206 	struct l2tp_session *session;  in l2tp_tunnel_get_session()  local
211 	hlist_for_each_entry(session, session_list, hlist)  in l2tp_tunnel_get_session()
212 		if (session->session_id == session_id) {  in l2tp_tunnel_get_session()
213 			l2tp_session_inc_refcount(session);  in l2tp_tunnel_get_session()
216 			return session;  in l2tp_tunnel_get_session()
227 	struct l2tp_session *session;  in l2tp_session_get()  local
232 	hlist_for_each_entry_rcu(session, session_list, global_hlist)  in l2tp_session_get()
233 		if (session->session_id == session_id) {  in l2tp_session_get()
234 			l2tp_session_inc_refcount(session);  in l2tp_session_get()
237 			return session;  in l2tp_session_get()
248 	struct l2tp_session *session;  in l2tp_session_get_nth()  local
253 		hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {  in l2tp_session_get_nth()
255 				l2tp_session_inc_refcount(session);  in l2tp_session_get_nth()
257 				return session;  in l2tp_session_get_nth()
276 	struct l2tp_session *session;  in l2tp_session_get_by_ifname()  local
280 		hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {  in l2tp_session_get_by_ifname()
281 			if (!strcmp(session->ifname, ifname)) {  in l2tp_session_get_by_ifname()
282 				l2tp_session_inc_refcount(session);  in l2tp_session_get_by_ifname()
285 				return session;  in l2tp_session_get_by_ifname()
296 int l2tp_session_register(struct l2tp_session *session,  in l2tp_session_register()  argument
305 	head = l2tp_session_id_hash(tunnel, session->session_id);  in l2tp_session_register()
314 		if (session_walk->session_id == session->session_id) {  in l2tp_session_register()
321 		g_head = l2tp_session_id_hash_2(pn, session->session_id);  in l2tp_session_register()
326 			if (session_walk->session_id == session->session_id) {  in l2tp_session_register()
332 		hlist_add_head_rcu(&session->global_hlist, g_head);  in l2tp_session_register()
339 	hlist_add_head(&session->hlist, head);  in l2tp_session_register()
360 static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)  in l2tp_recv_queue_skb()  argument
366 	spin_lock_bh(&session->reorder_q.lock);  in l2tp_recv_queue_skb()
367 	skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {  in l2tp_recv_queue_skb()
369 			__skb_queue_before(&session->reorder_q, skbp, skb);  in l2tp_recv_queue_skb()
370 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_queue_skb()
372 				 session->name, ns, L2TP_SKB_CB(skbp)->ns,  in l2tp_recv_queue_skb()
373 				 skb_queue_len(&session->reorder_q));  in l2tp_recv_queue_skb()
374 			atomic_long_inc(&session->stats.rx_oos_packets);  in l2tp_recv_queue_skb()
379 	__skb_queue_tail(&session->reorder_q, skb);  in l2tp_recv_queue_skb()
382 	spin_unlock_bh(&session->reorder_q.lock);  in l2tp_recv_queue_skb()
387 static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)  in l2tp_recv_dequeue_skb()  argument
389 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_recv_dequeue_skb()
399 	atomic_long_inc(&session->stats.rx_packets);  in l2tp_recv_dequeue_skb()
400 	atomic_long_add(length, &session->stats.rx_bytes);  in l2tp_recv_dequeue_skb()
404 		session->nr++;  in l2tp_recv_dequeue_skb()
405 		session->nr &= session->nr_max;  in l2tp_recv_dequeue_skb()
407 		l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated nr to %hu\n",  in l2tp_recv_dequeue_skb()
408 			 session->name, session->nr);  in l2tp_recv_dequeue_skb()
412 	if (session->recv_skb != NULL)  in l2tp_recv_dequeue_skb()
413 		(*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);  in l2tp_recv_dequeue_skb()
421 static void l2tp_recv_dequeue(struct l2tp_session *session)  in l2tp_recv_dequeue()  argument
431 	spin_lock_bh(&session->reorder_q.lock);  in l2tp_recv_dequeue()
432 	skb_queue_walk_safe(&session->reorder_q, skb, tmp) {  in l2tp_recv_dequeue()
434 			atomic_long_inc(&session->stats.rx_seq_discards);  in l2tp_recv_dequeue()
435 			atomic_long_inc(&session->stats.rx_errors);  in l2tp_recv_dequeue()
436 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_dequeue()
438 				 session->name, L2TP_SKB_CB(skb)->ns,  in l2tp_recv_dequeue()
439 				 L2TP_SKB_CB(skb)->length, session->nr,  in l2tp_recv_dequeue()
440 				 skb_queue_len(&session->reorder_q));  in l2tp_recv_dequeue()
441 			session->reorder_skip = 1;  in l2tp_recv_dequeue()
442 			__skb_unlink(skb, &session->reorder_q);  in l2tp_recv_dequeue()
448 			if (session->reorder_skip) {  in l2tp_recv_dequeue()
449 				l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_dequeue()
451 					 session->name, session->nr,  in l2tp_recv_dequeue()
453 				session->reorder_skip = 0;  in l2tp_recv_dequeue()
454 				session->nr = L2TP_SKB_CB(skb)->ns;  in l2tp_recv_dequeue()
456 			if (L2TP_SKB_CB(skb)->ns != session->nr) {  in l2tp_recv_dequeue()
457 				l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_dequeue()
459 					 session->name, L2TP_SKB_CB(skb)->ns,  in l2tp_recv_dequeue()
460 					 L2TP_SKB_CB(skb)->length, session->nr,  in l2tp_recv_dequeue()
461 					 skb_queue_len(&session->reorder_q));  in l2tp_recv_dequeue()
465 		__skb_unlink(skb, &session->reorder_q);  in l2tp_recv_dequeue()
470 		spin_unlock_bh(&session->reorder_q.lock);  in l2tp_recv_dequeue()
471 		l2tp_recv_dequeue_skb(session, skb);  in l2tp_recv_dequeue()
476 	spin_unlock_bh(&session->reorder_q.lock);  in l2tp_recv_dequeue()
479 static int l2tp_seq_check_rx_window(struct l2tp_session *session, u32 nr)  in l2tp_seq_check_rx_window()  argument
483 	if (nr >= session->nr)  in l2tp_seq_check_rx_window()
484 		nws = nr - session->nr;  in l2tp_seq_check_rx_window()
486 		nws = (session->nr_max + 1) - (session->nr - nr);  in l2tp_seq_check_rx_window()
488 	return nws < session->nr_window_size;  in l2tp_seq_check_rx_window()
494 static int l2tp_recv_data_seq(struct l2tp_session *session, struct sk_buff *skb)  in l2tp_recv_data_seq()  argument
496 	if (!l2tp_seq_check_rx_window(session, L2TP_SKB_CB(skb)->ns)) {  in l2tp_recv_data_seq()
500 		l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_data_seq()
502 			 session->name, L2TP_SKB_CB(skb)->ns,  in l2tp_recv_data_seq()
503 			 L2TP_SKB_CB(skb)->length, session->nr);  in l2tp_recv_data_seq()
507 	if (session->reorder_timeout != 0) {  in l2tp_recv_data_seq()
511 		l2tp_recv_queue_skb(session, skb);  in l2tp_recv_data_seq()
520 	if (L2TP_SKB_CB(skb)->ns == session->nr) {  in l2tp_recv_data_seq()
521 		skb_queue_tail(&session->reorder_q, skb);  in l2tp_recv_data_seq()
524 		u32 nr_next = (session->nr_oos + 1) & session->nr_max;  in l2tp_recv_data_seq()
527 			session->nr_oos_count++;  in l2tp_recv_data_seq()
529 			session->nr_oos_count = 0;  in l2tp_recv_data_seq()
531 		session->nr_oos = nr_oos;  in l2tp_recv_data_seq()
532 		if (session->nr_oos_count > session->nr_oos_count_max) {  in l2tp_recv_data_seq()
533 			session->reorder_skip = 1;  in l2tp_recv_data_seq()
534 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_data_seq()
536 				 session->name, session->nr_oos_count);  in l2tp_recv_data_seq()
538 		if (!session->reorder_skip) {  in l2tp_recv_data_seq()
539 			atomic_long_inc(&session->stats.rx_seq_discards);  in l2tp_recv_data_seq()
540 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_data_seq()
542 				 session->name, L2TP_SKB_CB(skb)->ns,  in l2tp_recv_data_seq()
543 				 L2TP_SKB_CB(skb)->length, session->nr,  in l2tp_recv_data_seq()
544 				 skb_queue_len(&session->reorder_q));  in l2tp_recv_data_seq()
547 		skb_queue_tail(&session->reorder_q, skb);  in l2tp_recv_data_seq()
616 void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,  in l2tp_recv_common()  argument
620 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_recv_common()
625 	if (session->peer_cookie_len > 0) {  in l2tp_recv_common()
626 		if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {  in l2tp_recv_common()
630 				  session->session_id);  in l2tp_recv_common()
631 			atomic_long_inc(&session->stats.rx_cookie_discards);  in l2tp_recv_common()
634 		ptr += session->peer_cookie_len;  in l2tp_recv_common()
657 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
659 				 session->name, ns, nr, session->nr);  in l2tp_recv_common()
661 	} else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {  in l2tp_recv_common()
671 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
673 				 session->name, ns, session->nr);  in l2tp_recv_common()
683 		if ((!session->lns_mode) && (!session->send_seq)) {  in l2tp_recv_common()
684 			l2tp_info(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
686 				  session->name);  in l2tp_recv_common()
687 			session->send_seq = 1;  in l2tp_recv_common()
688 			l2tp_session_set_header_len(session, tunnel->version);  in l2tp_recv_common()
694 		if (session->recv_seq) {  in l2tp_recv_common()
695 			l2tp_warn(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
697 				  session->name);  in l2tp_recv_common()
698 			atomic_long_inc(&session->stats.rx_seq_discards);  in l2tp_recv_common()
707 		if ((!session->lns_mode) && (session->send_seq)) {  in l2tp_recv_common()
708 			l2tp_info(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
710 				  session->name);  in l2tp_recv_common()
711 			session->send_seq = 0;  in l2tp_recv_common()
712 			l2tp_session_set_header_len(session, tunnel->version);  in l2tp_recv_common()
713 		} else if (session->send_seq) {  in l2tp_recv_common()
714 			l2tp_warn(session, L2TP_MSG_SEQ,  in l2tp_recv_common()
716 				  session->name);  in l2tp_recv_common()
717 			atomic_long_inc(&session->stats.rx_seq_discards);  in l2tp_recv_common()
745 		(session->reorder_timeout ? session->reorder_timeout : HZ);  in l2tp_recv_common()
751 		if (l2tp_recv_data_seq(session, skb))  in l2tp_recv_common()
758 		skb_queue_tail(&session->reorder_q, skb);  in l2tp_recv_common()
762 	l2tp_recv_dequeue(session);  in l2tp_recv_common()
767 	atomic_long_inc(&session->stats.rx_errors);  in l2tp_recv_common()
774 static int l2tp_session_queue_purge(struct l2tp_session *session)  in l2tp_session_queue_purge()  argument
777 	BUG_ON(!session);  in l2tp_session_queue_purge()
778 	BUG_ON(session->magic != L2TP_SESSION_MAGIC);  in l2tp_session_queue_purge()
779 	while ((skb = skb_dequeue(&session->reorder_q))) {  in l2tp_session_queue_purge()
780 		atomic_long_inc(&session->stats.rx_errors);  in l2tp_session_queue_purge()
794 	struct l2tp_session *session = NULL;  in l2tp_udp_recv_core()  local
871 	session = l2tp_tunnel_get_session(tunnel, session_id);  in l2tp_udp_recv_core()
872 	if (!session || !session->recv_skb) {  in l2tp_udp_recv_core()
873 		if (session)  in l2tp_udp_recv_core()
874 			l2tp_session_dec_refcount(session);  in l2tp_udp_recv_core()
884 	    l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr))  in l2tp_udp_recv_core()
887 	l2tp_recv_common(session, skb, ptr, optr, hdrflags, length);  in l2tp_udp_recv_core()
888 	l2tp_session_dec_refcount(session);  in l2tp_udp_recv_core()
932 static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)  in l2tp_build_l2tpv2_header()  argument
934 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_build_l2tpv2_header()
939 	u32 session_id = session->peer_session_id;  in l2tp_build_l2tpv2_header()
941 	if (session->send_seq)  in l2tp_build_l2tpv2_header()
948 	if (session->send_seq) {  in l2tp_build_l2tpv2_header()
949 		*bufp++ = htons(session->ns);  in l2tp_build_l2tpv2_header()
951 		session->ns++;  in l2tp_build_l2tpv2_header()
952 		session->ns &= 0xffff;  in l2tp_build_l2tpv2_header()
953 		l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated ns to %u\n",  in l2tp_build_l2tpv2_header()
954 			 session->name, session->ns);  in l2tp_build_l2tpv2_header()
960 static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)  in l2tp_build_l2tpv3_header()  argument
962 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_build_l2tpv3_header()
977 	*((__be32 *) bufp) = htonl(session->peer_session_id);  in l2tp_build_l2tpv3_header()
979 	if (session->cookie_len) {  in l2tp_build_l2tpv3_header()
980 		memcpy(bufp, &session->cookie[0], session->cookie_len);  in l2tp_build_l2tpv3_header()
981 		bufp += session->cookie_len;  in l2tp_build_l2tpv3_header()
983 	if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {  in l2tp_build_l2tpv3_header()
986 		if (session->send_seq) {  in l2tp_build_l2tpv3_header()
987 			l2h = 0x40000000 | session->ns;  in l2tp_build_l2tpv3_header()
988 			session->ns++;  in l2tp_build_l2tpv3_header()
989 			session->ns &= 0xffffff;  in l2tp_build_l2tpv3_header()
990 			l2tp_dbg(session, L2TP_MSG_SEQ,  in l2tp_build_l2tpv3_header()
992 				 session->name, session->ns);  in l2tp_build_l2tpv3_header()
1002 static void l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,  in l2tp_xmit_core()  argument
1005 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_xmit_core()
1010 	if (session->send_seq)  in l2tp_xmit_core()
1011 		l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %zd bytes, ns=%u\n",  in l2tp_xmit_core()
1012 			 session->name, data_len, session->ns - 1);  in l2tp_xmit_core()
1014 		l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %zd bytes\n",  in l2tp_xmit_core()
1015 			 session->name, data_len);  in l2tp_xmit_core()
1017 	if (session->debug & L2TP_MSG_DATA) {  in l2tp_xmit_core()
1021 		pr_debug("%s: xmit\n", session->name);  in l2tp_xmit_core()
1039 		atomic_long_inc(&session->stats.tx_packets);  in l2tp_xmit_core()
1040 		atomic_long_add(len, &session->stats.tx_bytes);  in l2tp_xmit_core()
1043 		atomic_long_inc(&session->stats.tx_errors);  in l2tp_xmit_core()
1050 int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len)  in l2tp_xmit_skb()  argument
1053 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_xmit_skb()
1075 	session->build_header(session, __skb_push(skb, hdr_len));  in l2tp_xmit_skb()
1132 	l2tp_xmit_core(session, skb, fl, data_len);  in l2tp_xmit_skb()
1189 	struct l2tp_session *session;  in l2tp_tunnel_closeall()  local
1201 			session = hlist_entry(walk, struct l2tp_session, hlist);  in l2tp_tunnel_closeall()
1203 			l2tp_info(session, L2TP_MSG_CONTROL,  in l2tp_tunnel_closeall()
1204 				  "%s: closing session\n", session->name);  in l2tp_tunnel_closeall()
1206 			hlist_del_init(&session->hlist);  in l2tp_tunnel_closeall()
1208 			if (test_and_set_bit(0, &session->dead))  in l2tp_tunnel_closeall()
1213 			__l2tp_session_unhash(session);  in l2tp_tunnel_closeall()
1214 			l2tp_session_queue_purge(session);  in l2tp_tunnel_closeall()
1216 			if (session->session_close != NULL)  in l2tp_tunnel_closeall()
1217 				(*session->session_close)(session);  in l2tp_tunnel_closeall()
1219 			l2tp_session_dec_refcount(session);  in l2tp_tunnel_closeall()
1559 void l2tp_session_free(struct l2tp_session *session)  in l2tp_session_free()  argument
1561 	struct l2tp_tunnel *tunnel = session->tunnel;  in l2tp_session_free()
1563 	BUG_ON(refcount_read(&session->ref_count) != 0);  in l2tp_session_free()
1570 	kfree(session);  in l2tp_session_free()
1579 void __l2tp_session_unhash(struct l2tp_session *session)  in __l2tp_session_unhash()  argument
1581 	struct l2tp_tunnel *tunnel = session->tunnel;  in __l2tp_session_unhash()
1587 		hlist_del_init(&session->hlist);  in __l2tp_session_unhash()
1594 			hlist_del_init_rcu(&session->global_hlist);  in __l2tp_session_unhash()
1605 int l2tp_session_delete(struct l2tp_session *session)  in l2tp_session_delete()  argument
1607 	if (test_and_set_bit(0, &session->dead))  in l2tp_session_delete()
1610 	__l2tp_session_unhash(session);  in l2tp_session_delete()
1611 	l2tp_session_queue_purge(session);  in l2tp_session_delete()
1612 	if (session->session_close != NULL)  in l2tp_session_delete()
1613 		(*session->session_close)(session);  in l2tp_session_delete()
1615 	l2tp_session_dec_refcount(session);  in l2tp_session_delete()
1624 void l2tp_session_set_header_len(struct l2tp_session *session, int version)  in l2tp_session_set_header_len()  argument
1627 		session->hdr_len = 6;  in l2tp_session_set_header_len()
1628 		if (session->send_seq)  in l2tp_session_set_header_len()
1629 			session->hdr_len += 4;  in l2tp_session_set_header_len()
1631 		session->hdr_len = 4 + session->cookie_len;  in l2tp_session_set_header_len()
1632 		session->hdr_len += l2tp_get_l2specific_len(session);  in l2tp_session_set_header_len()
1633 		if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)  in l2tp_session_set_header_len()
1634 			session->hdr_len += 4;  in l2tp_session_set_header_len()
1642 	struct l2tp_session *session;  in l2tp_session_create()  local
1644 	session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL);  in l2tp_session_create()
1645 	if (session != NULL) {  in l2tp_session_create()
1646 		session->magic = L2TP_SESSION_MAGIC;  in l2tp_session_create()
1647 		session->tunnel = tunnel;  in l2tp_session_create()
1649 		session->session_id = session_id;  in l2tp_session_create()
1650 		session->peer_session_id = peer_session_id;  in l2tp_session_create()
1651 		session->nr = 0;  in l2tp_session_create()
1653 			session->nr_max = 0xffff;  in l2tp_session_create()
1655 			session->nr_max = 0xffffff;  in l2tp_session_create()
1656 		session->nr_window_size = session->nr_max / 2;  in l2tp_session_create()
1657 		session->nr_oos_count_max = 4;  in l2tp_session_create()
1660 		session->reorder_skip = 1;  in l2tp_session_create()
1662 		sprintf(&session->name[0], "sess %u/%u",  in l2tp_session_create()
1663 			tunnel->tunnel_id, session->session_id);  in l2tp_session_create()
1665 		skb_queue_head_init(&session->reorder_q);  in l2tp_session_create()
1667 		INIT_HLIST_NODE(&session->hlist);  in l2tp_session_create()
1668 		INIT_HLIST_NODE(&session->global_hlist);  in l2tp_session_create()
1671 		session->debug = tunnel->debug;  in l2tp_session_create()
1674 			session->pwtype = cfg->pw_type;  in l2tp_session_create()
1675 			session->debug = cfg->debug;  in l2tp_session_create()
1676 			session->send_seq = cfg->send_seq;  in l2tp_session_create()
1677 			session->recv_seq = cfg->recv_seq;  in l2tp_session_create()
1678 			session->lns_mode = cfg->lns_mode;  in l2tp_session_create()
1679 			session->reorder_timeout = cfg->reorder_timeout;  in l2tp_session_create()
1680 			session->l2specific_type = cfg->l2specific_type;  in l2tp_session_create()
1681 			session->cookie_len = cfg->cookie_len;  in l2tp_session_create()
1682 			memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);  in l2tp_session_create()
1683 			session->peer_cookie_len = cfg->peer_cookie_len;  in l2tp_session_create()
1684 			memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);  in l2tp_session_create()
1688 			session->build_header = l2tp_build_l2tpv2_header;  in l2tp_session_create()
1690 			session->build_header = l2tp_build_l2tpv3_header;  in l2tp_session_create()
1692 		l2tp_session_set_header_len(session, tunnel->version);  in l2tp_session_create()
1694 		refcount_set(&session->ref_count, 1);  in l2tp_session_create()
1696 		return session;  in l2tp_session_create()