp.pppol2tp.addr.sin6_family = AF_INET6; 950 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 951 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 952 sizeof(tunnel->sock->sk_v6_daddr)); 953 memcpy(uaddr, &sp, len); 954 #endif 955 } else if (tunnel->version == 3) { 956 struct sockaddr_pppol2tpv3 sp; 957 len = sizeof(sp); 958 memset(&sp, 0, len); 959 sp.sa_family = AF_PPPOX; 960 sp.sa_protocol = PX_PROTO_OL2TP; 961 sp.pppol2tp.fd = tunnel->fd; 962 sp.pppol2tp.pid = pls->owner; 963 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 964 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 965 sp.pppol2tp.s_session = session->session_id; 966 sp.pppol2tp.d_session = session->peer_session_id; 967 sp.pppol2tp.addr.sin_family = AF_INET; 968 sp.pppol2tp.addr.sin_port = inet->inet_dport; 969 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 970 memcpy(uaddr, &sp, len); 971 } 972 973 error = len; 974 975 sock_put(sk); 976 end: 977 return error; 978 } 979 980 /**************************************************************************** 981 * ioctl() handlers. 982 * 983 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 984 * sockets. However, in order to control kernel tunnel features, we allow 985 * userspace to create a special "tunnel" PPPoX socket which is used for 986 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow 987 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl() 988 * calls. 989 ****************************************************************************/ 990 991 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest, 992 struct l2tp_stats *stats) 993 { 994 dest->tx_packets = atomic_long_read(&stats->tx_packets); 995 dest->tx_bytes = atomic_long_read(&stats->tx_bytes); 996 dest->tx_errors = atomic_long_read(&stats->tx_errors); 997 dest->rx_packets = atomic_long_read(&stats->rx_packets); 998 dest->rx_bytes = atomic_long_read(&stats->rx_bytes); 999 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards); 1000 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets); 1001 dest->rx_errors = atomic_long_read(&stats->rx_errors); 1002 } 1003 1004 /* Session ioctl helper. 1005 */ 1006 static int pppol2tp_session_ioctl(struct l2tp_session *session, 1007 unsigned int cmd, unsigned long arg) 1008 { 1009 struct ifreq ifr; 1010 int err = 0; 1011 struct sock *sk; 1012 int val = (int) arg; 1013 struct pppol2tp_session *ps = l2tp_session_priv(session); 1014 struct l2tp_tunnel *tunnel = session->tunnel; 1015 struct pppol2tp_ioc_stats stats; 1016 1017 l2tp_dbg(session, L2TP_MSG_CONTROL, 1018 "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n", 1019 session->name, cmd, arg); 1020 1021 sk = pppol2tp_session_get_sock(session); 1022 if (!sk) 1023 return -EBADR; 1024 1025 switch (cmd) { 1026 case SIOCGIFMTU: 1027 err = -ENXIO; 1028 if (!(sk->sk_state & PPPOX_CONNECTED)) 1029 break; 1030 1031 err = -EFAULT; 1032 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1033 break; 1034 ifr.ifr_mtu = session->mtu; 1035 if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq))) 1036 break; 1037 1038 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mtu=%d\n", 1039 session->name, session->mtu); 1040 err = 0; 1041 break; 1042 1043 case SIOCSIFMTU: 1044 err = -ENXIO; 1045 if (!(sk->sk_state & PPPOX_CONNECTED)) 1046 break; 1047 1048 err = -EFAULT; 1049 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1050 break; 1051 1052 session->mtu = ifr.ifr_mtu; 1053 1054 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mtu=%d\n", 1055 session->name, session->mtu); 1056 err = 0; 1057 break; 1058 1059 case PPPIOCGMRU: 1060 err = -ENXIO; 1061 if (!(sk->sk_state & PPPOX_CONNECTED)) 1062 break; 1063 1064 err = -EFAULT; 1065 if (put_user(session->mru, (int __user *) arg)) 1066 break; 1067 1068 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mru=%d\n", 1069 session->name, session->mru); 1070 err = 0; 1071 break; 1072 1073 case PPPIOCSMRU: 1074 err = -ENXIO; 1075 if (!(sk->sk_state & PPPOX_CONNECTED)) 1076 break; 1077 1078 err = -EFAULT; 1079 if (get_user(val, (int __user *) arg)) 1080 break; 1081 1082 session->mru = val; 1083 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mru=%d\n", 1084 session->name, session->mru); 1085 err = 0; 1086 break; 1087 1088 case PPPIOCGFLAGS: 1089 err = -EFAULT; 1090 if (put_user(ps->flags, (int __user *) arg)) 1091 break; 1092 1093 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get flags=%d\n", 1094 session->name, ps->flags); 1095 err = 0; 1096 break; 1097 1098 case PPPIOCSFLAGS: 1099 err = -EFAULT; 1100 if (get_user(val, (int __user *) arg)) 1101 break; 1102 ps->flags = val; 1103 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set flags=%d\n", 1104 session->name, ps->flags); 1105 err = 0; 1106 break; 1107 1108 case PPPIOCGL2TPSTATS: 1109 err = -ENXIO; 1110 if (!(sk->sk_state & PPPOX_CONNECTED)) 1111 break; 1112 1113 memset(&stats, 0, sizeof(stats)); 1114 stats.tunnel_id = tunnel->tunnel_id; 1115 stats.session_id = session->session_id; 1116 pppol2tp_copy_stats(&stats, &session->stats); 1117 if (copy_to_user((void __user *) arg, &stats, 1118 sizeof(stats))) 1119 break; 1120 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1121 session->name); 1122 err = 0; 1123 break; 1124 1125 default: 1126 err = -ENOSYS; 1127 break; 1128 } 1129 1130 sock_put(sk); 1131 1132 return err; 1133 } 1134 1135 /* Tunnel ioctl helper. 1136 * 1137 * Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data 1138 * specifies a session_id, the session ioctl handler is called. This allows an 1139 * application to retrieve session stats via a tunnel socket. 1140 */ 1141 static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel, 1142 unsigned int cmd, unsigned long arg) 1143 { 1144 int err = 0; 1145 struct sock *sk; 1146 struct pppol2tp_ioc_stats stats; 1147 1148 l2tp_dbg(tunnel, L2TP_MSG_CONTROL, 1149 "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n", 1150 tunnel->name, cmd, arg); 1151 1152 sk = tunnel->sock; 1153 sock_hold(sk); 1154 1155 switch (cmd) { 1156 case PPPIOCGL2TPSTATS: 1157 err = -ENXIO; 1158 if (!(sk->sk_state & PPPOX_CONNECTED)) 1159 break; 1160 1161 if (copy_from_user(&stats, (void __user *) arg, 1162 sizeof(stats))) { 1163 err = -EFAULT; 1164 break; 1165 } 1166 if (stats.session_id != 0) { 1167 /* resend to session ioctl handler */ 1168 struct l2tp_session *session = 1169 l2tp_session_get(sock_net(sk), tunnel, 1170 stats.session_id); 1171 1172 if (session) { 1173 err = pppol2tp_session_ioctl(session, cmd, 1174 arg); 1175 l2tp_session_dec_refcount(session); 1176 } else { 1177 err = -EBADR; 1178 } 1179 break; 1180 } 1181 #ifdef CONFIG_XFRM 1182 stats.using_ipsec = (sk->sk_policy[0] || sk->sk_policy[1]) ? 1 : 0; 1183 #endif 1184 pppol2tp_copy_stats(&stats, &tunnel->stats); 1185 if (copy_to_user((void __user *) arg, &stats, sizeof(stats))) { 1186 err = -EFAULT; 1187 break; 1188 } 1189 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1190 tunnel->name); 1191 err = 0; 1192 break; 1193 1194 default: 1195 err = -ENOSYS; 1196 break; 1197 } 1198 1199 sock_put(sk); 1200 1201 return err; 1202 } 1203 1204 /* Main ioctl() handler. 1205 * Dispatch to tunnel or session helpers depending on the socket. 1206 */ 1207 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, 1208 unsigned long arg) 1209 { 1210 struct sock *sk = sock->sk; 1211 struct l2tp_session *session; 1212 struct l2tp_tunnel *tunnel; 1213 int err; 1214 1215 if (!sk) 1216 return 0; 1217 1218 err = -EBADF; 1219 if (sock_flag(sk, SOCK_DEAD) != 0) 1220 goto end; 1221 1222 err = -ENOTCONN; 1223 if ((sk->sk_user_data == NULL) || 1224 (!(sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)))) 1225 goto end; 1226 1227 /* Get session context from the socket */ 1228 err = -EBADF; 1229 session = pppol2tp_sock_to_session(sk); 1230 if (session == NULL) 1231 goto end; 1232 1233 /* Special case: if session's session_id is zero, treat ioctl as a 1234 * tunnel ioctl 1235 */ 1236 if ((session->session_id == 0) && 1237 (session->peer_session_id == 0)) { 1238 tunnel = session->tunnel; 1239 err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg); 1240 goto end_put_sess; 1241 } 1242 1243 err = pppol2tp_session_ioctl(session, cmd, arg); 1244 1245 end_put_sess: 1246 sock_put(sk); 1247 end: 1248 return err; 1249 } 1250 1251 /***************************************************************************** 1252 * setsockopt() / getsockopt() support. 1253 * 1254 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1255 * sockets. In order to control kernel tunnel features, we allow userspace to 1256 * create a special "tunnel" PPPoX socket which is used for control only. 1257 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user 1258 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls. 1259 *****************************************************************************/ 1260 1261 /* Tunnel setsockopt() helper. 1262 */ 1263 static int pppol2tp_tunnel_setsockopt(struct sock *sk, 1264 struct l2tp_tunnel *tunnel, 1265 int optname, int val) 1266 { 1267 int err = 0; 1268 1269 switch (optname) { 1270 case PPPOL2TP_SO_DEBUG: 1271 tunnel->debug = val; 1272 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1273 tunnel->name, tunnel->debug); 1274 break; 1275 1276 default: 1277 err = -ENOPROTOOPT; 1278 break; 1279 } 1280 1281 return err; 1282 } 1283 1284 /* Session setsockopt helper. 1285 */ 1286 static int pppol2tp_session_setsockopt(struct sock *sk, 1287 struct l2tp_session *session, 1288 int optname, int val) 1289 { 1290 int err = 0; 1291 1292 switch (optname) { 1293 case PPPOL2TP_SO_RECVSEQ: 1294 if ((val != 0) && (val != 1)) { 1295 err = -EINVAL; 1296 break; 1297 } 1298 session->recv_seq = !!val; 1299 l2tp_info(session, L2TP_MSG_CONTROL, 1300 "%s: set recv_seq=%d\n", 1301 session->name, session->recv_seq); 1302 break; 1303 1304 case PPPOL2TP_SO_SENDSEQ: 1305 if ((val != 0) && (val != 1)) { 1306 err = -EINVAL; 1307 break; 1308 } 1309 session->send_seq = !!val; 1310 { 1311 struct pppox_sock *po = pppox_sk(sk); 1312 1313 po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ : 1314 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 1315 } 1316 l2tp_session_set_header_len(session, session->tunnel->version); 1317 l2tp_info(session, L2TP_MSG_CONTROL, 1318 "%s: set send_seq=%d\n", 1319 session->name, session->send_seq); 1320 break; 1321 1322 case PPPOL2TP_SO_LNSMODE: 1323 if ((val != 0) && (val != 1)) { 1324 err = -EINVAL; 1325 break; 1326 } 1327 session->lns_mode = !!val; 1328 l2tp_info(session, L2TP_MSG_CONTROL, 1329 "%s: set lns_mode=%d\n", 1330 session->name, session->lns_mode); 1331 break; 1332 1333 case PPPOL2TP_SO_DEBUG: 1334 session->debug = val; 1335 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1336 session->name, session->debug); 1337 break; 1338 1339 case PPPOL2TP_SO_REORDERTO: 1340 session->reorder_timeout = msecs_to_jiffies(val); 1341 l2tp_info(session, L2TP_MSG_CONTROL, 1342 "%s: set reorder_timeout=%d\n", 1343 session->name, session->reorder_timeout); 1344 break; 1345 1346 default: 1347 err = -ENOPROTOOPT; 1348 break; 1349 } 1350 1351 return err; 1352 } 1353 1354 /* Main setsockopt() entry point. 1355 * Does API checks, then calls either the tunnel or session setsockopt 1356 * handler, according to whether the PPPoL2TP socket is a for a regular 1357 * session or the special tunnel type. 1358 */ 1359 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, 1360 char __user *optval, unsigned int optlen) 1361 { 1362 struct sock *sk = sock->sk; 1363 struct l2tp_session *session; 1364 struct l2tp_tunnel *tunnel; 1365 int val; 1366 int err; 1367 1368 if (level != SOL_PPPOL2TP) 1369 return -EINVAL; 1370 1371 if (optlen < sizeof(int)) 1372 return -EINVAL; 1373 1374 if (get_user(val, (int __user *)optval)) 1375 return -EFAULT; 1376 1377 err = -ENOTCONN; 1378 if (sk->sk_user_data == NULL) 1379 goto end; 1380 1381 /* Get session context from the socket */ 1382 err = -EBADF; 1383 session = pppol2tp_sock_to_session(sk); 1384 if (session == NULL) 1385 goto end; 1386 1387 /* Special case: if session_id == 0x0000, treat as operation on tunnel 1388 */ 1389 if ((session->session_id == 0) && 1390 (session->peer_session_id == 0)) { 1391 tunnel = session->tunnel; 1392 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val); 1393 } else { 1394 err = pppol2tp_session_setsockopt(sk, session, optname, val); 1395 } 1396 1397 sock_put(sk); 1398 end: 1399 return err; 1400 } 1401 1402 /* Tunnel getsockopt helper. Called with sock locked. 1403 */ 1404 static int pppol2tp_tunnel_getsockopt(struct sock *sk, 1405 struct l2tp_tunnel *tunnel, 1406 int optname, int *val) 1407 { 1408 int err = 0; 1409 1410 switch (optname) { 1411 case PPPOL2TP_SO_DEBUG: 1412 *val = tunnel->debug; 1413 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get debug=%x\n", 1414 tunnel->name, tunnel->debug); 1415 break; 1416 1417 default: 1418 err = -ENOPROTOOPT; 1419 break; 1420 } 1421 1422 return err; 1423 } 1424 1425 /* Session getsockopt helper. Called with sock locked. 1426 */ 1427 static int pppol2tp_session_getsockopt(struct sock *sk, 1428 struct l2tp_session *session, 1429 int optname, int *val) 1430 { 1431 int err = 0; 1432 1433 switch (optname) { 1434 case PPPOL2TP_SO_RECVSEQ: 1435 *val = session->recv_seq; 1436 l2tp_info(session, L2TP_MSG_CONTROL, 1437 "%s: get recv_seq=%d\n", session->name, *val); 1438 break; 1439 1440 case PPPOL2TP_SO_SENDSEQ: 1441 *val = session->send_seq; 1442 l2tp_info(session, L2TP_MSG_CONTROL, 1443 "%s: get send_seq=%d\n", session->name, *val); 1444 break; 1445 1446 case PPPOL2TP_SO_LNSMODE: 1447 *val = session->lns_mode; 1448 l2tp_info(session, L2TP_MSG_CONTROL, 1449 "%s: get lns_mode=%d\n", session->name, *val); 1450 break; 1451 1452 case PPPOL2TP_SO_DEBUG: 1453 *val = session->debug; 1454 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get debug=%d\n", 1455 session->name, *val); 1456 break; 1457 1458 case PPPOL2TP_SO_REORDERTO: 1459 *val = (int) jiffies_to_msecs(session->reorder_timeout); 1460 l2tp_info(session, L2TP_MSG_CONTROL, 1461 "%s: get reorder_timeout=%d\n", session->name, *val); 1462 break; 1463 1464 default: 1465 err = -ENOPROTOOPT; 1466 } 1467 1468 return err; 1469 } 1470 1471 /* Main getsockopt() entry point. 1472 * Does API checks, then calls either the tunnel or session getsockopt 1473 * handler, according to whether the PPPoX socket is a for a regular session 1474 * or the special tunnel type. 1475 */ 1476 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, 1477 char __user *optval, int __user *optlen) 1478 { 1479 struct sock *sk = sock->sk; 1480 struct l2tp_session *session; 1481 struct l2tp_tunnel *tunnel; 1482 int val, len; 1483 int err; 1484 1485 if (level != SOL_PPPOL2TP) 1486 return -EINVAL; 1487 1488 if (get_user(len, optlen)) 1489 return -EFAULT; 1490 1491 len = min_t(unsigned int, len, sizeof(int)); 1492 1493 if (len < 0) 1494 return -EINVAL; 1495 1496 err = -ENOTCONN; 1497 if (sk->sk_user_data == NULL) 1498 goto end; 1499 1500 /* Get the session context */ 1501 err = -EBADF; 1502 session = pppol2tp_sock_to_session(sk); 1503 if (session == NULL) 1504 goto end; 1505 1506 /* Special case: if session_id == 0x0000, treat as operation on tunnel */ 1507 if ((session->session_id == 0) && 1508 (session->peer_session_id == 0)) { 1509 tunnel = session->tunnel; 1510 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val); 1511 if (err) 1512 goto end_put_sess; 1513 } else { 1514 err = pppol2tp_session_getsockopt(sk, session, optname, &val); 1515 if (err) 1516 goto end_put_sess; 1517 } 1518 1519 err = -EFAULT; 1520 if (put_user(len, optlen)) 1521 goto end_put_sess; 1522 1523 if (copy_to_user((void __user *) optval, &val, len)) 1524 goto end_put_sess; 1525 1526 err = 0; 1527 1528 end_put_sess: 1529 sock_put(sk); 1530 end: 1531 return err; 1532 } 1533 1534 /***************************************************************************** 1535 * /proc filesystem for debug 1536 * Since the original pppol2tp driver provided /proc/net/pppol2tp for 1537 * L2TPv2, we dump only L2TPv2 tunnels and sessions here. 1538 *****************************************************************************/ 1539 1540 static unsigned int pppol2tp_net_id; 1541 1542 #ifdef CONFIG_PROC_FS 1543 1544 struct pppol2tp_seq_data { 1545 struct seq_net_private p; 1546 int tunnel_idx; /* current tunnel */ 1547 int session_idx; /* index of session within current tunnel */ 1548 struct l2tp_tunnel *tunnel; 1549 struct l2tp_session *session; /* NULL means get next tunnel */ 1550 }; 1551 1552 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) 1553 { 1554 for (;;) { 1555 pd->tunnel = l2tp_tunnel_find_nth(net, pd->tunnel_idx); 1556 pd->tunnel_idx++; 1557 1558 if (pd->tunnel == NULL) 1559 break; 1560 1561 /* Ignore L2TPv3 tunnels */ 1562 if (pd->tunnel->version < 3) 1563 break; 1564 } 1565 } 1566 1567 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) 1568 { 1569 pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx); 1570 pd->session_idx++; 1571 1572 if (pd->session == NULL) { 1573 pd->session_idx = 0; 1574 pppol2tp_next_tunnel(net, pd); 1575 } 1576 } 1577 1578 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs) 1579 { 1580 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN; 1581 loff_t pos = *offs; 1582 struct net *net; 1583 1584 if (!pos) 1585 goto out; 1586 1587 BUG_ON(m->private == NULL); 1588 pd = m->private; 1589 net = seq_file_net(m); 1590 1591 if (pd->tunnel == NULL) 1592 pppol2tp_next_tunnel(net, pd); 1593 else 1594 pppol2tp_next_session(net, pd); 1595 1596 /* NULL tunnel and session indicates end of list */ 1597 if ((pd->tunnel == NULL) && (pd->session == NULL)) 1598 pd = NULL; 1599 1600 out: 1601 return pd; 1602 } 1603 1604 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos) 1605 { 1606 (*pos)++; 1607 return NULL; 1608 } 1609 1610 static void pppol2tp_seq_stop(struct seq_file *p, void *v) 1611 { 1612 /* nothing to do */ 1613 } 1614 1615 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) 1616 { 1617 struct l2tp_tunnel *tunnel = v; 1618 1619 seq_printf(m, "\nTUNNEL '%s', %c %d\n", 1620 tunnel->name, 1621 (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N', 1622 refcount_read(&tunnel->ref_count) - 1); 1623 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n", 1624 tunnel->debug, 1625 atomic_long_read(&tunnel->stats.tx_packets), 1626 atomic_long_read(&tunnel->stats.tx_bytes), 1627 atomic_long_read(&tunnel->stats.tx_errors), 1628 atomic_long_read(&tunnel->stats.rx_packets), 1629 atomic_long_read(&tunnel->stats.rx_bytes), 1630 atomic_long_read(&tunnel->stats.rx_errors)); 1631 } 1632 1633 static void pppol2tp_seq_session_show(struct seq_file *m, void *v) 1634 { 1635 struct l2tp_session *session = v; 1636 struct l2tp_tunnel *tunnel = session->tunnel; 1637 unsigned char state; 1638 char user_data_ok; 1639 struct sock *sk; 1640 u32 ip = 0; 1641 u16 port = 0; 1642 1643 if (tunnel->sock) { 1644 struct inet_sock *inet = inet_sk(tunnel->sock); 1645 ip = ntohl(inet->inet_saddr); 1646 port = ntohs(inet->inet_sport); 1647 } 1648 1649 sk = pppol2tp_session_get_sock(session); 1650 if (sk) { 1651 state = sk->sk_state; 1652 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N'; 1653 } else { 1654 state = 0; 1655 user_data_ok = 'N'; 1656 } 1657 1658 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> " 1659 "%04X/%04X %d %c\n", 1660 session->name, ip, port, 1661 tunnel->tunnel_id, 1662 session->session_id, 1663 tunnel->peer_tunnel_id, 1664 session->peer_session_id, 1665 state, user_data_ok); 1666 seq_printf(m, " %d/%d/%c/%c/%s %08x %u\n", 1667 session->mtu, session->mru, 1668 session->recv_seq ? 'R' : '-', 1669 session->send_seq ? 'S' : '-', 1670 session->lns_mode ? "LNS" : "LAC", 1671 session->debug, 1672 jiffies_to_msecs(session->reorder_timeout)); 1673 seq_printf(m, " %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n", 1674 session->nr, session->ns, 1675 atomic_long_read(&session->stats.tx_packets), 1676 atomic_long_read(&session->stats.tx_bytes), 1677 atomic_long_read(&session->stats.tx_errors), 1678 atomic_long_read(&session->stats.rx_packets), 1679 atomic_long_read(&session->stats.rx_bytes), 1680 atomic_long_read(&session->stats.rx_errors)); 1681 1682 if (sk) { 1683 struct pppox_sock *po = pppox_sk(sk); 1684 1685 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 1686 sock_put(sk); 1687 } 1688 } 1689 1690 static int pppol2tp_seq_show(struct seq_file *m, void *v) 1691 { 1692 struct pppol2tp_seq_data *pd = v; 1693 1694 /* display header on line 1 */ 1695 if (v == SEQ_START_TOKEN) { 1696 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n"); 1697 seq_puts(m, "TUNNEL name, user-data-ok session-count\n"); 1698 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1699 seq_puts(m, " SESSION name, addr/port src-tid/sid " 1700 "dest-tid/sid state user-data-ok\n"); 1701 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n"); 1702 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1703 goto out; 1704 } 1705 1706 /* Show the tunnel or session context. 1707 */ 1708 if (!pd->session) { 1709 pppol2tp_seq_tunnel_show(m, pd->tunnel); 1710 } else { 1711 pppol2tp_seq_session_show(m, pd->session); 1712 l2tp_session_dec_refcount(pd->session); 1713 } 1714 1715 out: 1716 return 0; 1717 } 1718 1719 static const struct seq_operations pppol2tp_seq_ops = { 1720 .start = pppol2tp_seq_start, 1721 .next = pppol2tp_seq_next, 1722 .stop = pppol2tp_seq_stop, 1723 .show = pppol2tp_seq_show, 1724 }; 1725 1726 /* Called when our /proc file is opened. We allocate data for use when 1727 * iterating our tunnel / session contexts and store it in the private 1728 * data of the seq_file. 1729 */ 1730 static int pppol2tp_proc_open(struct inode *inode, struct file *file) 1731 { 1732 return seq_open_net(inode, file, &pppol2tp_seq_ops, 1733 sizeof(struct pppol2tp_seq_data)); 1734 } 1735 1736 static const struct file_operations pppol2tp_proc_fops = { 1737 .open = pppol2tp_proc_open, 1738 .read = seq_read, 1739 .llseek = seq_lseek, 1740 .release = seq_release_net, 1741 }; 1742 1743 #endif /* CONFIG_PROC_FS */ 1744 1745 /***************************************************************************** 1746 * Network namespace 1747 *****************************************************************************/ 1748 1749 static __net_init int pppol2tp_init_net(struct net *net) 1750 { 1751 struct proc_dir_entry *pde; 1752 int err = 0; 1753 1754 pde = proc_create("pppol2tp", 0444, net->proc_net, 1755 &pppol2tp_proc_fops); 1756 if (!pde) { 1757 err = -ENOMEM; 1758 goto out; 1759 } 1760 1761 out: 1762 return err; 1763 } 1764 1765 static __net_exit void pppol2tp_exit_net(struct net *net) 1766 { 1767 remove_proc_entry("pppol2tp", net->proc_net); 1768 } 1769 1770 static struct pernet_operations pppol2tp_net_ops = { 1771 .init = pppol2tp_init_net, 1772 .exit = pppol2tp_exit_net, 1773 .id = &pppol2tp_net_id, 1774 }; 1775 1776 /***************************************************************************** 1777 * Init and cleanup 1778 *****************************************************************************/ 1779 1780 static const struct proto_ops pppol2tp_ops = { 1781 .family = AF_PPPOX, 1782 .owner = THIS_MODULE, 1783 .release = pppol2tp_release, 1784 .bind = sock_no_bind, 1785 .connect = pppol2tp_connect, 1786 .socketpair = sock_no_socketpair, 1787 .accept = sock_no_accept, 1788 .getname = pppol2tp_getname, 1789 .poll = datagram_poll, 1790 .listen = sock_no_listen, 1791 .shutdown = sock_no_shutdown, 1792 .setsockopt = pppol2tp_setsockopt, 1793 .getsockopt = pppol2tp_getsockopt, 1794 .sendmsg = pppol2tp_sendmsg, 1795 .recvmsg = pppol2tp_recvmsg, 1796 .mmap = sock_no_mmap, 1797 .ioctl = pppox_ioctl, 1798 }; 1799 1800 static const struct pppox_proto pppol2tp_proto = { 1801 .create = pppol2tp_create, 1802 .ioctl = pppol2tp_ioctl, 1803 .owner = THIS_MODULE, 1804 }; 1805 1806 #ifdef CONFIG_L2TP_V3 1807 1808 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = { 1809 .session_create = pppol2tp_session_create, 1810 .session_delete = l2tp_session_delete, 1811 }; 1812 1813 #endif /* CONFIG_L2TP_V3 */ 1814 1815 static int __init pppol2tp_init(void) 1816 { 1817 int err; 1818 1819 err = register_pernet_device(&pppol2tp_net_ops); 1820 if (err) 1821 goto out; 1822 1823 err = proto_register(&pppol2tp_sk_proto, 0); 1824 if (err) 1825 goto out_unregister_pppol2tp_pernet; 1826 1827 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto); 1828 if (err) 1829 goto out_unregister_pppol2tp_proto; 1830 1831 #ifdef CONFIG_L2TP_V3 1832 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops); 1833 if (err) 1834 goto out_unregister_pppox; 1835 #endif 1836 1837 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION); 1838 1839 out: 1840 return err; 1841 1842 #ifdef CONFIG_L2TP_V3 1843 out_unregister_pppox: 1844 unregister_pppox_proto(PX_PROTO_OL2TP); 1845 #endif 1846 out_unregister_pppol2tp_proto: 1847 proto_unregister(&pppol2tp_sk_proto); 1848 out_unregister_pppol2tp_pernet: 1849 unregister_pernet_device(&pppol2tp_net_ops); 1850 goto out; 1851 } 1852 1853 static void __exit pppol2tp_exit(void) 1854 { 1855 #ifdef CONFIG_L2TP_V3 1856 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP); 1857 #endif 1858 unregister_pppox_proto(PX_PROTO_OL2TP); 1859 proto_unregister(&pppol2tp_sk_proto); 1860 unregister_pernet_device(&pppol2tp_net_ops); 1861 } 1862 1863 module_init(pppol2tp_init); 1864 module_exit(pppol2tp_exit); 1865 1866 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1867 MODULE_DESCRIPTION("PPP over L2TP over UDP"); 1868 MODULE_LICENSE("GPL"); 1869 MODULE_VERSION(PPPOL2TP_DRV_VERSION); 1870 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP); 1871 MODULE_ALIAS_L2TP_PWTYPE(7); 1872