blob: 0dd50c079f29eb76d4270844d178e098b42a2af4 [file] [log] [blame]
James Chapmanfd558d12010-04-02 06:18:33 +00001/*
2 * L2TP core.
3 *
4 * Copyright (c) 2008,2009,2010 Katalix Systems Ltd
5 *
6 * This file contains some code of the original L2TPv2 pppol2tp
7 * driver, which has the following copyright:
8 *
9 * Authors: Martijn van Oosterhout <kleptog@svana.org>
10 * James Chapman (jchapman@katalix.com)
11 * Contributors:
12 * Michal Ostrowski <mostrows@speakeasy.net>
13 * Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
14 * David S. Miller (davem@redhat.com)
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2 as
18 * published by the Free Software Foundation.
19 */
20
Joe Perchesa4ca44f2012-05-16 09:55:56 +000021#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
22
James Chapmanfd558d12010-04-02 06:18:33 +000023#include <linux/module.h>
24#include <linux/string.h>
25#include <linux/list.h>
James Chapmane02d4942010-04-02 06:19:16 +000026#include <linux/rculist.h>
James Chapmanfd558d12010-04-02 06:18:33 +000027#include <linux/uaccess.h>
28
29#include <linux/kernel.h>
30#include <linux/spinlock.h>
31#include <linux/kthread.h>
32#include <linux/sched.h>
33#include <linux/slab.h>
34#include <linux/errno.h>
35#include <linux/jiffies.h>
36
37#include <linux/netdevice.h>
38#include <linux/net.h>
39#include <linux/inetdevice.h>
40#include <linux/skbuff.h>
41#include <linux/init.h>
James Chapman0d767512010-04-02 06:19:00 +000042#include <linux/in.h>
James Chapmanfd558d12010-04-02 06:18:33 +000043#include <linux/ip.h>
44#include <linux/udp.h>
James Chapman0d767512010-04-02 06:19:00 +000045#include <linux/l2tp.h>
James Chapmanfd558d12010-04-02 06:18:33 +000046#include <linux/hash.h>
47#include <linux/sort.h>
48#include <linux/file.h>
49#include <linux/nsproxy.h>
50#include <net/net_namespace.h>
51#include <net/netns/generic.h>
52#include <net/dst.h>
53#include <net/ip.h>
54#include <net/udp.h>
James Chapman309795f2010-04-02 06:19:10 +000055#include <net/inet_common.h>
James Chapmanfd558d12010-04-02 06:18:33 +000056#include <net/xfrm.h>
James Chapman0d767512010-04-02 06:19:00 +000057#include <net/protocol.h>
Benjamin LaHaised2cf3362012-04-27 08:24:18 +000058#include <net/inet6_connection_sock.h>
59#include <net/inet_ecn.h>
60#include <net/ip6_route.h>
David S. Millerd499bd22012-04-30 13:21:28 -040061#include <net/ip6_checksum.h>
James Chapmanfd558d12010-04-02 06:18:33 +000062
63#include <asm/byteorder.h>
Arun Sharma600634972011-07-26 16:09:06 -070064#include <linux/atomic.h>
James Chapmanfd558d12010-04-02 06:18:33 +000065
66#include "l2tp_core.h"
67
68#define L2TP_DRV_VERSION "V2.0"
69
70/* L2TP header constants */
71#define L2TP_HDRFLAG_T 0x8000
72#define L2TP_HDRFLAG_L 0x4000
73#define L2TP_HDRFLAG_S 0x0800
74#define L2TP_HDRFLAG_O 0x0200
75#define L2TP_HDRFLAG_P 0x0100
76
77#define L2TP_HDR_VER_MASK 0x000F
78#define L2TP_HDR_VER_2 0x0002
James Chapmanf7faffa2010-04-02 06:18:49 +000079#define L2TP_HDR_VER_3 0x0003
James Chapmanfd558d12010-04-02 06:18:33 +000080
81/* L2TPv3 default L2-specific sublayer */
82#define L2TP_SLFLAG_S 0x40000000
83#define L2TP_SL_SEQ_MASK 0x00ffffff
84
85#define L2TP_HDR_SIZE_SEQ 10
86#define L2TP_HDR_SIZE_NOSEQ 6
87
88/* Default trace flags */
89#define L2TP_DEFAULT_DEBUG_FLAGS 0
90
James Chapmanfd558d12010-04-02 06:18:33 +000091/* Private data stored for received packets in the skb.
92 */
93struct l2tp_skb_cb {
James Chapmanf7faffa2010-04-02 06:18:49 +000094 u32 ns;
James Chapmanfd558d12010-04-02 06:18:33 +000095 u16 has_seq;
96 u16 length;
97 unsigned long expires;
98};
99
100#define L2TP_SKB_CB(skb) ((struct l2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])
101
102static atomic_t l2tp_tunnel_count;
103static atomic_t l2tp_session_count;
Tom Parkinf8ccac02013-01-31 23:43:00 +0000104static struct workqueue_struct *l2tp_wq;
James Chapmanfd558d12010-04-02 06:18:33 +0000105
106/* per-net private data for this module */
107static unsigned int l2tp_net_id;
108struct l2tp_net {
109 struct list_head l2tp_tunnel_list;
James Chapmane02d4942010-04-02 06:19:16 +0000110 spinlock_t l2tp_tunnel_list_lock;
James Chapmanf7faffa2010-04-02 06:18:49 +0000111 struct hlist_head l2tp_session_hlist[L2TP_HASH_SIZE_2];
James Chapmane02d4942010-04-02 06:19:16 +0000112 spinlock_t l2tp_session_hlist_lock;
James Chapmanfd558d12010-04-02 06:18:33 +0000113};
114
stephen hemmingerfc130842010-10-21 07:50:46 +0000115static void l2tp_session_set_header_len(struct l2tp_session *session, int version);
116static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
stephen hemmingerfc130842010-10-21 07:50:46 +0000117
James Chapmanfd558d12010-04-02 06:18:33 +0000118static inline struct l2tp_net *l2tp_pernet(struct net *net)
119{
120 BUG_ON(!net);
121
122 return net_generic(net, l2tp_net_id);
123}
124
stephen hemmingerfc130842010-10-21 07:50:46 +0000125/* Tunnel reference counts. Incremented per session that is added to
126 * the tunnel.
127 */
128static inline void l2tp_tunnel_inc_refcount_1(struct l2tp_tunnel *tunnel)
129{
130 atomic_inc(&tunnel->ref_count);
131}
132
133static inline void l2tp_tunnel_dec_refcount_1(struct l2tp_tunnel *tunnel)
134{
135 if (atomic_dec_and_test(&tunnel->ref_count))
136 l2tp_tunnel_free(tunnel);
137}
138#ifdef L2TP_REFCNT_DEBUG
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000139#define l2tp_tunnel_inc_refcount(_t) \
140do { \
141 pr_debug("l2tp_tunnel_inc_refcount: %s:%d %s: cnt=%d\n", \
142 __func__, __LINE__, (_t)->name, \
143 atomic_read(&_t->ref_count)); \
144 l2tp_tunnel_inc_refcount_1(_t); \
145} while (0)
146#define l2tp_tunnel_dec_refcount(_t)
147do { \
148 pr_debug("l2tp_tunnel_dec_refcount: %s:%d %s: cnt=%d\n", \
149 __func__, __LINE__, (_t)->name, \
150 atomic_read(&_t->ref_count)); \
151 l2tp_tunnel_dec_refcount_1(_t); \
152} while (0)
stephen hemmingerfc130842010-10-21 07:50:46 +0000153#else
154#define l2tp_tunnel_inc_refcount(t) l2tp_tunnel_inc_refcount_1(t)
155#define l2tp_tunnel_dec_refcount(t) l2tp_tunnel_dec_refcount_1(t)
156#endif
157
James Chapmanf7faffa2010-04-02 06:18:49 +0000158/* Session hash global list for L2TPv3.
159 * The session_id SHOULD be random according to RFC3931, but several
160 * L2TP implementations use incrementing session_ids. So we do a real
161 * hash on the session_id, rather than a simple bitmask.
162 */
163static inline struct hlist_head *
164l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
165{
166 return &pn->l2tp_session_hlist[hash_32(session_id, L2TP_HASH_BITS_2)];
167
168}
169
Tom Parkin80d84ef2013-01-22 05:13:48 +0000170/* Lookup the tunnel socket, possibly involving the fs code if the socket is
171 * owned by userspace. A struct sock returned from this function must be
172 * released using l2tp_tunnel_sock_put once you're done with it.
173 */
174struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel)
175{
176 int err = 0;
177 struct socket *sock = NULL;
178 struct sock *sk = NULL;
179
180 if (!tunnel)
181 goto out;
182
183 if (tunnel->fd >= 0) {
184 /* Socket is owned by userspace, who might be in the process
185 * of closing it. Look the socket up using the fd to ensure
186 * consistency.
187 */
188 sock = sockfd_lookup(tunnel->fd, &err);
189 if (sock)
190 sk = sock->sk;
191 } else {
192 /* Socket is owned by kernelspace */
193 sk = tunnel->sock;
194 }
195
196out:
197 return sk;
198}
199EXPORT_SYMBOL_GPL(l2tp_tunnel_sock_lookup);
200
201/* Drop a reference to a tunnel socket obtained via. l2tp_tunnel_sock_put */
202void l2tp_tunnel_sock_put(struct sock *sk)
203{
204 struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
205 if (tunnel) {
206 if (tunnel->fd >= 0) {
207 /* Socket is owned by userspace */
208 sockfd_put(sk->sk_socket);
209 }
210 sock_put(sk);
211 }
212}
213EXPORT_SYMBOL_GPL(l2tp_tunnel_sock_put);
214
James Chapmanf7faffa2010-04-02 06:18:49 +0000215/* Lookup a session by id in the global session list
216 */
217static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
218{
219 struct l2tp_net *pn = l2tp_pernet(net);
220 struct hlist_head *session_list =
221 l2tp_session_id_hash_2(pn, session_id);
222 struct l2tp_session *session;
James Chapmanf7faffa2010-04-02 06:18:49 +0000223
James Chapmane02d4942010-04-02 06:19:16 +0000224 rcu_read_lock_bh();
Sasha Levinb67bfe02013-02-27 17:06:00 -0800225 hlist_for_each_entry_rcu(session, session_list, global_hlist) {
James Chapmanf7faffa2010-04-02 06:18:49 +0000226 if (session->session_id == session_id) {
James Chapmane02d4942010-04-02 06:19:16 +0000227 rcu_read_unlock_bh();
James Chapmanf7faffa2010-04-02 06:18:49 +0000228 return session;
229 }
230 }
James Chapmane02d4942010-04-02 06:19:16 +0000231 rcu_read_unlock_bh();
James Chapmanf7faffa2010-04-02 06:18:49 +0000232
233 return NULL;
234}
235
James Chapmanfd558d12010-04-02 06:18:33 +0000236/* Session hash list.
237 * The session_id SHOULD be random according to RFC2661, but several
238 * L2TP implementations (Cisco and Microsoft) use incrementing
239 * session_ids. So we do a real hash on the session_id, rather than a
240 * simple bitmask.
241 */
242static inline struct hlist_head *
243l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id)
244{
245 return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)];
246}
247
248/* Lookup a session by id
249 */
James Chapmanf7faffa2010-04-02 06:18:49 +0000250struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id)
James Chapmanfd558d12010-04-02 06:18:33 +0000251{
James Chapmanf7faffa2010-04-02 06:18:49 +0000252 struct hlist_head *session_list;
James Chapmanfd558d12010-04-02 06:18:33 +0000253 struct l2tp_session *session;
James Chapmanfd558d12010-04-02 06:18:33 +0000254
James Chapmanf7faffa2010-04-02 06:18:49 +0000255 /* In L2TPv3, session_ids are unique over all tunnels and we
256 * sometimes need to look them up before we know the
257 * tunnel.
258 */
259 if (tunnel == NULL)
260 return l2tp_session_find_2(net, session_id);
261
262 session_list = l2tp_session_id_hash(tunnel, session_id);
James Chapmanfd558d12010-04-02 06:18:33 +0000263 read_lock_bh(&tunnel->hlist_lock);
Sasha Levinb67bfe02013-02-27 17:06:00 -0800264 hlist_for_each_entry(session, session_list, hlist) {
James Chapmanfd558d12010-04-02 06:18:33 +0000265 if (session->session_id == session_id) {
266 read_unlock_bh(&tunnel->hlist_lock);
267 return session;
268 }
269 }
270 read_unlock_bh(&tunnel->hlist_lock);
271
272 return NULL;
273}
274EXPORT_SYMBOL_GPL(l2tp_session_find);
275
276struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
277{
278 int hash;
James Chapmanfd558d12010-04-02 06:18:33 +0000279 struct l2tp_session *session;
280 int count = 0;
281
282 read_lock_bh(&tunnel->hlist_lock);
283 for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
Sasha Levinb67bfe02013-02-27 17:06:00 -0800284 hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {
James Chapmanfd558d12010-04-02 06:18:33 +0000285 if (++count > nth) {
286 read_unlock_bh(&tunnel->hlist_lock);
287 return session;
288 }
289 }
290 }
291
292 read_unlock_bh(&tunnel->hlist_lock);
293
294 return NULL;
295}
296EXPORT_SYMBOL_GPL(l2tp_session_find_nth);
297
James Chapman309795f2010-04-02 06:19:10 +0000298/* Lookup a session by interface name.
299 * This is very inefficient but is only used by management interfaces.
300 */
301struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname)
302{
303 struct l2tp_net *pn = l2tp_pernet(net);
304 int hash;
James Chapman309795f2010-04-02 06:19:10 +0000305 struct l2tp_session *session;
306
James Chapmane02d4942010-04-02 06:19:16 +0000307 rcu_read_lock_bh();
James Chapman309795f2010-04-02 06:19:10 +0000308 for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) {
Sasha Levinb67bfe02013-02-27 17:06:00 -0800309 hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {
James Chapman309795f2010-04-02 06:19:10 +0000310 if (!strcmp(session->ifname, ifname)) {
James Chapmane02d4942010-04-02 06:19:16 +0000311 rcu_read_unlock_bh();
James Chapman309795f2010-04-02 06:19:10 +0000312 return session;
313 }
314 }
315 }
316
James Chapmane02d4942010-04-02 06:19:16 +0000317 rcu_read_unlock_bh();
James Chapman309795f2010-04-02 06:19:10 +0000318
319 return NULL;
320}
321EXPORT_SYMBOL_GPL(l2tp_session_find_by_ifname);
322
James Chapmanfd558d12010-04-02 06:18:33 +0000323/* Lookup a tunnel by id
324 */
325struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id)
326{
327 struct l2tp_tunnel *tunnel;
328 struct l2tp_net *pn = l2tp_pernet(net);
329
James Chapmane02d4942010-04-02 06:19:16 +0000330 rcu_read_lock_bh();
331 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
James Chapmanfd558d12010-04-02 06:18:33 +0000332 if (tunnel->tunnel_id == tunnel_id) {
James Chapmane02d4942010-04-02 06:19:16 +0000333 rcu_read_unlock_bh();
James Chapmanfd558d12010-04-02 06:18:33 +0000334 return tunnel;
335 }
336 }
James Chapmane02d4942010-04-02 06:19:16 +0000337 rcu_read_unlock_bh();
James Chapmanfd558d12010-04-02 06:18:33 +0000338
339 return NULL;
340}
341EXPORT_SYMBOL_GPL(l2tp_tunnel_find);
342
343struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth)
344{
345 struct l2tp_net *pn = l2tp_pernet(net);
346 struct l2tp_tunnel *tunnel;
347 int count = 0;
348
James Chapmane02d4942010-04-02 06:19:16 +0000349 rcu_read_lock_bh();
350 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
James Chapmanfd558d12010-04-02 06:18:33 +0000351 if (++count > nth) {
James Chapmane02d4942010-04-02 06:19:16 +0000352 rcu_read_unlock_bh();
James Chapmanfd558d12010-04-02 06:18:33 +0000353 return tunnel;
354 }
355 }
356
James Chapmane02d4942010-04-02 06:19:16 +0000357 rcu_read_unlock_bh();
James Chapmanfd558d12010-04-02 06:18:33 +0000358
359 return NULL;
360}
361EXPORT_SYMBOL_GPL(l2tp_tunnel_find_nth);
362
363/*****************************************************************************
364 * Receive data handling
365 *****************************************************************************/
366
367/* Queue a skb in order. We come here only if the skb has an L2TP sequence
368 * number.
369 */
370static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)
371{
372 struct sk_buff *skbp;
373 struct sk_buff *tmp;
James Chapmanf7faffa2010-04-02 06:18:49 +0000374 u32 ns = L2TP_SKB_CB(skb)->ns;
James Chapman5de7aee2012-04-29 21:48:46 +0000375 struct l2tp_stats *sstats;
James Chapmanfd558d12010-04-02 06:18:33 +0000376
377 spin_lock_bh(&session->reorder_q.lock);
James Chapman5de7aee2012-04-29 21:48:46 +0000378 sstats = &session->stats;
James Chapmanfd558d12010-04-02 06:18:33 +0000379 skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
380 if (L2TP_SKB_CB(skbp)->ns > ns) {
381 __skb_queue_before(&session->reorder_q, skbp, skb);
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000382 l2tp_dbg(session, L2TP_MSG_SEQ,
383 "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
384 session->name, ns, L2TP_SKB_CB(skbp)->ns,
385 skb_queue_len(&session->reorder_q));
James Chapman5de7aee2012-04-29 21:48:46 +0000386 u64_stats_update_begin(&sstats->syncp);
387 sstats->rx_oos_packets++;
388 u64_stats_update_end(&sstats->syncp);
James Chapmanfd558d12010-04-02 06:18:33 +0000389 goto out;
390 }
391 }
392
393 __skb_queue_tail(&session->reorder_q, skb);
394
395out:
396 spin_unlock_bh(&session->reorder_q.lock);
397}
398
399/* Dequeue a single skb.
400 */
401static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)
402{
403 struct l2tp_tunnel *tunnel = session->tunnel;
404 int length = L2TP_SKB_CB(skb)->length;
James Chapman5de7aee2012-04-29 21:48:46 +0000405 struct l2tp_stats *tstats, *sstats;
James Chapmanfd558d12010-04-02 06:18:33 +0000406
407 /* We're about to requeue the skb, so return resources
408 * to its current owner (a socket receive buffer).
409 */
410 skb_orphan(skb);
411
James Chapman5de7aee2012-04-29 21:48:46 +0000412 tstats = &tunnel->stats;
413 u64_stats_update_begin(&tstats->syncp);
414 sstats = &session->stats;
415 u64_stats_update_begin(&sstats->syncp);
416 tstats->rx_packets++;
417 tstats->rx_bytes += length;
418 sstats->rx_packets++;
419 sstats->rx_bytes += length;
420 u64_stats_update_end(&tstats->syncp);
421 u64_stats_update_end(&sstats->syncp);
James Chapmanfd558d12010-04-02 06:18:33 +0000422
423 if (L2TP_SKB_CB(skb)->has_seq) {
424 /* Bump our Nr */
425 session->nr++;
James Chapmanf7faffa2010-04-02 06:18:49 +0000426 if (tunnel->version == L2TP_HDR_VER_2)
427 session->nr &= 0xffff;
428 else
429 session->nr &= 0xffffff;
430
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000431 l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated nr to %hu\n",
432 session->name, session->nr);
James Chapmanfd558d12010-04-02 06:18:33 +0000433 }
434
435 /* call private receive handler */
436 if (session->recv_skb != NULL)
437 (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);
438 else
439 kfree_skb(skb);
440
441 if (session->deref)
442 (*session->deref)(session);
443}
444
445/* Dequeue skbs from the session's reorder_q, subject to packet order.
446 * Skbs that have been in the queue for too long are simply discarded.
447 */
448static void l2tp_recv_dequeue(struct l2tp_session *session)
449{
450 struct sk_buff *skb;
451 struct sk_buff *tmp;
James Chapman5de7aee2012-04-29 21:48:46 +0000452 struct l2tp_stats *sstats;
James Chapmanfd558d12010-04-02 06:18:33 +0000453
454 /* If the pkt at the head of the queue has the nr that we
455 * expect to send up next, dequeue it and any other
456 * in-sequence packets behind it.
457 */
Eric Dumazete2e210c2011-11-02 22:47:44 +0000458start:
James Chapmanfd558d12010-04-02 06:18:33 +0000459 spin_lock_bh(&session->reorder_q.lock);
James Chapman5de7aee2012-04-29 21:48:46 +0000460 sstats = &session->stats;
James Chapmanfd558d12010-04-02 06:18:33 +0000461 skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
462 if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) {
James Chapman5de7aee2012-04-29 21:48:46 +0000463 u64_stats_update_begin(&sstats->syncp);
464 sstats->rx_seq_discards++;
465 sstats->rx_errors++;
466 u64_stats_update_end(&sstats->syncp);
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000467 l2tp_dbg(session, L2TP_MSG_SEQ,
468 "%s: oos pkt %u len %d discarded (too old), waiting for %u, reorder_q_len=%d\n",
469 session->name, L2TP_SKB_CB(skb)->ns,
470 L2TP_SKB_CB(skb)->length, session->nr,
471 skb_queue_len(&session->reorder_q));
James Chapman38d40b32012-05-09 23:43:08 +0000472 session->reorder_skip = 1;
James Chapmanfd558d12010-04-02 06:18:33 +0000473 __skb_unlink(skb, &session->reorder_q);
474 kfree_skb(skb);
475 if (session->deref)
476 (*session->deref)(session);
477 continue;
478 }
479
480 if (L2TP_SKB_CB(skb)->has_seq) {
James Chapman38d40b32012-05-09 23:43:08 +0000481 if (session->reorder_skip) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000482 l2tp_dbg(session, L2TP_MSG_SEQ,
483 "%s: advancing nr to next pkt: %u -> %u",
484 session->name, session->nr,
485 L2TP_SKB_CB(skb)->ns);
James Chapman38d40b32012-05-09 23:43:08 +0000486 session->reorder_skip = 0;
487 session->nr = L2TP_SKB_CB(skb)->ns;
488 }
James Chapmanfd558d12010-04-02 06:18:33 +0000489 if (L2TP_SKB_CB(skb)->ns != session->nr) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000490 l2tp_dbg(session, L2TP_MSG_SEQ,
491 "%s: holding oos pkt %u len %d, waiting for %u, reorder_q_len=%d\n",
492 session->name, L2TP_SKB_CB(skb)->ns,
493 L2TP_SKB_CB(skb)->length, session->nr,
494 skb_queue_len(&session->reorder_q));
James Chapmanfd558d12010-04-02 06:18:33 +0000495 goto out;
496 }
497 }
498 __skb_unlink(skb, &session->reorder_q);
499
500 /* Process the skb. We release the queue lock while we
501 * do so to let other contexts process the queue.
502 */
503 spin_unlock_bh(&session->reorder_q.lock);
504 l2tp_recv_dequeue_skb(session, skb);
Eric Dumazete2e210c2011-11-02 22:47:44 +0000505 goto start;
James Chapmanfd558d12010-04-02 06:18:33 +0000506 }
507
508out:
509 spin_unlock_bh(&session->reorder_q.lock);
510}
511
512static inline int l2tp_verify_udp_checksum(struct sock *sk,
513 struct sk_buff *skb)
514{
515 struct udphdr *uh = udp_hdr(skb);
516 u16 ulen = ntohs(uh->len);
James Chapmanfd558d12010-04-02 06:18:33 +0000517 __wsum psum;
518
Benjamin LaHaised2cf3362012-04-27 08:24:18 +0000519 if (sk->sk_no_check || skb_csum_unnecessary(skb))
James Chapmanfd558d12010-04-02 06:18:33 +0000520 return 0;
521
Benjamin LaHaised2cf3362012-04-27 08:24:18 +0000522#if IS_ENABLED(CONFIG_IPV6)
523 if (sk->sk_family == PF_INET6) {
524 if (!uh->check) {
525 LIMIT_NETDEBUG(KERN_INFO "L2TP: IPv6: checksum is 0\n");
526 return 1;
527 }
528 if ((skb->ip_summed == CHECKSUM_COMPLETE) &&
529 !csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
530 &ipv6_hdr(skb)->daddr, ulen,
531 IPPROTO_UDP, skb->csum)) {
532 skb->ip_summed = CHECKSUM_UNNECESSARY;
533 return 0;
534 }
535 skb->csum = ~csum_unfold(csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
536 &ipv6_hdr(skb)->daddr,
537 skb->len, IPPROTO_UDP,
538 0));
539 } else
540#endif
541 {
542 struct inet_sock *inet;
543 if (!uh->check)
544 return 0;
545 inet = inet_sk(sk);
546 psum = csum_tcpudp_nofold(inet->inet_saddr, inet->inet_daddr,
547 ulen, IPPROTO_UDP, 0);
James Chapmanfd558d12010-04-02 06:18:33 +0000548
Benjamin LaHaised2cf3362012-04-27 08:24:18 +0000549 if ((skb->ip_summed == CHECKSUM_COMPLETE) &&
550 !csum_fold(csum_add(psum, skb->csum)))
551 return 0;
552 skb->csum = psum;
553 }
James Chapmanfd558d12010-04-02 06:18:33 +0000554
555 return __skb_checksum_complete(skb);
556}
557
James Chapmanf7faffa2010-04-02 06:18:49 +0000558/* Do receive processing of L2TP data frames. We handle both L2TPv2
559 * and L2TPv3 data frames here.
560 *
561 * L2TPv2 Data Message Header
562 *
563 * 0 1 2 3
564 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
565 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
566 * |T|L|x|x|S|x|O|P|x|x|x|x| Ver | Length (opt) |
567 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
568 * | Tunnel ID | Session ID |
569 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
570 * | Ns (opt) | Nr (opt) |
571 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
572 * | Offset Size (opt) | Offset pad... (opt)
573 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
574 *
575 * Data frames are marked by T=0. All other fields are the same as
576 * those in L2TP control frames.
577 *
578 * L2TPv3 Data Message Header
579 *
580 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
581 * | L2TP Session Header |
582 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
583 * | L2-Specific Sublayer |
584 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
585 * | Tunnel Payload ...
586 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
587 *
588 * L2TPv3 Session Header Over IP
589 *
590 * 0 1 2 3
591 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
592 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
593 * | Session ID |
594 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
595 * | Cookie (optional, maximum 64 bits)...
596 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
597 * |
598 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
599 *
600 * L2TPv3 L2-Specific Sublayer Format
601 *
602 * 0 1 2 3
603 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
604 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
605 * |x|S|x|x|x|x|x|x| Sequence Number |
606 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
607 *
608 * Cookie value, sublayer format and offset (pad) are negotiated with
609 * the peer when the session is set up. Unlike L2TPv2, we do not need
610 * to parse the packet header to determine if optional fields are
611 * present.
612 *
613 * Caller must already have parsed the frame and determined that it is
614 * a data (not control) frame before coming here. Fields up to the
615 * session-id have already been parsed and ptr points to the data
616 * after the session-id.
James Chapmanfd558d12010-04-02 06:18:33 +0000617 */
James Chapmanf7faffa2010-04-02 06:18:49 +0000618void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
619 unsigned char *ptr, unsigned char *optr, u16 hdrflags,
620 int length, int (*payload_hook)(struct sk_buff *skb))
James Chapmanfd558d12010-04-02 06:18:33 +0000621{
James Chapmanf7faffa2010-04-02 06:18:49 +0000622 struct l2tp_tunnel *tunnel = session->tunnel;
James Chapmanfd558d12010-04-02 06:18:33 +0000623 int offset;
James Chapmanf7faffa2010-04-02 06:18:49 +0000624 u32 ns, nr;
James Chapman5de7aee2012-04-29 21:48:46 +0000625 struct l2tp_stats *sstats = &session->stats;
James Chapmanfd558d12010-04-02 06:18:33 +0000626
627 /* The ref count is increased since we now hold a pointer to
628 * the session. Take care to decrement the refcnt when exiting
629 * this function from now on...
630 */
631 l2tp_session_inc_refcount(session);
632 if (session->ref)
633 (*session->ref)(session);
634
James Chapmanf7faffa2010-04-02 06:18:49 +0000635 /* Parse and check optional cookie */
636 if (session->peer_cookie_len > 0) {
637 if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000638 l2tp_info(tunnel, L2TP_MSG_DATA,
639 "%s: cookie mismatch (%u/%u). Discarding.\n",
640 tunnel->name, tunnel->tunnel_id,
641 session->session_id);
James Chapman5de7aee2012-04-29 21:48:46 +0000642 u64_stats_update_begin(&sstats->syncp);
643 sstats->rx_cookie_discards++;
644 u64_stats_update_end(&sstats->syncp);
James Chapmanf7faffa2010-04-02 06:18:49 +0000645 goto discard;
646 }
647 ptr += session->peer_cookie_len;
648 }
649
James Chapmanfd558d12010-04-02 06:18:33 +0000650 /* Handle the optional sequence numbers. Sequence numbers are
651 * in different places for L2TPv2 and L2TPv3.
652 *
653 * If we are the LAC, enable/disable sequence numbers under
654 * the control of the LNS. If no sequence numbers present but
655 * we were expecting them, discard frame.
656 */
657 ns = nr = 0;
658 L2TP_SKB_CB(skb)->has_seq = 0;
James Chapmanf7faffa2010-04-02 06:18:49 +0000659 if (tunnel->version == L2TP_HDR_VER_2) {
660 if (hdrflags & L2TP_HDRFLAG_S) {
661 ns = ntohs(*(__be16 *) ptr);
662 ptr += 2;
663 nr = ntohs(*(__be16 *) ptr);
664 ptr += 2;
James Chapmanfd558d12010-04-02 06:18:33 +0000665
James Chapmanf7faffa2010-04-02 06:18:49 +0000666 /* Store L2TP info in the skb */
667 L2TP_SKB_CB(skb)->ns = ns;
668 L2TP_SKB_CB(skb)->has_seq = 1;
James Chapmanfd558d12010-04-02 06:18:33 +0000669
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000670 l2tp_dbg(session, L2TP_MSG_SEQ,
671 "%s: recv data ns=%u, nr=%u, session nr=%u\n",
672 session->name, ns, nr, session->nr);
James Chapmanf7faffa2010-04-02 06:18:49 +0000673 }
674 } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
675 u32 l2h = ntohl(*(__be32 *) ptr);
676
677 if (l2h & 0x40000000) {
678 ns = l2h & 0x00ffffff;
679
680 /* Store L2TP info in the skb */
681 L2TP_SKB_CB(skb)->ns = ns;
682 L2TP_SKB_CB(skb)->has_seq = 1;
683
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000684 l2tp_dbg(session, L2TP_MSG_SEQ,
685 "%s: recv data ns=%u, session nr=%u\n",
686 session->name, ns, session->nr);
James Chapmanf7faffa2010-04-02 06:18:49 +0000687 }
James Chapmanfd558d12010-04-02 06:18:33 +0000688 }
689
James Chapmanf7faffa2010-04-02 06:18:49 +0000690 /* Advance past L2-specific header, if present */
691 ptr += session->l2specific_len;
692
James Chapmanfd558d12010-04-02 06:18:33 +0000693 if (L2TP_SKB_CB(skb)->has_seq) {
694 /* Received a packet with sequence numbers. If we're the LNS,
695 * check if we sre sending sequence numbers and if not,
696 * configure it so.
697 */
698 if ((!session->lns_mode) && (!session->send_seq)) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000699 l2tp_info(session, L2TP_MSG_SEQ,
700 "%s: requested to enable seq numbers by LNS\n",
701 session->name);
James Chapmanfd558d12010-04-02 06:18:33 +0000702 session->send_seq = -1;
James Chapmanf7faffa2010-04-02 06:18:49 +0000703 l2tp_session_set_header_len(session, tunnel->version);
James Chapmanfd558d12010-04-02 06:18:33 +0000704 }
705 } else {
706 /* No sequence numbers.
707 * If user has configured mandatory sequence numbers, discard.
708 */
709 if (session->recv_seq) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000710 l2tp_warn(session, L2TP_MSG_SEQ,
711 "%s: recv data has no seq numbers when required. Discarding.\n",
712 session->name);
James Chapman5de7aee2012-04-29 21:48:46 +0000713 u64_stats_update_begin(&sstats->syncp);
714 sstats->rx_seq_discards++;
715 u64_stats_update_end(&sstats->syncp);
James Chapmanfd558d12010-04-02 06:18:33 +0000716 goto discard;
717 }
718
719 /* If we're the LAC and we're sending sequence numbers, the
720 * LNS has requested that we no longer send sequence numbers.
721 * If we're the LNS and we're sending sequence numbers, the
722 * LAC is broken. Discard the frame.
723 */
724 if ((!session->lns_mode) && (session->send_seq)) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000725 l2tp_info(session, L2TP_MSG_SEQ,
726 "%s: requested to disable seq numbers by LNS\n",
727 session->name);
James Chapmanfd558d12010-04-02 06:18:33 +0000728 session->send_seq = 0;
James Chapmanf7faffa2010-04-02 06:18:49 +0000729 l2tp_session_set_header_len(session, tunnel->version);
James Chapmanfd558d12010-04-02 06:18:33 +0000730 } else if (session->send_seq) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000731 l2tp_warn(session, L2TP_MSG_SEQ,
732 "%s: recv data has no seq numbers when required. Discarding.\n",
733 session->name);
James Chapman5de7aee2012-04-29 21:48:46 +0000734 u64_stats_update_begin(&sstats->syncp);
735 sstats->rx_seq_discards++;
736 u64_stats_update_end(&sstats->syncp);
James Chapmanfd558d12010-04-02 06:18:33 +0000737 goto discard;
738 }
739 }
740
James Chapmanf7faffa2010-04-02 06:18:49 +0000741 /* Session data offset is handled differently for L2TPv2 and
742 * L2TPv3. For L2TPv2, there is an optional 16-bit value in
743 * the header. For L2TPv3, the offset is negotiated using AVPs
744 * in the session setup control protocol.
745 */
746 if (tunnel->version == L2TP_HDR_VER_2) {
747 /* If offset bit set, skip it. */
748 if (hdrflags & L2TP_HDRFLAG_O) {
749 offset = ntohs(*(__be16 *)ptr);
750 ptr += 2 + offset;
751 }
752 } else
753 ptr += session->offset;
James Chapmanfd558d12010-04-02 06:18:33 +0000754
755 offset = ptr - optr;
756 if (!pskb_may_pull(skb, offset))
757 goto discard;
758
759 __skb_pull(skb, offset);
760
761 /* If caller wants to process the payload before we queue the
762 * packet, do so now.
763 */
764 if (payload_hook)
765 if ((*payload_hook)(skb))
766 goto discard;
767
768 /* Prepare skb for adding to the session's reorder_q. Hold
769 * packets for max reorder_timeout or 1 second if not
770 * reordering.
771 */
772 L2TP_SKB_CB(skb)->length = length;
773 L2TP_SKB_CB(skb)->expires = jiffies +
774 (session->reorder_timeout ? session->reorder_timeout : HZ);
775
776 /* Add packet to the session's receive queue. Reordering is done here, if
777 * enabled. Saved L2TP protocol info is stored in skb->sb[].
778 */
779 if (L2TP_SKB_CB(skb)->has_seq) {
780 if (session->reorder_timeout != 0) {
781 /* Packet reordering enabled. Add skb to session's
782 * reorder queue, in order of ns.
783 */
784 l2tp_recv_queue_skb(session, skb);
785 } else {
786 /* Packet reordering disabled. Discard out-of-sequence
787 * packets
788 */
789 if (L2TP_SKB_CB(skb)->ns != session->nr) {
James Chapman5de7aee2012-04-29 21:48:46 +0000790 u64_stats_update_begin(&sstats->syncp);
791 sstats->rx_seq_discards++;
792 u64_stats_update_end(&sstats->syncp);
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000793 l2tp_dbg(session, L2TP_MSG_SEQ,
794 "%s: oos pkt %u len %d discarded, waiting for %u, reorder_q_len=%d\n",
795 session->name, L2TP_SKB_CB(skb)->ns,
796 L2TP_SKB_CB(skb)->length, session->nr,
797 skb_queue_len(&session->reorder_q));
James Chapmanfd558d12010-04-02 06:18:33 +0000798 goto discard;
799 }
800 skb_queue_tail(&session->reorder_q, skb);
801 }
802 } else {
803 /* No sequence numbers. Add the skb to the tail of the
804 * reorder queue. This ensures that it will be
805 * delivered after all previous sequenced skbs.
806 */
807 skb_queue_tail(&session->reorder_q, skb);
808 }
809
810 /* Try to dequeue as many skbs from reorder_q as we can. */
811 l2tp_recv_dequeue(session);
812
813 l2tp_session_dec_refcount(session);
814
James Chapmanf7faffa2010-04-02 06:18:49 +0000815 return;
James Chapmanfd558d12010-04-02 06:18:33 +0000816
817discard:
James Chapman5de7aee2012-04-29 21:48:46 +0000818 u64_stats_update_begin(&sstats->syncp);
819 sstats->rx_errors++;
820 u64_stats_update_end(&sstats->syncp);
James Chapmanfd558d12010-04-02 06:18:33 +0000821 kfree_skb(skb);
822
823 if (session->deref)
824 (*session->deref)(session);
825
826 l2tp_session_dec_refcount(session);
James Chapmanf7faffa2010-04-02 06:18:49 +0000827}
828EXPORT_SYMBOL(l2tp_recv_common);
829
830/* Internal UDP receive frame. Do the real work of receiving an L2TP data frame
831 * here. The skb is not on a list when we get here.
832 * Returns 0 if the packet was a data packet and was successfully passed on.
833 * Returns 1 if the packet was not a good data packet and could not be
834 * forwarded. All such packets are passed up to userspace to deal with.
835 */
stephen hemmingerfc130842010-10-21 07:50:46 +0000836static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
837 int (*payload_hook)(struct sk_buff *skb))
James Chapmanf7faffa2010-04-02 06:18:49 +0000838{
839 struct l2tp_session *session = NULL;
840 unsigned char *ptr, *optr;
841 u16 hdrflags;
842 u32 tunnel_id, session_id;
James Chapmanf7faffa2010-04-02 06:18:49 +0000843 u16 version;
844 int length;
James Chapman5de7aee2012-04-29 21:48:46 +0000845 struct l2tp_stats *tstats;
James Chapmanf7faffa2010-04-02 06:18:49 +0000846
847 if (tunnel->sock && l2tp_verify_udp_checksum(tunnel->sock, skb))
848 goto discard_bad_csum;
849
850 /* UDP always verifies the packet length. */
851 __skb_pull(skb, sizeof(struct udphdr));
852
853 /* Short packet? */
854 if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000855 l2tp_info(tunnel, L2TP_MSG_DATA,
856 "%s: recv short packet (len=%d)\n",
857 tunnel->name, skb->len);
James Chapmanf7faffa2010-04-02 06:18:49 +0000858 goto error;
859 }
860
James Chapmanf7faffa2010-04-02 06:18:49 +0000861 /* Trace packet contents, if enabled */
862 if (tunnel->debug & L2TP_MSG_DATA) {
863 length = min(32u, skb->len);
864 if (!pskb_may_pull(skb, length))
865 goto error;
866
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000867 pr_debug("%s: recv\n", tunnel->name);
868 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length);
James Chapmanf7faffa2010-04-02 06:18:49 +0000869 }
870
Eric Dumazete50e7052011-11-08 13:59:44 -0500871 /* Point to L2TP header */
872 optr = ptr = skb->data;
873
James Chapmanf7faffa2010-04-02 06:18:49 +0000874 /* Get L2TP header flags */
875 hdrflags = ntohs(*(__be16 *) ptr);
876
877 /* Check protocol version */
878 version = hdrflags & L2TP_HDR_VER_MASK;
879 if (version != tunnel->version) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000880 l2tp_info(tunnel, L2TP_MSG_DATA,
881 "%s: recv protocol version mismatch: got %d expected %d\n",
882 tunnel->name, version, tunnel->version);
James Chapmanf7faffa2010-04-02 06:18:49 +0000883 goto error;
884 }
885
886 /* Get length of L2TP packet */
887 length = skb->len;
888
889 /* If type is control packet, it is handled by userspace. */
890 if (hdrflags & L2TP_HDRFLAG_T) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000891 l2tp_dbg(tunnel, L2TP_MSG_DATA,
892 "%s: recv control packet, len=%d\n",
893 tunnel->name, length);
James Chapmanf7faffa2010-04-02 06:18:49 +0000894 goto error;
895 }
896
897 /* Skip flags */
898 ptr += 2;
899
900 if (tunnel->version == L2TP_HDR_VER_2) {
901 /* If length is present, skip it */
902 if (hdrflags & L2TP_HDRFLAG_L)
903 ptr += 2;
904
905 /* Extract tunnel and session ID */
906 tunnel_id = ntohs(*(__be16 *) ptr);
907 ptr += 2;
908 session_id = ntohs(*(__be16 *) ptr);
909 ptr += 2;
910 } else {
911 ptr += 2; /* skip reserved bits */
912 tunnel_id = tunnel->tunnel_id;
913 session_id = ntohl(*(__be32 *) ptr);
914 ptr += 4;
915 }
916
917 /* Find the session context */
918 session = l2tp_session_find(tunnel->l2tp_net, tunnel, session_id);
James Chapman309795f2010-04-02 06:19:10 +0000919 if (!session || !session->recv_skb) {
James Chapmanf7faffa2010-04-02 06:18:49 +0000920 /* Not found? Pass to userspace to deal with */
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000921 l2tp_info(tunnel, L2TP_MSG_DATA,
922 "%s: no session found (%u/%u). Passing up.\n",
923 tunnel->name, tunnel_id, session_id);
James Chapmanf7faffa2010-04-02 06:18:49 +0000924 goto error;
925 }
926
927 l2tp_recv_common(session, skb, ptr, optr, hdrflags, length, payload_hook);
James Chapmanfd558d12010-04-02 06:18:33 +0000928
929 return 0;
930
931discard_bad_csum:
932 LIMIT_NETDEBUG("%s: UDP: bad checksum\n", tunnel->name);
933 UDP_INC_STATS_USER(tunnel->l2tp_net, UDP_MIB_INERRORS, 0);
James Chapman5de7aee2012-04-29 21:48:46 +0000934 tstats = &tunnel->stats;
935 u64_stats_update_begin(&tstats->syncp);
936 tstats->rx_errors++;
937 u64_stats_update_end(&tstats->syncp);
James Chapmanfd558d12010-04-02 06:18:33 +0000938 kfree_skb(skb);
939
940 return 0;
941
942error:
943 /* Put UDP header back */
944 __skb_push(skb, sizeof(struct udphdr));
945
946 return 1;
947}
James Chapmanfd558d12010-04-02 06:18:33 +0000948
949/* UDP encapsulation receive handler. See net/ipv4/udp.c.
950 * Return codes:
951 * 0 : success.
952 * <0: error
953 * >0: skb should be passed up to userspace as UDP.
954 */
955int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
956{
957 struct l2tp_tunnel *tunnel;
958
959 tunnel = l2tp_sock_to_tunnel(sk);
960 if (tunnel == NULL)
961 goto pass_up;
962
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000963 l2tp_dbg(tunnel, L2TP_MSG_DATA, "%s: received %d bytes\n",
964 tunnel->name, skb->len);
James Chapmanfd558d12010-04-02 06:18:33 +0000965
966 if (l2tp_udp_recv_core(tunnel, skb, tunnel->recv_payload_hook))
967 goto pass_up_put;
968
969 sock_put(sk);
970 return 0;
971
972pass_up_put:
973 sock_put(sk);
974pass_up:
975 return 1;
976}
977EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv);
978
979/************************************************************************
980 * Transmit handling
981 ***********************************************************************/
982
983/* Build an L2TP header for the session into the buffer provided.
984 */
James Chapmanf7faffa2010-04-02 06:18:49 +0000985static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
James Chapmanfd558d12010-04-02 06:18:33 +0000986{
James Chapmanf7faffa2010-04-02 06:18:49 +0000987 struct l2tp_tunnel *tunnel = session->tunnel;
James Chapmanfd558d12010-04-02 06:18:33 +0000988 __be16 *bufp = buf;
James Chapmanf7faffa2010-04-02 06:18:49 +0000989 __be16 *optr = buf;
James Chapmanfd558d12010-04-02 06:18:33 +0000990 u16 flags = L2TP_HDR_VER_2;
991 u32 tunnel_id = tunnel->peer_tunnel_id;
992 u32 session_id = session->peer_session_id;
993
994 if (session->send_seq)
995 flags |= L2TP_HDRFLAG_S;
996
997 /* Setup L2TP header. */
998 *bufp++ = htons(flags);
999 *bufp++ = htons(tunnel_id);
1000 *bufp++ = htons(session_id);
1001 if (session->send_seq) {
1002 *bufp++ = htons(session->ns);
1003 *bufp++ = 0;
1004 session->ns++;
James Chapmanf7faffa2010-04-02 06:18:49 +00001005 session->ns &= 0xffff;
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001006 l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated ns to %u\n",
1007 session->name, session->ns);
James Chapmanfd558d12010-04-02 06:18:33 +00001008 }
James Chapmanf7faffa2010-04-02 06:18:49 +00001009
1010 return bufp - optr;
James Chapmanfd558d12010-04-02 06:18:33 +00001011}
1012
James Chapmanf7faffa2010-04-02 06:18:49 +00001013static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
James Chapmanfd558d12010-04-02 06:18:33 +00001014{
James Chapman0d767512010-04-02 06:19:00 +00001015 struct l2tp_tunnel *tunnel = session->tunnel;
James Chapmanf7faffa2010-04-02 06:18:49 +00001016 char *bufp = buf;
1017 char *optr = bufp;
James Chapmanfd558d12010-04-02 06:18:33 +00001018
James Chapman0d767512010-04-02 06:19:00 +00001019 /* Setup L2TP header. The header differs slightly for UDP and
1020 * IP encapsulations. For UDP, there is 4 bytes of flags.
1021 */
1022 if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
1023 u16 flags = L2TP_HDR_VER_3;
1024 *((__be16 *) bufp) = htons(flags);
1025 bufp += 2;
1026 *((__be16 *) bufp) = 0;
1027 bufp += 2;
1028 }
1029
James Chapmanf7faffa2010-04-02 06:18:49 +00001030 *((__be32 *) bufp) = htonl(session->peer_session_id);
1031 bufp += 4;
1032 if (session->cookie_len) {
1033 memcpy(bufp, &session->cookie[0], session->cookie_len);
1034 bufp += session->cookie_len;
1035 }
1036 if (session->l2specific_len) {
1037 if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
1038 u32 l2h = 0;
1039 if (session->send_seq) {
1040 l2h = 0x40000000 | session->ns;
1041 session->ns++;
1042 session->ns &= 0xffffff;
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001043 l2tp_dbg(session, L2TP_MSG_SEQ,
1044 "%s: updated ns to %u\n",
1045 session->name, session->ns);
James Chapmanf7faffa2010-04-02 06:18:49 +00001046 }
1047
1048 *((__be32 *) bufp) = htonl(l2h);
1049 }
1050 bufp += session->l2specific_len;
1051 }
1052 if (session->offset)
1053 bufp += session->offset;
1054
1055 return bufp - optr;
James Chapmanfd558d12010-04-02 06:18:33 +00001056}
James Chapmanfd558d12010-04-02 06:18:33 +00001057
stephen hemmingerfc130842010-10-21 07:50:46 +00001058static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
David S. Millerd9d8da82011-05-06 22:23:20 -07001059 struct flowi *fl, size_t data_len)
James Chapmanfd558d12010-04-02 06:18:33 +00001060{
1061 struct l2tp_tunnel *tunnel = session->tunnel;
1062 unsigned int len = skb->len;
1063 int error;
James Chapman5de7aee2012-04-29 21:48:46 +00001064 struct l2tp_stats *tstats, *sstats;
James Chapmanfd558d12010-04-02 06:18:33 +00001065
1066 /* Debug */
1067 if (session->send_seq)
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001068 l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %Zd bytes, ns=%u\n",
1069 session->name, data_len, session->ns - 1);
James Chapmanfd558d12010-04-02 06:18:33 +00001070 else
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001071 l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %Zd bytes\n",
1072 session->name, data_len);
James Chapmanfd558d12010-04-02 06:18:33 +00001073
1074 if (session->debug & L2TP_MSG_DATA) {
James Chapman0d767512010-04-02 06:19:00 +00001075 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1076 unsigned char *datap = skb->data + uhlen;
James Chapmanfd558d12010-04-02 06:18:33 +00001077
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001078 pr_debug("%s: xmit\n", session->name);
1079 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1080 datap, min_t(size_t, 32, len - uhlen));
James Chapmanfd558d12010-04-02 06:18:33 +00001081 }
1082
1083 /* Queue the packet to IP for output */
Shan Wei4e15ed42010-04-15 16:43:08 +00001084 skb->local_df = 1;
Benjamin LaHaised2cf3362012-04-27 08:24:18 +00001085#if IS_ENABLED(CONFIG_IPV6)
1086 if (skb->sk->sk_family == PF_INET6)
1087 error = inet6_csk_xmit(skb, NULL);
1088 else
1089#endif
1090 error = ip_queue_xmit(skb, fl);
James Chapmanfd558d12010-04-02 06:18:33 +00001091
1092 /* Update stats */
James Chapman5de7aee2012-04-29 21:48:46 +00001093 tstats = &tunnel->stats;
1094 u64_stats_update_begin(&tstats->syncp);
1095 sstats = &session->stats;
1096 u64_stats_update_begin(&sstats->syncp);
James Chapmanfd558d12010-04-02 06:18:33 +00001097 if (error >= 0) {
James Chapman5de7aee2012-04-29 21:48:46 +00001098 tstats->tx_packets++;
1099 tstats->tx_bytes += len;
1100 sstats->tx_packets++;
1101 sstats->tx_bytes += len;
James Chapmanfd558d12010-04-02 06:18:33 +00001102 } else {
James Chapman5de7aee2012-04-29 21:48:46 +00001103 tstats->tx_errors++;
1104 sstats->tx_errors++;
James Chapmanfd558d12010-04-02 06:18:33 +00001105 }
James Chapman5de7aee2012-04-29 21:48:46 +00001106 u64_stats_update_end(&tstats->syncp);
1107 u64_stats_update_end(&sstats->syncp);
James Chapmanfd558d12010-04-02 06:18:33 +00001108
1109 return 0;
1110}
James Chapmanfd558d12010-04-02 06:18:33 +00001111
1112/* Automatically called when the skb is freed.
1113 */
1114static void l2tp_sock_wfree(struct sk_buff *skb)
1115{
1116 sock_put(skb->sk);
1117}
1118
1119/* For data skbs that we transmit, we associate with the tunnel socket
1120 * but don't do accounting.
1121 */
1122static inline void l2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
1123{
1124 sock_hold(sk);
1125 skb->sk = sk;
1126 skb->destructor = l2tp_sock_wfree;
1127}
1128
Benjamin LaHaised2cf3362012-04-27 08:24:18 +00001129#if IS_ENABLED(CONFIG_IPV6)
1130static void l2tp_xmit_ipv6_csum(struct sock *sk, struct sk_buff *skb,
1131 int udp_len)
1132{
1133 struct ipv6_pinfo *np = inet6_sk(sk);
1134 struct udphdr *uh = udp_hdr(skb);
1135
1136 if (!skb_dst(skb) || !skb_dst(skb)->dev ||
1137 !(skb_dst(skb)->dev->features & NETIF_F_IPV6_CSUM)) {
1138 __wsum csum = skb_checksum(skb, 0, udp_len, 0);
1139 skb->ip_summed = CHECKSUM_UNNECESSARY;
1140 uh->check = csum_ipv6_magic(&np->saddr, &np->daddr, udp_len,
1141 IPPROTO_UDP, csum);
1142 if (uh->check == 0)
1143 uh->check = CSUM_MANGLED_0;
1144 } else {
1145 skb->ip_summed = CHECKSUM_PARTIAL;
1146 skb->csum_start = skb_transport_header(skb) - skb->head;
1147 skb->csum_offset = offsetof(struct udphdr, check);
1148 uh->check = ~csum_ipv6_magic(&np->saddr, &np->daddr,
1149 udp_len, IPPROTO_UDP, 0);
1150 }
1151}
1152#endif
1153
James Chapmanfd558d12010-04-02 06:18:33 +00001154/* If caller requires the skb to have a ppp header, the header must be
1155 * inserted in the skb data before calling this function.
1156 */
1157int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len)
1158{
1159 int data_len = skb->len;
James Chapman0d767512010-04-02 06:19:00 +00001160 struct l2tp_tunnel *tunnel = session->tunnel;
1161 struct sock *sk = tunnel->sock;
David S. Millerd9d8da82011-05-06 22:23:20 -07001162 struct flowi *fl;
James Chapmanfd558d12010-04-02 06:18:33 +00001163 struct udphdr *uh;
James Chapmanfd558d12010-04-02 06:18:33 +00001164 struct inet_sock *inet;
1165 __wsum csum;
James Chapmanfd558d12010-04-02 06:18:33 +00001166 int headroom;
James Chapman0d767512010-04-02 06:19:00 +00001167 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1168 int udp_len;
Eric Dumazetb8c84302012-06-28 20:15:13 +00001169 int ret = NET_XMIT_SUCCESS;
James Chapmanfd558d12010-04-02 06:18:33 +00001170
1171 /* Check that there's enough headroom in the skb to insert IP,
1172 * UDP and L2TP headers. If not enough, expand it to
1173 * make room. Adjust truesize.
1174 */
1175 headroom = NET_SKB_PAD + sizeof(struct iphdr) +
James Chapman0d767512010-04-02 06:19:00 +00001176 uhlen + hdr_len;
Eric Dumazet835acf52011-10-07 05:35:46 +00001177 if (skb_cow_head(skb, headroom)) {
Eric Dumazetb8c84302012-06-28 20:15:13 +00001178 kfree_skb(skb);
1179 return NET_XMIT_DROP;
Eric Dumazet835acf52011-10-07 05:35:46 +00001180 }
James Chapmanfd558d12010-04-02 06:18:33 +00001181
James Chapmanfd558d12010-04-02 06:18:33 +00001182 skb_orphan(skb);
James Chapmanfd558d12010-04-02 06:18:33 +00001183 /* Setup L2TP header */
James Chapmanf7faffa2010-04-02 06:18:49 +00001184 session->build_header(session, __skb_push(skb, hdr_len));
James Chapmanfd558d12010-04-02 06:18:33 +00001185
James Chapman0d767512010-04-02 06:19:00 +00001186 /* Reset skb netfilter state */
James Chapmanfd558d12010-04-02 06:18:33 +00001187 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
1188 IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
1189 IPSKB_REROUTED);
1190 nf_reset(skb);
1191
David S. Miller6af88da2011-05-08 13:45:20 -07001192 bh_lock_sock(sk);
1193 if (sock_owned_by_user(sk)) {
Eric Dumazetb8c84302012-06-28 20:15:13 +00001194 kfree_skb(skb);
1195 ret = NET_XMIT_DROP;
David S. Miller6af88da2011-05-08 13:45:20 -07001196 goto out_unlock;
1197 }
1198
James Chapmanfd558d12010-04-02 06:18:33 +00001199 /* Get routing info from the tunnel socket */
1200 skb_dst_drop(skb);
Florian Westphal71b13912011-11-25 06:47:16 +00001201 skb_dst_set(skb, dst_clone(__sk_dst_check(sk, 0)));
James Chapmanfd558d12010-04-02 06:18:33 +00001202
David S. Millerd9d8da82011-05-06 22:23:20 -07001203 inet = inet_sk(sk);
1204 fl = &inet->cork.fl;
James Chapman0d767512010-04-02 06:19:00 +00001205 switch (tunnel->encap) {
1206 case L2TP_ENCAPTYPE_UDP:
1207 /* Setup UDP header */
James Chapman0d767512010-04-02 06:19:00 +00001208 __skb_push(skb, sizeof(*uh));
1209 skb_reset_transport_header(skb);
1210 uh = udp_hdr(skb);
1211 uh->source = inet->inet_sport;
1212 uh->dest = inet->inet_dport;
1213 udp_len = uhlen + hdr_len + data_len;
1214 uh->len = htons(udp_len);
1215 uh->check = 0;
1216
1217 /* Calculate UDP checksum if configured to do so */
Benjamin LaHaised2cf3362012-04-27 08:24:18 +00001218#if IS_ENABLED(CONFIG_IPV6)
1219 if (sk->sk_family == PF_INET6)
1220 l2tp_xmit_ipv6_csum(sk, skb, udp_len);
1221 else
1222#endif
James Chapman0d767512010-04-02 06:19:00 +00001223 if (sk->sk_no_check == UDP_CSUM_NOXMIT)
1224 skb->ip_summed = CHECKSUM_NONE;
1225 else if ((skb_dst(skb) && skb_dst(skb)->dev) &&
1226 (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM))) {
1227 skb->ip_summed = CHECKSUM_COMPLETE;
1228 csum = skb_checksum(skb, 0, udp_len, 0);
1229 uh->check = csum_tcpudp_magic(inet->inet_saddr,
1230 inet->inet_daddr,
1231 udp_len, IPPROTO_UDP, csum);
1232 if (uh->check == 0)
1233 uh->check = CSUM_MANGLED_0;
1234 } else {
1235 skb->ip_summed = CHECKSUM_PARTIAL;
1236 skb->csum_start = skb_transport_header(skb) - skb->head;
1237 skb->csum_offset = offsetof(struct udphdr, check);
1238 uh->check = ~csum_tcpudp_magic(inet->inet_saddr,
1239 inet->inet_daddr,
1240 udp_len, IPPROTO_UDP, 0);
1241 }
1242 break;
1243
1244 case L2TP_ENCAPTYPE_IP:
1245 break;
James Chapmanfd558d12010-04-02 06:18:33 +00001246 }
1247
James Chapman0d767512010-04-02 06:19:00 +00001248 l2tp_skb_set_owner_w(skb, sk);
1249
David S. Millerd9d8da82011-05-06 22:23:20 -07001250 l2tp_xmit_core(session, skb, fl, data_len);
David S. Miller6af88da2011-05-08 13:45:20 -07001251out_unlock:
1252 bh_unlock_sock(sk);
James Chapmanfd558d12010-04-02 06:18:33 +00001253
Eric Dumazetb8c84302012-06-28 20:15:13 +00001254 return ret;
James Chapmanfd558d12010-04-02 06:18:33 +00001255}
1256EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
1257
1258/*****************************************************************************
1259 * Tinnel and session create/destroy.
1260 *****************************************************************************/
1261
1262/* Tunnel socket destruct hook.
1263 * The tunnel context is deleted only when all session sockets have been
1264 * closed.
1265 */
stephen hemmingerfc130842010-10-21 07:50:46 +00001266static void l2tp_tunnel_destruct(struct sock *sk)
James Chapmanfd558d12010-04-02 06:18:33 +00001267{
1268 struct l2tp_tunnel *tunnel;
Tom Parkinf8ccac02013-01-31 23:43:00 +00001269 struct l2tp_net *pn;
James Chapmanfd558d12010-04-02 06:18:33 +00001270
1271 tunnel = sk->sk_user_data;
1272 if (tunnel == NULL)
1273 goto end;
1274
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001275 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing...\n", tunnel->name);
James Chapmanfd558d12010-04-02 06:18:33 +00001276
James Chapmanfd558d12010-04-02 06:18:33 +00001277
Tom Parkinf8ccac02013-01-31 23:43:00 +00001278 /* Disable udp encapsulation */
James Chapman0d767512010-04-02 06:19:00 +00001279 switch (tunnel->encap) {
1280 case L2TP_ENCAPTYPE_UDP:
1281 /* No longer an encapsulation socket. See net/ipv4/udp.c */
1282 (udp_sk(sk))->encap_type = 0;
1283 (udp_sk(sk))->encap_rcv = NULL;
Tom Parkin9980d002013-03-19 06:11:13 +00001284 (udp_sk(sk))->encap_destroy = NULL;
James Chapman0d767512010-04-02 06:19:00 +00001285 break;
1286 case L2TP_ENCAPTYPE_IP:
1287 break;
1288 }
James Chapmanfd558d12010-04-02 06:18:33 +00001289
1290 /* Remove hooks into tunnel socket */
James Chapmanfd558d12010-04-02 06:18:33 +00001291 sk->sk_destruct = tunnel->old_sk_destruct;
1292 sk->sk_user_data = NULL;
Tom Parkinf8ccac02013-01-31 23:43:00 +00001293 tunnel->sock = NULL;
1294
1295 /* Remove the tunnel struct from the tunnel list */
1296 pn = l2tp_pernet(tunnel->l2tp_net);
1297 spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1298 list_del_rcu(&tunnel->list);
1299 spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
1300 atomic_dec(&l2tp_tunnel_count);
1301
1302 l2tp_tunnel_closeall(tunnel);
1303 l2tp_tunnel_dec_refcount(tunnel);
James Chapmanfd558d12010-04-02 06:18:33 +00001304
1305 /* Call the original destructor */
1306 if (sk->sk_destruct)
1307 (*sk->sk_destruct)(sk);
James Chapmanfd558d12010-04-02 06:18:33 +00001308end:
1309 return;
1310}
James Chapmanfd558d12010-04-02 06:18:33 +00001311
1312/* When the tunnel is closed, all the attached sessions need to go too.
1313 */
Tom Parkine34f4c72013-03-19 06:11:14 +00001314void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
James Chapmanfd558d12010-04-02 06:18:33 +00001315{
1316 int hash;
1317 struct hlist_node *walk;
1318 struct hlist_node *tmp;
1319 struct l2tp_session *session;
1320
1321 BUG_ON(tunnel == NULL);
1322
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001323 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing all sessions...\n",
1324 tunnel->name);
James Chapmanfd558d12010-04-02 06:18:33 +00001325
1326 write_lock_bh(&tunnel->hlist_lock);
1327 for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
1328again:
1329 hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
1330 session = hlist_entry(walk, struct l2tp_session, hlist);
1331
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001332 l2tp_info(session, L2TP_MSG_CONTROL,
1333 "%s: closing session\n", session->name);
James Chapmanfd558d12010-04-02 06:18:33 +00001334
1335 hlist_del_init(&session->hlist);
1336
1337 /* Since we should hold the sock lock while
1338 * doing any unbinding, we need to release the
1339 * lock we're holding before taking that lock.
1340 * Hold a reference to the sock so it doesn't
1341 * disappear as we're jumping between locks.
1342 */
1343 if (session->ref != NULL)
1344 (*session->ref)(session);
1345
1346 write_unlock_bh(&tunnel->hlist_lock);
1347
James Chapmanf7faffa2010-04-02 06:18:49 +00001348 if (tunnel->version != L2TP_HDR_VER_2) {
1349 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1350
James Chapmane02d4942010-04-02 06:19:16 +00001351 spin_lock_bh(&pn->l2tp_session_hlist_lock);
1352 hlist_del_init_rcu(&session->global_hlist);
1353 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
1354 synchronize_rcu();
James Chapmanf7faffa2010-04-02 06:18:49 +00001355 }
1356
James Chapmanfd558d12010-04-02 06:18:33 +00001357 if (session->session_close != NULL)
1358 (*session->session_close)(session);
1359
1360 if (session->deref != NULL)
1361 (*session->deref)(session);
1362
Tom Parkin9980d002013-03-19 06:11:13 +00001363 l2tp_session_dec_refcount(session);
1364
James Chapmanfd558d12010-04-02 06:18:33 +00001365 write_lock_bh(&tunnel->hlist_lock);
1366
1367 /* Now restart from the beginning of this hash
1368 * chain. We always remove a session from the
1369 * list so we are guaranteed to make forward
1370 * progress.
1371 */
1372 goto again;
1373 }
1374 }
1375 write_unlock_bh(&tunnel->hlist_lock);
1376}
Tom Parkine34f4c72013-03-19 06:11:14 +00001377EXPORT_SYMBOL_GPL(l2tp_tunnel_closeall);
James Chapmanfd558d12010-04-02 06:18:33 +00001378
Tom Parkin9980d002013-03-19 06:11:13 +00001379/* Tunnel socket destroy hook for UDP encapsulation */
1380static void l2tp_udp_encap_destroy(struct sock *sk)
1381{
1382 struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
1383 if (tunnel) {
1384 l2tp_tunnel_closeall(tunnel);
1385 sock_put(sk);
1386 }
1387}
1388
James Chapmanfd558d12010-04-02 06:18:33 +00001389/* Really kill the tunnel.
1390 * Come here only when all sessions have been cleared from the tunnel.
1391 */
stephen hemmingerfc130842010-10-21 07:50:46 +00001392static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
James Chapmanfd558d12010-04-02 06:18:33 +00001393{
James Chapmanfd558d12010-04-02 06:18:33 +00001394 BUG_ON(atomic_read(&tunnel->ref_count) != 0);
1395 BUG_ON(tunnel->sock != NULL);
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001396 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: free...\n", tunnel->name);
xeb@mail.ru99469c32012-08-24 01:07:38 +00001397 kfree_rcu(tunnel, rcu);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001398}
James Chapmanfd558d12010-04-02 06:18:33 +00001399
Tom Parkinf8ccac02013-01-31 23:43:00 +00001400/* Workqueue tunnel deletion function */
1401static void l2tp_tunnel_del_work(struct work_struct *work)
1402{
1403 struct l2tp_tunnel *tunnel = NULL;
1404 struct socket *sock = NULL;
1405 struct sock *sk = NULL;
1406
1407 tunnel = container_of(work, struct l2tp_tunnel, del_work);
1408 sk = l2tp_tunnel_sock_lookup(tunnel);
1409 if (!sk)
1410 return;
1411
1412 sock = sk->sk_socket;
1413 BUG_ON(!sock);
1414
Tom Parkin167eb172013-01-31 23:43:03 +00001415 /* If the tunnel socket was created directly by the kernel, use the
1416 * sk_* API to release the socket now. Otherwise go through the
1417 * inet_* layer to shut the socket down, and let userspace close it.
1418 * In either case the tunnel resources are freed in the socket
1419 * destructor when the tunnel socket goes away.
Tom Parkinf8ccac02013-01-31 23:43:00 +00001420 */
Tom Parkin167eb172013-01-31 23:43:03 +00001421 if (sock->file == NULL) {
1422 kernel_sock_shutdown(sock, SHUT_RDWR);
1423 sk_release_kernel(sk);
1424 } else {
1425 inet_shutdown(sock, 2);
1426 }
Tom Parkinf8ccac02013-01-31 23:43:00 +00001427
1428 l2tp_tunnel_sock_put(sk);
James Chapmanfd558d12010-04-02 06:18:33 +00001429}
James Chapmanfd558d12010-04-02 06:18:33 +00001430
James Chapman789a4a22010-04-02 06:19:40 +00001431/* Create a socket for the tunnel, if one isn't set up by
1432 * userspace. This is used for static tunnels where there is no
1433 * managing L2TP daemon.
Tom Parkin167eb172013-01-31 23:43:03 +00001434 *
1435 * Since we don't want these sockets to keep a namespace alive by
1436 * themselves, we drop the socket's namespace refcount after creation.
1437 * These sockets are freed when the namespace exits using the pernet
1438 * exit hook.
James Chapman789a4a22010-04-02 06:19:40 +00001439 */
Tom Parkin167eb172013-01-31 23:43:03 +00001440static int l2tp_tunnel_sock_create(struct net *net,
1441 u32 tunnel_id,
1442 u32 peer_tunnel_id,
1443 struct l2tp_tunnel_cfg *cfg,
1444 struct socket **sockp)
James Chapman789a4a22010-04-02 06:19:40 +00001445{
1446 int err = -EINVAL;
Eric Dumazet7bddd0d2010-04-04 01:02:46 -07001447 struct socket *sock = NULL;
Tom Parkin167eb172013-01-31 23:43:03 +00001448 struct sockaddr_in udp_addr = {0};
1449 struct sockaddr_l2tpip ip_addr = {0};
1450#if IS_ENABLED(CONFIG_IPV6)
1451 struct sockaddr_in6 udp6_addr = {0};
1452 struct sockaddr_l2tpip6 ip6_addr = {0};
1453#endif
James Chapman789a4a22010-04-02 06:19:40 +00001454
1455 switch (cfg->encap) {
1456 case L2TP_ENCAPTYPE_UDP:
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001457#if IS_ENABLED(CONFIG_IPV6)
1458 if (cfg->local_ip6 && cfg->peer_ip6) {
Tom Parkin167eb172013-01-31 23:43:03 +00001459 err = sock_create_kern(AF_INET6, SOCK_DGRAM, 0, &sock);
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001460 if (err < 0)
1461 goto out;
James Chapman789a4a22010-04-02 06:19:40 +00001462
Tom Parkin167eb172013-01-31 23:43:03 +00001463 sk_change_net(sock->sk, net);
James Chapman789a4a22010-04-02 06:19:40 +00001464
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001465 udp6_addr.sin6_family = AF_INET6;
1466 memcpy(&udp6_addr.sin6_addr, cfg->local_ip6,
1467 sizeof(udp6_addr.sin6_addr));
1468 udp6_addr.sin6_port = htons(cfg->local_udp_port);
1469 err = kernel_bind(sock, (struct sockaddr *) &udp6_addr,
1470 sizeof(udp6_addr));
1471 if (err < 0)
1472 goto out;
James Chapman789a4a22010-04-02 06:19:40 +00001473
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001474 udp6_addr.sin6_family = AF_INET6;
1475 memcpy(&udp6_addr.sin6_addr, cfg->peer_ip6,
1476 sizeof(udp6_addr.sin6_addr));
1477 udp6_addr.sin6_port = htons(cfg->peer_udp_port);
1478 err = kernel_connect(sock,
1479 (struct sockaddr *) &udp6_addr,
1480 sizeof(udp6_addr), 0);
1481 if (err < 0)
1482 goto out;
1483 } else
1484#endif
1485 {
Tom Parkin167eb172013-01-31 23:43:03 +00001486 err = sock_create_kern(AF_INET, SOCK_DGRAM, 0, &sock);
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001487 if (err < 0)
1488 goto out;
1489
Tom Parkin167eb172013-01-31 23:43:03 +00001490 sk_change_net(sock->sk, net);
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001491
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001492 udp_addr.sin_family = AF_INET;
1493 udp_addr.sin_addr = cfg->local_ip;
1494 udp_addr.sin_port = htons(cfg->local_udp_port);
1495 err = kernel_bind(sock, (struct sockaddr *) &udp_addr,
1496 sizeof(udp_addr));
1497 if (err < 0)
1498 goto out;
1499
1500 udp_addr.sin_family = AF_INET;
1501 udp_addr.sin_addr = cfg->peer_ip;
1502 udp_addr.sin_port = htons(cfg->peer_udp_port);
1503 err = kernel_connect(sock,
1504 (struct sockaddr *) &udp_addr,
1505 sizeof(udp_addr), 0);
1506 if (err < 0)
1507 goto out;
1508 }
James Chapman789a4a22010-04-02 06:19:40 +00001509
1510 if (!cfg->use_udp_checksums)
1511 sock->sk->sk_no_check = UDP_CSUM_NOXMIT;
1512
1513 break;
1514
1515 case L2TP_ENCAPTYPE_IP:
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001516#if IS_ENABLED(CONFIG_IPV6)
1517 if (cfg->local_ip6 && cfg->peer_ip6) {
Tom Parkin167eb172013-01-31 23:43:03 +00001518 err = sock_create_kern(AF_INET6, SOCK_DGRAM,
1519 IPPROTO_L2TP, &sock);
James Chapman5dac94e2012-04-29 21:48:55 +00001520 if (err < 0)
1521 goto out;
1522
Tom Parkin167eb172013-01-31 23:43:03 +00001523 sk_change_net(sock->sk, net);
James Chapman5dac94e2012-04-29 21:48:55 +00001524
James Chapman5dac94e2012-04-29 21:48:55 +00001525 ip6_addr.l2tp_family = AF_INET6;
1526 memcpy(&ip6_addr.l2tp_addr, cfg->local_ip6,
1527 sizeof(ip6_addr.l2tp_addr));
1528 ip6_addr.l2tp_conn_id = tunnel_id;
1529 err = kernel_bind(sock, (struct sockaddr *) &ip6_addr,
1530 sizeof(ip6_addr));
1531 if (err < 0)
1532 goto out;
1533
1534 ip6_addr.l2tp_family = AF_INET6;
1535 memcpy(&ip6_addr.l2tp_addr, cfg->peer_ip6,
1536 sizeof(ip6_addr.l2tp_addr));
1537 ip6_addr.l2tp_conn_id = peer_tunnel_id;
1538 err = kernel_connect(sock,
1539 (struct sockaddr *) &ip6_addr,
1540 sizeof(ip6_addr), 0);
1541 if (err < 0)
1542 goto out;
1543 } else
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001544#endif
James Chapman5dac94e2012-04-29 21:48:55 +00001545 {
Tom Parkin167eb172013-01-31 23:43:03 +00001546 err = sock_create_kern(AF_INET, SOCK_DGRAM,
1547 IPPROTO_L2TP, &sock);
James Chapman5dac94e2012-04-29 21:48:55 +00001548 if (err < 0)
1549 goto out;
James Chapman789a4a22010-04-02 06:19:40 +00001550
Tom Parkin167eb172013-01-31 23:43:03 +00001551 sk_change_net(sock->sk, net);
James Chapman789a4a22010-04-02 06:19:40 +00001552
James Chapman5dac94e2012-04-29 21:48:55 +00001553 ip_addr.l2tp_family = AF_INET;
1554 ip_addr.l2tp_addr = cfg->local_ip;
1555 ip_addr.l2tp_conn_id = tunnel_id;
1556 err = kernel_bind(sock, (struct sockaddr *) &ip_addr,
1557 sizeof(ip_addr));
1558 if (err < 0)
1559 goto out;
James Chapman789a4a22010-04-02 06:19:40 +00001560
James Chapman5dac94e2012-04-29 21:48:55 +00001561 ip_addr.l2tp_family = AF_INET;
1562 ip_addr.l2tp_addr = cfg->peer_ip;
1563 ip_addr.l2tp_conn_id = peer_tunnel_id;
1564 err = kernel_connect(sock, (struct sockaddr *) &ip_addr,
1565 sizeof(ip_addr), 0);
1566 if (err < 0)
1567 goto out;
1568 }
James Chapman789a4a22010-04-02 06:19:40 +00001569 break;
1570
1571 default:
1572 goto out;
1573 }
1574
1575out:
Tom Parkin167eb172013-01-31 23:43:03 +00001576 *sockp = sock;
James Chapman789a4a22010-04-02 06:19:40 +00001577 if ((err < 0) && sock) {
Tom Parkin167eb172013-01-31 23:43:03 +00001578 kernel_sock_shutdown(sock, SHUT_RDWR);
1579 sk_release_kernel(sock->sk);
James Chapman789a4a22010-04-02 06:19:40 +00001580 *sockp = NULL;
1581 }
1582
1583 return err;
1584}
1585
Eric Dumazet37159ef2012-09-04 07:18:57 +00001586static struct lock_class_key l2tp_socket_class;
1587
James Chapmanfd558d12010-04-02 06:18:33 +00001588int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp)
1589{
1590 struct l2tp_tunnel *tunnel = NULL;
1591 int err;
1592 struct socket *sock = NULL;
1593 struct sock *sk = NULL;
1594 struct l2tp_net *pn;
James Chapman0d767512010-04-02 06:19:00 +00001595 enum l2tp_encap_type encap = L2TP_ENCAPTYPE_UDP;
James Chapmanfd558d12010-04-02 06:18:33 +00001596
1597 /* Get the tunnel socket from the fd, which was opened by
James Chapman789a4a22010-04-02 06:19:40 +00001598 * the userspace L2TP daemon. If not specified, create a
1599 * kernel socket.
James Chapmanfd558d12010-04-02 06:18:33 +00001600 */
James Chapman789a4a22010-04-02 06:19:40 +00001601 if (fd < 0) {
Tom Parkin167eb172013-01-31 23:43:03 +00001602 err = l2tp_tunnel_sock_create(net, tunnel_id, peer_tunnel_id,
1603 cfg, &sock);
James Chapman789a4a22010-04-02 06:19:40 +00001604 if (err < 0)
1605 goto err;
1606 } else {
James Chapman789a4a22010-04-02 06:19:40 +00001607 sock = sockfd_lookup(fd, &err);
1608 if (!sock) {
Tom Parkincbb95e02013-01-31 23:43:02 +00001609 pr_err("tunl %u: sockfd_lookup(fd=%d) returned %d\n",
James Chapman789a4a22010-04-02 06:19:40 +00001610 tunnel_id, fd, err);
Tom Parkincbb95e02013-01-31 23:43:02 +00001611 err = -EBADF;
1612 goto err;
1613 }
1614
1615 /* Reject namespace mismatches */
1616 if (!net_eq(sock_net(sock->sk), net)) {
1617 pr_err("tunl %u: netns mismatch\n", tunnel_id);
1618 err = -EINVAL;
James Chapman789a4a22010-04-02 06:19:40 +00001619 goto err;
1620 }
James Chapmanfd558d12010-04-02 06:18:33 +00001621 }
1622
1623 sk = sock->sk;
1624
James Chapman0d767512010-04-02 06:19:00 +00001625 if (cfg != NULL)
1626 encap = cfg->encap;
1627
James Chapmanfd558d12010-04-02 06:18:33 +00001628 /* Quick sanity checks */
James Chapman0d767512010-04-02 06:19:00 +00001629 switch (encap) {
1630 case L2TP_ENCAPTYPE_UDP:
1631 err = -EPROTONOSUPPORT;
1632 if (sk->sk_protocol != IPPROTO_UDP) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001633 pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
James Chapman0d767512010-04-02 06:19:00 +00001634 tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
1635 goto err;
1636 }
1637 break;
1638 case L2TP_ENCAPTYPE_IP:
1639 err = -EPROTONOSUPPORT;
1640 if (sk->sk_protocol != IPPROTO_L2TP) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001641 pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
James Chapman0d767512010-04-02 06:19:00 +00001642 tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP);
1643 goto err;
1644 }
1645 break;
James Chapmanfd558d12010-04-02 06:18:33 +00001646 }
1647
1648 /* Check if this socket has already been prepped */
1649 tunnel = (struct l2tp_tunnel *)sk->sk_user_data;
1650 if (tunnel != NULL) {
1651 /* This socket has already been prepped */
1652 err = -EBUSY;
1653 goto err;
1654 }
1655
James Chapmanfd558d12010-04-02 06:18:33 +00001656 tunnel = kzalloc(sizeof(struct l2tp_tunnel), GFP_KERNEL);
1657 if (tunnel == NULL) {
1658 err = -ENOMEM;
1659 goto err;
1660 }
1661
1662 tunnel->version = version;
1663 tunnel->tunnel_id = tunnel_id;
1664 tunnel->peer_tunnel_id = peer_tunnel_id;
1665 tunnel->debug = L2TP_DEFAULT_DEBUG_FLAGS;
1666
1667 tunnel->magic = L2TP_TUNNEL_MAGIC;
1668 sprintf(&tunnel->name[0], "tunl %u", tunnel_id);
1669 rwlock_init(&tunnel->hlist_lock);
1670
1671 /* The net we belong to */
1672 tunnel->l2tp_net = net;
1673 pn = l2tp_pernet(net);
1674
James Chapman0d767512010-04-02 06:19:00 +00001675 if (cfg != NULL)
James Chapmanfd558d12010-04-02 06:18:33 +00001676 tunnel->debug = cfg->debug;
1677
1678 /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
James Chapman0d767512010-04-02 06:19:00 +00001679 tunnel->encap = encap;
1680 if (encap == L2TP_ENCAPTYPE_UDP) {
1681 /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
1682 udp_sk(sk)->encap_type = UDP_ENCAP_L2TPINUDP;
1683 udp_sk(sk)->encap_rcv = l2tp_udp_encap_recv;
Tom Parkin9980d002013-03-19 06:11:13 +00001684 udp_sk(sk)->encap_destroy = l2tp_udp_encap_destroy;
Benjamin LaHaised2cf3362012-04-27 08:24:18 +00001685#if IS_ENABLED(CONFIG_IPV6)
1686 if (sk->sk_family == PF_INET6)
1687 udpv6_encap_enable();
1688 else
1689#endif
Eric Dumazet447167b2012-04-11 23:05:28 +00001690 udp_encap_enable();
James Chapman0d767512010-04-02 06:19:00 +00001691 }
James Chapmanfd558d12010-04-02 06:18:33 +00001692
1693 sk->sk_user_data = tunnel;
1694
1695 /* Hook on the tunnel socket destructor so that we can cleanup
1696 * if the tunnel socket goes away.
1697 */
1698 tunnel->old_sk_destruct = sk->sk_destruct;
1699 sk->sk_destruct = &l2tp_tunnel_destruct;
1700 tunnel->sock = sk;
Tom Parkin80d84ef2013-01-22 05:13:48 +00001701 tunnel->fd = fd;
Eric Dumazet37159ef2012-09-04 07:18:57 +00001702 lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock");
1703
James Chapmanfd558d12010-04-02 06:18:33 +00001704 sk->sk_allocation = GFP_ATOMIC;
1705
Tom Parkinf8ccac02013-01-31 23:43:00 +00001706 /* Init delete workqueue struct */
1707 INIT_WORK(&tunnel->del_work, l2tp_tunnel_del_work);
1708
James Chapmanfd558d12010-04-02 06:18:33 +00001709 /* Add tunnel to our list */
1710 INIT_LIST_HEAD(&tunnel->list);
James Chapmanfd558d12010-04-02 06:18:33 +00001711 atomic_inc(&l2tp_tunnel_count);
1712
1713 /* Bump the reference count. The tunnel context is deleted
Eric Dumazet17691922011-05-11 18:22:36 +00001714 * only when this drops to zero. Must be done before list insertion
James Chapmanfd558d12010-04-02 06:18:33 +00001715 */
1716 l2tp_tunnel_inc_refcount(tunnel);
Eric Dumazet17691922011-05-11 18:22:36 +00001717 spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1718 list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
1719 spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
James Chapmanfd558d12010-04-02 06:18:33 +00001720
1721 err = 0;
1722err:
1723 if (tunnelp)
1724 *tunnelp = tunnel;
1725
James Chapman789a4a22010-04-02 06:19:40 +00001726 /* If tunnel's socket was created by the kernel, it doesn't
1727 * have a file.
1728 */
1729 if (sock && sock->file)
James Chapmanfd558d12010-04-02 06:18:33 +00001730 sockfd_put(sock);
1731
1732 return err;
1733}
1734EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
1735
James Chapman309795f2010-04-02 06:19:10 +00001736/* This function is used by the netlink TUNNEL_DELETE command.
1737 */
1738int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
1739{
Tom Parkin2b551c62013-03-19 06:11:16 +00001740 l2tp_tunnel_closeall(tunnel);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001741 return (false == queue_work(l2tp_wq, &tunnel->del_work));
James Chapman309795f2010-04-02 06:19:10 +00001742}
1743EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
1744
James Chapmanfd558d12010-04-02 06:18:33 +00001745/* Really kill the session.
1746 */
1747void l2tp_session_free(struct l2tp_session *session)
1748{
1749 struct l2tp_tunnel *tunnel;
1750
1751 BUG_ON(atomic_read(&session->ref_count) != 0);
1752
1753 tunnel = session->tunnel;
1754 if (tunnel != NULL) {
1755 BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
1756
1757 /* Delete the session from the hash */
1758 write_lock_bh(&tunnel->hlist_lock);
1759 hlist_del_init(&session->hlist);
1760 write_unlock_bh(&tunnel->hlist_lock);
1761
James Chapmanf7faffa2010-04-02 06:18:49 +00001762 /* Unlink from the global hash if not L2TPv2 */
1763 if (tunnel->version != L2TP_HDR_VER_2) {
1764 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1765
James Chapmane02d4942010-04-02 06:19:16 +00001766 spin_lock_bh(&pn->l2tp_session_hlist_lock);
1767 hlist_del_init_rcu(&session->global_hlist);
1768 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
1769 synchronize_rcu();
James Chapmanf7faffa2010-04-02 06:18:49 +00001770 }
1771
James Chapmanfd558d12010-04-02 06:18:33 +00001772 if (session->session_id != 0)
1773 atomic_dec(&l2tp_session_count);
1774
1775 sock_put(tunnel->sock);
1776
1777 /* This will delete the tunnel context if this
1778 * is the last session on the tunnel.
1779 */
1780 session->tunnel = NULL;
1781 l2tp_tunnel_dec_refcount(tunnel);
1782 }
1783
1784 kfree(session);
1785
1786 return;
1787}
1788EXPORT_SYMBOL_GPL(l2tp_session_free);
1789
James Chapman309795f2010-04-02 06:19:10 +00001790/* This function is used by the netlink SESSION_DELETE command and by
1791 pseudowire modules.
1792 */
1793int l2tp_session_delete(struct l2tp_session *session)
1794{
1795 if (session->session_close != NULL)
1796 (*session->session_close)(session);
1797
1798 l2tp_session_dec_refcount(session);
1799
1800 return 0;
1801}
1802EXPORT_SYMBOL_GPL(l2tp_session_delete);
1803
1804
James Chapmanf7faffa2010-04-02 06:18:49 +00001805/* We come here whenever a session's send_seq, cookie_len or
1806 * l2specific_len parameters are set.
1807 */
stephen hemmingerfc130842010-10-21 07:50:46 +00001808static void l2tp_session_set_header_len(struct l2tp_session *session, int version)
James Chapmanf7faffa2010-04-02 06:18:49 +00001809{
1810 if (version == L2TP_HDR_VER_2) {
1811 session->hdr_len = 6;
1812 if (session->send_seq)
1813 session->hdr_len += 4;
1814 } else {
James Chapman0d767512010-04-02 06:19:00 +00001815 session->hdr_len = 4 + session->cookie_len + session->l2specific_len + session->offset;
1816 if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)
1817 session->hdr_len += 4;
James Chapmanf7faffa2010-04-02 06:18:49 +00001818 }
1819
1820}
James Chapmanf7faffa2010-04-02 06:18:49 +00001821
James Chapmanfd558d12010-04-02 06:18:33 +00001822struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
1823{
1824 struct l2tp_session *session;
1825
1826 session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL);
1827 if (session != NULL) {
1828 session->magic = L2TP_SESSION_MAGIC;
1829 session->tunnel = tunnel;
1830
1831 session->session_id = session_id;
1832 session->peer_session_id = peer_session_id;
James Chapmand301e322012-05-09 23:43:09 +00001833 session->nr = 0;
James Chapmanfd558d12010-04-02 06:18:33 +00001834
1835 sprintf(&session->name[0], "sess %u/%u",
1836 tunnel->tunnel_id, session->session_id);
1837
1838 skb_queue_head_init(&session->reorder_q);
1839
1840 INIT_HLIST_NODE(&session->hlist);
James Chapmanf7faffa2010-04-02 06:18:49 +00001841 INIT_HLIST_NODE(&session->global_hlist);
James Chapmanfd558d12010-04-02 06:18:33 +00001842
1843 /* Inherit debug options from tunnel */
1844 session->debug = tunnel->debug;
1845
1846 if (cfg) {
James Chapmanf7faffa2010-04-02 06:18:49 +00001847 session->pwtype = cfg->pw_type;
James Chapmanfd558d12010-04-02 06:18:33 +00001848 session->debug = cfg->debug;
James Chapmanfd558d12010-04-02 06:18:33 +00001849 session->mtu = cfg->mtu;
1850 session->mru = cfg->mru;
1851 session->send_seq = cfg->send_seq;
1852 session->recv_seq = cfg->recv_seq;
1853 session->lns_mode = cfg->lns_mode;
James Chapmanf7faffa2010-04-02 06:18:49 +00001854 session->reorder_timeout = cfg->reorder_timeout;
1855 session->offset = cfg->offset;
1856 session->l2specific_type = cfg->l2specific_type;
1857 session->l2specific_len = cfg->l2specific_len;
1858 session->cookie_len = cfg->cookie_len;
1859 memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);
1860 session->peer_cookie_len = cfg->peer_cookie_len;
1861 memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);
James Chapmanfd558d12010-04-02 06:18:33 +00001862 }
1863
James Chapmanf7faffa2010-04-02 06:18:49 +00001864 if (tunnel->version == L2TP_HDR_VER_2)
1865 session->build_header = l2tp_build_l2tpv2_header;
1866 else
1867 session->build_header = l2tp_build_l2tpv3_header;
1868
1869 l2tp_session_set_header_len(session, tunnel->version);
1870
James Chapmanfd558d12010-04-02 06:18:33 +00001871 /* Bump the reference count. The session context is deleted
1872 * only when this drops to zero.
1873 */
1874 l2tp_session_inc_refcount(session);
1875 l2tp_tunnel_inc_refcount(tunnel);
1876
1877 /* Ensure tunnel socket isn't deleted */
1878 sock_hold(tunnel->sock);
1879
1880 /* Add session to the tunnel's hash list */
1881 write_lock_bh(&tunnel->hlist_lock);
1882 hlist_add_head(&session->hlist,
1883 l2tp_session_id_hash(tunnel, session_id));
1884 write_unlock_bh(&tunnel->hlist_lock);
1885
James Chapmanf7faffa2010-04-02 06:18:49 +00001886 /* And to the global session list if L2TPv3 */
1887 if (tunnel->version != L2TP_HDR_VER_2) {
1888 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1889
James Chapmane02d4942010-04-02 06:19:16 +00001890 spin_lock_bh(&pn->l2tp_session_hlist_lock);
1891 hlist_add_head_rcu(&session->global_hlist,
1892 l2tp_session_id_hash_2(pn, session_id));
1893 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
James Chapmanf7faffa2010-04-02 06:18:49 +00001894 }
1895
James Chapmanfd558d12010-04-02 06:18:33 +00001896 /* Ignore management session in session count value */
1897 if (session->session_id != 0)
1898 atomic_inc(&l2tp_session_count);
1899 }
1900
1901 return session;
1902}
1903EXPORT_SYMBOL_GPL(l2tp_session_create);
1904
1905/*****************************************************************************
1906 * Init and cleanup
1907 *****************************************************************************/
1908
1909static __net_init int l2tp_init_net(struct net *net)
1910{
Jiri Pirkoe773aaf2010-04-23 00:53:39 +00001911 struct l2tp_net *pn = net_generic(net, l2tp_net_id);
James Chapmanf7faffa2010-04-02 06:18:49 +00001912 int hash;
James Chapmanfd558d12010-04-02 06:18:33 +00001913
James Chapmanfd558d12010-04-02 06:18:33 +00001914 INIT_LIST_HEAD(&pn->l2tp_tunnel_list);
James Chapmane02d4942010-04-02 06:19:16 +00001915 spin_lock_init(&pn->l2tp_tunnel_list_lock);
James Chapmanfd558d12010-04-02 06:18:33 +00001916
James Chapmanf7faffa2010-04-02 06:18:49 +00001917 for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
1918 INIT_HLIST_HEAD(&pn->l2tp_session_hlist[hash]);
1919
James Chapmane02d4942010-04-02 06:19:16 +00001920 spin_lock_init(&pn->l2tp_session_hlist_lock);
James Chapmanf7faffa2010-04-02 06:18:49 +00001921
James Chapmanfd558d12010-04-02 06:18:33 +00001922 return 0;
James Chapmanfd558d12010-04-02 06:18:33 +00001923}
1924
Tom Parkin167eb172013-01-31 23:43:03 +00001925static __net_exit void l2tp_exit_net(struct net *net)
1926{
1927 struct l2tp_net *pn = l2tp_pernet(net);
1928 struct l2tp_tunnel *tunnel = NULL;
1929
1930 rcu_read_lock_bh();
1931 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
1932 (void)l2tp_tunnel_delete(tunnel);
1933 }
1934 rcu_read_unlock_bh();
1935}
1936
James Chapmanfd558d12010-04-02 06:18:33 +00001937static struct pernet_operations l2tp_net_ops = {
1938 .init = l2tp_init_net,
Tom Parkin167eb172013-01-31 23:43:03 +00001939 .exit = l2tp_exit_net,
James Chapmanfd558d12010-04-02 06:18:33 +00001940 .id = &l2tp_net_id,
1941 .size = sizeof(struct l2tp_net),
1942};
1943
1944static int __init l2tp_init(void)
1945{
1946 int rc = 0;
1947
1948 rc = register_pernet_device(&l2tp_net_ops);
1949 if (rc)
1950 goto out;
1951
Tom Parkinf8ccac02013-01-31 23:43:00 +00001952 l2tp_wq = alloc_workqueue("l2tp", WQ_NON_REENTRANT | WQ_UNBOUND, 0);
1953 if (!l2tp_wq) {
1954 pr_err("alloc_workqueue failed\n");
1955 rc = -ENOMEM;
1956 goto out;
1957 }
1958
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001959 pr_info("L2TP core driver, %s\n", L2TP_DRV_VERSION);
James Chapmanfd558d12010-04-02 06:18:33 +00001960
1961out:
1962 return rc;
1963}
1964
1965static void __exit l2tp_exit(void)
1966{
1967 unregister_pernet_device(&l2tp_net_ops);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001968 if (l2tp_wq) {
1969 destroy_workqueue(l2tp_wq);
1970 l2tp_wq = NULL;
1971 }
James Chapmanfd558d12010-04-02 06:18:33 +00001972}
1973
1974module_init(l2tp_init);
1975module_exit(l2tp_exit);
1976
1977MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1978MODULE_DESCRIPTION("L2TP core");
1979MODULE_LICENSE("GPL");
1980MODULE_VERSION(L2TP_DRV_VERSION);
1981