1 /*****************************************************************************
2 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets
3 *
4 * PPPoX --- Generic PPP encapsulation socket family
5 * PPPoL2TP --- PPP over L2TP (RFC 2661)
6 *
7 * Version: 2.0.0
8 *
9 * Authors: James Chapman (jchapman@katalix.com)
10 *
11 * Based on original work by Martijn van Oosterhout <kleptog@svana.org>
12 *
13 * License:
14 * This program is free software; you can redistribute it and/or
15 * modify it under the terms of the GNU General Public License
16 * as published by the Free Software Foundation; either version
17 * 2 of the License, or (at your option) any later version.
18 *
19 */
20
21 /* This driver handles only L2TP data frames; control frames are handled by a
22 * userspace application.
23 *
24 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and
25 * attaches it to a bound UDP socket with local tunnel_id / session_id and
26 * peer tunnel_id / session_id set. Data can then be sent or received using
27 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket
28 * can be read or modified using ioctl() or [gs]etsockopt() calls.
29 *
30 * When a PPPoL2TP socket is connected with local and peer session_id values
31 * zero, the socket is treated as a special tunnel management socket.
32 *
33 * Here's example userspace code to create a socket for sending/receiving data
34 * over an L2TP session:-
35 *
36 * struct sockaddr_pppol2tp sax;
37 * int fd;
38 * int session_fd;
39 *
40 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
41 *
42 * sax.sa_family = AF_PPPOX;
43 * sax.sa_protocol = PX_PROTO_OL2TP;
44 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket
45 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr;
46 * sax.pppol2tp.addr.sin_port = addr->sin_port;
47 * sax.pppol2tp.addr.sin_family = AF_INET;
48 * sax.pppol2tp.s_tunnel = tunnel_id;
49 * sax.pppol2tp.s_session = session_id;
50 * sax.pppol2tp.d_tunnel = peer_tunnel_id;
51 * sax.pppol2tp.d_session = peer_session_id;
52 *
53 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax));
54 *
55 * A pppd plugin that allows PPP traffic to be carried over L2TP using
56 * this driver is available from the OpenL2TP project at
57 * http://openl2tp.sourceforge.net.
58 */
59
60 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
61
62 #include <linux/module.h>
63 #include <linux/string.h>
64 #include <linux/list.h>
65 #include <linux/uaccess.h>
66
67 #include <linux/kernel.h>
68 #include <linux/spinlock.h>
69 #include <linux/kthread.h>
70 #include <linux/sched.h>
71 #include <linux/slab.h>
72 #include <linux/errno.h>
73 #include <linux/jiffies.h>
74
75 #include <linux/netdevice.h>
76 #include <linux/net.h>
77 #include <linux/inetdevice.h>
78 #include <linux/skbuff.h>
79 #include <linux/init.h>
80 #include <linux/ip.h>
81 #include <linux/udp.h>
82 #include <linux/if_pppox.h>
83 #include <linux/if_pppol2tp.h>
84 #include <net/sock.h>
85 #include <linux/ppp_channel.h>
86 #include <linux/ppp_defs.h>
87 #include <linux/ppp-ioctl.h>
88 #include <linux/file.h>
89 #include <linux/hash.h>
90 #include <linux/sort.h>
91 #include <linux/proc_fs.h>
92 #include <linux/l2tp.h>
93 #include <linux/nsproxy.h>
94 #include <net/net_namespace.h>
95 #include <net/netns/generic.h>
96 #include <net/ip.h>
97 #include <net/udp.h>
98 #include <net/inet_common.h>
99
100 #include <asm/byteorder.h>
101 #include <linux/atomic.h>
102
103 #include "l2tp_core.h"
104
105 #define PPPOL2TP_DRV_VERSION "V2.0"
106
107 /* Space for UDP, L2TP and PPP headers */
108 #define PPPOL2TP_HEADER_OVERHEAD 40
109
110 /* Number of bytes to build transmit L2TP headers.
111 * Unfortunately the size is different depending on whether sequence numbers
112 * are enabled.
113 */
114 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10
115 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6
116
117 /* Private data of each session. This data lives at the end of struct
118 * l2tp_session, referenced via session->priv[].
119 */
120 struct pppol2tp_session {
121 int owner; /* pid that opened the socket */
122
123 struct mutex sk_lock; /* Protects .sk */
124 struct sock __rcu *sk; /* Pointer to the session
125 * PPPoX socket */
126 struct sock *__sk; /* Copy of .sk, for cleanup */
127 struct rcu_head rcu; /* For asynchronous release */
128 };
129
130 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);
131
132 static const struct ppp_channel_ops pppol2tp_chan_ops = {
133 .start_xmit = pppol2tp_xmit,
134 };
135
136 static const struct proto_ops pppol2tp_ops;
137
138 /* Retrieves the pppol2tp socket associated to a session.
139 * A reference is held on the returned socket, so this function must be paired
140 * with sock_put().
141 */
pppol2tp_session_get_sock(struct l2tp_session * session)142 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session)
143 {
144 struct pppol2tp_session *ps = l2tp_session_priv(session);
145 struct sock *sk;
146
147 rcu_read_lock();
148 sk = rcu_dereference(ps->sk);
149 if (sk)
150 sock_hold(sk);
151 rcu_read_unlock();
152
153 return sk;
154 }
155
156 /* Helpers to obtain tunnel/session contexts from sockets.
157 */
pppol2tp_sock_to_session(struct sock * sk)158 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk)
159 {
160 struct l2tp_session *session;
161
162 if (sk == NULL)
163 return NULL;
164
165 sock_hold(sk);
166 session = (struct l2tp_session *)(sk->sk_user_data);
167 if (session == NULL) {
168 sock_put(sk);
169 goto out;
170 }
171
172 BUG_ON(session->magic != L2TP_SESSION_MAGIC);
173
174 out:
175 return session;
176 }
177
178 /*****************************************************************************
179 * Receive data handling
180 *****************************************************************************/
181
182 /* Receive message. This is the recvmsg for the PPPoL2TP socket.
183 */
pppol2tp_recvmsg(struct socket * sock,struct msghdr * msg,size_t len,int flags)184 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg,
185 size_t len, int flags)
186 {
187 int err;
188 struct sk_buff *skb;
189 struct sock *sk = sock->sk;
190
191 err = -EIO;
192 if (sk->sk_state & PPPOX_BOUND)
193 goto end;
194
195 err = 0;
196 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
197 flags & MSG_DONTWAIT, &err);
198 if (!skb)
199 goto end;
200
201 if (len > skb->len)
202 len = skb->len;
203 else if (len < skb->len)
204 msg->msg_flags |= MSG_TRUNC;
205
206 err = skb_copy_datagram_msg(skb, 0, msg, len);
207 if (likely(err == 0))
208 err = len;
209
210 kfree_skb(skb);
211 end:
212 return err;
213 }
214
pppol2tp_recv(struct l2tp_session * session,struct sk_buff * skb,int data_len)215 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len)
216 {
217 struct pppol2tp_session *ps = l2tp_session_priv(session);
218 struct sock *sk = NULL;
219
220 /* If the socket is bound, send it in to PPP's input queue. Otherwise
221 * queue it on the session socket.
222 */
223 rcu_read_lock();
224 sk = rcu_dereference(ps->sk);
225 if (sk == NULL)
226 goto no_sock;
227
228 /* If the first two bytes are 0xFF03, consider that it is the PPP's
229 * Address and Control fields and skip them. The L2TP module has always
230 * worked this way, although, in theory, the use of these fields should
231 * be negociated and handled at the PPP layer. These fields are
232 * constant: 0xFF is the All-Stations Address and 0x03 the Unnumbered
233 * Information command with Poll/Final bit set to zero (RFC 1662).
234 */
235 if (pskb_may_pull(skb, 2) && skb->data[0] == PPP_ALLSTATIONS &&
236 skb->data[1] == PPP_UI)
237 skb_pull(skb, 2);
238
239 if (sk->sk_state & PPPOX_BOUND) {
240 struct pppox_sock *po;
241
242 l2tp_dbg(session, L2TP_MSG_DATA,
243 "%s: recv %d byte data frame, passing to ppp\n",
244 session->name, data_len);
245
246 po = pppox_sk(sk);
247 ppp_input(&po->chan, skb);
248 } else {
249 l2tp_dbg(session, L2TP_MSG_DATA,
250 "%s: recv %d byte data frame, passing to L2TP socket\n",
251 session->name, data_len);
252
253 if (sock_queue_rcv_skb(sk, skb) < 0) {
254 atomic_long_inc(&session->stats.rx_errors);
255 kfree_skb(skb);
256 }
257 }
258 rcu_read_unlock();
259
260 return;
261
262 no_sock:
263 rcu_read_unlock();
264 l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name);
265 kfree_skb(skb);
266 }
267
268 /************************************************************************
269 * Transmit handling
270 ***********************************************************************/
271
272 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here
273 * when a user application does a sendmsg() on the session socket. L2TP and
274 * PPP headers must be inserted into the user's data.
275 */
pppol2tp_sendmsg(struct socket * sock,struct msghdr * m,size_t total_len)276 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
277 size_t total_len)
278 {
279 struct sock *sk = sock->sk;
280 struct sk_buff *skb;
281 int error;
282 struct l2tp_session *session;
283 struct l2tp_tunnel *tunnel;
284 int uhlen;
285
286 error = -ENOTCONN;
287 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
288 goto error;
289
290 /* Get session and tunnel contexts */
291 error = -EBADF;
292 session = pppol2tp_sock_to_session(sk);
293 if (session == NULL)
294 goto error;
295
296 tunnel = session->tunnel;
297
298 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
299
300 /* Allocate a socket buffer */
301 error = -ENOMEM;
302 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) +
303 uhlen + session->hdr_len +
304 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
305 0, GFP_KERNEL);
306 if (!skb)
307 goto error_put_sess;
308
309 /* Reserve space for headers. */
310 skb_reserve(skb, NET_SKB_PAD);
311 skb_reset_network_header(skb);
312 skb_reserve(skb, sizeof(struct iphdr));
313 skb_reset_transport_header(skb);
314 skb_reserve(skb, uhlen);
315
316 /* Add PPP header */
317 skb->data[0] = PPP_ALLSTATIONS;
318 skb->data[1] = PPP_UI;
319 skb_put(skb, 2);
320
321 /* Copy user data into skb */
322 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len);
323 if (error < 0) {
324 kfree_skb(skb);
325 goto error_put_sess;
326 }
327
328 local_bh_disable();
329 l2tp_xmit_skb(session, skb, session->hdr_len);
330 local_bh_enable();
331
332 sock_put(sk);
333
334 return total_len;
335
336 error_put_sess:
337 sock_put(sk);
338 error:
339 return error;
340 }
341
342 /* Transmit function called by generic PPP driver. Sends PPP frame
343 * over PPPoL2TP socket.
344 *
345 * This is almost the same as pppol2tp_sendmsg(), but rather than
346 * being called with a msghdr from userspace, it is called with a skb
347 * from the kernel.
348 *
349 * The supplied skb from ppp doesn't have enough headroom for the
350 * insertion of L2TP, UDP and IP headers so we need to allocate more
351 * headroom in the skb. This will create a cloned skb. But we must be
352 * careful in the error case because the caller will expect to free
353 * the skb it supplied, not our cloned skb. So we take care to always
354 * leave the original skb unfreed if we return an error.
355 */
pppol2tp_xmit(struct ppp_channel * chan,struct sk_buff * skb)356 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
357 {
358 struct sock *sk = (struct sock *) chan->private;
359 struct l2tp_session *session;
360 struct l2tp_tunnel *tunnel;
361 int uhlen, headroom;
362
363 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
364 goto abort;
365
366 /* Get session and tunnel contexts from the socket */
367 session = pppol2tp_sock_to_session(sk);
368 if (session == NULL)
369 goto abort;
370
371 tunnel = session->tunnel;
372
373 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
374 headroom = NET_SKB_PAD +
375 sizeof(struct iphdr) + /* IP header */
376 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */
377 session->hdr_len + /* L2TP header */
378 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
379 if (skb_cow_head(skb, headroom))
380 goto abort_put_sess;
381
382 /* Setup PPP header */
383 __skb_push(skb, 2);
384 skb->data[0] = PPP_ALLSTATIONS;
385 skb->data[1] = PPP_UI;
386
387 local_bh_disable();
388 l2tp_xmit_skb(session, skb, session->hdr_len);
389 local_bh_enable();
390
391 sock_put(sk);
392
393 return 1;
394
395 abort_put_sess:
396 sock_put(sk);
397 abort:
398 /* Free the original skb */
399 kfree_skb(skb);
400 return 1;
401 }
402
403 /*****************************************************************************
404 * Session (and tunnel control) socket create/destroy.
405 *****************************************************************************/
406
pppol2tp_put_sk(struct rcu_head * head)407 static void pppol2tp_put_sk(struct rcu_head *head)
408 {
409 struct pppol2tp_session *ps;
410
411 ps = container_of(head, typeof(*ps), rcu);
412 sock_put(ps->__sk);
413 }
414
415 /* Really kill the session socket. (Called from sock_put() if
416 * refcnt == 0.)
417 */
pppol2tp_session_destruct(struct sock * sk)418 static void pppol2tp_session_destruct(struct sock *sk)
419 {
420 struct l2tp_session *session = sk->sk_user_data;
421
422 skb_queue_purge(&sk->sk_receive_queue);
423 skb_queue_purge(&sk->sk_write_queue);
424
425 if (session) {
426 sk->sk_user_data = NULL;
427 BUG_ON(session->magic != L2TP_SESSION_MAGIC);
428 l2tp_session_dec_refcount(session);
429 }
430 }
431
432 /* Called when the PPPoX socket (session) is closed.
433 */
pppol2tp_release(struct socket * sock)434 static int pppol2tp_release(struct socket *sock)
435 {
436 struct sock *sk = sock->sk;
437 struct l2tp_session *session;
438 int error;
439
440 if (!sk)
441 return 0;
442
443 error = -EBADF;
444 lock_sock(sk);
445 if (sock_flag(sk, SOCK_DEAD) != 0)
446 goto error;
447
448 pppox_unbind_sock(sk);
449
450 /* Signal the death of the socket. */
451 sk->sk_state = PPPOX_DEAD;
452 sock_orphan(sk);
453 sock->sk = NULL;
454
455 session = pppol2tp_sock_to_session(sk);
456 if (session) {
457 struct pppol2tp_session *ps;
458
459 l2tp_session_delete(session);
460
461 ps = l2tp_session_priv(session);
462 mutex_lock(&ps->sk_lock);
463 ps->__sk = rcu_dereference_protected(ps->sk,
464 lockdep_is_held(&ps->sk_lock));
465 RCU_INIT_POINTER(ps->sk, NULL);
466 mutex_unlock(&ps->sk_lock);
467 call_rcu(&ps->rcu, pppol2tp_put_sk);
468
469 /* Rely on the sock_put() call at the end of the function for
470 * dropping the reference held by pppol2tp_sock_to_session().
471 * The last reference will be dropped by pppol2tp_put_sk().
472 */
473 }
474
475 release_sock(sk);
476
477 /* This will delete the session context via
478 * pppol2tp_session_destruct() if the socket's refcnt drops to
479 * zero.
480 */
481 sock_put(sk);
482
483 return 0;
484
485 error:
486 release_sock(sk);
487 return error;
488 }
489
490 static struct proto pppol2tp_sk_proto = {
491 .name = "PPPOL2TP",
492 .owner = THIS_MODULE,
493 .obj_size = sizeof(struct pppox_sock),
494 };
495
pppol2tp_backlog_recv(struct sock * sk,struct sk_buff * skb)496 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb)
497 {
498 int rc;
499
500 rc = l2tp_udp_encap_recv(sk, skb);
501 if (rc)
502 kfree_skb(skb);
503
504 return NET_RX_SUCCESS;
505 }
506
507 /* socket() handler. Initialize a new struct sock.
508 */
pppol2tp_create(struct net * net,struct socket * sock,int kern)509 static int pppol2tp_create(struct net *net, struct socket *sock, int kern)
510 {
511 int error = -ENOMEM;
512 struct sock *sk;
513
514 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern);
515 if (!sk)
516 goto out;
517
518 sock_init_data(sock, sk);
519
520 sock->state = SS_UNCONNECTED;
521 sock->ops = &pppol2tp_ops;
522
523 sk->sk_backlog_rcv = pppol2tp_backlog_recv;
524 sk->sk_protocol = PX_PROTO_OL2TP;
525 sk->sk_family = PF_PPPOX;
526 sk->sk_state = PPPOX_NONE;
527 sk->sk_type = SOCK_STREAM;
528 sk->sk_destruct = pppol2tp_session_destruct;
529
530 error = 0;
531
532 out:
533 return error;
534 }
535
pppol2tp_show(struct seq_file * m,void * arg)536 static void pppol2tp_show(struct seq_file *m, void *arg)
537 {
538 struct l2tp_session *session = arg;
539 struct sock *sk;
540
541 sk = pppol2tp_session_get_sock(session);
542 if (sk) {
543 struct pppox_sock *po = pppox_sk(sk);
544
545 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan));
546 sock_put(sk);
547 }
548 }
549
pppol2tp_session_init(struct l2tp_session * session)550 static void pppol2tp_session_init(struct l2tp_session *session)
551 {
552 struct pppol2tp_session *ps;
553
554 session->recv_skb = pppol2tp_recv;
555 if (IS_ENABLED(CONFIG_L2TP_DEBUGFS))
556 session->show = pppol2tp_show;
557
558 ps = l2tp_session_priv(session);
559 mutex_init(&ps->sk_lock);
560 ps->owner = current->pid;
561 }
562
563 struct l2tp_connect_info {
564 u8 version;
565 int fd;
566 u32 tunnel_id;
567 u32 peer_tunnel_id;
568 u32 session_id;
569 u32 peer_session_id;
570 };
571
pppol2tp_sockaddr_get_info(const void * sa,int sa_len,struct l2tp_connect_info * info)572 static int pppol2tp_sockaddr_get_info(const void *sa, int sa_len,
573 struct l2tp_connect_info *info)
574 {
575 switch (sa_len) {
576 case sizeof(struct sockaddr_pppol2tp):
577 {
578 const struct sockaddr_pppol2tp *sa_v2in4 = sa;
579
580 if (sa_v2in4->sa_protocol != PX_PROTO_OL2TP)
581 return -EINVAL;
582
583 info->version = 2;
584 info->fd = sa_v2in4->pppol2tp.fd;
585 info->tunnel_id = sa_v2in4->pppol2tp.s_tunnel;
586 info->peer_tunnel_id = sa_v2in4->pppol2tp.d_tunnel;
587 info->session_id = sa_v2in4->pppol2tp.s_session;
588 info->peer_session_id = sa_v2in4->pppol2tp.d_session;
589
590 break;
591 }
592 case sizeof(struct sockaddr_pppol2tpv3):
593 {
594 const struct sockaddr_pppol2tpv3 *sa_v3in4 = sa;
595
596 if (sa_v3in4->sa_protocol != PX_PROTO_OL2TP)
597 return -EINVAL;
598
599 info->version = 3;
600 info->fd = sa_v3in4->pppol2tp.fd;
601 info->tunnel_id = sa_v3in4->pppol2tp.s_tunnel;
602 info->peer_tunnel_id = sa_v3in4->pppol2tp.d_tunnel;
603 info->session_id = sa_v3in4->pppol2tp.s_session;
604 info->peer_session_id = sa_v3in4->pppol2tp.d_session;
605
606 break;
607 }
608 case sizeof(struct sockaddr_pppol2tpin6):
609 {
610 const struct sockaddr_pppol2tpin6 *sa_v2in6 = sa;
611
612 if (sa_v2in6->sa_protocol != PX_PROTO_OL2TP)
613 return -EINVAL;
614
615 info->version = 2;
616 info->fd = sa_v2in6->pppol2tp.fd;
617 info->tunnel_id = sa_v2in6->pppol2tp.s_tunnel;
618 info->peer_tunnel_id = sa_v2in6->pppol2tp.d_tunnel;
619 info->session_id = sa_v2in6->pppol2tp.s_session;
620 info->peer_session_id = sa_v2in6->pppol2tp.d_session;
621
622 break;
623 }
624 case sizeof(struct sockaddr_pppol2tpv3in6):
625 {
626 const struct sockaddr_pppol2tpv3in6 *sa_v3in6 = sa;
627
628 if (sa_v3in6->sa_protocol != PX_PROTO_OL2TP)
629 return -EINVAL;
630
631 info->version = 3;
632 info->fd = sa_v3in6->pppol2tp.fd;
633 info->tunnel_id = sa_v3in6->pppol2tp.s_tunnel;
634 info->peer_tunnel_id = sa_v3in6->pppol2tp.d_tunnel;
635 info->session_id = sa_v3in6->pppol2tp.s_session;
636 info->peer_session_id = sa_v3in6->pppol2tp.d_session;
637
638 break;
639 }
640 default:
641 return -EINVAL;
642 }
643
644 return 0;
645 }
646
647 /* Rough estimation of the maximum payload size a tunnel can transmit without
648 * fragmenting at the lower IP layer. Assumes L2TPv2 with sequence
649 * numbers and no IP option. Not quite accurate, but the result is mostly
650 * unused anyway.
651 */
pppol2tp_tunnel_mtu(const struct l2tp_tunnel * tunnel)652 static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel)
653 {
654 int mtu;
655
656 mtu = l2tp_tunnel_dst_mtu(tunnel);
657 if (mtu <= PPPOL2TP_HEADER_OVERHEAD)
658 return 1500 - PPPOL2TP_HEADER_OVERHEAD;
659
660 return mtu - PPPOL2TP_HEADER_OVERHEAD;
661 }
662
663 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
664 */
pppol2tp_connect(struct socket * sock,struct sockaddr * uservaddr,int sockaddr_len,int flags)665 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
666 int sockaddr_len, int flags)
667 {
668 struct sock *sk = sock->sk;
669 struct pppox_sock *po = pppox_sk(sk);
670 struct l2tp_session *session = NULL;
671 struct l2tp_connect_info info;
672 struct l2tp_tunnel *tunnel;
673 struct pppol2tp_session *ps;
674 struct l2tp_session_cfg cfg = { 0, };
675 bool drop_refcnt = false;
676 bool drop_tunnel = false;
677 bool new_session = false;
678 bool new_tunnel = false;
679 int error;
680
681 error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info);
682 if (error < 0)
683 return error;
684
685 lock_sock(sk);
686
687 /* Check for already bound sockets */
688 error = -EBUSY;
689 if (sk->sk_state & PPPOX_CONNECTED)
690 goto end;
691
692 /* We don't supporting rebinding anyway */
693 error = -EALREADY;
694 if (sk->sk_user_data)
695 goto end; /* socket is already attached */
696
697 /* Don't bind if tunnel_id is 0 */
698 error = -EINVAL;
699 if (!info.tunnel_id)
700 goto end;
701
702 tunnel = l2tp_tunnel_get(sock_net(sk), info.tunnel_id);
703 if (tunnel)
704 drop_tunnel = true;
705
706 /* Special case: create tunnel context if session_id and
707 * peer_session_id is 0. Otherwise look up tunnel using supplied
708 * tunnel id.
709 */
710 if (!info.session_id && !info.peer_session_id) {
711 if (tunnel == NULL) {
712 struct l2tp_tunnel_cfg tcfg = {
713 .encap = L2TP_ENCAPTYPE_UDP,
714 .debug = 0,
715 };
716
717 /* Prevent l2tp_tunnel_register() from trying to set up
718 * a kernel socket.
719 */
720 if (info.fd < 0) {
721 error = -EBADF;
722 goto end;
723 }
724
725 error = l2tp_tunnel_create(sock_net(sk), info.fd,
726 info.version,
727 info.tunnel_id,
728 info.peer_tunnel_id, &tcfg,
729 &tunnel);
730 if (error < 0)
731 goto end;
732
733 l2tp_tunnel_inc_refcount(tunnel);
734 error = l2tp_tunnel_register(tunnel, sock_net(sk),
735 &tcfg);
736 if (error < 0) {
737 kfree(tunnel);
738 goto end;
739 }
740 drop_tunnel = true;
741 new_tunnel = true;
742 }
743 } else {
744 /* Error if we can't find the tunnel */
745 error = -ENOENT;
746 if (tunnel == NULL)
747 goto end;
748
749 /* Error if socket is not prepped */
750 if (tunnel->sock == NULL)
751 goto end;
752 }
753
754 if (tunnel->peer_tunnel_id == 0)
755 tunnel->peer_tunnel_id = info.peer_tunnel_id;
756
757 session = l2tp_tunnel_get_session(tunnel, info.session_id);
758 if (session) {
759 drop_refcnt = true;
760
761 if (session->pwtype != L2TP_PWTYPE_PPP) {
762 error = -EPROTOTYPE;
763 goto end;
764 }
765
766 ps = l2tp_session_priv(session);
767
768 /* Using a pre-existing session is fine as long as it hasn't
769 * been connected yet.
770 */
771 mutex_lock(&ps->sk_lock);
772 if (rcu_dereference_protected(ps->sk,
773 lockdep_is_held(&ps->sk_lock)) ||
774 ps->__sk) {
775 mutex_unlock(&ps->sk_lock);
776 error = -EEXIST;
777 goto end;
778 }
779 } else {
780 cfg.pw_type = L2TP_PWTYPE_PPP;
781
782 session = l2tp_session_create(sizeof(struct pppol2tp_session),
783 tunnel, info.session_id,
784 info.peer_session_id, &cfg);
785 if (IS_ERR(session)) {
786 error = PTR_ERR(session);
787 goto end;
788 }
789
790 pppol2tp_session_init(session);
791 ps = l2tp_session_priv(session);
792 l2tp_session_inc_refcount(session);
793
794 mutex_lock(&ps->sk_lock);
795 error = l2tp_session_register(session, tunnel);
796 if (error < 0) {
797 mutex_unlock(&ps->sk_lock);
798 kfree(session);
799 goto end;
800 }
801 drop_refcnt = true;
802 new_session = true;
803 }
804
805 /* Special case: if source & dest session_id == 0x0000, this
806 * socket is being created to manage the tunnel. Just set up
807 * the internal context for use by ioctl() and sockopt()
808 * handlers.
809 */
810 if ((session->session_id == 0) &&
811 (session->peer_session_id == 0)) {
812 error = 0;
813 goto out_no_ppp;
814 }
815
816 /* The only header we need to worry about is the L2TP
817 * header. This size is different depending on whether
818 * sequence numbers are enabled for the data channel.
819 */
820 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
821
822 po->chan.private = sk;
823 po->chan.ops = &pppol2tp_chan_ops;
824 po->chan.mtu = pppol2tp_tunnel_mtu(tunnel);
825
826 error = ppp_register_net_channel(sock_net(sk), &po->chan);
827 if (error) {
828 mutex_unlock(&ps->sk_lock);
829 goto end;
830 }
831
832 out_no_ppp:
833 /* This is how we get the session context from the socket. */
834 sk->sk_user_data = session;
835 rcu_assign_pointer(ps->sk, sk);
836 mutex_unlock(&ps->sk_lock);
837
838 /* Keep the reference we've grabbed on the session: sk doesn't expect
839 * the session to disappear. pppol2tp_session_destruct() is responsible
840 * for dropping it.
841 */
842 drop_refcnt = false;
843
844 sk->sk_state = PPPOX_CONNECTED;
845 l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n",
846 session->name);
847
848 end:
849 if (error) {
850 if (new_session)
851 l2tp_session_delete(session);
852 if (new_tunnel)
853 l2tp_tunnel_delete(tunnel);
854 }
855 if (drop_refcnt)
856 l2tp_session_dec_refcount(session);
857 if (drop_tunnel)
858 l2tp_tunnel_dec_refcount(tunnel);
859 release_sock(sk);
860
861 return error;
862 }
863
864 #ifdef CONFIG_L2TP_V3
865
866 /* Called when creating sessions via the netlink interface. */
pppol2tp_session_create(struct net * net,struct l2tp_tunnel * tunnel,u32 session_id,u32 peer_session_id,struct l2tp_session_cfg * cfg)867 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel,
868 u32 session_id, u32 peer_session_id,
869 struct l2tp_session_cfg *cfg)
870 {
871 int error;
872 struct l2tp_session *session;
873
874 /* Error if tunnel socket is not prepped */
875 if (!tunnel->sock) {
876 error = -ENOENT;
877 goto err;
878 }
879
880 /* Allocate and initialize a new session context. */
881 session = l2tp_session_create(sizeof(struct pppol2tp_session),
882 tunnel, session_id,
883 peer_session_id, cfg);
884 if (IS_ERR(session)) {
885 error = PTR_ERR(session);
886 goto err;
887 }
888
889 pppol2tp_session_init(session);
890
891 error = l2tp_session_register(session, tunnel);
892 if (error < 0)
893 goto err_sess;
894
895 return 0;
896
897 err_sess:
898 kfree(session);
899 err:
900 return error;
901 }
902
903 #endif /* CONFIG_L2TP_V3 */
904
905 /* getname() support.
906 */
pppol2tp_getname(struct socket * sock,struct sockaddr * uaddr,int peer)907 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
908 int peer)
909 {
910 int len = 0;
911 int error = 0;
912 struct l2tp_session *session;
913 struct l2tp_tunnel *tunnel;
914 struct sock *sk = sock->sk;
915 struct inet_sock *inet;
916 struct pppol2tp_session *pls;
917
918 error = -ENOTCONN;
919 if (sk == NULL)
920 goto end;
921 if (!(sk->sk_state & PPPOX_CONNECTED))
922 goto end;
923
924 error = -EBADF;
925 session = pppol2tp_sock_to_session(sk);
926 if (session == NULL)
927 goto end;
928
929 pls = l2tp_session_priv(session);
930 tunnel = session->tunnel;
931
932 inet = inet_sk(tunnel->sock);
933 if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) {
934 struct sockaddr_pppol2tp sp;
935 len = sizeof(sp);
936 memset(&sp, 0, len);
937 sp.sa_family = AF_PPPOX;
938 sp.sa_protocol = PX_PROTO_OL2TP;
939 sp.pppol2tp.fd = tunnel->fd;
940 sp.pppol2tp.pid = pls->owner;
941 sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
942 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
943 sp.pppol2tp.s_session = session->session_id;
944 sp.pppol2tp.d_session = session->peer_session_id;
945 sp.pppol2tp.addr.sin_family = AF_INET;
946 sp.pppol2tp.addr.sin_port = inet->inet_dport;
947 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
948 memcpy(uaddr, &sp, len);
949 #if IS_ENABLED(CONFIG_IPV6)
950 } else if ((tunnel->version == 2) &&
951 (tunnel->sock->sk_family == AF_INET6)) {
952 struct sockaddr_pppol2tpin6 sp;
953
954 len = sizeof(sp);
955 memset(&sp, 0, len);
956 sp.sa_family = AF_PPPOX;
957 sp.sa_protocol = PX_PROTO_OL2TP;
958 sp.pppol2tp.fd = tunnel->fd;
959 sp.pppol2tp.pid = pls->owner;
960 sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
961 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
962 sp.pppol2tp.s_session = session->session_id;
963 sp.pppol2tp.d_session = session->peer_session_id;
964 sp.pppol2tp.addr.sin6_family = AF_INET6;
965 sp.pppol2tp.addr.sin6_port = inet->inet_dport;
966 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
967 sizeof(tunnel->sock->sk_v6_daddr));
968 memcpy(uaddr, &sp, len);
969 } else if ((tunnel->version == 3) &&
970 (tunnel->sock->sk_family == AF_INET6)) {
971 struct sockaddr_pppol2tpv3in6 sp;
972
973 len = sizeof(sp);
974 memset(&sp, 0, len);
975 sp.sa_family = AF_PPPOX;
976 sp.sa_protocol = PX_PROTO_OL2TP;
977 sp.pppol2tp.fd = tunnel->fd;
978 sp.pppol2tp.pid = pls->owner;
979 sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
980 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
981 sp.pppol2tp.s_session = session->session_id;
982 sp.pppol2tp.d_session = session->peer_session_id;
983 sp.pppol2tp.addr.sin6_family = AF_INET6;
984 sp.pppol2tp.addr.sin6_port = inet->inet_dport;
985 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
986 sizeof(tunnel->sock->sk_v6_daddr));
987 memcpy(uaddr, &sp, len);
988 #endif
989 } else if (tunnel->version == 3) {
990 struct sockaddr_pppol2tpv3 sp;
991 len = sizeof(sp);
992 memset(&sp, 0, len);
993 sp.sa_family = AF_PPPOX;
994 sp.sa_protocol = PX_PROTO_OL2TP;
995 sp.pppol2tp.fd = tunnel->fd;
996 sp.pppol2tp.pid = pls->owner;
997 sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
998 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
999 sp.pppol2tp.s_session = session->session_id;
1000 sp.pppol2tp.d_session = session->peer_session_id;
1001 sp.pppol2tp.addr.sin_family = AF_INET;
1002 sp.pppol2tp.addr.sin_port = inet->inet_dport;
1003 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
1004 memcpy(uaddr, &sp, len);
1005 }
1006
1007 error = len;
1008
1009 sock_put(sk);
1010 end:
1011 return error;
1012 }
1013
1014 /****************************************************************************
1015 * ioctl() handlers.
1016 *
1017 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
1018 * sockets. However, in order to control kernel tunnel features, we allow
1019 * userspace to create a special "tunnel" PPPoX socket which is used for
1020 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow
1021 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl()
1022 * calls.
1023 ****************************************************************************/
1024
pppol2tp_copy_stats(struct pppol2tp_ioc_stats * dest,const struct l2tp_stats * stats)1025 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest,
1026 const struct l2tp_stats *stats)
1027 {
1028 memset(dest, 0, sizeof(*dest));
1029
1030 dest->tx_packets = atomic_long_read(&stats->tx_packets);
1031 dest->tx_bytes = atomic_long_read(&stats->tx_bytes);
1032 dest->tx_errors = atomic_long_read(&stats->tx_errors);
1033 dest->rx_packets = atomic_long_read(&stats->rx_packets);
1034 dest->rx_bytes = atomic_long_read(&stats->rx_bytes);
1035 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards);
1036 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets);
1037 dest->rx_errors = atomic_long_read(&stats->rx_errors);
1038 }
1039
pppol2tp_tunnel_copy_stats(struct pppol2tp_ioc_stats * stats,struct l2tp_tunnel * tunnel)1040 static int pppol2tp_tunnel_copy_stats(struct pppol2tp_ioc_stats *stats,
1041 struct l2tp_tunnel *tunnel)
1042 {
1043 struct l2tp_session *session;
1044
1045 if (!stats->session_id) {
1046 pppol2tp_copy_stats(stats, &tunnel->stats);
1047 return 0;
1048 }
1049
1050 /* If session_id is set, search the corresponding session in the
1051 * context of this tunnel and record the session's statistics.
1052 */
1053 session = l2tp_tunnel_get_session(tunnel, stats->session_id);
1054 if (!session)
1055 return -EBADR;
1056
1057 if (session->pwtype != L2TP_PWTYPE_PPP) {
1058 l2tp_session_dec_refcount(session);
1059 return -EBADR;
1060 }
1061
1062 pppol2tp_copy_stats(stats, &session->stats);
1063 l2tp_session_dec_refcount(session);
1064
1065 return 0;
1066 }
1067
pppol2tp_ioctl(struct socket * sock,unsigned int cmd,unsigned long arg)1068 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
1069 unsigned long arg)
1070 {
1071 struct pppol2tp_ioc_stats stats;
1072 struct l2tp_session *session;
1073 int val;
1074
1075 switch (cmd) {
1076 case PPPIOCGMRU:
1077 case PPPIOCGFLAGS:
1078 session = sock->sk->sk_user_data;
1079 if (!session)
1080 return -ENOTCONN;
1081
1082 /* Not defined for tunnels */
1083 if (!session->session_id && !session->peer_session_id)
1084 return -ENOSYS;
1085
1086 if (put_user(0, (int __user *)arg))
1087 return -EFAULT;
1088 break;
1089
1090 case PPPIOCSMRU:
1091 case PPPIOCSFLAGS:
1092 session = sock->sk->sk_user_data;
1093 if (!session)
1094 return -ENOTCONN;
1095
1096 /* Not defined for tunnels */
1097 if (!session->session_id && !session->peer_session_id)
1098 return -ENOSYS;
1099
1100 if (get_user(val, (int __user *)arg))
1101 return -EFAULT;
1102 break;
1103
1104 case PPPIOCGL2TPSTATS:
1105 session = sock->sk->sk_user_data;
1106 if (!session)
1107 return -ENOTCONN;
1108
1109 /* Session 0 represents the parent tunnel */
1110 if (!session->session_id && !session->peer_session_id) {
1111 u32 session_id;
1112 int err;
1113
1114 if (copy_from_user(&stats, (void __user *)arg,
1115 sizeof(stats)))
1116 return -EFAULT;
1117
1118 session_id = stats.session_id;
1119 err = pppol2tp_tunnel_copy_stats(&stats,
1120 session->tunnel);
1121 if (err < 0)
1122 return err;
1123
1124 stats.session_id = session_id;
1125 } else {
1126 pppol2tp_copy_stats(&stats, &session->stats);
1127 stats.session_id = session->session_id;
1128 }
1129 stats.tunnel_id = session->tunnel->tunnel_id;
1130 stats.using_ipsec = l2tp_tunnel_uses_xfrm(session->tunnel);
1131
1132 if (copy_to_user((void __user *)arg, &stats, sizeof(stats)))
1133 return -EFAULT;
1134 break;
1135
1136 default:
1137 return -ENOIOCTLCMD;
1138 }
1139
1140 return 0;
1141 }
1142
1143 /*****************************************************************************
1144 * setsockopt() / getsockopt() support.
1145 *
1146 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
1147 * sockets. In order to control kernel tunnel features, we allow userspace to
1148 * create a special "tunnel" PPPoX socket which is used for control only.
1149 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user
1150 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls.
1151 *****************************************************************************/
1152
1153 /* Tunnel setsockopt() helper.
1154 */
pppol2tp_tunnel_setsockopt(struct sock * sk,struct l2tp_tunnel * tunnel,int optname,int val)1155 static int pppol2tp_tunnel_setsockopt(struct sock *sk,
1156 struct l2tp_tunnel *tunnel,
1157 int optname, int val)
1158 {
1159 int err = 0;
1160
1161 switch (optname) {
1162 case PPPOL2TP_SO_DEBUG:
1163 tunnel->debug = val;
1164 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: set debug=%x\n",
1165 tunnel->name, tunnel->debug);
1166 break;
1167
1168 default:
1169 err = -ENOPROTOOPT;
1170 break;
1171 }
1172
1173 return err;
1174 }
1175
1176 /* Session setsockopt helper.
1177 */
pppol2tp_session_setsockopt(struct sock * sk,struct l2tp_session * session,int optname,int val)1178 static int pppol2tp_session_setsockopt(struct sock *sk,
1179 struct l2tp_session *session,
1180 int optname, int val)
1181 {
1182 int err = 0;
1183
1184 switch (optname) {
1185 case PPPOL2TP_SO_RECVSEQ:
1186 if ((val != 0) && (val != 1)) {
1187 err = -EINVAL;
1188 break;
1189 }
1190 session->recv_seq = !!val;
1191 l2tp_info(session, L2TP_MSG_CONTROL,
1192 "%s: set recv_seq=%d\n",
1193 session->name, session->recv_seq);
1194 break;
1195
1196 case PPPOL2TP_SO_SENDSEQ:
1197 if ((val != 0) && (val != 1)) {
1198 err = -EINVAL;
1199 break;
1200 }
1201 session->send_seq = !!val;
1202 {
1203 struct pppox_sock *po = pppox_sk(sk);
1204
1205 po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
1206 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
1207 }
1208 l2tp_session_set_header_len(session, session->tunnel->version);
1209 l2tp_info(session, L2TP_MSG_CONTROL,
1210 "%s: set send_seq=%d\n",
1211 session->name, session->send_seq);
1212 break;
1213
1214 case PPPOL2TP_SO_LNSMODE:
1215 if ((val != 0) && (val != 1)) {
1216 err = -EINVAL;
1217 break;
1218 }
1219 session->lns_mode = !!val;
1220 l2tp_info(session, L2TP_MSG_CONTROL,
1221 "%s: set lns_mode=%d\n",
1222 session->name, session->lns_mode);
1223 break;
1224
1225 case PPPOL2TP_SO_DEBUG:
1226 session->debug = val;
1227 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set debug=%x\n",
1228 session->name, session->debug);
1229 break;
1230
1231 case PPPOL2TP_SO_REORDERTO:
1232 session->reorder_timeout = msecs_to_jiffies(val);
1233 l2tp_info(session, L2TP_MSG_CONTROL,
1234 "%s: set reorder_timeout=%d\n",
1235 session->name, session->reorder_timeout);
1236 break;
1237
1238 default:
1239 err = -ENOPROTOOPT;
1240 break;
1241 }
1242
1243 return err;
1244 }
1245
1246 /* Main setsockopt() entry point.
1247 * Does API checks, then calls either the tunnel or session setsockopt
1248 * handler, according to whether the PPPoL2TP socket is a for a regular
1249 * session or the special tunnel type.
1250 */
pppol2tp_setsockopt(struct socket * sock,int level,int optname,char __user * optval,unsigned int optlen)1251 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
1252 char __user *optval, unsigned int optlen)
1253 {
1254 struct sock *sk = sock->sk;
1255 struct l2tp_session *session;
1256 struct l2tp_tunnel *tunnel;
1257 int val;
1258 int err;
1259
1260 if (level != SOL_PPPOL2TP)
1261 return -EINVAL;
1262
1263 if (optlen < sizeof(int))
1264 return -EINVAL;
1265
1266 if (get_user(val, (int __user *)optval))
1267 return -EFAULT;
1268
1269 err = -ENOTCONN;
1270 if (sk->sk_user_data == NULL)
1271 goto end;
1272
1273 /* Get session context from the socket */
1274 err = -EBADF;
1275 session = pppol2tp_sock_to_session(sk);
1276 if (session == NULL)
1277 goto end;
1278
1279 /* Special case: if session_id == 0x0000, treat as operation on tunnel
1280 */
1281 if ((session->session_id == 0) &&
1282 (session->peer_session_id == 0)) {
1283 tunnel = session->tunnel;
1284 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
1285 } else {
1286 err = pppol2tp_session_setsockopt(sk, session, optname, val);
1287 }
1288
1289 sock_put(sk);
1290 end:
1291 return err;
1292 }
1293
1294 /* Tunnel getsockopt helper. Called with sock locked.
1295 */
pppol2tp_tunnel_getsockopt(struct sock * sk,struct l2tp_tunnel * tunnel,int optname,int * val)1296 static int pppol2tp_tunnel_getsockopt(struct sock *sk,
1297 struct l2tp_tunnel *tunnel,
1298 int optname, int *val)
1299 {
1300 int err = 0;
1301
1302 switch (optname) {
1303 case PPPOL2TP_SO_DEBUG:
1304 *val = tunnel->debug;
1305 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get debug=%x\n",
1306 tunnel->name, tunnel->debug);
1307 break;
1308
1309 default:
1310 err = -ENOPROTOOPT;
1311 break;
1312 }
1313
1314 return err;
1315 }
1316
1317 /* Session getsockopt helper. Called with sock locked.
1318 */
pppol2tp_session_getsockopt(struct sock * sk,struct l2tp_session * session,int optname,int * val)1319 static int pppol2tp_session_getsockopt(struct sock *sk,
1320 struct l2tp_session *session,
1321 int optname, int *val)
1322 {
1323 int err = 0;
1324
1325 switch (optname) {
1326 case PPPOL2TP_SO_RECVSEQ:
1327 *val = session->recv_seq;
1328 l2tp_info(session, L2TP_MSG_CONTROL,
1329 "%s: get recv_seq=%d\n", session->name, *val);
1330 break;
1331
1332 case PPPOL2TP_SO_SENDSEQ:
1333 *val = session->send_seq;
1334 l2tp_info(session, L2TP_MSG_CONTROL,
1335 "%s: get send_seq=%d\n", session->name, *val);
1336 break;
1337
1338 case PPPOL2TP_SO_LNSMODE:
1339 *val = session->lns_mode;
1340 l2tp_info(session, L2TP_MSG_CONTROL,
1341 "%s: get lns_mode=%d\n", session->name, *val);
1342 break;
1343
1344 case PPPOL2TP_SO_DEBUG:
1345 *val = session->debug;
1346 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get debug=%d\n",
1347 session->name, *val);
1348 break;
1349
1350 case PPPOL2TP_SO_REORDERTO:
1351 *val = (int) jiffies_to_msecs(session->reorder_timeout);
1352 l2tp_info(session, L2TP_MSG_CONTROL,
1353 "%s: get reorder_timeout=%d\n", session->name, *val);
1354 break;
1355
1356 default:
1357 err = -ENOPROTOOPT;
1358 }
1359
1360 return err;
1361 }
1362
1363 /* Main getsockopt() entry point.
1364 * Does API checks, then calls either the tunnel or session getsockopt
1365 * handler, according to whether the PPPoX socket is a for a regular session
1366 * or the special tunnel type.
1367 */
pppol2tp_getsockopt(struct socket * sock,int level,int optname,char __user * optval,int __user * optlen)1368 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
1369 char __user *optval, int __user *optlen)
1370 {
1371 struct sock *sk = sock->sk;
1372 struct l2tp_session *session;
1373 struct l2tp_tunnel *tunnel;
1374 int val, len;
1375 int err;
1376
1377 if (level != SOL_PPPOL2TP)
1378 return -EINVAL;
1379
1380 if (get_user(len, optlen))
1381 return -EFAULT;
1382
1383 len = min_t(unsigned int, len, sizeof(int));
1384
1385 if (len < 0)
1386 return -EINVAL;
1387
1388 err = -ENOTCONN;
1389 if (sk->sk_user_data == NULL)
1390 goto end;
1391
1392 /* Get the session context */
1393 err = -EBADF;
1394 session = pppol2tp_sock_to_session(sk);
1395 if (session == NULL)
1396 goto end;
1397
1398 /* Special case: if session_id == 0x0000, treat as operation on tunnel */
1399 if ((session->session_id == 0) &&
1400 (session->peer_session_id == 0)) {
1401 tunnel = session->tunnel;
1402 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
1403 if (err)
1404 goto end_put_sess;
1405 } else {
1406 err = pppol2tp_session_getsockopt(sk, session, optname, &val);
1407 if (err)
1408 goto end_put_sess;
1409 }
1410
1411 err = -EFAULT;
1412 if (put_user(len, optlen))
1413 goto end_put_sess;
1414
1415 if (copy_to_user((void __user *) optval, &val, len))
1416 goto end_put_sess;
1417
1418 err = 0;
1419
1420 end_put_sess:
1421 sock_put(sk);
1422 end:
1423 return err;
1424 }
1425
1426 /*****************************************************************************
1427 * /proc filesystem for debug
1428 * Since the original pppol2tp driver provided /proc/net/pppol2tp for
1429 * L2TPv2, we dump only L2TPv2 tunnels and sessions here.
1430 *****************************************************************************/
1431
1432 static unsigned int pppol2tp_net_id;
1433
1434 #ifdef CONFIG_PROC_FS
1435
1436 struct pppol2tp_seq_data {
1437 struct seq_net_private p;
1438 int tunnel_idx; /* current tunnel */
1439 int session_idx; /* index of session within current tunnel */
1440 struct l2tp_tunnel *tunnel;
1441 struct l2tp_session *session; /* NULL means get next tunnel */
1442 };
1443
pppol2tp_next_tunnel(struct net * net,struct pppol2tp_seq_data * pd)1444 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
1445 {
1446 /* Drop reference taken during previous invocation */
1447 if (pd->tunnel)
1448 l2tp_tunnel_dec_refcount(pd->tunnel);
1449
1450 for (;;) {
1451 pd->tunnel = l2tp_tunnel_get_nth(net, pd->tunnel_idx);
1452 pd->tunnel_idx++;
1453
1454 /* Only accept L2TPv2 tunnels */
1455 if (!pd->tunnel || pd->tunnel->version == 2)
1456 return;
1457
1458 l2tp_tunnel_dec_refcount(pd->tunnel);
1459 }
1460 }
1461
pppol2tp_next_session(struct net * net,struct pppol2tp_seq_data * pd)1462 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
1463 {
1464 /* Drop reference taken during previous invocation */
1465 if (pd->session)
1466 l2tp_session_dec_refcount(pd->session);
1467
1468 pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx);
1469 pd->session_idx++;
1470
1471 if (pd->session == NULL) {
1472 pd->session_idx = 0;
1473 pppol2tp_next_tunnel(net, pd);
1474 }
1475 }
1476
pppol2tp_seq_start(struct seq_file * m,loff_t * offs)1477 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs)
1478 {
1479 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN;
1480 loff_t pos = *offs;
1481 struct net *net;
1482
1483 if (!pos)
1484 goto out;
1485
1486 BUG_ON(m->private == NULL);
1487 pd = m->private;
1488 net = seq_file_net(m);
1489
1490 if (pd->tunnel == NULL)
1491 pppol2tp_next_tunnel(net, pd);
1492 else
1493 pppol2tp_next_session(net, pd);
1494
1495 /* NULL tunnel and session indicates end of list */
1496 if ((pd->tunnel == NULL) && (pd->session == NULL))
1497 pd = NULL;
1498
1499 out:
1500 return pd;
1501 }
1502
pppol2tp_seq_next(struct seq_file * m,void * v,loff_t * pos)1503 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos)
1504 {
1505 (*pos)++;
1506 return NULL;
1507 }
1508
pppol2tp_seq_stop(struct seq_file * p,void * v)1509 static void pppol2tp_seq_stop(struct seq_file *p, void *v)
1510 {
1511 struct pppol2tp_seq_data *pd = v;
1512
1513 if (!pd || pd == SEQ_START_TOKEN)
1514 return;
1515
1516 /* Drop reference taken by last invocation of pppol2tp_next_session()
1517 * or pppol2tp_next_tunnel().
1518 */
1519 if (pd->session) {
1520 l2tp_session_dec_refcount(pd->session);
1521 pd->session = NULL;
1522 }
1523 if (pd->tunnel) {
1524 l2tp_tunnel_dec_refcount(pd->tunnel);
1525 pd->tunnel = NULL;
1526 }
1527 }
1528
pppol2tp_seq_tunnel_show(struct seq_file * m,void * v)1529 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
1530 {
1531 struct l2tp_tunnel *tunnel = v;
1532
1533 seq_printf(m, "\nTUNNEL '%s', %c %d\n",
1534 tunnel->name,
1535 (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N',
1536 refcount_read(&tunnel->ref_count) - 1);
1537 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n",
1538 tunnel->debug,
1539 atomic_long_read(&tunnel->stats.tx_packets),
1540 atomic_long_read(&tunnel->stats.tx_bytes),
1541 atomic_long_read(&tunnel->stats.tx_errors),
1542 atomic_long_read(&tunnel->stats.rx_packets),
1543 atomic_long_read(&tunnel->stats.rx_bytes),
1544 atomic_long_read(&tunnel->stats.rx_errors));
1545 }
1546
pppol2tp_seq_session_show(struct seq_file * m,void * v)1547 static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
1548 {
1549 struct l2tp_session *session = v;
1550 struct l2tp_tunnel *tunnel = session->tunnel;
1551 unsigned char state;
1552 char user_data_ok;
1553 struct sock *sk;
1554 u32 ip = 0;
1555 u16 port = 0;
1556
1557 if (tunnel->sock) {
1558 struct inet_sock *inet = inet_sk(tunnel->sock);
1559 ip = ntohl(inet->inet_saddr);
1560 port = ntohs(inet->inet_sport);
1561 }
1562
1563 sk = pppol2tp_session_get_sock(session);
1564 if (sk) {
1565 state = sk->sk_state;
1566 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N';
1567 } else {
1568 state = 0;
1569 user_data_ok = 'N';
1570 }
1571
1572 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> "
1573 "%04X/%04X %d %c\n",
1574 session->name, ip, port,
1575 tunnel->tunnel_id,
1576 session->session_id,
1577 tunnel->peer_tunnel_id,
1578 session->peer_session_id,
1579 state, user_data_ok);
1580 seq_printf(m, " 0/0/%c/%c/%s %08x %u\n",
1581 session->recv_seq ? 'R' : '-',
1582 session->send_seq ? 'S' : '-',
1583 session->lns_mode ? "LNS" : "LAC",
1584 session->debug,
1585 jiffies_to_msecs(session->reorder_timeout));
1586 seq_printf(m, " %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n",
1587 session->nr, session->ns,
1588 atomic_long_read(&session->stats.tx_packets),
1589 atomic_long_read(&session->stats.tx_bytes),
1590 atomic_long_read(&session->stats.tx_errors),
1591 atomic_long_read(&session->stats.rx_packets),
1592 atomic_long_read(&session->stats.rx_bytes),
1593 atomic_long_read(&session->stats.rx_errors));
1594
1595 if (sk) {
1596 struct pppox_sock *po = pppox_sk(sk);
1597
1598 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan));
1599 sock_put(sk);
1600 }
1601 }
1602
pppol2tp_seq_show(struct seq_file * m,void * v)1603 static int pppol2tp_seq_show(struct seq_file *m, void *v)
1604 {
1605 struct pppol2tp_seq_data *pd = v;
1606
1607 /* display header on line 1 */
1608 if (v == SEQ_START_TOKEN) {
1609 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n");
1610 seq_puts(m, "TUNNEL name, user-data-ok session-count\n");
1611 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1612 seq_puts(m, " SESSION name, addr/port src-tid/sid "
1613 "dest-tid/sid state user-data-ok\n");
1614 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n");
1615 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1616 goto out;
1617 }
1618
1619 if (!pd->session)
1620 pppol2tp_seq_tunnel_show(m, pd->tunnel);
1621 else
1622 pppol2tp_seq_session_show(m, pd->session);
1623
1624 out:
1625 return 0;
1626 }
1627
1628 static const struct seq_operations pppol2tp_seq_ops = {
1629 .start = pppol2tp_seq_start,
1630 .next = pppol2tp_seq_next,
1631 .stop = pppol2tp_seq_stop,
1632 .show = pppol2tp_seq_show,
1633 };
1634 #endif /* CONFIG_PROC_FS */
1635
1636 /*****************************************************************************
1637 * Network namespace
1638 *****************************************************************************/
1639
pppol2tp_init_net(struct net * net)1640 static __net_init int pppol2tp_init_net(struct net *net)
1641 {
1642 struct proc_dir_entry *pde;
1643 int err = 0;
1644
1645 pde = proc_create_net("pppol2tp", 0444, net->proc_net,
1646 &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data));
1647 if (!pde) {
1648 err = -ENOMEM;
1649 goto out;
1650 }
1651
1652 out:
1653 return err;
1654 }
1655
pppol2tp_exit_net(struct net * net)1656 static __net_exit void pppol2tp_exit_net(struct net *net)
1657 {
1658 remove_proc_entry("pppol2tp", net->proc_net);
1659 }
1660
1661 static struct pernet_operations pppol2tp_net_ops = {
1662 .init = pppol2tp_init_net,
1663 .exit = pppol2tp_exit_net,
1664 .id = &pppol2tp_net_id,
1665 };
1666
1667 /*****************************************************************************
1668 * Init and cleanup
1669 *****************************************************************************/
1670
1671 static const struct proto_ops pppol2tp_ops = {
1672 .family = AF_PPPOX,
1673 .owner = THIS_MODULE,
1674 .release = pppol2tp_release,
1675 .bind = sock_no_bind,
1676 .connect = pppol2tp_connect,
1677 .socketpair = sock_no_socketpair,
1678 .accept = sock_no_accept,
1679 .getname = pppol2tp_getname,
1680 .poll = datagram_poll,
1681 .listen = sock_no_listen,
1682 .shutdown = sock_no_shutdown,
1683 .setsockopt = pppol2tp_setsockopt,
1684 .getsockopt = pppol2tp_getsockopt,
1685 .sendmsg = pppol2tp_sendmsg,
1686 .recvmsg = pppol2tp_recvmsg,
1687 .mmap = sock_no_mmap,
1688 .ioctl = pppox_ioctl,
1689 };
1690
1691 static const struct pppox_proto pppol2tp_proto = {
1692 .create = pppol2tp_create,
1693 .ioctl = pppol2tp_ioctl,
1694 .owner = THIS_MODULE,
1695 };
1696
1697 #ifdef CONFIG_L2TP_V3
1698
1699 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = {
1700 .session_create = pppol2tp_session_create,
1701 .session_delete = l2tp_session_delete,
1702 };
1703
1704 #endif /* CONFIG_L2TP_V3 */
1705
pppol2tp_init(void)1706 static int __init pppol2tp_init(void)
1707 {
1708 int err;
1709
1710 err = register_pernet_device(&pppol2tp_net_ops);
1711 if (err)
1712 goto out;
1713
1714 err = proto_register(&pppol2tp_sk_proto, 0);
1715 if (err)
1716 goto out_unregister_pppol2tp_pernet;
1717
1718 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto);
1719 if (err)
1720 goto out_unregister_pppol2tp_proto;
1721
1722 #ifdef CONFIG_L2TP_V3
1723 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops);
1724 if (err)
1725 goto out_unregister_pppox;
1726 #endif
1727
1728 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION);
1729
1730 out:
1731 return err;
1732
1733 #ifdef CONFIG_L2TP_V3
1734 out_unregister_pppox:
1735 unregister_pppox_proto(PX_PROTO_OL2TP);
1736 #endif
1737 out_unregister_pppol2tp_proto:
1738 proto_unregister(&pppol2tp_sk_proto);
1739 out_unregister_pppol2tp_pernet:
1740 unregister_pernet_device(&pppol2tp_net_ops);
1741 goto out;
1742 }
1743
pppol2tp_exit(void)1744 static void __exit pppol2tp_exit(void)
1745 {
1746 #ifdef CONFIG_L2TP_V3
1747 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP);
1748 #endif
1749 unregister_pppox_proto(PX_PROTO_OL2TP);
1750 proto_unregister(&pppol2tp_sk_proto);
1751 unregister_pernet_device(&pppol2tp_net_ops);
1752 }
1753
1754 module_init(pppol2tp_init);
1755 module_exit(pppol2tp_exit);
1756
1757 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1758 MODULE_DESCRIPTION("PPP over L2TP over UDP");
1759 MODULE_LICENSE("GPL");
1760 MODULE_VERSION(PPPOL2TP_DRV_VERSION);
1761 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP);
1762 MODULE_ALIAS_L2TP_PWTYPE(7);
1763
