~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/l2tp/l2tp_ppp.c

Version: ~ [ linux-5.10-rc5 ] ~ [ linux-5.9.10 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.79 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.159 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.208 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.245 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.245 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*****************************************************************************
  2  * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets
  3  *
  4  * PPPoX    --- Generic PPP encapsulation socket family
  5  * PPPoL2TP --- PPP over L2TP (RFC 2661)
  6  *
  7  * Version:     2.0.0
  8  *
  9  * Authors:     James Chapman (jchapman@katalix.com)
 10  *
 11  * Based on original work by Martijn van Oosterhout <kleptog@svana.org>
 12  *
 13  * License:
 14  *              This program is free software; you can redistribute it and/or
 15  *              modify it under the terms of the GNU General Public License
 16  *              as published by the Free Software Foundation; either version
 17  *              2 of the License, or (at your option) any later version.
 18  *
 19  */
 20 
 21 /* This driver handles only L2TP data frames; control frames are handled by a
 22  * userspace application.
 23  *
 24  * To send data in an L2TP session, userspace opens a PPPoL2TP socket and
 25  * attaches it to a bound UDP socket with local tunnel_id / session_id and
 26  * peer tunnel_id / session_id set. Data can then be sent or received using
 27  * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket
 28  * can be read or modified using ioctl() or [gs]etsockopt() calls.
 29  *
 30  * When a PPPoL2TP socket is connected with local and peer session_id values
 31  * zero, the socket is treated as a special tunnel management socket.
 32  *
 33  * Here's example userspace code to create a socket for sending/receiving data
 34  * over an L2TP session:-
 35  *
 36  *      struct sockaddr_pppol2tp sax;
 37  *      int fd;
 38  *      int session_fd;
 39  *
 40  *      fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
 41  *
 42  *      sax.sa_family = AF_PPPOX;
 43  *      sax.sa_protocol = PX_PROTO_OL2TP;
 44  *      sax.pppol2tp.fd = tunnel_fd;    // bound UDP socket
 45  *      sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr;
 46  *      sax.pppol2tp.addr.sin_port = addr->sin_port;
 47  *      sax.pppol2tp.addr.sin_family = AF_INET;
 48  *      sax.pppol2tp.s_tunnel  = tunnel_id;
 49  *      sax.pppol2tp.s_session = session_id;
 50  *      sax.pppol2tp.d_tunnel  = peer_tunnel_id;
 51  *      sax.pppol2tp.d_session = peer_session_id;
 52  *
 53  *      session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax));
 54  *
 55  * A pppd plugin that allows PPP traffic to be carried over L2TP using
 56  * this driver is available from the OpenL2TP project at
 57  * http://openl2tp.sourceforge.net.
 58  */
 59 
 60 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 61 
 62 #include <linux/module.h>
 63 #include <linux/string.h>
 64 #include <linux/list.h>
 65 #include <linux/uaccess.h>
 66 
 67 #include <linux/kernel.h>
 68 #include <linux/spinlock.h>
 69 #include <linux/kthread.h>
 70 #include <linux/sched.h>
 71 #include <linux/slab.h>
 72 #include <linux/errno.h>
 73 #include <linux/jiffies.h>
 74 
 75 #include <linux/netdevice.h>
 76 #include <linux/net.h>
 77 #include <linux/inetdevice.h>
 78 #include <linux/skbuff.h>
 79 #include <linux/init.h>
 80 #include <linux/ip.h>
 81 #include <linux/udp.h>
 82 #include <linux/if_pppox.h>
 83 #include <linux/if_pppol2tp.h>
 84 #include <net/sock.h>
 85 #include <linux/ppp_channel.h>
 86 #include <linux/ppp_defs.h>
 87 #include <linux/ppp-ioctl.h>
 88 #include <linux/file.h>
 89 #include <linux/hash.h>
 90 #include <linux/sort.h>
 91 #include <linux/proc_fs.h>
 92 #include <linux/l2tp.h>
 93 #include <linux/nsproxy.h>
 94 #include <net/net_namespace.h>
 95 #include <net/netns/generic.h>
 96 #include <net/dst.h>
 97 #include <net/ip.h>
 98 #include <net/udp.h>
 99 #include <net/xfrm.h>
100 #include <net/inet_common.h>
101 
102 #include <asm/byteorder.h>
103 #include <linux/atomic.h>
104 
105 #include "l2tp_core.h"
106 
107 #define PPPOL2TP_DRV_VERSION    "V2.0"
108 
109 /* Space for UDP, L2TP and PPP headers */
110 #define PPPOL2TP_HEADER_OVERHEAD        40
111 
112 /* Number of bytes to build transmit L2TP headers.
113  * Unfortunately the size is different depending on whether sequence numbers
114  * are enabled.
115  */
116 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ              10
117 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ            6
118 
119 /* Private data of each session. This data lives at the end of struct
120  * l2tp_session, referenced via session->priv[].
121  */
122 struct pppol2tp_session {
123         int                     owner;          /* pid that opened the socket */
124 
125         struct mutex            sk_lock;        /* Protects .sk */
126         struct sock __rcu       *sk;            /* Pointer to the session
127                                                  * PPPoX socket */
128         struct sock             *__sk;          /* Copy of .sk, for cleanup */
129         struct rcu_head         rcu;            /* For asynchronous release */
130         int                     flags;          /* accessed by PPPIOCGFLAGS.
131                                                  * Unused. */
132 };
133 
134 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);
135 
136 static const struct ppp_channel_ops pppol2tp_chan_ops = {
137         .start_xmit =  pppol2tp_xmit,
138 };
139 
140 static const struct proto_ops pppol2tp_ops;
141 
142 /* Retrieves the pppol2tp socket associated to a session.
143  * A reference is held on the returned socket, so this function must be paired
144  * with sock_put().
145  */
146 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session)
147 {
148         struct pppol2tp_session *ps = l2tp_session_priv(session);
149         struct sock *sk;
150 
151         rcu_read_lock();
152         sk = rcu_dereference(ps->sk);
153         if (sk)
154                 sock_hold(sk);
155         rcu_read_unlock();
156 
157         return sk;
158 }
159 
160 /* Helpers to obtain tunnel/session contexts from sockets.
161  */
162 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk)
163 {
164         struct l2tp_session *session;
165 
166         if (sk == NULL)
167                 return NULL;
168 
169         sock_hold(sk);
170         session = (struct l2tp_session *)(sk->sk_user_data);
171         if (session == NULL) {
172                 sock_put(sk);
173                 goto out;
174         }
175 
176         BUG_ON(session->magic != L2TP_SESSION_MAGIC);
177 
178 out:
179         return session;
180 }
181 
182 /*****************************************************************************
183  * Receive data handling
184  *****************************************************************************/
185 
186 static int pppol2tp_recv_payload_hook(struct sk_buff *skb)
187 {
188         /* Skip PPP header, if present.  In testing, Microsoft L2TP clients
189          * don't send the PPP header (PPP header compression enabled), but
190          * other clients can include the header. So we cope with both cases
191          * here. The PPP header is always FF03 when using L2TP.
192          *
193          * Note that skb->data[] isn't dereferenced from a u16 ptr here since
194          * the field may be unaligned.
195          */
196         if (!pskb_may_pull(skb, 2))
197                 return 1;
198 
199         if ((skb->data[0] == PPP_ALLSTATIONS) && (skb->data[1] == PPP_UI))
200                 skb_pull(skb, 2);
201 
202         return 0;
203 }
204 
205 /* Receive message. This is the recvmsg for the PPPoL2TP socket.
206  */
207 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg,
208                             size_t len, int flags)
209 {
210         int err;
211         struct sk_buff *skb;
212         struct sock *sk = sock->sk;
213 
214         err = -EIO;
215         if (sk->sk_state & PPPOX_BOUND)
216                 goto end;
217 
218         err = 0;
219         skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
220                                 flags & MSG_DONTWAIT, &err);
221         if (!skb)
222                 goto end;
223 
224         if (len > skb->len)
225                 len = skb->len;
226         else if (len < skb->len)
227                 msg->msg_flags |= MSG_TRUNC;
228 
229         err = skb_copy_datagram_msg(skb, 0, msg, len);
230         if (likely(err == 0))
231                 err = len;
232 
233         kfree_skb(skb);
234 end:
235         return err;
236 }
237 
238 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len)
239 {
240         struct pppol2tp_session *ps = l2tp_session_priv(session);
241         struct sock *sk = NULL;
242 
243         /* If the socket is bound, send it in to PPP's input queue. Otherwise
244          * queue it on the session socket.
245          */
246         rcu_read_lock();
247         sk = rcu_dereference(ps->sk);
248         if (sk == NULL)
249                 goto no_sock;
250 
251         if (sk->sk_state & PPPOX_BOUND) {
252                 struct pppox_sock *po;
253 
254                 l2tp_dbg(session, L2TP_MSG_DATA,
255                          "%s: recv %d byte data frame, passing to ppp\n",
256                          session->name, data_len);
257 
258                 po = pppox_sk(sk);
259                 ppp_input(&po->chan, skb);
260         } else {
261                 l2tp_dbg(session, L2TP_MSG_DATA,
262                          "%s: recv %d byte data frame, passing to L2TP socket\n",
263                          session->name, data_len);
264 
265                 if (sock_queue_rcv_skb(sk, skb) < 0) {
266                         atomic_long_inc(&session->stats.rx_errors);
267                         kfree_skb(skb);
268                 }
269         }
270         rcu_read_unlock();
271 
272         return;
273 
274 no_sock:
275         rcu_read_unlock();
276         l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name);
277         kfree_skb(skb);
278 }
279 
280 /************************************************************************
281  * Transmit handling
282  ***********************************************************************/
283 
284 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket.  We come here
285  * when a user application does a sendmsg() on the session socket. L2TP and
286  * PPP headers must be inserted into the user's data.
287  */
288 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
289                             size_t total_len)
290 {
291         struct sock *sk = sock->sk;
292         struct sk_buff *skb;
293         int error;
294         struct l2tp_session *session;
295         struct l2tp_tunnel *tunnel;
296         int uhlen;
297 
298         error = -ENOTCONN;
299         if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
300                 goto error;
301 
302         /* Get session and tunnel contexts */
303         error = -EBADF;
304         session = pppol2tp_sock_to_session(sk);
305         if (session == NULL)
306                 goto error;
307 
308         tunnel = session->tunnel;
309 
310         uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
311 
312         /* Allocate a socket buffer */
313         error = -ENOMEM;
314         skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) +
315                            uhlen + session->hdr_len +
316                            2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
317                            0, GFP_KERNEL);
318         if (!skb)
319                 goto error_put_sess;
320 
321         /* Reserve space for headers. */
322         skb_reserve(skb, NET_SKB_PAD);
323         skb_reset_network_header(skb);
324         skb_reserve(skb, sizeof(struct iphdr));
325         skb_reset_transport_header(skb);
326         skb_reserve(skb, uhlen);
327 
328         /* Add PPP header */
329         skb->data[0] = PPP_ALLSTATIONS;
330         skb->data[1] = PPP_UI;
331         skb_put(skb, 2);
332 
333         /* Copy user data into skb */
334         error = memcpy_from_msg(skb_put(skb, total_len), m, total_len);
335         if (error < 0) {
336                 kfree_skb(skb);
337                 goto error_put_sess;
338         }
339 
340         local_bh_disable();
341         l2tp_xmit_skb(session, skb, session->hdr_len);
342         local_bh_enable();
343 
344         sock_put(sk);
345 
346         return total_len;
347 
348 error_put_sess:
349         sock_put(sk);
350 error:
351         return error;
352 }
353 
354 /* Transmit function called by generic PPP driver.  Sends PPP frame
355  * over PPPoL2TP socket.
356  *
357  * This is almost the same as pppol2tp_sendmsg(), but rather than
358  * being called with a msghdr from userspace, it is called with a skb
359  * from the kernel.
360  *
361  * The supplied skb from ppp doesn't have enough headroom for the
362  * insertion of L2TP, UDP and IP headers so we need to allocate more
363  * headroom in the skb. This will create a cloned skb. But we must be
364  * careful in the error case because the caller will expect to free
365  * the skb it supplied, not our cloned skb. So we take care to always
366  * leave the original skb unfreed if we return an error.
367  */
368 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
369 {
370         struct sock *sk = (struct sock *) chan->private;
371         struct l2tp_session *session;
372         struct l2tp_tunnel *tunnel;
373         int uhlen, headroom;
374 
375         if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
376                 goto abort;
377 
378         /* Get session and tunnel contexts from the socket */
379         session = pppol2tp_sock_to_session(sk);
380         if (session == NULL)
381                 goto abort;
382 
383         tunnel = session->tunnel;
384 
385         uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
386         headroom = NET_SKB_PAD +
387                    sizeof(struct iphdr) + /* IP header */
388                    uhlen +              /* UDP header (if L2TP_ENCAPTYPE_UDP) */
389                    session->hdr_len +   /* L2TP header */
390                    2;                   /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
391         if (skb_cow_head(skb, headroom))
392                 goto abort_put_sess;
393 
394         /* Setup PPP header */
395         __skb_push(skb, 2);
396         skb->data[0] = PPP_ALLSTATIONS;
397         skb->data[1] = PPP_UI;
398 
399         local_bh_disable();
400         l2tp_xmit_skb(session, skb, session->hdr_len);
401         local_bh_enable();
402 
403         sock_put(sk);
404 
405         return 1;
406 
407 abort_put_sess:
408         sock_put(sk);
409 abort:
410         /* Free the original skb */
411         kfree_skb(skb);
412         return 1;
413 }
414 
415 /*****************************************************************************
416  * Session (and tunnel control) socket create/destroy.
417  *****************************************************************************/
418 
419 static void pppol2tp_put_sk(struct rcu_head *head)
420 {
421         struct pppol2tp_session *ps;
422 
423         ps = container_of(head, typeof(*ps), rcu);
424         sock_put(ps->__sk);
425 }
426 
427 /* Called by l2tp_core when a session socket is being closed.
428  */
429 static void pppol2tp_session_close(struct l2tp_session *session)
430 {
431         struct pppol2tp_session *ps;
432 
433         ps = l2tp_session_priv(session);
434         mutex_lock(&ps->sk_lock);
435         ps->__sk = rcu_dereference_protected(ps->sk,
436                                              lockdep_is_held(&ps->sk_lock));
437         RCU_INIT_POINTER(ps->sk, NULL);
438         if (ps->__sk)
439                 call_rcu(&ps->rcu, pppol2tp_put_sk);
440         mutex_unlock(&ps->sk_lock);
441 }
442 
443 /* Really kill the session socket. (Called from sock_put() if
444  * refcnt == 0.)
445  */
446 static void pppol2tp_session_destruct(struct sock *sk)
447 {
448         struct l2tp_session *session = sk->sk_user_data;
449 
450         skb_queue_purge(&sk->sk_receive_queue);
451         skb_queue_purge(&sk->sk_write_queue);
452 
453         if (session) {
454                 sk->sk_user_data = NULL;
455                 BUG_ON(session->magic != L2TP_SESSION_MAGIC);
456                 l2tp_session_dec_refcount(session);
457         }
458 }
459 
460 /* Called when the PPPoX socket (session) is closed.
461  */
462 static int pppol2tp_release(struct socket *sock)
463 {
464         struct sock *sk = sock->sk;
465         struct l2tp_session *session;
466         int error;
467 
468         if (!sk)
469                 return 0;
470 
471         error = -EBADF;
472         lock_sock(sk);
473         if (sock_flag(sk, SOCK_DEAD) != 0)
474                 goto error;
475 
476         pppox_unbind_sock(sk);
477 
478         /* Signal the death of the socket. */
479         sk->sk_state = PPPOX_DEAD;
480         sock_orphan(sk);
481         sock->sk = NULL;
482 
483         /* If the socket is associated with a session,
484          * l2tp_session_delete will call pppol2tp_session_close which
485          * will drop the session's ref on the socket.
486          */
487         session = pppol2tp_sock_to_session(sk);
488         if (session) {
489                 l2tp_session_delete(session);
490                 /* drop the ref obtained by pppol2tp_sock_to_session */
491                 sock_put(sk);
492         }
493 
494         release_sock(sk);
495 
496         /* This will delete the session context via
497          * pppol2tp_session_destruct() if the socket's refcnt drops to
498          * zero.
499          */
500         sock_put(sk);
501 
502         return 0;
503 
504 error:
505         release_sock(sk);
506         return error;
507 }
508 
509 static struct proto pppol2tp_sk_proto = {
510         .name     = "PPPOL2TP",
511         .owner    = THIS_MODULE,
512         .obj_size = sizeof(struct pppox_sock),
513 };
514 
515 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb)
516 {
517         int rc;
518 
519         rc = l2tp_udp_encap_recv(sk, skb);
520         if (rc)
521                 kfree_skb(skb);
522 
523         return NET_RX_SUCCESS;
524 }
525 
526 /* socket() handler. Initialize a new struct sock.
527  */
528 static int pppol2tp_create(struct net *net, struct socket *sock, int kern)
529 {
530         int error = -ENOMEM;
531         struct sock *sk;
532 
533         sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern);
534         if (!sk)
535                 goto out;
536 
537         sock_init_data(sock, sk);
538 
539         sock->state  = SS_UNCONNECTED;
540         sock->ops    = &pppol2tp_ops;
541 
542         sk->sk_backlog_rcv = pppol2tp_backlog_recv;
543         sk->sk_protocol    = PX_PROTO_OL2TP;
544         sk->sk_family      = PF_PPPOX;
545         sk->sk_state       = PPPOX_NONE;
546         sk->sk_type        = SOCK_STREAM;
547         sk->sk_destruct    = pppol2tp_session_destruct;
548 
549         error = 0;
550 
551 out:
552         return error;
553 }
554 
555 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS)
556 static void pppol2tp_show(struct seq_file *m, void *arg)
557 {
558         struct l2tp_session *session = arg;
559         struct sock *sk;
560 
561         sk = pppol2tp_session_get_sock(session);
562         if (sk) {
563                 struct pppox_sock *po = pppox_sk(sk);
564 
565                 seq_printf(m, "   interface %s\n", ppp_dev_name(&po->chan));
566                 sock_put(sk);
567         }
568 }
569 #endif
570 
571 static void pppol2tp_session_init(struct l2tp_session *session)
572 {
573         struct pppol2tp_session *ps;
574         struct dst_entry *dst;
575 
576         session->recv_skb = pppol2tp_recv;
577         session->session_close = pppol2tp_session_close;
578 #if IS_ENABLED(CONFIG_L2TP_DEBUGFS)
579         session->show = pppol2tp_show;
580 #endif
581 
582         ps = l2tp_session_priv(session);
583         mutex_init(&ps->sk_lock);
584         ps->owner = current->pid;
585 
586         /* If PMTU discovery was enabled, use the MTU that was discovered */
587         dst = sk_dst_get(session->tunnel->sock);
588         if (dst) {
589                 u32 pmtu = dst_mtu(dst);
590 
591                 if (pmtu) {
592                         session->mtu = pmtu - PPPOL2TP_HEADER_OVERHEAD;
593                         session->mru = pmtu - PPPOL2TP_HEADER_OVERHEAD;
594                 }
595                 dst_release(dst);
596         }
597 }
598 
599 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
600  */
601 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
602                             int sockaddr_len, int flags)
603 {
604         struct sock *sk = sock->sk;
605         struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr;
606         struct pppox_sock *po = pppox_sk(sk);
607         struct l2tp_session *session = NULL;
608         struct l2tp_tunnel *tunnel;
609         struct pppol2tp_session *ps;
610         struct l2tp_session_cfg cfg = { 0, };
611         int error = 0;
612         u32 tunnel_id, peer_tunnel_id;
613         u32 session_id, peer_session_id;
614         bool drop_refcnt = false;
615         bool drop_tunnel = false;
616         int ver = 2;
617         int fd;
618 
619         lock_sock(sk);
620 
621         error = -EINVAL;
622         if (sp->sa_protocol != PX_PROTO_OL2TP)
623                 goto end;
624 
625         /* Check for already bound sockets */
626         error = -EBUSY;
627         if (sk->sk_state & PPPOX_CONNECTED)
628                 goto end;
629 
630         /* We don't supporting rebinding anyway */
631         error = -EALREADY;
632         if (sk->sk_user_data)
633                 goto end; /* socket is already attached */
634 
635         /* Get params from socket address. Handle L2TPv2 and L2TPv3.
636          * This is nasty because there are different sockaddr_pppol2tp
637          * structs for L2TPv2, L2TPv3, over IPv4 and IPv6. We use
638          * the sockaddr size to determine which structure the caller
639          * is using.
640          */
641         peer_tunnel_id = 0;
642         if (sockaddr_len == sizeof(struct sockaddr_pppol2tp)) {
643                 fd = sp->pppol2tp.fd;
644                 tunnel_id = sp->pppol2tp.s_tunnel;
645                 peer_tunnel_id = sp->pppol2tp.d_tunnel;
646                 session_id = sp->pppol2tp.s_session;
647                 peer_session_id = sp->pppol2tp.d_session;
648         } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3)) {
649                 struct sockaddr_pppol2tpv3 *sp3 =
650                         (struct sockaddr_pppol2tpv3 *) sp;
651                 ver = 3;
652                 fd = sp3->pppol2tp.fd;
653                 tunnel_id = sp3->pppol2tp.s_tunnel;
654                 peer_tunnel_id = sp3->pppol2tp.d_tunnel;
655                 session_id = sp3->pppol2tp.s_session;
656                 peer_session_id = sp3->pppol2tp.d_session;
657         } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpin6)) {
658                 struct sockaddr_pppol2tpin6 *sp6 =
659                         (struct sockaddr_pppol2tpin6 *) sp;
660                 fd = sp6->pppol2tp.fd;
661                 tunnel_id = sp6->pppol2tp.s_tunnel;
662                 peer_tunnel_id = sp6->pppol2tp.d_tunnel;
663                 session_id = sp6->pppol2tp.s_session;
664                 peer_session_id = sp6->pppol2tp.d_session;
665         } else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3in6)) {
666                 struct sockaddr_pppol2tpv3in6 *sp6 =
667                         (struct sockaddr_pppol2tpv3in6 *) sp;
668                 ver = 3;
669                 fd = sp6->pppol2tp.fd;
670                 tunnel_id = sp6->pppol2tp.s_tunnel;
671                 peer_tunnel_id = sp6->pppol2tp.d_tunnel;
672                 session_id = sp6->pppol2tp.s_session;
673                 peer_session_id = sp6->pppol2tp.d_session;
674         } else {
675                 error = -EINVAL;
676                 goto end; /* bad socket address */
677         }
678 
679         /* Don't bind if tunnel_id is 0 */
680         error = -EINVAL;
681         if (tunnel_id == 0)
682                 goto end;
683 
684         tunnel = l2tp_tunnel_get(sock_net(sk), tunnel_id);
685         if (tunnel)
686                 drop_tunnel = true;
687 
688         /* Special case: create tunnel context if session_id and
689          * peer_session_id is 0. Otherwise look up tunnel using supplied
690          * tunnel id.
691          */
692         if ((session_id == 0) && (peer_session_id == 0)) {
693                 if (tunnel == NULL) {
694                         struct l2tp_tunnel_cfg tcfg = {
695                                 .encap = L2TP_ENCAPTYPE_UDP,
696                                 .debug = 0,
697                         };
698                         error = l2tp_tunnel_create(sock_net(sk), fd, ver, tunnel_id, peer_tunnel_id, &tcfg, &tunnel);
699                         if (error < 0)
700                                 goto end;
701 
702                         l2tp_tunnel_inc_refcount(tunnel);
703                         error = l2tp_tunnel_register(tunnel, sock_net(sk),
704                                                      &tcfg);
705                         if (error < 0) {
706                                 kfree(tunnel);
707                                 goto end;
708                         }
709                         drop_tunnel = true;
710                 }
711         } else {
712                 /* Error if we can't find the tunnel */
713                 error = -ENOENT;
714                 if (tunnel == NULL)
715                         goto end;
716 
717                 /* Error if socket is not prepped */
718                 if (tunnel->sock == NULL)
719                         goto end;
720         }
721 
722         if (tunnel->recv_payload_hook == NULL)
723                 tunnel->recv_payload_hook = pppol2tp_recv_payload_hook;
724 
725         if (tunnel->peer_tunnel_id == 0)
726                 tunnel->peer_tunnel_id = peer_tunnel_id;
727 
728         session = l2tp_session_get(sock_net(sk), tunnel, session_id);
729         if (session) {
730                 drop_refcnt = true;
731                 ps = l2tp_session_priv(session);
732 
733                 /* Using a pre-existing session is fine as long as it hasn't
734                  * been connected yet.
735                  */
736                 mutex_lock(&ps->sk_lock);
737                 if (rcu_dereference_protected(ps->sk,
738                                               lockdep_is_held(&ps->sk_lock))) {
739                         mutex_unlock(&ps->sk_lock);
740                         error = -EEXIST;
741                         goto end;
742                 }
743         } else {
744                 /* Default MTU must allow space for UDP/L2TP/PPP headers */
745                 cfg.mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD;
746                 cfg.mru = cfg.mtu;
747 
748                 session = l2tp_session_create(sizeof(struct pppol2tp_session),
749                                               tunnel, session_id,
750                                               peer_session_id, &cfg);
751                 if (IS_ERR(session)) {
752                         error = PTR_ERR(session);
753                         goto end;
754                 }
755 
756                 pppol2tp_session_init(session);
757                 ps = l2tp_session_priv(session);
758                 l2tp_session_inc_refcount(session);
759 
760                 mutex_lock(&ps->sk_lock);
761                 error = l2tp_session_register(session, tunnel);
762                 if (error < 0) {
763                         mutex_unlock(&ps->sk_lock);
764                         kfree(session);
765                         goto end;
766                 }
767                 drop_refcnt = true;
768         }
769 
770         /* Special case: if source & dest session_id == 0x0000, this
771          * socket is being created to manage the tunnel. Just set up
772          * the internal context for use by ioctl() and sockopt()
773          * handlers.
774          */
775         if ((session->session_id == 0) &&
776             (session->peer_session_id == 0)) {
777                 error = 0;
778                 goto out_no_ppp;
779         }
780 
781         /* The only header we need to worry about is the L2TP
782          * header. This size is different depending on whether
783          * sequence numbers are enabled for the data channel.
784          */
785         po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
786 
787         po->chan.private = sk;
788         po->chan.ops     = &pppol2tp_chan_ops;
789         po->chan.mtu     = session->mtu;
790 
791         error = ppp_register_net_channel(sock_net(sk), &po->chan);
792         if (error) {
793                 mutex_unlock(&ps->sk_lock);
794                 goto end;
795         }
796 
797 out_no_ppp:
798         /* This is how we get the session context from the socket. */
799         sock_hold(sk);
800         sk->sk_user_data = session;
801         rcu_assign_pointer(ps->sk, sk);
802         mutex_unlock(&ps->sk_lock);
803 
804         /* Keep the reference we've grabbed on the session: sk doesn't expect
805          * the session to disappear. pppol2tp_session_destruct() is responsible
806          * for dropping it.
807          */
808         drop_refcnt = false;
809 
810         sk->sk_state = PPPOX_CONNECTED;
811         l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n",
812                   session->name);
813 
814 end:
815         if (drop_refcnt)
816                 l2tp_session_dec_refcount(session);
817         if (drop_tunnel)
818                 l2tp_tunnel_dec_refcount(tunnel);
819         release_sock(sk);
820 
821         return error;
822 }
823 
824 #ifdef CONFIG_L2TP_V3
825 
826 /* Called when creating sessions via the netlink interface. */
827 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel,
828                                    u32 session_id, u32 peer_session_id,
829                                    struct l2tp_session_cfg *cfg)
830 {
831         int error;
832         struct l2tp_session *session;
833 
834         /* Error if tunnel socket is not prepped */
835         if (!tunnel->sock) {
836                 error = -ENOENT;
837                 goto err;
838         }
839 
840         /* Default MTU values. */
841         if (cfg->mtu == 0)
842                 cfg->mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD;
843         if (cfg->mru == 0)
844                 cfg->mru = cfg->mtu;
845 
846         /* Allocate and initialize a new session context. */
847         session = l2tp_session_create(sizeof(struct pppol2tp_session),
848                                       tunnel, session_id,
849                                       peer_session_id, cfg);
850         if (IS_ERR(session)) {
851                 error = PTR_ERR(session);
852                 goto err;
853         }
854 
855         pppol2tp_session_init(session);
856 
857         error = l2tp_session_register(session, tunnel);
858         if (error < 0)
859                 goto err_sess;
860 
861         return 0;
862 
863 err_sess:
864         kfree(session);
865 err:
866         return error;
867 }
868 
869 #endif /* CONFIG_L2TP_V3 */
870 
871 /* getname() support.
872  */
873 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
874                             int *usockaddr_len, int peer)
875 {
876         int len = 0;
877         int error = 0;
878         struct l2tp_session *session;
879         struct l2tp_tunnel *tunnel;
880         struct sock *sk = sock->sk;
881         struct inet_sock *inet;
882         struct pppol2tp_session *pls;
883 
884         error = -ENOTCONN;
885         if (sk == NULL)
886                 goto end;
887         if (!(sk->sk_state & PPPOX_CONNECTED))
888                 goto end;
889 
890         error = -EBADF;
891         session = pppol2tp_sock_to_session(sk);
892         if (session == NULL)
893                 goto end;
894 
895         pls = l2tp_session_priv(session);
896         tunnel = session->tunnel;
897 
898         inet = inet_sk(tunnel->sock);
899         if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) {
900                 struct sockaddr_pppol2tp sp;
901                 len = sizeof(sp);
902                 memset(&sp, 0, len);
903                 sp.sa_family    = AF_PPPOX;
904                 sp.sa_protocol  = PX_PROTO_OL2TP;
905                 sp.pppol2tp.fd  = tunnel->fd;
906                 sp.pppol2tp.pid = pls->owner;
907                 sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
908                 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
909                 sp.pppol2tp.s_session = session->session_id;
910                 sp.pppol2tp.d_session = session->peer_session_id;
911                 sp.pppol2tp.addr.sin_family = AF_INET;
912                 sp.pppol2tp.addr.sin_port = inet->inet_dport;
913                 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
914                 memcpy(uaddr, &sp, len);
915 #if IS_ENABLED(CONFIG_IPV6)
916         } else if ((tunnel->version == 2) &&
917                    (tunnel->sock->sk_family == AF_INET6)) {
918                 struct sockaddr_pppol2tpin6 sp;
919 
920                 len = sizeof(sp);
921                 memset(&sp, 0, len);
922                 sp.sa_family    = AF_PPPOX;
923                 sp.sa_protocol  = PX_PROTO_OL2TP;
924                 sp.pppol2tp.fd  = tunnel->fd;
925                 sp.pppol2tp.pid = pls->owner;
926                 sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
927                 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
928                 sp.pppol2tp.s_session = session->session_id;
929                 sp.pppol2tp.d_session = session->peer_session_id;
930                 sp.pppol2tp.addr.sin6_family = AF_INET6;
931                 sp.pppol2tp.addr.sin6_port = inet->inet_dport;
932                 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
933                        sizeof(tunnel->sock->sk_v6_daddr));
934                 memcpy(uaddr, &sp, len);
935         } else if ((tunnel->version == 3) &&
936                    (tunnel->sock->sk_family == AF_INET6)) {
937                 struct sockaddr_pppol2tpv3in6 sp;
938 
939                 len = sizeof(sp);
940                 memset(&sp, 0, len);
941                 sp.sa_family    = AF_PPPOX;
942                 sp.sa_protocol  = PX_PROTO_OL2TP;
943                 sp.pppol2tp.fd  = tunnel->fd;
944                 sp.pppol2tp.pid = pls->owner;
945                 sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
946                 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
947                 sp.pppol2tp.s_session = session->session_id;
948                 sp.pppol2tp.d_session = session->peer_session_id;
949                 sp.pppol2tp.addr.sin6_family = AF_INET6;
950                 sp.pppol2tp.addr.sin6_port = inet->inet_dport;
951                 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
952                        sizeof(tunnel->sock->sk_v6_daddr));
953                 memcpy(uaddr, &sp, len);
954 #endif
955         } else if (tunnel->version == 3) {
956                 struct sockaddr_pppol2tpv3 sp;
957                 len = sizeof(sp);
958                 memset(&sp, 0, len);
959                 sp.sa_family    = AF_PPPOX;
960                 sp.sa_protocol  = PX_PROTO_OL2TP;
961                 sp.pppol2tp.fd  = tunnel->fd;
962                 sp.pppol2tp.pid = pls->owner;
963                 sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
964                 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
965                 sp.pppol2tp.s_session = session->session_id;
966                 sp.pppol2tp.d_session = session->peer_session_id;
967                 sp.pppol2tp.addr.sin_family = AF_INET;
968                 sp.pppol2tp.addr.sin_port = inet->inet_dport;
969                 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
970                 memcpy(uaddr, &sp, len);
971         }
972 
973         *usockaddr_len = len;
974         error = 0;
975 
976         sock_put(sk);
977 end:
978         return error;
979 }
980 
981 /****************************************************************************
982  * ioctl() handlers.
983  *
984  * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
985  * sockets. However, in order to control kernel tunnel features, we allow
986  * userspace to create a special "tunnel" PPPoX socket which is used for
987  * control only.  Tunnel PPPoX sockets have session_id == 0 and simply allow
988  * the user application to issue L2TP setsockopt(), getsockopt() and ioctl()
989  * calls.
990  ****************************************************************************/
991 
992 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest,
993                                 struct l2tp_stats *stats)
994 {
995         dest->tx_packets = atomic_long_read(&stats->tx_packets);
996         dest->tx_bytes = atomic_long_read(&stats->tx_bytes);
997         dest->tx_errors = atomic_long_read(&stats->tx_errors);
998         dest->rx_packets = atomic_long_read(&stats->rx_packets);
999         dest->rx_bytes = atomic_long_read(&stats->rx_bytes);
1000         dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards);
1001         dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets);
1002         dest->rx_errors = atomic_long_read(&stats->rx_errors);
1003 }
1004 
1005 /* Session ioctl helper.
1006  */
1007 static int pppol2tp_session_ioctl(struct l2tp_session *session,
1008                                   unsigned int cmd, unsigned long arg)
1009 {
1010         struct ifreq ifr;
1011         int err = 0;
1012         struct sock *sk;
1013         int val = (int) arg;
1014         struct pppol2tp_session *ps = l2tp_session_priv(session);
1015         struct l2tp_tunnel *tunnel = session->tunnel;
1016         struct pppol2tp_ioc_stats stats;
1017 
1018         l2tp_dbg(session, L2TP_MSG_CONTROL,
1019                  "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n",
1020                  session->name, cmd, arg);
1021 
1022         sk = pppol2tp_session_get_sock(session);
1023         if (!sk)
1024                 return -EBADR;
1025 
1026         switch (cmd) {
1027         case SIOCGIFMTU:
1028                 err = -ENXIO;
1029                 if (!(sk->sk_state & PPPOX_CONNECTED))
1030                         break;
1031 
1032                 err = -EFAULT;
1033                 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq)))
1034                         break;
1035                 ifr.ifr_mtu = session->mtu;
1036                 if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq)))
1037                         break;
1038 
1039                 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mtu=%d\n",
1040                           session->name, session->mtu);
1041                 err = 0;
1042                 break;
1043 
1044         case SIOCSIFMTU:
1045                 err = -ENXIO;
1046                 if (!(sk->sk_state & PPPOX_CONNECTED))
1047                         break;
1048 
1049                 err = -EFAULT;
1050                 if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq)))
1051                         break;
1052 
1053                 session->mtu = ifr.ifr_mtu;
1054 
1055                 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mtu=%d\n",
1056                           session->name, session->mtu);
1057                 err = 0;
1058                 break;
1059 
1060         case PPPIOCGMRU:
1061                 err = -ENXIO;
1062                 if (!(sk->sk_state & PPPOX_CONNECTED))
1063                         break;
1064 
1065                 err = -EFAULT;
1066                 if (put_user(session->mru, (int __user *) arg))
1067                         break;
1068 
1069                 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mru=%d\n",
1070                           session->name, session->mru);
1071                 err = 0;
1072                 break;
1073 
1074         case PPPIOCSMRU:
1075                 err = -ENXIO;
1076                 if (!(sk->sk_state & PPPOX_CONNECTED))
1077                         break;
1078 
1079                 err = -EFAULT;
1080                 if (get_user(val, (int __user *) arg))
1081                         break;
1082 
1083                 session->mru = val;
1084                 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mru=%d\n",
1085                           session->name, session->mru);
1086                 err = 0;
1087                 break;
1088 
1089         case PPPIOCGFLAGS:
1090                 err = -EFAULT;
1091                 if (put_user(ps->flags, (int __user *) arg))
1092                         break;
1093 
1094                 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get flags=%d\n",
1095                           session->name, ps->flags);
1096                 err = 0;
1097                 break;
1098 
1099         case PPPIOCSFLAGS:
1100                 err = -EFAULT;
1101                 if (get_user(val, (int __user *) arg))
1102                         break;
1103                 ps->flags = val;
1104                 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set flags=%d\n",
1105                           session->name, ps->flags);
1106                 err = 0;
1107                 break;
1108 
1109         case PPPIOCGL2TPSTATS:
1110                 err = -ENXIO;
1111                 if (!(sk->sk_state & PPPOX_CONNECTED))
1112                         break;
1113 
1114                 memset(&stats, 0, sizeof(stats));
1115                 stats.tunnel_id = tunnel->tunnel_id;
1116                 stats.session_id = session->session_id;
1117                 pppol2tp_copy_stats(&stats, &session->stats);
1118                 if (copy_to_user((void __user *) arg, &stats,
1119                                  sizeof(stats)))
1120                         break;
1121                 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get L2TP stats\n",
1122                           session->name);
1123                 err = 0;
1124                 break;
1125 
1126         default:
1127                 err = -ENOSYS;
1128                 break;
1129         }
1130 
1131         sock_put(sk);
1132 
1133         return err;
1134 }
1135 
1136 /* Tunnel ioctl helper.
1137  *
1138  * Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data
1139  * specifies a session_id, the session ioctl handler is called. This allows an
1140  * application to retrieve session stats via a tunnel socket.
1141  */
1142 static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel,
1143                                  unsigned int cmd, unsigned long arg)
1144 {
1145         int err = 0;
1146         struct sock *sk;
1147         struct pppol2tp_ioc_stats stats;
1148 
1149         l2tp_dbg(tunnel, L2TP_MSG_CONTROL,
1150                  "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n",
1151                  tunnel->name, cmd, arg);
1152 
1153         sk = tunnel->sock;
1154         sock_hold(sk);
1155 
1156         switch (cmd) {
1157         case PPPIOCGL2TPSTATS:
1158                 err = -ENXIO;
1159                 if (!(sk->sk_state & PPPOX_CONNECTED))
1160                         break;
1161 
1162                 if (copy_from_user(&stats, (void __user *) arg,
1163                                    sizeof(stats))) {
1164                         err = -EFAULT;
1165                         break;
1166                 }
1167                 if (stats.session_id != 0) {
1168                         /* resend to session ioctl handler */
1169                         struct l2tp_session *session =
1170                                 l2tp_session_get(sock_net(sk), tunnel,
1171                                                  stats.session_id);
1172 
1173                         if (session) {
1174                                 err = pppol2tp_session_ioctl(session, cmd,
1175                                                              arg);
1176                                 l2tp_session_dec_refcount(session);
1177                         } else {
1178                                 err = -EBADR;
1179                         }
1180                         break;
1181                 }
1182 #ifdef CONFIG_XFRM
1183                 stats.using_ipsec = (sk->sk_policy[0] || sk->sk_policy[1]) ? 1 : 0;
1184 #endif
1185                 pppol2tp_copy_stats(&stats, &tunnel->stats);
1186                 if (copy_to_user((void __user *) arg, &stats, sizeof(stats))) {
1187                         err = -EFAULT;
1188                         break;
1189                 }
1190                 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get L2TP stats\n",
1191                           tunnel->name);
1192                 err = 0;
1193                 break;
1194 
1195         default:
1196                 err = -ENOSYS;
1197                 break;
1198         }
1199 
1200         sock_put(sk);
1201 
1202         return err;
1203 }
1204 
1205 /* Main ioctl() handler.
1206  * Dispatch to tunnel or session helpers depending on the socket.
1207  */
1208 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
1209                           unsigned long arg)
1210 {
1211         struct sock *sk = sock->sk;
1212         struct l2tp_session *session;
1213         struct l2tp_tunnel *tunnel;
1214         int err;
1215 
1216         if (!sk)
1217                 return 0;
1218 
1219         err = -EBADF;
1220         if (sock_flag(sk, SOCK_DEAD) != 0)
1221                 goto end;
1222 
1223         err = -ENOTCONN;
1224         if ((sk->sk_user_data == NULL) ||
1225             (!(sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND))))
1226                 goto end;
1227 
1228         /* Get session context from the socket */
1229         err = -EBADF;
1230         session = pppol2tp_sock_to_session(sk);
1231         if (session == NULL)
1232                 goto end;
1233 
1234         /* Special case: if session's session_id is zero, treat ioctl as a
1235          * tunnel ioctl
1236          */
1237         if ((session->session_id == 0) &&
1238             (session->peer_session_id == 0)) {
1239                 tunnel = session->tunnel;
1240                 err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg);
1241                 goto end_put_sess;
1242         }
1243 
1244         err = pppol2tp_session_ioctl(session, cmd, arg);
1245 
1246 end_put_sess:
1247         sock_put(sk);
1248 end:
1249         return err;
1250 }
1251 
1252 /*****************************************************************************
1253  * setsockopt() / getsockopt() support.
1254  *
1255  * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
1256  * sockets. In order to control kernel tunnel features, we allow userspace to
1257  * create a special "tunnel" PPPoX socket which is used for control only.
1258  * Tunnel PPPoX sockets have session_id == 0 and simply allow the user
1259  * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls.
1260  *****************************************************************************/
1261 
1262 /* Tunnel setsockopt() helper.
1263  */
1264 static int pppol2tp_tunnel_setsockopt(struct sock *sk,
1265                                       struct l2tp_tunnel *tunnel,
1266                                       int optname, int val)
1267 {
1268         int err = 0;
1269 
1270         switch (optname) {
1271         case PPPOL2TP_SO_DEBUG:
1272                 tunnel->debug = val;
1273                 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: set debug=%x\n",
1274                           tunnel->name, tunnel->debug);
1275                 break;
1276 
1277         default:
1278                 err = -ENOPROTOOPT;
1279                 break;
1280         }
1281 
1282         return err;
1283 }
1284 
1285 /* Session setsockopt helper.
1286  */
1287 static int pppol2tp_session_setsockopt(struct sock *sk,
1288                                        struct l2tp_session *session,
1289                                        int optname, int val)
1290 {
1291         int err = 0;
1292 
1293         switch (optname) {
1294         case PPPOL2TP_SO_RECVSEQ:
1295                 if ((val != 0) && (val != 1)) {
1296                         err = -EINVAL;
1297                         break;
1298                 }
1299                 session->recv_seq = !!val;
1300                 l2tp_info(session, L2TP_MSG_CONTROL,
1301                           "%s: set recv_seq=%d\n",
1302                           session->name, session->recv_seq);
1303                 break;
1304 
1305         case PPPOL2TP_SO_SENDSEQ:
1306                 if ((val != 0) && (val != 1)) {
1307                         err = -EINVAL;
1308                         break;
1309                 }
1310                 session->send_seq = !!val;
1311                 {
1312                         struct pppox_sock *po = pppox_sk(sk);
1313 
1314                         po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
1315                                 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
1316                 }
1317                 l2tp_session_set_header_len(session, session->tunnel->version);
1318                 l2tp_info(session, L2TP_MSG_CONTROL,
1319                           "%s: set send_seq=%d\n",
1320                           session->name, session->send_seq);
1321                 break;
1322 
1323         case PPPOL2TP_SO_LNSMODE:
1324                 if ((val != 0) && (val != 1)) {
1325                         err = -EINVAL;
1326                         break;
1327                 }
1328                 session->lns_mode = !!val;
1329                 l2tp_info(session, L2TP_MSG_CONTROL,
1330                           "%s: set lns_mode=%d\n",
1331                           session->name, session->lns_mode);
1332                 break;
1333 
1334         case PPPOL2TP_SO_DEBUG:
1335                 session->debug = val;
1336                 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set debug=%x\n",
1337                           session->name, session->debug);
1338                 break;
1339 
1340         case PPPOL2TP_SO_REORDERTO:
1341                 session->reorder_timeout = msecs_to_jiffies(val);
1342                 l2tp_info(session, L2TP_MSG_CONTROL,
1343                           "%s: set reorder_timeout=%d\n",
1344                           session->name, session->reorder_timeout);
1345                 break;
1346 
1347         default:
1348                 err = -ENOPROTOOPT;
1349                 break;
1350         }
1351 
1352         return err;
1353 }
1354 
1355 /* Main setsockopt() entry point.
1356  * Does API checks, then calls either the tunnel or session setsockopt
1357  * handler, according to whether the PPPoL2TP socket is a for a regular
1358  * session or the special tunnel type.
1359  */
1360 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
1361                                char __user *optval, unsigned int optlen)
1362 {
1363         struct sock *sk = sock->sk;
1364         struct l2tp_session *session;
1365         struct l2tp_tunnel *tunnel;
1366         int val;
1367         int err;
1368 
1369         if (level != SOL_PPPOL2TP)
1370                 return -EINVAL;
1371 
1372         if (optlen < sizeof(int))
1373                 return -EINVAL;
1374 
1375         if (get_user(val, (int __user *)optval))
1376                 return -EFAULT;
1377 
1378         err = -ENOTCONN;
1379         if (sk->sk_user_data == NULL)
1380                 goto end;
1381 
1382         /* Get session context from the socket */
1383         err = -EBADF;
1384         session = pppol2tp_sock_to_session(sk);
1385         if (session == NULL)
1386                 goto end;
1387 
1388         /* Special case: if session_id == 0x0000, treat as operation on tunnel
1389          */
1390         if ((session->session_id == 0) &&
1391             (session->peer_session_id == 0)) {
1392                 tunnel = session->tunnel;
1393                 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
1394         } else {
1395                 err = pppol2tp_session_setsockopt(sk, session, optname, val);
1396         }
1397 
1398         sock_put(sk);
1399 end:
1400         return err;
1401 }
1402 
1403 /* Tunnel getsockopt helper. Called with sock locked.
1404  */
1405 static int pppol2tp_tunnel_getsockopt(struct sock *sk,
1406                                       struct l2tp_tunnel *tunnel,
1407                                       int optname, int *val)
1408 {
1409         int err = 0;
1410 
1411         switch (optname) {
1412         case PPPOL2TP_SO_DEBUG:
1413                 *val = tunnel->debug;
1414                 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get debug=%x\n",
1415                           tunnel->name, tunnel->debug);
1416                 break;
1417 
1418         default:
1419                 err = -ENOPROTOOPT;
1420                 break;
1421         }
1422 
1423         return err;
1424 }
1425 
1426 /* Session getsockopt helper. Called with sock locked.
1427  */
1428 static int pppol2tp_session_getsockopt(struct sock *sk,
1429                                        struct l2tp_session *session,
1430                                        int optname, int *val)
1431 {
1432         int err = 0;
1433 
1434         switch (optname) {
1435         case PPPOL2TP_SO_RECVSEQ:
1436                 *val = session->recv_seq;
1437                 l2tp_info(session, L2TP_MSG_CONTROL,
1438                           "%s: get recv_seq=%d\n", session->name, *val);
1439                 break;
1440 
1441         case PPPOL2TP_SO_SENDSEQ:
1442                 *val = session->send_seq;
1443                 l2tp_info(session, L2TP_MSG_CONTROL,
1444                           "%s: get send_seq=%d\n", session->name, *val);
1445                 break;
1446 
1447         case PPPOL2TP_SO_LNSMODE:
1448                 *val = session->lns_mode;
1449                 l2tp_info(session, L2TP_MSG_CONTROL,
1450                           "%s: get lns_mode=%d\n", session->name, *val);
1451                 break;
1452 
1453         case PPPOL2TP_SO_DEBUG:
1454                 *val = session->debug;
1455                 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get debug=%d\n",
1456                           session->name, *val);
1457                 break;
1458 
1459         case PPPOL2TP_SO_REORDERTO:
1460                 *val = (int) jiffies_to_msecs(session->reorder_timeout);
1461                 l2tp_info(session, L2TP_MSG_CONTROL,
1462                           "%s: get reorder_timeout=%d\n", session->name, *val);
1463                 break;
1464 
1465         default:
1466                 err = -ENOPROTOOPT;
1467         }
1468 
1469         return err;
1470 }
1471 
1472 /* Main getsockopt() entry point.
1473  * Does API checks, then calls either the tunnel or session getsockopt
1474  * handler, according to whether the PPPoX socket is a for a regular session
1475  * or the special tunnel type.
1476  */
1477 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
1478                                char __user *optval, int __user *optlen)
1479 {
1480         struct sock *sk = sock->sk;
1481         struct l2tp_session *session;
1482         struct l2tp_tunnel *tunnel;
1483         int val, len;
1484         int err;
1485 
1486         if (level != SOL_PPPOL2TP)
1487                 return -EINVAL;
1488 
1489         if (get_user(len, optlen))
1490                 return -EFAULT;
1491 
1492         len = min_t(unsigned int, len, sizeof(int));
1493 
1494         if (len < 0)
1495                 return -EINVAL;
1496 
1497         err = -ENOTCONN;
1498         if (sk->sk_user_data == NULL)
1499                 goto end;
1500 
1501         /* Get the session context */
1502         err = -EBADF;
1503         session = pppol2tp_sock_to_session(sk);
1504         if (session == NULL)
1505                 goto end;
1506 
1507         /* Special case: if session_id == 0x0000, treat as operation on tunnel */
1508         if ((session->session_id == 0) &&
1509             (session->peer_session_id == 0)) {
1510                 tunnel = session->tunnel;
1511                 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
1512                 if (err)
1513                         goto end_put_sess;
1514         } else {
1515                 err = pppol2tp_session_getsockopt(sk, session, optname, &val);
1516                 if (err)
1517                         goto end_put_sess;
1518         }
1519 
1520         err = -EFAULT;
1521         if (put_user(len, optlen))
1522                 goto end_put_sess;
1523 
1524         if (copy_to_user((void __user *) optval, &val, len))
1525                 goto end_put_sess;
1526 
1527         err = 0;
1528 
1529 end_put_sess:
1530         sock_put(sk);
1531 end:
1532         return err;
1533 }
1534 
1535 /*****************************************************************************
1536  * /proc filesystem for debug
1537  * Since the original pppol2tp driver provided /proc/net/pppol2tp for
1538  * L2TPv2, we dump only L2TPv2 tunnels and sessions here.
1539  *****************************************************************************/
1540 
1541 static unsigned int pppol2tp_net_id;
1542 
1543 #ifdef CONFIG_PROC_FS
1544 
1545 struct pppol2tp_seq_data {
1546         struct seq_net_private p;
1547         int tunnel_idx;                 /* current tunnel */
1548         int session_idx;                /* index of session within current tunnel */
1549         struct l2tp_tunnel *tunnel;
1550         struct l2tp_session *session;   /* NULL means get next tunnel */
1551 };
1552 
1553 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
1554 {
1555         for (;;) {
1556                 pd->tunnel = l2tp_tunnel_find_nth(net, pd->tunnel_idx);
1557                 pd->tunnel_idx++;
1558 
1559                 if (pd->tunnel == NULL)
1560                         break;
1561 
1562                 /* Ignore L2TPv3 tunnels */
1563                 if (pd->tunnel->version < 3)
1564                         break;
1565         }
1566 }
1567 
1568 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
1569 {
1570         pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx);
1571         pd->session_idx++;
1572 
1573         if (pd->session == NULL) {
1574                 pd->session_idx = 0;
1575                 pppol2tp_next_tunnel(net, pd);
1576         }
1577 }
1578 
1579 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs)
1580 {
1581         struct pppol2tp_seq_data *pd = SEQ_START_TOKEN;
1582         loff_t pos = *offs;
1583         struct net *net;
1584 
1585         if (!pos)
1586                 goto out;
1587 
1588         BUG_ON(m->private == NULL);
1589         pd = m->private;
1590         net = seq_file_net(m);
1591 
1592         if (pd->tunnel == NULL)
1593                 pppol2tp_next_tunnel(net, pd);
1594         else
1595                 pppol2tp_next_session(net, pd);
1596 
1597         /* NULL tunnel and session indicates end of list */
1598         if ((pd->tunnel == NULL) && (pd->session == NULL))
1599                 pd = NULL;
1600 
1601 out:
1602         return pd;
1603 }
1604 
1605 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos)
1606 {
1607         (*pos)++;
1608         return NULL;
1609 }
1610 
1611 static void pppol2tp_seq_stop(struct seq_file *p, void *v)
1612 {
1613         /* nothing to do */
1614 }
1615 
1616 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
1617 {
1618         struct l2tp_tunnel *tunnel = v;
1619 
1620         seq_printf(m, "\nTUNNEL '%s', %c %d\n",
1621                    tunnel->name,
1622                    (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N',
1623                    refcount_read(&tunnel->ref_count) - 1);
1624         seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n",
1625                    tunnel->debug,
1626                    atomic_long_read(&tunnel->stats.tx_packets),
1627                    atomic_long_read(&tunnel->stats.tx_bytes),
1628                    atomic_long_read(&tunnel->stats.tx_errors),
1629                    atomic_long_read(&tunnel->stats.rx_packets),
1630                    atomic_long_read(&tunnel->stats.rx_bytes),
1631                    atomic_long_read(&tunnel->stats.rx_errors));
1632 }
1633 
1634 static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
1635 {
1636         struct l2tp_session *session = v;
1637         struct l2tp_tunnel *tunnel = session->tunnel;
1638         unsigned char state;
1639         char user_data_ok;
1640         struct sock *sk;
1641         u32 ip = 0;
1642         u16 port = 0;
1643 
1644         if (tunnel->sock) {
1645                 struct inet_sock *inet = inet_sk(tunnel->sock);
1646                 ip = ntohl(inet->inet_saddr);
1647                 port = ntohs(inet->inet_sport);
1648         }
1649 
1650         sk = pppol2tp_session_get_sock(session);
1651         if (sk) {
1652                 state = sk->sk_state;
1653                 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N';
1654         } else {
1655                 state = 0;
1656                 user_data_ok = 'N';
1657         }
1658 
1659         seq_printf(m, "  SESSION '%s' %08X/%d %04X/%04X -> "
1660                    "%04X/%04X %d %c\n",
1661                    session->name, ip, port,
1662                    tunnel->tunnel_id,
1663                    session->session_id,
1664                    tunnel->peer_tunnel_id,
1665                    session->peer_session_id,
1666                    state, user_data_ok);
1667         seq_printf(m, "   %d/%d/%c/%c/%s %08x %u\n",
1668                    session->mtu, session->mru,
1669                    session->recv_seq ? 'R' : '-',
1670                    session->send_seq ? 'S' : '-',
1671                    session->lns_mode ? "LNS" : "LAC",
1672                    session->debug,
1673                    jiffies_to_msecs(session->reorder_timeout));
1674         seq_printf(m, "   %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n",
1675                    session->nr, session->ns,
1676                    atomic_long_read(&session->stats.tx_packets),
1677                    atomic_long_read(&session->stats.tx_bytes),
1678                    atomic_long_read(&session->stats.tx_errors),
1679                    atomic_long_read(&session->stats.rx_packets),
1680                    atomic_long_read(&session->stats.rx_bytes),
1681                    atomic_long_read(&session->stats.rx_errors));
1682 
1683         if (sk) {
1684                 struct pppox_sock *po = pppox_sk(sk);
1685 
1686                 seq_printf(m, "   interface %s\n", ppp_dev_name(&po->chan));
1687                 sock_put(sk);
1688         }
1689 }
1690 
1691 static int pppol2tp_seq_show(struct seq_file *m, void *v)
1692 {
1693         struct pppol2tp_seq_data *pd = v;
1694 
1695         /* display header on line 1 */
1696         if (v == SEQ_START_TOKEN) {
1697                 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n");
1698                 seq_puts(m, "TUNNEL name, user-data-ok session-count\n");
1699                 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1700                 seq_puts(m, "  SESSION name, addr/port src-tid/sid "
1701                          "dest-tid/sid state user-data-ok\n");
1702                 seq_puts(m, "   mtu/mru/rcvseq/sendseq/lns debug reorderto\n");
1703                 seq_puts(m, "   nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1704                 goto out;
1705         }
1706 
1707         /* Show the tunnel or session context.
1708          */
1709         if (!pd->session) {
1710                 pppol2tp_seq_tunnel_show(m, pd->tunnel);
1711         } else {
1712                 pppol2tp_seq_session_show(m, pd->session);
1713                 l2tp_session_dec_refcount(pd->session);
1714         }
1715 
1716 out:
1717         return 0;
1718 }
1719 
1720 static const struct seq_operations pppol2tp_seq_ops = {
1721         .start          = pppol2tp_seq_start,
1722         .next           = pppol2tp_seq_next,
1723         .stop           = pppol2tp_seq_stop,
1724         .show           = pppol2tp_seq_show,
1725 };
1726 
1727 /* Called when our /proc file is opened. We allocate data for use when
1728  * iterating our tunnel / session contexts and store it in the private
1729  * data of the seq_file.
1730  */
1731 static int pppol2tp_proc_open(struct inode *inode, struct file *file)
1732 {
1733         return seq_open_net(inode, file, &pppol2tp_seq_ops,
1734                             sizeof(struct pppol2tp_seq_data));
1735 }
1736 
1737 static const struct file_operations pppol2tp_proc_fops = {
1738         .owner          = THIS_MODULE,
1739         .open           = pppol2tp_proc_open,
1740         .read           = seq_read,
1741         .llseek         = seq_lseek,
1742         .release        = seq_release_net,
1743 };
1744 
1745 #endif /* CONFIG_PROC_FS */
1746 
1747 /*****************************************************************************
1748  * Network namespace
1749  *****************************************************************************/
1750 
1751 static __net_init int pppol2tp_init_net(struct net *net)
1752 {
1753         struct proc_dir_entry *pde;
1754         int err = 0;
1755 
1756         pde = proc_create("pppol2tp", S_IRUGO, net->proc_net,
1757                           &pppol2tp_proc_fops);
1758         if (!pde) {
1759                 err = -ENOMEM;
1760                 goto out;
1761         }
1762 
1763 out:
1764         return err;
1765 }
1766 
1767 static __net_exit void pppol2tp_exit_net(struct net *net)
1768 {
1769         remove_proc_entry("pppol2tp", net->proc_net);
1770 }
1771 
1772 static struct pernet_operations pppol2tp_net_ops = {
1773         .init = pppol2tp_init_net,
1774         .exit = pppol2tp_exit_net,
1775         .id   = &pppol2tp_net_id,
1776 };
1777 
1778 /*****************************************************************************
1779  * Init and cleanup
1780  *****************************************************************************/
1781 
1782 static const struct proto_ops pppol2tp_ops = {
1783         .family         = AF_PPPOX,
1784         .owner          = THIS_MODULE,
1785         .release        = pppol2tp_release,
1786         .bind           = sock_no_bind,
1787         .connect        = pppol2tp_connect,
1788         .socketpair     = sock_no_socketpair,
1789         .accept         = sock_no_accept,
1790         .getname        = pppol2tp_getname,
1791         .poll           = datagram_poll,
1792         .listen         = sock_no_listen,
1793         .shutdown       = sock_no_shutdown,
1794         .setsockopt     = pppol2tp_setsockopt,
1795         .getsockopt     = pppol2tp_getsockopt,
1796         .sendmsg        = pppol2tp_sendmsg,
1797         .recvmsg        = pppol2tp_recvmsg,
1798         .mmap           = sock_no_mmap,
1799         .ioctl          = pppox_ioctl,
1800 };
1801 
1802 static const struct pppox_proto pppol2tp_proto = {
1803         .create         = pppol2tp_create,
1804         .ioctl          = pppol2tp_ioctl,
1805         .owner          = THIS_MODULE,
1806 };
1807 
1808 #ifdef CONFIG_L2TP_V3
1809 
1810 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = {
1811         .session_create = pppol2tp_session_create,
1812         .session_delete = l2tp_session_delete,
1813 };
1814 
1815 #endif /* CONFIG_L2TP_V3 */
1816 
1817 static int __init pppol2tp_init(void)
1818 {
1819         int err;
1820 
1821         err = register_pernet_device(&pppol2tp_net_ops);
1822         if (err)
1823                 goto out;
1824 
1825         err = proto_register(&pppol2tp_sk_proto, 0);
1826         if (err)
1827                 goto out_unregister_pppol2tp_pernet;
1828 
1829         err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto);
1830         if (err)
1831                 goto out_unregister_pppol2tp_proto;
1832 
1833 #ifdef CONFIG_L2TP_V3
1834         err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops);
1835         if (err)
1836                 goto out_unregister_pppox;
1837 #endif
1838 
1839         pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION);
1840 
1841 out:
1842         return err;
1843 
1844 #ifdef CONFIG_L2TP_V3
1845 out_unregister_pppox:
1846         unregister_pppox_proto(PX_PROTO_OL2TP);
1847 #endif
1848 out_unregister_pppol2tp_proto:
1849         proto_unregister(&pppol2tp_sk_proto);
1850 out_unregister_pppol2tp_pernet:
1851         unregister_pernet_device(&pppol2tp_net_ops);
1852         goto out;
1853 }
1854 
1855 static void __exit pppol2tp_exit(void)
1856 {
1857 #ifdef CONFIG_L2TP_V3
1858         l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP);
1859 #endif
1860         unregister_pppox_proto(PX_PROTO_OL2TP);
1861         proto_unregister(&pppol2tp_sk_proto);
1862         unregister_pernet_device(&pppol2tp_net_ops);
1863 }
1864 
1865 module_init(pppol2tp_init);
1866 module_exit(pppol2tp_exit);
1867 
1868 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1869 MODULE_DESCRIPTION("PPP over L2TP over UDP");
1870 MODULE_LICENSE("GPL");
1871 MODULE_VERSION(PPPOL2TP_DRV_VERSION);
1872 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP);
1873 MODULE_ALIAS_L2TP_PWTYPE(7);
1874 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp