blob: 6edfa99803148815e383eb13ce6a9c1eb098058d [file] [log] [blame]
James Chapmanfd558d12010-04-02 06:18:33 +00001/*
2 * L2TP core.
3 *
4 * Copyright (c) 2008,2009,2010 Katalix Systems Ltd
5 *
6 * This file contains some code of the original L2TPv2 pppol2tp
7 * driver, which has the following copyright:
8 *
9 * Authors: Martijn van Oosterhout <kleptog@svana.org>
10 * James Chapman (jchapman@katalix.com)
11 * Contributors:
12 * Michal Ostrowski <mostrows@speakeasy.net>
13 * Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
14 * David S. Miller (davem@redhat.com)
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2 as
18 * published by the Free Software Foundation.
19 */
20
Joe Perchesa4ca44f2012-05-16 09:55:56 +000021#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
22
James Chapmanfd558d12010-04-02 06:18:33 +000023#include <linux/module.h>
24#include <linux/string.h>
25#include <linux/list.h>
James Chapmane02d4942010-04-02 06:19:16 +000026#include <linux/rculist.h>
James Chapmanfd558d12010-04-02 06:18:33 +000027#include <linux/uaccess.h>
28
29#include <linux/kernel.h>
30#include <linux/spinlock.h>
31#include <linux/kthread.h>
32#include <linux/sched.h>
33#include <linux/slab.h>
34#include <linux/errno.h>
35#include <linux/jiffies.h>
36
37#include <linux/netdevice.h>
38#include <linux/net.h>
39#include <linux/inetdevice.h>
40#include <linux/skbuff.h>
41#include <linux/init.h>
James Chapman0d767512010-04-02 06:19:00 +000042#include <linux/in.h>
James Chapmanfd558d12010-04-02 06:18:33 +000043#include <linux/ip.h>
44#include <linux/udp.h>
James Chapman0d767512010-04-02 06:19:00 +000045#include <linux/l2tp.h>
James Chapmanfd558d12010-04-02 06:18:33 +000046#include <linux/hash.h>
47#include <linux/sort.h>
48#include <linux/file.h>
49#include <linux/nsproxy.h>
50#include <net/net_namespace.h>
51#include <net/netns/generic.h>
52#include <net/dst.h>
53#include <net/ip.h>
54#include <net/udp.h>
Tom Herbert85644b42014-07-13 19:49:48 -070055#include <net/udp_tunnel.h>
James Chapman309795f2010-04-02 06:19:10 +000056#include <net/inet_common.h>
James Chapmanfd558d12010-04-02 06:18:33 +000057#include <net/xfrm.h>
James Chapman0d767512010-04-02 06:19:00 +000058#include <net/protocol.h>
Benjamin LaHaised2cf3362012-04-27 08:24:18 +000059#include <net/inet6_connection_sock.h>
60#include <net/inet_ecn.h>
61#include <net/ip6_route.h>
David S. Millerd499bd22012-04-30 13:21:28 -040062#include <net/ip6_checksum.h>
James Chapmanfd558d12010-04-02 06:18:33 +000063
64#include <asm/byteorder.h>
Arun Sharma600634972011-07-26 16:09:06 -070065#include <linux/atomic.h>
James Chapmanfd558d12010-04-02 06:18:33 +000066
67#include "l2tp_core.h"
68
69#define L2TP_DRV_VERSION "V2.0"
70
71/* L2TP header constants */
72#define L2TP_HDRFLAG_T 0x8000
73#define L2TP_HDRFLAG_L 0x4000
74#define L2TP_HDRFLAG_S 0x0800
75#define L2TP_HDRFLAG_O 0x0200
76#define L2TP_HDRFLAG_P 0x0100
77
78#define L2TP_HDR_VER_MASK 0x000F
79#define L2TP_HDR_VER_2 0x0002
James Chapmanf7faffa2010-04-02 06:18:49 +000080#define L2TP_HDR_VER_3 0x0003
James Chapmanfd558d12010-04-02 06:18:33 +000081
82/* L2TPv3 default L2-specific sublayer */
83#define L2TP_SLFLAG_S 0x40000000
84#define L2TP_SL_SEQ_MASK 0x00ffffff
85
86#define L2TP_HDR_SIZE_SEQ 10
87#define L2TP_HDR_SIZE_NOSEQ 6
88
89/* Default trace flags */
90#define L2TP_DEFAULT_DEBUG_FLAGS 0
91
James Chapmanfd558d12010-04-02 06:18:33 +000092/* Private data stored for received packets in the skb.
93 */
94struct l2tp_skb_cb {
James Chapmanf7faffa2010-04-02 06:18:49 +000095 u32 ns;
James Chapmanfd558d12010-04-02 06:18:33 +000096 u16 has_seq;
97 u16 length;
98 unsigned long expires;
99};
100
101#define L2TP_SKB_CB(skb) ((struct l2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])
102
103static atomic_t l2tp_tunnel_count;
104static atomic_t l2tp_session_count;
Tom Parkinf8ccac02013-01-31 23:43:00 +0000105static struct workqueue_struct *l2tp_wq;
James Chapmanfd558d12010-04-02 06:18:33 +0000106
107/* per-net private data for this module */
108static unsigned int l2tp_net_id;
109struct l2tp_net {
110 struct list_head l2tp_tunnel_list;
James Chapmane02d4942010-04-02 06:19:16 +0000111 spinlock_t l2tp_tunnel_list_lock;
James Chapmanf7faffa2010-04-02 06:18:49 +0000112 struct hlist_head l2tp_session_hlist[L2TP_HASH_SIZE_2];
James Chapmane02d4942010-04-02 06:19:16 +0000113 spinlock_t l2tp_session_hlist_lock;
James Chapmanfd558d12010-04-02 06:18:33 +0000114};
115
stephen hemmingerfc130842010-10-21 07:50:46 +0000116static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
stephen hemmingerfc130842010-10-21 07:50:46 +0000117
David S. Miller8d8a51e2013-10-08 15:44:26 -0400118static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk)
119{
120 return sk->sk_user_data;
121}
122
James Chapmanfd558d12010-04-02 06:18:33 +0000123static inline struct l2tp_net *l2tp_pernet(struct net *net)
124{
125 BUG_ON(!net);
126
127 return net_generic(net, l2tp_net_id);
128}
129
stephen hemmingerfc130842010-10-21 07:50:46 +0000130/* Tunnel reference counts. Incremented per session that is added to
131 * the tunnel.
132 */
133static inline void l2tp_tunnel_inc_refcount_1(struct l2tp_tunnel *tunnel)
134{
135 atomic_inc(&tunnel->ref_count);
136}
137
138static inline void l2tp_tunnel_dec_refcount_1(struct l2tp_tunnel *tunnel)
139{
140 if (atomic_dec_and_test(&tunnel->ref_count))
141 l2tp_tunnel_free(tunnel);
142}
143#ifdef L2TP_REFCNT_DEBUG
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000144#define l2tp_tunnel_inc_refcount(_t) \
145do { \
146 pr_debug("l2tp_tunnel_inc_refcount: %s:%d %s: cnt=%d\n", \
147 __func__, __LINE__, (_t)->name, \
148 atomic_read(&_t->ref_count)); \
149 l2tp_tunnel_inc_refcount_1(_t); \
150} while (0)
Andy Zhou29abe2f2014-09-03 13:16:54 -0700151#define l2tp_tunnel_dec_refcount(_t) \
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000152do { \
153 pr_debug("l2tp_tunnel_dec_refcount: %s:%d %s: cnt=%d\n", \
154 __func__, __LINE__, (_t)->name, \
155 atomic_read(&_t->ref_count)); \
156 l2tp_tunnel_dec_refcount_1(_t); \
157} while (0)
stephen hemmingerfc130842010-10-21 07:50:46 +0000158#else
159#define l2tp_tunnel_inc_refcount(t) l2tp_tunnel_inc_refcount_1(t)
160#define l2tp_tunnel_dec_refcount(t) l2tp_tunnel_dec_refcount_1(t)
161#endif
162
James Chapmanf7faffa2010-04-02 06:18:49 +0000163/* Session hash global list for L2TPv3.
164 * The session_id SHOULD be random according to RFC3931, but several
165 * L2TP implementations use incrementing session_ids. So we do a real
166 * hash on the session_id, rather than a simple bitmask.
167 */
168static inline struct hlist_head *
169l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
170{
171 return &pn->l2tp_session_hlist[hash_32(session_id, L2TP_HASH_BITS_2)];
172
173}
174
Tom Parkin80d84ef2013-01-22 05:13:48 +0000175/* Lookup the tunnel socket, possibly involving the fs code if the socket is
176 * owned by userspace. A struct sock returned from this function must be
177 * released using l2tp_tunnel_sock_put once you're done with it.
178 */
stephen hemmingerb5d2b282014-01-09 22:22:27 -0800179static struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel)
Tom Parkin80d84ef2013-01-22 05:13:48 +0000180{
181 int err = 0;
182 struct socket *sock = NULL;
183 struct sock *sk = NULL;
184
185 if (!tunnel)
186 goto out;
187
188 if (tunnel->fd >= 0) {
189 /* Socket is owned by userspace, who might be in the process
190 * of closing it. Look the socket up using the fd to ensure
191 * consistency.
192 */
193 sock = sockfd_lookup(tunnel->fd, &err);
194 if (sock)
195 sk = sock->sk;
196 } else {
197 /* Socket is owned by kernelspace */
198 sk = tunnel->sock;
Tom Parkin8abbbe82013-03-19 06:11:17 +0000199 sock_hold(sk);
Tom Parkin80d84ef2013-01-22 05:13:48 +0000200 }
201
202out:
203 return sk;
204}
Tom Parkin80d84ef2013-01-22 05:13:48 +0000205
206/* Drop a reference to a tunnel socket obtained via. l2tp_tunnel_sock_put */
stephen hemmingerb5d2b282014-01-09 22:22:27 -0800207static void l2tp_tunnel_sock_put(struct sock *sk)
Tom Parkin80d84ef2013-01-22 05:13:48 +0000208{
209 struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
210 if (tunnel) {
211 if (tunnel->fd >= 0) {
212 /* Socket is owned by userspace */
213 sockfd_put(sk->sk_socket);
214 }
215 sock_put(sk);
216 }
Tom Parkin8abbbe82013-03-19 06:11:17 +0000217 sock_put(sk);
Tom Parkin80d84ef2013-01-22 05:13:48 +0000218}
Tom Parkin80d84ef2013-01-22 05:13:48 +0000219
James Chapmanf7faffa2010-04-02 06:18:49 +0000220/* Lookup a session by id in the global session list
221 */
222static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
223{
224 struct l2tp_net *pn = l2tp_pernet(net);
225 struct hlist_head *session_list =
226 l2tp_session_id_hash_2(pn, session_id);
227 struct l2tp_session *session;
James Chapmanf7faffa2010-04-02 06:18:49 +0000228
James Chapmane02d4942010-04-02 06:19:16 +0000229 rcu_read_lock_bh();
Sasha Levinb67bfe02013-02-27 17:06:00 -0800230 hlist_for_each_entry_rcu(session, session_list, global_hlist) {
James Chapmanf7faffa2010-04-02 06:18:49 +0000231 if (session->session_id == session_id) {
James Chapmane02d4942010-04-02 06:19:16 +0000232 rcu_read_unlock_bh();
James Chapmanf7faffa2010-04-02 06:18:49 +0000233 return session;
234 }
235 }
James Chapmane02d4942010-04-02 06:19:16 +0000236 rcu_read_unlock_bh();
James Chapmanf7faffa2010-04-02 06:18:49 +0000237
238 return NULL;
239}
240
James Chapmanfd558d12010-04-02 06:18:33 +0000241/* Session hash list.
242 * The session_id SHOULD be random according to RFC2661, but several
243 * L2TP implementations (Cisco and Microsoft) use incrementing
244 * session_ids. So we do a real hash on the session_id, rather than a
245 * simple bitmask.
246 */
247static inline struct hlist_head *
248l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id)
249{
250 return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)];
251}
252
253/* Lookup a session by id
254 */
James Chapmanf7faffa2010-04-02 06:18:49 +0000255struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id)
James Chapmanfd558d12010-04-02 06:18:33 +0000256{
James Chapmanf7faffa2010-04-02 06:18:49 +0000257 struct hlist_head *session_list;
James Chapmanfd558d12010-04-02 06:18:33 +0000258 struct l2tp_session *session;
James Chapmanfd558d12010-04-02 06:18:33 +0000259
James Chapmanf7faffa2010-04-02 06:18:49 +0000260 /* In L2TPv3, session_ids are unique over all tunnels and we
261 * sometimes need to look them up before we know the
262 * tunnel.
263 */
264 if (tunnel == NULL)
265 return l2tp_session_find_2(net, session_id);
266
267 session_list = l2tp_session_id_hash(tunnel, session_id);
James Chapmanfd558d12010-04-02 06:18:33 +0000268 read_lock_bh(&tunnel->hlist_lock);
Sasha Levinb67bfe02013-02-27 17:06:00 -0800269 hlist_for_each_entry(session, session_list, hlist) {
James Chapmanfd558d12010-04-02 06:18:33 +0000270 if (session->session_id == session_id) {
271 read_unlock_bh(&tunnel->hlist_lock);
272 return session;
273 }
274 }
275 read_unlock_bh(&tunnel->hlist_lock);
276
277 return NULL;
278}
279EXPORT_SYMBOL_GPL(l2tp_session_find);
280
281struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
282{
283 int hash;
James Chapmanfd558d12010-04-02 06:18:33 +0000284 struct l2tp_session *session;
285 int count = 0;
286
287 read_lock_bh(&tunnel->hlist_lock);
288 for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
Sasha Levinb67bfe02013-02-27 17:06:00 -0800289 hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {
James Chapmanfd558d12010-04-02 06:18:33 +0000290 if (++count > nth) {
291 read_unlock_bh(&tunnel->hlist_lock);
292 return session;
293 }
294 }
295 }
296
297 read_unlock_bh(&tunnel->hlist_lock);
298
299 return NULL;
300}
301EXPORT_SYMBOL_GPL(l2tp_session_find_nth);
302
James Chapman309795f2010-04-02 06:19:10 +0000303/* Lookup a session by interface name.
304 * This is very inefficient but is only used by management interfaces.
305 */
306struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname)
307{
308 struct l2tp_net *pn = l2tp_pernet(net);
309 int hash;
James Chapman309795f2010-04-02 06:19:10 +0000310 struct l2tp_session *session;
311
James Chapmane02d4942010-04-02 06:19:16 +0000312 rcu_read_lock_bh();
James Chapman309795f2010-04-02 06:19:10 +0000313 for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) {
Sasha Levinb67bfe02013-02-27 17:06:00 -0800314 hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {
James Chapman309795f2010-04-02 06:19:10 +0000315 if (!strcmp(session->ifname, ifname)) {
James Chapmane02d4942010-04-02 06:19:16 +0000316 rcu_read_unlock_bh();
James Chapman309795f2010-04-02 06:19:10 +0000317 return session;
318 }
319 }
320 }
321
James Chapmane02d4942010-04-02 06:19:16 +0000322 rcu_read_unlock_bh();
James Chapman309795f2010-04-02 06:19:10 +0000323
324 return NULL;
325}
326EXPORT_SYMBOL_GPL(l2tp_session_find_by_ifname);
327
James Chapmanfd558d12010-04-02 06:18:33 +0000328/* Lookup a tunnel by id
329 */
330struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id)
331{
332 struct l2tp_tunnel *tunnel;
333 struct l2tp_net *pn = l2tp_pernet(net);
334
James Chapmane02d4942010-04-02 06:19:16 +0000335 rcu_read_lock_bh();
336 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
James Chapmanfd558d12010-04-02 06:18:33 +0000337 if (tunnel->tunnel_id == tunnel_id) {
James Chapmane02d4942010-04-02 06:19:16 +0000338 rcu_read_unlock_bh();
James Chapmanfd558d12010-04-02 06:18:33 +0000339 return tunnel;
340 }
341 }
James Chapmane02d4942010-04-02 06:19:16 +0000342 rcu_read_unlock_bh();
James Chapmanfd558d12010-04-02 06:18:33 +0000343
344 return NULL;
345}
346EXPORT_SYMBOL_GPL(l2tp_tunnel_find);
347
348struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth)
349{
350 struct l2tp_net *pn = l2tp_pernet(net);
351 struct l2tp_tunnel *tunnel;
352 int count = 0;
353
James Chapmane02d4942010-04-02 06:19:16 +0000354 rcu_read_lock_bh();
355 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
James Chapmanfd558d12010-04-02 06:18:33 +0000356 if (++count > nth) {
James Chapmane02d4942010-04-02 06:19:16 +0000357 rcu_read_unlock_bh();
James Chapmanfd558d12010-04-02 06:18:33 +0000358 return tunnel;
359 }
360 }
361
James Chapmane02d4942010-04-02 06:19:16 +0000362 rcu_read_unlock_bh();
James Chapmanfd558d12010-04-02 06:18:33 +0000363
364 return NULL;
365}
366EXPORT_SYMBOL_GPL(l2tp_tunnel_find_nth);
367
368/*****************************************************************************
369 * Receive data handling
370 *****************************************************************************/
371
372/* Queue a skb in order. We come here only if the skb has an L2TP sequence
373 * number.
374 */
375static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)
376{
377 struct sk_buff *skbp;
378 struct sk_buff *tmp;
James Chapmanf7faffa2010-04-02 06:18:49 +0000379 u32 ns = L2TP_SKB_CB(skb)->ns;
James Chapmanfd558d12010-04-02 06:18:33 +0000380
381 spin_lock_bh(&session->reorder_q.lock);
382 skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
383 if (L2TP_SKB_CB(skbp)->ns > ns) {
384 __skb_queue_before(&session->reorder_q, skbp, skb);
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000385 l2tp_dbg(session, L2TP_MSG_SEQ,
386 "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
387 session->name, ns, L2TP_SKB_CB(skbp)->ns,
388 skb_queue_len(&session->reorder_q));
Tom Parkin7b7c0712013-03-19 06:11:22 +0000389 atomic_long_inc(&session->stats.rx_oos_packets);
James Chapmanfd558d12010-04-02 06:18:33 +0000390 goto out;
391 }
392 }
393
394 __skb_queue_tail(&session->reorder_q, skb);
395
396out:
397 spin_unlock_bh(&session->reorder_q.lock);
398}
399
400/* Dequeue a single skb.
401 */
402static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)
403{
404 struct l2tp_tunnel *tunnel = session->tunnel;
405 int length = L2TP_SKB_CB(skb)->length;
406
407 /* We're about to requeue the skb, so return resources
408 * to its current owner (a socket receive buffer).
409 */
410 skb_orphan(skb);
411
Tom Parkin7b7c0712013-03-19 06:11:22 +0000412 atomic_long_inc(&tunnel->stats.rx_packets);
413 atomic_long_add(length, &tunnel->stats.rx_bytes);
414 atomic_long_inc(&session->stats.rx_packets);
415 atomic_long_add(length, &session->stats.rx_bytes);
James Chapmanfd558d12010-04-02 06:18:33 +0000416
417 if (L2TP_SKB_CB(skb)->has_seq) {
418 /* Bump our Nr */
419 session->nr++;
James Chapman8a1631d2013-07-02 20:28:59 +0100420 session->nr &= session->nr_max;
James Chapmanf7faffa2010-04-02 06:18:49 +0000421
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000422 l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated nr to %hu\n",
423 session->name, session->nr);
James Chapmanfd558d12010-04-02 06:18:33 +0000424 }
425
426 /* call private receive handler */
427 if (session->recv_skb != NULL)
428 (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);
429 else
430 kfree_skb(skb);
431
432 if (session->deref)
433 (*session->deref)(session);
434}
435
436/* Dequeue skbs from the session's reorder_q, subject to packet order.
437 * Skbs that have been in the queue for too long are simply discarded.
438 */
439static void l2tp_recv_dequeue(struct l2tp_session *session)
440{
441 struct sk_buff *skb;
442 struct sk_buff *tmp;
443
444 /* If the pkt at the head of the queue has the nr that we
445 * expect to send up next, dequeue it and any other
446 * in-sequence packets behind it.
447 */
Eric Dumazete2e210c2011-11-02 22:47:44 +0000448start:
James Chapmanfd558d12010-04-02 06:18:33 +0000449 spin_lock_bh(&session->reorder_q.lock);
450 skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
451 if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) {
Tom Parkin7b7c0712013-03-19 06:11:22 +0000452 atomic_long_inc(&session->stats.rx_seq_discards);
453 atomic_long_inc(&session->stats.rx_errors);
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000454 l2tp_dbg(session, L2TP_MSG_SEQ,
455 "%s: oos pkt %u len %d discarded (too old), waiting for %u, reorder_q_len=%d\n",
456 session->name, L2TP_SKB_CB(skb)->ns,
457 L2TP_SKB_CB(skb)->length, session->nr,
458 skb_queue_len(&session->reorder_q));
James Chapman38d40b32012-05-09 23:43:08 +0000459 session->reorder_skip = 1;
James Chapmanfd558d12010-04-02 06:18:33 +0000460 __skb_unlink(skb, &session->reorder_q);
461 kfree_skb(skb);
462 if (session->deref)
463 (*session->deref)(session);
464 continue;
465 }
466
467 if (L2TP_SKB_CB(skb)->has_seq) {
James Chapman38d40b32012-05-09 23:43:08 +0000468 if (session->reorder_skip) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000469 l2tp_dbg(session, L2TP_MSG_SEQ,
470 "%s: advancing nr to next pkt: %u -> %u",
471 session->name, session->nr,
472 L2TP_SKB_CB(skb)->ns);
James Chapman38d40b32012-05-09 23:43:08 +0000473 session->reorder_skip = 0;
474 session->nr = L2TP_SKB_CB(skb)->ns;
475 }
James Chapmanfd558d12010-04-02 06:18:33 +0000476 if (L2TP_SKB_CB(skb)->ns != session->nr) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000477 l2tp_dbg(session, L2TP_MSG_SEQ,
478 "%s: holding oos pkt %u len %d, waiting for %u, reorder_q_len=%d\n",
479 session->name, L2TP_SKB_CB(skb)->ns,
480 L2TP_SKB_CB(skb)->length, session->nr,
481 skb_queue_len(&session->reorder_q));
James Chapmanfd558d12010-04-02 06:18:33 +0000482 goto out;
483 }
484 }
485 __skb_unlink(skb, &session->reorder_q);
486
487 /* Process the skb. We release the queue lock while we
488 * do so to let other contexts process the queue.
489 */
490 spin_unlock_bh(&session->reorder_q.lock);
491 l2tp_recv_dequeue_skb(session, skb);
Eric Dumazete2e210c2011-11-02 22:47:44 +0000492 goto start;
James Chapmanfd558d12010-04-02 06:18:33 +0000493 }
494
495out:
496 spin_unlock_bh(&session->reorder_q.lock);
497}
498
James Chapman8a1631d2013-07-02 20:28:59 +0100499static int l2tp_seq_check_rx_window(struct l2tp_session *session, u32 nr)
500{
501 u32 nws;
502
503 if (nr >= session->nr)
504 nws = nr - session->nr;
505 else
506 nws = (session->nr_max + 1) - (session->nr - nr);
507
508 return nws < session->nr_window_size;
509}
510
James Chapmanb6dc01a2013-07-02 20:28:58 +0100511/* If packet has sequence numbers, queue it if acceptable. Returns 0 if
512 * acceptable, else non-zero.
513 */
514static int l2tp_recv_data_seq(struct l2tp_session *session, struct sk_buff *skb)
515{
James Chapman8a1631d2013-07-02 20:28:59 +0100516 if (!l2tp_seq_check_rx_window(session, L2TP_SKB_CB(skb)->ns)) {
517 /* Packet sequence number is outside allowed window.
518 * Discard it.
519 */
520 l2tp_dbg(session, L2TP_MSG_SEQ,
521 "%s: pkt %u len %d discarded, outside window, nr=%u\n",
522 session->name, L2TP_SKB_CB(skb)->ns,
523 L2TP_SKB_CB(skb)->length, session->nr);
524 goto discard;
525 }
526
James Chapmanb6dc01a2013-07-02 20:28:58 +0100527 if (session->reorder_timeout != 0) {
528 /* Packet reordering enabled. Add skb to session's
529 * reorder queue, in order of ns.
530 */
531 l2tp_recv_queue_skb(session, skb);
James Chapmana0dbd822013-07-02 20:29:00 +0100532 goto out;
533 }
534
535 /* Packet reordering disabled. Discard out-of-sequence packets, while
536 * tracking the number if in-sequence packets after the first OOS packet
537 * is seen. After nr_oos_count_max in-sequence packets, reset the
538 * sequence number to re-enable packet reception.
539 */
540 if (L2TP_SKB_CB(skb)->ns == session->nr) {
541 skb_queue_tail(&session->reorder_q, skb);
James Chapmanb6dc01a2013-07-02 20:28:58 +0100542 } else {
James Chapmana0dbd822013-07-02 20:29:00 +0100543 u32 nr_oos = L2TP_SKB_CB(skb)->ns;
544 u32 nr_next = (session->nr_oos + 1) & session->nr_max;
545
546 if (nr_oos == nr_next)
547 session->nr_oos_count++;
548 else
549 session->nr_oos_count = 0;
550
551 session->nr_oos = nr_oos;
552 if (session->nr_oos_count > session->nr_oos_count_max) {
553 session->reorder_skip = 1;
554 l2tp_dbg(session, L2TP_MSG_SEQ,
555 "%s: %d oos packets received. Resetting sequence numbers\n",
556 session->name, session->nr_oos_count);
557 }
558 if (!session->reorder_skip) {
James Chapmanb6dc01a2013-07-02 20:28:58 +0100559 atomic_long_inc(&session->stats.rx_seq_discards);
560 l2tp_dbg(session, L2TP_MSG_SEQ,
561 "%s: oos pkt %u len %d discarded, waiting for %u, reorder_q_len=%d\n",
562 session->name, L2TP_SKB_CB(skb)->ns,
563 L2TP_SKB_CB(skb)->length, session->nr,
564 skb_queue_len(&session->reorder_q));
565 goto discard;
566 }
567 skb_queue_tail(&session->reorder_q, skb);
568 }
569
James Chapmana0dbd822013-07-02 20:29:00 +0100570out:
James Chapmanb6dc01a2013-07-02 20:28:58 +0100571 return 0;
572
573discard:
574 return 1;
575}
576
James Chapmanf7faffa2010-04-02 06:18:49 +0000577/* Do receive processing of L2TP data frames. We handle both L2TPv2
578 * and L2TPv3 data frames here.
579 *
580 * L2TPv2 Data Message Header
581 *
582 * 0 1 2 3
583 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
584 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
585 * |T|L|x|x|S|x|O|P|x|x|x|x| Ver | Length (opt) |
586 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
587 * | Tunnel ID | Session ID |
588 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
589 * | Ns (opt) | Nr (opt) |
590 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
591 * | Offset Size (opt) | Offset pad... (opt)
592 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
593 *
594 * Data frames are marked by T=0. All other fields are the same as
595 * those in L2TP control frames.
596 *
597 * L2TPv3 Data Message Header
598 *
599 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
600 * | L2TP Session Header |
601 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
602 * | L2-Specific Sublayer |
603 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
604 * | Tunnel Payload ...
605 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
606 *
607 * L2TPv3 Session Header Over IP
608 *
609 * 0 1 2 3
610 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
611 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
612 * | Session ID |
613 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
614 * | Cookie (optional, maximum 64 bits)...
615 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
616 * |
617 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
618 *
619 * L2TPv3 L2-Specific Sublayer Format
620 *
621 * 0 1 2 3
622 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
623 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
624 * |x|S|x|x|x|x|x|x| Sequence Number |
625 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
626 *
627 * Cookie value, sublayer format and offset (pad) are negotiated with
628 * the peer when the session is set up. Unlike L2TPv2, we do not need
629 * to parse the packet header to determine if optional fields are
630 * present.
631 *
632 * Caller must already have parsed the frame and determined that it is
633 * a data (not control) frame before coming here. Fields up to the
634 * session-id have already been parsed and ptr points to the data
635 * after the session-id.
James Chapmanfd558d12010-04-02 06:18:33 +0000636 */
James Chapmanf7faffa2010-04-02 06:18:49 +0000637void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
638 unsigned char *ptr, unsigned char *optr, u16 hdrflags,
639 int length, int (*payload_hook)(struct sk_buff *skb))
James Chapmanfd558d12010-04-02 06:18:33 +0000640{
James Chapmanf7faffa2010-04-02 06:18:49 +0000641 struct l2tp_tunnel *tunnel = session->tunnel;
James Chapmanfd558d12010-04-02 06:18:33 +0000642 int offset;
James Chapmanf7faffa2010-04-02 06:18:49 +0000643 u32 ns, nr;
James Chapmanfd558d12010-04-02 06:18:33 +0000644
645 /* The ref count is increased since we now hold a pointer to
646 * the session. Take care to decrement the refcnt when exiting
647 * this function from now on...
648 */
649 l2tp_session_inc_refcount(session);
650 if (session->ref)
651 (*session->ref)(session);
652
James Chapmanf7faffa2010-04-02 06:18:49 +0000653 /* Parse and check optional cookie */
654 if (session->peer_cookie_len > 0) {
655 if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000656 l2tp_info(tunnel, L2TP_MSG_DATA,
657 "%s: cookie mismatch (%u/%u). Discarding.\n",
658 tunnel->name, tunnel->tunnel_id,
659 session->session_id);
Tom Parkin7b7c0712013-03-19 06:11:22 +0000660 atomic_long_inc(&session->stats.rx_cookie_discards);
James Chapmanf7faffa2010-04-02 06:18:49 +0000661 goto discard;
662 }
663 ptr += session->peer_cookie_len;
664 }
665
James Chapmanfd558d12010-04-02 06:18:33 +0000666 /* Handle the optional sequence numbers. Sequence numbers are
667 * in different places for L2TPv2 and L2TPv3.
668 *
669 * If we are the LAC, enable/disable sequence numbers under
670 * the control of the LNS. If no sequence numbers present but
671 * we were expecting them, discard frame.
672 */
673 ns = nr = 0;
674 L2TP_SKB_CB(skb)->has_seq = 0;
James Chapmanf7faffa2010-04-02 06:18:49 +0000675 if (tunnel->version == L2TP_HDR_VER_2) {
676 if (hdrflags & L2TP_HDRFLAG_S) {
677 ns = ntohs(*(__be16 *) ptr);
678 ptr += 2;
679 nr = ntohs(*(__be16 *) ptr);
680 ptr += 2;
James Chapmanfd558d12010-04-02 06:18:33 +0000681
James Chapmanf7faffa2010-04-02 06:18:49 +0000682 /* Store L2TP info in the skb */
683 L2TP_SKB_CB(skb)->ns = ns;
684 L2TP_SKB_CB(skb)->has_seq = 1;
James Chapmanfd558d12010-04-02 06:18:33 +0000685
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000686 l2tp_dbg(session, L2TP_MSG_SEQ,
687 "%s: recv data ns=%u, nr=%u, session nr=%u\n",
688 session->name, ns, nr, session->nr);
James Chapmanf7faffa2010-04-02 06:18:49 +0000689 }
690 } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
691 u32 l2h = ntohl(*(__be32 *) ptr);
692
693 if (l2h & 0x40000000) {
694 ns = l2h & 0x00ffffff;
695
696 /* Store L2TP info in the skb */
697 L2TP_SKB_CB(skb)->ns = ns;
698 L2TP_SKB_CB(skb)->has_seq = 1;
699
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000700 l2tp_dbg(session, L2TP_MSG_SEQ,
701 "%s: recv data ns=%u, session nr=%u\n",
702 session->name, ns, session->nr);
James Chapmanf7faffa2010-04-02 06:18:49 +0000703 }
James Chapmanfd558d12010-04-02 06:18:33 +0000704 }
705
James Chapmanf7faffa2010-04-02 06:18:49 +0000706 /* Advance past L2-specific header, if present */
707 ptr += session->l2specific_len;
708
James Chapmanfd558d12010-04-02 06:18:33 +0000709 if (L2TP_SKB_CB(skb)->has_seq) {
710 /* Received a packet with sequence numbers. If we're the LNS,
711 * check if we sre sending sequence numbers and if not,
712 * configure it so.
713 */
714 if ((!session->lns_mode) && (!session->send_seq)) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000715 l2tp_info(session, L2TP_MSG_SEQ,
716 "%s: requested to enable seq numbers by LNS\n",
717 session->name);
James Chapmanfd558d12010-04-02 06:18:33 +0000718 session->send_seq = -1;
James Chapmanf7faffa2010-04-02 06:18:49 +0000719 l2tp_session_set_header_len(session, tunnel->version);
James Chapmanfd558d12010-04-02 06:18:33 +0000720 }
721 } else {
722 /* No sequence numbers.
723 * If user has configured mandatory sequence numbers, discard.
724 */
725 if (session->recv_seq) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000726 l2tp_warn(session, L2TP_MSG_SEQ,
727 "%s: recv data has no seq numbers when required. Discarding.\n",
728 session->name);
Tom Parkin7b7c0712013-03-19 06:11:22 +0000729 atomic_long_inc(&session->stats.rx_seq_discards);
James Chapmanfd558d12010-04-02 06:18:33 +0000730 goto discard;
731 }
732
733 /* If we're the LAC and we're sending sequence numbers, the
734 * LNS has requested that we no longer send sequence numbers.
735 * If we're the LNS and we're sending sequence numbers, the
736 * LAC is broken. Discard the frame.
737 */
738 if ((!session->lns_mode) && (session->send_seq)) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000739 l2tp_info(session, L2TP_MSG_SEQ,
740 "%s: requested to disable seq numbers by LNS\n",
741 session->name);
James Chapmanfd558d12010-04-02 06:18:33 +0000742 session->send_seq = 0;
James Chapmanf7faffa2010-04-02 06:18:49 +0000743 l2tp_session_set_header_len(session, tunnel->version);
James Chapmanfd558d12010-04-02 06:18:33 +0000744 } else if (session->send_seq) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000745 l2tp_warn(session, L2TP_MSG_SEQ,
746 "%s: recv data has no seq numbers when required. Discarding.\n",
747 session->name);
Tom Parkin7b7c0712013-03-19 06:11:22 +0000748 atomic_long_inc(&session->stats.rx_seq_discards);
James Chapmanfd558d12010-04-02 06:18:33 +0000749 goto discard;
750 }
751 }
752
James Chapmanf7faffa2010-04-02 06:18:49 +0000753 /* Session data offset is handled differently for L2TPv2 and
754 * L2TPv3. For L2TPv2, there is an optional 16-bit value in
755 * the header. For L2TPv3, the offset is negotiated using AVPs
756 * in the session setup control protocol.
757 */
758 if (tunnel->version == L2TP_HDR_VER_2) {
759 /* If offset bit set, skip it. */
760 if (hdrflags & L2TP_HDRFLAG_O) {
761 offset = ntohs(*(__be16 *)ptr);
762 ptr += 2 + offset;
763 }
764 } else
765 ptr += session->offset;
James Chapmanfd558d12010-04-02 06:18:33 +0000766
767 offset = ptr - optr;
768 if (!pskb_may_pull(skb, offset))
769 goto discard;
770
771 __skb_pull(skb, offset);
772
773 /* If caller wants to process the payload before we queue the
774 * packet, do so now.
775 */
776 if (payload_hook)
777 if ((*payload_hook)(skb))
778 goto discard;
779
780 /* Prepare skb for adding to the session's reorder_q. Hold
781 * packets for max reorder_timeout or 1 second if not
782 * reordering.
783 */
784 L2TP_SKB_CB(skb)->length = length;
785 L2TP_SKB_CB(skb)->expires = jiffies +
786 (session->reorder_timeout ? session->reorder_timeout : HZ);
787
788 /* Add packet to the session's receive queue. Reordering is done here, if
789 * enabled. Saved L2TP protocol info is stored in skb->sb[].
790 */
791 if (L2TP_SKB_CB(skb)->has_seq) {
James Chapmanb6dc01a2013-07-02 20:28:58 +0100792 if (l2tp_recv_data_seq(session, skb))
793 goto discard;
James Chapmanfd558d12010-04-02 06:18:33 +0000794 } else {
795 /* No sequence numbers. Add the skb to the tail of the
796 * reorder queue. This ensures that it will be
797 * delivered after all previous sequenced skbs.
798 */
799 skb_queue_tail(&session->reorder_q, skb);
800 }
801
802 /* Try to dequeue as many skbs from reorder_q as we can. */
803 l2tp_recv_dequeue(session);
804
805 l2tp_session_dec_refcount(session);
806
James Chapmanf7faffa2010-04-02 06:18:49 +0000807 return;
James Chapmanfd558d12010-04-02 06:18:33 +0000808
809discard:
Tom Parkin7b7c0712013-03-19 06:11:22 +0000810 atomic_long_inc(&session->stats.rx_errors);
James Chapmanfd558d12010-04-02 06:18:33 +0000811 kfree_skb(skb);
812
813 if (session->deref)
814 (*session->deref)(session);
815
816 l2tp_session_dec_refcount(session);
James Chapmanf7faffa2010-04-02 06:18:49 +0000817}
818EXPORT_SYMBOL(l2tp_recv_common);
819
Tom Parkin48f72f92013-03-19 06:11:19 +0000820/* Drop skbs from the session's reorder_q
821 */
822int l2tp_session_queue_purge(struct l2tp_session *session)
823{
824 struct sk_buff *skb = NULL;
825 BUG_ON(!session);
826 BUG_ON(session->magic != L2TP_SESSION_MAGIC);
827 while ((skb = skb_dequeue(&session->reorder_q))) {
828 atomic_long_inc(&session->stats.rx_errors);
829 kfree_skb(skb);
830 if (session->deref)
831 (*session->deref)(session);
832 }
833 return 0;
834}
835EXPORT_SYMBOL_GPL(l2tp_session_queue_purge);
836
James Chapmanf7faffa2010-04-02 06:18:49 +0000837/* Internal UDP receive frame. Do the real work of receiving an L2TP data frame
838 * here. The skb is not on a list when we get here.
839 * Returns 0 if the packet was a data packet and was successfully passed on.
840 * Returns 1 if the packet was not a good data packet and could not be
841 * forwarded. All such packets are passed up to userspace to deal with.
842 */
stephen hemmingerfc130842010-10-21 07:50:46 +0000843static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
844 int (*payload_hook)(struct sk_buff *skb))
James Chapmanf7faffa2010-04-02 06:18:49 +0000845{
846 struct l2tp_session *session = NULL;
847 unsigned char *ptr, *optr;
848 u16 hdrflags;
849 u32 tunnel_id, session_id;
James Chapmanf7faffa2010-04-02 06:18:49 +0000850 u16 version;
851 int length;
852
Tom Herbert58d60852014-05-07 16:52:48 -0700853 /* UDP has verifed checksum */
James Chapmanf7faffa2010-04-02 06:18:49 +0000854
855 /* UDP always verifies the packet length. */
856 __skb_pull(skb, sizeof(struct udphdr));
857
858 /* Short packet? */
859 if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000860 l2tp_info(tunnel, L2TP_MSG_DATA,
861 "%s: recv short packet (len=%d)\n",
862 tunnel->name, skb->len);
James Chapmanf7faffa2010-04-02 06:18:49 +0000863 goto error;
864 }
865
James Chapmanf7faffa2010-04-02 06:18:49 +0000866 /* Trace packet contents, if enabled */
867 if (tunnel->debug & L2TP_MSG_DATA) {
868 length = min(32u, skb->len);
869 if (!pskb_may_pull(skb, length))
870 goto error;
871
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000872 pr_debug("%s: recv\n", tunnel->name);
873 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length);
James Chapmanf7faffa2010-04-02 06:18:49 +0000874 }
875
Eric Dumazete50e7052011-11-08 13:59:44 -0500876 /* Point to L2TP header */
877 optr = ptr = skb->data;
878
James Chapmanf7faffa2010-04-02 06:18:49 +0000879 /* Get L2TP header flags */
880 hdrflags = ntohs(*(__be16 *) ptr);
881
882 /* Check protocol version */
883 version = hdrflags & L2TP_HDR_VER_MASK;
884 if (version != tunnel->version) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000885 l2tp_info(tunnel, L2TP_MSG_DATA,
886 "%s: recv protocol version mismatch: got %d expected %d\n",
887 tunnel->name, version, tunnel->version);
James Chapmanf7faffa2010-04-02 06:18:49 +0000888 goto error;
889 }
890
891 /* Get length of L2TP packet */
892 length = skb->len;
893
894 /* If type is control packet, it is handled by userspace. */
895 if (hdrflags & L2TP_HDRFLAG_T) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000896 l2tp_dbg(tunnel, L2TP_MSG_DATA,
897 "%s: recv control packet, len=%d\n",
898 tunnel->name, length);
James Chapmanf7faffa2010-04-02 06:18:49 +0000899 goto error;
900 }
901
902 /* Skip flags */
903 ptr += 2;
904
905 if (tunnel->version == L2TP_HDR_VER_2) {
906 /* If length is present, skip it */
907 if (hdrflags & L2TP_HDRFLAG_L)
908 ptr += 2;
909
910 /* Extract tunnel and session ID */
911 tunnel_id = ntohs(*(__be16 *) ptr);
912 ptr += 2;
913 session_id = ntohs(*(__be16 *) ptr);
914 ptr += 2;
915 } else {
916 ptr += 2; /* skip reserved bits */
917 tunnel_id = tunnel->tunnel_id;
918 session_id = ntohl(*(__be32 *) ptr);
919 ptr += 4;
920 }
921
922 /* Find the session context */
923 session = l2tp_session_find(tunnel->l2tp_net, tunnel, session_id);
James Chapman309795f2010-04-02 06:19:10 +0000924 if (!session || !session->recv_skb) {
James Chapmanf7faffa2010-04-02 06:18:49 +0000925 /* Not found? Pass to userspace to deal with */
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000926 l2tp_info(tunnel, L2TP_MSG_DATA,
927 "%s: no session found (%u/%u). Passing up.\n",
928 tunnel->name, tunnel_id, session_id);
James Chapmanf7faffa2010-04-02 06:18:49 +0000929 goto error;
930 }
931
932 l2tp_recv_common(session, skb, ptr, optr, hdrflags, length, payload_hook);
James Chapmanfd558d12010-04-02 06:18:33 +0000933
934 return 0;
935
James Chapmanfd558d12010-04-02 06:18:33 +0000936error:
937 /* Put UDP header back */
938 __skb_push(skb, sizeof(struct udphdr));
939
940 return 1;
941}
James Chapmanfd558d12010-04-02 06:18:33 +0000942
943/* UDP encapsulation receive handler. See net/ipv4/udp.c.
944 * Return codes:
945 * 0 : success.
946 * <0: error
947 * >0: skb should be passed up to userspace as UDP.
948 */
949int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
950{
951 struct l2tp_tunnel *tunnel;
952
953 tunnel = l2tp_sock_to_tunnel(sk);
954 if (tunnel == NULL)
955 goto pass_up;
956
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000957 l2tp_dbg(tunnel, L2TP_MSG_DATA, "%s: received %d bytes\n",
958 tunnel->name, skb->len);
James Chapmanfd558d12010-04-02 06:18:33 +0000959
960 if (l2tp_udp_recv_core(tunnel, skb, tunnel->recv_payload_hook))
961 goto pass_up_put;
962
963 sock_put(sk);
964 return 0;
965
966pass_up_put:
967 sock_put(sk);
968pass_up:
969 return 1;
970}
971EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv);
972
973/************************************************************************
974 * Transmit handling
975 ***********************************************************************/
976
977/* Build an L2TP header for the session into the buffer provided.
978 */
James Chapmanf7faffa2010-04-02 06:18:49 +0000979static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
James Chapmanfd558d12010-04-02 06:18:33 +0000980{
James Chapmanf7faffa2010-04-02 06:18:49 +0000981 struct l2tp_tunnel *tunnel = session->tunnel;
James Chapmanfd558d12010-04-02 06:18:33 +0000982 __be16 *bufp = buf;
James Chapmanf7faffa2010-04-02 06:18:49 +0000983 __be16 *optr = buf;
James Chapmanfd558d12010-04-02 06:18:33 +0000984 u16 flags = L2TP_HDR_VER_2;
985 u32 tunnel_id = tunnel->peer_tunnel_id;
986 u32 session_id = session->peer_session_id;
987
988 if (session->send_seq)
989 flags |= L2TP_HDRFLAG_S;
990
991 /* Setup L2TP header. */
992 *bufp++ = htons(flags);
993 *bufp++ = htons(tunnel_id);
994 *bufp++ = htons(session_id);
995 if (session->send_seq) {
996 *bufp++ = htons(session->ns);
997 *bufp++ = 0;
998 session->ns++;
James Chapmanf7faffa2010-04-02 06:18:49 +0000999 session->ns &= 0xffff;
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001000 l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated ns to %u\n",
1001 session->name, session->ns);
James Chapmanfd558d12010-04-02 06:18:33 +00001002 }
James Chapmanf7faffa2010-04-02 06:18:49 +00001003
1004 return bufp - optr;
James Chapmanfd558d12010-04-02 06:18:33 +00001005}
1006
James Chapmanf7faffa2010-04-02 06:18:49 +00001007static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
James Chapmanfd558d12010-04-02 06:18:33 +00001008{
James Chapman0d767512010-04-02 06:19:00 +00001009 struct l2tp_tunnel *tunnel = session->tunnel;
James Chapmanf7faffa2010-04-02 06:18:49 +00001010 char *bufp = buf;
1011 char *optr = bufp;
James Chapmanfd558d12010-04-02 06:18:33 +00001012
James Chapman0d767512010-04-02 06:19:00 +00001013 /* Setup L2TP header. The header differs slightly for UDP and
1014 * IP encapsulations. For UDP, there is 4 bytes of flags.
1015 */
1016 if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
1017 u16 flags = L2TP_HDR_VER_3;
1018 *((__be16 *) bufp) = htons(flags);
1019 bufp += 2;
1020 *((__be16 *) bufp) = 0;
1021 bufp += 2;
1022 }
1023
James Chapmanf7faffa2010-04-02 06:18:49 +00001024 *((__be32 *) bufp) = htonl(session->peer_session_id);
1025 bufp += 4;
1026 if (session->cookie_len) {
1027 memcpy(bufp, &session->cookie[0], session->cookie_len);
1028 bufp += session->cookie_len;
1029 }
1030 if (session->l2specific_len) {
1031 if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
1032 u32 l2h = 0;
1033 if (session->send_seq) {
1034 l2h = 0x40000000 | session->ns;
1035 session->ns++;
1036 session->ns &= 0xffffff;
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001037 l2tp_dbg(session, L2TP_MSG_SEQ,
1038 "%s: updated ns to %u\n",
1039 session->name, session->ns);
James Chapmanf7faffa2010-04-02 06:18:49 +00001040 }
1041
1042 *((__be32 *) bufp) = htonl(l2h);
1043 }
1044 bufp += session->l2specific_len;
1045 }
1046 if (session->offset)
1047 bufp += session->offset;
1048
1049 return bufp - optr;
James Chapmanfd558d12010-04-02 06:18:33 +00001050}
James Chapmanfd558d12010-04-02 06:18:33 +00001051
stephen hemmingerfc130842010-10-21 07:50:46 +00001052static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
David S. Millerd9d8da82011-05-06 22:23:20 -07001053 struct flowi *fl, size_t data_len)
James Chapmanfd558d12010-04-02 06:18:33 +00001054{
1055 struct l2tp_tunnel *tunnel = session->tunnel;
1056 unsigned int len = skb->len;
1057 int error;
1058
1059 /* Debug */
1060 if (session->send_seq)
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001061 l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %Zd bytes, ns=%u\n",
1062 session->name, data_len, session->ns - 1);
James Chapmanfd558d12010-04-02 06:18:33 +00001063 else
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001064 l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %Zd bytes\n",
1065 session->name, data_len);
James Chapmanfd558d12010-04-02 06:18:33 +00001066
1067 if (session->debug & L2TP_MSG_DATA) {
James Chapman0d767512010-04-02 06:19:00 +00001068 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1069 unsigned char *datap = skb->data + uhlen;
James Chapmanfd558d12010-04-02 06:18:33 +00001070
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001071 pr_debug("%s: xmit\n", session->name);
1072 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1073 datap, min_t(size_t, 32, len - uhlen));
James Chapmanfd558d12010-04-02 06:18:33 +00001074 }
1075
1076 /* Queue the packet to IP for output */
WANG Cong60ff7462014-05-04 16:39:18 -07001077 skb->ignore_df = 1;
Benjamin LaHaised2cf3362012-04-27 08:24:18 +00001078#if IS_ENABLED(CONFIG_IPV6)
Eric Dumazet746e3492014-03-07 14:57:43 -08001079 if (tunnel->sock->sk_family == PF_INET6 && !tunnel->v4mapped)
Eric Dumazetb0270e92014-04-15 12:58:34 -04001080 error = inet6_csk_xmit(tunnel->sock, skb, NULL);
Benjamin LaHaised2cf3362012-04-27 08:24:18 +00001081 else
1082#endif
Eric Dumazetb0270e92014-04-15 12:58:34 -04001083 error = ip_queue_xmit(tunnel->sock, skb, fl);
James Chapmanfd558d12010-04-02 06:18:33 +00001084
1085 /* Update stats */
1086 if (error >= 0) {
Tom Parkin7b7c0712013-03-19 06:11:22 +00001087 atomic_long_inc(&tunnel->stats.tx_packets);
1088 atomic_long_add(len, &tunnel->stats.tx_bytes);
1089 atomic_long_inc(&session->stats.tx_packets);
1090 atomic_long_add(len, &session->stats.tx_bytes);
James Chapmanfd558d12010-04-02 06:18:33 +00001091 } else {
Tom Parkin7b7c0712013-03-19 06:11:22 +00001092 atomic_long_inc(&tunnel->stats.tx_errors);
1093 atomic_long_inc(&session->stats.tx_errors);
James Chapmanfd558d12010-04-02 06:18:33 +00001094 }
1095
1096 return 0;
1097}
James Chapmanfd558d12010-04-02 06:18:33 +00001098
James Chapmanfd558d12010-04-02 06:18:33 +00001099/* If caller requires the skb to have a ppp header, the header must be
1100 * inserted in the skb data before calling this function.
1101 */
1102int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len)
1103{
1104 int data_len = skb->len;
James Chapman0d767512010-04-02 06:19:00 +00001105 struct l2tp_tunnel *tunnel = session->tunnel;
1106 struct sock *sk = tunnel->sock;
David S. Millerd9d8da82011-05-06 22:23:20 -07001107 struct flowi *fl;
James Chapmanfd558d12010-04-02 06:18:33 +00001108 struct udphdr *uh;
James Chapmanfd558d12010-04-02 06:18:33 +00001109 struct inet_sock *inet;
James Chapmanfd558d12010-04-02 06:18:33 +00001110 int headroom;
James Chapman0d767512010-04-02 06:19:00 +00001111 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1112 int udp_len;
Eric Dumazetb8c84302012-06-28 20:15:13 +00001113 int ret = NET_XMIT_SUCCESS;
James Chapmanfd558d12010-04-02 06:18:33 +00001114
1115 /* Check that there's enough headroom in the skb to insert IP,
1116 * UDP and L2TP headers. If not enough, expand it to
1117 * make room. Adjust truesize.
1118 */
1119 headroom = NET_SKB_PAD + sizeof(struct iphdr) +
James Chapman0d767512010-04-02 06:19:00 +00001120 uhlen + hdr_len;
Eric Dumazet835acf52011-10-07 05:35:46 +00001121 if (skb_cow_head(skb, headroom)) {
Eric Dumazetb8c84302012-06-28 20:15:13 +00001122 kfree_skb(skb);
1123 return NET_XMIT_DROP;
Eric Dumazet835acf52011-10-07 05:35:46 +00001124 }
James Chapmanfd558d12010-04-02 06:18:33 +00001125
James Chapmanfd558d12010-04-02 06:18:33 +00001126 /* Setup L2TP header */
James Chapmanf7faffa2010-04-02 06:18:49 +00001127 session->build_header(session, __skb_push(skb, hdr_len));
James Chapmanfd558d12010-04-02 06:18:33 +00001128
James Chapman0d767512010-04-02 06:19:00 +00001129 /* Reset skb netfilter state */
James Chapmanfd558d12010-04-02 06:18:33 +00001130 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
1131 IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
1132 IPSKB_REROUTED);
1133 nf_reset(skb);
1134
David S. Miller6af88da2011-05-08 13:45:20 -07001135 bh_lock_sock(sk);
1136 if (sock_owned_by_user(sk)) {
Eric Dumazetb8c84302012-06-28 20:15:13 +00001137 kfree_skb(skb);
1138 ret = NET_XMIT_DROP;
David S. Miller6af88da2011-05-08 13:45:20 -07001139 goto out_unlock;
1140 }
1141
James Chapmanfd558d12010-04-02 06:18:33 +00001142 /* Get routing info from the tunnel socket */
1143 skb_dst_drop(skb);
Florian Westphal71b13912011-11-25 06:47:16 +00001144 skb_dst_set(skb, dst_clone(__sk_dst_check(sk, 0)));
James Chapmanfd558d12010-04-02 06:18:33 +00001145
David S. Millerd9d8da82011-05-06 22:23:20 -07001146 inet = inet_sk(sk);
1147 fl = &inet->cork.fl;
James Chapman0d767512010-04-02 06:19:00 +00001148 switch (tunnel->encap) {
1149 case L2TP_ENCAPTYPE_UDP:
1150 /* Setup UDP header */
James Chapman0d767512010-04-02 06:19:00 +00001151 __skb_push(skb, sizeof(*uh));
1152 skb_reset_transport_header(skb);
1153 uh = udp_hdr(skb);
1154 uh->source = inet->inet_sport;
1155 uh->dest = inet->inet_dport;
1156 udp_len = uhlen + hdr_len + data_len;
1157 uh->len = htons(udp_len);
James Chapman0d767512010-04-02 06:19:00 +00001158
1159 /* Calculate UDP checksum if configured to do so */
Benjamin LaHaised2cf3362012-04-27 08:24:18 +00001160#if IS_ENABLED(CONFIG_IPV6)
François Cachereule18503f2013-10-02 10:16:02 +02001161 if (sk->sk_family == PF_INET6 && !tunnel->v4mapped)
Tom Herbert77157e12014-06-04 17:19:56 -07001162 udp6_set_csum(udp_get_no_check6_tx(sk),
1163 skb, &inet6_sk(sk)->saddr,
1164 &sk->sk_v6_daddr, udp_len);
Benjamin LaHaised2cf3362012-04-27 08:24:18 +00001165 else
1166#endif
Tom Herbert77157e12014-06-04 17:19:56 -07001167 udp_set_csum(sk->sk_no_check_tx, skb, inet->inet_saddr,
1168 inet->inet_daddr, udp_len);
James Chapman0d767512010-04-02 06:19:00 +00001169 break;
1170
1171 case L2TP_ENCAPTYPE_IP:
1172 break;
James Chapmanfd558d12010-04-02 06:18:33 +00001173 }
1174
David S. Millerd9d8da82011-05-06 22:23:20 -07001175 l2tp_xmit_core(session, skb, fl, data_len);
David S. Miller6af88da2011-05-08 13:45:20 -07001176out_unlock:
1177 bh_unlock_sock(sk);
James Chapmanfd558d12010-04-02 06:18:33 +00001178
Eric Dumazetb8c84302012-06-28 20:15:13 +00001179 return ret;
James Chapmanfd558d12010-04-02 06:18:33 +00001180}
1181EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
1182
1183/*****************************************************************************
1184 * Tinnel and session create/destroy.
1185 *****************************************************************************/
1186
1187/* Tunnel socket destruct hook.
1188 * The tunnel context is deleted only when all session sockets have been
1189 * closed.
1190 */
stephen hemmingerfc130842010-10-21 07:50:46 +00001191static void l2tp_tunnel_destruct(struct sock *sk)
James Chapmanfd558d12010-04-02 06:18:33 +00001192{
David S. Miller8d8a51e2013-10-08 15:44:26 -04001193 struct l2tp_tunnel *tunnel = l2tp_tunnel(sk);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001194 struct l2tp_net *pn;
James Chapmanfd558d12010-04-02 06:18:33 +00001195
James Chapmanfd558d12010-04-02 06:18:33 +00001196 if (tunnel == NULL)
1197 goto end;
1198
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001199 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing...\n", tunnel->name);
James Chapmanfd558d12010-04-02 06:18:33 +00001200
James Chapmanfd558d12010-04-02 06:18:33 +00001201
Tom Parkinf8ccac02013-01-31 23:43:00 +00001202 /* Disable udp encapsulation */
James Chapman0d767512010-04-02 06:19:00 +00001203 switch (tunnel->encap) {
1204 case L2TP_ENCAPTYPE_UDP:
1205 /* No longer an encapsulation socket. See net/ipv4/udp.c */
1206 (udp_sk(sk))->encap_type = 0;
1207 (udp_sk(sk))->encap_rcv = NULL;
Tom Parkin9980d002013-03-19 06:11:13 +00001208 (udp_sk(sk))->encap_destroy = NULL;
James Chapman0d767512010-04-02 06:19:00 +00001209 break;
1210 case L2TP_ENCAPTYPE_IP:
1211 break;
1212 }
James Chapmanfd558d12010-04-02 06:18:33 +00001213
1214 /* Remove hooks into tunnel socket */
James Chapmanfd558d12010-04-02 06:18:33 +00001215 sk->sk_destruct = tunnel->old_sk_destruct;
1216 sk->sk_user_data = NULL;
Tom Parkinf8ccac02013-01-31 23:43:00 +00001217 tunnel->sock = NULL;
1218
1219 /* Remove the tunnel struct from the tunnel list */
1220 pn = l2tp_pernet(tunnel->l2tp_net);
1221 spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1222 list_del_rcu(&tunnel->list);
1223 spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
1224 atomic_dec(&l2tp_tunnel_count);
1225
1226 l2tp_tunnel_closeall(tunnel);
1227 l2tp_tunnel_dec_refcount(tunnel);
James Chapmanfd558d12010-04-02 06:18:33 +00001228
1229 /* Call the original destructor */
1230 if (sk->sk_destruct)
1231 (*sk->sk_destruct)(sk);
James Chapmanfd558d12010-04-02 06:18:33 +00001232end:
1233 return;
1234}
James Chapmanfd558d12010-04-02 06:18:33 +00001235
1236/* When the tunnel is closed, all the attached sessions need to go too.
1237 */
Tom Parkine34f4c72013-03-19 06:11:14 +00001238void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
James Chapmanfd558d12010-04-02 06:18:33 +00001239{
1240 int hash;
1241 struct hlist_node *walk;
1242 struct hlist_node *tmp;
1243 struct l2tp_session *session;
1244
1245 BUG_ON(tunnel == NULL);
1246
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001247 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing all sessions...\n",
1248 tunnel->name);
James Chapmanfd558d12010-04-02 06:18:33 +00001249
1250 write_lock_bh(&tunnel->hlist_lock);
1251 for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
1252again:
1253 hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
1254 session = hlist_entry(walk, struct l2tp_session, hlist);
1255
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001256 l2tp_info(session, L2TP_MSG_CONTROL,
1257 "%s: closing session\n", session->name);
James Chapmanfd558d12010-04-02 06:18:33 +00001258
1259 hlist_del_init(&session->hlist);
1260
James Chapmanfd558d12010-04-02 06:18:33 +00001261 if (session->ref != NULL)
1262 (*session->ref)(session);
1263
1264 write_unlock_bh(&tunnel->hlist_lock);
1265
Tom Parkinf6e16b22013-03-19 06:11:23 +00001266 __l2tp_session_unhash(session);
Tom Parkin4c6e2fd2013-03-19 06:11:20 +00001267 l2tp_session_queue_purge(session);
1268
James Chapmanfd558d12010-04-02 06:18:33 +00001269 if (session->session_close != NULL)
1270 (*session->session_close)(session);
1271
1272 if (session->deref != NULL)
1273 (*session->deref)(session);
1274
Tom Parkin9980d002013-03-19 06:11:13 +00001275 l2tp_session_dec_refcount(session);
1276
James Chapmanfd558d12010-04-02 06:18:33 +00001277 write_lock_bh(&tunnel->hlist_lock);
1278
1279 /* Now restart from the beginning of this hash
1280 * chain. We always remove a session from the
1281 * list so we are guaranteed to make forward
1282 * progress.
1283 */
1284 goto again;
1285 }
1286 }
1287 write_unlock_bh(&tunnel->hlist_lock);
1288}
Tom Parkine34f4c72013-03-19 06:11:14 +00001289EXPORT_SYMBOL_GPL(l2tp_tunnel_closeall);
James Chapmanfd558d12010-04-02 06:18:33 +00001290
Tom Parkin9980d002013-03-19 06:11:13 +00001291/* Tunnel socket destroy hook for UDP encapsulation */
1292static void l2tp_udp_encap_destroy(struct sock *sk)
1293{
1294 struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
1295 if (tunnel) {
1296 l2tp_tunnel_closeall(tunnel);
1297 sock_put(sk);
1298 }
1299}
1300
James Chapmanfd558d12010-04-02 06:18:33 +00001301/* Really kill the tunnel.
1302 * Come here only when all sessions have been cleared from the tunnel.
1303 */
stephen hemmingerfc130842010-10-21 07:50:46 +00001304static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
James Chapmanfd558d12010-04-02 06:18:33 +00001305{
James Chapmanfd558d12010-04-02 06:18:33 +00001306 BUG_ON(atomic_read(&tunnel->ref_count) != 0);
1307 BUG_ON(tunnel->sock != NULL);
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001308 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: free...\n", tunnel->name);
xeb@mail.ru99469c32012-08-24 01:07:38 +00001309 kfree_rcu(tunnel, rcu);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001310}
James Chapmanfd558d12010-04-02 06:18:33 +00001311
Tom Parkinf8ccac02013-01-31 23:43:00 +00001312/* Workqueue tunnel deletion function */
1313static void l2tp_tunnel_del_work(struct work_struct *work)
1314{
1315 struct l2tp_tunnel *tunnel = NULL;
1316 struct socket *sock = NULL;
1317 struct sock *sk = NULL;
1318
1319 tunnel = container_of(work, struct l2tp_tunnel, del_work);
1320 sk = l2tp_tunnel_sock_lookup(tunnel);
1321 if (!sk)
Alexander Couzens06a15f52015-09-28 11:32:42 +02001322 goto out;
Tom Parkinf8ccac02013-01-31 23:43:00 +00001323
1324 sock = sk->sk_socket;
Tom Parkinf8ccac02013-01-31 23:43:00 +00001325
Tom Parkin02d13ed2013-03-19 06:11:18 +00001326 /* If the tunnel socket was created by userspace, then go through the
1327 * inet layer to shut the socket down, and let userspace close it.
1328 * Otherwise, if we created the socket directly within the kernel, use
1329 * the sk API to release it here.
Tom Parkin167eb172013-01-31 23:43:03 +00001330 * In either case the tunnel resources are freed in the socket
1331 * destructor when the tunnel socket goes away.
Tom Parkinf8ccac02013-01-31 23:43:00 +00001332 */
Tom Parkin02d13ed2013-03-19 06:11:18 +00001333 if (tunnel->fd >= 0) {
1334 if (sock)
1335 inet_shutdown(sock, 2);
Tom Parkin167eb172013-01-31 23:43:03 +00001336 } else {
Eric W. Biederman26abe142015-05-08 21:10:31 -05001337 if (sock) {
Tom Parkin02d13ed2013-03-19 06:11:18 +00001338 kernel_sock_shutdown(sock, SHUT_RDWR);
Eric W. Biederman26abe142015-05-08 21:10:31 -05001339 sock_release(sock);
1340 }
Tom Parkin167eb172013-01-31 23:43:03 +00001341 }
Tom Parkinf8ccac02013-01-31 23:43:00 +00001342
1343 l2tp_tunnel_sock_put(sk);
Alexander Couzens06a15f52015-09-28 11:32:42 +02001344out:
1345 l2tp_tunnel_dec_refcount(tunnel);
James Chapmanfd558d12010-04-02 06:18:33 +00001346}
James Chapmanfd558d12010-04-02 06:18:33 +00001347
James Chapman789a4a22010-04-02 06:19:40 +00001348/* Create a socket for the tunnel, if one isn't set up by
1349 * userspace. This is used for static tunnels where there is no
1350 * managing L2TP daemon.
Tom Parkin167eb172013-01-31 23:43:03 +00001351 *
1352 * Since we don't want these sockets to keep a namespace alive by
1353 * themselves, we drop the socket's namespace refcount after creation.
1354 * These sockets are freed when the namespace exits using the pernet
1355 * exit hook.
James Chapman789a4a22010-04-02 06:19:40 +00001356 */
Tom Parkin167eb172013-01-31 23:43:03 +00001357static int l2tp_tunnel_sock_create(struct net *net,
1358 u32 tunnel_id,
1359 u32 peer_tunnel_id,
1360 struct l2tp_tunnel_cfg *cfg,
1361 struct socket **sockp)
James Chapman789a4a22010-04-02 06:19:40 +00001362{
1363 int err = -EINVAL;
Eric Dumazet7bddd0d2010-04-04 01:02:46 -07001364 struct socket *sock = NULL;
Tom Herbert85644b42014-07-13 19:49:48 -07001365 struct udp_port_cfg udp_conf;
James Chapman789a4a22010-04-02 06:19:40 +00001366
1367 switch (cfg->encap) {
1368 case L2TP_ENCAPTYPE_UDP:
Tom Herbert85644b42014-07-13 19:49:48 -07001369 memset(&udp_conf, 0, sizeof(udp_conf));
1370
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001371#if IS_ENABLED(CONFIG_IPV6)
1372 if (cfg->local_ip6 && cfg->peer_ip6) {
Tom Herbert85644b42014-07-13 19:49:48 -07001373 udp_conf.family = AF_INET6;
1374 memcpy(&udp_conf.local_ip6, cfg->local_ip6,
1375 sizeof(udp_conf.local_ip6));
1376 memcpy(&udp_conf.peer_ip6, cfg->peer_ip6,
1377 sizeof(udp_conf.peer_ip6));
1378 udp_conf.use_udp6_tx_checksums =
Wang Shanker018f8252016-04-29 01:29:43 +08001379 ! cfg->udp6_zero_tx_checksums;
Tom Herbert85644b42014-07-13 19:49:48 -07001380 udp_conf.use_udp6_rx_checksums =
Wang Shanker018f8252016-04-29 01:29:43 +08001381 ! cfg->udp6_zero_rx_checksums;
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001382 } else
1383#endif
1384 {
Tom Herbert85644b42014-07-13 19:49:48 -07001385 udp_conf.family = AF_INET;
1386 udp_conf.local_ip = cfg->local_ip;
1387 udp_conf.peer_ip = cfg->peer_ip;
1388 udp_conf.use_udp_checksums = cfg->use_udp_checksums;
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001389 }
James Chapman789a4a22010-04-02 06:19:40 +00001390
Tom Herbert85644b42014-07-13 19:49:48 -07001391 udp_conf.local_udp_port = htons(cfg->local_udp_port);
1392 udp_conf.peer_udp_port = htons(cfg->peer_udp_port);
1393
1394 err = udp_sock_create(net, &udp_conf, &sock);
1395 if (err < 0)
1396 goto out;
James Chapman789a4a22010-04-02 06:19:40 +00001397
1398 break;
1399
1400 case L2TP_ENCAPTYPE_IP:
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001401#if IS_ENABLED(CONFIG_IPV6)
1402 if (cfg->local_ip6 && cfg->peer_ip6) {
Tom Herbert85644b42014-07-13 19:49:48 -07001403 struct sockaddr_l2tpip6 ip6_addr = {0};
1404
Eric W. Biederman26abe142015-05-08 21:10:31 -05001405 err = sock_create_kern(net, AF_INET6, SOCK_DGRAM,
Tom Parkin167eb172013-01-31 23:43:03 +00001406 IPPROTO_L2TP, &sock);
James Chapman5dac94e2012-04-29 21:48:55 +00001407 if (err < 0)
1408 goto out;
1409
James Chapman5dac94e2012-04-29 21:48:55 +00001410 ip6_addr.l2tp_family = AF_INET6;
1411 memcpy(&ip6_addr.l2tp_addr, cfg->local_ip6,
1412 sizeof(ip6_addr.l2tp_addr));
1413 ip6_addr.l2tp_conn_id = tunnel_id;
1414 err = kernel_bind(sock, (struct sockaddr *) &ip6_addr,
1415 sizeof(ip6_addr));
1416 if (err < 0)
1417 goto out;
1418
1419 ip6_addr.l2tp_family = AF_INET6;
1420 memcpy(&ip6_addr.l2tp_addr, cfg->peer_ip6,
1421 sizeof(ip6_addr.l2tp_addr));
1422 ip6_addr.l2tp_conn_id = peer_tunnel_id;
1423 err = kernel_connect(sock,
1424 (struct sockaddr *) &ip6_addr,
1425 sizeof(ip6_addr), 0);
1426 if (err < 0)
1427 goto out;
1428 } else
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001429#endif
James Chapman5dac94e2012-04-29 21:48:55 +00001430 {
Tom Herbert85644b42014-07-13 19:49:48 -07001431 struct sockaddr_l2tpip ip_addr = {0};
1432
Eric W. Biederman26abe142015-05-08 21:10:31 -05001433 err = sock_create_kern(net, AF_INET, SOCK_DGRAM,
Tom Parkin167eb172013-01-31 23:43:03 +00001434 IPPROTO_L2TP, &sock);
James Chapman5dac94e2012-04-29 21:48:55 +00001435 if (err < 0)
1436 goto out;
James Chapman789a4a22010-04-02 06:19:40 +00001437
James Chapman5dac94e2012-04-29 21:48:55 +00001438 ip_addr.l2tp_family = AF_INET;
1439 ip_addr.l2tp_addr = cfg->local_ip;
1440 ip_addr.l2tp_conn_id = tunnel_id;
1441 err = kernel_bind(sock, (struct sockaddr *) &ip_addr,
1442 sizeof(ip_addr));
1443 if (err < 0)
1444 goto out;
James Chapman789a4a22010-04-02 06:19:40 +00001445
James Chapman5dac94e2012-04-29 21:48:55 +00001446 ip_addr.l2tp_family = AF_INET;
1447 ip_addr.l2tp_addr = cfg->peer_ip;
1448 ip_addr.l2tp_conn_id = peer_tunnel_id;
1449 err = kernel_connect(sock, (struct sockaddr *) &ip_addr,
1450 sizeof(ip_addr), 0);
1451 if (err < 0)
1452 goto out;
1453 }
James Chapman789a4a22010-04-02 06:19:40 +00001454 break;
1455
1456 default:
1457 goto out;
1458 }
1459
1460out:
Tom Parkin167eb172013-01-31 23:43:03 +00001461 *sockp = sock;
James Chapman789a4a22010-04-02 06:19:40 +00001462 if ((err < 0) && sock) {
Tom Parkin167eb172013-01-31 23:43:03 +00001463 kernel_sock_shutdown(sock, SHUT_RDWR);
Eric W. Biederman26abe142015-05-08 21:10:31 -05001464 sock_release(sock);
James Chapman789a4a22010-04-02 06:19:40 +00001465 *sockp = NULL;
1466 }
1467
1468 return err;
1469}
1470
Eric Dumazet37159ef2012-09-04 07:18:57 +00001471static struct lock_class_key l2tp_socket_class;
1472
James Chapmanfd558d12010-04-02 06:18:33 +00001473int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp)
1474{
1475 struct l2tp_tunnel *tunnel = NULL;
1476 int err;
1477 struct socket *sock = NULL;
1478 struct sock *sk = NULL;
1479 struct l2tp_net *pn;
James Chapman0d767512010-04-02 06:19:00 +00001480 enum l2tp_encap_type encap = L2TP_ENCAPTYPE_UDP;
James Chapmanfd558d12010-04-02 06:18:33 +00001481
1482 /* Get the tunnel socket from the fd, which was opened by
James Chapman789a4a22010-04-02 06:19:40 +00001483 * the userspace L2TP daemon. If not specified, create a
1484 * kernel socket.
James Chapmanfd558d12010-04-02 06:18:33 +00001485 */
James Chapman789a4a22010-04-02 06:19:40 +00001486 if (fd < 0) {
Tom Parkin167eb172013-01-31 23:43:03 +00001487 err = l2tp_tunnel_sock_create(net, tunnel_id, peer_tunnel_id,
1488 cfg, &sock);
James Chapman789a4a22010-04-02 06:19:40 +00001489 if (err < 0)
1490 goto err;
1491 } else {
James Chapman789a4a22010-04-02 06:19:40 +00001492 sock = sockfd_lookup(fd, &err);
1493 if (!sock) {
Tom Parkincbb95e02013-01-31 23:43:02 +00001494 pr_err("tunl %u: sockfd_lookup(fd=%d) returned %d\n",
James Chapman789a4a22010-04-02 06:19:40 +00001495 tunnel_id, fd, err);
Tom Parkincbb95e02013-01-31 23:43:02 +00001496 err = -EBADF;
1497 goto err;
1498 }
1499
1500 /* Reject namespace mismatches */
1501 if (!net_eq(sock_net(sock->sk), net)) {
1502 pr_err("tunl %u: netns mismatch\n", tunnel_id);
1503 err = -EINVAL;
James Chapman789a4a22010-04-02 06:19:40 +00001504 goto err;
1505 }
James Chapmanfd558d12010-04-02 06:18:33 +00001506 }
1507
1508 sk = sock->sk;
1509
James Chapman0d767512010-04-02 06:19:00 +00001510 if (cfg != NULL)
1511 encap = cfg->encap;
1512
James Chapmanfd558d12010-04-02 06:18:33 +00001513 /* Quick sanity checks */
James Chapman0d767512010-04-02 06:19:00 +00001514 switch (encap) {
1515 case L2TP_ENCAPTYPE_UDP:
1516 err = -EPROTONOSUPPORT;
1517 if (sk->sk_protocol != IPPROTO_UDP) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001518 pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
James Chapman0d767512010-04-02 06:19:00 +00001519 tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
1520 goto err;
1521 }
1522 break;
1523 case L2TP_ENCAPTYPE_IP:
1524 err = -EPROTONOSUPPORT;
1525 if (sk->sk_protocol != IPPROTO_L2TP) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001526 pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
James Chapman0d767512010-04-02 06:19:00 +00001527 tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP);
1528 goto err;
1529 }
1530 break;
James Chapmanfd558d12010-04-02 06:18:33 +00001531 }
1532
1533 /* Check if this socket has already been prepped */
David S. Miller8d8a51e2013-10-08 15:44:26 -04001534 tunnel = l2tp_tunnel(sk);
James Chapmanfd558d12010-04-02 06:18:33 +00001535 if (tunnel != NULL) {
1536 /* This socket has already been prepped */
1537 err = -EBUSY;
1538 goto err;
1539 }
1540
James Chapmanfd558d12010-04-02 06:18:33 +00001541 tunnel = kzalloc(sizeof(struct l2tp_tunnel), GFP_KERNEL);
1542 if (tunnel == NULL) {
1543 err = -ENOMEM;
1544 goto err;
1545 }
1546
1547 tunnel->version = version;
1548 tunnel->tunnel_id = tunnel_id;
1549 tunnel->peer_tunnel_id = peer_tunnel_id;
1550 tunnel->debug = L2TP_DEFAULT_DEBUG_FLAGS;
1551
1552 tunnel->magic = L2TP_TUNNEL_MAGIC;
1553 sprintf(&tunnel->name[0], "tunl %u", tunnel_id);
1554 rwlock_init(&tunnel->hlist_lock);
1555
1556 /* The net we belong to */
1557 tunnel->l2tp_net = net;
1558 pn = l2tp_pernet(net);
1559
James Chapman0d767512010-04-02 06:19:00 +00001560 if (cfg != NULL)
James Chapmanfd558d12010-04-02 06:18:33 +00001561 tunnel->debug = cfg->debug;
1562
François Cachereule18503f2013-10-02 10:16:02 +02001563#if IS_ENABLED(CONFIG_IPV6)
1564 if (sk->sk_family == PF_INET6) {
1565 struct ipv6_pinfo *np = inet6_sk(sk);
1566
1567 if (ipv6_addr_v4mapped(&np->saddr) &&
Eric Dumazetefe42082013-10-03 15:42:29 -07001568 ipv6_addr_v4mapped(&sk->sk_v6_daddr)) {
François Cachereule18503f2013-10-02 10:16:02 +02001569 struct inet_sock *inet = inet_sk(sk);
1570
1571 tunnel->v4mapped = true;
1572 inet->inet_saddr = np->saddr.s6_addr32[3];
Eric Dumazetefe42082013-10-03 15:42:29 -07001573 inet->inet_rcv_saddr = sk->sk_v6_rcv_saddr.s6_addr32[3];
1574 inet->inet_daddr = sk->sk_v6_daddr.s6_addr32[3];
François Cachereule18503f2013-10-02 10:16:02 +02001575 } else {
1576 tunnel->v4mapped = false;
1577 }
1578 }
1579#endif
1580
James Chapmanfd558d12010-04-02 06:18:33 +00001581 /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
James Chapman0d767512010-04-02 06:19:00 +00001582 tunnel->encap = encap;
1583 if (encap == L2TP_ENCAPTYPE_UDP) {
Andy Zhouc8fffce2014-09-16 17:31:19 -07001584 struct udp_tunnel_sock_cfg udp_cfg;
James Chapmanfd558d12010-04-02 06:18:33 +00001585
Andy Zhouc8fffce2014-09-16 17:31:19 -07001586 udp_cfg.sk_user_data = tunnel;
1587 udp_cfg.encap_type = UDP_ENCAP_L2TPINUDP;
1588 udp_cfg.encap_rcv = l2tp_udp_encap_recv;
1589 udp_cfg.encap_destroy = l2tp_udp_encap_destroy;
1590
1591 setup_udp_tunnel_sock(net, sock, &udp_cfg);
1592 } else {
1593 sk->sk_user_data = tunnel;
1594 }
James Chapmanfd558d12010-04-02 06:18:33 +00001595
1596 /* Hook on the tunnel socket destructor so that we can cleanup
1597 * if the tunnel socket goes away.
1598 */
1599 tunnel->old_sk_destruct = sk->sk_destruct;
1600 sk->sk_destruct = &l2tp_tunnel_destruct;
1601 tunnel->sock = sk;
Tom Parkin80d84ef2013-01-22 05:13:48 +00001602 tunnel->fd = fd;
Eric Dumazet37159ef2012-09-04 07:18:57 +00001603 lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock");
1604
James Chapmanfd558d12010-04-02 06:18:33 +00001605 sk->sk_allocation = GFP_ATOMIC;
1606
Tom Parkinf8ccac02013-01-31 23:43:00 +00001607 /* Init delete workqueue struct */
1608 INIT_WORK(&tunnel->del_work, l2tp_tunnel_del_work);
1609
James Chapmanfd558d12010-04-02 06:18:33 +00001610 /* Add tunnel to our list */
1611 INIT_LIST_HEAD(&tunnel->list);
James Chapmanfd558d12010-04-02 06:18:33 +00001612 atomic_inc(&l2tp_tunnel_count);
1613
1614 /* Bump the reference count. The tunnel context is deleted
Eric Dumazet17691922011-05-11 18:22:36 +00001615 * only when this drops to zero. Must be done before list insertion
James Chapmanfd558d12010-04-02 06:18:33 +00001616 */
1617 l2tp_tunnel_inc_refcount(tunnel);
Eric Dumazet17691922011-05-11 18:22:36 +00001618 spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1619 list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
1620 spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
James Chapmanfd558d12010-04-02 06:18:33 +00001621
1622 err = 0;
1623err:
1624 if (tunnelp)
1625 *tunnelp = tunnel;
1626
James Chapman789a4a22010-04-02 06:19:40 +00001627 /* If tunnel's socket was created by the kernel, it doesn't
1628 * have a file.
1629 */
1630 if (sock && sock->file)
James Chapmanfd558d12010-04-02 06:18:33 +00001631 sockfd_put(sock);
1632
1633 return err;
1634}
1635EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
1636
James Chapman309795f2010-04-02 06:19:10 +00001637/* This function is used by the netlink TUNNEL_DELETE command.
1638 */
1639int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
1640{
Alexander Couzens06a15f52015-09-28 11:32:42 +02001641 l2tp_tunnel_inc_refcount(tunnel);
Tom Parkin2b551c62013-03-19 06:11:16 +00001642 l2tp_tunnel_closeall(tunnel);
Alexander Couzens06a15f52015-09-28 11:32:42 +02001643 if (false == queue_work(l2tp_wq, &tunnel->del_work)) {
1644 l2tp_tunnel_dec_refcount(tunnel);
1645 return 1;
1646 }
1647 return 0;
James Chapman309795f2010-04-02 06:19:10 +00001648}
1649EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
1650
James Chapmanfd558d12010-04-02 06:18:33 +00001651/* Really kill the session.
1652 */
1653void l2tp_session_free(struct l2tp_session *session)
1654{
Tom Parkinf6e16b22013-03-19 06:11:23 +00001655 struct l2tp_tunnel *tunnel = session->tunnel;
James Chapmanfd558d12010-04-02 06:18:33 +00001656
1657 BUG_ON(atomic_read(&session->ref_count) != 0);
1658
Tom Parkinf6e16b22013-03-19 06:11:23 +00001659 if (tunnel) {
James Chapmanfd558d12010-04-02 06:18:33 +00001660 BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
James Chapmanfd558d12010-04-02 06:18:33 +00001661 if (session->session_id != 0)
1662 atomic_dec(&l2tp_session_count);
James Chapmanfd558d12010-04-02 06:18:33 +00001663 sock_put(tunnel->sock);
James Chapmanfd558d12010-04-02 06:18:33 +00001664 session->tunnel = NULL;
1665 l2tp_tunnel_dec_refcount(tunnel);
1666 }
1667
1668 kfree(session);
James Chapmanfd558d12010-04-02 06:18:33 +00001669}
1670EXPORT_SYMBOL_GPL(l2tp_session_free);
1671
Tom Parkinf6e16b22013-03-19 06:11:23 +00001672/* Remove an l2tp session from l2tp_core's hash lists.
1673 * Provides a tidyup interface for pseudowire code which can't just route all
1674 * shutdown via. l2tp_session_delete and a pseudowire-specific session_close
1675 * callback.
1676 */
1677void __l2tp_session_unhash(struct l2tp_session *session)
1678{
1679 struct l2tp_tunnel *tunnel = session->tunnel;
1680
1681 /* Remove the session from core hashes */
1682 if (tunnel) {
1683 /* Remove from the per-tunnel hash */
1684 write_lock_bh(&tunnel->hlist_lock);
1685 hlist_del_init(&session->hlist);
1686 write_unlock_bh(&tunnel->hlist_lock);
1687
1688 /* For L2TPv3 we have a per-net hash: remove from there, too */
1689 if (tunnel->version != L2TP_HDR_VER_2) {
1690 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1691 spin_lock_bh(&pn->l2tp_session_hlist_lock);
1692 hlist_del_init_rcu(&session->global_hlist);
1693 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
1694 synchronize_rcu();
1695 }
1696 }
1697}
1698EXPORT_SYMBOL_GPL(__l2tp_session_unhash);
1699
James Chapman309795f2010-04-02 06:19:10 +00001700/* This function is used by the netlink SESSION_DELETE command and by
1701 pseudowire modules.
1702 */
1703int l2tp_session_delete(struct l2tp_session *session)
1704{
Tom Parkinf6e16b22013-03-19 06:11:23 +00001705 if (session->ref)
1706 (*session->ref)(session);
1707 __l2tp_session_unhash(session);
Tom Parkin4c6e2fd2013-03-19 06:11:20 +00001708 l2tp_session_queue_purge(session);
James Chapman309795f2010-04-02 06:19:10 +00001709 if (session->session_close != NULL)
1710 (*session->session_close)(session);
Tom Parkinf6e16b22013-03-19 06:11:23 +00001711 if (session->deref)
Dan Carpenter1b7c92b2013-03-22 21:33:15 +03001712 (*session->deref)(session);
James Chapman309795f2010-04-02 06:19:10 +00001713 l2tp_session_dec_refcount(session);
James Chapman309795f2010-04-02 06:19:10 +00001714 return 0;
1715}
1716EXPORT_SYMBOL_GPL(l2tp_session_delete);
1717
James Chapmanf7faffa2010-04-02 06:18:49 +00001718/* We come here whenever a session's send_seq, cookie_len or
1719 * l2specific_len parameters are set.
1720 */
Guillaume Naultbb5016e2014-03-06 11:14:30 +01001721void l2tp_session_set_header_len(struct l2tp_session *session, int version)
James Chapmanf7faffa2010-04-02 06:18:49 +00001722{
1723 if (version == L2TP_HDR_VER_2) {
1724 session->hdr_len = 6;
1725 if (session->send_seq)
1726 session->hdr_len += 4;
1727 } else {
James Chapman0d767512010-04-02 06:19:00 +00001728 session->hdr_len = 4 + session->cookie_len + session->l2specific_len + session->offset;
1729 if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)
1730 session->hdr_len += 4;
James Chapmanf7faffa2010-04-02 06:18:49 +00001731 }
1732
1733}
Guillaume Naultbb5016e2014-03-06 11:14:30 +01001734EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
James Chapmanf7faffa2010-04-02 06:18:49 +00001735
James Chapmanfd558d12010-04-02 06:18:33 +00001736struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
1737{
1738 struct l2tp_session *session;
1739
1740 session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL);
1741 if (session != NULL) {
1742 session->magic = L2TP_SESSION_MAGIC;
1743 session->tunnel = tunnel;
1744
1745 session->session_id = session_id;
1746 session->peer_session_id = peer_session_id;
James Chapmand301e322012-05-09 23:43:09 +00001747 session->nr = 0;
James Chapman8a1631d2013-07-02 20:28:59 +01001748 if (tunnel->version == L2TP_HDR_VER_2)
1749 session->nr_max = 0xffff;
1750 else
1751 session->nr_max = 0xffffff;
1752 session->nr_window_size = session->nr_max / 2;
James Chapmana0dbd822013-07-02 20:29:00 +01001753 session->nr_oos_count_max = 4;
1754
1755 /* Use NR of first received packet */
1756 session->reorder_skip = 1;
James Chapmanfd558d12010-04-02 06:18:33 +00001757
1758 sprintf(&session->name[0], "sess %u/%u",
1759 tunnel->tunnel_id, session->session_id);
1760
1761 skb_queue_head_init(&session->reorder_q);
1762
1763 INIT_HLIST_NODE(&session->hlist);
James Chapmanf7faffa2010-04-02 06:18:49 +00001764 INIT_HLIST_NODE(&session->global_hlist);
James Chapmanfd558d12010-04-02 06:18:33 +00001765
1766 /* Inherit debug options from tunnel */
1767 session->debug = tunnel->debug;
1768
1769 if (cfg) {
James Chapmanf7faffa2010-04-02 06:18:49 +00001770 session->pwtype = cfg->pw_type;
James Chapmanfd558d12010-04-02 06:18:33 +00001771 session->debug = cfg->debug;
James Chapmanfd558d12010-04-02 06:18:33 +00001772 session->mtu = cfg->mtu;
1773 session->mru = cfg->mru;
1774 session->send_seq = cfg->send_seq;
1775 session->recv_seq = cfg->recv_seq;
1776 session->lns_mode = cfg->lns_mode;
James Chapmanf7faffa2010-04-02 06:18:49 +00001777 session->reorder_timeout = cfg->reorder_timeout;
1778 session->offset = cfg->offset;
1779 session->l2specific_type = cfg->l2specific_type;
1780 session->l2specific_len = cfg->l2specific_len;
1781 session->cookie_len = cfg->cookie_len;
1782 memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);
1783 session->peer_cookie_len = cfg->peer_cookie_len;
1784 memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);
James Chapmanfd558d12010-04-02 06:18:33 +00001785 }
1786
James Chapmanf7faffa2010-04-02 06:18:49 +00001787 if (tunnel->version == L2TP_HDR_VER_2)
1788 session->build_header = l2tp_build_l2tpv2_header;
1789 else
1790 session->build_header = l2tp_build_l2tpv3_header;
1791
1792 l2tp_session_set_header_len(session, tunnel->version);
1793
James Chapmanfd558d12010-04-02 06:18:33 +00001794 /* Bump the reference count. The session context is deleted
1795 * only when this drops to zero.
1796 */
1797 l2tp_session_inc_refcount(session);
1798 l2tp_tunnel_inc_refcount(tunnel);
1799
1800 /* Ensure tunnel socket isn't deleted */
1801 sock_hold(tunnel->sock);
1802
1803 /* Add session to the tunnel's hash list */
1804 write_lock_bh(&tunnel->hlist_lock);
1805 hlist_add_head(&session->hlist,
1806 l2tp_session_id_hash(tunnel, session_id));
1807 write_unlock_bh(&tunnel->hlist_lock);
1808
James Chapmanf7faffa2010-04-02 06:18:49 +00001809 /* And to the global session list if L2TPv3 */
1810 if (tunnel->version != L2TP_HDR_VER_2) {
1811 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1812
James Chapmane02d4942010-04-02 06:19:16 +00001813 spin_lock_bh(&pn->l2tp_session_hlist_lock);
1814 hlist_add_head_rcu(&session->global_hlist,
1815 l2tp_session_id_hash_2(pn, session_id));
1816 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
James Chapmanf7faffa2010-04-02 06:18:49 +00001817 }
1818
James Chapmanfd558d12010-04-02 06:18:33 +00001819 /* Ignore management session in session count value */
1820 if (session->session_id != 0)
1821 atomic_inc(&l2tp_session_count);
1822 }
1823
1824 return session;
1825}
1826EXPORT_SYMBOL_GPL(l2tp_session_create);
1827
1828/*****************************************************************************
1829 * Init and cleanup
1830 *****************************************************************************/
1831
1832static __net_init int l2tp_init_net(struct net *net)
1833{
Jiri Pirkoe773aaf2010-04-23 00:53:39 +00001834 struct l2tp_net *pn = net_generic(net, l2tp_net_id);
James Chapmanf7faffa2010-04-02 06:18:49 +00001835 int hash;
James Chapmanfd558d12010-04-02 06:18:33 +00001836
James Chapmanfd558d12010-04-02 06:18:33 +00001837 INIT_LIST_HEAD(&pn->l2tp_tunnel_list);
James Chapmane02d4942010-04-02 06:19:16 +00001838 spin_lock_init(&pn->l2tp_tunnel_list_lock);
James Chapmanfd558d12010-04-02 06:18:33 +00001839
James Chapmanf7faffa2010-04-02 06:18:49 +00001840 for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
1841 INIT_HLIST_HEAD(&pn->l2tp_session_hlist[hash]);
1842
James Chapmane02d4942010-04-02 06:19:16 +00001843 spin_lock_init(&pn->l2tp_session_hlist_lock);
James Chapmanf7faffa2010-04-02 06:18:49 +00001844
James Chapmanfd558d12010-04-02 06:18:33 +00001845 return 0;
James Chapmanfd558d12010-04-02 06:18:33 +00001846}
1847
Tom Parkin167eb172013-01-31 23:43:03 +00001848static __net_exit void l2tp_exit_net(struct net *net)
1849{
1850 struct l2tp_net *pn = l2tp_pernet(net);
1851 struct l2tp_tunnel *tunnel = NULL;
1852
1853 rcu_read_lock_bh();
1854 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
1855 (void)l2tp_tunnel_delete(tunnel);
1856 }
1857 rcu_read_unlock_bh();
1858}
1859
James Chapmanfd558d12010-04-02 06:18:33 +00001860static struct pernet_operations l2tp_net_ops = {
1861 .init = l2tp_init_net,
Tom Parkin167eb172013-01-31 23:43:03 +00001862 .exit = l2tp_exit_net,
James Chapmanfd558d12010-04-02 06:18:33 +00001863 .id = &l2tp_net_id,
1864 .size = sizeof(struct l2tp_net),
1865};
1866
1867static int __init l2tp_init(void)
1868{
1869 int rc = 0;
1870
1871 rc = register_pernet_device(&l2tp_net_ops);
1872 if (rc)
1873 goto out;
1874
ZhangZhen59ff3eb2014-03-27 09:41:47 +08001875 l2tp_wq = alloc_workqueue("l2tp", WQ_UNBOUND, 0);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001876 if (!l2tp_wq) {
1877 pr_err("alloc_workqueue failed\n");
WANG Cong67e04c22015-04-03 13:46:09 -07001878 unregister_pernet_device(&l2tp_net_ops);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001879 rc = -ENOMEM;
1880 goto out;
1881 }
1882
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001883 pr_info("L2TP core driver, %s\n", L2TP_DRV_VERSION);
James Chapmanfd558d12010-04-02 06:18:33 +00001884
1885out:
1886 return rc;
1887}
1888
1889static void __exit l2tp_exit(void)
1890{
1891 unregister_pernet_device(&l2tp_net_ops);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001892 if (l2tp_wq) {
1893 destroy_workqueue(l2tp_wq);
1894 l2tp_wq = NULL;
1895 }
James Chapmanfd558d12010-04-02 06:18:33 +00001896}
1897
1898module_init(l2tp_init);
1899module_exit(l2tp_exit);
1900
1901MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1902MODULE_DESCRIPTION("L2TP core");
1903MODULE_LICENSE("GPL");
1904MODULE_VERSION(L2TP_DRV_VERSION);
1905