l2tp_ppp.c 42 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*****************************************************************************
  3. * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets
  4. *
  5. * PPPoX --- Generic PPP encapsulation socket family
  6. * PPPoL2TP --- PPP over L2TP (RFC 2661)
  7. *
  8. * Version: 2.0.0
  9. *
  10. * Authors: James Chapman (jchapman@katalix.com)
  11. *
  12. * Based on original work by Martijn van Oosterhout <kleptog@svana.org>
  13. *
  14. * License:
  15. */
  16. /* This driver handles only L2TP data frames; control frames are handled by a
  17. * userspace application.
  18. *
  19. * To send data in an L2TP session, userspace opens a PPPoL2TP socket and
  20. * attaches it to a bound UDP socket with local tunnel_id / session_id and
  21. * peer tunnel_id / session_id set. Data can then be sent or received using
  22. * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket
  23. * can be read or modified using ioctl() or [gs]etsockopt() calls.
  24. *
  25. * When a PPPoL2TP socket is connected with local and peer session_id values
  26. * zero, the socket is treated as a special tunnel management socket.
  27. *
  28. * Here's example userspace code to create a socket for sending/receiving data
  29. * over an L2TP session:-
  30. *
  31. * struct sockaddr_pppol2tp sax;
  32. * int fd;
  33. * int session_fd;
  34. *
  35. * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
  36. *
  37. * sax.sa_family = AF_PPPOX;
  38. * sax.sa_protocol = PX_PROTO_OL2TP;
  39. * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket
  40. * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr;
  41. * sax.pppol2tp.addr.sin_port = addr->sin_port;
  42. * sax.pppol2tp.addr.sin_family = AF_INET;
  43. * sax.pppol2tp.s_tunnel = tunnel_id;
  44. * sax.pppol2tp.s_session = session_id;
  45. * sax.pppol2tp.d_tunnel = peer_tunnel_id;
  46. * sax.pppol2tp.d_session = peer_session_id;
  47. *
  48. * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax));
  49. *
  50. * A pppd plugin that allows PPP traffic to be carried over L2TP using
  51. * this driver is available from the OpenL2TP project at
  52. * http://openl2tp.sourceforge.net.
  53. */
  54. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  55. #include <linux/module.h>
  56. #include <linux/string.h>
  57. #include <linux/list.h>
  58. #include <linux/uaccess.h>
  59. #include <linux/kernel.h>
  60. #include <linux/spinlock.h>
  61. #include <linux/kthread.h>
  62. #include <linux/sched.h>
  63. #include <linux/slab.h>
  64. #include <linux/errno.h>
  65. #include <linux/jiffies.h>
  66. #include <linux/netdevice.h>
  67. #include <linux/net.h>
  68. #include <linux/inetdevice.h>
  69. #include <linux/skbuff.h>
  70. #include <linux/init.h>
  71. #include <linux/ip.h>
  72. #include <linux/udp.h>
  73. #include <linux/if_pppox.h>
  74. #include <linux/if_pppol2tp.h>
  75. #include <net/sock.h>
  76. #include <linux/ppp_channel.h>
  77. #include <linux/ppp_defs.h>
  78. #include <linux/ppp-ioctl.h>
  79. #include <linux/file.h>
  80. #include <linux/hash.h>
  81. #include <linux/sort.h>
  82. #include <linux/proc_fs.h>
  83. #include <linux/l2tp.h>
  84. #include <linux/nsproxy.h>
  85. #include <net/net_namespace.h>
  86. #include <net/netns/generic.h>
  87. #include <net/ip.h>
  88. #include <net/udp.h>
  89. #include <net/inet_common.h>
  90. #include <asm/byteorder.h>
  91. #include <linux/atomic.h>
  92. #include "l2tp_core.h"
  93. #define PPPOL2TP_DRV_VERSION "V2.0"
  94. /* Space for UDP, L2TP and PPP headers */
  95. #define PPPOL2TP_HEADER_OVERHEAD 40
  96. /* Number of bytes to build transmit L2TP headers.
  97. * Unfortunately the size is different depending on whether sequence numbers
  98. * are enabled.
  99. */
  100. #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10
  101. #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6
  102. /* Private data of each session. This data lives at the end of struct
  103. * l2tp_session, referenced via session->priv[].
  104. */
  105. struct pppol2tp_session {
  106. int owner; /* pid that opened the socket */
  107. struct mutex sk_lock; /* Protects .sk */
  108. struct sock __rcu *sk; /* Pointer to the session PPPoX socket */
  109. struct sock *__sk; /* Copy of .sk, for cleanup */
  110. struct rcu_head rcu; /* For asynchronous release */
  111. };
  112. static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);
  113. static const struct ppp_channel_ops pppol2tp_chan_ops = {
  114. .start_xmit = pppol2tp_xmit,
  115. };
  116. static const struct proto_ops pppol2tp_ops;
  117. /* Retrieves the pppol2tp socket associated to a session.
  118. * A reference is held on the returned socket, so this function must be paired
  119. * with sock_put().
  120. */
  121. static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session)
  122. {
  123. struct pppol2tp_session *ps = l2tp_session_priv(session);
  124. struct sock *sk;
  125. rcu_read_lock();
  126. sk = rcu_dereference(ps->sk);
  127. if (sk)
  128. sock_hold(sk);
  129. rcu_read_unlock();
  130. return sk;
  131. }
  132. /* Helpers to obtain tunnel/session contexts from sockets.
  133. */
  134. static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk)
  135. {
  136. struct l2tp_session *session;
  137. if (!sk)
  138. return NULL;
  139. sock_hold(sk);
  140. session = (struct l2tp_session *)(sk->sk_user_data);
  141. if (!session) {
  142. sock_put(sk);
  143. goto out;
  144. }
  145. if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) {
  146. session = NULL;
  147. sock_put(sk);
  148. goto out;
  149. }
  150. out:
  151. return session;
  152. }
  153. /*****************************************************************************
  154. * Receive data handling
  155. *****************************************************************************/
  156. /* Receive message. This is the recvmsg for the PPPoL2TP socket.
  157. */
  158. static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg,
  159. size_t len, int flags)
  160. {
  161. int err;
  162. struct sk_buff *skb;
  163. struct sock *sk = sock->sk;
  164. err = -EIO;
  165. if (sk->sk_state & PPPOX_BOUND)
  166. goto end;
  167. err = 0;
  168. skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
  169. flags & MSG_DONTWAIT, &err);
  170. if (!skb)
  171. goto end;
  172. if (len > skb->len)
  173. len = skb->len;
  174. else if (len < skb->len)
  175. msg->msg_flags |= MSG_TRUNC;
  176. err = skb_copy_datagram_msg(skb, 0, msg, len);
  177. if (likely(err == 0))
  178. err = len;
  179. kfree_skb(skb);
  180. end:
  181. return err;
  182. }
  183. static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len)
  184. {
  185. struct pppol2tp_session *ps = l2tp_session_priv(session);
  186. struct sock *sk = NULL;
  187. /* If the socket is bound, send it in to PPP's input queue. Otherwise
  188. * queue it on the session socket.
  189. */
  190. rcu_read_lock();
  191. sk = rcu_dereference(ps->sk);
  192. if (!sk)
  193. goto no_sock;
  194. /* If the first two bytes are 0xFF03, consider that it is the PPP's
  195. * Address and Control fields and skip them. The L2TP module has always
  196. * worked this way, although, in theory, the use of these fields should
  197. * be negociated and handled at the PPP layer. These fields are
  198. * constant: 0xFF is the All-Stations Address and 0x03 the Unnumbered
  199. * Information command with Poll/Final bit set to zero (RFC 1662).
  200. */
  201. if (pskb_may_pull(skb, 2) && skb->data[0] == PPP_ALLSTATIONS &&
  202. skb->data[1] == PPP_UI)
  203. skb_pull(skb, 2);
  204. if (sk->sk_state & PPPOX_BOUND) {
  205. struct pppox_sock *po;
  206. po = pppox_sk(sk);
  207. ppp_input(&po->chan, skb);
  208. } else {
  209. if (sock_queue_rcv_skb(sk, skb) < 0) {
  210. atomic_long_inc(&session->stats.rx_errors);
  211. kfree_skb(skb);
  212. }
  213. }
  214. rcu_read_unlock();
  215. return;
  216. no_sock:
  217. rcu_read_unlock();
  218. pr_warn_ratelimited("%s: no socket in recv\n", session->name);
  219. kfree_skb(skb);
  220. }
  221. /************************************************************************
  222. * Transmit handling
  223. ***********************************************************************/
  224. /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here
  225. * when a user application does a sendmsg() on the session socket. L2TP and
  226. * PPP headers must be inserted into the user's data.
  227. */
  228. static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
  229. size_t total_len)
  230. {
  231. struct sock *sk = sock->sk;
  232. struct sk_buff *skb;
  233. int error;
  234. struct l2tp_session *session;
  235. struct l2tp_tunnel *tunnel;
  236. int uhlen;
  237. error = -ENOTCONN;
  238. if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
  239. goto error;
  240. /* Get session and tunnel contexts */
  241. error = -EBADF;
  242. session = pppol2tp_sock_to_session(sk);
  243. if (!session)
  244. goto error;
  245. tunnel = session->tunnel;
  246. uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
  247. /* Allocate a socket buffer */
  248. error = -ENOMEM;
  249. skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) +
  250. uhlen + session->hdr_len +
  251. 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
  252. 0, GFP_KERNEL);
  253. if (!skb)
  254. goto error_put_sess;
  255. /* Reserve space for headers. */
  256. skb_reserve(skb, NET_SKB_PAD);
  257. skb_reset_network_header(skb);
  258. skb_reserve(skb, sizeof(struct iphdr));
  259. skb_reset_transport_header(skb);
  260. skb_reserve(skb, uhlen);
  261. /* Add PPP header */
  262. skb->data[0] = PPP_ALLSTATIONS;
  263. skb->data[1] = PPP_UI;
  264. skb_put(skb, 2);
  265. /* Copy user data into skb */
  266. error = memcpy_from_msg(skb_put(skb, total_len), m, total_len);
  267. if (error < 0) {
  268. kfree_skb(skb);
  269. goto error_put_sess;
  270. }
  271. local_bh_disable();
  272. l2tp_xmit_skb(session, skb);
  273. local_bh_enable();
  274. sock_put(sk);
  275. return total_len;
  276. error_put_sess:
  277. sock_put(sk);
  278. error:
  279. return error;
  280. }
  281. /* Transmit function called by generic PPP driver. Sends PPP frame
  282. * over PPPoL2TP socket.
  283. *
  284. * This is almost the same as pppol2tp_sendmsg(), but rather than
  285. * being called with a msghdr from userspace, it is called with a skb
  286. * from the kernel.
  287. *
  288. * The supplied skb from ppp doesn't have enough headroom for the
  289. * insertion of L2TP, UDP and IP headers so we need to allocate more
  290. * headroom in the skb. This will create a cloned skb. But we must be
  291. * careful in the error case because the caller will expect to free
  292. * the skb it supplied, not our cloned skb. So we take care to always
  293. * leave the original skb unfreed if we return an error.
  294. */
  295. static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
  296. {
  297. struct sock *sk = (struct sock *)chan->private;
  298. struct l2tp_session *session;
  299. struct l2tp_tunnel *tunnel;
  300. int uhlen, headroom;
  301. if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
  302. goto abort;
  303. /* Get session and tunnel contexts from the socket */
  304. session = pppol2tp_sock_to_session(sk);
  305. if (!session)
  306. goto abort;
  307. tunnel = session->tunnel;
  308. uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
  309. headroom = NET_SKB_PAD +
  310. sizeof(struct iphdr) + /* IP header */
  311. uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */
  312. session->hdr_len + /* L2TP header */
  313. 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
  314. if (skb_cow_head(skb, headroom))
  315. goto abort_put_sess;
  316. /* Setup PPP header */
  317. __skb_push(skb, 2);
  318. skb->data[0] = PPP_ALLSTATIONS;
  319. skb->data[1] = PPP_UI;
  320. local_bh_disable();
  321. l2tp_xmit_skb(session, skb);
  322. local_bh_enable();
  323. sock_put(sk);
  324. return 1;
  325. abort_put_sess:
  326. sock_put(sk);
  327. abort:
  328. /* Free the original skb */
  329. kfree_skb(skb);
  330. return 1;
  331. }
  332. /*****************************************************************************
  333. * Session (and tunnel control) socket create/destroy.
  334. *****************************************************************************/
  335. static void pppol2tp_put_sk(struct rcu_head *head)
  336. {
  337. struct pppol2tp_session *ps;
  338. ps = container_of(head, typeof(*ps), rcu);
  339. sock_put(ps->__sk);
  340. }
  341. /* Really kill the session socket. (Called from sock_put() if
  342. * refcnt == 0.)
  343. */
  344. static void pppol2tp_session_destruct(struct sock *sk)
  345. {
  346. struct l2tp_session *session = sk->sk_user_data;
  347. skb_queue_purge(&sk->sk_receive_queue);
  348. skb_queue_purge(&sk->sk_write_queue);
  349. if (session) {
  350. sk->sk_user_data = NULL;
  351. if (WARN_ON(session->magic != L2TP_SESSION_MAGIC))
  352. return;
  353. l2tp_session_dec_refcount(session);
  354. }
  355. }
  356. /* Called when the PPPoX socket (session) is closed.
  357. */
  358. static int pppol2tp_release(struct socket *sock)
  359. {
  360. struct sock *sk = sock->sk;
  361. struct l2tp_session *session;
  362. int error;
  363. if (!sk)
  364. return 0;
  365. error = -EBADF;
  366. lock_sock(sk);
  367. if (sock_flag(sk, SOCK_DEAD) != 0)
  368. goto error;
  369. pppox_unbind_sock(sk);
  370. /* Signal the death of the socket. */
  371. sk->sk_state = PPPOX_DEAD;
  372. sock_orphan(sk);
  373. sock->sk = NULL;
  374. session = pppol2tp_sock_to_session(sk);
  375. if (session) {
  376. struct pppol2tp_session *ps;
  377. l2tp_session_delete(session);
  378. ps = l2tp_session_priv(session);
  379. mutex_lock(&ps->sk_lock);
  380. ps->__sk = rcu_dereference_protected(ps->sk,
  381. lockdep_is_held(&ps->sk_lock));
  382. RCU_INIT_POINTER(ps->sk, NULL);
  383. mutex_unlock(&ps->sk_lock);
  384. call_rcu(&ps->rcu, pppol2tp_put_sk);
  385. /* Rely on the sock_put() call at the end of the function for
  386. * dropping the reference held by pppol2tp_sock_to_session().
  387. * The last reference will be dropped by pppol2tp_put_sk().
  388. */
  389. }
  390. release_sock(sk);
  391. /* This will delete the session context via
  392. * pppol2tp_session_destruct() if the socket's refcnt drops to
  393. * zero.
  394. */
  395. sock_put(sk);
  396. return 0;
  397. error:
  398. release_sock(sk);
  399. return error;
  400. }
  401. static struct proto pppol2tp_sk_proto = {
  402. .name = "PPPOL2TP",
  403. .owner = THIS_MODULE,
  404. .obj_size = sizeof(struct pppox_sock),
  405. };
  406. static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb)
  407. {
  408. int rc;
  409. rc = l2tp_udp_encap_recv(sk, skb);
  410. if (rc)
  411. kfree_skb(skb);
  412. return NET_RX_SUCCESS;
  413. }
  414. /* socket() handler. Initialize a new struct sock.
  415. */
  416. static int pppol2tp_create(struct net *net, struct socket *sock, int kern)
  417. {
  418. int error = -ENOMEM;
  419. struct sock *sk;
  420. sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern);
  421. if (!sk)
  422. goto out;
  423. sock_init_data(sock, sk);
  424. sock->state = SS_UNCONNECTED;
  425. sock->ops = &pppol2tp_ops;
  426. sk->sk_backlog_rcv = pppol2tp_backlog_recv;
  427. sk->sk_protocol = PX_PROTO_OL2TP;
  428. sk->sk_family = PF_PPPOX;
  429. sk->sk_state = PPPOX_NONE;
  430. sk->sk_type = SOCK_STREAM;
  431. sk->sk_destruct = pppol2tp_session_destruct;
  432. error = 0;
  433. out:
  434. return error;
  435. }
  436. static void pppol2tp_show(struct seq_file *m, void *arg)
  437. {
  438. struct l2tp_session *session = arg;
  439. struct sock *sk;
  440. sk = pppol2tp_session_get_sock(session);
  441. if (sk) {
  442. struct pppox_sock *po = pppox_sk(sk);
  443. seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan));
  444. sock_put(sk);
  445. }
  446. }
  447. static void pppol2tp_session_init(struct l2tp_session *session)
  448. {
  449. struct pppol2tp_session *ps;
  450. session->recv_skb = pppol2tp_recv;
  451. if (IS_ENABLED(CONFIG_L2TP_DEBUGFS))
  452. session->show = pppol2tp_show;
  453. ps = l2tp_session_priv(session);
  454. mutex_init(&ps->sk_lock);
  455. ps->owner = current->pid;
  456. }
  457. struct l2tp_connect_info {
  458. u8 version;
  459. int fd;
  460. u32 tunnel_id;
  461. u32 peer_tunnel_id;
  462. u32 session_id;
  463. u32 peer_session_id;
  464. };
  465. static int pppol2tp_sockaddr_get_info(const void *sa, int sa_len,
  466. struct l2tp_connect_info *info)
  467. {
  468. switch (sa_len) {
  469. case sizeof(struct sockaddr_pppol2tp):
  470. {
  471. const struct sockaddr_pppol2tp *sa_v2in4 = sa;
  472. if (sa_v2in4->sa_protocol != PX_PROTO_OL2TP)
  473. return -EINVAL;
  474. info->version = 2;
  475. info->fd = sa_v2in4->pppol2tp.fd;
  476. info->tunnel_id = sa_v2in4->pppol2tp.s_tunnel;
  477. info->peer_tunnel_id = sa_v2in4->pppol2tp.d_tunnel;
  478. info->session_id = sa_v2in4->pppol2tp.s_session;
  479. info->peer_session_id = sa_v2in4->pppol2tp.d_session;
  480. break;
  481. }
  482. case sizeof(struct sockaddr_pppol2tpv3):
  483. {
  484. const struct sockaddr_pppol2tpv3 *sa_v3in4 = sa;
  485. if (sa_v3in4->sa_protocol != PX_PROTO_OL2TP)
  486. return -EINVAL;
  487. info->version = 3;
  488. info->fd = sa_v3in4->pppol2tp.fd;
  489. info->tunnel_id = sa_v3in4->pppol2tp.s_tunnel;
  490. info->peer_tunnel_id = sa_v3in4->pppol2tp.d_tunnel;
  491. info->session_id = sa_v3in4->pppol2tp.s_session;
  492. info->peer_session_id = sa_v3in4->pppol2tp.d_session;
  493. break;
  494. }
  495. case sizeof(struct sockaddr_pppol2tpin6):
  496. {
  497. const struct sockaddr_pppol2tpin6 *sa_v2in6 = sa;
  498. if (sa_v2in6->sa_protocol != PX_PROTO_OL2TP)
  499. return -EINVAL;
  500. info->version = 2;
  501. info->fd = sa_v2in6->pppol2tp.fd;
  502. info->tunnel_id = sa_v2in6->pppol2tp.s_tunnel;
  503. info->peer_tunnel_id = sa_v2in6->pppol2tp.d_tunnel;
  504. info->session_id = sa_v2in6->pppol2tp.s_session;
  505. info->peer_session_id = sa_v2in6->pppol2tp.d_session;
  506. break;
  507. }
  508. case sizeof(struct sockaddr_pppol2tpv3in6):
  509. {
  510. const struct sockaddr_pppol2tpv3in6 *sa_v3in6 = sa;
  511. if (sa_v3in6->sa_protocol != PX_PROTO_OL2TP)
  512. return -EINVAL;
  513. info->version = 3;
  514. info->fd = sa_v3in6->pppol2tp.fd;
  515. info->tunnel_id = sa_v3in6->pppol2tp.s_tunnel;
  516. info->peer_tunnel_id = sa_v3in6->pppol2tp.d_tunnel;
  517. info->session_id = sa_v3in6->pppol2tp.s_session;
  518. info->peer_session_id = sa_v3in6->pppol2tp.d_session;
  519. break;
  520. }
  521. default:
  522. return -EINVAL;
  523. }
  524. return 0;
  525. }
  526. /* Rough estimation of the maximum payload size a tunnel can transmit without
  527. * fragmenting at the lower IP layer. Assumes L2TPv2 with sequence
  528. * numbers and no IP option. Not quite accurate, but the result is mostly
  529. * unused anyway.
  530. */
  531. static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel)
  532. {
  533. int mtu;
  534. mtu = l2tp_tunnel_dst_mtu(tunnel);
  535. if (mtu <= PPPOL2TP_HEADER_OVERHEAD)
  536. return 1500 - PPPOL2TP_HEADER_OVERHEAD;
  537. return mtu - PPPOL2TP_HEADER_OVERHEAD;
  538. }
  539. /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
  540. */
  541. static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
  542. int sockaddr_len, int flags)
  543. {
  544. struct sock *sk = sock->sk;
  545. struct pppox_sock *po = pppox_sk(sk);
  546. struct l2tp_session *session = NULL;
  547. struct l2tp_connect_info info;
  548. struct l2tp_tunnel *tunnel;
  549. struct pppol2tp_session *ps;
  550. struct l2tp_session_cfg cfg = { 0, };
  551. bool drop_refcnt = false;
  552. bool drop_tunnel = false;
  553. bool new_session = false;
  554. bool new_tunnel = false;
  555. int error;
  556. error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info);
  557. if (error < 0)
  558. return error;
  559. lock_sock(sk);
  560. /* Check for already bound sockets */
  561. error = -EBUSY;
  562. if (sk->sk_state & PPPOX_CONNECTED)
  563. goto end;
  564. /* We don't supporting rebinding anyway */
  565. error = -EALREADY;
  566. if (sk->sk_user_data)
  567. goto end; /* socket is already attached */
  568. /* Don't bind if tunnel_id is 0 */
  569. error = -EINVAL;
  570. if (!info.tunnel_id)
  571. goto end;
  572. tunnel = l2tp_tunnel_get(sock_net(sk), info.tunnel_id);
  573. if (tunnel)
  574. drop_tunnel = true;
  575. /* Special case: create tunnel context if session_id and
  576. * peer_session_id is 0. Otherwise look up tunnel using supplied
  577. * tunnel id.
  578. */
  579. if (!info.session_id && !info.peer_session_id) {
  580. if (!tunnel) {
  581. struct l2tp_tunnel_cfg tcfg = {
  582. .encap = L2TP_ENCAPTYPE_UDP,
  583. };
  584. /* Prevent l2tp_tunnel_register() from trying to set up
  585. * a kernel socket.
  586. */
  587. if (info.fd < 0) {
  588. error = -EBADF;
  589. goto end;
  590. }
  591. error = l2tp_tunnel_create(info.fd,
  592. info.version,
  593. info.tunnel_id,
  594. info.peer_tunnel_id, &tcfg,
  595. &tunnel);
  596. if (error < 0)
  597. goto end;
  598. l2tp_tunnel_inc_refcount(tunnel);
  599. error = l2tp_tunnel_register(tunnel, sock_net(sk),
  600. &tcfg);
  601. if (error < 0) {
  602. kfree(tunnel);
  603. goto end;
  604. }
  605. drop_tunnel = true;
  606. new_tunnel = true;
  607. }
  608. } else {
  609. /* Error if we can't find the tunnel */
  610. error = -ENOENT;
  611. if (!tunnel)
  612. goto end;
  613. /* Error if socket is not prepped */
  614. if (!tunnel->sock)
  615. goto end;
  616. }
  617. if (tunnel->peer_tunnel_id == 0)
  618. tunnel->peer_tunnel_id = info.peer_tunnel_id;
  619. session = l2tp_tunnel_get_session(tunnel, info.session_id);
  620. if (session) {
  621. drop_refcnt = true;
  622. if (session->pwtype != L2TP_PWTYPE_PPP) {
  623. error = -EPROTOTYPE;
  624. goto end;
  625. }
  626. ps = l2tp_session_priv(session);
  627. /* Using a pre-existing session is fine as long as it hasn't
  628. * been connected yet.
  629. */
  630. mutex_lock(&ps->sk_lock);
  631. if (rcu_dereference_protected(ps->sk,
  632. lockdep_is_held(&ps->sk_lock)) ||
  633. ps->__sk) {
  634. mutex_unlock(&ps->sk_lock);
  635. error = -EEXIST;
  636. goto end;
  637. }
  638. } else {
  639. cfg.pw_type = L2TP_PWTYPE_PPP;
  640. session = l2tp_session_create(sizeof(struct pppol2tp_session),
  641. tunnel, info.session_id,
  642. info.peer_session_id, &cfg);
  643. if (IS_ERR(session)) {
  644. error = PTR_ERR(session);
  645. goto end;
  646. }
  647. pppol2tp_session_init(session);
  648. ps = l2tp_session_priv(session);
  649. l2tp_session_inc_refcount(session);
  650. mutex_lock(&ps->sk_lock);
  651. error = l2tp_session_register(session, tunnel);
  652. if (error < 0) {
  653. mutex_unlock(&ps->sk_lock);
  654. kfree(session);
  655. goto end;
  656. }
  657. drop_refcnt = true;
  658. new_session = true;
  659. }
  660. /* Special case: if source & dest session_id == 0x0000, this
  661. * socket is being created to manage the tunnel. Just set up
  662. * the internal context for use by ioctl() and sockopt()
  663. * handlers.
  664. */
  665. if (session->session_id == 0 && session->peer_session_id == 0) {
  666. error = 0;
  667. goto out_no_ppp;
  668. }
  669. /* The only header we need to worry about is the L2TP
  670. * header. This size is different depending on whether
  671. * sequence numbers are enabled for the data channel.
  672. */
  673. po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
  674. po->chan.private = sk;
  675. po->chan.ops = &pppol2tp_chan_ops;
  676. po->chan.mtu = pppol2tp_tunnel_mtu(tunnel);
  677. error = ppp_register_net_channel(sock_net(sk), &po->chan);
  678. if (error) {
  679. mutex_unlock(&ps->sk_lock);
  680. goto end;
  681. }
  682. out_no_ppp:
  683. /* This is how we get the session context from the socket. */
  684. sk->sk_user_data = session;
  685. rcu_assign_pointer(ps->sk, sk);
  686. mutex_unlock(&ps->sk_lock);
  687. /* Keep the reference we've grabbed on the session: sk doesn't expect
  688. * the session to disappear. pppol2tp_session_destruct() is responsible
  689. * for dropping it.
  690. */
  691. drop_refcnt = false;
  692. sk->sk_state = PPPOX_CONNECTED;
  693. end:
  694. if (error) {
  695. if (new_session)
  696. l2tp_session_delete(session);
  697. if (new_tunnel)
  698. l2tp_tunnel_delete(tunnel);
  699. }
  700. if (drop_refcnt)
  701. l2tp_session_dec_refcount(session);
  702. if (drop_tunnel)
  703. l2tp_tunnel_dec_refcount(tunnel);
  704. release_sock(sk);
  705. return error;
  706. }
  707. #ifdef CONFIG_L2TP_V3
  708. /* Called when creating sessions via the netlink interface. */
  709. static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel,
  710. u32 session_id, u32 peer_session_id,
  711. struct l2tp_session_cfg *cfg)
  712. {
  713. int error;
  714. struct l2tp_session *session;
  715. /* Error if tunnel socket is not prepped */
  716. if (!tunnel->sock) {
  717. error = -ENOENT;
  718. goto err;
  719. }
  720. /* Allocate and initialize a new session context. */
  721. session = l2tp_session_create(sizeof(struct pppol2tp_session),
  722. tunnel, session_id,
  723. peer_session_id, cfg);
  724. if (IS_ERR(session)) {
  725. error = PTR_ERR(session);
  726. goto err;
  727. }
  728. pppol2tp_session_init(session);
  729. error = l2tp_session_register(session, tunnel);
  730. if (error < 0)
  731. goto err_sess;
  732. return 0;
  733. err_sess:
  734. kfree(session);
  735. err:
  736. return error;
  737. }
  738. #endif /* CONFIG_L2TP_V3 */
  739. /* getname() support.
  740. */
  741. static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
  742. int peer)
  743. {
  744. int len = 0;
  745. int error = 0;
  746. struct l2tp_session *session;
  747. struct l2tp_tunnel *tunnel;
  748. struct sock *sk = sock->sk;
  749. struct inet_sock *inet;
  750. struct pppol2tp_session *pls;
  751. error = -ENOTCONN;
  752. if (!sk)
  753. goto end;
  754. if (!(sk->sk_state & PPPOX_CONNECTED))
  755. goto end;
  756. error = -EBADF;
  757. session = pppol2tp_sock_to_session(sk);
  758. if (!session)
  759. goto end;
  760. pls = l2tp_session_priv(session);
  761. tunnel = session->tunnel;
  762. inet = inet_sk(tunnel->sock);
  763. if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET) {
  764. struct sockaddr_pppol2tp sp;
  765. len = sizeof(sp);
  766. memset(&sp, 0, len);
  767. sp.sa_family = AF_PPPOX;
  768. sp.sa_protocol = PX_PROTO_OL2TP;
  769. sp.pppol2tp.fd = tunnel->fd;
  770. sp.pppol2tp.pid = pls->owner;
  771. sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
  772. sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
  773. sp.pppol2tp.s_session = session->session_id;
  774. sp.pppol2tp.d_session = session->peer_session_id;
  775. sp.pppol2tp.addr.sin_family = AF_INET;
  776. sp.pppol2tp.addr.sin_port = inet->inet_dport;
  777. sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
  778. memcpy(uaddr, &sp, len);
  779. #if IS_ENABLED(CONFIG_IPV6)
  780. } else if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET6) {
  781. struct sockaddr_pppol2tpin6 sp;
  782. len = sizeof(sp);
  783. memset(&sp, 0, len);
  784. sp.sa_family = AF_PPPOX;
  785. sp.sa_protocol = PX_PROTO_OL2TP;
  786. sp.pppol2tp.fd = tunnel->fd;
  787. sp.pppol2tp.pid = pls->owner;
  788. sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
  789. sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
  790. sp.pppol2tp.s_session = session->session_id;
  791. sp.pppol2tp.d_session = session->peer_session_id;
  792. sp.pppol2tp.addr.sin6_family = AF_INET6;
  793. sp.pppol2tp.addr.sin6_port = inet->inet_dport;
  794. memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
  795. sizeof(tunnel->sock->sk_v6_daddr));
  796. memcpy(uaddr, &sp, len);
  797. } else if (tunnel->version == 3 && tunnel->sock->sk_family == AF_INET6) {
  798. struct sockaddr_pppol2tpv3in6 sp;
  799. len = sizeof(sp);
  800. memset(&sp, 0, len);
  801. sp.sa_family = AF_PPPOX;
  802. sp.sa_protocol = PX_PROTO_OL2TP;
  803. sp.pppol2tp.fd = tunnel->fd;
  804. sp.pppol2tp.pid = pls->owner;
  805. sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
  806. sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
  807. sp.pppol2tp.s_session = session->session_id;
  808. sp.pppol2tp.d_session = session->peer_session_id;
  809. sp.pppol2tp.addr.sin6_family = AF_INET6;
  810. sp.pppol2tp.addr.sin6_port = inet->inet_dport;
  811. memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
  812. sizeof(tunnel->sock->sk_v6_daddr));
  813. memcpy(uaddr, &sp, len);
  814. #endif
  815. } else if (tunnel->version == 3) {
  816. struct sockaddr_pppol2tpv3 sp;
  817. len = sizeof(sp);
  818. memset(&sp, 0, len);
  819. sp.sa_family = AF_PPPOX;
  820. sp.sa_protocol = PX_PROTO_OL2TP;
  821. sp.pppol2tp.fd = tunnel->fd;
  822. sp.pppol2tp.pid = pls->owner;
  823. sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
  824. sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
  825. sp.pppol2tp.s_session = session->session_id;
  826. sp.pppol2tp.d_session = session->peer_session_id;
  827. sp.pppol2tp.addr.sin_family = AF_INET;
  828. sp.pppol2tp.addr.sin_port = inet->inet_dport;
  829. sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
  830. memcpy(uaddr, &sp, len);
  831. }
  832. error = len;
  833. sock_put(sk);
  834. end:
  835. return error;
  836. }
  837. /****************************************************************************
  838. * ioctl() handlers.
  839. *
  840. * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
  841. * sockets. However, in order to control kernel tunnel features, we allow
  842. * userspace to create a special "tunnel" PPPoX socket which is used for
  843. * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow
  844. * the user application to issue L2TP setsockopt(), getsockopt() and ioctl()
  845. * calls.
  846. ****************************************************************************/
  847. static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest,
  848. const struct l2tp_stats *stats)
  849. {
  850. memset(dest, 0, sizeof(*dest));
  851. dest->tx_packets = atomic_long_read(&stats->tx_packets);
  852. dest->tx_bytes = atomic_long_read(&stats->tx_bytes);
  853. dest->tx_errors = atomic_long_read(&stats->tx_errors);
  854. dest->rx_packets = atomic_long_read(&stats->rx_packets);
  855. dest->rx_bytes = atomic_long_read(&stats->rx_bytes);
  856. dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards);
  857. dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets);
  858. dest->rx_errors = atomic_long_read(&stats->rx_errors);
  859. }
  860. static int pppol2tp_tunnel_copy_stats(struct pppol2tp_ioc_stats *stats,
  861. struct l2tp_tunnel *tunnel)
  862. {
  863. struct l2tp_session *session;
  864. if (!stats->session_id) {
  865. pppol2tp_copy_stats(stats, &tunnel->stats);
  866. return 0;
  867. }
  868. /* If session_id is set, search the corresponding session in the
  869. * context of this tunnel and record the session's statistics.
  870. */
  871. session = l2tp_tunnel_get_session(tunnel, stats->session_id);
  872. if (!session)
  873. return -EBADR;
  874. if (session->pwtype != L2TP_PWTYPE_PPP) {
  875. l2tp_session_dec_refcount(session);
  876. return -EBADR;
  877. }
  878. pppol2tp_copy_stats(stats, &session->stats);
  879. l2tp_session_dec_refcount(session);
  880. return 0;
  881. }
  882. static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
  883. unsigned long arg)
  884. {
  885. struct pppol2tp_ioc_stats stats;
  886. struct l2tp_session *session;
  887. switch (cmd) {
  888. case PPPIOCGMRU:
  889. case PPPIOCGFLAGS:
  890. session = sock->sk->sk_user_data;
  891. if (!session)
  892. return -ENOTCONN;
  893. if (WARN_ON(session->magic != L2TP_SESSION_MAGIC))
  894. return -EBADF;
  895. /* Not defined for tunnels */
  896. if (!session->session_id && !session->peer_session_id)
  897. return -ENOSYS;
  898. if (put_user(0, (int __user *)arg))
  899. return -EFAULT;
  900. break;
  901. case PPPIOCSMRU:
  902. case PPPIOCSFLAGS:
  903. session = sock->sk->sk_user_data;
  904. if (!session)
  905. return -ENOTCONN;
  906. if (WARN_ON(session->magic != L2TP_SESSION_MAGIC))
  907. return -EBADF;
  908. /* Not defined for tunnels */
  909. if (!session->session_id && !session->peer_session_id)
  910. return -ENOSYS;
  911. if (!access_ok((int __user *)arg, sizeof(int)))
  912. return -EFAULT;
  913. break;
  914. case PPPIOCGL2TPSTATS:
  915. session = sock->sk->sk_user_data;
  916. if (!session)
  917. return -ENOTCONN;
  918. if (WARN_ON(session->magic != L2TP_SESSION_MAGIC))
  919. return -EBADF;
  920. /* Session 0 represents the parent tunnel */
  921. if (!session->session_id && !session->peer_session_id) {
  922. u32 session_id;
  923. int err;
  924. if (copy_from_user(&stats, (void __user *)arg,
  925. sizeof(stats)))
  926. return -EFAULT;
  927. session_id = stats.session_id;
  928. err = pppol2tp_tunnel_copy_stats(&stats,
  929. session->tunnel);
  930. if (err < 0)
  931. return err;
  932. stats.session_id = session_id;
  933. } else {
  934. pppol2tp_copy_stats(&stats, &session->stats);
  935. stats.session_id = session->session_id;
  936. }
  937. stats.tunnel_id = session->tunnel->tunnel_id;
  938. stats.using_ipsec = l2tp_tunnel_uses_xfrm(session->tunnel);
  939. if (copy_to_user((void __user *)arg, &stats, sizeof(stats)))
  940. return -EFAULT;
  941. break;
  942. default:
  943. return -ENOIOCTLCMD;
  944. }
  945. return 0;
  946. }
  947. /*****************************************************************************
  948. * setsockopt() / getsockopt() support.
  949. *
  950. * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
  951. * sockets. In order to control kernel tunnel features, we allow userspace to
  952. * create a special "tunnel" PPPoX socket which is used for control only.
  953. * Tunnel PPPoX sockets have session_id == 0 and simply allow the user
  954. * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls.
  955. *****************************************************************************/
  956. /* Tunnel setsockopt() helper.
  957. */
  958. static int pppol2tp_tunnel_setsockopt(struct sock *sk,
  959. struct l2tp_tunnel *tunnel,
  960. int optname, int val)
  961. {
  962. int err = 0;
  963. switch (optname) {
  964. case PPPOL2TP_SO_DEBUG:
  965. /* Tunnel debug flags option is deprecated */
  966. break;
  967. default:
  968. err = -ENOPROTOOPT;
  969. break;
  970. }
  971. return err;
  972. }
  973. /* Session setsockopt helper.
  974. */
  975. static int pppol2tp_session_setsockopt(struct sock *sk,
  976. struct l2tp_session *session,
  977. int optname, int val)
  978. {
  979. int err = 0;
  980. switch (optname) {
  981. case PPPOL2TP_SO_RECVSEQ:
  982. if (val != 0 && val != 1) {
  983. err = -EINVAL;
  984. break;
  985. }
  986. session->recv_seq = !!val;
  987. break;
  988. case PPPOL2TP_SO_SENDSEQ:
  989. if (val != 0 && val != 1) {
  990. err = -EINVAL;
  991. break;
  992. }
  993. session->send_seq = !!val;
  994. {
  995. struct pppox_sock *po = pppox_sk(sk);
  996. po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
  997. PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
  998. }
  999. l2tp_session_set_header_len(session, session->tunnel->version);
  1000. break;
  1001. case PPPOL2TP_SO_LNSMODE:
  1002. if (val != 0 && val != 1) {
  1003. err = -EINVAL;
  1004. break;
  1005. }
  1006. session->lns_mode = !!val;
  1007. break;
  1008. case PPPOL2TP_SO_DEBUG:
  1009. /* Session debug flags option is deprecated */
  1010. break;
  1011. case PPPOL2TP_SO_REORDERTO:
  1012. session->reorder_timeout = msecs_to_jiffies(val);
  1013. break;
  1014. default:
  1015. err = -ENOPROTOOPT;
  1016. break;
  1017. }
  1018. return err;
  1019. }
  1020. /* Main setsockopt() entry point.
  1021. * Does API checks, then calls either the tunnel or session setsockopt
  1022. * handler, according to whether the PPPoL2TP socket is a for a regular
  1023. * session or the special tunnel type.
  1024. */
  1025. static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
  1026. sockptr_t optval, unsigned int optlen)
  1027. {
  1028. struct sock *sk = sock->sk;
  1029. struct l2tp_session *session;
  1030. struct l2tp_tunnel *tunnel;
  1031. int val;
  1032. int err;
  1033. if (level != SOL_PPPOL2TP)
  1034. return -EINVAL;
  1035. if (optlen < sizeof(int))
  1036. return -EINVAL;
  1037. if (copy_from_sockptr(&val, optval, sizeof(int)))
  1038. return -EFAULT;
  1039. err = -ENOTCONN;
  1040. if (!sk->sk_user_data)
  1041. goto end;
  1042. /* Get session context from the socket */
  1043. err = -EBADF;
  1044. session = pppol2tp_sock_to_session(sk);
  1045. if (!session)
  1046. goto end;
  1047. /* Special case: if session_id == 0x0000, treat as operation on tunnel
  1048. */
  1049. if (session->session_id == 0 && session->peer_session_id == 0) {
  1050. tunnel = session->tunnel;
  1051. err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
  1052. } else {
  1053. err = pppol2tp_session_setsockopt(sk, session, optname, val);
  1054. }
  1055. sock_put(sk);
  1056. end:
  1057. return err;
  1058. }
  1059. /* Tunnel getsockopt helper. Called with sock locked.
  1060. */
  1061. static int pppol2tp_tunnel_getsockopt(struct sock *sk,
  1062. struct l2tp_tunnel *tunnel,
  1063. int optname, int *val)
  1064. {
  1065. int err = 0;
  1066. switch (optname) {
  1067. case PPPOL2TP_SO_DEBUG:
  1068. /* Tunnel debug flags option is deprecated */
  1069. *val = 0;
  1070. break;
  1071. default:
  1072. err = -ENOPROTOOPT;
  1073. break;
  1074. }
  1075. return err;
  1076. }
  1077. /* Session getsockopt helper. Called with sock locked.
  1078. */
  1079. static int pppol2tp_session_getsockopt(struct sock *sk,
  1080. struct l2tp_session *session,
  1081. int optname, int *val)
  1082. {
  1083. int err = 0;
  1084. switch (optname) {
  1085. case PPPOL2TP_SO_RECVSEQ:
  1086. *val = session->recv_seq;
  1087. break;
  1088. case PPPOL2TP_SO_SENDSEQ:
  1089. *val = session->send_seq;
  1090. break;
  1091. case PPPOL2TP_SO_LNSMODE:
  1092. *val = session->lns_mode;
  1093. break;
  1094. case PPPOL2TP_SO_DEBUG:
  1095. /* Session debug flags option is deprecated */
  1096. *val = 0;
  1097. break;
  1098. case PPPOL2TP_SO_REORDERTO:
  1099. *val = (int)jiffies_to_msecs(session->reorder_timeout);
  1100. break;
  1101. default:
  1102. err = -ENOPROTOOPT;
  1103. }
  1104. return err;
  1105. }
  1106. /* Main getsockopt() entry point.
  1107. * Does API checks, then calls either the tunnel or session getsockopt
  1108. * handler, according to whether the PPPoX socket is a for a regular session
  1109. * or the special tunnel type.
  1110. */
  1111. static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
  1112. char __user *optval, int __user *optlen)
  1113. {
  1114. struct sock *sk = sock->sk;
  1115. struct l2tp_session *session;
  1116. struct l2tp_tunnel *tunnel;
  1117. int val, len;
  1118. int err;
  1119. if (level != SOL_PPPOL2TP)
  1120. return -EINVAL;
  1121. if (get_user(len, optlen))
  1122. return -EFAULT;
  1123. len = min_t(unsigned int, len, sizeof(int));
  1124. if (len < 0)
  1125. return -EINVAL;
  1126. err = -ENOTCONN;
  1127. if (!sk->sk_user_data)
  1128. goto end;
  1129. /* Get the session context */
  1130. err = -EBADF;
  1131. session = pppol2tp_sock_to_session(sk);
  1132. if (!session)
  1133. goto end;
  1134. /* Special case: if session_id == 0x0000, treat as operation on tunnel */
  1135. if (session->session_id == 0 && session->peer_session_id == 0) {
  1136. tunnel = session->tunnel;
  1137. err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
  1138. if (err)
  1139. goto end_put_sess;
  1140. } else {
  1141. err = pppol2tp_session_getsockopt(sk, session, optname, &val);
  1142. if (err)
  1143. goto end_put_sess;
  1144. }
  1145. err = -EFAULT;
  1146. if (put_user(len, optlen))
  1147. goto end_put_sess;
  1148. if (copy_to_user((void __user *)optval, &val, len))
  1149. goto end_put_sess;
  1150. err = 0;
  1151. end_put_sess:
  1152. sock_put(sk);
  1153. end:
  1154. return err;
  1155. }
  1156. /*****************************************************************************
  1157. * /proc filesystem for debug
  1158. * Since the original pppol2tp driver provided /proc/net/pppol2tp for
  1159. * L2TPv2, we dump only L2TPv2 tunnels and sessions here.
  1160. *****************************************************************************/
  1161. static unsigned int pppol2tp_net_id;
  1162. #ifdef CONFIG_PROC_FS
  1163. struct pppol2tp_seq_data {
  1164. struct seq_net_private p;
  1165. int tunnel_idx; /* current tunnel */
  1166. int session_idx; /* index of session within current tunnel */
  1167. struct l2tp_tunnel *tunnel;
  1168. struct l2tp_session *session; /* NULL means get next tunnel */
  1169. };
  1170. static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
  1171. {
  1172. /* Drop reference taken during previous invocation */
  1173. if (pd->tunnel)
  1174. l2tp_tunnel_dec_refcount(pd->tunnel);
  1175. for (;;) {
  1176. pd->tunnel = l2tp_tunnel_get_nth(net, pd->tunnel_idx);
  1177. pd->tunnel_idx++;
  1178. /* Only accept L2TPv2 tunnels */
  1179. if (!pd->tunnel || pd->tunnel->version == 2)
  1180. return;
  1181. l2tp_tunnel_dec_refcount(pd->tunnel);
  1182. }
  1183. }
  1184. static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
  1185. {
  1186. /* Drop reference taken during previous invocation */
  1187. if (pd->session)
  1188. l2tp_session_dec_refcount(pd->session);
  1189. pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx);
  1190. pd->session_idx++;
  1191. if (!pd->session) {
  1192. pd->session_idx = 0;
  1193. pppol2tp_next_tunnel(net, pd);
  1194. }
  1195. }
  1196. static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs)
  1197. {
  1198. struct pppol2tp_seq_data *pd = SEQ_START_TOKEN;
  1199. loff_t pos = *offs;
  1200. struct net *net;
  1201. if (!pos)
  1202. goto out;
  1203. if (WARN_ON(!m->private)) {
  1204. pd = NULL;
  1205. goto out;
  1206. }
  1207. pd = m->private;
  1208. net = seq_file_net(m);
  1209. if (!pd->tunnel)
  1210. pppol2tp_next_tunnel(net, pd);
  1211. else
  1212. pppol2tp_next_session(net, pd);
  1213. /* NULL tunnel and session indicates end of list */
  1214. if (!pd->tunnel && !pd->session)
  1215. pd = NULL;
  1216. out:
  1217. return pd;
  1218. }
  1219. static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos)
  1220. {
  1221. (*pos)++;
  1222. return NULL;
  1223. }
  1224. static void pppol2tp_seq_stop(struct seq_file *p, void *v)
  1225. {
  1226. struct pppol2tp_seq_data *pd = v;
  1227. if (!pd || pd == SEQ_START_TOKEN)
  1228. return;
  1229. /* Drop reference taken by last invocation of pppol2tp_next_session()
  1230. * or pppol2tp_next_tunnel().
  1231. */
  1232. if (pd->session) {
  1233. l2tp_session_dec_refcount(pd->session);
  1234. pd->session = NULL;
  1235. }
  1236. if (pd->tunnel) {
  1237. l2tp_tunnel_dec_refcount(pd->tunnel);
  1238. pd->tunnel = NULL;
  1239. }
  1240. }
  1241. static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
  1242. {
  1243. struct l2tp_tunnel *tunnel = v;
  1244. seq_printf(m, "\nTUNNEL '%s', %c %d\n",
  1245. tunnel->name,
  1246. (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N',
  1247. refcount_read(&tunnel->ref_count) - 1);
  1248. seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n",
  1249. 0,
  1250. atomic_long_read(&tunnel->stats.tx_packets),
  1251. atomic_long_read(&tunnel->stats.tx_bytes),
  1252. atomic_long_read(&tunnel->stats.tx_errors),
  1253. atomic_long_read(&tunnel->stats.rx_packets),
  1254. atomic_long_read(&tunnel->stats.rx_bytes),
  1255. atomic_long_read(&tunnel->stats.rx_errors));
  1256. }
  1257. static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
  1258. {
  1259. struct l2tp_session *session = v;
  1260. struct l2tp_tunnel *tunnel = session->tunnel;
  1261. unsigned char state;
  1262. char user_data_ok;
  1263. struct sock *sk;
  1264. u32 ip = 0;
  1265. u16 port = 0;
  1266. if (tunnel->sock) {
  1267. struct inet_sock *inet = inet_sk(tunnel->sock);
  1268. ip = ntohl(inet->inet_saddr);
  1269. port = ntohs(inet->inet_sport);
  1270. }
  1271. sk = pppol2tp_session_get_sock(session);
  1272. if (sk) {
  1273. state = sk->sk_state;
  1274. user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N';
  1275. } else {
  1276. state = 0;
  1277. user_data_ok = 'N';
  1278. }
  1279. seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> %04X/%04X %d %c\n",
  1280. session->name, ip, port,
  1281. tunnel->tunnel_id,
  1282. session->session_id,
  1283. tunnel->peer_tunnel_id,
  1284. session->peer_session_id,
  1285. state, user_data_ok);
  1286. seq_printf(m, " 0/0/%c/%c/%s %08x %u\n",
  1287. session->recv_seq ? 'R' : '-',
  1288. session->send_seq ? 'S' : '-',
  1289. session->lns_mode ? "LNS" : "LAC",
  1290. 0,
  1291. jiffies_to_msecs(session->reorder_timeout));
  1292. seq_printf(m, " %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n",
  1293. session->nr, session->ns,
  1294. atomic_long_read(&session->stats.tx_packets),
  1295. atomic_long_read(&session->stats.tx_bytes),
  1296. atomic_long_read(&session->stats.tx_errors),
  1297. atomic_long_read(&session->stats.rx_packets),
  1298. atomic_long_read(&session->stats.rx_bytes),
  1299. atomic_long_read(&session->stats.rx_errors));
  1300. if (sk) {
  1301. struct pppox_sock *po = pppox_sk(sk);
  1302. seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan));
  1303. sock_put(sk);
  1304. }
  1305. }
  1306. static int pppol2tp_seq_show(struct seq_file *m, void *v)
  1307. {
  1308. struct pppol2tp_seq_data *pd = v;
  1309. /* display header on line 1 */
  1310. if (v == SEQ_START_TOKEN) {
  1311. seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n");
  1312. seq_puts(m, "TUNNEL name, user-data-ok session-count\n");
  1313. seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
  1314. seq_puts(m, " SESSION name, addr/port src-tid/sid dest-tid/sid state user-data-ok\n");
  1315. seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n");
  1316. seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
  1317. goto out;
  1318. }
  1319. if (!pd->session)
  1320. pppol2tp_seq_tunnel_show(m, pd->tunnel);
  1321. else
  1322. pppol2tp_seq_session_show(m, pd->session);
  1323. out:
  1324. return 0;
  1325. }
  1326. static const struct seq_operations pppol2tp_seq_ops = {
  1327. .start = pppol2tp_seq_start,
  1328. .next = pppol2tp_seq_next,
  1329. .stop = pppol2tp_seq_stop,
  1330. .show = pppol2tp_seq_show,
  1331. };
  1332. #endif /* CONFIG_PROC_FS */
  1333. /*****************************************************************************
  1334. * Network namespace
  1335. *****************************************************************************/
  1336. static __net_init int pppol2tp_init_net(struct net *net)
  1337. {
  1338. struct proc_dir_entry *pde;
  1339. int err = 0;
  1340. pde = proc_create_net("pppol2tp", 0444, net->proc_net,
  1341. &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data));
  1342. if (!pde) {
  1343. err = -ENOMEM;
  1344. goto out;
  1345. }
  1346. out:
  1347. return err;
  1348. }
  1349. static __net_exit void pppol2tp_exit_net(struct net *net)
  1350. {
  1351. remove_proc_entry("pppol2tp", net->proc_net);
  1352. }
  1353. static struct pernet_operations pppol2tp_net_ops = {
  1354. .init = pppol2tp_init_net,
  1355. .exit = pppol2tp_exit_net,
  1356. .id = &pppol2tp_net_id,
  1357. };
  1358. /*****************************************************************************
  1359. * Init and cleanup
  1360. *****************************************************************************/
  1361. static const struct proto_ops pppol2tp_ops = {
  1362. .family = AF_PPPOX,
  1363. .owner = THIS_MODULE,
  1364. .release = pppol2tp_release,
  1365. .bind = sock_no_bind,
  1366. .connect = pppol2tp_connect,
  1367. .socketpair = sock_no_socketpair,
  1368. .accept = sock_no_accept,
  1369. .getname = pppol2tp_getname,
  1370. .poll = datagram_poll,
  1371. .listen = sock_no_listen,
  1372. .shutdown = sock_no_shutdown,
  1373. .setsockopt = pppol2tp_setsockopt,
  1374. .getsockopt = pppol2tp_getsockopt,
  1375. .sendmsg = pppol2tp_sendmsg,
  1376. .recvmsg = pppol2tp_recvmsg,
  1377. .mmap = sock_no_mmap,
  1378. .ioctl = pppox_ioctl,
  1379. #ifdef CONFIG_COMPAT
  1380. .compat_ioctl = pppox_compat_ioctl,
  1381. #endif
  1382. };
  1383. static const struct pppox_proto pppol2tp_proto = {
  1384. .create = pppol2tp_create,
  1385. .ioctl = pppol2tp_ioctl,
  1386. .owner = THIS_MODULE,
  1387. };
  1388. #ifdef CONFIG_L2TP_V3
  1389. static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = {
  1390. .session_create = pppol2tp_session_create,
  1391. .session_delete = l2tp_session_delete,
  1392. };
  1393. #endif /* CONFIG_L2TP_V3 */
  1394. static int __init pppol2tp_init(void)
  1395. {
  1396. int err;
  1397. err = register_pernet_device(&pppol2tp_net_ops);
  1398. if (err)
  1399. goto out;
  1400. err = proto_register(&pppol2tp_sk_proto, 0);
  1401. if (err)
  1402. goto out_unregister_pppol2tp_pernet;
  1403. err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto);
  1404. if (err)
  1405. goto out_unregister_pppol2tp_proto;
  1406. #ifdef CONFIG_L2TP_V3
  1407. err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops);
  1408. if (err)
  1409. goto out_unregister_pppox;
  1410. #endif
  1411. pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION);
  1412. out:
  1413. return err;
  1414. #ifdef CONFIG_L2TP_V3
  1415. out_unregister_pppox:
  1416. unregister_pppox_proto(PX_PROTO_OL2TP);
  1417. #endif
  1418. out_unregister_pppol2tp_proto:
  1419. proto_unregister(&pppol2tp_sk_proto);
  1420. out_unregister_pppol2tp_pernet:
  1421. unregister_pernet_device(&pppol2tp_net_ops);
  1422. goto out;
  1423. }
  1424. static void __exit pppol2tp_exit(void)
  1425. {
  1426. #ifdef CONFIG_L2TP_V3
  1427. l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP);
  1428. #endif
  1429. unregister_pppox_proto(PX_PROTO_OL2TP);
  1430. proto_unregister(&pppol2tp_sk_proto);
  1431. unregister_pernet_device(&pppol2tp_net_ops);
  1432. }
  1433. module_init(pppol2tp_init);
  1434. module_exit(pppol2tp_exit);
  1435. MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
  1436. MODULE_DESCRIPTION("PPP over L2TP over UDP");
  1437. MODULE_LICENSE("GPL");
  1438. MODULE_VERSION(PPPOL2TP_DRV_VERSION);
  1439. MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP);
  1440. MODULE_ALIAS_L2TP_PWTYPE(7);