210 	struct l2tp_session *session;  in l2tp_tunnel_get_session()  local
215 	hlist_for_each_entry(session, session_list, hlist)  in l2tp_tunnel_get_session()
216 		if (session->session_id == session_id) {  in l2tp_tunnel_get_session()
217 			l2tp_session_inc_refcount(session);  in l2tp_tunnel_get_session()
220 			return session;  in l2tp_tunnel_get_session()
231 	struct l2tp_session *session;  in l2tp_session_get()  local
236 	hlist_for_each_entry_rcu(session, session_list, global_hlist)  in l2tp_session_get()
237 		if (session->session_id == session_id) {  in l2tp_session_get()
238 			l2tp_session_inc_refcount(session);  in l2tp_session_get()
241 			return session;  in l2tp_session_get()
252 	struct l2tp_session *session;  in l2tp_session_get_nth()  local
257 		hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {  in l2tp_session_get_nth()
259 				l2tp_session_inc_refcount(session);  in l2tp_session_get_nth()
261 				return session;  in l2tp_session_get_nth()
280 	struct l2tp_session *session;  in l2tp_session_get_by_ifname()  local
284 		hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {  in l2tp_session_get_by_ifname()
285 			if (!strcmp(session->ifname, ifname)) {  in l2tp_session_get_by_ifname()
286 				l2tp_session_inc_refcount(session);  in l2tp_session_get_by_ifname()
289 				return session;  in l2tp_session_get_by_ifname()
300 int l2tp_session_register(struct l2tp_session *session,  in l2tp_session_register()  argument
309 	head = l2tp_session_id_hash(tunnel, session->session_id);  in l2tp_session_register()
318 		if (session_walk->session_id == session->session_id) {  in l2tp_session_register()
325 		g_head = l2tp_session_id_hash_2(pn, session->session_id);  in l2tp_session_register()
330 			if (session_walk->session_id == session->session_id) {  in l2tp_session_register()
336 		hlist_add_head_rcu(&session->global_hlist, g_head);  in l2tp_session_register()
343 	hlist_add_head(&session->hlist, head);  in l2tp_session_register()
364 static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)  in l2tp_recv_queue_skb()  argument
370 	spin_lock_bh(&session->reorder_q.lock);  in l2tp_recv_queue_skb()
371 	skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {  in l2tp_recv_queue_skb()
373 			__skb_queue_before(&session->reorder_q, skbp, skb);  in l2tp_recv_queue_skb()
374 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_queue_skb()
376 				 session->name, ns, L2TP_SKB_CB(skbp)->ns,  in l2tp_recv_queue_skb()
377 				 skb_queue_len(&session->reorder_q));  in l2tp_recv_queue_skb()
378 			atomic_long_inc(&session->stats.rx_oos_packets);  in l2tp_recv_queue_skb()
383 	__skb_queue_tail(&session->reorder_q, skb);  in l2tp_recv_queue_skb()
386 	spin_unlock_bh(&session->reorder_q.lock);  in l2tp_recv_queue_skb()
391 static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)  in l2tp_recv_dequeue_skb()  argument
393 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_recv_dequeue_skb()
403 	atomic_long_inc(&session->stats.rx_packets);  in l2tp_recv_dequeue_skb()
404 	atomic_long_add(length, &session->stats.rx_bytes);  in l2tp_recv_dequeue_skb()
408 		session->nr++;  in l2tp_recv_dequeue_skb()
409 		session->nr &= session->nr_max;  in l2tp_recv_dequeue_skb()
411 		l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated nr to %hu\n",  in l2tp_recv_dequeue_skb()
412 			 session->name, session->nr);  in l2tp_recv_dequeue_skb()
416 	if (session->recv_skb != NULL)  in l2tp_recv_dequeue_skb()
417 		(*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);  in l2tp_recv_dequeue_skb()
425 static void l2tp_recv_dequeue(struct l2tp_session *session)  in l2tp_recv_dequeue()  argument
435 	spin_lock_bh(&session->reorder_q.lock);  in l2tp_recv_dequeue()
436 	skb_queue_walk_safe(&session->reorder_q, skb, tmp) {  in l2tp_recv_dequeue()
438 			atomic_long_inc(&session->stats.rx_seq_discards);  in l2tp_recv_dequeue()
439 			atomic_long_inc(&session->stats.rx_errors);  in l2tp_recv_dequeue()
440 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_dequeue()
442 				 session->name, L2TP_SKB_CB(skb)->ns,  in l2tp_recv_dequeue()
443 				 L2TP_SKB_CB(skb)->length, session->nr,  in l2tp_recv_dequeue()
444 				 skb_queue_len(&session->reorder_q));  in l2tp_recv_dequeue()
445 			session->reorder_skip = 1;  in l2tp_recv_dequeue()
446 			__skb_unlink(skb, &session->reorder_q);  in l2tp_recv_dequeue()
452 			if (session->reorder_skip) {  in l2tp_recv_dequeue()
453 				l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_dequeue()
455 					 session->name, session->nr,  in l2tp_recv_dequeue()
457 				session->reorder_skip = 0;  in l2tp_recv_dequeue()
458 				session->nr = L2TP_SKB_CB(skb)->ns;  in l2tp_recv_dequeue()
460 			if (L2TP_SKB_CB(skb)->ns != session->nr) {  in l2tp_recv_dequeue()
461 				l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_dequeue()
463 					 session->name, L2TP_SKB_CB(skb)->ns,  in l2tp_recv_dequeue()
464 					 L2TP_SKB_CB(skb)->length, session->nr,  in l2tp_recv_dequeue()
465 					 skb_queue_len(&session->reorder_q));  in l2tp_recv_dequeue()
469 		__skb_unlink(skb, &session->reorder_q);  in l2tp_recv_dequeue()
474 		spin_unlock_bh(&session->reorder_q.lock);  in l2tp_recv_dequeue()
475 		l2tp_recv_dequeue_skb(session, skb);  in l2tp_recv_dequeue()
480 	spin_unlock_bh(&session->reorder_q.lock);  in l2tp_recv_dequeue()
483 static int l2tp_seq_check_rx_window(struct l2tp_session *session, u32 nr)  in l2tp_seq_check_rx_window()  argument
487 	if (nr >= session->nr)  in l2tp_seq_check_rx_window()
488 		nws = nr - session->nr;  in l2tp_seq_check_rx_window()
490 		nws = (session->nr_max + 1) - (session->nr - nr);  in l2tp_seq_check_rx_window()
492 	return nws < session->nr_window_size;  in l2tp_seq_check_rx_window()
498 static int l2tp_recv_data_seq(struct l2tp_session *session, struct sk_buff *skb)  in l2tp_recv_data_seq()  argument
500 	if (!l2tp_seq_check_rx_window(session, L2TP_SKB_CB(skb)->ns)) {  in l2tp_recv_data_seq()
504 		l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_data_seq()
506 			 session->name, L2TP_SKB_CB(skb)->ns,  in l2tp_recv_data_seq()
507 			 L2TP_SKB_CB(skb)->length, session->nr);  in l2tp_recv_data_seq()
511 	if (session->reorder_timeout != 0) {  in l2tp_recv_data_seq()
515 		l2tp_recv_queue_skb(session, skb);  in l2tp_recv_data_seq()
524 	if (L2TP_SKB_CB(skb)->ns == session->nr) {  in l2tp_recv_data_seq()
525 		skb_queue_tail(&session->reorder_q, skb);  in l2tp_recv_data_seq()
528 		u32 nr_next = (session->nr_oos + 1) & session->nr_max;  in l2tp_recv_data_seq()
531 			session->nr_oos_count++;  in l2tp_recv_data_seq()
533 			session->nr_oos_count = 0;  in l2tp_recv_data_seq()
535 		session->nr_oos = nr_oos;  in l2tp_recv_data_seq()
536 		if (session->nr_oos_count > session->nr_oos_count_max) {  in l2tp_recv_data_seq()
537 			session->reorder_skip = 1;  in l2tp_recv_data_seq()
538 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_data_seq()
540 				 session->name, session->nr_oos_count);  in l2tp_recv_data_seq()
542 		if (!session->reorder_skip) {  in l2tp_recv_data_seq()
543 			atomic_long_inc(&session->stats.rx_seq_discards);  in l2tp_recv_data_seq()
544 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_data_seq()
546 				 session->name, L2TP_SKB_CB(skb)->ns,  in l2tp_recv_data_seq()
547 				 L2TP_SKB_CB(skb)->length, session->nr,  in l2tp_recv_data_seq()
548 				 skb_queue_len(&session->reorder_q));  in l2tp_recv_data_seq()
551 		skb_queue_tail(&session->reorder_q, skb);  in l2tp_recv_data_seq()
620 void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,  in l2tp_recv_common()  argument
624 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_recv_common()
629 	if (session->peer_cookie_len > 0) {  in l2tp_recv_common()
630 		if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {  in l2tp_recv_common()
634 				  session->session_id);  in l2tp_recv_common()
635 			atomic_long_inc(&session->stats.rx_cookie_discards);  in l2tp_recv_common()
638 		ptr += session->peer_cookie_len;  in l2tp_recv_common()
661 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
663 				 session->name, ns, nr, session->nr);  in l2tp_recv_common()
665 	} else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {  in l2tp_recv_common()
675 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
677 				 session->name, ns, session->nr);  in l2tp_recv_common()
687 		if ((!session->lns_mode) && (!session->send_seq)) {  in l2tp_recv_common()
688 			l2tp_info(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
690 				  session->name);  in l2tp_recv_common()
691 			session->send_seq = 1;  in l2tp_recv_common()
692 			l2tp_session_set_header_len(session, tunnel->version);  in l2tp_recv_common()
698 		if (session->recv_seq) {  in l2tp_recv_common()
699 			l2tp_warn(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
701 				  session->name);  in l2tp_recv_common()
702 			atomic_long_inc(&session->stats.rx_seq_discards);  in l2tp_recv_common()
711 		if ((!session->lns_mode) && (session->send_seq)) {  in l2tp_recv_common()
712 			l2tp_info(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
714 				  session->name);  in l2tp_recv_common()
715 			session->send_seq = 0;  in l2tp_recv_common()
716 			l2tp_session_set_header_len(session, tunnel->version);  in l2tp_recv_common()
717 		} else if (session->send_seq) {  in l2tp_recv_common()
718 			l2tp_warn(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
720 				  session->name);  in l2tp_recv_common()
721 			atomic_long_inc(&session->stats.rx_seq_discards);  in l2tp_recv_common()
749 		(session->reorder_timeout ? session->reorder_timeout : HZ);  in l2tp_recv_common()
755 		if (l2tp_recv_data_seq(session, skb))  in l2tp_recv_common()
762 		skb_queue_tail(&session->reorder_q, skb);  in l2tp_recv_common()
766 	l2tp_recv_dequeue(session);  in l2tp_recv_common()
771 	atomic_long_inc(&session->stats.rx_errors);  in l2tp_recv_common()
778 static int l2tp_session_queue_purge(struct l2tp_session *session)  in l2tp_session_queue_purge()  argument
781 	BUG_ON(!session);  in l2tp_session_queue_purge()
782 	BUG_ON(session->magic != L2TP_SESSION_MAGIC);  in l2tp_session_queue_purge()
783 	while ((skb = skb_dequeue(&session->reorder_q))) {  in l2tp_session_queue_purge()
784 		atomic_long_inc(&session->stats.rx_errors);  in l2tp_session_queue_purge()
798 	struct l2tp_session *session = NULL;  in l2tp_udp_recv_core()  local
875 	session = l2tp_tunnel_get_session(tunnel, session_id);  in l2tp_udp_recv_core()
876 	if (!session || !session->recv_skb) {  in l2tp_udp_recv_core()
877 		if (session)  in l2tp_udp_recv_core()
878 			l2tp_session_dec_refcount(session);  in l2tp_udp_recv_core()
887 	l2tp_recv_common(session, skb, ptr, optr, hdrflags, length);  in l2tp_udp_recv_core()
888 	l2tp_session_dec_refcount(session);  in l2tp_udp_recv_core()
932 static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)  in l2tp_build_l2tpv2_header()  argument
934 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_build_l2tpv2_header()
939 	u32 session_id = session->peer_session_id;  in l2tp_build_l2tpv2_header()
941 	if (session->send_seq)  in l2tp_build_l2tpv2_header()
948 	if (session->send_seq) {  in l2tp_build_l2tpv2_header()
949 		*bufp++ = htons(session->ns);  in l2tp_build_l2tpv2_header()
951 		session->ns++;  in l2tp_build_l2tpv2_header()
952 		session->ns &= 0xffff;  in l2tp_build_l2tpv2_header()
953 		l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated ns to %u\n",  in l2tp_build_l2tpv2_header()
954 			 session->name, session->ns);  in l2tp_build_l2tpv2_header()
960 static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)  in l2tp_build_l2tpv3_header()  argument
962 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_build_l2tpv3_header()
977 	*((__be32 *) bufp) = htonl(session->peer_session_id);  in l2tp_build_l2tpv3_header()
979 	if (session->cookie_len) {  in l2tp_build_l2tpv3_header()
980 		memcpy(bufp, &session->cookie[0], session->cookie_len);  in l2tp_build_l2tpv3_header()
981 		bufp += session->cookie_len;  in l2tp_build_l2tpv3_header()
983 	if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {  in l2tp_build_l2tpv3_header()
986 		if (session->send_seq) {  in l2tp_build_l2tpv3_header()
987 			l2h = 0x40000000 | session->ns;  in l2tp_build_l2tpv3_header()
988 			session->ns++;  in l2tp_build_l2tpv3_header()
989 			session->ns &= 0xffffff;  in l2tp_build_l2tpv3_header()
990 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_build_l2tpv3_header()
992 				 session->name, session->ns);  in l2tp_build_l2tpv3_header()
1002 static void l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,  in l2tp_xmit_core()  argument
1005 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_xmit_core()
1010 	if (session->send_seq)  in l2tp_xmit_core()
1011 		l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %zd bytes, ns=%u\n",  in l2tp_xmit_core()
1012 			 session->name, data_len, session->ns - 1);  in l2tp_xmit_core()
1014 		l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %zd bytes\n",  in l2tp_xmit_core()
1015 			 session->name, data_len);  in l2tp_xmit_core()
1017 	if (session->debug & L2TP_MSG_DATA) {  in l2tp_xmit_core()
1021 		pr_debug("%s: xmit\n", session->name);  in l2tp_xmit_core()
1039 		atomic_long_inc(&session->stats.tx_packets);  in l2tp_xmit_core()
1040 		atomic_long_add(len, &session->stats.tx_bytes);  in l2tp_xmit_core()
1043 		atomic_long_inc(&session->stats.tx_errors);  in l2tp_xmit_core()
1050 int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len)  in l2tp_xmit_skb()  argument
1053 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_xmit_skb()
1075 	session->build_header(session, __skb_push(skb, hdr_len));  in l2tp_xmit_skb()
1132 	l2tp_xmit_core(session, skb, fl, data_len);  in l2tp_xmit_skb()
1189 	struct l2tp_session *session;  in l2tp_tunnel_closeall()  local
1201 			session = hlist_entry(walk, struct l2tp_session, hlist);  in l2tp_tunnel_closeall()
1203 			l2tp_info(session, L2TP_MSG_CONTROL,  in l2tp_tunnel_closeall()
1204 				  "%s: closing session\n", session->name);  in l2tp_tunnel_closeall()
1206 			hlist_del_init(&session->hlist);  in l2tp_tunnel_closeall()
1208 			if (test_and_set_bit(0, &session->dead))  in l2tp_tunnel_closeall()
1213 			__l2tp_session_unhash(session);  in l2tp_tunnel_closeall()
1214 			l2tp_session_queue_purge(session);  in l2tp_tunnel_closeall()
1216 			if (session->session_close != NULL)  in l2tp_tunnel_closeall()
1217 				(*session->session_close)(session);  in l2tp_tunnel_closeall()
1219 			l2tp_session_dec_refcount(session);  in l2tp_tunnel_closeall()
1560 void l2tp_session_free(struct l2tp_session *session)  in l2tp_session_free()  argument
1562 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_session_free()
1564 	BUG_ON(refcount_read(&session->ref_count) != 0);  in l2tp_session_free()
1571 	kfree(session);  in l2tp_session_free()
1580 void __l2tp_session_unhash(struct l2tp_session *session)  in __l2tp_session_unhash()  argument
1582 	struct l2tp_tunnel *tunnel = session->tunnel;  in __l2tp_session_unhash()
1588 		hlist_del_init(&session->hlist);  in __l2tp_session_unhash()
1595 			hlist_del_init_rcu(&session->global_hlist);  in __l2tp_session_unhash()
1606 int l2tp_session_delete(struct l2tp_session *session)  in l2tp_session_delete()  argument
1608 	if (test_and_set_bit(0, &session->dead))  in l2tp_session_delete()
1611 	__l2tp_session_unhash(session);  in l2tp_session_delete()
1612 	l2tp_session_queue_purge(session);  in l2tp_session_delete()
1613 	if (session->session_close != NULL)  in l2tp_session_delete()
1614 		(*session->session_close)(session);  in l2tp_session_delete()
1616 	l2tp_session_dec_refcount(session);  in l2tp_session_delete()
1625 void l2tp_session_set_header_len(struct l2tp_session *session, int version)  in l2tp_session_set_header_len()  argument
1628 		session->hdr_len = 6;  in l2tp_session_set_header_len()
1629 		if (session->send_seq)  in l2tp_session_set_header_len()
1630 			session->hdr_len += 4;  in l2tp_session_set_header_len()
1632 		session->hdr_len = 4 + session->cookie_len;  in l2tp_session_set_header_len()
1633 		session->hdr_len += l2tp_get_l2specific_len(session);  in l2tp_session_set_header_len()
1634 		if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)  in l2tp_session_set_header_len()
1635 			session->hdr_len += 4;  in l2tp_session_set_header_len()
1643 	struct l2tp_session *session;  in l2tp_session_create()  local
1645 	session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL);  in l2tp_session_create()
1646 	if (session != NULL) {  in l2tp_session_create()
1647 		session->magic = L2TP_SESSION_MAGIC;  in l2tp_session_create()
1648 		session->tunnel = tunnel;  in l2tp_session_create()
1650 		session->session_id = session_id;  in l2tp_session_create()
1651 		session->peer_session_id = peer_session_id;  in l2tp_session_create()
1652 		session->nr = 0;  in l2tp_session_create()
1654 			session->nr_max = 0xffff;  in l2tp_session_create()
1656 			session->nr_max = 0xffffff;  in l2tp_session_create()
1657 		session->nr_window_size = session->nr_max / 2;  in l2tp_session_create()
1658 		session->nr_oos_count_max = 4;  in l2tp_session_create()
1661 		session->reorder_skip = 1;  in l2tp_session_create()
1663 		sprintf(&session->name[0], "sess %u/%u",  in l2tp_session_create()
1664 			tunnel->tunnel_id, session->session_id);  in l2tp_session_create()
1666 		skb_queue_head_init(&session->reorder_q);  in l2tp_session_create()
1668 		INIT_HLIST_NODE(&session->hlist);  in l2tp_session_create()
1669 		INIT_HLIST_NODE(&session->global_hlist);  in l2tp_session_create()
1672 		session->debug = tunnel->debug;  in l2tp_session_create()
1675 			session->pwtype = cfg->pw_type;  in l2tp_session_create()
1676 			session->debug = cfg->debug;  in l2tp_session_create()
1677 			session->send_seq = cfg->send_seq;  in l2tp_session_create()
1678 			session->recv_seq = cfg->recv_seq;  in l2tp_session_create()
1679 			session->lns_mode = cfg->lns_mode;  in l2tp_session_create()
1680 			session->reorder_timeout = cfg->reorder_timeout;  in l2tp_session_create()
1681 			session->l2specific_type = cfg->l2specific_type;  in l2tp_session_create()
1682 			session->cookie_len = cfg->cookie_len;  in l2tp_session_create()
1683 			memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);  in l2tp_session_create()
1684 			session->peer_cookie_len = cfg->peer_cookie_len;  in l2tp_session_create()
1685 			memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);  in l2tp_session_create()
1689 			session->build_header = l2tp_build_l2tpv2_header;  in l2tp_session_create()
1691 			session->build_header = l2tp_build_l2tpv3_header;  in l2tp_session_create()
1693 		l2tp_session_set_header_len(session, tunnel->version);  in l2tp_session_create()
1695 		refcount_set(&session->ref_count, 1);  in l2tp_session_create()
1697 		return session;  in l2tp_session_create()