1 /***************************************************************************** 2 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets 3 * 4 * PPPoX --- Generic PPP encapsulation socket family 5 * PPPoL2TP --- PPP over L2TP (RFC 2661) 6 * 7 * Version: 2.0.0 8 * 9 * Authors: James Chapman (jchapman@katalix.com) 10 * 11 * Based on original work by Martijn van Oosterhout <kleptog@svana.org> 12 * 13 * License: 14 * This program is free software; you can redistribute it and/or 15 * modify it under the terms of the GNU General Public License 16 * as published by the Free Software Foundation; either version 17 * 2 of the License, or (at your option) any later version. 18 * 19 */ 20 21 /* This driver handles only L2TP data frames; control frames are handled by a 22 * userspace application. 23 * 24 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and 25 * attaches it to a bound UDP socket with local tunnel_id / session_id and 26 * peer tunnel_id / session_id set. Data can then be sent or received using 27 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket 28 * can be read or modified using ioctl() or [gs]etsockopt() calls. 29 * 30 * When a PPPoL2TP socket is connected with local and peer session_id values 31 * zero, the socket is treated as a special tunnel management socket. 32 * 33 * Here's example userspace code to create a socket for sending/receiving data 34 * over an L2TP session:- 35 * 36 * struct sockaddr_pppol2tp sax; 37 * int fd; 38 * int session_fd; 39 * 40 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); 41 * 42 * sax.sa_family = AF_PPPOX; 43 * sax.sa_protocol = PX_PROTO_OL2TP; 44 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket 45 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr; 46 * sax.pppol2tp.addr.sin_port = addr->sin_port; 47 * sax.pppol2tp.addr.sin_family = AF_INET; 48 * sax.pppol2tp.s_tunnel = tunnel_id; 49 * sax.pppol2tp.s_session = session_id; 50 * sax.pppol2tp.d_tunnel = peer_tunnel_id; 51 * sax.pppol2tp.d_session = peer_session_id; 52 * 53 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax)); 54 * 55 * A pppd plugin that allows PPP traffic to be carried over L2TP using 56 * this driver is available from the OpenL2TP project at 57 * http://openl2tp.sourceforge.net. 58 */ 59 60 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 61 62 #include <linux/module.h> 63 #include <linux/string.h> 64 #include <linux/list.h> 65 #include <linux/uaccess.h> 66 67 #include <linux/kernel.h> 68 #include <linux/spinlock.h> 69 #include <linux/kthread.h> 70 #include <linux/sched.h> 71 #include <linux/slab.h> 72 #include <linux/errno.h> 73 #include <linux/jiffies.h> 74 75 #include <linux/netdevice.h> 76 #include <linux/net.h> 77 #include <linux/inetdevice.h> 78 #include <linux/skbuff.h> 79 #include <linux/init.h> 80 #include <linux/ip.h> 81 #include <linux/udp.h> 82 #include <linux/if_pppox.h> 83 #include <linux/if_pppol2tp.h> 84 #include <net/sock.h> 85 #include <linux/ppp_channel.h> 86 #include <linux/ppp_defs.h> 87 #include <linux/ppp-ioctl.h> 88 #include <linux/file.h> 89 #include <linux/hash.h> 90 #include <linux/sort.h> 91 #include <linux/proc_fs.h> 92 #include <linux/l2tp.h> 93 #include <linux/nsproxy.h> 94 #include <net/net_namespace.h> 95 #include <net/netns/generic.h> 96 #include <net/dst.h> 97 #include <net/ip.h> 98 #include <net/udp.h> 99 #include <net/xfrm.h> 100 #include <net/inet_common.h> 101 102 #include <asm/byteorder.h> 103 #include <linux/atomic.h> 104 105 #include "l2tp_core.h" 106 107 #define PPPOL2TP_DRV_VERSION "V2.0" 108 109 /* Space for UDP, L2TP and PPP headers */ 110 #define PPPOL2TP_HEADER_OVERHEAD 40 111 112 /* Number of bytes to build transmit L2TP headers. 113 * Unfortunately the size is different depending on whether sequence numbers 114 * are enabled. 115 */ 116 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10 117 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6 118 119 /* Private data of each session. This data lives at the end of struct 120 * l2tp_session, referenced via session->priv[]. 121 */ 122 struct pppol2tp_session { 123 int owner; /* pid that opened the socket */ 124 125 struct mutex sk_lock; /* Protects .sk */ 126 struct sock __rcu *sk; /* Pointer to the session 127 * PPPoX socket */ 128 struct sock *__sk; /* Copy of .sk, for cleanup */ 129 struct rcu_head rcu; /* For asynchronous release */ 130 int flags; /* accessed by PPPIOCGFLAGS. 131 * Unused. */ 132 }; 133 134 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb); 135 136 static const struct ppp_channel_ops pppol2tp_chan_ops = { 137 .start_xmit = pppol2tp_xmit, 138 }; 139 140 static const struct proto_ops pppol2tp_ops; 141 142 /* Retrieves the pppol2tp socket associated to a session. 143 * A reference is held on the returned socket, so this function must be paired 144 * with sock_put(). 145 */ 146 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session) 147 { 148 struct pppol2tp_session *ps = l2tp_session_priv(session); 149 struct sock *sk; 150 151 rcu_read_lock(); 152 sk = rcu_dereference(ps->sk); 153 if (sk) 154 sock_hold(sk); 155 rcu_read_unlock(); 156 157 return sk; 158 } 159 160 /* Helpers to obtain tunnel/session contexts from sockets. 161 */ 162 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk) 163 { 164 struct l2tp_session *session; 165 166 if (sk == NULL) 167 return NULL; 168 169 sock_hold(sk); 170 session = (struct l2tp_session *)(sk->sk_user_data); 171 if (session == NULL) { 172 sock_put(sk); 173 goto out; 174 } 175 176 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 177 178 out: 179 return session; 180 } 181 182 /***************************************************************************** 183 * Receive data handling 184 *****************************************************************************/ 185 186 static int pppol2tp_recv_payload_hook(struct sk_buff *skb) 187 { 188 /* Skip PPP header, if present. In testing, Microsoft L2TP clients 189 * don't send the PPP header (PPP header compression enabled), but 190 * other clients can include the header. So we cope with both cases 191 * here. The PPP header is always FF03 when using L2TP. 192 * 193 * Note that skb->data[] isn't dereferenced from a u16 ptr here since 194 * the field may be unaligned. 195 */ 196 if (!pskb_may_pull(skb, 2)) 197 return 1; 198 199 if ((skb->data[0] == PPP_ALLSTATIONS) && (skb->data[1] == PPP_UI)) 200 skb_pull(skb, 2); 201 202 return 0; 203 } 204 205 /* Receive message. This is the recvmsg for the PPPoL2TP socket. 206 */ 207 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, 208 size_t len, int flags) 209 { 210 int err; 211 struct sk_buff *skb; 212 struct sock *sk = sock->sk; 213 214 err = -EIO; 215 if (sk->sk_state & PPPOX_BOUND) 216 goto end; 217 218 err = 0; 219 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 220 flags & MSG_DONTWAIT, &err); 221 if (!skb) 222 goto end; 223 224 if (len > skb->len) 225 len = skb->len; 226 else if (len < skb->len) 227 msg->msg_flags |= MSG_TRUNC; 228 229 err = skb_copy_datagram_msg(skb, 0, msg, len); 230 if (likely(err == 0)) 231 err = len; 232 233 kfree_skb(skb); 234 end: 235 return err; 236 } 237 238 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len) 239 { 240 struct pppol2tp_session *ps = l2tp_session_priv(session); 241 struct sock *sk = NULL; 242 243 /* If the socket is bound, send it in to PPP's input queue. Otherwise 244 * queue it on the session socket. 245 */ 246 rcu_read_lock(); 247 sk = rcu_dereference(ps->sk); 248 if (sk == NULL) 249 goto no_sock; 250 251 if (sk->sk_state & PPPOX_BOUND) { 252 struct pppox_sock *po; 253 254 l2tp_dbg(session, L2TP_MSG_DATA, 255 "%s: recv %d byte data frame, passing to ppp\n", 256 session->name, data_len); 257 258 po = pppox_sk(sk); 259 ppp_input(&po->chan, skb); 260 } else { 261 l2tp_dbg(session, L2TP_MSG_DATA, 262 "%s: recv %d byte data frame, passing to L2TP socket\n", 263 session->name, data_len); 264 265 if (sock_queue_rcv_skb(sk, skb) < 0) { 266 atomic_long_inc(&session->stats.rx_errors); 267 kfree_skb(skb); 268 } 269 } 270 rcu_read_unlock(); 271 272 return; 273 274 no_sock: 275 rcu_read_unlock(); 276 l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name); 277 kfree_skb(skb); 278 } 279 280 /************************************************************************ 281 * Transmit handling 282 ***********************************************************************/ 283 284 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here 285 * when a user application does a sendmsg() on the session socket. L2TP and 286 * PPP headers must be inserted into the user's data. 287 */ 288 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m, 289 size_t total_len) 290 { 291 struct sock *sk = sock->sk; 292 struct sk_buff *skb; 293 int error; 294 struct l2tp_session *session; 295 struct l2tp_tunnel *tunnel; 296 int uhlen; 297 298 error = -ENOTCONN; 299 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 300 goto error; 301 302 /* Get session and tunnel contexts */ 303 error = -EBADF; 304 session = pppol2tp_sock_to_session(sk); 305 if (session == NULL) 306 goto error; 307 308 tunnel = session->tunnel; 309 310 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 311 312 /* Allocate a socket buffer */ 313 error = -ENOMEM; 314 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) + 315 uhlen + session->hdr_len + 316 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 317 0, GFP_KERNEL); 318 if (!skb) 319 goto error_put_sess; 320 321 /* Reserve space for headers. */ 322 skb_reserve(skb, NET_SKB_PAD); 323 skb_reset_network_header(skb); 324 skb_reserve(skb, sizeof(struct iphdr)); 325 skb_reset_transport_header(skb); 326 skb_reserve(skb, uhlen); 327 328 /* Add PPP header */ 329 skb->data[0] = PPP_ALLSTATIONS; 330 skb->data[1] = PPP_UI; 331 skb_put(skb, 2); 332 333 /* Copy user data into skb */ 334 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len); 335 if (error < 0) { 336 kfree_skb(skb); 337 goto error_put_sess; 338 } 339 340 local_bh_disable(); 341 l2tp_xmit_skb(session, skb, session->hdr_len); 342 local_bh_enable(); 343 344 sock_put(sk); 345 346 return total_len; 347 348 error_put_sess: 349 sock_put(sk); 350 error: 351 return error; 352 } 353 354 /* Transmit function called by generic PPP driver. Sends PPP frame 355 * over PPPoL2TP socket. 356 * 357 * This is almost the same as pppol2tp_sendmsg(), but rather than 358 * being called with a msghdr from userspace, it is called with a skb 359 * from the kernel. 360 * 361 * The supplied skb from ppp doesn't have enough headroom for the 362 * insertion of L2TP, UDP and IP headers so we need to allocate more 363 * headroom in the skb. This will create a cloned skb. But we must be 364 * careful in the error case because the caller will expect to free 365 * the skb it supplied, not our cloned skb. So we take care to always 366 * leave the original skb unfreed if we return an error. 367 */ 368 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) 369 { 370 struct sock *sk = (struct sock *) chan->private; 371 struct l2tp_session *session; 372 struct l2tp_tunnel *tunnel; 373 int uhlen, headroom; 374 375 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 376 goto abort; 377 378 /* Get session and tunnel contexts from the socket */ 379 session = pppol2tp_sock_to_session(sk); 380 if (session == NULL) 381 goto abort; 382 383 tunnel = session->tunnel; 384 385 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 386 headroom = NET_SKB_PAD + 387 sizeof(struct iphdr) + /* IP header */ 388 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */ 389 session->hdr_len + /* L2TP header */ 390 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */ 391 if (skb_cow_head(skb, headroom)) 392 goto abort_put_sess; 393 394 /* Setup PPP header */ 395 __skb_push(skb, 2); 396 skb->data[0] = PPP_ALLSTATIONS; 397 skb->data[1] = PPP_UI; 398 399 local_bh_disable(); 400 l2tp_xmit_skb(session, skb, session->hdr_len); 401 local_bh_enable(); 402 403 sock_put(sk); 404 405 return 1; 406 407 abort_put_sess: 408 sock_put(sk); 409 abort: 410 /* Free the original skb */ 411 kfree_skb(skb); 412 return 1; 413 } 414 415 /***************************************************************************** 416 * Session (and tunnel control) socket create/destroy. 417 *****************************************************************************/ 418 419 static void pppol2tp_put_sk(struct rcu_head *head) 420 { 421 struct pppol2tp_session *ps; 422 423 ps = container_of(head, typeof(*ps), rcu); 424 sock_put(ps->__sk); 425 } 426 427 /* Really kill the session socket. (Called from sock_put() if 428 * refcnt == 0.) 429 */ 430 static void pppol2tp_session_destruct(struct sock *sk) 431 { 432 struct l2tp_session *session = sk->sk_user_data; 433 434 skb_queue_purge(&sk->sk_receive_queue); 435 skb_queue_purge(&sk->sk_write_queue); 436 437 if (session) { 438 sk->sk_user_data = NULL; 439 BUG_ON(session->magic != L2TP_SESSION_MAGIC); 440 l2tp_session_dec_refcount(session); 441 } 442 } 443 444 /* Called when the PPPoX socket (session) is closed. 445 */ 446 static int pppol2tp_release(struct socket *sock) 447 { 448 struct sock *sk = sock->sk; 449 struct l2tp_session *session; 450 int error; 451 452 if (!sk) 453 return 0; 454 455 error = -EBADF; 456 lock_sock(sk); 457 if (sock_flag(sk, SOCK_DEAD) != 0) 458 goto error; 459 460 pppox_unbind_sock(sk); 461 462 /* Signal the death of the socket. */ 463 sk->sk_state = PPPOX_DEAD; 464 sock_orphan(sk); 465 sock->sk = NULL; 466 467 session = pppol2tp_sock_to_session(sk); 468 if (session) { 469 struct pppol2tp_session *ps; 470 471 l2tp_session_delete(session); 472 473 ps = l2tp_session_priv(session); 474 mutex_lock(&ps->sk_lock); 475 ps->__sk = rcu_dereference_protected(ps->sk, 476 lockdep_is_held(&ps->sk_lock)); 477 RCU_INIT_POINTER(ps->sk, NULL); 478 mutex_unlock(&ps->sk_lock); 479 call_rcu(&ps->rcu, pppol2tp_put_sk); 480 481 /* Rely on the sock_put() call at the end of the function for 482 * dropping the reference held by pppol2tp_sock_to_session(). 483 * The last reference will be dropped by pppol2tp_put_sk(). 484 */ 485 } 486 487 release_sock(sk); 488 489 /* This will delete the session context via 490 * pppol2tp_session_destruct() if the socket's refcnt drops to 491 * zero. 492 */ 493 sock_put(sk); 494 495 return 0; 496 497 error: 498 release_sock(sk); 499 return error; 500 } 501 502 static struct proto pppol2tp_sk_proto = { 503 .name = "PPPOL2TP", 504 .owner = THIS_MODULE, 505 .obj_size = sizeof(struct pppox_sock), 506 }; 507 508 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb) 509 { 510 int rc; 511 512 rc = l2tp_udp_encap_recv(sk, skb); 513 if (rc) 514 kfree_skb(skb); 515 516 return NET_RX_SUCCESS; 517 } 518 519 /* socket() handler. Initialize a new struct sock. 520 */ 521 static int pppol2tp_create(struct net *net, struct socket *sock, int kern) 522 { 523 int error = -ENOMEM; 524 struct sock *sk; 525 526 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern); 527 if (!sk) 528 goto out; 529 530 sock_init_data(sock, sk); 531 532 sock->state = SS_UNCONNECTED; 533 sock->ops = &pppol2tp_ops; 534 535 sk->sk_backlog_rcv = pppol2tp_backlog_recv; 536 sk->sk_protocol = PX_PROTO_OL2TP; 537 sk->sk_family = PF_PPPOX; 538 sk->sk_state = PPPOX_NONE; 539 sk->sk_type = SOCK_STREAM; 540 sk->sk_destruct = pppol2tp_session_destruct; 541 542 error = 0; 543 544 out: 545 return error; 546 } 547 548 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 549 static void pppol2tp_show(struct seq_file *m, void *arg) 550 { 551 struct l2tp_session *session = arg; 552 struct sock *sk; 553 554 sk = pppol2tp_session_get_sock(session); 555 if (sk) { 556 struct pppox_sock *po = pppox_sk(sk); 557 558 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 559 sock_put(sk); 560 } 561 } 562 #endif 563 564 static void pppol2tp_session_init(struct l2tp_session *session) 565 { 566 struct pppol2tp_session *ps; 567 struct dst_entry *dst; 568 569 session->recv_skb = pppol2tp_recv; 570 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS) 571 session->show = pppol2tp_show; 572 #endif 573 574 ps = l2tp_session_priv(session); 575 mutex_init(&ps->sk_lock); 576 ps->owner = current->pid; 577 578 /* If PMTU discovery was enabled, use the MTU that was discovered */ 579 dst = sk_dst_get(session->tunnel->sock); 580 if (dst) { 581 u32 pmtu = dst_mtu(dst); 582 583 if (pmtu) { 584 session->mtu = pmtu - PPPOL2TP_HEADER_OVERHEAD; 585 session->mru = pmtu - PPPOL2TP_HEADER_OVERHEAD; 586 } 587 dst_release(dst); 588 } 589 } 590 591 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket 592 */ 593 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, 594 int sockaddr_len, int flags) 595 { 596 struct sock *sk = sock->sk; 597 struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr; 598 struct pppox_sock *po = pppox_sk(sk); 599 struct l2tp_session *session = NULL; 600 struct l2tp_tunnel *tunnel; 601 struct pppol2tp_session *ps; 602 struct l2tp_session_cfg cfg = { 0, }; 603 int error = 0; 604 u32 tunnel_id, peer_tunnel_id; 605 u32 session_id, peer_session_id; 606 bool drop_refcnt = false; 607 bool drop_tunnel = false; 608 bool new_session = false; 609 bool new_tunnel = false; 610 int ver = 2; 611 int fd; 612 613 lock_sock(sk); 614 615 error = -EINVAL; 616 617 if (sockaddr_len != sizeof(struct sockaddr_pppol2tp) && 618 sockaddr_len != sizeof(struct sockaddr_pppol2tpv3) && 619 sockaddr_len != sizeof(struct sockaddr_pppol2tpin6) && 620 sockaddr_len != sizeof(struct sockaddr_pppol2tpv3in6)) 621 goto end; 622 623 if (sp->sa_protocol != PX_PROTO_OL2TP) 624 goto end; 625 626 /* Check for already bound sockets */ 627 error = -EBUSY; 628 if (sk->sk_state & PPPOX_CONNECTED) 629 goto end; 630 631 /* We don't supporting rebinding anyway */ 632 error = -EALREADY; 633 if (sk->sk_user_data) 634 goto end; /* socket is already attached */ 635 636 /* Get params from socket address. Handle L2TPv2 and L2TPv3. 637 * This is nasty because there are different sockaddr_pppol2tp 638 * structs for L2TPv2, L2TPv3, over IPv4 and IPv6. We use 639 * the sockaddr size to determine which structure the caller 640 * is using. 641 */ 642 peer_tunnel_id = 0; 643 if (sockaddr_len == sizeof(struct sockaddr_pppol2tp)) { 644 fd = sp->pppol2tp.fd; 645 tunnel_id = sp->pppol2tp.s_tunnel; 646 peer_tunnel_id = sp->pppol2tp.d_tunnel; 647 session_id = sp->pppol2tp.s_session; 648 peer_session_id = sp->pppol2tp.d_session; 649 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3)) { 650 struct sockaddr_pppol2tpv3 *sp3 = 651 (struct sockaddr_pppol2tpv3 *) sp; 652 ver = 3; 653 fd = sp3->pppol2tp.fd; 654 tunnel_id = sp3->pppol2tp.s_tunnel; 655 peer_tunnel_id = sp3->pppol2tp.d_tunnel; 656 session_id = sp3->pppol2tp.s_session; 657 peer_session_id = sp3->pppol2tp.d_session; 658 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpin6)) { 659 struct sockaddr_pppol2tpin6 *sp6 = 660 (struct sockaddr_pppol2tpin6 *) sp; 661 fd = sp6->pppol2tp.fd; 662 tunnel_id = sp6->pppol2tp.s_tunnel; 663 peer_tunnel_id = sp6->pppol2tp.d_tunnel; 664 session_id = sp6->pppol2tp.s_session; 665 peer_session_id = sp6->pppol2tp.d_session; 666 } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3in6)) { 667 struct sockaddr_pppol2tpv3in6 *sp6 = 668 (struct sockaddr_pppol2tpv3in6 *) sp; 669 ver = 3; 670 fd = sp6->pppol2tp.fd; 671 tunnel_id = sp6->pppol2tp.s_tunnel; 672 peer_tunnel_id = sp6->pppol2tp.d_tunnel; 673 session_id = sp6->pppol2tp.s_session; 674 peer_session_id = sp6->pppol2tp.d_session; 675 } else { 676 error = -EINVAL; 677 goto end; /* bad socket address */ 678 } 679 680 /* Don't bind if tunnel_id is 0 */ 681 error = -EINVAL; 682 if (tunnel_id == 0) 683 goto end; 684 685 tunnel = l2tp_tunnel_get(sock_net(sk), tunnel_id); 686 if (tunnel) 687 drop_tunnel = true; 688 689 /* Special case: create tunnel context if session_id and 690 * peer_session_id is 0. Otherwise look up tunnel using supplied 691 * tunnel id. 692 */ 693 if ((session_id == 0) && (peer_session_id == 0)) { 694 if (tunnel == NULL) { 695 struct l2tp_tunnel_cfg tcfg = { 696 .encap = L2TP_ENCAPTYPE_UDP, 697 .debug = 0, 698 }; 699 700 /* Prevent l2tp_tunnel_register() from trying to set up 701 * a kernel socket. 702 */ 703 if (fd < 0) { 704 error = -EBADF; 705 goto end; 706 } 707 708 error = l2tp_tunnel_create(sock_net(sk), fd, ver, tunnel_id, peer_tunnel_id, &tcfg, &tunnel); 709 if (error < 0) 710 goto end; 711 712 l2tp_tunnel_inc_refcount(tunnel); 713 error = l2tp_tunnel_register(tunnel, sock_net(sk), 714 &tcfg); 715 if (error < 0) { 716 kfree(tunnel); 717 goto end; 718 } 719 drop_tunnel = true; 720 new_tunnel = true; 721 } 722 } else { 723 /* Error if we can't find the tunnel */ 724 error = -ENOENT; 725 if (tunnel == NULL) 726 goto end; 727 728 /* Error if socket is not prepped */ 729 if (tunnel->sock == NULL) 730 goto end; 731 } 732 733 if (tunnel->recv_payload_hook == NULL) 734 tunnel->recv_payload_hook = pppol2tp_recv_payload_hook; 735 736 if (tunnel->peer_tunnel_id == 0) 737 tunnel->peer_tunnel_id = peer_tunnel_id; 738 739 session = l2tp_session_get(sock_net(sk), tunnel, session_id); 740 if (session) { 741 drop_refcnt = true; 742 743 if (session->pwtype != L2TP_PWTYPE_PPP) { 744 error = -EPROTOTYPE; 745 goto end; 746 } 747 748 ps = l2tp_session_priv(session); 749 750 /* Using a pre-existing session is fine as long as it hasn't 751 * been connected yet. 752 */ 753 mutex_lock(&ps->sk_lock); 754 if (rcu_dereference_protected(ps->sk, 755 lockdep_is_held(&ps->sk_lock)) || 756 ps->__sk) { 757 mutex_unlock(&ps->sk_lock); 758 error = -EEXIST; 759 goto end; 760 } 761 } else { 762 /* Default MTU must allow space for UDP/L2TP/PPP headers */ 763 cfg.mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 764 cfg.mru = cfg.mtu; 765 cfg.pw_type = L2TP_PWTYPE_PPP; 766 767 session = l2tp_session_create(sizeof(struct pppol2tp_session), 768 tunnel, session_id, 769 peer_session_id, &cfg); 770 if (IS_ERR(session)) { 771 error = PTR_ERR(session); 772 goto end; 773 } 774 775 pppol2tp_session_init(session); 776 ps = l2tp_session_priv(session); 777 l2tp_session_inc_refcount(session); 778 779 mutex_lock(&ps->sk_lock); 780 error = l2tp_session_register(session, tunnel); 781 if (error < 0) { 782 mutex_unlock(&ps->sk_lock); 783 kfree(session); 784 goto end; 785 } 786 drop_refcnt = true; 787 new_session = true; 788 } 789 790 /* Special case: if source & dest session_id == 0x0000, this 791 * socket is being created to manage the tunnel. Just set up 792 * the internal context for use by ioctl() and sockopt() 793 * handlers. 794 */ 795 if ((session->session_id == 0) && 796 (session->peer_session_id == 0)) { 797 error = 0; 798 goto out_no_ppp; 799 } 800 801 /* The only header we need to worry about is the L2TP 802 * header. This size is different depending on whether 803 * sequence numbers are enabled for the data channel. 804 */ 805 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 806 807 po->chan.private = sk; 808 po->chan.ops = &pppol2tp_chan_ops; 809 po->chan.mtu = session->mtu; 810 811 error = ppp_register_net_channel(sock_net(sk), &po->chan); 812 if (error) { 813 mutex_unlock(&ps->sk_lock); 814 goto end; 815 } 816 817 out_no_ppp: 818 /* This is how we get the session context from the socket. */ 819 sk->sk_user_data = session; 820 rcu_assign_pointer(ps->sk, sk); 821 mutex_unlock(&ps->sk_lock); 822 823 /* Keep the reference we've grabbed on the session: sk doesn't expect 824 * the session to disappear. pppol2tp_session_destruct() is responsible 825 * for dropping it. 826 */ 827 drop_refcnt = false; 828 829 sk->sk_state = PPPOX_CONNECTED; 830 l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n", 831 session->name); 832 833 end: 834 if (error) { 835 if (new_session) 836 l2tp_session_delete(session); 837 if (new_tunnel) 838 l2tp_tunnel_delete(tunnel); 839 } 840 if (drop_refcnt) 841 l2tp_session_dec_refcount(session); 842 if (drop_tunnel) 843 l2tp_tunnel_dec_refcount(tunnel); 844 release_sock(sk); 845 846 return error; 847 } 848 849 #ifdef CONFIG_L2TP_V3 850 851 /* Called when creating sessions via the netlink interface. */ 852 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel, 853 u32 session_id, u32 peer_session_id, 854 struct l2tp_session_cfg *cfg) 855 { 856 int error; 857 struct l2tp_session *session; 858 859 /* Error if tunnel socket is not prepped */ 860 if (!tunnel->sock) { 861 error = -ENOENT; 862 goto err; 863 } 864 865 /* Default MTU values. */ 866 if (cfg->mtu == 0) 867 cfg->mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD; 868 if (cfg->mru == 0) 869 cfg->mru = cfg->mtu; 870 871 /* Allocate and initialize a new session context. */ 872 session = l2tp_session_create(sizeof(struct pppol2tp_session), 873 tunnel, session_id, 874 peer_session_id, cfg); 875 if (IS_ERR(session)) { 876 error = PTR_ERR(session); 877 goto err; 878 } 879 880 pppol2tp_session_init(session); 881 882 error = l2tp_session_register(session, tunnel); 883 if (error < 0) 884 goto err_sess; 885 886 return 0; 887 888 err_sess: 889 kfree(session); 890 err: 891 return error; 892 } 893 894 #endif /* CONFIG_L2TP_V3 */ 895 896 /* getname() support. 897 */ 898 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr, 899 int peer) 900 { 901 int len = 0; 902 int error = 0; 903 struct l2tp_session *session; 904 struct l2tp_tunnel *tunnel; 905 struct sock *sk = sock->sk; 906 struct inet_sock *inet; 907 struct pppol2tp_session *pls; 908 909 error = -ENOTCONN; 910 if (sk == NULL) 911 goto end; 912 if (!(sk->sk_state & PPPOX_CONNECTED)) 913 goto end; 914 915 error = -EBADF; 916 session = pppol2tp_sock_to_session(sk); 917 if (session == NULL) 918 goto end; 919 920 pls = l2tp_session_priv(session); 921 tunnel = session->tunnel; 922 923 inet = inet_sk(tunnel->sock); 924 if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) { 925 struct sockaddr_pppol2tp sp; 926 len = sizeof(sp); 927 memset(&sp, 0, len); 928 sp.sa_family = AF_PPPOX; 929 sp.sa_protocol = PX_PROTO_OL2TP; 930 sp.pppol2tp.fd = tunnel->fd; 931 sp.pppol2tp.pid = pls->owner; 932 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 933 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 934 sp.pppol2tp.s_session = session->session_id; 935 sp.pppol2tp.d_session = session->peer_session_id; 936 sp.pppol2tp.addr.sin_family = AF_INET; 937 sp.pppol2tp.addr.sin_port = inet->inet_dport; 938 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 939 memcpy(uaddr, &sp, len); 940 #if IS_ENABLED(CONFIG_IPV6) 941 } else if ((tunnel->version == 2) && 942 (tunnel->sock->sk_family == AF_INET6)) { 943 struct sockaddr_pppol2tpin6 sp; 944 945 len = sizeof(sp); 946 memset(&sp, 0, len); 947 sp.sa_family = AF_PPPOX; 948 sp.sa_protocol = PX_PROTO_OL2TP; 949 sp.pppol2tp.fd = tunnel->fd; 950 sp.pppol2tp.pid = pls->owner; 951 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 952 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 953 sp.pppol2tp.s_session = session->session_id; 954 sp.pppol2tp.d_session = session->peer_session_id; 955 sp.pppol2tp.addr.sin6_family = AF_INET6; 956 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 957 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 958 sizeof(tunnel->sock->sk_v6_daddr)); 959 memcpy(uaddr, &sp, len); 960 } else if ((tunnel->version == 3) && 961 (tunnel->sock->sk_family == AF_INET6)) { 962 struct sockaddr_pppol2tpv3in6 sp; 963 964 len = sizeof(sp); 965 memset(&sp, 0, len); 966 sp.sa_family = AF_PPPOX; 967 sp.sa_protocol = PX_PROTO_OL2TP; 968 sp.pppol2tp.fd = tunnel->fd; 969 sp.pppol2tp.pid = pls->owner; 970 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 971 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 972 sp.pppol2tp.s_session = session->session_id; 973 sp.pppol2tp.d_session = session->peer_session_id; 974 sp.pppol2tp.addr.sin6_family = AF_INET6; 975 sp.pppol2tp.addr.sin6_port = inet->inet_dport; 976 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr, 977 sizeof(tunnel->sock->sk_v6_daddr)); 978 memcpy(uaddr, &sp, len); 979 #endif 980 } else if (tunnel->version == 3) { 981 struct sockaddr_pppol2tpv3 sp; 982 len = sizeof(sp); 983 memset(&sp, 0, len); 984 sp.sa_family = AF_PPPOX; 985 sp.sa_protocol = PX_PROTO_OL2TP; 986 sp.pppol2tp.fd = tunnel->fd; 987 sp.pppol2tp.pid = pls->owner; 988 sp.pppol2tp.s_tunnel = tunnel->tunnel_id; 989 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id; 990 sp.pppol2tp.s_session = session->session_id; 991 sp.pppol2tp.d_session = session->peer_session_id; 992 sp.pppol2tp.addr.sin_family = AF_INET; 993 sp.pppol2tp.addr.sin_port = inet->inet_dport; 994 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr; 995 memcpy(uaddr, &sp, len); 996 } 997 998 error = len; 999 1000 sock_put(sk); 1001 end: 1002 return error; 1003 } 1004 1005 /**************************************************************************** 1006 * ioctl() handlers. 1007 * 1008 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1009 * sockets. However, in order to control kernel tunnel features, we allow 1010 * userspace to create a special "tunnel" PPPoX socket which is used for 1011 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow 1012 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl() 1013 * calls. 1014 ****************************************************************************/ 1015 1016 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest, 1017 struct l2tp_stats *stats) 1018 { 1019 dest->tx_packets = atomic_long_read(&stats->tx_packets); 1020 dest->tx_bytes = atomic_long_read(&stats->tx_bytes); 1021 dest->tx_errors = atomic_long_read(&stats->tx_errors); 1022 dest->rx_packets = atomic_long_read(&stats->rx_packets); 1023 dest->rx_bytes = atomic_long_read(&stats->rx_bytes); 1024 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards); 1025 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets); 1026 dest->rx_errors = atomic_long_read(&stats->rx_errors); 1027 } 1028 1029 /* Session ioctl helper. 1030 */ 1031 static int pppol2tp_session_ioctl(struct l2tp_session *session, 1032 unsigned int cmd, unsigned long arg) 1033 { 1034 struct ifreq ifr; 1035 int err = 0; 1036 struct sock *sk; 1037 int val = (int) arg; 1038 struct pppol2tp_session *ps = l2tp_session_priv(session); 1039 struct l2tp_tunnel *tunnel = session->tunnel; 1040 struct pppol2tp_ioc_stats stats; 1041 1042 l2tp_dbg(session, L2TP_MSG_CONTROL, 1043 "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n", 1044 session->name, cmd, arg); 1045 1046 sk = pppol2tp_session_get_sock(session); 1047 if (!sk) 1048 return -EBADR; 1049 1050 switch (cmd) { 1051 case SIOCGIFMTU: 1052 err = -ENXIO; 1053 if (!(sk->sk_state & PPPOX_CONNECTED)) 1054 break; 1055 1056 err = -EFAULT; 1057 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1058 break; 1059 ifr.ifr_mtu = session->mtu; 1060 if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq))) 1061 break; 1062 1063 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mtu=%d\n", 1064 session->name, session->mtu); 1065 err = 0; 1066 break; 1067 1068 case SIOCSIFMTU: 1069 err = -ENXIO; 1070 if (!(sk->sk_state & PPPOX_CONNECTED)) 1071 break; 1072 1073 err = -EFAULT; 1074 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq))) 1075 break; 1076 1077 session->mtu = ifr.ifr_mtu; 1078 1079 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mtu=%d\n", 1080 session->name, session->mtu); 1081 err = 0; 1082 break; 1083 1084 case PPPIOCGMRU: 1085 err = -ENXIO; 1086 if (!(sk->sk_state & PPPOX_CONNECTED)) 1087 break; 1088 1089 err = -EFAULT; 1090 if (put_user(session->mru, (int __user *) arg)) 1091 break; 1092 1093 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mru=%d\n", 1094 session->name, session->mru); 1095 err = 0; 1096 break; 1097 1098 case PPPIOCSMRU: 1099 err = -ENXIO; 1100 if (!(sk->sk_state & PPPOX_CONNECTED)) 1101 break; 1102 1103 err = -EFAULT; 1104 if (get_user(val, (int __user *) arg)) 1105 break; 1106 1107 session->mru = val; 1108 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mru=%d\n", 1109 session->name, session->mru); 1110 err = 0; 1111 break; 1112 1113 case PPPIOCGFLAGS: 1114 err = -EFAULT; 1115 if (put_user(ps->flags, (int __user *) arg)) 1116 break; 1117 1118 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get flags=%d\n", 1119 session->name, ps->flags); 1120 err = 0; 1121 break; 1122 1123 case PPPIOCSFLAGS: 1124 err = -EFAULT; 1125 if (get_user(val, (int __user *) arg)) 1126 break; 1127 ps->flags = val; 1128 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set flags=%d\n", 1129 session->name, ps->flags); 1130 err = 0; 1131 break; 1132 1133 case PPPIOCGL2TPSTATS: 1134 err = -ENXIO; 1135 if (!(sk->sk_state & PPPOX_CONNECTED)) 1136 break; 1137 1138 memset(&stats, 0, sizeof(stats)); 1139 stats.tunnel_id = tunnel->tunnel_id; 1140 stats.session_id = session->session_id; 1141 pppol2tp_copy_stats(&stats, &session->stats); 1142 if (copy_to_user((void __user *) arg, &stats, 1143 sizeof(stats))) 1144 break; 1145 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1146 session->name); 1147 err = 0; 1148 break; 1149 1150 default: 1151 err = -ENOSYS; 1152 break; 1153 } 1154 1155 sock_put(sk); 1156 1157 return err; 1158 } 1159 1160 /* Tunnel ioctl helper. 1161 * 1162 * Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data 1163 * specifies a session_id, the session ioctl handler is called. This allows an 1164 * application to retrieve session stats via a tunnel socket. 1165 */ 1166 static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel, 1167 unsigned int cmd, unsigned long arg) 1168 { 1169 int err = 0; 1170 struct sock *sk; 1171 struct pppol2tp_ioc_stats stats; 1172 1173 l2tp_dbg(tunnel, L2TP_MSG_CONTROL, 1174 "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n", 1175 tunnel->name, cmd, arg); 1176 1177 sk = tunnel->sock; 1178 sock_hold(sk); 1179 1180 switch (cmd) { 1181 case PPPIOCGL2TPSTATS: 1182 err = -ENXIO; 1183 if (!(sk->sk_state & PPPOX_CONNECTED)) 1184 break; 1185 1186 if (copy_from_user(&stats, (void __user *) arg, 1187 sizeof(stats))) { 1188 err = -EFAULT; 1189 break; 1190 } 1191 if (stats.session_id != 0) { 1192 /* resend to session ioctl handler */ 1193 struct l2tp_session *session = 1194 l2tp_session_get(sock_net(sk), tunnel, 1195 stats.session_id); 1196 1197 if (session && session->pwtype == L2TP_PWTYPE_PPP) { 1198 err = pppol2tp_session_ioctl(session, cmd, 1199 arg); 1200 l2tp_session_dec_refcount(session); 1201 } else { 1202 err = -EBADR; 1203 } 1204 break; 1205 } 1206 #ifdef CONFIG_XFRM 1207 stats.using_ipsec = (sk->sk_policy[0] || sk->sk_policy[1]) ? 1 : 0; 1208 #endif 1209 pppol2tp_copy_stats(&stats, &tunnel->stats); 1210 if (copy_to_user((void __user *) arg, &stats, sizeof(stats))) { 1211 err = -EFAULT; 1212 break; 1213 } 1214 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get L2TP stats\n", 1215 tunnel->name); 1216 err = 0; 1217 break; 1218 1219 default: 1220 err = -ENOSYS; 1221 break; 1222 } 1223 1224 sock_put(sk); 1225 1226 return err; 1227 } 1228 1229 /* Main ioctl() handler. 1230 * Dispatch to tunnel or session helpers depending on the socket. 1231 */ 1232 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, 1233 unsigned long arg) 1234 { 1235 struct sock *sk = sock->sk; 1236 struct l2tp_session *session; 1237 struct l2tp_tunnel *tunnel; 1238 int err; 1239 1240 if (!sk) 1241 return 0; 1242 1243 err = -EBADF; 1244 if (sock_flag(sk, SOCK_DEAD) != 0) 1245 goto end; 1246 1247 err = -ENOTCONN; 1248 if ((sk->sk_user_data == NULL) || 1249 (!(sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)))) 1250 goto end; 1251 1252 /* Get session context from the socket */ 1253 err = -EBADF; 1254 session = pppol2tp_sock_to_session(sk); 1255 if (session == NULL) 1256 goto end; 1257 1258 /* Special case: if session's session_id is zero, treat ioctl as a 1259 * tunnel ioctl 1260 */ 1261 if ((session->session_id == 0) && 1262 (session->peer_session_id == 0)) { 1263 tunnel = session->tunnel; 1264 err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg); 1265 goto end_put_sess; 1266 } 1267 1268 err = pppol2tp_session_ioctl(session, cmd, arg); 1269 1270 end_put_sess: 1271 sock_put(sk); 1272 end: 1273 return err; 1274 } 1275 1276 /***************************************************************************** 1277 * setsockopt() / getsockopt() support. 1278 * 1279 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP 1280 * sockets. In order to control kernel tunnel features, we allow userspace to 1281 * create a special "tunnel" PPPoX socket which is used for control only. 1282 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user 1283 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls. 1284 *****************************************************************************/ 1285 1286 /* Tunnel setsockopt() helper. 1287 */ 1288 static int pppol2tp_tunnel_setsockopt(struct sock *sk, 1289 struct l2tp_tunnel *tunnel, 1290 int optname, int val) 1291 { 1292 int err = 0; 1293 1294 switch (optname) { 1295 case PPPOL2TP_SO_DEBUG: 1296 tunnel->debug = val; 1297 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1298 tunnel->name, tunnel->debug); 1299 break; 1300 1301 default: 1302 err = -ENOPROTOOPT; 1303 break; 1304 } 1305 1306 return err; 1307 } 1308 1309 /* Session setsockopt helper. 1310 */ 1311 static int pppol2tp_session_setsockopt(struct sock *sk, 1312 struct l2tp_session *session, 1313 int optname, int val) 1314 { 1315 int err = 0; 1316 1317 switch (optname) { 1318 case PPPOL2TP_SO_RECVSEQ: 1319 if ((val != 0) && (val != 1)) { 1320 err = -EINVAL; 1321 break; 1322 } 1323 session->recv_seq = !!val; 1324 l2tp_info(session, L2TP_MSG_CONTROL, 1325 "%s: set recv_seq=%d\n", 1326 session->name, session->recv_seq); 1327 break; 1328 1329 case PPPOL2TP_SO_SENDSEQ: 1330 if ((val != 0) && (val != 1)) { 1331 err = -EINVAL; 1332 break; 1333 } 1334 session->send_seq = !!val; 1335 { 1336 struct pppox_sock *po = pppox_sk(sk); 1337 1338 po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ : 1339 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ; 1340 } 1341 l2tp_session_set_header_len(session, session->tunnel->version); 1342 l2tp_info(session, L2TP_MSG_CONTROL, 1343 "%s: set send_seq=%d\n", 1344 session->name, session->send_seq); 1345 break; 1346 1347 case PPPOL2TP_SO_LNSMODE: 1348 if ((val != 0) && (val != 1)) { 1349 err = -EINVAL; 1350 break; 1351 } 1352 session->lns_mode = !!val; 1353 l2tp_info(session, L2TP_MSG_CONTROL, 1354 "%s: set lns_mode=%d\n", 1355 session->name, session->lns_mode); 1356 break; 1357 1358 case PPPOL2TP_SO_DEBUG: 1359 session->debug = val; 1360 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set debug=%x\n", 1361 session->name, session->debug); 1362 break; 1363 1364 case PPPOL2TP_SO_REORDERTO: 1365 session->reorder_timeout = msecs_to_jiffies(val); 1366 l2tp_info(session, L2TP_MSG_CONTROL, 1367 "%s: set reorder_timeout=%d\n", 1368 session->name, session->reorder_timeout); 1369 break; 1370 1371 default: 1372 err = -ENOPROTOOPT; 1373 break; 1374 } 1375 1376 return err; 1377 } 1378 1379 /* Main setsockopt() entry point. 1380 * Does API checks, then calls either the tunnel or session setsockopt 1381 * handler, according to whether the PPPoL2TP socket is a for a regular 1382 * session or the special tunnel type. 1383 */ 1384 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname, 1385 char __user *optval, unsigned int optlen) 1386 { 1387 struct sock *sk = sock->sk; 1388 struct l2tp_session *session; 1389 struct l2tp_tunnel *tunnel; 1390 int val; 1391 int err; 1392 1393 if (level != SOL_PPPOL2TP) 1394 return -EINVAL; 1395 1396 if (optlen < sizeof(int)) 1397 return -EINVAL; 1398 1399 if (get_user(val, (int __user *)optval)) 1400 return -EFAULT; 1401 1402 err = -ENOTCONN; 1403 if (sk->sk_user_data == NULL) 1404 goto end; 1405 1406 /* Get session context from the socket */ 1407 err = -EBADF; 1408 session = pppol2tp_sock_to_session(sk); 1409 if (session == NULL) 1410 goto end; 1411 1412 /* Special case: if session_id == 0x0000, treat as operation on tunnel 1413 */ 1414 if ((session->session_id == 0) && 1415 (session->peer_session_id == 0)) { 1416 tunnel = session->tunnel; 1417 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val); 1418 } else { 1419 err = pppol2tp_session_setsockopt(sk, session, optname, val); 1420 } 1421 1422 sock_put(sk); 1423 end: 1424 return err; 1425 } 1426 1427 /* Tunnel getsockopt helper. Called with sock locked. 1428 */ 1429 static int pppol2tp_tunnel_getsockopt(struct sock *sk, 1430 struct l2tp_tunnel *tunnel, 1431 int optname, int *val) 1432 { 1433 int err = 0; 1434 1435 switch (optname) { 1436 case PPPOL2TP_SO_DEBUG: 1437 *val = tunnel->debug; 1438 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get debug=%x\n", 1439 tunnel->name, tunnel->debug); 1440 break; 1441 1442 default: 1443 err = -ENOPROTOOPT; 1444 break; 1445 } 1446 1447 return err; 1448 } 1449 1450 /* Session getsockopt helper. Called with sock locked. 1451 */ 1452 static int pppol2tp_session_getsockopt(struct sock *sk, 1453 struct l2tp_session *session, 1454 int optname, int *val) 1455 { 1456 int err = 0; 1457 1458 switch (optname) { 1459 case PPPOL2TP_SO_RECVSEQ: 1460 *val = session->recv_seq; 1461 l2tp_info(session, L2TP_MSG_CONTROL, 1462 "%s: get recv_seq=%d\n", session->name, *val); 1463 break; 1464 1465 case PPPOL2TP_SO_SENDSEQ: 1466 *val = session->send_seq; 1467 l2tp_info(session, L2TP_MSG_CONTROL, 1468 "%s: get send_seq=%d\n", session->name, *val); 1469 break; 1470 1471 case PPPOL2TP_SO_LNSMODE: 1472 *val = session->lns_mode; 1473 l2tp_info(session, L2TP_MSG_CONTROL, 1474 "%s: get lns_mode=%d\n", session->name, *val); 1475 break; 1476 1477 case PPPOL2TP_SO_DEBUG: 1478 *val = session->debug; 1479 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get debug=%d\n", 1480 session->name, *val); 1481 break; 1482 1483 case PPPOL2TP_SO_REORDERTO: 1484 *val = (int) jiffies_to_msecs(session->reorder_timeout); 1485 l2tp_info(session, L2TP_MSG_CONTROL, 1486 "%s: get reorder_timeout=%d\n", session->name, *val); 1487 break; 1488 1489 default: 1490 err = -ENOPROTOOPT; 1491 } 1492 1493 return err; 1494 } 1495 1496 /* Main getsockopt() entry point. 1497 * Does API checks, then calls either the tunnel or session getsockopt 1498 * handler, according to whether the PPPoX socket is a for a regular session 1499 * or the special tunnel type. 1500 */ 1501 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, 1502 char __user *optval, int __user *optlen) 1503 { 1504 struct sock *sk = sock->sk; 1505 struct l2tp_session *session; 1506 struct l2tp_tunnel *tunnel; 1507 int val, len; 1508 int err; 1509 1510 if (level != SOL_PPPOL2TP) 1511 return -EINVAL; 1512 1513 if (get_user(len, optlen)) 1514 return -EFAULT; 1515 1516 len = min_t(unsigned int, len, sizeof(int)); 1517 1518 if (len < 0) 1519 return -EINVAL; 1520 1521 err = -ENOTCONN; 1522 if (sk->sk_user_data == NULL) 1523 goto end; 1524 1525 /* Get the session context */ 1526 err = -EBADF; 1527 session = pppol2tp_sock_to_session(sk); 1528 if (session == NULL) 1529 goto end; 1530 1531 /* Special case: if session_id == 0x0000, treat as operation on tunnel */ 1532 if ((session->session_id == 0) && 1533 (session->peer_session_id == 0)) { 1534 tunnel = session->tunnel; 1535 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val); 1536 if (err) 1537 goto end_put_sess; 1538 } else { 1539 err = pppol2tp_session_getsockopt(sk, session, optname, &val); 1540 if (err) 1541 goto end_put_sess; 1542 } 1543 1544 err = -EFAULT; 1545 if (put_user(len, optlen)) 1546 goto end_put_sess; 1547 1548 if (copy_to_user((void __user *) optval, &val, len)) 1549 goto end_put_sess; 1550 1551 err = 0; 1552 1553 end_put_sess: 1554 sock_put(sk); 1555 end: 1556 return err; 1557 } 1558 1559 /***************************************************************************** 1560 * /proc filesystem for debug 1561 * Since the original pppol2tp driver provided /proc/net/pppol2tp for 1562 * L2TPv2, we dump only L2TPv2 tunnels and sessions here. 1563 *****************************************************************************/ 1564 1565 static unsigned int pppol2tp_net_id; 1566 1567 #ifdef CONFIG_PROC_FS 1568 1569 struct pppol2tp_seq_data { 1570 struct seq_net_private p; 1571 int tunnel_idx; /* current tunnel */ 1572 int session_idx; /* index of session within current tunnel */ 1573 struct l2tp_tunnel *tunnel; 1574 struct l2tp_session *session; /* NULL means get next tunnel */ 1575 }; 1576 1577 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) 1578 { 1579 /* Drop reference taken during previous invocation */ 1580 if (pd->tunnel) 1581 l2tp_tunnel_dec_refcount(pd->tunnel); 1582 1583 for (;;) { 1584 pd->tunnel = l2tp_tunnel_get_nth(net, pd->tunnel_idx); 1585 pd->tunnel_idx++; 1586 1587 /* Only accept L2TPv2 tunnels */ 1588 if (!pd->tunnel || pd->tunnel->version == 2) 1589 return; 1590 1591 l2tp_tunnel_dec_refcount(pd->tunnel); 1592 } 1593 } 1594 1595 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) 1596 { 1597 /* Drop reference taken during previous invocation */ 1598 if (pd->session) 1599 l2tp_session_dec_refcount(pd->session); 1600 1601 pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx); 1602 pd->session_idx++; 1603 1604 if (pd->session == NULL) { 1605 pd->session_idx = 0; 1606 pppol2tp_next_tunnel(net, pd); 1607 } 1608 } 1609 1610 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs) 1611 { 1612 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN; 1613 loff_t pos = *offs; 1614 struct net *net; 1615 1616 if (!pos) 1617 goto out; 1618 1619 BUG_ON(m->private == NULL); 1620 pd = m->private; 1621 net = seq_file_net(m); 1622 1623 if (pd->tunnel == NULL) 1624 pppol2tp_next_tunnel(net, pd); 1625 else 1626 pppol2tp_next_session(net, pd); 1627 1628 /* NULL tunnel and session indicates end of list */ 1629 if ((pd->tunnel == NULL) && (pd->session == NULL)) 1630 pd = NULL; 1631 1632 out: 1633 return pd; 1634 } 1635 1636 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos) 1637 { 1638 (*pos)++; 1639 return NULL; 1640 } 1641 1642 static void pppol2tp_seq_stop(struct seq_file *p, void *v) 1643 { 1644 struct pppol2tp_seq_data *pd = v; 1645 1646 if (!pd || pd == SEQ_START_TOKEN) 1647 return; 1648 1649 /* Drop reference taken by last invocation of pppol2tp_next_session() 1650 * or pppol2tp_next_tunnel(). 1651 */ 1652 if (pd->session) { 1653 l2tp_session_dec_refcount(pd->session); 1654 pd->session = NULL; 1655 } 1656 if (pd->tunnel) { 1657 l2tp_tunnel_dec_refcount(pd->tunnel); 1658 pd->tunnel = NULL; 1659 } 1660 } 1661 1662 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v) 1663 { 1664 struct l2tp_tunnel *tunnel = v; 1665 1666 seq_printf(m, "\nTUNNEL '%s', %c %d\n", 1667 tunnel->name, 1668 (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N', 1669 refcount_read(&tunnel->ref_count) - 1); 1670 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n", 1671 tunnel->debug, 1672 atomic_long_read(&tunnel->stats.tx_packets), 1673 atomic_long_read(&tunnel->stats.tx_bytes), 1674 atomic_long_read(&tunnel->stats.tx_errors), 1675 atomic_long_read(&tunnel->stats.rx_packets), 1676 atomic_long_read(&tunnel->stats.rx_bytes), 1677 atomic_long_read(&tunnel->stats.rx_errors)); 1678 } 1679 1680 static void pppol2tp_seq_session_show(struct seq_file *m, void *v) 1681 { 1682 struct l2tp_session *session = v; 1683 struct l2tp_tunnel *tunnel = session->tunnel; 1684 unsigned char state; 1685 char user_data_ok; 1686 struct sock *sk; 1687 u32 ip = 0; 1688 u16 port = 0; 1689 1690 if (tunnel->sock) { 1691 struct inet_sock *inet = inet_sk(tunnel->sock); 1692 ip = ntohl(inet->inet_saddr); 1693 port = ntohs(inet->inet_sport); 1694 } 1695 1696 sk = pppol2tp_session_get_sock(session); 1697 if (sk) { 1698 state = sk->sk_state; 1699 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N'; 1700 } else { 1701 state = 0; 1702 user_data_ok = 'N'; 1703 } 1704 1705 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> " 1706 "%04X/%04X %d %c\n", 1707 session->name, ip, port, 1708 tunnel->tunnel_id, 1709 session->session_id, 1710 tunnel->peer_tunnel_id, 1711 session->peer_session_id, 1712 state, user_data_ok); 1713 seq_printf(m, " %d/%d/%c/%c/%s %08x %u\n", 1714 session->mtu, session->mru, 1715 session->recv_seq ? 'R' : '-', 1716 session->send_seq ? 'S' : '-', 1717 session->lns_mode ? "LNS" : "LAC", 1718 session->debug, 1719 jiffies_to_msecs(session->reorder_timeout)); 1720 seq_printf(m, " %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n", 1721 session->nr, session->ns, 1722 atomic_long_read(&session->stats.tx_packets), 1723 atomic_long_read(&session->stats.tx_bytes), 1724 atomic_long_read(&session->stats.tx_errors), 1725 atomic_long_read(&session->stats.rx_packets), 1726 atomic_long_read(&session->stats.rx_bytes), 1727 atomic_long_read(&session->stats.rx_errors)); 1728 1729 if (sk) { 1730 struct pppox_sock *po = pppox_sk(sk); 1731 1732 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan)); 1733 sock_put(sk); 1734 } 1735 } 1736 1737 static int pppol2tp_seq_show(struct seq_file *m, void *v) 1738 { 1739 struct pppol2tp_seq_data *pd = v; 1740 1741 /* display header on line 1 */ 1742 if (v == SEQ_START_TOKEN) { 1743 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n"); 1744 seq_puts(m, "TUNNEL name, user-data-ok session-count\n"); 1745 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1746 seq_puts(m, " SESSION name, addr/port src-tid/sid " 1747 "dest-tid/sid state user-data-ok\n"); 1748 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n"); 1749 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n"); 1750 goto out; 1751 } 1752 1753 if (!pd->session) 1754 pppol2tp_seq_tunnel_show(m, pd->tunnel); 1755 else 1756 pppol2tp_seq_session_show(m, pd->session); 1757 1758 out: 1759 return 0; 1760 } 1761 1762 static const struct seq_operations pppol2tp_seq_ops = { 1763 .start = pppol2tp_seq_start, 1764 .next = pppol2tp_seq_next, 1765 .stop = pppol2tp_seq_stop, 1766 .show = pppol2tp_seq_show, 1767 }; 1768 #endif /* CONFIG_PROC_FS */ 1769 1770 /***************************************************************************** 1771 * Network namespace 1772 *****************************************************************************/ 1773 1774 static __net_init int pppol2tp_init_net(struct net *net) 1775 { 1776 struct proc_dir_entry *pde; 1777 int err = 0; 1778 1779 pde = proc_create_net("pppol2tp", 0444, net->proc_net, 1780 &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data)); 1781 if (!pde) { 1782 err = -ENOMEM; 1783 goto out; 1784 } 1785 1786 out: 1787 return err; 1788 } 1789 1790 static __net_exit void pppol2tp_exit_net(struct net *net) 1791 { 1792 remove_proc_entry("pppol2tp", net->proc_net); 1793 } 1794 1795 static struct pernet_operations pppol2tp_net_ops = { 1796 .init = pppol2tp_init_net, 1797 .exit = pppol2tp_exit_net, 1798 .id = &pppol2tp_net_id, 1799 }; 1800 1801 /***************************************************************************** 1802 * Init and cleanup 1803 *****************************************************************************/ 1804 1805 static const struct proto_ops pppol2tp_ops = { 1806 .family = AF_PPPOX, 1807 .owner = THIS_MODULE, 1808 .release = pppol2tp_release, 1809 .bind = sock_no_bind, 1810 .connect = pppol2tp_connect, 1811 .socketpair = sock_no_socketpair, 1812 .accept = sock_no_accept, 1813 .getname = pppol2tp_getname, 1814 .poll_mask = datagram_poll_mask, 1815 .listen = sock_no_listen, 1816 .shutdown = sock_no_shutdown, 1817 .setsockopt = pppol2tp_setsockopt, 1818 .getsockopt = pppol2tp_getsockopt, 1819 .sendmsg = pppol2tp_sendmsg, 1820 .recvmsg = pppol2tp_recvmsg, 1821 .mmap = sock_no_mmap, 1822 .ioctl = pppox_ioctl, 1823 }; 1824 1825 static const struct pppox_proto pppol2tp_proto = { 1826 .create = pppol2tp_create, 1827 .ioctl = pppol2tp_ioctl, 1828 .owner = THIS_MODULE, 1829 }; 1830 1831 #ifdef CONFIG_L2TP_V3 1832 1833 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = { 1834 .session_create = pppol2tp_session_create, 1835 .session_delete = l2tp_session_delete, 1836 }; 1837 1838 #endif /* CONFIG_L2TP_V3 */ 1839 1840 static int __init pppol2tp_init(void) 1841 { 1842 int err; 1843 1844 err = register_pernet_device(&pppol2tp_net_ops); 1845 if (err) 1846 goto out; 1847 1848 err = proto_register(&pppol2tp_sk_proto, 0); 1849 if (err) 1850 goto out_unregister_pppol2tp_pernet; 1851 1852 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto); 1853 if (err) 1854 goto out_unregister_pppol2tp_proto; 1855 1856 #ifdef CONFIG_L2TP_V3 1857 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops); 1858 if (err) 1859 goto out_unregister_pppox; 1860 #endif 1861 1862 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION); 1863 1864 out: 1865 return err; 1866 1867 #ifdef CONFIG_L2TP_V3 1868 out_unregister_pppox: 1869 unregister_pppox_proto(PX_PROTO_OL2TP); 1870 #endif 1871 out_unregister_pppol2tp_proto: 1872 proto_unregister(&pppol2tp_sk_proto); 1873 out_unregister_pppol2tp_pernet: 1874 unregister_pernet_device(&pppol2tp_net_ops); 1875 goto out; 1876 } 1877 1878 static void __exit pppol2tp_exit(void) 1879 { 1880 #ifdef CONFIG_L2TP_V3 1881 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP); 1882 #endif 1883 unregister_pppox_proto(PX_PROTO_OL2TP); 1884 proto_unregister(&pppol2tp_sk_proto); 1885 unregister_pernet_device(&pppol2tp_net_ops); 1886 } 1887 1888 module_init(pppol2tp_init); 1889 module_exit(pppol2tp_exit); 1890 1891 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1892 MODULE_DESCRIPTION("PPP over L2TP over UDP"); 1893 MODULE_LICENSE("GPL"); 1894 MODULE_VERSION(PPPOL2TP_DRV_VERSION); 1895 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP); 1896 MODULE_ALIAS_L2TP_PWTYPE(7); 1897