blob: f6b090df3930d32dc1fda0c8069ad1f7b3246d41 [file] [log] [blame]
James Chapmanfd558d12010-04-02 06:18:33 +00001/*
2 * L2TP core.
3 *
4 * Copyright (c) 2008,2009,2010 Katalix Systems Ltd
5 *
6 * This file contains some code of the original L2TPv2 pppol2tp
7 * driver, which has the following copyright:
8 *
9 * Authors: Martijn van Oosterhout <kleptog@svana.org>
10 * James Chapman (jchapman@katalix.com)
11 * Contributors:
12 * Michal Ostrowski <mostrows@speakeasy.net>
13 * Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
14 * David S. Miller (davem@redhat.com)
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2 as
18 * published by the Free Software Foundation.
19 */
20
Joe Perchesa4ca44f2012-05-16 09:55:56 +000021#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
22
James Chapmanfd558d12010-04-02 06:18:33 +000023#include <linux/module.h>
24#include <linux/string.h>
25#include <linux/list.h>
James Chapmane02d4942010-04-02 06:19:16 +000026#include <linux/rculist.h>
James Chapmanfd558d12010-04-02 06:18:33 +000027#include <linux/uaccess.h>
28
29#include <linux/kernel.h>
30#include <linux/spinlock.h>
31#include <linux/kthread.h>
32#include <linux/sched.h>
33#include <linux/slab.h>
34#include <linux/errno.h>
35#include <linux/jiffies.h>
36
37#include <linux/netdevice.h>
38#include <linux/net.h>
39#include <linux/inetdevice.h>
40#include <linux/skbuff.h>
41#include <linux/init.h>
James Chapman0d767512010-04-02 06:19:00 +000042#include <linux/in.h>
James Chapmanfd558d12010-04-02 06:18:33 +000043#include <linux/ip.h>
44#include <linux/udp.h>
James Chapman0d767512010-04-02 06:19:00 +000045#include <linux/l2tp.h>
James Chapmanfd558d12010-04-02 06:18:33 +000046#include <linux/hash.h>
47#include <linux/sort.h>
48#include <linux/file.h>
49#include <linux/nsproxy.h>
50#include <net/net_namespace.h>
51#include <net/netns/generic.h>
52#include <net/dst.h>
53#include <net/ip.h>
54#include <net/udp.h>
Tom Herbert85644b42014-07-13 19:49:48 -070055#include <net/udp_tunnel.h>
James Chapman309795f2010-04-02 06:19:10 +000056#include <net/inet_common.h>
James Chapmanfd558d12010-04-02 06:18:33 +000057#include <net/xfrm.h>
James Chapman0d767512010-04-02 06:19:00 +000058#include <net/protocol.h>
Benjamin LaHaised2cf3362012-04-27 08:24:18 +000059#include <net/inet6_connection_sock.h>
60#include <net/inet_ecn.h>
61#include <net/ip6_route.h>
David S. Millerd499bd22012-04-30 13:21:28 -040062#include <net/ip6_checksum.h>
James Chapmanfd558d12010-04-02 06:18:33 +000063
64#include <asm/byteorder.h>
Arun Sharma600634972011-07-26 16:09:06 -070065#include <linux/atomic.h>
James Chapmanfd558d12010-04-02 06:18:33 +000066
67#include "l2tp_core.h"
68
69#define L2TP_DRV_VERSION "V2.0"
70
71/* L2TP header constants */
72#define L2TP_HDRFLAG_T 0x8000
73#define L2TP_HDRFLAG_L 0x4000
74#define L2TP_HDRFLAG_S 0x0800
75#define L2TP_HDRFLAG_O 0x0200
76#define L2TP_HDRFLAG_P 0x0100
77
78#define L2TP_HDR_VER_MASK 0x000F
79#define L2TP_HDR_VER_2 0x0002
James Chapmanf7faffa2010-04-02 06:18:49 +000080#define L2TP_HDR_VER_3 0x0003
James Chapmanfd558d12010-04-02 06:18:33 +000081
82/* L2TPv3 default L2-specific sublayer */
83#define L2TP_SLFLAG_S 0x40000000
84#define L2TP_SL_SEQ_MASK 0x00ffffff
85
86#define L2TP_HDR_SIZE_SEQ 10
87#define L2TP_HDR_SIZE_NOSEQ 6
88
89/* Default trace flags */
90#define L2TP_DEFAULT_DEBUG_FLAGS 0
91
James Chapmanfd558d12010-04-02 06:18:33 +000092/* Private data stored for received packets in the skb.
93 */
94struct l2tp_skb_cb {
James Chapmanf7faffa2010-04-02 06:18:49 +000095 u32 ns;
James Chapmanfd558d12010-04-02 06:18:33 +000096 u16 has_seq;
97 u16 length;
98 unsigned long expires;
99};
100
101#define L2TP_SKB_CB(skb) ((struct l2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])
102
103static atomic_t l2tp_tunnel_count;
104static atomic_t l2tp_session_count;
Tom Parkinf8ccac02013-01-31 23:43:00 +0000105static struct workqueue_struct *l2tp_wq;
James Chapmanfd558d12010-04-02 06:18:33 +0000106
107/* per-net private data for this module */
108static unsigned int l2tp_net_id;
109struct l2tp_net {
110 struct list_head l2tp_tunnel_list;
James Chapmane02d4942010-04-02 06:19:16 +0000111 spinlock_t l2tp_tunnel_list_lock;
James Chapmanf7faffa2010-04-02 06:18:49 +0000112 struct hlist_head l2tp_session_hlist[L2TP_HASH_SIZE_2];
James Chapmane02d4942010-04-02 06:19:16 +0000113 spinlock_t l2tp_session_hlist_lock;
James Chapmanfd558d12010-04-02 06:18:33 +0000114};
115
stephen hemmingerfc130842010-10-21 07:50:46 +0000116static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
stephen hemmingerfc130842010-10-21 07:50:46 +0000117
David S. Miller8d8a51e2013-10-08 15:44:26 -0400118static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk)
119{
120 return sk->sk_user_data;
121}
122
James Chapmanfd558d12010-04-02 06:18:33 +0000123static inline struct l2tp_net *l2tp_pernet(struct net *net)
124{
125 BUG_ON(!net);
126
127 return net_generic(net, l2tp_net_id);
128}
129
stephen hemmingerfc130842010-10-21 07:50:46 +0000130/* Tunnel reference counts. Incremented per session that is added to
131 * the tunnel.
132 */
133static inline void l2tp_tunnel_inc_refcount_1(struct l2tp_tunnel *tunnel)
134{
135 atomic_inc(&tunnel->ref_count);
136}
137
138static inline void l2tp_tunnel_dec_refcount_1(struct l2tp_tunnel *tunnel)
139{
140 if (atomic_dec_and_test(&tunnel->ref_count))
141 l2tp_tunnel_free(tunnel);
142}
143#ifdef L2TP_REFCNT_DEBUG
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000144#define l2tp_tunnel_inc_refcount(_t) \
145do { \
146 pr_debug("l2tp_tunnel_inc_refcount: %s:%d %s: cnt=%d\n", \
147 __func__, __LINE__, (_t)->name, \
148 atomic_read(&_t->ref_count)); \
149 l2tp_tunnel_inc_refcount_1(_t); \
150} while (0)
Andy Zhou29abe2f2014-09-03 13:16:54 -0700151#define l2tp_tunnel_dec_refcount(_t) \
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000152do { \
153 pr_debug("l2tp_tunnel_dec_refcount: %s:%d %s: cnt=%d\n", \
154 __func__, __LINE__, (_t)->name, \
155 atomic_read(&_t->ref_count)); \
156 l2tp_tunnel_dec_refcount_1(_t); \
157} while (0)
stephen hemmingerfc130842010-10-21 07:50:46 +0000158#else
159#define l2tp_tunnel_inc_refcount(t) l2tp_tunnel_inc_refcount_1(t)
160#define l2tp_tunnel_dec_refcount(t) l2tp_tunnel_dec_refcount_1(t)
161#endif
162
James Chapmanf7faffa2010-04-02 06:18:49 +0000163/* Session hash global list for L2TPv3.
164 * The session_id SHOULD be random according to RFC3931, but several
165 * L2TP implementations use incrementing session_ids. So we do a real
166 * hash on the session_id, rather than a simple bitmask.
167 */
168static inline struct hlist_head *
169l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
170{
171 return &pn->l2tp_session_hlist[hash_32(session_id, L2TP_HASH_BITS_2)];
172
173}
174
Tom Parkin80d84ef2013-01-22 05:13:48 +0000175/* Lookup the tunnel socket, possibly involving the fs code if the socket is
176 * owned by userspace. A struct sock returned from this function must be
177 * released using l2tp_tunnel_sock_put once you're done with it.
178 */
stephen hemmingerb5d2b282014-01-09 22:22:27 -0800179static struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel)
Tom Parkin80d84ef2013-01-22 05:13:48 +0000180{
181 int err = 0;
182 struct socket *sock = NULL;
183 struct sock *sk = NULL;
184
185 if (!tunnel)
186 goto out;
187
188 if (tunnel->fd >= 0) {
189 /* Socket is owned by userspace, who might be in the process
190 * of closing it. Look the socket up using the fd to ensure
191 * consistency.
192 */
193 sock = sockfd_lookup(tunnel->fd, &err);
194 if (sock)
195 sk = sock->sk;
196 } else {
197 /* Socket is owned by kernelspace */
198 sk = tunnel->sock;
Tom Parkin8abbbe82013-03-19 06:11:17 +0000199 sock_hold(sk);
Tom Parkin80d84ef2013-01-22 05:13:48 +0000200 }
201
202out:
203 return sk;
204}
Tom Parkin80d84ef2013-01-22 05:13:48 +0000205
206/* Drop a reference to a tunnel socket obtained via. l2tp_tunnel_sock_put */
stephen hemmingerb5d2b282014-01-09 22:22:27 -0800207static void l2tp_tunnel_sock_put(struct sock *sk)
Tom Parkin80d84ef2013-01-22 05:13:48 +0000208{
209 struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
210 if (tunnel) {
211 if (tunnel->fd >= 0) {
212 /* Socket is owned by userspace */
213 sockfd_put(sk->sk_socket);
214 }
215 sock_put(sk);
216 }
Tom Parkin8abbbe82013-03-19 06:11:17 +0000217 sock_put(sk);
Tom Parkin80d84ef2013-01-22 05:13:48 +0000218}
Tom Parkin80d84ef2013-01-22 05:13:48 +0000219
James Chapmanf7faffa2010-04-02 06:18:49 +0000220/* Lookup a session by id in the global session list
221 */
222static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
223{
224 struct l2tp_net *pn = l2tp_pernet(net);
225 struct hlist_head *session_list =
226 l2tp_session_id_hash_2(pn, session_id);
227 struct l2tp_session *session;
James Chapmanf7faffa2010-04-02 06:18:49 +0000228
James Chapmane02d4942010-04-02 06:19:16 +0000229 rcu_read_lock_bh();
Sasha Levinb67bfe02013-02-27 17:06:00 -0800230 hlist_for_each_entry_rcu(session, session_list, global_hlist) {
James Chapmanf7faffa2010-04-02 06:18:49 +0000231 if (session->session_id == session_id) {
James Chapmane02d4942010-04-02 06:19:16 +0000232 rcu_read_unlock_bh();
James Chapmanf7faffa2010-04-02 06:18:49 +0000233 return session;
234 }
235 }
James Chapmane02d4942010-04-02 06:19:16 +0000236 rcu_read_unlock_bh();
James Chapmanf7faffa2010-04-02 06:18:49 +0000237
238 return NULL;
239}
240
James Chapmanfd558d12010-04-02 06:18:33 +0000241/* Session hash list.
242 * The session_id SHOULD be random according to RFC2661, but several
243 * L2TP implementations (Cisco and Microsoft) use incrementing
244 * session_ids. So we do a real hash on the session_id, rather than a
245 * simple bitmask.
246 */
247static inline struct hlist_head *
248l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id)
249{
250 return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)];
251}
252
253/* Lookup a session by id
254 */
James Chapmanf7faffa2010-04-02 06:18:49 +0000255struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id)
James Chapmanfd558d12010-04-02 06:18:33 +0000256{
James Chapmanf7faffa2010-04-02 06:18:49 +0000257 struct hlist_head *session_list;
James Chapmanfd558d12010-04-02 06:18:33 +0000258 struct l2tp_session *session;
James Chapmanfd558d12010-04-02 06:18:33 +0000259
James Chapmanf7faffa2010-04-02 06:18:49 +0000260 /* In L2TPv3, session_ids are unique over all tunnels and we
261 * sometimes need to look them up before we know the
262 * tunnel.
263 */
264 if (tunnel == NULL)
265 return l2tp_session_find_2(net, session_id);
266
267 session_list = l2tp_session_id_hash(tunnel, session_id);
James Chapmanfd558d12010-04-02 06:18:33 +0000268 read_lock_bh(&tunnel->hlist_lock);
Sasha Levinb67bfe02013-02-27 17:06:00 -0800269 hlist_for_each_entry(session, session_list, hlist) {
James Chapmanfd558d12010-04-02 06:18:33 +0000270 if (session->session_id == session_id) {
271 read_unlock_bh(&tunnel->hlist_lock);
272 return session;
273 }
274 }
275 read_unlock_bh(&tunnel->hlist_lock);
276
277 return NULL;
278}
279EXPORT_SYMBOL_GPL(l2tp_session_find);
280
281struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
282{
283 int hash;
James Chapmanfd558d12010-04-02 06:18:33 +0000284 struct l2tp_session *session;
285 int count = 0;
286
287 read_lock_bh(&tunnel->hlist_lock);
288 for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
Sasha Levinb67bfe02013-02-27 17:06:00 -0800289 hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {
James Chapmanfd558d12010-04-02 06:18:33 +0000290 if (++count > nth) {
291 read_unlock_bh(&tunnel->hlist_lock);
292 return session;
293 }
294 }
295 }
296
297 read_unlock_bh(&tunnel->hlist_lock);
298
299 return NULL;
300}
301EXPORT_SYMBOL_GPL(l2tp_session_find_nth);
302
James Chapman309795f2010-04-02 06:19:10 +0000303/* Lookup a session by interface name.
304 * This is very inefficient but is only used by management interfaces.
305 */
306struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname)
307{
308 struct l2tp_net *pn = l2tp_pernet(net);
309 int hash;
James Chapman309795f2010-04-02 06:19:10 +0000310 struct l2tp_session *session;
311
James Chapmane02d4942010-04-02 06:19:16 +0000312 rcu_read_lock_bh();
James Chapman309795f2010-04-02 06:19:10 +0000313 for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) {
Sasha Levinb67bfe02013-02-27 17:06:00 -0800314 hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {
James Chapman309795f2010-04-02 06:19:10 +0000315 if (!strcmp(session->ifname, ifname)) {
James Chapmane02d4942010-04-02 06:19:16 +0000316 rcu_read_unlock_bh();
James Chapman309795f2010-04-02 06:19:10 +0000317 return session;
318 }
319 }
320 }
321
James Chapmane02d4942010-04-02 06:19:16 +0000322 rcu_read_unlock_bh();
James Chapman309795f2010-04-02 06:19:10 +0000323
324 return NULL;
325}
326EXPORT_SYMBOL_GPL(l2tp_session_find_by_ifname);
327
James Chapmanfd558d12010-04-02 06:18:33 +0000328/* Lookup a tunnel by id
329 */
330struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id)
331{
332 struct l2tp_tunnel *tunnel;
333 struct l2tp_net *pn = l2tp_pernet(net);
334
James Chapmane02d4942010-04-02 06:19:16 +0000335 rcu_read_lock_bh();
336 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
James Chapmanfd558d12010-04-02 06:18:33 +0000337 if (tunnel->tunnel_id == tunnel_id) {
James Chapmane02d4942010-04-02 06:19:16 +0000338 rcu_read_unlock_bh();
James Chapmanfd558d12010-04-02 06:18:33 +0000339 return tunnel;
340 }
341 }
James Chapmane02d4942010-04-02 06:19:16 +0000342 rcu_read_unlock_bh();
James Chapmanfd558d12010-04-02 06:18:33 +0000343
344 return NULL;
345}
346EXPORT_SYMBOL_GPL(l2tp_tunnel_find);
347
348struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth)
349{
350 struct l2tp_net *pn = l2tp_pernet(net);
351 struct l2tp_tunnel *tunnel;
352 int count = 0;
353
James Chapmane02d4942010-04-02 06:19:16 +0000354 rcu_read_lock_bh();
355 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
James Chapmanfd558d12010-04-02 06:18:33 +0000356 if (++count > nth) {
James Chapmane02d4942010-04-02 06:19:16 +0000357 rcu_read_unlock_bh();
James Chapmanfd558d12010-04-02 06:18:33 +0000358 return tunnel;
359 }
360 }
361
James Chapmane02d4942010-04-02 06:19:16 +0000362 rcu_read_unlock_bh();
James Chapmanfd558d12010-04-02 06:18:33 +0000363
364 return NULL;
365}
366EXPORT_SYMBOL_GPL(l2tp_tunnel_find_nth);
367
368/*****************************************************************************
369 * Receive data handling
370 *****************************************************************************/
371
372/* Queue a skb in order. We come here only if the skb has an L2TP sequence
373 * number.
374 */
375static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)
376{
377 struct sk_buff *skbp;
378 struct sk_buff *tmp;
James Chapmanf7faffa2010-04-02 06:18:49 +0000379 u32 ns = L2TP_SKB_CB(skb)->ns;
James Chapmanfd558d12010-04-02 06:18:33 +0000380
381 spin_lock_bh(&session->reorder_q.lock);
382 skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
383 if (L2TP_SKB_CB(skbp)->ns > ns) {
384 __skb_queue_before(&session->reorder_q, skbp, skb);
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000385 l2tp_dbg(session, L2TP_MSG_SEQ,
386 "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
387 session->name, ns, L2TP_SKB_CB(skbp)->ns,
388 skb_queue_len(&session->reorder_q));
Tom Parkin7b7c0712013-03-19 06:11:22 +0000389 atomic_long_inc(&session->stats.rx_oos_packets);
James Chapmanfd558d12010-04-02 06:18:33 +0000390 goto out;
391 }
392 }
393
394 __skb_queue_tail(&session->reorder_q, skb);
395
396out:
397 spin_unlock_bh(&session->reorder_q.lock);
398}
399
400/* Dequeue a single skb.
401 */
402static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)
403{
404 struct l2tp_tunnel *tunnel = session->tunnel;
405 int length = L2TP_SKB_CB(skb)->length;
406
407 /* We're about to requeue the skb, so return resources
408 * to its current owner (a socket receive buffer).
409 */
410 skb_orphan(skb);
411
Tom Parkin7b7c0712013-03-19 06:11:22 +0000412 atomic_long_inc(&tunnel->stats.rx_packets);
413 atomic_long_add(length, &tunnel->stats.rx_bytes);
414 atomic_long_inc(&session->stats.rx_packets);
415 atomic_long_add(length, &session->stats.rx_bytes);
James Chapmanfd558d12010-04-02 06:18:33 +0000416
417 if (L2TP_SKB_CB(skb)->has_seq) {
418 /* Bump our Nr */
419 session->nr++;
James Chapman8a1631d2013-07-02 20:28:59 +0100420 session->nr &= session->nr_max;
James Chapmanf7faffa2010-04-02 06:18:49 +0000421
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000422 l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated nr to %hu\n",
423 session->name, session->nr);
James Chapmanfd558d12010-04-02 06:18:33 +0000424 }
425
426 /* call private receive handler */
427 if (session->recv_skb != NULL)
428 (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);
429 else
430 kfree_skb(skb);
431
432 if (session->deref)
433 (*session->deref)(session);
434}
435
436/* Dequeue skbs from the session's reorder_q, subject to packet order.
437 * Skbs that have been in the queue for too long are simply discarded.
438 */
439static void l2tp_recv_dequeue(struct l2tp_session *session)
440{
441 struct sk_buff *skb;
442 struct sk_buff *tmp;
443
444 /* If the pkt at the head of the queue has the nr that we
445 * expect to send up next, dequeue it and any other
446 * in-sequence packets behind it.
447 */
Eric Dumazete2e210c2011-11-02 22:47:44 +0000448start:
James Chapmanfd558d12010-04-02 06:18:33 +0000449 spin_lock_bh(&session->reorder_q.lock);
450 skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
451 if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) {
Tom Parkin7b7c0712013-03-19 06:11:22 +0000452 atomic_long_inc(&session->stats.rx_seq_discards);
453 atomic_long_inc(&session->stats.rx_errors);
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000454 l2tp_dbg(session, L2TP_MSG_SEQ,
455 "%s: oos pkt %u len %d discarded (too old), waiting for %u, reorder_q_len=%d\n",
456 session->name, L2TP_SKB_CB(skb)->ns,
457 L2TP_SKB_CB(skb)->length, session->nr,
458 skb_queue_len(&session->reorder_q));
James Chapman38d40b32012-05-09 23:43:08 +0000459 session->reorder_skip = 1;
James Chapmanfd558d12010-04-02 06:18:33 +0000460 __skb_unlink(skb, &session->reorder_q);
461 kfree_skb(skb);
462 if (session->deref)
463 (*session->deref)(session);
464 continue;
465 }
466
467 if (L2TP_SKB_CB(skb)->has_seq) {
James Chapman38d40b32012-05-09 23:43:08 +0000468 if (session->reorder_skip) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000469 l2tp_dbg(session, L2TP_MSG_SEQ,
470 "%s: advancing nr to next pkt: %u -> %u",
471 session->name, session->nr,
472 L2TP_SKB_CB(skb)->ns);
James Chapman38d40b32012-05-09 23:43:08 +0000473 session->reorder_skip = 0;
474 session->nr = L2TP_SKB_CB(skb)->ns;
475 }
James Chapmanfd558d12010-04-02 06:18:33 +0000476 if (L2TP_SKB_CB(skb)->ns != session->nr) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000477 l2tp_dbg(session, L2TP_MSG_SEQ,
478 "%s: holding oos pkt %u len %d, waiting for %u, reorder_q_len=%d\n",
479 session->name, L2TP_SKB_CB(skb)->ns,
480 L2TP_SKB_CB(skb)->length, session->nr,
481 skb_queue_len(&session->reorder_q));
James Chapmanfd558d12010-04-02 06:18:33 +0000482 goto out;
483 }
484 }
485 __skb_unlink(skb, &session->reorder_q);
486
487 /* Process the skb. We release the queue lock while we
488 * do so to let other contexts process the queue.
489 */
490 spin_unlock_bh(&session->reorder_q.lock);
491 l2tp_recv_dequeue_skb(session, skb);
Eric Dumazete2e210c2011-11-02 22:47:44 +0000492 goto start;
James Chapmanfd558d12010-04-02 06:18:33 +0000493 }
494
495out:
496 spin_unlock_bh(&session->reorder_q.lock);
497}
498
James Chapman8a1631d2013-07-02 20:28:59 +0100499static int l2tp_seq_check_rx_window(struct l2tp_session *session, u32 nr)
500{
501 u32 nws;
502
503 if (nr >= session->nr)
504 nws = nr - session->nr;
505 else
506 nws = (session->nr_max + 1) - (session->nr - nr);
507
508 return nws < session->nr_window_size;
509}
510
James Chapmanb6dc01a2013-07-02 20:28:58 +0100511/* If packet has sequence numbers, queue it if acceptable. Returns 0 if
512 * acceptable, else non-zero.
513 */
514static int l2tp_recv_data_seq(struct l2tp_session *session, struct sk_buff *skb)
515{
James Chapman8a1631d2013-07-02 20:28:59 +0100516 if (!l2tp_seq_check_rx_window(session, L2TP_SKB_CB(skb)->ns)) {
517 /* Packet sequence number is outside allowed window.
518 * Discard it.
519 */
520 l2tp_dbg(session, L2TP_MSG_SEQ,
521 "%s: pkt %u len %d discarded, outside window, nr=%u\n",
522 session->name, L2TP_SKB_CB(skb)->ns,
523 L2TP_SKB_CB(skb)->length, session->nr);
524 goto discard;
525 }
526
James Chapmanb6dc01a2013-07-02 20:28:58 +0100527 if (session->reorder_timeout != 0) {
528 /* Packet reordering enabled. Add skb to session's
529 * reorder queue, in order of ns.
530 */
531 l2tp_recv_queue_skb(session, skb);
James Chapmana0dbd822013-07-02 20:29:00 +0100532 goto out;
533 }
534
535 /* Packet reordering disabled. Discard out-of-sequence packets, while
536 * tracking the number if in-sequence packets after the first OOS packet
537 * is seen. After nr_oos_count_max in-sequence packets, reset the
538 * sequence number to re-enable packet reception.
539 */
540 if (L2TP_SKB_CB(skb)->ns == session->nr) {
541 skb_queue_tail(&session->reorder_q, skb);
James Chapmanb6dc01a2013-07-02 20:28:58 +0100542 } else {
James Chapmana0dbd822013-07-02 20:29:00 +0100543 u32 nr_oos = L2TP_SKB_CB(skb)->ns;
544 u32 nr_next = (session->nr_oos + 1) & session->nr_max;
545
546 if (nr_oos == nr_next)
547 session->nr_oos_count++;
548 else
549 session->nr_oos_count = 0;
550
551 session->nr_oos = nr_oos;
552 if (session->nr_oos_count > session->nr_oos_count_max) {
553 session->reorder_skip = 1;
554 l2tp_dbg(session, L2TP_MSG_SEQ,
555 "%s: %d oos packets received. Resetting sequence numbers\n",
556 session->name, session->nr_oos_count);
557 }
558 if (!session->reorder_skip) {
James Chapmanb6dc01a2013-07-02 20:28:58 +0100559 atomic_long_inc(&session->stats.rx_seq_discards);
560 l2tp_dbg(session, L2TP_MSG_SEQ,
561 "%s: oos pkt %u len %d discarded, waiting for %u, reorder_q_len=%d\n",
562 session->name, L2TP_SKB_CB(skb)->ns,
563 L2TP_SKB_CB(skb)->length, session->nr,
564 skb_queue_len(&session->reorder_q));
565 goto discard;
566 }
567 skb_queue_tail(&session->reorder_q, skb);
568 }
569
James Chapmana0dbd822013-07-02 20:29:00 +0100570out:
James Chapmanb6dc01a2013-07-02 20:28:58 +0100571 return 0;
572
573discard:
574 return 1;
575}
576
James Chapmanf7faffa2010-04-02 06:18:49 +0000577/* Do receive processing of L2TP data frames. We handle both L2TPv2
578 * and L2TPv3 data frames here.
579 *
580 * L2TPv2 Data Message Header
581 *
582 * 0 1 2 3
583 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
584 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
585 * |T|L|x|x|S|x|O|P|x|x|x|x| Ver | Length (opt) |
586 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
587 * | Tunnel ID | Session ID |
588 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
589 * | Ns (opt) | Nr (opt) |
590 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
591 * | Offset Size (opt) | Offset pad... (opt)
592 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
593 *
594 * Data frames are marked by T=0. All other fields are the same as
595 * those in L2TP control frames.
596 *
597 * L2TPv3 Data Message Header
598 *
599 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
600 * | L2TP Session Header |
601 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
602 * | L2-Specific Sublayer |
603 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
604 * | Tunnel Payload ...
605 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
606 *
607 * L2TPv3 Session Header Over IP
608 *
609 * 0 1 2 3
610 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
611 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
612 * | Session ID |
613 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
614 * | Cookie (optional, maximum 64 bits)...
615 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
616 * |
617 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
618 *
619 * L2TPv3 L2-Specific Sublayer Format
620 *
621 * 0 1 2 3
622 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
623 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
624 * |x|S|x|x|x|x|x|x| Sequence Number |
625 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
626 *
627 * Cookie value, sublayer format and offset (pad) are negotiated with
628 * the peer when the session is set up. Unlike L2TPv2, we do not need
629 * to parse the packet header to determine if optional fields are
630 * present.
631 *
632 * Caller must already have parsed the frame and determined that it is
633 * a data (not control) frame before coming here. Fields up to the
634 * session-id have already been parsed and ptr points to the data
635 * after the session-id.
James Chapmanfd558d12010-04-02 06:18:33 +0000636 */
James Chapmanf7faffa2010-04-02 06:18:49 +0000637void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
638 unsigned char *ptr, unsigned char *optr, u16 hdrflags,
639 int length, int (*payload_hook)(struct sk_buff *skb))
James Chapmanfd558d12010-04-02 06:18:33 +0000640{
James Chapmanf7faffa2010-04-02 06:18:49 +0000641 struct l2tp_tunnel *tunnel = session->tunnel;
James Chapmanfd558d12010-04-02 06:18:33 +0000642 int offset;
James Chapmanf7faffa2010-04-02 06:18:49 +0000643 u32 ns, nr;
James Chapmanfd558d12010-04-02 06:18:33 +0000644
645 /* The ref count is increased since we now hold a pointer to
646 * the session. Take care to decrement the refcnt when exiting
647 * this function from now on...
648 */
649 l2tp_session_inc_refcount(session);
650 if (session->ref)
651 (*session->ref)(session);
652
James Chapmanf7faffa2010-04-02 06:18:49 +0000653 /* Parse and check optional cookie */
654 if (session->peer_cookie_len > 0) {
655 if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000656 l2tp_info(tunnel, L2TP_MSG_DATA,
657 "%s: cookie mismatch (%u/%u). Discarding.\n",
658 tunnel->name, tunnel->tunnel_id,
659 session->session_id);
Tom Parkin7b7c0712013-03-19 06:11:22 +0000660 atomic_long_inc(&session->stats.rx_cookie_discards);
James Chapmanf7faffa2010-04-02 06:18:49 +0000661 goto discard;
662 }
663 ptr += session->peer_cookie_len;
664 }
665
James Chapmanfd558d12010-04-02 06:18:33 +0000666 /* Handle the optional sequence numbers. Sequence numbers are
667 * in different places for L2TPv2 and L2TPv3.
668 *
669 * If we are the LAC, enable/disable sequence numbers under
670 * the control of the LNS. If no sequence numbers present but
671 * we were expecting them, discard frame.
672 */
673 ns = nr = 0;
674 L2TP_SKB_CB(skb)->has_seq = 0;
James Chapmanf7faffa2010-04-02 06:18:49 +0000675 if (tunnel->version == L2TP_HDR_VER_2) {
676 if (hdrflags & L2TP_HDRFLAG_S) {
677 ns = ntohs(*(__be16 *) ptr);
678 ptr += 2;
679 nr = ntohs(*(__be16 *) ptr);
680 ptr += 2;
James Chapmanfd558d12010-04-02 06:18:33 +0000681
James Chapmanf7faffa2010-04-02 06:18:49 +0000682 /* Store L2TP info in the skb */
683 L2TP_SKB_CB(skb)->ns = ns;
684 L2TP_SKB_CB(skb)->has_seq = 1;
James Chapmanfd558d12010-04-02 06:18:33 +0000685
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000686 l2tp_dbg(session, L2TP_MSG_SEQ,
687 "%s: recv data ns=%u, nr=%u, session nr=%u\n",
688 session->name, ns, nr, session->nr);
James Chapmanf7faffa2010-04-02 06:18:49 +0000689 }
690 } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
691 u32 l2h = ntohl(*(__be32 *) ptr);
692
693 if (l2h & 0x40000000) {
694 ns = l2h & 0x00ffffff;
695
696 /* Store L2TP info in the skb */
697 L2TP_SKB_CB(skb)->ns = ns;
698 L2TP_SKB_CB(skb)->has_seq = 1;
699
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000700 l2tp_dbg(session, L2TP_MSG_SEQ,
701 "%s: recv data ns=%u, session nr=%u\n",
702 session->name, ns, session->nr);
James Chapmanf7faffa2010-04-02 06:18:49 +0000703 }
James Chapmanfd558d12010-04-02 06:18:33 +0000704 }
705
James Chapmanf7faffa2010-04-02 06:18:49 +0000706 /* Advance past L2-specific header, if present */
707 ptr += session->l2specific_len;
708
James Chapmanfd558d12010-04-02 06:18:33 +0000709 if (L2TP_SKB_CB(skb)->has_seq) {
710 /* Received a packet with sequence numbers. If we're the LNS,
711 * check if we sre sending sequence numbers and if not,
712 * configure it so.
713 */
714 if ((!session->lns_mode) && (!session->send_seq)) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000715 l2tp_info(session, L2TP_MSG_SEQ,
716 "%s: requested to enable seq numbers by LNS\n",
717 session->name);
James Chapmanfd558d12010-04-02 06:18:33 +0000718 session->send_seq = -1;
James Chapmanf7faffa2010-04-02 06:18:49 +0000719 l2tp_session_set_header_len(session, tunnel->version);
James Chapmanfd558d12010-04-02 06:18:33 +0000720 }
721 } else {
722 /* No sequence numbers.
723 * If user has configured mandatory sequence numbers, discard.
724 */
725 if (session->recv_seq) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000726 l2tp_warn(session, L2TP_MSG_SEQ,
727 "%s: recv data has no seq numbers when required. Discarding.\n",
728 session->name);
Tom Parkin7b7c0712013-03-19 06:11:22 +0000729 atomic_long_inc(&session->stats.rx_seq_discards);
James Chapmanfd558d12010-04-02 06:18:33 +0000730 goto discard;
731 }
732
733 /* If we're the LAC and we're sending sequence numbers, the
734 * LNS has requested that we no longer send sequence numbers.
735 * If we're the LNS and we're sending sequence numbers, the
736 * LAC is broken. Discard the frame.
737 */
738 if ((!session->lns_mode) && (session->send_seq)) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000739 l2tp_info(session, L2TP_MSG_SEQ,
740 "%s: requested to disable seq numbers by LNS\n",
741 session->name);
James Chapmanfd558d12010-04-02 06:18:33 +0000742 session->send_seq = 0;
James Chapmanf7faffa2010-04-02 06:18:49 +0000743 l2tp_session_set_header_len(session, tunnel->version);
James Chapmanfd558d12010-04-02 06:18:33 +0000744 } else if (session->send_seq) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000745 l2tp_warn(session, L2TP_MSG_SEQ,
746 "%s: recv data has no seq numbers when required. Discarding.\n",
747 session->name);
Tom Parkin7b7c0712013-03-19 06:11:22 +0000748 atomic_long_inc(&session->stats.rx_seq_discards);
James Chapmanfd558d12010-04-02 06:18:33 +0000749 goto discard;
750 }
751 }
752
James Chapmanf7faffa2010-04-02 06:18:49 +0000753 /* Session data offset is handled differently for L2TPv2 and
754 * L2TPv3. For L2TPv2, there is an optional 16-bit value in
755 * the header. For L2TPv3, the offset is negotiated using AVPs
756 * in the session setup control protocol.
757 */
758 if (tunnel->version == L2TP_HDR_VER_2) {
759 /* If offset bit set, skip it. */
760 if (hdrflags & L2TP_HDRFLAG_O) {
761 offset = ntohs(*(__be16 *)ptr);
762 ptr += 2 + offset;
763 }
764 } else
765 ptr += session->offset;
James Chapmanfd558d12010-04-02 06:18:33 +0000766
767 offset = ptr - optr;
768 if (!pskb_may_pull(skb, offset))
769 goto discard;
770
771 __skb_pull(skb, offset);
772
773 /* If caller wants to process the payload before we queue the
774 * packet, do so now.
775 */
776 if (payload_hook)
777 if ((*payload_hook)(skb))
778 goto discard;
779
780 /* Prepare skb for adding to the session's reorder_q. Hold
781 * packets for max reorder_timeout or 1 second if not
782 * reordering.
783 */
784 L2TP_SKB_CB(skb)->length = length;
785 L2TP_SKB_CB(skb)->expires = jiffies +
786 (session->reorder_timeout ? session->reorder_timeout : HZ);
787
788 /* Add packet to the session's receive queue. Reordering is done here, if
789 * enabled. Saved L2TP protocol info is stored in skb->sb[].
790 */
791 if (L2TP_SKB_CB(skb)->has_seq) {
James Chapmanb6dc01a2013-07-02 20:28:58 +0100792 if (l2tp_recv_data_seq(session, skb))
793 goto discard;
James Chapmanfd558d12010-04-02 06:18:33 +0000794 } else {
795 /* No sequence numbers. Add the skb to the tail of the
796 * reorder queue. This ensures that it will be
797 * delivered after all previous sequenced skbs.
798 */
799 skb_queue_tail(&session->reorder_q, skb);
800 }
801
802 /* Try to dequeue as many skbs from reorder_q as we can. */
803 l2tp_recv_dequeue(session);
804
805 l2tp_session_dec_refcount(session);
806
James Chapmanf7faffa2010-04-02 06:18:49 +0000807 return;
James Chapmanfd558d12010-04-02 06:18:33 +0000808
809discard:
Tom Parkin7b7c0712013-03-19 06:11:22 +0000810 atomic_long_inc(&session->stats.rx_errors);
James Chapmanfd558d12010-04-02 06:18:33 +0000811 kfree_skb(skb);
812
813 if (session->deref)
814 (*session->deref)(session);
815
816 l2tp_session_dec_refcount(session);
James Chapmanf7faffa2010-04-02 06:18:49 +0000817}
818EXPORT_SYMBOL(l2tp_recv_common);
819
Tom Parkin48f72f92013-03-19 06:11:19 +0000820/* Drop skbs from the session's reorder_q
821 */
822int l2tp_session_queue_purge(struct l2tp_session *session)
823{
824 struct sk_buff *skb = NULL;
825 BUG_ON(!session);
826 BUG_ON(session->magic != L2TP_SESSION_MAGIC);
827 while ((skb = skb_dequeue(&session->reorder_q))) {
828 atomic_long_inc(&session->stats.rx_errors);
829 kfree_skb(skb);
830 if (session->deref)
831 (*session->deref)(session);
832 }
833 return 0;
834}
835EXPORT_SYMBOL_GPL(l2tp_session_queue_purge);
836
James Chapmanf7faffa2010-04-02 06:18:49 +0000837/* Internal UDP receive frame. Do the real work of receiving an L2TP data frame
838 * here. The skb is not on a list when we get here.
839 * Returns 0 if the packet was a data packet and was successfully passed on.
840 * Returns 1 if the packet was not a good data packet and could not be
841 * forwarded. All such packets are passed up to userspace to deal with.
842 */
stephen hemmingerfc130842010-10-21 07:50:46 +0000843static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
844 int (*payload_hook)(struct sk_buff *skb))
James Chapmanf7faffa2010-04-02 06:18:49 +0000845{
846 struct l2tp_session *session = NULL;
847 unsigned char *ptr, *optr;
848 u16 hdrflags;
849 u32 tunnel_id, session_id;
James Chapmanf7faffa2010-04-02 06:18:49 +0000850 u16 version;
851 int length;
852
Tom Herbert58d60852014-05-07 16:52:48 -0700853 /* UDP has verifed checksum */
James Chapmanf7faffa2010-04-02 06:18:49 +0000854
855 /* UDP always verifies the packet length. */
856 __skb_pull(skb, sizeof(struct udphdr));
857
858 /* Short packet? */
859 if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000860 l2tp_info(tunnel, L2TP_MSG_DATA,
861 "%s: recv short packet (len=%d)\n",
862 tunnel->name, skb->len);
James Chapmanf7faffa2010-04-02 06:18:49 +0000863 goto error;
864 }
865
James Chapmanf7faffa2010-04-02 06:18:49 +0000866 /* Trace packet contents, if enabled */
867 if (tunnel->debug & L2TP_MSG_DATA) {
868 length = min(32u, skb->len);
869 if (!pskb_may_pull(skb, length))
870 goto error;
871
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000872 pr_debug("%s: recv\n", tunnel->name);
873 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length);
James Chapmanf7faffa2010-04-02 06:18:49 +0000874 }
875
Eric Dumazete50e7052011-11-08 13:59:44 -0500876 /* Point to L2TP header */
877 optr = ptr = skb->data;
878
James Chapmanf7faffa2010-04-02 06:18:49 +0000879 /* Get L2TP header flags */
880 hdrflags = ntohs(*(__be16 *) ptr);
881
882 /* Check protocol version */
883 version = hdrflags & L2TP_HDR_VER_MASK;
884 if (version != tunnel->version) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000885 l2tp_info(tunnel, L2TP_MSG_DATA,
886 "%s: recv protocol version mismatch: got %d expected %d\n",
887 tunnel->name, version, tunnel->version);
James Chapmanf7faffa2010-04-02 06:18:49 +0000888 goto error;
889 }
890
891 /* Get length of L2TP packet */
892 length = skb->len;
893
894 /* If type is control packet, it is handled by userspace. */
895 if (hdrflags & L2TP_HDRFLAG_T) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000896 l2tp_dbg(tunnel, L2TP_MSG_DATA,
897 "%s: recv control packet, len=%d\n",
898 tunnel->name, length);
James Chapmanf7faffa2010-04-02 06:18:49 +0000899 goto error;
900 }
901
902 /* Skip flags */
903 ptr += 2;
904
905 if (tunnel->version == L2TP_HDR_VER_2) {
906 /* If length is present, skip it */
907 if (hdrflags & L2TP_HDRFLAG_L)
908 ptr += 2;
909
910 /* Extract tunnel and session ID */
911 tunnel_id = ntohs(*(__be16 *) ptr);
912 ptr += 2;
913 session_id = ntohs(*(__be16 *) ptr);
914 ptr += 2;
915 } else {
916 ptr += 2; /* skip reserved bits */
917 tunnel_id = tunnel->tunnel_id;
918 session_id = ntohl(*(__be32 *) ptr);
919 ptr += 4;
920 }
921
922 /* Find the session context */
923 session = l2tp_session_find(tunnel->l2tp_net, tunnel, session_id);
James Chapman309795f2010-04-02 06:19:10 +0000924 if (!session || !session->recv_skb) {
James Chapmanf7faffa2010-04-02 06:18:49 +0000925 /* Not found? Pass to userspace to deal with */
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000926 l2tp_info(tunnel, L2TP_MSG_DATA,
927 "%s: no session found (%u/%u). Passing up.\n",
928 tunnel->name, tunnel_id, session_id);
James Chapmanf7faffa2010-04-02 06:18:49 +0000929 goto error;
930 }
931
932 l2tp_recv_common(session, skb, ptr, optr, hdrflags, length, payload_hook);
James Chapmanfd558d12010-04-02 06:18:33 +0000933
934 return 0;
935
James Chapmanfd558d12010-04-02 06:18:33 +0000936error:
937 /* Put UDP header back */
938 __skb_push(skb, sizeof(struct udphdr));
939
940 return 1;
941}
James Chapmanfd558d12010-04-02 06:18:33 +0000942
943/* UDP encapsulation receive handler. See net/ipv4/udp.c.
944 * Return codes:
945 * 0 : success.
946 * <0: error
947 * >0: skb should be passed up to userspace as UDP.
948 */
949int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
950{
951 struct l2tp_tunnel *tunnel;
952
953 tunnel = l2tp_sock_to_tunnel(sk);
954 if (tunnel == NULL)
955 goto pass_up;
956
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000957 l2tp_dbg(tunnel, L2TP_MSG_DATA, "%s: received %d bytes\n",
958 tunnel->name, skb->len);
James Chapmanfd558d12010-04-02 06:18:33 +0000959
960 if (l2tp_udp_recv_core(tunnel, skb, tunnel->recv_payload_hook))
961 goto pass_up_put;
962
963 sock_put(sk);
964 return 0;
965
966pass_up_put:
967 sock_put(sk);
968pass_up:
969 return 1;
970}
971EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv);
972
973/************************************************************************
974 * Transmit handling
975 ***********************************************************************/
976
977/* Build an L2TP header for the session into the buffer provided.
978 */
James Chapmanf7faffa2010-04-02 06:18:49 +0000979static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
James Chapmanfd558d12010-04-02 06:18:33 +0000980{
James Chapmanf7faffa2010-04-02 06:18:49 +0000981 struct l2tp_tunnel *tunnel = session->tunnel;
James Chapmanfd558d12010-04-02 06:18:33 +0000982 __be16 *bufp = buf;
James Chapmanf7faffa2010-04-02 06:18:49 +0000983 __be16 *optr = buf;
James Chapmanfd558d12010-04-02 06:18:33 +0000984 u16 flags = L2TP_HDR_VER_2;
985 u32 tunnel_id = tunnel->peer_tunnel_id;
986 u32 session_id = session->peer_session_id;
987
988 if (session->send_seq)
989 flags |= L2TP_HDRFLAG_S;
990
991 /* Setup L2TP header. */
992 *bufp++ = htons(flags);
993 *bufp++ = htons(tunnel_id);
994 *bufp++ = htons(session_id);
995 if (session->send_seq) {
996 *bufp++ = htons(session->ns);
997 *bufp++ = 0;
998 session->ns++;
James Chapmanf7faffa2010-04-02 06:18:49 +0000999 session->ns &= 0xffff;
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001000 l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated ns to %u\n",
1001 session->name, session->ns);
James Chapmanfd558d12010-04-02 06:18:33 +00001002 }
James Chapmanf7faffa2010-04-02 06:18:49 +00001003
1004 return bufp - optr;
James Chapmanfd558d12010-04-02 06:18:33 +00001005}
1006
James Chapmanf7faffa2010-04-02 06:18:49 +00001007static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
James Chapmanfd558d12010-04-02 06:18:33 +00001008{
James Chapman0d767512010-04-02 06:19:00 +00001009 struct l2tp_tunnel *tunnel = session->tunnel;
James Chapmanf7faffa2010-04-02 06:18:49 +00001010 char *bufp = buf;
1011 char *optr = bufp;
James Chapmanfd558d12010-04-02 06:18:33 +00001012
James Chapman0d767512010-04-02 06:19:00 +00001013 /* Setup L2TP header. The header differs slightly for UDP and
1014 * IP encapsulations. For UDP, there is 4 bytes of flags.
1015 */
1016 if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
1017 u16 flags = L2TP_HDR_VER_3;
1018 *((__be16 *) bufp) = htons(flags);
1019 bufp += 2;
1020 *((__be16 *) bufp) = 0;
1021 bufp += 2;
1022 }
1023
James Chapmanf7faffa2010-04-02 06:18:49 +00001024 *((__be32 *) bufp) = htonl(session->peer_session_id);
1025 bufp += 4;
1026 if (session->cookie_len) {
1027 memcpy(bufp, &session->cookie[0], session->cookie_len);
1028 bufp += session->cookie_len;
1029 }
1030 if (session->l2specific_len) {
1031 if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
1032 u32 l2h = 0;
1033 if (session->send_seq) {
1034 l2h = 0x40000000 | session->ns;
1035 session->ns++;
1036 session->ns &= 0xffffff;
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001037 l2tp_dbg(session, L2TP_MSG_SEQ,
1038 "%s: updated ns to %u\n",
1039 session->name, session->ns);
James Chapmanf7faffa2010-04-02 06:18:49 +00001040 }
1041
1042 *((__be32 *) bufp) = htonl(l2h);
1043 }
1044 bufp += session->l2specific_len;
1045 }
1046 if (session->offset)
1047 bufp += session->offset;
1048
1049 return bufp - optr;
James Chapmanfd558d12010-04-02 06:18:33 +00001050}
James Chapmanfd558d12010-04-02 06:18:33 +00001051
stephen hemmingerfc130842010-10-21 07:50:46 +00001052static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
David S. Millerd9d8da82011-05-06 22:23:20 -07001053 struct flowi *fl, size_t data_len)
James Chapmanfd558d12010-04-02 06:18:33 +00001054{
1055 struct l2tp_tunnel *tunnel = session->tunnel;
1056 unsigned int len = skb->len;
1057 int error;
1058
1059 /* Debug */
1060 if (session->send_seq)
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001061 l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %Zd bytes, ns=%u\n",
1062 session->name, data_len, session->ns - 1);
James Chapmanfd558d12010-04-02 06:18:33 +00001063 else
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001064 l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %Zd bytes\n",
1065 session->name, data_len);
James Chapmanfd558d12010-04-02 06:18:33 +00001066
1067 if (session->debug & L2TP_MSG_DATA) {
James Chapman0d767512010-04-02 06:19:00 +00001068 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1069 unsigned char *datap = skb->data + uhlen;
James Chapmanfd558d12010-04-02 06:18:33 +00001070
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001071 pr_debug("%s: xmit\n", session->name);
1072 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1073 datap, min_t(size_t, 32, len - uhlen));
James Chapmanfd558d12010-04-02 06:18:33 +00001074 }
1075
1076 /* Queue the packet to IP for output */
WANG Cong60ff7462014-05-04 16:39:18 -07001077 skb->ignore_df = 1;
Benjamin LaHaised2cf3362012-04-27 08:24:18 +00001078#if IS_ENABLED(CONFIG_IPV6)
Eric Dumazet746e3492014-03-07 14:57:43 -08001079 if (tunnel->sock->sk_family == PF_INET6 && !tunnel->v4mapped)
Eric Dumazetb0270e92014-04-15 12:58:34 -04001080 error = inet6_csk_xmit(tunnel->sock, skb, NULL);
Benjamin LaHaised2cf3362012-04-27 08:24:18 +00001081 else
1082#endif
Eric Dumazetb0270e92014-04-15 12:58:34 -04001083 error = ip_queue_xmit(tunnel->sock, skb, fl);
James Chapmanfd558d12010-04-02 06:18:33 +00001084
1085 /* Update stats */
1086 if (error >= 0) {
Tom Parkin7b7c0712013-03-19 06:11:22 +00001087 atomic_long_inc(&tunnel->stats.tx_packets);
1088 atomic_long_add(len, &tunnel->stats.tx_bytes);
1089 atomic_long_inc(&session->stats.tx_packets);
1090 atomic_long_add(len, &session->stats.tx_bytes);
James Chapmanfd558d12010-04-02 06:18:33 +00001091 } else {
Tom Parkin7b7c0712013-03-19 06:11:22 +00001092 atomic_long_inc(&tunnel->stats.tx_errors);
1093 atomic_long_inc(&session->stats.tx_errors);
James Chapmanfd558d12010-04-02 06:18:33 +00001094 }
1095
1096 return 0;
1097}
James Chapmanfd558d12010-04-02 06:18:33 +00001098
James Chapmanfd558d12010-04-02 06:18:33 +00001099/* If caller requires the skb to have a ppp header, the header must be
1100 * inserted in the skb data before calling this function.
1101 */
1102int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len)
1103{
1104 int data_len = skb->len;
James Chapman0d767512010-04-02 06:19:00 +00001105 struct l2tp_tunnel *tunnel = session->tunnel;
1106 struct sock *sk = tunnel->sock;
David S. Millerd9d8da82011-05-06 22:23:20 -07001107 struct flowi *fl;
James Chapmanfd558d12010-04-02 06:18:33 +00001108 struct udphdr *uh;
James Chapmanfd558d12010-04-02 06:18:33 +00001109 struct inet_sock *inet;
James Chapmanfd558d12010-04-02 06:18:33 +00001110 int headroom;
James Chapman0d767512010-04-02 06:19:00 +00001111 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1112 int udp_len;
Eric Dumazetb8c84302012-06-28 20:15:13 +00001113 int ret = NET_XMIT_SUCCESS;
James Chapmanfd558d12010-04-02 06:18:33 +00001114
1115 /* Check that there's enough headroom in the skb to insert IP,
1116 * UDP and L2TP headers. If not enough, expand it to
1117 * make room. Adjust truesize.
1118 */
1119 headroom = NET_SKB_PAD + sizeof(struct iphdr) +
James Chapman0d767512010-04-02 06:19:00 +00001120 uhlen + hdr_len;
Eric Dumazet835acf52011-10-07 05:35:46 +00001121 if (skb_cow_head(skb, headroom)) {
Eric Dumazetb8c84302012-06-28 20:15:13 +00001122 kfree_skb(skb);
1123 return NET_XMIT_DROP;
Eric Dumazet835acf52011-10-07 05:35:46 +00001124 }
James Chapmanfd558d12010-04-02 06:18:33 +00001125
James Chapmanfd558d12010-04-02 06:18:33 +00001126 /* Setup L2TP header */
James Chapmanf7faffa2010-04-02 06:18:49 +00001127 session->build_header(session, __skb_push(skb, hdr_len));
James Chapmanfd558d12010-04-02 06:18:33 +00001128
James Chapman0d767512010-04-02 06:19:00 +00001129 /* Reset skb netfilter state */
James Chapmanfd558d12010-04-02 06:18:33 +00001130 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
1131 IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
1132 IPSKB_REROUTED);
1133 nf_reset(skb);
1134
David S. Miller6af88da2011-05-08 13:45:20 -07001135 bh_lock_sock(sk);
1136 if (sock_owned_by_user(sk)) {
Eric Dumazetb8c84302012-06-28 20:15:13 +00001137 kfree_skb(skb);
1138 ret = NET_XMIT_DROP;
David S. Miller6af88da2011-05-08 13:45:20 -07001139 goto out_unlock;
1140 }
1141
James Chapmanfd558d12010-04-02 06:18:33 +00001142 /* Get routing info from the tunnel socket */
1143 skb_dst_drop(skb);
Florian Westphal71b13912011-11-25 06:47:16 +00001144 skb_dst_set(skb, dst_clone(__sk_dst_check(sk, 0)));
James Chapmanfd558d12010-04-02 06:18:33 +00001145
David S. Millerd9d8da82011-05-06 22:23:20 -07001146 inet = inet_sk(sk);
1147 fl = &inet->cork.fl;
James Chapman0d767512010-04-02 06:19:00 +00001148 switch (tunnel->encap) {
1149 case L2TP_ENCAPTYPE_UDP:
1150 /* Setup UDP header */
James Chapman0d767512010-04-02 06:19:00 +00001151 __skb_push(skb, sizeof(*uh));
1152 skb_reset_transport_header(skb);
1153 uh = udp_hdr(skb);
1154 uh->source = inet->inet_sport;
1155 uh->dest = inet->inet_dport;
1156 udp_len = uhlen + hdr_len + data_len;
1157 uh->len = htons(udp_len);
James Chapman0d767512010-04-02 06:19:00 +00001158
1159 /* Calculate UDP checksum if configured to do so */
Benjamin LaHaised2cf3362012-04-27 08:24:18 +00001160#if IS_ENABLED(CONFIG_IPV6)
François Cachereule18503f2013-10-02 10:16:02 +02001161 if (sk->sk_family == PF_INET6 && !tunnel->v4mapped)
Tom Herbert77157e12014-06-04 17:19:56 -07001162 udp6_set_csum(udp_get_no_check6_tx(sk),
1163 skb, &inet6_sk(sk)->saddr,
1164 &sk->sk_v6_daddr, udp_len);
Benjamin LaHaised2cf3362012-04-27 08:24:18 +00001165 else
1166#endif
Tom Herbert77157e12014-06-04 17:19:56 -07001167 udp_set_csum(sk->sk_no_check_tx, skb, inet->inet_saddr,
1168 inet->inet_daddr, udp_len);
James Chapman0d767512010-04-02 06:19:00 +00001169 break;
1170
1171 case L2TP_ENCAPTYPE_IP:
1172 break;
James Chapmanfd558d12010-04-02 06:18:33 +00001173 }
1174
David S. Millerd9d8da82011-05-06 22:23:20 -07001175 l2tp_xmit_core(session, skb, fl, data_len);
David S. Miller6af88da2011-05-08 13:45:20 -07001176out_unlock:
1177 bh_unlock_sock(sk);
James Chapmanfd558d12010-04-02 06:18:33 +00001178
Eric Dumazetb8c84302012-06-28 20:15:13 +00001179 return ret;
James Chapmanfd558d12010-04-02 06:18:33 +00001180}
1181EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
1182
1183/*****************************************************************************
1184 * Tinnel and session create/destroy.
1185 *****************************************************************************/
1186
1187/* Tunnel socket destruct hook.
1188 * The tunnel context is deleted only when all session sockets have been
1189 * closed.
1190 */
stephen hemmingerfc130842010-10-21 07:50:46 +00001191static void l2tp_tunnel_destruct(struct sock *sk)
James Chapmanfd558d12010-04-02 06:18:33 +00001192{
David S. Miller8d8a51e2013-10-08 15:44:26 -04001193 struct l2tp_tunnel *tunnel = l2tp_tunnel(sk);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001194 struct l2tp_net *pn;
James Chapmanfd558d12010-04-02 06:18:33 +00001195
James Chapmanfd558d12010-04-02 06:18:33 +00001196 if (tunnel == NULL)
1197 goto end;
1198
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001199 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing...\n", tunnel->name);
James Chapmanfd558d12010-04-02 06:18:33 +00001200
James Chapmanfd558d12010-04-02 06:18:33 +00001201
Tom Parkinf8ccac02013-01-31 23:43:00 +00001202 /* Disable udp encapsulation */
James Chapman0d767512010-04-02 06:19:00 +00001203 switch (tunnel->encap) {
1204 case L2TP_ENCAPTYPE_UDP:
1205 /* No longer an encapsulation socket. See net/ipv4/udp.c */
1206 (udp_sk(sk))->encap_type = 0;
1207 (udp_sk(sk))->encap_rcv = NULL;
Tom Parkin9980d002013-03-19 06:11:13 +00001208 (udp_sk(sk))->encap_destroy = NULL;
James Chapman0d767512010-04-02 06:19:00 +00001209 break;
1210 case L2TP_ENCAPTYPE_IP:
1211 break;
1212 }
James Chapmanfd558d12010-04-02 06:18:33 +00001213
1214 /* Remove hooks into tunnel socket */
James Chapmanfd558d12010-04-02 06:18:33 +00001215 sk->sk_destruct = tunnel->old_sk_destruct;
1216 sk->sk_user_data = NULL;
Tom Parkinf8ccac02013-01-31 23:43:00 +00001217 tunnel->sock = NULL;
1218
1219 /* Remove the tunnel struct from the tunnel list */
1220 pn = l2tp_pernet(tunnel->l2tp_net);
1221 spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1222 list_del_rcu(&tunnel->list);
1223 spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
1224 atomic_dec(&l2tp_tunnel_count);
1225
1226 l2tp_tunnel_closeall(tunnel);
1227 l2tp_tunnel_dec_refcount(tunnel);
James Chapmanfd558d12010-04-02 06:18:33 +00001228
1229 /* Call the original destructor */
1230 if (sk->sk_destruct)
1231 (*sk->sk_destruct)(sk);
James Chapmanfd558d12010-04-02 06:18:33 +00001232end:
1233 return;
1234}
James Chapmanfd558d12010-04-02 06:18:33 +00001235
1236/* When the tunnel is closed, all the attached sessions need to go too.
1237 */
Tom Parkine34f4c72013-03-19 06:11:14 +00001238void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
James Chapmanfd558d12010-04-02 06:18:33 +00001239{
1240 int hash;
1241 struct hlist_node *walk;
1242 struct hlist_node *tmp;
1243 struct l2tp_session *session;
1244
1245 BUG_ON(tunnel == NULL);
1246
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001247 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing all sessions...\n",
1248 tunnel->name);
James Chapmanfd558d12010-04-02 06:18:33 +00001249
1250 write_lock_bh(&tunnel->hlist_lock);
1251 for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
1252again:
1253 hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
1254 session = hlist_entry(walk, struct l2tp_session, hlist);
1255
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001256 l2tp_info(session, L2TP_MSG_CONTROL,
1257 "%s: closing session\n", session->name);
James Chapmanfd558d12010-04-02 06:18:33 +00001258
1259 hlist_del_init(&session->hlist);
1260
James Chapmanfd558d12010-04-02 06:18:33 +00001261 if (session->ref != NULL)
1262 (*session->ref)(session);
1263
1264 write_unlock_bh(&tunnel->hlist_lock);
1265
Tom Parkinf6e16b22013-03-19 06:11:23 +00001266 __l2tp_session_unhash(session);
Tom Parkin4c6e2fd2013-03-19 06:11:20 +00001267 l2tp_session_queue_purge(session);
1268
James Chapmanfd558d12010-04-02 06:18:33 +00001269 if (session->session_close != NULL)
1270 (*session->session_close)(session);
1271
1272 if (session->deref != NULL)
1273 (*session->deref)(session);
1274
Tom Parkin9980d002013-03-19 06:11:13 +00001275 l2tp_session_dec_refcount(session);
1276
James Chapmanfd558d12010-04-02 06:18:33 +00001277 write_lock_bh(&tunnel->hlist_lock);
1278
1279 /* Now restart from the beginning of this hash
1280 * chain. We always remove a session from the
1281 * list so we are guaranteed to make forward
1282 * progress.
1283 */
1284 goto again;
1285 }
1286 }
1287 write_unlock_bh(&tunnel->hlist_lock);
1288}
Tom Parkine34f4c72013-03-19 06:11:14 +00001289EXPORT_SYMBOL_GPL(l2tp_tunnel_closeall);
James Chapmanfd558d12010-04-02 06:18:33 +00001290
Tom Parkin9980d002013-03-19 06:11:13 +00001291/* Tunnel socket destroy hook for UDP encapsulation */
1292static void l2tp_udp_encap_destroy(struct sock *sk)
1293{
1294 struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
1295 if (tunnel) {
1296 l2tp_tunnel_closeall(tunnel);
1297 sock_put(sk);
1298 }
1299}
1300
James Chapmanfd558d12010-04-02 06:18:33 +00001301/* Really kill the tunnel.
1302 * Come here only when all sessions have been cleared from the tunnel.
1303 */
stephen hemmingerfc130842010-10-21 07:50:46 +00001304static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
James Chapmanfd558d12010-04-02 06:18:33 +00001305{
James Chapmanfd558d12010-04-02 06:18:33 +00001306 BUG_ON(atomic_read(&tunnel->ref_count) != 0);
1307 BUG_ON(tunnel->sock != NULL);
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001308 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: free...\n", tunnel->name);
xeb@mail.ru99469c32012-08-24 01:07:38 +00001309 kfree_rcu(tunnel, rcu);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001310}
James Chapmanfd558d12010-04-02 06:18:33 +00001311
Tom Parkinf8ccac02013-01-31 23:43:00 +00001312/* Workqueue tunnel deletion function */
1313static void l2tp_tunnel_del_work(struct work_struct *work)
1314{
1315 struct l2tp_tunnel *tunnel = NULL;
1316 struct socket *sock = NULL;
1317 struct sock *sk = NULL;
1318
1319 tunnel = container_of(work, struct l2tp_tunnel, del_work);
1320 sk = l2tp_tunnel_sock_lookup(tunnel);
1321 if (!sk)
1322 return;
1323
1324 sock = sk->sk_socket;
Tom Parkinf8ccac02013-01-31 23:43:00 +00001325
Tom Parkin02d13ed2013-03-19 06:11:18 +00001326 /* If the tunnel socket was created by userspace, then go through the
1327 * inet layer to shut the socket down, and let userspace close it.
1328 * Otherwise, if we created the socket directly within the kernel, use
1329 * the sk API to release it here.
Tom Parkin167eb172013-01-31 23:43:03 +00001330 * In either case the tunnel resources are freed in the socket
1331 * destructor when the tunnel socket goes away.
Tom Parkinf8ccac02013-01-31 23:43:00 +00001332 */
Tom Parkin02d13ed2013-03-19 06:11:18 +00001333 if (tunnel->fd >= 0) {
1334 if (sock)
1335 inet_shutdown(sock, 2);
Tom Parkin167eb172013-01-31 23:43:03 +00001336 } else {
Eric W. Biederman26abe142015-05-08 21:10:31 -05001337 if (sock) {
Tom Parkin02d13ed2013-03-19 06:11:18 +00001338 kernel_sock_shutdown(sock, SHUT_RDWR);
Eric W. Biederman26abe142015-05-08 21:10:31 -05001339 sock_release(sock);
1340 }
Tom Parkin167eb172013-01-31 23:43:03 +00001341 }
Tom Parkinf8ccac02013-01-31 23:43:00 +00001342
1343 l2tp_tunnel_sock_put(sk);
James Chapmanfd558d12010-04-02 06:18:33 +00001344}
James Chapmanfd558d12010-04-02 06:18:33 +00001345
James Chapman789a4a22010-04-02 06:19:40 +00001346/* Create a socket for the tunnel, if one isn't set up by
1347 * userspace. This is used for static tunnels where there is no
1348 * managing L2TP daemon.
Tom Parkin167eb172013-01-31 23:43:03 +00001349 *
1350 * Since we don't want these sockets to keep a namespace alive by
1351 * themselves, we drop the socket's namespace refcount after creation.
1352 * These sockets are freed when the namespace exits using the pernet
1353 * exit hook.
James Chapman789a4a22010-04-02 06:19:40 +00001354 */
Tom Parkin167eb172013-01-31 23:43:03 +00001355static int l2tp_tunnel_sock_create(struct net *net,
1356 u32 tunnel_id,
1357 u32 peer_tunnel_id,
1358 struct l2tp_tunnel_cfg *cfg,
1359 struct socket **sockp)
James Chapman789a4a22010-04-02 06:19:40 +00001360{
1361 int err = -EINVAL;
Eric Dumazet7bddd0d2010-04-04 01:02:46 -07001362 struct socket *sock = NULL;
Tom Herbert85644b42014-07-13 19:49:48 -07001363 struct udp_port_cfg udp_conf;
James Chapman789a4a22010-04-02 06:19:40 +00001364
1365 switch (cfg->encap) {
1366 case L2TP_ENCAPTYPE_UDP:
Tom Herbert85644b42014-07-13 19:49:48 -07001367 memset(&udp_conf, 0, sizeof(udp_conf));
1368
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001369#if IS_ENABLED(CONFIG_IPV6)
1370 if (cfg->local_ip6 && cfg->peer_ip6) {
Tom Herbert85644b42014-07-13 19:49:48 -07001371 udp_conf.family = AF_INET6;
1372 memcpy(&udp_conf.local_ip6, cfg->local_ip6,
1373 sizeof(udp_conf.local_ip6));
1374 memcpy(&udp_conf.peer_ip6, cfg->peer_ip6,
1375 sizeof(udp_conf.peer_ip6));
1376 udp_conf.use_udp6_tx_checksums =
1377 cfg->udp6_zero_tx_checksums;
1378 udp_conf.use_udp6_rx_checksums =
1379 cfg->udp6_zero_rx_checksums;
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001380 } else
1381#endif
1382 {
Tom Herbert85644b42014-07-13 19:49:48 -07001383 udp_conf.family = AF_INET;
1384 udp_conf.local_ip = cfg->local_ip;
1385 udp_conf.peer_ip = cfg->peer_ip;
1386 udp_conf.use_udp_checksums = cfg->use_udp_checksums;
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001387 }
James Chapman789a4a22010-04-02 06:19:40 +00001388
Tom Herbert85644b42014-07-13 19:49:48 -07001389 udp_conf.local_udp_port = htons(cfg->local_udp_port);
1390 udp_conf.peer_udp_port = htons(cfg->peer_udp_port);
1391
1392 err = udp_sock_create(net, &udp_conf, &sock);
1393 if (err < 0)
1394 goto out;
James Chapman789a4a22010-04-02 06:19:40 +00001395
1396 break;
1397
1398 case L2TP_ENCAPTYPE_IP:
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001399#if IS_ENABLED(CONFIG_IPV6)
1400 if (cfg->local_ip6 && cfg->peer_ip6) {
Tom Herbert85644b42014-07-13 19:49:48 -07001401 struct sockaddr_l2tpip6 ip6_addr = {0};
1402
Eric W. Biederman26abe142015-05-08 21:10:31 -05001403 err = sock_create_kern(net, AF_INET6, SOCK_DGRAM,
Tom Parkin167eb172013-01-31 23:43:03 +00001404 IPPROTO_L2TP, &sock);
James Chapman5dac94e2012-04-29 21:48:55 +00001405 if (err < 0)
1406 goto out;
1407
James Chapman5dac94e2012-04-29 21:48:55 +00001408 ip6_addr.l2tp_family = AF_INET6;
1409 memcpy(&ip6_addr.l2tp_addr, cfg->local_ip6,
1410 sizeof(ip6_addr.l2tp_addr));
1411 ip6_addr.l2tp_conn_id = tunnel_id;
1412 err = kernel_bind(sock, (struct sockaddr *) &ip6_addr,
1413 sizeof(ip6_addr));
1414 if (err < 0)
1415 goto out;
1416
1417 ip6_addr.l2tp_family = AF_INET6;
1418 memcpy(&ip6_addr.l2tp_addr, cfg->peer_ip6,
1419 sizeof(ip6_addr.l2tp_addr));
1420 ip6_addr.l2tp_conn_id = peer_tunnel_id;
1421 err = kernel_connect(sock,
1422 (struct sockaddr *) &ip6_addr,
1423 sizeof(ip6_addr), 0);
1424 if (err < 0)
1425 goto out;
1426 } else
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001427#endif
James Chapman5dac94e2012-04-29 21:48:55 +00001428 {
Tom Herbert85644b42014-07-13 19:49:48 -07001429 struct sockaddr_l2tpip ip_addr = {0};
1430
Eric W. Biederman26abe142015-05-08 21:10:31 -05001431 err = sock_create_kern(net, AF_INET, SOCK_DGRAM,
Tom Parkin167eb172013-01-31 23:43:03 +00001432 IPPROTO_L2TP, &sock);
James Chapman5dac94e2012-04-29 21:48:55 +00001433 if (err < 0)
1434 goto out;
James Chapman789a4a22010-04-02 06:19:40 +00001435
James Chapman5dac94e2012-04-29 21:48:55 +00001436 ip_addr.l2tp_family = AF_INET;
1437 ip_addr.l2tp_addr = cfg->local_ip;
1438 ip_addr.l2tp_conn_id = tunnel_id;
1439 err = kernel_bind(sock, (struct sockaddr *) &ip_addr,
1440 sizeof(ip_addr));
1441 if (err < 0)
1442 goto out;
James Chapman789a4a22010-04-02 06:19:40 +00001443
James Chapman5dac94e2012-04-29 21:48:55 +00001444 ip_addr.l2tp_family = AF_INET;
1445 ip_addr.l2tp_addr = cfg->peer_ip;
1446 ip_addr.l2tp_conn_id = peer_tunnel_id;
1447 err = kernel_connect(sock, (struct sockaddr *) &ip_addr,
1448 sizeof(ip_addr), 0);
1449 if (err < 0)
1450 goto out;
1451 }
James Chapman789a4a22010-04-02 06:19:40 +00001452 break;
1453
1454 default:
1455 goto out;
1456 }
1457
1458out:
Tom Parkin167eb172013-01-31 23:43:03 +00001459 *sockp = sock;
James Chapman789a4a22010-04-02 06:19:40 +00001460 if ((err < 0) && sock) {
Tom Parkin167eb172013-01-31 23:43:03 +00001461 kernel_sock_shutdown(sock, SHUT_RDWR);
Eric W. Biederman26abe142015-05-08 21:10:31 -05001462 sock_release(sock);
James Chapman789a4a22010-04-02 06:19:40 +00001463 *sockp = NULL;
1464 }
1465
1466 return err;
1467}
1468
Eric Dumazet37159ef2012-09-04 07:18:57 +00001469static struct lock_class_key l2tp_socket_class;
1470
James Chapmanfd558d12010-04-02 06:18:33 +00001471int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp)
1472{
1473 struct l2tp_tunnel *tunnel = NULL;
1474 int err;
1475 struct socket *sock = NULL;
1476 struct sock *sk = NULL;
1477 struct l2tp_net *pn;
James Chapman0d767512010-04-02 06:19:00 +00001478 enum l2tp_encap_type encap = L2TP_ENCAPTYPE_UDP;
James Chapmanfd558d12010-04-02 06:18:33 +00001479
1480 /* Get the tunnel socket from the fd, which was opened by
James Chapman789a4a22010-04-02 06:19:40 +00001481 * the userspace L2TP daemon. If not specified, create a
1482 * kernel socket.
James Chapmanfd558d12010-04-02 06:18:33 +00001483 */
James Chapman789a4a22010-04-02 06:19:40 +00001484 if (fd < 0) {
Tom Parkin167eb172013-01-31 23:43:03 +00001485 err = l2tp_tunnel_sock_create(net, tunnel_id, peer_tunnel_id,
1486 cfg, &sock);
James Chapman789a4a22010-04-02 06:19:40 +00001487 if (err < 0)
1488 goto err;
1489 } else {
James Chapman789a4a22010-04-02 06:19:40 +00001490 sock = sockfd_lookup(fd, &err);
1491 if (!sock) {
Tom Parkincbb95e02013-01-31 23:43:02 +00001492 pr_err("tunl %u: sockfd_lookup(fd=%d) returned %d\n",
James Chapman789a4a22010-04-02 06:19:40 +00001493 tunnel_id, fd, err);
Tom Parkincbb95e02013-01-31 23:43:02 +00001494 err = -EBADF;
1495 goto err;
1496 }
1497
1498 /* Reject namespace mismatches */
1499 if (!net_eq(sock_net(sock->sk), net)) {
1500 pr_err("tunl %u: netns mismatch\n", tunnel_id);
1501 err = -EINVAL;
James Chapman789a4a22010-04-02 06:19:40 +00001502 goto err;
1503 }
James Chapmanfd558d12010-04-02 06:18:33 +00001504 }
1505
1506 sk = sock->sk;
1507
James Chapman0d767512010-04-02 06:19:00 +00001508 if (cfg != NULL)
1509 encap = cfg->encap;
1510
James Chapmanfd558d12010-04-02 06:18:33 +00001511 /* Quick sanity checks */
James Chapman0d767512010-04-02 06:19:00 +00001512 switch (encap) {
1513 case L2TP_ENCAPTYPE_UDP:
1514 err = -EPROTONOSUPPORT;
1515 if (sk->sk_protocol != IPPROTO_UDP) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001516 pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
James Chapman0d767512010-04-02 06:19:00 +00001517 tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
1518 goto err;
1519 }
1520 break;
1521 case L2TP_ENCAPTYPE_IP:
1522 err = -EPROTONOSUPPORT;
1523 if (sk->sk_protocol != IPPROTO_L2TP) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001524 pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
James Chapman0d767512010-04-02 06:19:00 +00001525 tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP);
1526 goto err;
1527 }
1528 break;
James Chapmanfd558d12010-04-02 06:18:33 +00001529 }
1530
1531 /* Check if this socket has already been prepped */
David S. Miller8d8a51e2013-10-08 15:44:26 -04001532 tunnel = l2tp_tunnel(sk);
James Chapmanfd558d12010-04-02 06:18:33 +00001533 if (tunnel != NULL) {
1534 /* This socket has already been prepped */
1535 err = -EBUSY;
1536 goto err;
1537 }
1538
James Chapmanfd558d12010-04-02 06:18:33 +00001539 tunnel = kzalloc(sizeof(struct l2tp_tunnel), GFP_KERNEL);
1540 if (tunnel == NULL) {
1541 err = -ENOMEM;
1542 goto err;
1543 }
1544
1545 tunnel->version = version;
1546 tunnel->tunnel_id = tunnel_id;
1547 tunnel->peer_tunnel_id = peer_tunnel_id;
1548 tunnel->debug = L2TP_DEFAULT_DEBUG_FLAGS;
1549
1550 tunnel->magic = L2TP_TUNNEL_MAGIC;
1551 sprintf(&tunnel->name[0], "tunl %u", tunnel_id);
1552 rwlock_init(&tunnel->hlist_lock);
1553
1554 /* The net we belong to */
1555 tunnel->l2tp_net = net;
1556 pn = l2tp_pernet(net);
1557
James Chapman0d767512010-04-02 06:19:00 +00001558 if (cfg != NULL)
James Chapmanfd558d12010-04-02 06:18:33 +00001559 tunnel->debug = cfg->debug;
1560
François Cachereule18503f2013-10-02 10:16:02 +02001561#if IS_ENABLED(CONFIG_IPV6)
1562 if (sk->sk_family == PF_INET6) {
1563 struct ipv6_pinfo *np = inet6_sk(sk);
1564
1565 if (ipv6_addr_v4mapped(&np->saddr) &&
Eric Dumazetefe42082013-10-03 15:42:29 -07001566 ipv6_addr_v4mapped(&sk->sk_v6_daddr)) {
François Cachereule18503f2013-10-02 10:16:02 +02001567 struct inet_sock *inet = inet_sk(sk);
1568
1569 tunnel->v4mapped = true;
1570 inet->inet_saddr = np->saddr.s6_addr32[3];
Eric Dumazetefe42082013-10-03 15:42:29 -07001571 inet->inet_rcv_saddr = sk->sk_v6_rcv_saddr.s6_addr32[3];
1572 inet->inet_daddr = sk->sk_v6_daddr.s6_addr32[3];
François Cachereule18503f2013-10-02 10:16:02 +02001573 } else {
1574 tunnel->v4mapped = false;
1575 }
1576 }
1577#endif
1578
James Chapmanfd558d12010-04-02 06:18:33 +00001579 /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
James Chapman0d767512010-04-02 06:19:00 +00001580 tunnel->encap = encap;
1581 if (encap == L2TP_ENCAPTYPE_UDP) {
Andy Zhouc8fffce2014-09-16 17:31:19 -07001582 struct udp_tunnel_sock_cfg udp_cfg;
James Chapmanfd558d12010-04-02 06:18:33 +00001583
Andy Zhouc8fffce2014-09-16 17:31:19 -07001584 udp_cfg.sk_user_data = tunnel;
1585 udp_cfg.encap_type = UDP_ENCAP_L2TPINUDP;
1586 udp_cfg.encap_rcv = l2tp_udp_encap_recv;
1587 udp_cfg.encap_destroy = l2tp_udp_encap_destroy;
1588
1589 setup_udp_tunnel_sock(net, sock, &udp_cfg);
1590 } else {
1591 sk->sk_user_data = tunnel;
1592 }
James Chapmanfd558d12010-04-02 06:18:33 +00001593
1594 /* Hook on the tunnel socket destructor so that we can cleanup
1595 * if the tunnel socket goes away.
1596 */
1597 tunnel->old_sk_destruct = sk->sk_destruct;
1598 sk->sk_destruct = &l2tp_tunnel_destruct;
1599 tunnel->sock = sk;
Tom Parkin80d84ef2013-01-22 05:13:48 +00001600 tunnel->fd = fd;
Eric Dumazet37159ef2012-09-04 07:18:57 +00001601 lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock");
1602
James Chapmanfd558d12010-04-02 06:18:33 +00001603 sk->sk_allocation = GFP_ATOMIC;
1604
Tom Parkinf8ccac02013-01-31 23:43:00 +00001605 /* Init delete workqueue struct */
1606 INIT_WORK(&tunnel->del_work, l2tp_tunnel_del_work);
1607
James Chapmanfd558d12010-04-02 06:18:33 +00001608 /* Add tunnel to our list */
1609 INIT_LIST_HEAD(&tunnel->list);
James Chapmanfd558d12010-04-02 06:18:33 +00001610 atomic_inc(&l2tp_tunnel_count);
1611
1612 /* Bump the reference count. The tunnel context is deleted
Eric Dumazet17691922011-05-11 18:22:36 +00001613 * only when this drops to zero. Must be done before list insertion
James Chapmanfd558d12010-04-02 06:18:33 +00001614 */
1615 l2tp_tunnel_inc_refcount(tunnel);
Eric Dumazet17691922011-05-11 18:22:36 +00001616 spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1617 list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
1618 spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
James Chapmanfd558d12010-04-02 06:18:33 +00001619
1620 err = 0;
1621err:
1622 if (tunnelp)
1623 *tunnelp = tunnel;
1624
James Chapman789a4a22010-04-02 06:19:40 +00001625 /* If tunnel's socket was created by the kernel, it doesn't
1626 * have a file.
1627 */
1628 if (sock && sock->file)
James Chapmanfd558d12010-04-02 06:18:33 +00001629 sockfd_put(sock);
1630
1631 return err;
1632}
1633EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
1634
James Chapman309795f2010-04-02 06:19:10 +00001635/* This function is used by the netlink TUNNEL_DELETE command.
1636 */
1637int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
1638{
Tom Parkin2b551c62013-03-19 06:11:16 +00001639 l2tp_tunnel_closeall(tunnel);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001640 return (false == queue_work(l2tp_wq, &tunnel->del_work));
James Chapman309795f2010-04-02 06:19:10 +00001641}
1642EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
1643
James Chapmanfd558d12010-04-02 06:18:33 +00001644/* Really kill the session.
1645 */
1646void l2tp_session_free(struct l2tp_session *session)
1647{
Tom Parkinf6e16b22013-03-19 06:11:23 +00001648 struct l2tp_tunnel *tunnel = session->tunnel;
James Chapmanfd558d12010-04-02 06:18:33 +00001649
1650 BUG_ON(atomic_read(&session->ref_count) != 0);
1651
Tom Parkinf6e16b22013-03-19 06:11:23 +00001652 if (tunnel) {
James Chapmanfd558d12010-04-02 06:18:33 +00001653 BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
James Chapmanfd558d12010-04-02 06:18:33 +00001654 if (session->session_id != 0)
1655 atomic_dec(&l2tp_session_count);
James Chapmanfd558d12010-04-02 06:18:33 +00001656 sock_put(tunnel->sock);
James Chapmanfd558d12010-04-02 06:18:33 +00001657 session->tunnel = NULL;
1658 l2tp_tunnel_dec_refcount(tunnel);
1659 }
1660
1661 kfree(session);
James Chapmanfd558d12010-04-02 06:18:33 +00001662}
1663EXPORT_SYMBOL_GPL(l2tp_session_free);
1664
Tom Parkinf6e16b22013-03-19 06:11:23 +00001665/* Remove an l2tp session from l2tp_core's hash lists.
1666 * Provides a tidyup interface for pseudowire code which can't just route all
1667 * shutdown via. l2tp_session_delete and a pseudowire-specific session_close
1668 * callback.
1669 */
1670void __l2tp_session_unhash(struct l2tp_session *session)
1671{
1672 struct l2tp_tunnel *tunnel = session->tunnel;
1673
1674 /* Remove the session from core hashes */
1675 if (tunnel) {
1676 /* Remove from the per-tunnel hash */
1677 write_lock_bh(&tunnel->hlist_lock);
1678 hlist_del_init(&session->hlist);
1679 write_unlock_bh(&tunnel->hlist_lock);
1680
1681 /* For L2TPv3 we have a per-net hash: remove from there, too */
1682 if (tunnel->version != L2TP_HDR_VER_2) {
1683 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1684 spin_lock_bh(&pn->l2tp_session_hlist_lock);
1685 hlist_del_init_rcu(&session->global_hlist);
1686 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
1687 synchronize_rcu();
1688 }
1689 }
1690}
1691EXPORT_SYMBOL_GPL(__l2tp_session_unhash);
1692
James Chapman309795f2010-04-02 06:19:10 +00001693/* This function is used by the netlink SESSION_DELETE command and by
1694 pseudowire modules.
1695 */
1696int l2tp_session_delete(struct l2tp_session *session)
1697{
Tom Parkinf6e16b22013-03-19 06:11:23 +00001698 if (session->ref)
1699 (*session->ref)(session);
1700 __l2tp_session_unhash(session);
Tom Parkin4c6e2fd2013-03-19 06:11:20 +00001701 l2tp_session_queue_purge(session);
James Chapman309795f2010-04-02 06:19:10 +00001702 if (session->session_close != NULL)
1703 (*session->session_close)(session);
Tom Parkinf6e16b22013-03-19 06:11:23 +00001704 if (session->deref)
Dan Carpenter1b7c92b2013-03-22 21:33:15 +03001705 (*session->deref)(session);
James Chapman309795f2010-04-02 06:19:10 +00001706 l2tp_session_dec_refcount(session);
James Chapman309795f2010-04-02 06:19:10 +00001707 return 0;
1708}
1709EXPORT_SYMBOL_GPL(l2tp_session_delete);
1710
James Chapmanf7faffa2010-04-02 06:18:49 +00001711/* We come here whenever a session's send_seq, cookie_len or
1712 * l2specific_len parameters are set.
1713 */
Guillaume Naultbb5016e2014-03-06 11:14:30 +01001714void l2tp_session_set_header_len(struct l2tp_session *session, int version)
James Chapmanf7faffa2010-04-02 06:18:49 +00001715{
1716 if (version == L2TP_HDR_VER_2) {
1717 session->hdr_len = 6;
1718 if (session->send_seq)
1719 session->hdr_len += 4;
1720 } else {
James Chapman0d767512010-04-02 06:19:00 +00001721 session->hdr_len = 4 + session->cookie_len + session->l2specific_len + session->offset;
1722 if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)
1723 session->hdr_len += 4;
James Chapmanf7faffa2010-04-02 06:18:49 +00001724 }
1725
1726}
Guillaume Naultbb5016e2014-03-06 11:14:30 +01001727EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
James Chapmanf7faffa2010-04-02 06:18:49 +00001728
James Chapmanfd558d12010-04-02 06:18:33 +00001729struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
1730{
1731 struct l2tp_session *session;
1732
1733 session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL);
1734 if (session != NULL) {
1735 session->magic = L2TP_SESSION_MAGIC;
1736 session->tunnel = tunnel;
1737
1738 session->session_id = session_id;
1739 session->peer_session_id = peer_session_id;
James Chapmand301e322012-05-09 23:43:09 +00001740 session->nr = 0;
James Chapman8a1631d2013-07-02 20:28:59 +01001741 if (tunnel->version == L2TP_HDR_VER_2)
1742 session->nr_max = 0xffff;
1743 else
1744 session->nr_max = 0xffffff;
1745 session->nr_window_size = session->nr_max / 2;
James Chapmana0dbd822013-07-02 20:29:00 +01001746 session->nr_oos_count_max = 4;
1747
1748 /* Use NR of first received packet */
1749 session->reorder_skip = 1;
James Chapmanfd558d12010-04-02 06:18:33 +00001750
1751 sprintf(&session->name[0], "sess %u/%u",
1752 tunnel->tunnel_id, session->session_id);
1753
1754 skb_queue_head_init(&session->reorder_q);
1755
1756 INIT_HLIST_NODE(&session->hlist);
James Chapmanf7faffa2010-04-02 06:18:49 +00001757 INIT_HLIST_NODE(&session->global_hlist);
James Chapmanfd558d12010-04-02 06:18:33 +00001758
1759 /* Inherit debug options from tunnel */
1760 session->debug = tunnel->debug;
1761
1762 if (cfg) {
James Chapmanf7faffa2010-04-02 06:18:49 +00001763 session->pwtype = cfg->pw_type;
James Chapmanfd558d12010-04-02 06:18:33 +00001764 session->debug = cfg->debug;
James Chapmanfd558d12010-04-02 06:18:33 +00001765 session->mtu = cfg->mtu;
1766 session->mru = cfg->mru;
1767 session->send_seq = cfg->send_seq;
1768 session->recv_seq = cfg->recv_seq;
1769 session->lns_mode = cfg->lns_mode;
James Chapmanf7faffa2010-04-02 06:18:49 +00001770 session->reorder_timeout = cfg->reorder_timeout;
1771 session->offset = cfg->offset;
1772 session->l2specific_type = cfg->l2specific_type;
1773 session->l2specific_len = cfg->l2specific_len;
1774 session->cookie_len = cfg->cookie_len;
1775 memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);
1776 session->peer_cookie_len = cfg->peer_cookie_len;
1777 memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);
James Chapmanfd558d12010-04-02 06:18:33 +00001778 }
1779
James Chapmanf7faffa2010-04-02 06:18:49 +00001780 if (tunnel->version == L2TP_HDR_VER_2)
1781 session->build_header = l2tp_build_l2tpv2_header;
1782 else
1783 session->build_header = l2tp_build_l2tpv3_header;
1784
1785 l2tp_session_set_header_len(session, tunnel->version);
1786
James Chapmanfd558d12010-04-02 06:18:33 +00001787 /* Bump the reference count. The session context is deleted
1788 * only when this drops to zero.
1789 */
1790 l2tp_session_inc_refcount(session);
1791 l2tp_tunnel_inc_refcount(tunnel);
1792
1793 /* Ensure tunnel socket isn't deleted */
1794 sock_hold(tunnel->sock);
1795
1796 /* Add session to the tunnel's hash list */
1797 write_lock_bh(&tunnel->hlist_lock);
1798 hlist_add_head(&session->hlist,
1799 l2tp_session_id_hash(tunnel, session_id));
1800 write_unlock_bh(&tunnel->hlist_lock);
1801
James Chapmanf7faffa2010-04-02 06:18:49 +00001802 /* And to the global session list if L2TPv3 */
1803 if (tunnel->version != L2TP_HDR_VER_2) {
1804 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1805
James Chapmane02d4942010-04-02 06:19:16 +00001806 spin_lock_bh(&pn->l2tp_session_hlist_lock);
1807 hlist_add_head_rcu(&session->global_hlist,
1808 l2tp_session_id_hash_2(pn, session_id));
1809 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
James Chapmanf7faffa2010-04-02 06:18:49 +00001810 }
1811
James Chapmanfd558d12010-04-02 06:18:33 +00001812 /* Ignore management session in session count value */
1813 if (session->session_id != 0)
1814 atomic_inc(&l2tp_session_count);
1815 }
1816
1817 return session;
1818}
1819EXPORT_SYMBOL_GPL(l2tp_session_create);
1820
1821/*****************************************************************************
1822 * Init and cleanup
1823 *****************************************************************************/
1824
1825static __net_init int l2tp_init_net(struct net *net)
1826{
Jiri Pirkoe773aaf2010-04-23 00:53:39 +00001827 struct l2tp_net *pn = net_generic(net, l2tp_net_id);
James Chapmanf7faffa2010-04-02 06:18:49 +00001828 int hash;
James Chapmanfd558d12010-04-02 06:18:33 +00001829
James Chapmanfd558d12010-04-02 06:18:33 +00001830 INIT_LIST_HEAD(&pn->l2tp_tunnel_list);
James Chapmane02d4942010-04-02 06:19:16 +00001831 spin_lock_init(&pn->l2tp_tunnel_list_lock);
James Chapmanfd558d12010-04-02 06:18:33 +00001832
James Chapmanf7faffa2010-04-02 06:18:49 +00001833 for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
1834 INIT_HLIST_HEAD(&pn->l2tp_session_hlist[hash]);
1835
James Chapmane02d4942010-04-02 06:19:16 +00001836 spin_lock_init(&pn->l2tp_session_hlist_lock);
James Chapmanf7faffa2010-04-02 06:18:49 +00001837
James Chapmanfd558d12010-04-02 06:18:33 +00001838 return 0;
James Chapmanfd558d12010-04-02 06:18:33 +00001839}
1840
Tom Parkin167eb172013-01-31 23:43:03 +00001841static __net_exit void l2tp_exit_net(struct net *net)
1842{
1843 struct l2tp_net *pn = l2tp_pernet(net);
1844 struct l2tp_tunnel *tunnel = NULL;
1845
1846 rcu_read_lock_bh();
1847 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
1848 (void)l2tp_tunnel_delete(tunnel);
1849 }
1850 rcu_read_unlock_bh();
1851}
1852
James Chapmanfd558d12010-04-02 06:18:33 +00001853static struct pernet_operations l2tp_net_ops = {
1854 .init = l2tp_init_net,
Tom Parkin167eb172013-01-31 23:43:03 +00001855 .exit = l2tp_exit_net,
James Chapmanfd558d12010-04-02 06:18:33 +00001856 .id = &l2tp_net_id,
1857 .size = sizeof(struct l2tp_net),
1858};
1859
1860static int __init l2tp_init(void)
1861{
1862 int rc = 0;
1863
1864 rc = register_pernet_device(&l2tp_net_ops);
1865 if (rc)
1866 goto out;
1867
ZhangZhen59ff3eb2014-03-27 09:41:47 +08001868 l2tp_wq = alloc_workqueue("l2tp", WQ_UNBOUND, 0);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001869 if (!l2tp_wq) {
1870 pr_err("alloc_workqueue failed\n");
WANG Cong67e04c22015-04-03 13:46:09 -07001871 unregister_pernet_device(&l2tp_net_ops);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001872 rc = -ENOMEM;
1873 goto out;
1874 }
1875
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001876 pr_info("L2TP core driver, %s\n", L2TP_DRV_VERSION);
James Chapmanfd558d12010-04-02 06:18:33 +00001877
1878out:
1879 return rc;
1880}
1881
1882static void __exit l2tp_exit(void)
1883{
1884 unregister_pernet_device(&l2tp_net_ops);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001885 if (l2tp_wq) {
1886 destroy_workqueue(l2tp_wq);
1887 l2tp_wq = NULL;
1888 }
James Chapmanfd558d12010-04-02 06:18:33 +00001889}
1890
1891module_init(l2tp_init);
1892module_exit(l2tp_exit);
1893
1894MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1895MODULE_DESCRIPTION("L2TP core");
1896MODULE_LICENSE("GPL");
1897MODULE_VERSION(L2TP_DRV_VERSION);
1898