l2tp_core.c 45 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /* L2TP core.
  3. *
  4. * Copyright (c) 2008,2009,2010 Katalix Systems Ltd
  5. *
  6. * This file contains some code of the original L2TPv2 pppol2tp
  7. * driver, which has the following copyright:
  8. *
  9. * Authors: Martijn van Oosterhout <kleptog@svana.org>
  10. * James Chapman (jchapman@katalix.com)
  11. * Contributors:
  12. * Michal Ostrowski <mostrows@speakeasy.net>
  13. * Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
  14. * David S. Miller (davem@redhat.com)
  15. */
  16. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  17. #include <linux/module.h>
  18. #include <linux/string.h>
  19. #include <linux/list.h>
  20. #include <linux/rculist.h>
  21. #include <linux/uaccess.h>
  22. #include <linux/kernel.h>
  23. #include <linux/spinlock.h>
  24. #include <linux/kthread.h>
  25. #include <linux/sched.h>
  26. #include <linux/slab.h>
  27. #include <linux/errno.h>
  28. #include <linux/jiffies.h>
  29. #include <linux/netdevice.h>
  30. #include <linux/net.h>
  31. #include <linux/inetdevice.h>
  32. #include <linux/skbuff.h>
  33. #include <linux/init.h>
  34. #include <linux/in.h>
  35. #include <linux/ip.h>
  36. #include <linux/udp.h>
  37. #include <linux/l2tp.h>
  38. #include <linux/hash.h>
  39. #include <linux/sort.h>
  40. #include <linux/file.h>
  41. #include <linux/nsproxy.h>
  42. #include <net/net_namespace.h>
  43. #include <net/netns/generic.h>
  44. #include <net/dst.h>
  45. #include <net/ip.h>
  46. #include <net/udp.h>
  47. #include <net/udp_tunnel.h>
  48. #include <net/inet_common.h>
  49. #include <net/xfrm.h>
  50. #include <net/protocol.h>
  51. #include <net/inet6_connection_sock.h>
  52. #include <net/inet_ecn.h>
  53. #include <net/ip6_route.h>
  54. #include <net/ip6_checksum.h>
  55. #include <asm/byteorder.h>
  56. #include <linux/atomic.h>
  57. #include "l2tp_core.h"
  58. #include "trace.h"
  59. #define CREATE_TRACE_POINTS
  60. #include "trace.h"
  61. #define L2TP_DRV_VERSION "V2.0"
  62. /* L2TP header constants */
  63. #define L2TP_HDRFLAG_T 0x8000
  64. #define L2TP_HDRFLAG_L 0x4000
  65. #define L2TP_HDRFLAG_S 0x0800
  66. #define L2TP_HDRFLAG_O 0x0200
  67. #define L2TP_HDRFLAG_P 0x0100
  68. #define L2TP_HDR_VER_MASK 0x000F
  69. #define L2TP_HDR_VER_2 0x0002
  70. #define L2TP_HDR_VER_3 0x0003
  71. /* L2TPv3 default L2-specific sublayer */
  72. #define L2TP_SLFLAG_S 0x40000000
  73. #define L2TP_SL_SEQ_MASK 0x00ffffff
  74. #define L2TP_HDR_SIZE_MAX 14
  75. /* Default trace flags */
  76. #define L2TP_DEFAULT_DEBUG_FLAGS 0
  77. /* Private data stored for received packets in the skb.
  78. */
  79. struct l2tp_skb_cb {
  80. u32 ns;
  81. u16 has_seq;
  82. u16 length;
  83. unsigned long expires;
  84. };
  85. #define L2TP_SKB_CB(skb) ((struct l2tp_skb_cb *)&(skb)->cb[sizeof(struct inet_skb_parm)])
  86. static struct workqueue_struct *l2tp_wq;
  87. /* per-net private data for this module */
  88. static unsigned int l2tp_net_id;
  89. struct l2tp_net {
  90. struct list_head l2tp_tunnel_list;
  91. /* Lock for write access to l2tp_tunnel_list */
  92. spinlock_t l2tp_tunnel_list_lock;
  93. struct hlist_head l2tp_session_hlist[L2TP_HASH_SIZE_2];
  94. /* Lock for write access to l2tp_session_hlist */
  95. spinlock_t l2tp_session_hlist_lock;
  96. };
  97. #if IS_ENABLED(CONFIG_IPV6)
  98. static bool l2tp_sk_is_v6(struct sock *sk)
  99. {
  100. return sk->sk_family == PF_INET6 &&
  101. !ipv6_addr_v4mapped(&sk->sk_v6_daddr);
  102. }
  103. #endif
  104. static inline struct l2tp_net *l2tp_pernet(const struct net *net)
  105. {
  106. return net_generic(net, l2tp_net_id);
  107. }
  108. /* Session hash global list for L2TPv3.
  109. * The session_id SHOULD be random according to RFC3931, but several
  110. * L2TP implementations use incrementing session_ids. So we do a real
  111. * hash on the session_id, rather than a simple bitmask.
  112. */
  113. static inline struct hlist_head *
  114. l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
  115. {
  116. return &pn->l2tp_session_hlist[hash_32(session_id, L2TP_HASH_BITS_2)];
  117. }
  118. /* Session hash list.
  119. * The session_id SHOULD be random according to RFC2661, but several
  120. * L2TP implementations (Cisco and Microsoft) use incrementing
  121. * session_ids. So we do a real hash on the session_id, rather than a
  122. * simple bitmask.
  123. */
  124. static inline struct hlist_head *
  125. l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id)
  126. {
  127. return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)];
  128. }
  129. static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
  130. {
  131. trace_free_tunnel(tunnel);
  132. sock_put(tunnel->sock);
  133. /* the tunnel is freed in the socket destructor */
  134. }
  135. static void l2tp_session_free(struct l2tp_session *session)
  136. {
  137. trace_free_session(session);
  138. if (session->tunnel)
  139. l2tp_tunnel_dec_refcount(session->tunnel);
  140. kfree(session);
  141. }
  142. struct l2tp_tunnel *l2tp_sk_to_tunnel(struct sock *sk)
  143. {
  144. struct l2tp_tunnel *tunnel = sk->sk_user_data;
  145. if (tunnel)
  146. if (WARN_ON(tunnel->magic != L2TP_TUNNEL_MAGIC))
  147. return NULL;
  148. return tunnel;
  149. }
  150. EXPORT_SYMBOL_GPL(l2tp_sk_to_tunnel);
  151. void l2tp_tunnel_inc_refcount(struct l2tp_tunnel *tunnel)
  152. {
  153. refcount_inc(&tunnel->ref_count);
  154. }
  155. EXPORT_SYMBOL_GPL(l2tp_tunnel_inc_refcount);
  156. void l2tp_tunnel_dec_refcount(struct l2tp_tunnel *tunnel)
  157. {
  158. if (refcount_dec_and_test(&tunnel->ref_count))
  159. l2tp_tunnel_free(tunnel);
  160. }
  161. EXPORT_SYMBOL_GPL(l2tp_tunnel_dec_refcount);
  162. void l2tp_session_inc_refcount(struct l2tp_session *session)
  163. {
  164. refcount_inc(&session->ref_count);
  165. }
  166. EXPORT_SYMBOL_GPL(l2tp_session_inc_refcount);
  167. void l2tp_session_dec_refcount(struct l2tp_session *session)
  168. {
  169. if (refcount_dec_and_test(&session->ref_count))
  170. l2tp_session_free(session);
  171. }
  172. EXPORT_SYMBOL_GPL(l2tp_session_dec_refcount);
  173. /* Lookup a tunnel. A new reference is held on the returned tunnel. */
  174. struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id)
  175. {
  176. const struct l2tp_net *pn = l2tp_pernet(net);
  177. struct l2tp_tunnel *tunnel;
  178. rcu_read_lock_bh();
  179. list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
  180. if (tunnel->tunnel_id == tunnel_id &&
  181. refcount_inc_not_zero(&tunnel->ref_count)) {
  182. rcu_read_unlock_bh();
  183. return tunnel;
  184. }
  185. }
  186. rcu_read_unlock_bh();
  187. return NULL;
  188. }
  189. EXPORT_SYMBOL_GPL(l2tp_tunnel_get);
  190. struct l2tp_tunnel *l2tp_tunnel_get_nth(const struct net *net, int nth)
  191. {
  192. const struct l2tp_net *pn = l2tp_pernet(net);
  193. struct l2tp_tunnel *tunnel;
  194. int count = 0;
  195. rcu_read_lock_bh();
  196. list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
  197. if (++count > nth &&
  198. refcount_inc_not_zero(&tunnel->ref_count)) {
  199. rcu_read_unlock_bh();
  200. return tunnel;
  201. }
  202. }
  203. rcu_read_unlock_bh();
  204. return NULL;
  205. }
  206. EXPORT_SYMBOL_GPL(l2tp_tunnel_get_nth);
  207. struct l2tp_session *l2tp_tunnel_get_session(struct l2tp_tunnel *tunnel,
  208. u32 session_id)
  209. {
  210. struct hlist_head *session_list;
  211. struct l2tp_session *session;
  212. session_list = l2tp_session_id_hash(tunnel, session_id);
  213. read_lock_bh(&tunnel->hlist_lock);
  214. hlist_for_each_entry(session, session_list, hlist)
  215. if (session->session_id == session_id) {
  216. l2tp_session_inc_refcount(session);
  217. read_unlock_bh(&tunnel->hlist_lock);
  218. return session;
  219. }
  220. read_unlock_bh(&tunnel->hlist_lock);
  221. return NULL;
  222. }
  223. EXPORT_SYMBOL_GPL(l2tp_tunnel_get_session);
  224. struct l2tp_session *l2tp_session_get(const struct net *net, u32 session_id)
  225. {
  226. struct hlist_head *session_list;
  227. struct l2tp_session *session;
  228. session_list = l2tp_session_id_hash_2(l2tp_pernet(net), session_id);
  229. rcu_read_lock_bh();
  230. hlist_for_each_entry_rcu(session, session_list, global_hlist)
  231. if (session->session_id == session_id) {
  232. l2tp_session_inc_refcount(session);
  233. rcu_read_unlock_bh();
  234. return session;
  235. }
  236. rcu_read_unlock_bh();
  237. return NULL;
  238. }
  239. EXPORT_SYMBOL_GPL(l2tp_session_get);
  240. struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth)
  241. {
  242. int hash;
  243. struct l2tp_session *session;
  244. int count = 0;
  245. read_lock_bh(&tunnel->hlist_lock);
  246. for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
  247. hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {
  248. if (++count > nth) {
  249. l2tp_session_inc_refcount(session);
  250. read_unlock_bh(&tunnel->hlist_lock);
  251. return session;
  252. }
  253. }
  254. }
  255. read_unlock_bh(&tunnel->hlist_lock);
  256. return NULL;
  257. }
  258. EXPORT_SYMBOL_GPL(l2tp_session_get_nth);
  259. /* Lookup a session by interface name.
  260. * This is very inefficient but is only used by management interfaces.
  261. */
  262. struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
  263. const char *ifname)
  264. {
  265. struct l2tp_net *pn = l2tp_pernet(net);
  266. int hash;
  267. struct l2tp_session *session;
  268. rcu_read_lock_bh();
  269. for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) {
  270. hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {
  271. if (!strcmp(session->ifname, ifname)) {
  272. l2tp_session_inc_refcount(session);
  273. rcu_read_unlock_bh();
  274. return session;
  275. }
  276. }
  277. }
  278. rcu_read_unlock_bh();
  279. return NULL;
  280. }
  281. EXPORT_SYMBOL_GPL(l2tp_session_get_by_ifname);
  282. int l2tp_session_register(struct l2tp_session *session,
  283. struct l2tp_tunnel *tunnel)
  284. {
  285. struct l2tp_session *session_walk;
  286. struct hlist_head *g_head;
  287. struct hlist_head *head;
  288. struct l2tp_net *pn;
  289. int err;
  290. head = l2tp_session_id_hash(tunnel, session->session_id);
  291. write_lock_bh(&tunnel->hlist_lock);
  292. if (!tunnel->acpt_newsess) {
  293. err = -ENODEV;
  294. goto err_tlock;
  295. }
  296. hlist_for_each_entry(session_walk, head, hlist)
  297. if (session_walk->session_id == session->session_id) {
  298. err = -EEXIST;
  299. goto err_tlock;
  300. }
  301. if (tunnel->version == L2TP_HDR_VER_3) {
  302. pn = l2tp_pernet(tunnel->l2tp_net);
  303. g_head = l2tp_session_id_hash_2(pn, session->session_id);
  304. spin_lock_bh(&pn->l2tp_session_hlist_lock);
  305. /* IP encap expects session IDs to be globally unique, while
  306. * UDP encap doesn't.
  307. */
  308. hlist_for_each_entry(session_walk, g_head, global_hlist)
  309. if (session_walk->session_id == session->session_id &&
  310. (session_walk->tunnel->encap == L2TP_ENCAPTYPE_IP ||
  311. tunnel->encap == L2TP_ENCAPTYPE_IP)) {
  312. err = -EEXIST;
  313. goto err_tlock_pnlock;
  314. }
  315. l2tp_tunnel_inc_refcount(tunnel);
  316. hlist_add_head_rcu(&session->global_hlist, g_head);
  317. spin_unlock_bh(&pn->l2tp_session_hlist_lock);
  318. } else {
  319. l2tp_tunnel_inc_refcount(tunnel);
  320. }
  321. hlist_add_head(&session->hlist, head);
  322. write_unlock_bh(&tunnel->hlist_lock);
  323. trace_register_session(session);
  324. return 0;
  325. err_tlock_pnlock:
  326. spin_unlock_bh(&pn->l2tp_session_hlist_lock);
  327. err_tlock:
  328. write_unlock_bh(&tunnel->hlist_lock);
  329. return err;
  330. }
  331. EXPORT_SYMBOL_GPL(l2tp_session_register);
  332. /*****************************************************************************
  333. * Receive data handling
  334. *****************************************************************************/
  335. /* Queue a skb in order. We come here only if the skb has an L2TP sequence
  336. * number.
  337. */
  338. static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)
  339. {
  340. struct sk_buff *skbp;
  341. struct sk_buff *tmp;
  342. u32 ns = L2TP_SKB_CB(skb)->ns;
  343. spin_lock_bh(&session->reorder_q.lock);
  344. skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
  345. if (L2TP_SKB_CB(skbp)->ns > ns) {
  346. __skb_queue_before(&session->reorder_q, skbp, skb);
  347. atomic_long_inc(&session->stats.rx_oos_packets);
  348. goto out;
  349. }
  350. }
  351. __skb_queue_tail(&session->reorder_q, skb);
  352. out:
  353. spin_unlock_bh(&session->reorder_q.lock);
  354. }
  355. /* Dequeue a single skb.
  356. */
  357. static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)
  358. {
  359. struct l2tp_tunnel *tunnel = session->tunnel;
  360. int length = L2TP_SKB_CB(skb)->length;
  361. /* We're about to requeue the skb, so return resources
  362. * to its current owner (a socket receive buffer).
  363. */
  364. skb_orphan(skb);
  365. atomic_long_inc(&tunnel->stats.rx_packets);
  366. atomic_long_add(length, &tunnel->stats.rx_bytes);
  367. atomic_long_inc(&session->stats.rx_packets);
  368. atomic_long_add(length, &session->stats.rx_bytes);
  369. if (L2TP_SKB_CB(skb)->has_seq) {
  370. /* Bump our Nr */
  371. session->nr++;
  372. session->nr &= session->nr_max;
  373. trace_session_seqnum_update(session);
  374. }
  375. /* call private receive handler */
  376. if (session->recv_skb)
  377. (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);
  378. else
  379. kfree_skb(skb);
  380. }
  381. /* Dequeue skbs from the session's reorder_q, subject to packet order.
  382. * Skbs that have been in the queue for too long are simply discarded.
  383. */
  384. static void l2tp_recv_dequeue(struct l2tp_session *session)
  385. {
  386. struct sk_buff *skb;
  387. struct sk_buff *tmp;
  388. /* If the pkt at the head of the queue has the nr that we
  389. * expect to send up next, dequeue it and any other
  390. * in-sequence packets behind it.
  391. */
  392. start:
  393. spin_lock_bh(&session->reorder_q.lock);
  394. skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
  395. struct l2tp_skb_cb *cb = L2TP_SKB_CB(skb);
  396. /* If the packet has been pending on the queue for too long, discard it */
  397. if (time_after(jiffies, cb->expires)) {
  398. atomic_long_inc(&session->stats.rx_seq_discards);
  399. atomic_long_inc(&session->stats.rx_errors);
  400. trace_session_pkt_expired(session, cb->ns);
  401. session->reorder_skip = 1;
  402. __skb_unlink(skb, &session->reorder_q);
  403. kfree_skb(skb);
  404. continue;
  405. }
  406. if (cb->has_seq) {
  407. if (session->reorder_skip) {
  408. session->reorder_skip = 0;
  409. session->nr = cb->ns;
  410. trace_session_seqnum_reset(session);
  411. }
  412. if (cb->ns != session->nr)
  413. goto out;
  414. }
  415. __skb_unlink(skb, &session->reorder_q);
  416. /* Process the skb. We release the queue lock while we
  417. * do so to let other contexts process the queue.
  418. */
  419. spin_unlock_bh(&session->reorder_q.lock);
  420. l2tp_recv_dequeue_skb(session, skb);
  421. goto start;
  422. }
  423. out:
  424. spin_unlock_bh(&session->reorder_q.lock);
  425. }
  426. static int l2tp_seq_check_rx_window(struct l2tp_session *session, u32 nr)
  427. {
  428. u32 nws;
  429. if (nr >= session->nr)
  430. nws = nr - session->nr;
  431. else
  432. nws = (session->nr_max + 1) - (session->nr - nr);
  433. return nws < session->nr_window_size;
  434. }
  435. /* If packet has sequence numbers, queue it if acceptable. Returns 0 if
  436. * acceptable, else non-zero.
  437. */
  438. static int l2tp_recv_data_seq(struct l2tp_session *session, struct sk_buff *skb)
  439. {
  440. struct l2tp_skb_cb *cb = L2TP_SKB_CB(skb);
  441. if (!l2tp_seq_check_rx_window(session, cb->ns)) {
  442. /* Packet sequence number is outside allowed window.
  443. * Discard it.
  444. */
  445. trace_session_pkt_outside_rx_window(session, cb->ns);
  446. goto discard;
  447. }
  448. if (session->reorder_timeout != 0) {
  449. /* Packet reordering enabled. Add skb to session's
  450. * reorder queue, in order of ns.
  451. */
  452. l2tp_recv_queue_skb(session, skb);
  453. goto out;
  454. }
  455. /* Packet reordering disabled. Discard out-of-sequence packets, while
  456. * tracking the number if in-sequence packets after the first OOS packet
  457. * is seen. After nr_oos_count_max in-sequence packets, reset the
  458. * sequence number to re-enable packet reception.
  459. */
  460. if (cb->ns == session->nr) {
  461. skb_queue_tail(&session->reorder_q, skb);
  462. } else {
  463. u32 nr_oos = cb->ns;
  464. u32 nr_next = (session->nr_oos + 1) & session->nr_max;
  465. if (nr_oos == nr_next)
  466. session->nr_oos_count++;
  467. else
  468. session->nr_oos_count = 0;
  469. session->nr_oos = nr_oos;
  470. if (session->nr_oos_count > session->nr_oos_count_max) {
  471. session->reorder_skip = 1;
  472. }
  473. if (!session->reorder_skip) {
  474. atomic_long_inc(&session->stats.rx_seq_discards);
  475. trace_session_pkt_oos(session, cb->ns);
  476. goto discard;
  477. }
  478. skb_queue_tail(&session->reorder_q, skb);
  479. }
  480. out:
  481. return 0;
  482. discard:
  483. return 1;
  484. }
  485. /* Do receive processing of L2TP data frames. We handle both L2TPv2
  486. * and L2TPv3 data frames here.
  487. *
  488. * L2TPv2 Data Message Header
  489. *
  490. * 0 1 2 3
  491. * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  492. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  493. * |T|L|x|x|S|x|O|P|x|x|x|x| Ver | Length (opt) |
  494. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  495. * | Tunnel ID | Session ID |
  496. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  497. * | Ns (opt) | Nr (opt) |
  498. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  499. * | Offset Size (opt) | Offset pad... (opt)
  500. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  501. *
  502. * Data frames are marked by T=0. All other fields are the same as
  503. * those in L2TP control frames.
  504. *
  505. * L2TPv3 Data Message Header
  506. *
  507. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  508. * | L2TP Session Header |
  509. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  510. * | L2-Specific Sublayer |
  511. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  512. * | Tunnel Payload ...
  513. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  514. *
  515. * L2TPv3 Session Header Over IP
  516. *
  517. * 0 1 2 3
  518. * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  519. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  520. * | Session ID |
  521. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  522. * | Cookie (optional, maximum 64 bits)...
  523. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  524. * |
  525. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  526. *
  527. * L2TPv3 L2-Specific Sublayer Format
  528. *
  529. * 0 1 2 3
  530. * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  531. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  532. * |x|S|x|x|x|x|x|x| Sequence Number |
  533. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  534. *
  535. * Cookie value and sublayer format are negotiated with the peer when
  536. * the session is set up. Unlike L2TPv2, we do not need to parse the
  537. * packet header to determine if optional fields are present.
  538. *
  539. * Caller must already have parsed the frame and determined that it is
  540. * a data (not control) frame before coming here. Fields up to the
  541. * session-id have already been parsed and ptr points to the data
  542. * after the session-id.
  543. */
  544. void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
  545. unsigned char *ptr, unsigned char *optr, u16 hdrflags,
  546. int length)
  547. {
  548. struct l2tp_tunnel *tunnel = session->tunnel;
  549. int offset;
  550. /* Parse and check optional cookie */
  551. if (session->peer_cookie_len > 0) {
  552. if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
  553. pr_debug_ratelimited("%s: cookie mismatch (%u/%u). Discarding.\n",
  554. tunnel->name, tunnel->tunnel_id,
  555. session->session_id);
  556. atomic_long_inc(&session->stats.rx_cookie_discards);
  557. goto discard;
  558. }
  559. ptr += session->peer_cookie_len;
  560. }
  561. /* Handle the optional sequence numbers. Sequence numbers are
  562. * in different places for L2TPv2 and L2TPv3.
  563. *
  564. * If we are the LAC, enable/disable sequence numbers under
  565. * the control of the LNS. If no sequence numbers present but
  566. * we were expecting them, discard frame.
  567. */
  568. L2TP_SKB_CB(skb)->has_seq = 0;
  569. if (tunnel->version == L2TP_HDR_VER_2) {
  570. if (hdrflags & L2TP_HDRFLAG_S) {
  571. /* Store L2TP info in the skb */
  572. L2TP_SKB_CB(skb)->ns = ntohs(*(__be16 *)ptr);
  573. L2TP_SKB_CB(skb)->has_seq = 1;
  574. ptr += 2;
  575. /* Skip past nr in the header */
  576. ptr += 2;
  577. }
  578. } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
  579. u32 l2h = ntohl(*(__be32 *)ptr);
  580. if (l2h & 0x40000000) {
  581. /* Store L2TP info in the skb */
  582. L2TP_SKB_CB(skb)->ns = l2h & 0x00ffffff;
  583. L2TP_SKB_CB(skb)->has_seq = 1;
  584. }
  585. ptr += 4;
  586. }
  587. if (L2TP_SKB_CB(skb)->has_seq) {
  588. /* Received a packet with sequence numbers. If we're the LAC,
  589. * check if we sre sending sequence numbers and if not,
  590. * configure it so.
  591. */
  592. if (!session->lns_mode && !session->send_seq) {
  593. trace_session_seqnum_lns_enable(session);
  594. session->send_seq = 1;
  595. l2tp_session_set_header_len(session, tunnel->version);
  596. }
  597. } else {
  598. /* No sequence numbers.
  599. * If user has configured mandatory sequence numbers, discard.
  600. */
  601. if (session->recv_seq) {
  602. pr_debug_ratelimited("%s: recv data has no seq numbers when required. Discarding.\n",
  603. session->name);
  604. atomic_long_inc(&session->stats.rx_seq_discards);
  605. goto discard;
  606. }
  607. /* If we're the LAC and we're sending sequence numbers, the
  608. * LNS has requested that we no longer send sequence numbers.
  609. * If we're the LNS and we're sending sequence numbers, the
  610. * LAC is broken. Discard the frame.
  611. */
  612. if (!session->lns_mode && session->send_seq) {
  613. trace_session_seqnum_lns_disable(session);
  614. session->send_seq = 0;
  615. l2tp_session_set_header_len(session, tunnel->version);
  616. } else if (session->send_seq) {
  617. pr_debug_ratelimited("%s: recv data has no seq numbers when required. Discarding.\n",
  618. session->name);
  619. atomic_long_inc(&session->stats.rx_seq_discards);
  620. goto discard;
  621. }
  622. }
  623. /* Session data offset is defined only for L2TPv2 and is
  624. * indicated by an optional 16-bit value in the header.
  625. */
  626. if (tunnel->version == L2TP_HDR_VER_2) {
  627. /* If offset bit set, skip it. */
  628. if (hdrflags & L2TP_HDRFLAG_O) {
  629. offset = ntohs(*(__be16 *)ptr);
  630. ptr += 2 + offset;
  631. }
  632. }
  633. offset = ptr - optr;
  634. if (!pskb_may_pull(skb, offset))
  635. goto discard;
  636. __skb_pull(skb, offset);
  637. /* Prepare skb for adding to the session's reorder_q. Hold
  638. * packets for max reorder_timeout or 1 second if not
  639. * reordering.
  640. */
  641. L2TP_SKB_CB(skb)->length = length;
  642. L2TP_SKB_CB(skb)->expires = jiffies +
  643. (session->reorder_timeout ? session->reorder_timeout : HZ);
  644. /* Add packet to the session's receive queue. Reordering is done here, if
  645. * enabled. Saved L2TP protocol info is stored in skb->sb[].
  646. */
  647. if (L2TP_SKB_CB(skb)->has_seq) {
  648. if (l2tp_recv_data_seq(session, skb))
  649. goto discard;
  650. } else {
  651. /* No sequence numbers. Add the skb to the tail of the
  652. * reorder queue. This ensures that it will be
  653. * delivered after all previous sequenced skbs.
  654. */
  655. skb_queue_tail(&session->reorder_q, skb);
  656. }
  657. /* Try to dequeue as many skbs from reorder_q as we can. */
  658. l2tp_recv_dequeue(session);
  659. return;
  660. discard:
  661. atomic_long_inc(&session->stats.rx_errors);
  662. kfree_skb(skb);
  663. }
  664. EXPORT_SYMBOL_GPL(l2tp_recv_common);
  665. /* Drop skbs from the session's reorder_q
  666. */
  667. static void l2tp_session_queue_purge(struct l2tp_session *session)
  668. {
  669. struct sk_buff *skb = NULL;
  670. while ((skb = skb_dequeue(&session->reorder_q))) {
  671. atomic_long_inc(&session->stats.rx_errors);
  672. kfree_skb(skb);
  673. }
  674. }
  675. /* Internal UDP receive frame. Do the real work of receiving an L2TP data frame
  676. * here. The skb is not on a list when we get here.
  677. * Returns 0 if the packet was a data packet and was successfully passed on.
  678. * Returns 1 if the packet was not a good data packet and could not be
  679. * forwarded. All such packets are passed up to userspace to deal with.
  680. */
  681. static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb)
  682. {
  683. struct l2tp_session *session = NULL;
  684. unsigned char *ptr, *optr;
  685. u16 hdrflags;
  686. u32 tunnel_id, session_id;
  687. u16 version;
  688. int length;
  689. /* UDP has verifed checksum */
  690. /* UDP always verifies the packet length. */
  691. __skb_pull(skb, sizeof(struct udphdr));
  692. /* Short packet? */
  693. if (!pskb_may_pull(skb, L2TP_HDR_SIZE_MAX)) {
  694. pr_debug_ratelimited("%s: recv short packet (len=%d)\n",
  695. tunnel->name, skb->len);
  696. goto invalid;
  697. }
  698. /* Point to L2TP header */
  699. optr = skb->data;
  700. ptr = skb->data;
  701. /* Get L2TP header flags */
  702. hdrflags = ntohs(*(__be16 *)ptr);
  703. /* Check protocol version */
  704. version = hdrflags & L2TP_HDR_VER_MASK;
  705. if (version != tunnel->version) {
  706. pr_debug_ratelimited("%s: recv protocol version mismatch: got %d expected %d\n",
  707. tunnel->name, version, tunnel->version);
  708. goto invalid;
  709. }
  710. /* Get length of L2TP packet */
  711. length = skb->len;
  712. /* If type is control packet, it is handled by userspace. */
  713. if (hdrflags & L2TP_HDRFLAG_T)
  714. goto pass;
  715. /* Skip flags */
  716. ptr += 2;
  717. if (tunnel->version == L2TP_HDR_VER_2) {
  718. /* If length is present, skip it */
  719. if (hdrflags & L2TP_HDRFLAG_L)
  720. ptr += 2;
  721. /* Extract tunnel and session ID */
  722. tunnel_id = ntohs(*(__be16 *)ptr);
  723. ptr += 2;
  724. session_id = ntohs(*(__be16 *)ptr);
  725. ptr += 2;
  726. } else {
  727. ptr += 2; /* skip reserved bits */
  728. tunnel_id = tunnel->tunnel_id;
  729. session_id = ntohl(*(__be32 *)ptr);
  730. ptr += 4;
  731. }
  732. /* Find the session context */
  733. session = l2tp_tunnel_get_session(tunnel, session_id);
  734. if (!session || !session->recv_skb) {
  735. if (session)
  736. l2tp_session_dec_refcount(session);
  737. /* Not found? Pass to userspace to deal with */
  738. pr_debug_ratelimited("%s: no session found (%u/%u). Passing up.\n",
  739. tunnel->name, tunnel_id, session_id);
  740. goto pass;
  741. }
  742. if (tunnel->version == L2TP_HDR_VER_3 &&
  743. l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) {
  744. l2tp_session_dec_refcount(session);
  745. goto invalid;
  746. }
  747. l2tp_recv_common(session, skb, ptr, optr, hdrflags, length);
  748. l2tp_session_dec_refcount(session);
  749. return 0;
  750. invalid:
  751. atomic_long_inc(&tunnel->stats.rx_invalid);
  752. pass:
  753. /* Put UDP header back */
  754. __skb_push(skb, sizeof(struct udphdr));
  755. return 1;
  756. }
  757. /* UDP encapsulation receive handler. See net/ipv4/udp.c.
  758. * Return codes:
  759. * 0 : success.
  760. * <0: error
  761. * >0: skb should be passed up to userspace as UDP.
  762. */
  763. int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
  764. {
  765. struct l2tp_tunnel *tunnel;
  766. /* Note that this is called from the encap_rcv hook inside an
  767. * RCU-protected region, but without the socket being locked.
  768. * Hence we use rcu_dereference_sk_user_data to access the
  769. * tunnel data structure rather the usual l2tp_sk_to_tunnel
  770. * accessor function.
  771. */
  772. tunnel = rcu_dereference_sk_user_data(sk);
  773. if (!tunnel)
  774. goto pass_up;
  775. if (WARN_ON(tunnel->magic != L2TP_TUNNEL_MAGIC))
  776. goto pass_up;
  777. if (l2tp_udp_recv_core(tunnel, skb))
  778. goto pass_up;
  779. return 0;
  780. pass_up:
  781. return 1;
  782. }
  783. EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv);
  784. /************************************************************************
  785. * Transmit handling
  786. ***********************************************************************/
  787. /* Build an L2TP header for the session into the buffer provided.
  788. */
  789. static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
  790. {
  791. struct l2tp_tunnel *tunnel = session->tunnel;
  792. __be16 *bufp = buf;
  793. __be16 *optr = buf;
  794. u16 flags = L2TP_HDR_VER_2;
  795. u32 tunnel_id = tunnel->peer_tunnel_id;
  796. u32 session_id = session->peer_session_id;
  797. if (session->send_seq)
  798. flags |= L2TP_HDRFLAG_S;
  799. /* Setup L2TP header. */
  800. *bufp++ = htons(flags);
  801. *bufp++ = htons(tunnel_id);
  802. *bufp++ = htons(session_id);
  803. if (session->send_seq) {
  804. *bufp++ = htons(session->ns);
  805. *bufp++ = 0;
  806. session->ns++;
  807. session->ns &= 0xffff;
  808. trace_session_seqnum_update(session);
  809. }
  810. return bufp - optr;
  811. }
  812. static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
  813. {
  814. struct l2tp_tunnel *tunnel = session->tunnel;
  815. char *bufp = buf;
  816. char *optr = bufp;
  817. /* Setup L2TP header. The header differs slightly for UDP and
  818. * IP encapsulations. For UDP, there is 4 bytes of flags.
  819. */
  820. if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
  821. u16 flags = L2TP_HDR_VER_3;
  822. *((__be16 *)bufp) = htons(flags);
  823. bufp += 2;
  824. *((__be16 *)bufp) = 0;
  825. bufp += 2;
  826. }
  827. *((__be32 *)bufp) = htonl(session->peer_session_id);
  828. bufp += 4;
  829. if (session->cookie_len) {
  830. memcpy(bufp, &session->cookie[0], session->cookie_len);
  831. bufp += session->cookie_len;
  832. }
  833. if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
  834. u32 l2h = 0;
  835. if (session->send_seq) {
  836. l2h = 0x40000000 | session->ns;
  837. session->ns++;
  838. session->ns &= 0xffffff;
  839. trace_session_seqnum_update(session);
  840. }
  841. *((__be32 *)bufp) = htonl(l2h);
  842. bufp += 4;
  843. }
  844. return bufp - optr;
  845. }
  846. /* Queue the packet to IP for output: tunnel socket lock must be held */
  847. static int l2tp_xmit_queue(struct l2tp_tunnel *tunnel, struct sk_buff *skb, struct flowi *fl)
  848. {
  849. int err;
  850. skb->ignore_df = 1;
  851. skb_dst_drop(skb);
  852. #if IS_ENABLED(CONFIG_IPV6)
  853. if (l2tp_sk_is_v6(tunnel->sock))
  854. err = inet6_csk_xmit(tunnel->sock, skb, NULL);
  855. else
  856. #endif
  857. err = ip_queue_xmit(tunnel->sock, skb, fl);
  858. return err >= 0 ? NET_XMIT_SUCCESS : NET_XMIT_DROP;
  859. }
  860. static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, unsigned int *len)
  861. {
  862. struct l2tp_tunnel *tunnel = session->tunnel;
  863. unsigned int data_len = skb->len;
  864. struct sock *sk = tunnel->sock;
  865. int headroom, uhlen, udp_len;
  866. int ret = NET_XMIT_SUCCESS;
  867. struct inet_sock *inet;
  868. struct udphdr *uh;
  869. /* Check that there's enough headroom in the skb to insert IP,
  870. * UDP and L2TP headers. If not enough, expand it to
  871. * make room. Adjust truesize.
  872. */
  873. uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(*uh) : 0;
  874. headroom = NET_SKB_PAD + sizeof(struct iphdr) + uhlen + session->hdr_len;
  875. if (skb_cow_head(skb, headroom)) {
  876. kfree_skb(skb);
  877. return NET_XMIT_DROP;
  878. }
  879. /* Setup L2TP header */
  880. if (tunnel->version == L2TP_HDR_VER_2)
  881. l2tp_build_l2tpv2_header(session, __skb_push(skb, session->hdr_len));
  882. else
  883. l2tp_build_l2tpv3_header(session, __skb_push(skb, session->hdr_len));
  884. /* Reset skb netfilter state */
  885. memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
  886. IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED | IPSKB_REROUTED);
  887. nf_reset_ct(skb);
  888. bh_lock_sock(sk);
  889. if (sock_owned_by_user(sk)) {
  890. kfree_skb(skb);
  891. ret = NET_XMIT_DROP;
  892. goto out_unlock;
  893. }
  894. /* The user-space may change the connection status for the user-space
  895. * provided socket at run time: we must check it under the socket lock
  896. */
  897. if (tunnel->fd >= 0 && sk->sk_state != TCP_ESTABLISHED) {
  898. kfree_skb(skb);
  899. ret = NET_XMIT_DROP;
  900. goto out_unlock;
  901. }
  902. /* Report transmitted length before we add encap header, which keeps
  903. * statistics consistent for both UDP and IP encap tx/rx paths.
  904. */
  905. *len = skb->len;
  906. inet = inet_sk(sk);
  907. switch (tunnel->encap) {
  908. case L2TP_ENCAPTYPE_UDP:
  909. /* Setup UDP header */
  910. __skb_push(skb, sizeof(*uh));
  911. skb_reset_transport_header(skb);
  912. uh = udp_hdr(skb);
  913. uh->source = inet->inet_sport;
  914. uh->dest = inet->inet_dport;
  915. udp_len = uhlen + session->hdr_len + data_len;
  916. uh->len = htons(udp_len);
  917. /* Calculate UDP checksum if configured to do so */
  918. #if IS_ENABLED(CONFIG_IPV6)
  919. if (l2tp_sk_is_v6(sk))
  920. udp6_set_csum(udp_get_no_check6_tx(sk),
  921. skb, &inet6_sk(sk)->saddr,
  922. &sk->sk_v6_daddr, udp_len);
  923. else
  924. #endif
  925. udp_set_csum(sk->sk_no_check_tx, skb, inet->inet_saddr,
  926. inet->inet_daddr, udp_len);
  927. break;
  928. case L2TP_ENCAPTYPE_IP:
  929. break;
  930. }
  931. ret = l2tp_xmit_queue(tunnel, skb, &inet->cork.fl);
  932. out_unlock:
  933. bh_unlock_sock(sk);
  934. return ret;
  935. }
  936. /* If caller requires the skb to have a ppp header, the header must be
  937. * inserted in the skb data before calling this function.
  938. */
  939. int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb)
  940. {
  941. unsigned int len = 0;
  942. int ret;
  943. ret = l2tp_xmit_core(session, skb, &len);
  944. if (ret == NET_XMIT_SUCCESS) {
  945. atomic_long_inc(&session->tunnel->stats.tx_packets);
  946. atomic_long_add(len, &session->tunnel->stats.tx_bytes);
  947. atomic_long_inc(&session->stats.tx_packets);
  948. atomic_long_add(len, &session->stats.tx_bytes);
  949. } else {
  950. atomic_long_inc(&session->tunnel->stats.tx_errors);
  951. atomic_long_inc(&session->stats.tx_errors);
  952. }
  953. return ret;
  954. }
  955. EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
  956. /*****************************************************************************
  957. * Tinnel and session create/destroy.
  958. *****************************************************************************/
  959. /* Tunnel socket destruct hook.
  960. * The tunnel context is deleted only when all session sockets have been
  961. * closed.
  962. */
  963. static void l2tp_tunnel_destruct(struct sock *sk)
  964. {
  965. struct l2tp_tunnel *tunnel = l2tp_sk_to_tunnel(sk);
  966. if (!tunnel)
  967. goto end;
  968. /* Disable udp encapsulation */
  969. switch (tunnel->encap) {
  970. case L2TP_ENCAPTYPE_UDP:
  971. /* No longer an encapsulation socket. See net/ipv4/udp.c */
  972. (udp_sk(sk))->encap_type = 0;
  973. (udp_sk(sk))->encap_rcv = NULL;
  974. (udp_sk(sk))->encap_destroy = NULL;
  975. break;
  976. case L2TP_ENCAPTYPE_IP:
  977. break;
  978. }
  979. /* Remove hooks into tunnel socket */
  980. sk->sk_destruct = tunnel->old_sk_destruct;
  981. sk->sk_user_data = NULL;
  982. /* Call the original destructor */
  983. if (sk->sk_destruct)
  984. (*sk->sk_destruct)(sk);
  985. kfree_rcu(tunnel, rcu);
  986. end:
  987. return;
  988. }
  989. /* Remove an l2tp session from l2tp_core's hash lists. */
  990. static void l2tp_session_unhash(struct l2tp_session *session)
  991. {
  992. struct l2tp_tunnel *tunnel = session->tunnel;
  993. /* Remove the session from core hashes */
  994. if (tunnel) {
  995. /* Remove from the per-tunnel hash */
  996. write_lock_bh(&tunnel->hlist_lock);
  997. hlist_del_init(&session->hlist);
  998. write_unlock_bh(&tunnel->hlist_lock);
  999. /* For L2TPv3 we have a per-net hash: remove from there, too */
  1000. if (tunnel->version != L2TP_HDR_VER_2) {
  1001. struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
  1002. spin_lock_bh(&pn->l2tp_session_hlist_lock);
  1003. hlist_del_init_rcu(&session->global_hlist);
  1004. spin_unlock_bh(&pn->l2tp_session_hlist_lock);
  1005. synchronize_rcu();
  1006. }
  1007. }
  1008. }
  1009. /* When the tunnel is closed, all the attached sessions need to go too.
  1010. */
  1011. static void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
  1012. {
  1013. int hash;
  1014. struct hlist_node *walk;
  1015. struct hlist_node *tmp;
  1016. struct l2tp_session *session;
  1017. write_lock_bh(&tunnel->hlist_lock);
  1018. tunnel->acpt_newsess = false;
  1019. for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
  1020. again:
  1021. hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
  1022. session = hlist_entry(walk, struct l2tp_session, hlist);
  1023. hlist_del_init(&session->hlist);
  1024. write_unlock_bh(&tunnel->hlist_lock);
  1025. l2tp_session_delete(session);
  1026. write_lock_bh(&tunnel->hlist_lock);
  1027. /* Now restart from the beginning of this hash
  1028. * chain. We always remove a session from the
  1029. * list so we are guaranteed to make forward
  1030. * progress.
  1031. */
  1032. goto again;
  1033. }
  1034. }
  1035. write_unlock_bh(&tunnel->hlist_lock);
  1036. }
  1037. /* Tunnel socket destroy hook for UDP encapsulation */
  1038. static void l2tp_udp_encap_destroy(struct sock *sk)
  1039. {
  1040. struct l2tp_tunnel *tunnel = l2tp_sk_to_tunnel(sk);
  1041. if (tunnel)
  1042. l2tp_tunnel_delete(tunnel);
  1043. }
  1044. /* Workqueue tunnel deletion function */
  1045. static void l2tp_tunnel_del_work(struct work_struct *work)
  1046. {
  1047. struct l2tp_tunnel *tunnel = container_of(work, struct l2tp_tunnel,
  1048. del_work);
  1049. struct sock *sk = tunnel->sock;
  1050. struct socket *sock = sk->sk_socket;
  1051. struct l2tp_net *pn;
  1052. l2tp_tunnel_closeall(tunnel);
  1053. /* If the tunnel socket was created within the kernel, use
  1054. * the sk API to release it here.
  1055. */
  1056. if (tunnel->fd < 0) {
  1057. if (sock) {
  1058. kernel_sock_shutdown(sock, SHUT_RDWR);
  1059. sock_release(sock);
  1060. }
  1061. }
  1062. /* Remove the tunnel struct from the tunnel list */
  1063. pn = l2tp_pernet(tunnel->l2tp_net);
  1064. spin_lock_bh(&pn->l2tp_tunnel_list_lock);
  1065. list_del_rcu(&tunnel->list);
  1066. spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
  1067. /* drop initial ref */
  1068. l2tp_tunnel_dec_refcount(tunnel);
  1069. /* drop workqueue ref */
  1070. l2tp_tunnel_dec_refcount(tunnel);
  1071. }
  1072. /* Create a socket for the tunnel, if one isn't set up by
  1073. * userspace. This is used for static tunnels where there is no
  1074. * managing L2TP daemon.
  1075. *
  1076. * Since we don't want these sockets to keep a namespace alive by
  1077. * themselves, we drop the socket's namespace refcount after creation.
  1078. * These sockets are freed when the namespace exits using the pernet
  1079. * exit hook.
  1080. */
  1081. static int l2tp_tunnel_sock_create(struct net *net,
  1082. u32 tunnel_id,
  1083. u32 peer_tunnel_id,
  1084. struct l2tp_tunnel_cfg *cfg,
  1085. struct socket **sockp)
  1086. {
  1087. int err = -EINVAL;
  1088. struct socket *sock = NULL;
  1089. struct udp_port_cfg udp_conf;
  1090. switch (cfg->encap) {
  1091. case L2TP_ENCAPTYPE_UDP:
  1092. memset(&udp_conf, 0, sizeof(udp_conf));
  1093. #if IS_ENABLED(CONFIG_IPV6)
  1094. if (cfg->local_ip6 && cfg->peer_ip6) {
  1095. udp_conf.family = AF_INET6;
  1096. memcpy(&udp_conf.local_ip6, cfg->local_ip6,
  1097. sizeof(udp_conf.local_ip6));
  1098. memcpy(&udp_conf.peer_ip6, cfg->peer_ip6,
  1099. sizeof(udp_conf.peer_ip6));
  1100. udp_conf.use_udp6_tx_checksums =
  1101. !cfg->udp6_zero_tx_checksums;
  1102. udp_conf.use_udp6_rx_checksums =
  1103. !cfg->udp6_zero_rx_checksums;
  1104. } else
  1105. #endif
  1106. {
  1107. udp_conf.family = AF_INET;
  1108. udp_conf.local_ip = cfg->local_ip;
  1109. udp_conf.peer_ip = cfg->peer_ip;
  1110. udp_conf.use_udp_checksums = cfg->use_udp_checksums;
  1111. }
  1112. udp_conf.local_udp_port = htons(cfg->local_udp_port);
  1113. udp_conf.peer_udp_port = htons(cfg->peer_udp_port);
  1114. err = udp_sock_create(net, &udp_conf, &sock);
  1115. if (err < 0)
  1116. goto out;
  1117. break;
  1118. case L2TP_ENCAPTYPE_IP:
  1119. #if IS_ENABLED(CONFIG_IPV6)
  1120. if (cfg->local_ip6 && cfg->peer_ip6) {
  1121. struct sockaddr_l2tpip6 ip6_addr = {0};
  1122. err = sock_create_kern(net, AF_INET6, SOCK_DGRAM,
  1123. IPPROTO_L2TP, &sock);
  1124. if (err < 0)
  1125. goto out;
  1126. ip6_addr.l2tp_family = AF_INET6;
  1127. memcpy(&ip6_addr.l2tp_addr, cfg->local_ip6,
  1128. sizeof(ip6_addr.l2tp_addr));
  1129. ip6_addr.l2tp_conn_id = tunnel_id;
  1130. err = kernel_bind(sock, (struct sockaddr *)&ip6_addr,
  1131. sizeof(ip6_addr));
  1132. if (err < 0)
  1133. goto out;
  1134. ip6_addr.l2tp_family = AF_INET6;
  1135. memcpy(&ip6_addr.l2tp_addr, cfg->peer_ip6,
  1136. sizeof(ip6_addr.l2tp_addr));
  1137. ip6_addr.l2tp_conn_id = peer_tunnel_id;
  1138. err = kernel_connect(sock,
  1139. (struct sockaddr *)&ip6_addr,
  1140. sizeof(ip6_addr), 0);
  1141. if (err < 0)
  1142. goto out;
  1143. } else
  1144. #endif
  1145. {
  1146. struct sockaddr_l2tpip ip_addr = {0};
  1147. err = sock_create_kern(net, AF_INET, SOCK_DGRAM,
  1148. IPPROTO_L2TP, &sock);
  1149. if (err < 0)
  1150. goto out;
  1151. ip_addr.l2tp_family = AF_INET;
  1152. ip_addr.l2tp_addr = cfg->local_ip;
  1153. ip_addr.l2tp_conn_id = tunnel_id;
  1154. err = kernel_bind(sock, (struct sockaddr *)&ip_addr,
  1155. sizeof(ip_addr));
  1156. if (err < 0)
  1157. goto out;
  1158. ip_addr.l2tp_family = AF_INET;
  1159. ip_addr.l2tp_addr = cfg->peer_ip;
  1160. ip_addr.l2tp_conn_id = peer_tunnel_id;
  1161. err = kernel_connect(sock, (struct sockaddr *)&ip_addr,
  1162. sizeof(ip_addr), 0);
  1163. if (err < 0)
  1164. goto out;
  1165. }
  1166. break;
  1167. default:
  1168. goto out;
  1169. }
  1170. out:
  1171. *sockp = sock;
  1172. if (err < 0 && sock) {
  1173. kernel_sock_shutdown(sock, SHUT_RDWR);
  1174. sock_release(sock);
  1175. *sockp = NULL;
  1176. }
  1177. return err;
  1178. }
  1179. static struct lock_class_key l2tp_socket_class;
  1180. int l2tp_tunnel_create(int fd, int version, u32 tunnel_id, u32 peer_tunnel_id,
  1181. struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp)
  1182. {
  1183. struct l2tp_tunnel *tunnel = NULL;
  1184. int err;
  1185. enum l2tp_encap_type encap = L2TP_ENCAPTYPE_UDP;
  1186. if (cfg)
  1187. encap = cfg->encap;
  1188. tunnel = kzalloc(sizeof(*tunnel), GFP_KERNEL);
  1189. if (!tunnel) {
  1190. err = -ENOMEM;
  1191. goto err;
  1192. }
  1193. tunnel->version = version;
  1194. tunnel->tunnel_id = tunnel_id;
  1195. tunnel->peer_tunnel_id = peer_tunnel_id;
  1196. tunnel->magic = L2TP_TUNNEL_MAGIC;
  1197. sprintf(&tunnel->name[0], "tunl %u", tunnel_id);
  1198. rwlock_init(&tunnel->hlist_lock);
  1199. tunnel->acpt_newsess = true;
  1200. tunnel->encap = encap;
  1201. refcount_set(&tunnel->ref_count, 1);
  1202. tunnel->fd = fd;
  1203. /* Init delete workqueue struct */
  1204. INIT_WORK(&tunnel->del_work, l2tp_tunnel_del_work);
  1205. INIT_LIST_HEAD(&tunnel->list);
  1206. err = 0;
  1207. err:
  1208. if (tunnelp)
  1209. *tunnelp = tunnel;
  1210. return err;
  1211. }
  1212. EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
  1213. static int l2tp_validate_socket(const struct sock *sk, const struct net *net,
  1214. enum l2tp_encap_type encap)
  1215. {
  1216. if (!net_eq(sock_net(sk), net))
  1217. return -EINVAL;
  1218. if (sk->sk_type != SOCK_DGRAM)
  1219. return -EPROTONOSUPPORT;
  1220. if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)
  1221. return -EPROTONOSUPPORT;
  1222. if ((encap == L2TP_ENCAPTYPE_UDP && sk->sk_protocol != IPPROTO_UDP) ||
  1223. (encap == L2TP_ENCAPTYPE_IP && sk->sk_protocol != IPPROTO_L2TP))
  1224. return -EPROTONOSUPPORT;
  1225. if (sk->sk_user_data)
  1226. return -EBUSY;
  1227. return 0;
  1228. }
  1229. int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
  1230. struct l2tp_tunnel_cfg *cfg)
  1231. {
  1232. struct l2tp_tunnel *tunnel_walk;
  1233. struct l2tp_net *pn;
  1234. struct socket *sock;
  1235. struct sock *sk;
  1236. int ret;
  1237. if (tunnel->fd < 0) {
  1238. ret = l2tp_tunnel_sock_create(net, tunnel->tunnel_id,
  1239. tunnel->peer_tunnel_id, cfg,
  1240. &sock);
  1241. if (ret < 0)
  1242. goto err;
  1243. } else {
  1244. sock = sockfd_lookup(tunnel->fd, &ret);
  1245. if (!sock)
  1246. goto err;
  1247. ret = l2tp_validate_socket(sock->sk, net, tunnel->encap);
  1248. if (ret < 0)
  1249. goto err_sock;
  1250. }
  1251. tunnel->l2tp_net = net;
  1252. pn = l2tp_pernet(net);
  1253. spin_lock_bh(&pn->l2tp_tunnel_list_lock);
  1254. list_for_each_entry(tunnel_walk, &pn->l2tp_tunnel_list, list) {
  1255. if (tunnel_walk->tunnel_id == tunnel->tunnel_id) {
  1256. spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
  1257. ret = -EEXIST;
  1258. goto err_sock;
  1259. }
  1260. }
  1261. list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
  1262. spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
  1263. sk = sock->sk;
  1264. sock_hold(sk);
  1265. tunnel->sock = sk;
  1266. if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
  1267. struct udp_tunnel_sock_cfg udp_cfg = {
  1268. .sk_user_data = tunnel,
  1269. .encap_type = UDP_ENCAP_L2TPINUDP,
  1270. .encap_rcv = l2tp_udp_encap_recv,
  1271. .encap_destroy = l2tp_udp_encap_destroy,
  1272. };
  1273. setup_udp_tunnel_sock(net, sock, &udp_cfg);
  1274. } else {
  1275. sk->sk_user_data = tunnel;
  1276. }
  1277. tunnel->old_sk_destruct = sk->sk_destruct;
  1278. sk->sk_destruct = &l2tp_tunnel_destruct;
  1279. lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class,
  1280. "l2tp_sock");
  1281. sk->sk_allocation = GFP_ATOMIC;
  1282. trace_register_tunnel(tunnel);
  1283. if (tunnel->fd >= 0)
  1284. sockfd_put(sock);
  1285. return 0;
  1286. err_sock:
  1287. if (tunnel->fd < 0)
  1288. sock_release(sock);
  1289. else
  1290. sockfd_put(sock);
  1291. err:
  1292. return ret;
  1293. }
  1294. EXPORT_SYMBOL_GPL(l2tp_tunnel_register);
  1295. /* This function is used by the netlink TUNNEL_DELETE command.
  1296. */
  1297. void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
  1298. {
  1299. if (!test_and_set_bit(0, &tunnel->dead)) {
  1300. trace_delete_tunnel(tunnel);
  1301. l2tp_tunnel_inc_refcount(tunnel);
  1302. queue_work(l2tp_wq, &tunnel->del_work);
  1303. }
  1304. }
  1305. EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
  1306. void l2tp_session_delete(struct l2tp_session *session)
  1307. {
  1308. if (test_and_set_bit(0, &session->dead))
  1309. return;
  1310. trace_delete_session(session);
  1311. l2tp_session_unhash(session);
  1312. l2tp_session_queue_purge(session);
  1313. if (session->session_close)
  1314. (*session->session_close)(session);
  1315. l2tp_session_dec_refcount(session);
  1316. }
  1317. EXPORT_SYMBOL_GPL(l2tp_session_delete);
  1318. /* We come here whenever a session's send_seq, cookie_len or
  1319. * l2specific_type parameters are set.
  1320. */
  1321. void l2tp_session_set_header_len(struct l2tp_session *session, int version)
  1322. {
  1323. if (version == L2TP_HDR_VER_2) {
  1324. session->hdr_len = 6;
  1325. if (session->send_seq)
  1326. session->hdr_len += 4;
  1327. } else {
  1328. session->hdr_len = 4 + session->cookie_len;
  1329. session->hdr_len += l2tp_get_l2specific_len(session);
  1330. if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)
  1331. session->hdr_len += 4;
  1332. }
  1333. }
  1334. EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
  1335. struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id,
  1336. u32 peer_session_id, struct l2tp_session_cfg *cfg)
  1337. {
  1338. struct l2tp_session *session;
  1339. session = kzalloc(sizeof(*session) + priv_size, GFP_KERNEL);
  1340. if (session) {
  1341. session->magic = L2TP_SESSION_MAGIC;
  1342. session->tunnel = tunnel;
  1343. session->session_id = session_id;
  1344. session->peer_session_id = peer_session_id;
  1345. session->nr = 0;
  1346. if (tunnel->version == L2TP_HDR_VER_2)
  1347. session->nr_max = 0xffff;
  1348. else
  1349. session->nr_max = 0xffffff;
  1350. session->nr_window_size = session->nr_max / 2;
  1351. session->nr_oos_count_max = 4;
  1352. /* Use NR of first received packet */
  1353. session->reorder_skip = 1;
  1354. sprintf(&session->name[0], "sess %u/%u",
  1355. tunnel->tunnel_id, session->session_id);
  1356. skb_queue_head_init(&session->reorder_q);
  1357. INIT_HLIST_NODE(&session->hlist);
  1358. INIT_HLIST_NODE(&session->global_hlist);
  1359. if (cfg) {
  1360. session->pwtype = cfg->pw_type;
  1361. session->send_seq = cfg->send_seq;
  1362. session->recv_seq = cfg->recv_seq;
  1363. session->lns_mode = cfg->lns_mode;
  1364. session->reorder_timeout = cfg->reorder_timeout;
  1365. session->l2specific_type = cfg->l2specific_type;
  1366. session->cookie_len = cfg->cookie_len;
  1367. memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);
  1368. session->peer_cookie_len = cfg->peer_cookie_len;
  1369. memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);
  1370. }
  1371. l2tp_session_set_header_len(session, tunnel->version);
  1372. refcount_set(&session->ref_count, 1);
  1373. return session;
  1374. }
  1375. return ERR_PTR(-ENOMEM);
  1376. }
  1377. EXPORT_SYMBOL_GPL(l2tp_session_create);
  1378. /*****************************************************************************
  1379. * Init and cleanup
  1380. *****************************************************************************/
  1381. static __net_init int l2tp_init_net(struct net *net)
  1382. {
  1383. struct l2tp_net *pn = net_generic(net, l2tp_net_id);
  1384. int hash;
  1385. INIT_LIST_HEAD(&pn->l2tp_tunnel_list);
  1386. spin_lock_init(&pn->l2tp_tunnel_list_lock);
  1387. for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
  1388. INIT_HLIST_HEAD(&pn->l2tp_session_hlist[hash]);
  1389. spin_lock_init(&pn->l2tp_session_hlist_lock);
  1390. return 0;
  1391. }
  1392. static __net_exit void l2tp_exit_net(struct net *net)
  1393. {
  1394. struct l2tp_net *pn = l2tp_pernet(net);
  1395. struct l2tp_tunnel *tunnel = NULL;
  1396. int hash;
  1397. rcu_read_lock_bh();
  1398. list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
  1399. l2tp_tunnel_delete(tunnel);
  1400. }
  1401. rcu_read_unlock_bh();
  1402. if (l2tp_wq)
  1403. flush_workqueue(l2tp_wq);
  1404. rcu_barrier();
  1405. for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
  1406. WARN_ON_ONCE(!hlist_empty(&pn->l2tp_session_hlist[hash]));
  1407. }
  1408. static struct pernet_operations l2tp_net_ops = {
  1409. .init = l2tp_init_net,
  1410. .exit = l2tp_exit_net,
  1411. .id = &l2tp_net_id,
  1412. .size = sizeof(struct l2tp_net),
  1413. };
  1414. static int __init l2tp_init(void)
  1415. {
  1416. int rc = 0;
  1417. rc = register_pernet_device(&l2tp_net_ops);
  1418. if (rc)
  1419. goto out;
  1420. l2tp_wq = alloc_workqueue("l2tp", WQ_UNBOUND, 0);
  1421. if (!l2tp_wq) {
  1422. pr_err("alloc_workqueue failed\n");
  1423. unregister_pernet_device(&l2tp_net_ops);
  1424. rc = -ENOMEM;
  1425. goto out;
  1426. }
  1427. pr_info("L2TP core driver, %s\n", L2TP_DRV_VERSION);
  1428. out:
  1429. return rc;
  1430. }
  1431. static void __exit l2tp_exit(void)
  1432. {
  1433. unregister_pernet_device(&l2tp_net_ops);
  1434. if (l2tp_wq) {
  1435. destroy_workqueue(l2tp_wq);
  1436. l2tp_wq = NULL;
  1437. }
  1438. }
  1439. module_init(l2tp_init);
  1440. module_exit(l2tp_exit);
  1441. MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
  1442. MODULE_DESCRIPTION("L2TP core");
  1443. MODULE_LICENSE("GPL");
  1444. MODULE_VERSION(L2TP_DRV_VERSION);