blob: 776603385f8c5268954d7e8b154532f6b55f1ff6 [file] [log] [blame]
James Chapmanfd558d12010-04-02 06:18:33 +00001/*
2 * L2TP core.
3 *
4 * Copyright (c) 2008,2009,2010 Katalix Systems Ltd
5 *
6 * This file contains some code of the original L2TPv2 pppol2tp
7 * driver, which has the following copyright:
8 *
9 * Authors: Martijn van Oosterhout <kleptog@svana.org>
10 * James Chapman (jchapman@katalix.com)
11 * Contributors:
12 * Michal Ostrowski <mostrows@speakeasy.net>
13 * Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
14 * David S. Miller (davem@redhat.com)
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2 as
18 * published by the Free Software Foundation.
19 */
20
Joe Perchesa4ca44f2012-05-16 09:55:56 +000021#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
22
James Chapmanfd558d12010-04-02 06:18:33 +000023#include <linux/module.h>
24#include <linux/string.h>
25#include <linux/list.h>
James Chapmane02d4942010-04-02 06:19:16 +000026#include <linux/rculist.h>
James Chapmanfd558d12010-04-02 06:18:33 +000027#include <linux/uaccess.h>
28
29#include <linux/kernel.h>
30#include <linux/spinlock.h>
31#include <linux/kthread.h>
32#include <linux/sched.h>
33#include <linux/slab.h>
34#include <linux/errno.h>
35#include <linux/jiffies.h>
36
37#include <linux/netdevice.h>
38#include <linux/net.h>
39#include <linux/inetdevice.h>
40#include <linux/skbuff.h>
41#include <linux/init.h>
James Chapman0d767512010-04-02 06:19:00 +000042#include <linux/in.h>
James Chapmanfd558d12010-04-02 06:18:33 +000043#include <linux/ip.h>
44#include <linux/udp.h>
James Chapman0d767512010-04-02 06:19:00 +000045#include <linux/l2tp.h>
James Chapmanfd558d12010-04-02 06:18:33 +000046#include <linux/hash.h>
47#include <linux/sort.h>
48#include <linux/file.h>
49#include <linux/nsproxy.h>
50#include <net/net_namespace.h>
51#include <net/netns/generic.h>
52#include <net/dst.h>
53#include <net/ip.h>
54#include <net/udp.h>
Tom Herbert85644b42014-07-13 19:49:48 -070055#include <net/udp_tunnel.h>
James Chapman309795f2010-04-02 06:19:10 +000056#include <net/inet_common.h>
James Chapmanfd558d12010-04-02 06:18:33 +000057#include <net/xfrm.h>
James Chapman0d767512010-04-02 06:19:00 +000058#include <net/protocol.h>
Benjamin LaHaised2cf3362012-04-27 08:24:18 +000059#include <net/inet6_connection_sock.h>
60#include <net/inet_ecn.h>
61#include <net/ip6_route.h>
David S. Millerd499bd22012-04-30 13:21:28 -040062#include <net/ip6_checksum.h>
James Chapmanfd558d12010-04-02 06:18:33 +000063
64#include <asm/byteorder.h>
Arun Sharma600634972011-07-26 16:09:06 -070065#include <linux/atomic.h>
James Chapmanfd558d12010-04-02 06:18:33 +000066
67#include "l2tp_core.h"
68
69#define L2TP_DRV_VERSION "V2.0"
70
71/* L2TP header constants */
72#define L2TP_HDRFLAG_T 0x8000
73#define L2TP_HDRFLAG_L 0x4000
74#define L2TP_HDRFLAG_S 0x0800
75#define L2TP_HDRFLAG_O 0x0200
76#define L2TP_HDRFLAG_P 0x0100
77
78#define L2TP_HDR_VER_MASK 0x000F
79#define L2TP_HDR_VER_2 0x0002
James Chapmanf7faffa2010-04-02 06:18:49 +000080#define L2TP_HDR_VER_3 0x0003
James Chapmanfd558d12010-04-02 06:18:33 +000081
82/* L2TPv3 default L2-specific sublayer */
83#define L2TP_SLFLAG_S 0x40000000
84#define L2TP_SL_SEQ_MASK 0x00ffffff
85
86#define L2TP_HDR_SIZE_SEQ 10
87#define L2TP_HDR_SIZE_NOSEQ 6
88
89/* Default trace flags */
90#define L2TP_DEFAULT_DEBUG_FLAGS 0
91
James Chapmanfd558d12010-04-02 06:18:33 +000092/* Private data stored for received packets in the skb.
93 */
94struct l2tp_skb_cb {
James Chapmanf7faffa2010-04-02 06:18:49 +000095 u32 ns;
James Chapmanfd558d12010-04-02 06:18:33 +000096 u16 has_seq;
97 u16 length;
98 unsigned long expires;
99};
100
101#define L2TP_SKB_CB(skb) ((struct l2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])
102
103static atomic_t l2tp_tunnel_count;
104static atomic_t l2tp_session_count;
Tom Parkinf8ccac02013-01-31 23:43:00 +0000105static struct workqueue_struct *l2tp_wq;
James Chapmanfd558d12010-04-02 06:18:33 +0000106
107/* per-net private data for this module */
108static unsigned int l2tp_net_id;
109struct l2tp_net {
110 struct list_head l2tp_tunnel_list;
James Chapmane02d4942010-04-02 06:19:16 +0000111 spinlock_t l2tp_tunnel_list_lock;
James Chapmanf7faffa2010-04-02 06:18:49 +0000112 struct hlist_head l2tp_session_hlist[L2TP_HASH_SIZE_2];
James Chapmane02d4942010-04-02 06:19:16 +0000113 spinlock_t l2tp_session_hlist_lock;
James Chapmanfd558d12010-04-02 06:18:33 +0000114};
115
stephen hemmingerfc130842010-10-21 07:50:46 +0000116static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
stephen hemmingerfc130842010-10-21 07:50:46 +0000117
David S. Miller8d8a51e2013-10-08 15:44:26 -0400118static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk)
119{
120 return sk->sk_user_data;
121}
122
James Chapmanfd558d12010-04-02 06:18:33 +0000123static inline struct l2tp_net *l2tp_pernet(struct net *net)
124{
125 BUG_ON(!net);
126
127 return net_generic(net, l2tp_net_id);
128}
129
stephen hemmingerfc130842010-10-21 07:50:46 +0000130/* Tunnel reference counts. Incremented per session that is added to
131 * the tunnel.
132 */
133static inline void l2tp_tunnel_inc_refcount_1(struct l2tp_tunnel *tunnel)
134{
135 atomic_inc(&tunnel->ref_count);
136}
137
138static inline void l2tp_tunnel_dec_refcount_1(struct l2tp_tunnel *tunnel)
139{
140 if (atomic_dec_and_test(&tunnel->ref_count))
141 l2tp_tunnel_free(tunnel);
142}
143#ifdef L2TP_REFCNT_DEBUG
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000144#define l2tp_tunnel_inc_refcount(_t) \
145do { \
146 pr_debug("l2tp_tunnel_inc_refcount: %s:%d %s: cnt=%d\n", \
147 __func__, __LINE__, (_t)->name, \
148 atomic_read(&_t->ref_count)); \
149 l2tp_tunnel_inc_refcount_1(_t); \
150} while (0)
Andy Zhou29abe2f2014-09-03 13:16:54 -0700151#define l2tp_tunnel_dec_refcount(_t) \
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000152do { \
153 pr_debug("l2tp_tunnel_dec_refcount: %s:%d %s: cnt=%d\n", \
154 __func__, __LINE__, (_t)->name, \
155 atomic_read(&_t->ref_count)); \
156 l2tp_tunnel_dec_refcount_1(_t); \
157} while (0)
stephen hemmingerfc130842010-10-21 07:50:46 +0000158#else
159#define l2tp_tunnel_inc_refcount(t) l2tp_tunnel_inc_refcount_1(t)
160#define l2tp_tunnel_dec_refcount(t) l2tp_tunnel_dec_refcount_1(t)
161#endif
162
James Chapmanf7faffa2010-04-02 06:18:49 +0000163/* Session hash global list for L2TPv3.
164 * The session_id SHOULD be random according to RFC3931, but several
165 * L2TP implementations use incrementing session_ids. So we do a real
166 * hash on the session_id, rather than a simple bitmask.
167 */
168static inline struct hlist_head *
169l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
170{
171 return &pn->l2tp_session_hlist[hash_32(session_id, L2TP_HASH_BITS_2)];
172
173}
174
Tom Parkin80d84ef2013-01-22 05:13:48 +0000175/* Lookup the tunnel socket, possibly involving the fs code if the socket is
176 * owned by userspace. A struct sock returned from this function must be
177 * released using l2tp_tunnel_sock_put once you're done with it.
178 */
stephen hemmingerb5d2b282014-01-09 22:22:27 -0800179static struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel)
Tom Parkin80d84ef2013-01-22 05:13:48 +0000180{
181 int err = 0;
182 struct socket *sock = NULL;
183 struct sock *sk = NULL;
184
185 if (!tunnel)
186 goto out;
187
188 if (tunnel->fd >= 0) {
189 /* Socket is owned by userspace, who might be in the process
190 * of closing it. Look the socket up using the fd to ensure
191 * consistency.
192 */
193 sock = sockfd_lookup(tunnel->fd, &err);
194 if (sock)
195 sk = sock->sk;
196 } else {
197 /* Socket is owned by kernelspace */
198 sk = tunnel->sock;
Tom Parkin8abbbe82013-03-19 06:11:17 +0000199 sock_hold(sk);
Tom Parkin80d84ef2013-01-22 05:13:48 +0000200 }
201
202out:
203 return sk;
204}
Tom Parkin80d84ef2013-01-22 05:13:48 +0000205
206/* Drop a reference to a tunnel socket obtained via. l2tp_tunnel_sock_put */
stephen hemmingerb5d2b282014-01-09 22:22:27 -0800207static void l2tp_tunnel_sock_put(struct sock *sk)
Tom Parkin80d84ef2013-01-22 05:13:48 +0000208{
209 struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
210 if (tunnel) {
211 if (tunnel->fd >= 0) {
212 /* Socket is owned by userspace */
213 sockfd_put(sk->sk_socket);
214 }
215 sock_put(sk);
216 }
Tom Parkin8abbbe82013-03-19 06:11:17 +0000217 sock_put(sk);
Tom Parkin80d84ef2013-01-22 05:13:48 +0000218}
Tom Parkin80d84ef2013-01-22 05:13:48 +0000219
James Chapmanf7faffa2010-04-02 06:18:49 +0000220/* Lookup a session by id in the global session list
221 */
222static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
223{
224 struct l2tp_net *pn = l2tp_pernet(net);
225 struct hlist_head *session_list =
226 l2tp_session_id_hash_2(pn, session_id);
227 struct l2tp_session *session;
James Chapmanf7faffa2010-04-02 06:18:49 +0000228
James Chapmane02d4942010-04-02 06:19:16 +0000229 rcu_read_lock_bh();
Sasha Levinb67bfe02013-02-27 17:06:00 -0800230 hlist_for_each_entry_rcu(session, session_list, global_hlist) {
James Chapmanf7faffa2010-04-02 06:18:49 +0000231 if (session->session_id == session_id) {
James Chapmane02d4942010-04-02 06:19:16 +0000232 rcu_read_unlock_bh();
James Chapmanf7faffa2010-04-02 06:18:49 +0000233 return session;
234 }
235 }
James Chapmane02d4942010-04-02 06:19:16 +0000236 rcu_read_unlock_bh();
James Chapmanf7faffa2010-04-02 06:18:49 +0000237
238 return NULL;
239}
240
James Chapmanfd558d12010-04-02 06:18:33 +0000241/* Session hash list.
242 * The session_id SHOULD be random according to RFC2661, but several
243 * L2TP implementations (Cisco and Microsoft) use incrementing
244 * session_ids. So we do a real hash on the session_id, rather than a
245 * simple bitmask.
246 */
247static inline struct hlist_head *
248l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id)
249{
250 return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)];
251}
252
253/* Lookup a session by id
254 */
James Chapmanf7faffa2010-04-02 06:18:49 +0000255struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id)
James Chapmanfd558d12010-04-02 06:18:33 +0000256{
James Chapmanf7faffa2010-04-02 06:18:49 +0000257 struct hlist_head *session_list;
James Chapmanfd558d12010-04-02 06:18:33 +0000258 struct l2tp_session *session;
James Chapmanfd558d12010-04-02 06:18:33 +0000259
James Chapmanf7faffa2010-04-02 06:18:49 +0000260 /* In L2TPv3, session_ids are unique over all tunnels and we
261 * sometimes need to look them up before we know the
262 * tunnel.
263 */
264 if (tunnel == NULL)
265 return l2tp_session_find_2(net, session_id);
266
267 session_list = l2tp_session_id_hash(tunnel, session_id);
James Chapmanfd558d12010-04-02 06:18:33 +0000268 read_lock_bh(&tunnel->hlist_lock);
Sasha Levinb67bfe02013-02-27 17:06:00 -0800269 hlist_for_each_entry(session, session_list, hlist) {
James Chapmanfd558d12010-04-02 06:18:33 +0000270 if (session->session_id == session_id) {
271 read_unlock_bh(&tunnel->hlist_lock);
272 return session;
273 }
274 }
275 read_unlock_bh(&tunnel->hlist_lock);
276
277 return NULL;
278}
279EXPORT_SYMBOL_GPL(l2tp_session_find);
280
Guillaume Nault6539c4f2017-03-31 13:02:25 +0200281/* Like l2tp_session_find() but takes a reference on the returned session.
282 * Optionally calls session->ref() too if do_ref is true.
283 */
284struct l2tp_session *l2tp_session_get(struct net *net,
285 struct l2tp_tunnel *tunnel,
286 u32 session_id, bool do_ref)
287{
288 struct hlist_head *session_list;
289 struct l2tp_session *session;
290
291 if (!tunnel) {
292 struct l2tp_net *pn = l2tp_pernet(net);
293
294 session_list = l2tp_session_id_hash_2(pn, session_id);
295
296 rcu_read_lock_bh();
297 hlist_for_each_entry_rcu(session, session_list, global_hlist) {
298 if (session->session_id == session_id) {
299 l2tp_session_inc_refcount(session);
300 if (do_ref && session->ref)
301 session->ref(session);
302 rcu_read_unlock_bh();
303
304 return session;
305 }
306 }
307 rcu_read_unlock_bh();
308
309 return NULL;
310 }
311
312 session_list = l2tp_session_id_hash(tunnel, session_id);
313 read_lock_bh(&tunnel->hlist_lock);
314 hlist_for_each_entry(session, session_list, hlist) {
315 if (session->session_id == session_id) {
316 l2tp_session_inc_refcount(session);
317 if (do_ref && session->ref)
318 session->ref(session);
319 read_unlock_bh(&tunnel->hlist_lock);
320
321 return session;
322 }
323 }
324 read_unlock_bh(&tunnel->hlist_lock);
325
326 return NULL;
327}
328EXPORT_SYMBOL_GPL(l2tp_session_get);
329
Guillaume Naultb7902602017-04-03 12:03:13 +0200330struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth,
331 bool do_ref)
James Chapmanfd558d12010-04-02 06:18:33 +0000332{
333 int hash;
James Chapmanfd558d12010-04-02 06:18:33 +0000334 struct l2tp_session *session;
335 int count = 0;
336
337 read_lock_bh(&tunnel->hlist_lock);
338 for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
Sasha Levinb67bfe02013-02-27 17:06:00 -0800339 hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {
James Chapmanfd558d12010-04-02 06:18:33 +0000340 if (++count > nth) {
Guillaume Naultb7902602017-04-03 12:03:13 +0200341 l2tp_session_inc_refcount(session);
342 if (do_ref && session->ref)
343 session->ref(session);
James Chapmanfd558d12010-04-02 06:18:33 +0000344 read_unlock_bh(&tunnel->hlist_lock);
345 return session;
346 }
347 }
348 }
349
350 read_unlock_bh(&tunnel->hlist_lock);
351
352 return NULL;
353}
Guillaume Naultb7902602017-04-03 12:03:13 +0200354EXPORT_SYMBOL_GPL(l2tp_session_get_nth);
James Chapmanfd558d12010-04-02 06:18:33 +0000355
James Chapman309795f2010-04-02 06:19:10 +0000356/* Lookup a session by interface name.
357 * This is very inefficient but is only used by management interfaces.
358 */
Guillaume Nault08cb8e52017-03-31 13:02:30 +0200359struct l2tp_session *l2tp_session_get_by_ifname(struct net *net, char *ifname,
360 bool do_ref)
James Chapman309795f2010-04-02 06:19:10 +0000361{
362 struct l2tp_net *pn = l2tp_pernet(net);
363 int hash;
James Chapman309795f2010-04-02 06:19:10 +0000364 struct l2tp_session *session;
365
James Chapmane02d4942010-04-02 06:19:16 +0000366 rcu_read_lock_bh();
James Chapman309795f2010-04-02 06:19:10 +0000367 for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) {
Sasha Levinb67bfe02013-02-27 17:06:00 -0800368 hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {
James Chapman309795f2010-04-02 06:19:10 +0000369 if (!strcmp(session->ifname, ifname)) {
Guillaume Nault08cb8e52017-03-31 13:02:30 +0200370 l2tp_session_inc_refcount(session);
371 if (do_ref && session->ref)
372 session->ref(session);
James Chapmane02d4942010-04-02 06:19:16 +0000373 rcu_read_unlock_bh();
Guillaume Nault08cb8e52017-03-31 13:02:30 +0200374
James Chapman309795f2010-04-02 06:19:10 +0000375 return session;
376 }
377 }
378 }
379
James Chapmane02d4942010-04-02 06:19:16 +0000380 rcu_read_unlock_bh();
James Chapman309795f2010-04-02 06:19:10 +0000381
382 return NULL;
383}
Guillaume Nault08cb8e52017-03-31 13:02:30 +0200384EXPORT_SYMBOL_GPL(l2tp_session_get_by_ifname);
James Chapman309795f2010-04-02 06:19:10 +0000385
Guillaume Naultd9face62017-03-31 13:02:27 +0200386static int l2tp_session_add_to_tunnel(struct l2tp_tunnel *tunnel,
387 struct l2tp_session *session)
388{
389 struct l2tp_session *session_walk;
390 struct hlist_head *g_head;
391 struct hlist_head *head;
392 struct l2tp_net *pn;
393
394 head = l2tp_session_id_hash(tunnel, session->session_id);
395
396 write_lock_bh(&tunnel->hlist_lock);
397 hlist_for_each_entry(session_walk, head, hlist)
398 if (session_walk->session_id == session->session_id)
399 goto exist;
400
401 if (tunnel->version == L2TP_HDR_VER_3) {
402 pn = l2tp_pernet(tunnel->l2tp_net);
403 g_head = l2tp_session_id_hash_2(l2tp_pernet(tunnel->l2tp_net),
404 session->session_id);
405
406 spin_lock_bh(&pn->l2tp_session_hlist_lock);
407 hlist_for_each_entry(session_walk, g_head, global_hlist)
408 if (session_walk->session_id == session->session_id)
409 goto exist_glob;
410
411 hlist_add_head_rcu(&session->global_hlist, g_head);
412 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
413 }
414
415 hlist_add_head(&session->hlist, head);
416 write_unlock_bh(&tunnel->hlist_lock);
417
418 return 0;
419
420exist_glob:
421 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
422exist:
423 write_unlock_bh(&tunnel->hlist_lock);
424
425 return -EEXIST;
426}
427
James Chapmanfd558d12010-04-02 06:18:33 +0000428/* Lookup a tunnel by id
429 */
430struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id)
431{
432 struct l2tp_tunnel *tunnel;
433 struct l2tp_net *pn = l2tp_pernet(net);
434
James Chapmane02d4942010-04-02 06:19:16 +0000435 rcu_read_lock_bh();
436 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
James Chapmanfd558d12010-04-02 06:18:33 +0000437 if (tunnel->tunnel_id == tunnel_id) {
James Chapmane02d4942010-04-02 06:19:16 +0000438 rcu_read_unlock_bh();
James Chapmanfd558d12010-04-02 06:18:33 +0000439 return tunnel;
440 }
441 }
James Chapmane02d4942010-04-02 06:19:16 +0000442 rcu_read_unlock_bh();
James Chapmanfd558d12010-04-02 06:18:33 +0000443
444 return NULL;
445}
446EXPORT_SYMBOL_GPL(l2tp_tunnel_find);
447
448struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth)
449{
450 struct l2tp_net *pn = l2tp_pernet(net);
451 struct l2tp_tunnel *tunnel;
452 int count = 0;
453
James Chapmane02d4942010-04-02 06:19:16 +0000454 rcu_read_lock_bh();
455 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
James Chapmanfd558d12010-04-02 06:18:33 +0000456 if (++count > nth) {
James Chapmane02d4942010-04-02 06:19:16 +0000457 rcu_read_unlock_bh();
James Chapmanfd558d12010-04-02 06:18:33 +0000458 return tunnel;
459 }
460 }
461
James Chapmane02d4942010-04-02 06:19:16 +0000462 rcu_read_unlock_bh();
James Chapmanfd558d12010-04-02 06:18:33 +0000463
464 return NULL;
465}
466EXPORT_SYMBOL_GPL(l2tp_tunnel_find_nth);
467
468/*****************************************************************************
469 * Receive data handling
470 *****************************************************************************/
471
472/* Queue a skb in order. We come here only if the skb has an L2TP sequence
473 * number.
474 */
475static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)
476{
477 struct sk_buff *skbp;
478 struct sk_buff *tmp;
James Chapmanf7faffa2010-04-02 06:18:49 +0000479 u32 ns = L2TP_SKB_CB(skb)->ns;
James Chapmanfd558d12010-04-02 06:18:33 +0000480
481 spin_lock_bh(&session->reorder_q.lock);
482 skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
483 if (L2TP_SKB_CB(skbp)->ns > ns) {
484 __skb_queue_before(&session->reorder_q, skbp, skb);
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000485 l2tp_dbg(session, L2TP_MSG_SEQ,
486 "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
487 session->name, ns, L2TP_SKB_CB(skbp)->ns,
488 skb_queue_len(&session->reorder_q));
Tom Parkin7b7c0712013-03-19 06:11:22 +0000489 atomic_long_inc(&session->stats.rx_oos_packets);
James Chapmanfd558d12010-04-02 06:18:33 +0000490 goto out;
491 }
492 }
493
494 __skb_queue_tail(&session->reorder_q, skb);
495
496out:
497 spin_unlock_bh(&session->reorder_q.lock);
498}
499
500/* Dequeue a single skb.
501 */
502static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)
503{
504 struct l2tp_tunnel *tunnel = session->tunnel;
505 int length = L2TP_SKB_CB(skb)->length;
506
507 /* We're about to requeue the skb, so return resources
508 * to its current owner (a socket receive buffer).
509 */
510 skb_orphan(skb);
511
Tom Parkin7b7c0712013-03-19 06:11:22 +0000512 atomic_long_inc(&tunnel->stats.rx_packets);
513 atomic_long_add(length, &tunnel->stats.rx_bytes);
514 atomic_long_inc(&session->stats.rx_packets);
515 atomic_long_add(length, &session->stats.rx_bytes);
James Chapmanfd558d12010-04-02 06:18:33 +0000516
517 if (L2TP_SKB_CB(skb)->has_seq) {
518 /* Bump our Nr */
519 session->nr++;
James Chapman8a1631d2013-07-02 20:28:59 +0100520 session->nr &= session->nr_max;
James Chapmanf7faffa2010-04-02 06:18:49 +0000521
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000522 l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated nr to %hu\n",
523 session->name, session->nr);
James Chapmanfd558d12010-04-02 06:18:33 +0000524 }
525
526 /* call private receive handler */
527 if (session->recv_skb != NULL)
528 (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);
529 else
530 kfree_skb(skb);
531
532 if (session->deref)
533 (*session->deref)(session);
534}
535
536/* Dequeue skbs from the session's reorder_q, subject to packet order.
537 * Skbs that have been in the queue for too long are simply discarded.
538 */
539static void l2tp_recv_dequeue(struct l2tp_session *session)
540{
541 struct sk_buff *skb;
542 struct sk_buff *tmp;
543
544 /* If the pkt at the head of the queue has the nr that we
545 * expect to send up next, dequeue it and any other
546 * in-sequence packets behind it.
547 */
Eric Dumazete2e210c2011-11-02 22:47:44 +0000548start:
James Chapmanfd558d12010-04-02 06:18:33 +0000549 spin_lock_bh(&session->reorder_q.lock);
550 skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
551 if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) {
Tom Parkin7b7c0712013-03-19 06:11:22 +0000552 atomic_long_inc(&session->stats.rx_seq_discards);
553 atomic_long_inc(&session->stats.rx_errors);
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000554 l2tp_dbg(session, L2TP_MSG_SEQ,
555 "%s: oos pkt %u len %d discarded (too old), waiting for %u, reorder_q_len=%d\n",
556 session->name, L2TP_SKB_CB(skb)->ns,
557 L2TP_SKB_CB(skb)->length, session->nr,
558 skb_queue_len(&session->reorder_q));
James Chapman38d40b32012-05-09 23:43:08 +0000559 session->reorder_skip = 1;
James Chapmanfd558d12010-04-02 06:18:33 +0000560 __skb_unlink(skb, &session->reorder_q);
561 kfree_skb(skb);
562 if (session->deref)
563 (*session->deref)(session);
564 continue;
565 }
566
567 if (L2TP_SKB_CB(skb)->has_seq) {
James Chapman38d40b32012-05-09 23:43:08 +0000568 if (session->reorder_skip) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000569 l2tp_dbg(session, L2TP_MSG_SEQ,
570 "%s: advancing nr to next pkt: %u -> %u",
571 session->name, session->nr,
572 L2TP_SKB_CB(skb)->ns);
James Chapman38d40b32012-05-09 23:43:08 +0000573 session->reorder_skip = 0;
574 session->nr = L2TP_SKB_CB(skb)->ns;
575 }
James Chapmanfd558d12010-04-02 06:18:33 +0000576 if (L2TP_SKB_CB(skb)->ns != session->nr) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000577 l2tp_dbg(session, L2TP_MSG_SEQ,
578 "%s: holding oos pkt %u len %d, waiting for %u, reorder_q_len=%d\n",
579 session->name, L2TP_SKB_CB(skb)->ns,
580 L2TP_SKB_CB(skb)->length, session->nr,
581 skb_queue_len(&session->reorder_q));
James Chapmanfd558d12010-04-02 06:18:33 +0000582 goto out;
583 }
584 }
585 __skb_unlink(skb, &session->reorder_q);
586
587 /* Process the skb. We release the queue lock while we
588 * do so to let other contexts process the queue.
589 */
590 spin_unlock_bh(&session->reorder_q.lock);
591 l2tp_recv_dequeue_skb(session, skb);
Eric Dumazete2e210c2011-11-02 22:47:44 +0000592 goto start;
James Chapmanfd558d12010-04-02 06:18:33 +0000593 }
594
595out:
596 spin_unlock_bh(&session->reorder_q.lock);
597}
598
James Chapman8a1631d2013-07-02 20:28:59 +0100599static int l2tp_seq_check_rx_window(struct l2tp_session *session, u32 nr)
600{
601 u32 nws;
602
603 if (nr >= session->nr)
604 nws = nr - session->nr;
605 else
606 nws = (session->nr_max + 1) - (session->nr - nr);
607
608 return nws < session->nr_window_size;
609}
610
James Chapmanb6dc01a2013-07-02 20:28:58 +0100611/* If packet has sequence numbers, queue it if acceptable. Returns 0 if
612 * acceptable, else non-zero.
613 */
614static int l2tp_recv_data_seq(struct l2tp_session *session, struct sk_buff *skb)
615{
James Chapman8a1631d2013-07-02 20:28:59 +0100616 if (!l2tp_seq_check_rx_window(session, L2TP_SKB_CB(skb)->ns)) {
617 /* Packet sequence number is outside allowed window.
618 * Discard it.
619 */
620 l2tp_dbg(session, L2TP_MSG_SEQ,
621 "%s: pkt %u len %d discarded, outside window, nr=%u\n",
622 session->name, L2TP_SKB_CB(skb)->ns,
623 L2TP_SKB_CB(skb)->length, session->nr);
624 goto discard;
625 }
626
James Chapmanb6dc01a2013-07-02 20:28:58 +0100627 if (session->reorder_timeout != 0) {
628 /* Packet reordering enabled. Add skb to session's
629 * reorder queue, in order of ns.
630 */
631 l2tp_recv_queue_skb(session, skb);
James Chapmana0dbd822013-07-02 20:29:00 +0100632 goto out;
633 }
634
635 /* Packet reordering disabled. Discard out-of-sequence packets, while
636 * tracking the number if in-sequence packets after the first OOS packet
637 * is seen. After nr_oos_count_max in-sequence packets, reset the
638 * sequence number to re-enable packet reception.
639 */
640 if (L2TP_SKB_CB(skb)->ns == session->nr) {
641 skb_queue_tail(&session->reorder_q, skb);
James Chapmanb6dc01a2013-07-02 20:28:58 +0100642 } else {
James Chapmana0dbd822013-07-02 20:29:00 +0100643 u32 nr_oos = L2TP_SKB_CB(skb)->ns;
644 u32 nr_next = (session->nr_oos + 1) & session->nr_max;
645
646 if (nr_oos == nr_next)
647 session->nr_oos_count++;
648 else
649 session->nr_oos_count = 0;
650
651 session->nr_oos = nr_oos;
652 if (session->nr_oos_count > session->nr_oos_count_max) {
653 session->reorder_skip = 1;
654 l2tp_dbg(session, L2TP_MSG_SEQ,
655 "%s: %d oos packets received. Resetting sequence numbers\n",
656 session->name, session->nr_oos_count);
657 }
658 if (!session->reorder_skip) {
James Chapmanb6dc01a2013-07-02 20:28:58 +0100659 atomic_long_inc(&session->stats.rx_seq_discards);
660 l2tp_dbg(session, L2TP_MSG_SEQ,
661 "%s: oos pkt %u len %d discarded, waiting for %u, reorder_q_len=%d\n",
662 session->name, L2TP_SKB_CB(skb)->ns,
663 L2TP_SKB_CB(skb)->length, session->nr,
664 skb_queue_len(&session->reorder_q));
665 goto discard;
666 }
667 skb_queue_tail(&session->reorder_q, skb);
668 }
669
James Chapmana0dbd822013-07-02 20:29:00 +0100670out:
James Chapmanb6dc01a2013-07-02 20:28:58 +0100671 return 0;
672
673discard:
674 return 1;
675}
676
James Chapmanf7faffa2010-04-02 06:18:49 +0000677/* Do receive processing of L2TP data frames. We handle both L2TPv2
678 * and L2TPv3 data frames here.
679 *
680 * L2TPv2 Data Message Header
681 *
682 * 0 1 2 3
683 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
684 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
685 * |T|L|x|x|S|x|O|P|x|x|x|x| Ver | Length (opt) |
686 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
687 * | Tunnel ID | Session ID |
688 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
689 * | Ns (opt) | Nr (opt) |
690 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
691 * | Offset Size (opt) | Offset pad... (opt)
692 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
693 *
694 * Data frames are marked by T=0. All other fields are the same as
695 * those in L2TP control frames.
696 *
697 * L2TPv3 Data Message Header
698 *
699 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
700 * | L2TP Session Header |
701 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
702 * | L2-Specific Sublayer |
703 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
704 * | Tunnel Payload ...
705 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
706 *
707 * L2TPv3 Session Header Over IP
708 *
709 * 0 1 2 3
710 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
711 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
712 * | Session ID |
713 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
714 * | Cookie (optional, maximum 64 bits)...
715 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
716 * |
717 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
718 *
719 * L2TPv3 L2-Specific Sublayer Format
720 *
721 * 0 1 2 3
722 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
723 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
724 * |x|S|x|x|x|x|x|x| Sequence Number |
725 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
726 *
727 * Cookie value, sublayer format and offset (pad) are negotiated with
728 * the peer when the session is set up. Unlike L2TPv2, we do not need
729 * to parse the packet header to determine if optional fields are
730 * present.
731 *
732 * Caller must already have parsed the frame and determined that it is
733 * a data (not control) frame before coming here. Fields up to the
734 * session-id have already been parsed and ptr points to the data
735 * after the session-id.
Guillaume Nault6539c4f2017-03-31 13:02:25 +0200736 *
737 * session->ref() must have been called prior to l2tp_recv_common().
738 * session->deref() will be called automatically after skb is processed.
James Chapmanfd558d12010-04-02 06:18:33 +0000739 */
James Chapmanf7faffa2010-04-02 06:18:49 +0000740void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
741 unsigned char *ptr, unsigned char *optr, u16 hdrflags,
Guillaume Nault9532aa62018-07-25 14:53:33 +0200742 int length)
James Chapmanfd558d12010-04-02 06:18:33 +0000743{
James Chapmanf7faffa2010-04-02 06:18:49 +0000744 struct l2tp_tunnel *tunnel = session->tunnel;
James Chapmanfd558d12010-04-02 06:18:33 +0000745 int offset;
James Chapmanf7faffa2010-04-02 06:18:49 +0000746 u32 ns, nr;
James Chapmanfd558d12010-04-02 06:18:33 +0000747
James Chapmanf7faffa2010-04-02 06:18:49 +0000748 /* Parse and check optional cookie */
749 if (session->peer_cookie_len > 0) {
750 if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000751 l2tp_info(tunnel, L2TP_MSG_DATA,
752 "%s: cookie mismatch (%u/%u). Discarding.\n",
753 tunnel->name, tunnel->tunnel_id,
754 session->session_id);
Tom Parkin7b7c0712013-03-19 06:11:22 +0000755 atomic_long_inc(&session->stats.rx_cookie_discards);
James Chapmanf7faffa2010-04-02 06:18:49 +0000756 goto discard;
757 }
758 ptr += session->peer_cookie_len;
759 }
760
James Chapmanfd558d12010-04-02 06:18:33 +0000761 /* Handle the optional sequence numbers. Sequence numbers are
762 * in different places for L2TPv2 and L2TPv3.
763 *
764 * If we are the LAC, enable/disable sequence numbers under
765 * the control of the LNS. If no sequence numbers present but
766 * we were expecting them, discard frame.
767 */
768 ns = nr = 0;
769 L2TP_SKB_CB(skb)->has_seq = 0;
James Chapmanf7faffa2010-04-02 06:18:49 +0000770 if (tunnel->version == L2TP_HDR_VER_2) {
771 if (hdrflags & L2TP_HDRFLAG_S) {
772 ns = ntohs(*(__be16 *) ptr);
773 ptr += 2;
774 nr = ntohs(*(__be16 *) ptr);
775 ptr += 2;
James Chapmanfd558d12010-04-02 06:18:33 +0000776
James Chapmanf7faffa2010-04-02 06:18:49 +0000777 /* Store L2TP info in the skb */
778 L2TP_SKB_CB(skb)->ns = ns;
779 L2TP_SKB_CB(skb)->has_seq = 1;
James Chapmanfd558d12010-04-02 06:18:33 +0000780
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000781 l2tp_dbg(session, L2TP_MSG_SEQ,
782 "%s: recv data ns=%u, nr=%u, session nr=%u\n",
783 session->name, ns, nr, session->nr);
James Chapmanf7faffa2010-04-02 06:18:49 +0000784 }
785 } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
786 u32 l2h = ntohl(*(__be32 *) ptr);
787
788 if (l2h & 0x40000000) {
789 ns = l2h & 0x00ffffff;
790
791 /* Store L2TP info in the skb */
792 L2TP_SKB_CB(skb)->ns = ns;
793 L2TP_SKB_CB(skb)->has_seq = 1;
794
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000795 l2tp_dbg(session, L2TP_MSG_SEQ,
796 "%s: recv data ns=%u, session nr=%u\n",
797 session->name, ns, session->nr);
James Chapmanf7faffa2010-04-02 06:18:49 +0000798 }
James Chapmanfd558d12010-04-02 06:18:33 +0000799 }
800
James Chapmanf7faffa2010-04-02 06:18:49 +0000801 /* Advance past L2-specific header, if present */
802 ptr += session->l2specific_len;
803
James Chapmanfd558d12010-04-02 06:18:33 +0000804 if (L2TP_SKB_CB(skb)->has_seq) {
805 /* Received a packet with sequence numbers. If we're the LNS,
806 * check if we sre sending sequence numbers and if not,
807 * configure it so.
808 */
809 if ((!session->lns_mode) && (!session->send_seq)) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000810 l2tp_info(session, L2TP_MSG_SEQ,
811 "%s: requested to enable seq numbers by LNS\n",
812 session->name);
James Chapmanfd558d12010-04-02 06:18:33 +0000813 session->send_seq = -1;
James Chapmanf7faffa2010-04-02 06:18:49 +0000814 l2tp_session_set_header_len(session, tunnel->version);
James Chapmanfd558d12010-04-02 06:18:33 +0000815 }
816 } else {
817 /* No sequence numbers.
818 * If user has configured mandatory sequence numbers, discard.
819 */
820 if (session->recv_seq) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000821 l2tp_warn(session, L2TP_MSG_SEQ,
822 "%s: recv data has no seq numbers when required. Discarding.\n",
823 session->name);
Tom Parkin7b7c0712013-03-19 06:11:22 +0000824 atomic_long_inc(&session->stats.rx_seq_discards);
James Chapmanfd558d12010-04-02 06:18:33 +0000825 goto discard;
826 }
827
828 /* If we're the LAC and we're sending sequence numbers, the
829 * LNS has requested that we no longer send sequence numbers.
830 * If we're the LNS and we're sending sequence numbers, the
831 * LAC is broken. Discard the frame.
832 */
833 if ((!session->lns_mode) && (session->send_seq)) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000834 l2tp_info(session, L2TP_MSG_SEQ,
835 "%s: requested to disable seq numbers by LNS\n",
836 session->name);
James Chapmanfd558d12010-04-02 06:18:33 +0000837 session->send_seq = 0;
James Chapmanf7faffa2010-04-02 06:18:49 +0000838 l2tp_session_set_header_len(session, tunnel->version);
James Chapmanfd558d12010-04-02 06:18:33 +0000839 } else if (session->send_seq) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000840 l2tp_warn(session, L2TP_MSG_SEQ,
841 "%s: recv data has no seq numbers when required. Discarding.\n",
842 session->name);
Tom Parkin7b7c0712013-03-19 06:11:22 +0000843 atomic_long_inc(&session->stats.rx_seq_discards);
James Chapmanfd558d12010-04-02 06:18:33 +0000844 goto discard;
845 }
846 }
847
James Chapman65b05d02018-01-03 22:48:06 +0000848 /* Session data offset is defined only for L2TPv2 and is
849 * indicated by an optional 16-bit value in the header.
James Chapmanf7faffa2010-04-02 06:18:49 +0000850 */
851 if (tunnel->version == L2TP_HDR_VER_2) {
852 /* If offset bit set, skip it. */
853 if (hdrflags & L2TP_HDRFLAG_O) {
854 offset = ntohs(*(__be16 *)ptr);
855 ptr += 2 + offset;
856 }
James Chapman65b05d02018-01-03 22:48:06 +0000857 }
James Chapmanfd558d12010-04-02 06:18:33 +0000858
859 offset = ptr - optr;
860 if (!pskb_may_pull(skb, offset))
861 goto discard;
862
863 __skb_pull(skb, offset);
864
James Chapmanfd558d12010-04-02 06:18:33 +0000865 /* Prepare skb for adding to the session's reorder_q. Hold
866 * packets for max reorder_timeout or 1 second if not
867 * reordering.
868 */
869 L2TP_SKB_CB(skb)->length = length;
870 L2TP_SKB_CB(skb)->expires = jiffies +
871 (session->reorder_timeout ? session->reorder_timeout : HZ);
872
873 /* Add packet to the session's receive queue. Reordering is done here, if
874 * enabled. Saved L2TP protocol info is stored in skb->sb[].
875 */
876 if (L2TP_SKB_CB(skb)->has_seq) {
James Chapmanb6dc01a2013-07-02 20:28:58 +0100877 if (l2tp_recv_data_seq(session, skb))
878 goto discard;
James Chapmanfd558d12010-04-02 06:18:33 +0000879 } else {
880 /* No sequence numbers. Add the skb to the tail of the
881 * reorder queue. This ensures that it will be
882 * delivered after all previous sequenced skbs.
883 */
884 skb_queue_tail(&session->reorder_q, skb);
885 }
886
887 /* Try to dequeue as many skbs from reorder_q as we can. */
888 l2tp_recv_dequeue(session);
889
James Chapmanf7faffa2010-04-02 06:18:49 +0000890 return;
James Chapmanfd558d12010-04-02 06:18:33 +0000891
892discard:
Tom Parkin7b7c0712013-03-19 06:11:22 +0000893 atomic_long_inc(&session->stats.rx_errors);
James Chapmanfd558d12010-04-02 06:18:33 +0000894 kfree_skb(skb);
895
896 if (session->deref)
897 (*session->deref)(session);
James Chapmanf7faffa2010-04-02 06:18:49 +0000898}
899EXPORT_SYMBOL(l2tp_recv_common);
900
Tom Parkin48f72f92013-03-19 06:11:19 +0000901/* Drop skbs from the session's reorder_q
902 */
903int l2tp_session_queue_purge(struct l2tp_session *session)
904{
905 struct sk_buff *skb = NULL;
906 BUG_ON(!session);
907 BUG_ON(session->magic != L2TP_SESSION_MAGIC);
908 while ((skb = skb_dequeue(&session->reorder_q))) {
909 atomic_long_inc(&session->stats.rx_errors);
910 kfree_skb(skb);
911 if (session->deref)
912 (*session->deref)(session);
913 }
914 return 0;
915}
916EXPORT_SYMBOL_GPL(l2tp_session_queue_purge);
917
James Chapmanf7faffa2010-04-02 06:18:49 +0000918/* Internal UDP receive frame. Do the real work of receiving an L2TP data frame
919 * here. The skb is not on a list when we get here.
920 * Returns 0 if the packet was a data packet and was successfully passed on.
921 * Returns 1 if the packet was not a good data packet and could not be
922 * forwarded. All such packets are passed up to userspace to deal with.
923 */
Guillaume Nault9532aa62018-07-25 14:53:33 +0200924static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb)
James Chapmanf7faffa2010-04-02 06:18:49 +0000925{
926 struct l2tp_session *session = NULL;
927 unsigned char *ptr, *optr;
928 u16 hdrflags;
929 u32 tunnel_id, session_id;
James Chapmanf7faffa2010-04-02 06:18:49 +0000930 u16 version;
931 int length;
932
Tom Herbert58d60852014-05-07 16:52:48 -0700933 /* UDP has verifed checksum */
James Chapmanf7faffa2010-04-02 06:18:49 +0000934
935 /* UDP always verifies the packet length. */
936 __skb_pull(skb, sizeof(struct udphdr));
937
938 /* Short packet? */
939 if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000940 l2tp_info(tunnel, L2TP_MSG_DATA,
941 "%s: recv short packet (len=%d)\n",
942 tunnel->name, skb->len);
James Chapmanf7faffa2010-04-02 06:18:49 +0000943 goto error;
944 }
945
James Chapmanf7faffa2010-04-02 06:18:49 +0000946 /* Trace packet contents, if enabled */
947 if (tunnel->debug & L2TP_MSG_DATA) {
948 length = min(32u, skb->len);
949 if (!pskb_may_pull(skb, length))
950 goto error;
951
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000952 pr_debug("%s: recv\n", tunnel->name);
953 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length);
James Chapmanf7faffa2010-04-02 06:18:49 +0000954 }
955
Eric Dumazete50e7052011-11-08 13:59:44 -0500956 /* Point to L2TP header */
957 optr = ptr = skb->data;
958
James Chapmanf7faffa2010-04-02 06:18:49 +0000959 /* Get L2TP header flags */
960 hdrflags = ntohs(*(__be16 *) ptr);
961
962 /* Check protocol version */
963 version = hdrflags & L2TP_HDR_VER_MASK;
964 if (version != tunnel->version) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000965 l2tp_info(tunnel, L2TP_MSG_DATA,
966 "%s: recv protocol version mismatch: got %d expected %d\n",
967 tunnel->name, version, tunnel->version);
James Chapmanf7faffa2010-04-02 06:18:49 +0000968 goto error;
969 }
970
971 /* Get length of L2TP packet */
972 length = skb->len;
973
974 /* If type is control packet, it is handled by userspace. */
975 if (hdrflags & L2TP_HDRFLAG_T) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +0000976 l2tp_dbg(tunnel, L2TP_MSG_DATA,
977 "%s: recv control packet, len=%d\n",
978 tunnel->name, length);
James Chapmanf7faffa2010-04-02 06:18:49 +0000979 goto error;
980 }
981
982 /* Skip flags */
983 ptr += 2;
984
985 if (tunnel->version == L2TP_HDR_VER_2) {
986 /* If length is present, skip it */
987 if (hdrflags & L2TP_HDRFLAG_L)
988 ptr += 2;
989
990 /* Extract tunnel and session ID */
991 tunnel_id = ntohs(*(__be16 *) ptr);
992 ptr += 2;
993 session_id = ntohs(*(__be16 *) ptr);
994 ptr += 2;
995 } else {
996 ptr += 2; /* skip reserved bits */
997 tunnel_id = tunnel->tunnel_id;
998 session_id = ntohl(*(__be32 *) ptr);
999 ptr += 4;
1000 }
1001
1002 /* Find the session context */
Guillaume Nault6539c4f2017-03-31 13:02:25 +02001003 session = l2tp_session_get(tunnel->l2tp_net, tunnel, session_id, true);
James Chapman309795f2010-04-02 06:19:10 +00001004 if (!session || !session->recv_skb) {
Guillaume Nault6539c4f2017-03-31 13:02:25 +02001005 if (session) {
1006 if (session->deref)
1007 session->deref(session);
1008 l2tp_session_dec_refcount(session);
1009 }
1010
James Chapmanf7faffa2010-04-02 06:18:49 +00001011 /* Not found? Pass to userspace to deal with */
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001012 l2tp_info(tunnel, L2TP_MSG_DATA,
1013 "%s: no session found (%u/%u). Passing up.\n",
1014 tunnel->name, tunnel_id, session_id);
James Chapmanf7faffa2010-04-02 06:18:49 +00001015 goto error;
1016 }
1017
Guillaume Nault9532aa62018-07-25 14:53:33 +02001018 l2tp_recv_common(session, skb, ptr, optr, hdrflags, length);
Guillaume Nault6539c4f2017-03-31 13:02:25 +02001019 l2tp_session_dec_refcount(session);
James Chapmanfd558d12010-04-02 06:18:33 +00001020
1021 return 0;
1022
James Chapmanfd558d12010-04-02 06:18:33 +00001023error:
1024 /* Put UDP header back */
1025 __skb_push(skb, sizeof(struct udphdr));
1026
1027 return 1;
1028}
James Chapmanfd558d12010-04-02 06:18:33 +00001029
1030/* UDP encapsulation receive handler. See net/ipv4/udp.c.
1031 * Return codes:
1032 * 0 : success.
1033 * <0: error
1034 * >0: skb should be passed up to userspace as UDP.
1035 */
1036int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
1037{
1038 struct l2tp_tunnel *tunnel;
1039
1040 tunnel = l2tp_sock_to_tunnel(sk);
1041 if (tunnel == NULL)
1042 goto pass_up;
1043
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001044 l2tp_dbg(tunnel, L2TP_MSG_DATA, "%s: received %d bytes\n",
1045 tunnel->name, skb->len);
James Chapmanfd558d12010-04-02 06:18:33 +00001046
Guillaume Nault9532aa62018-07-25 14:53:33 +02001047 if (l2tp_udp_recv_core(tunnel, skb))
James Chapmanfd558d12010-04-02 06:18:33 +00001048 goto pass_up_put;
1049
1050 sock_put(sk);
1051 return 0;
1052
1053pass_up_put:
1054 sock_put(sk);
1055pass_up:
1056 return 1;
1057}
1058EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv);
1059
1060/************************************************************************
1061 * Transmit handling
1062 ***********************************************************************/
1063
1064/* Build an L2TP header for the session into the buffer provided.
1065 */
James Chapmanf7faffa2010-04-02 06:18:49 +00001066static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
James Chapmanfd558d12010-04-02 06:18:33 +00001067{
James Chapmanf7faffa2010-04-02 06:18:49 +00001068 struct l2tp_tunnel *tunnel = session->tunnel;
James Chapmanfd558d12010-04-02 06:18:33 +00001069 __be16 *bufp = buf;
James Chapmanf7faffa2010-04-02 06:18:49 +00001070 __be16 *optr = buf;
James Chapmanfd558d12010-04-02 06:18:33 +00001071 u16 flags = L2TP_HDR_VER_2;
1072 u32 tunnel_id = tunnel->peer_tunnel_id;
1073 u32 session_id = session->peer_session_id;
1074
1075 if (session->send_seq)
1076 flags |= L2TP_HDRFLAG_S;
1077
1078 /* Setup L2TP header. */
1079 *bufp++ = htons(flags);
1080 *bufp++ = htons(tunnel_id);
1081 *bufp++ = htons(session_id);
1082 if (session->send_seq) {
1083 *bufp++ = htons(session->ns);
1084 *bufp++ = 0;
1085 session->ns++;
James Chapmanf7faffa2010-04-02 06:18:49 +00001086 session->ns &= 0xffff;
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001087 l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated ns to %u\n",
1088 session->name, session->ns);
James Chapmanfd558d12010-04-02 06:18:33 +00001089 }
James Chapmanf7faffa2010-04-02 06:18:49 +00001090
1091 return bufp - optr;
James Chapmanfd558d12010-04-02 06:18:33 +00001092}
1093
James Chapmanf7faffa2010-04-02 06:18:49 +00001094static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
James Chapmanfd558d12010-04-02 06:18:33 +00001095{
James Chapman0d767512010-04-02 06:19:00 +00001096 struct l2tp_tunnel *tunnel = session->tunnel;
James Chapmanf7faffa2010-04-02 06:18:49 +00001097 char *bufp = buf;
1098 char *optr = bufp;
James Chapmanfd558d12010-04-02 06:18:33 +00001099
James Chapman0d767512010-04-02 06:19:00 +00001100 /* Setup L2TP header. The header differs slightly for UDP and
1101 * IP encapsulations. For UDP, there is 4 bytes of flags.
1102 */
1103 if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
1104 u16 flags = L2TP_HDR_VER_3;
1105 *((__be16 *) bufp) = htons(flags);
1106 bufp += 2;
1107 *((__be16 *) bufp) = 0;
1108 bufp += 2;
1109 }
1110
James Chapmanf7faffa2010-04-02 06:18:49 +00001111 *((__be32 *) bufp) = htonl(session->peer_session_id);
1112 bufp += 4;
1113 if (session->cookie_len) {
1114 memcpy(bufp, &session->cookie[0], session->cookie_len);
1115 bufp += session->cookie_len;
1116 }
1117 if (session->l2specific_len) {
1118 if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
1119 u32 l2h = 0;
1120 if (session->send_seq) {
1121 l2h = 0x40000000 | session->ns;
1122 session->ns++;
1123 session->ns &= 0xffffff;
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001124 l2tp_dbg(session, L2TP_MSG_SEQ,
1125 "%s: updated ns to %u\n",
1126 session->name, session->ns);
James Chapmanf7faffa2010-04-02 06:18:49 +00001127 }
1128
1129 *((__be32 *) bufp) = htonl(l2h);
1130 }
1131 bufp += session->l2specific_len;
1132 }
James Chapmanf7faffa2010-04-02 06:18:49 +00001133
1134 return bufp - optr;
James Chapmanfd558d12010-04-02 06:18:33 +00001135}
James Chapmanfd558d12010-04-02 06:18:33 +00001136
stephen hemmingerfc130842010-10-21 07:50:46 +00001137static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
David S. Millerd9d8da82011-05-06 22:23:20 -07001138 struct flowi *fl, size_t data_len)
James Chapmanfd558d12010-04-02 06:18:33 +00001139{
1140 struct l2tp_tunnel *tunnel = session->tunnel;
1141 unsigned int len = skb->len;
1142 int error;
1143
1144 /* Debug */
1145 if (session->send_seq)
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001146 l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %Zd bytes, ns=%u\n",
1147 session->name, data_len, session->ns - 1);
James Chapmanfd558d12010-04-02 06:18:33 +00001148 else
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001149 l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %Zd bytes\n",
1150 session->name, data_len);
James Chapmanfd558d12010-04-02 06:18:33 +00001151
1152 if (session->debug & L2TP_MSG_DATA) {
James Chapman0d767512010-04-02 06:19:00 +00001153 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1154 unsigned char *datap = skb->data + uhlen;
James Chapmanfd558d12010-04-02 06:18:33 +00001155
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001156 pr_debug("%s: xmit\n", session->name);
1157 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1158 datap, min_t(size_t, 32, len - uhlen));
James Chapmanfd558d12010-04-02 06:18:33 +00001159 }
1160
1161 /* Queue the packet to IP for output */
WANG Cong60ff7462014-05-04 16:39:18 -07001162 skb->ignore_df = 1;
Benjamin LaHaised2cf3362012-04-27 08:24:18 +00001163#if IS_ENABLED(CONFIG_IPV6)
Eric Dumazet746e3492014-03-07 14:57:43 -08001164 if (tunnel->sock->sk_family == PF_INET6 && !tunnel->v4mapped)
Eric Dumazetb0270e92014-04-15 12:58:34 -04001165 error = inet6_csk_xmit(tunnel->sock, skb, NULL);
Benjamin LaHaised2cf3362012-04-27 08:24:18 +00001166 else
1167#endif
Eric Dumazetb0270e92014-04-15 12:58:34 -04001168 error = ip_queue_xmit(tunnel->sock, skb, fl);
James Chapmanfd558d12010-04-02 06:18:33 +00001169
1170 /* Update stats */
1171 if (error >= 0) {
Tom Parkin7b7c0712013-03-19 06:11:22 +00001172 atomic_long_inc(&tunnel->stats.tx_packets);
1173 atomic_long_add(len, &tunnel->stats.tx_bytes);
1174 atomic_long_inc(&session->stats.tx_packets);
1175 atomic_long_add(len, &session->stats.tx_bytes);
James Chapmanfd558d12010-04-02 06:18:33 +00001176 } else {
Tom Parkin7b7c0712013-03-19 06:11:22 +00001177 atomic_long_inc(&tunnel->stats.tx_errors);
1178 atomic_long_inc(&session->stats.tx_errors);
James Chapmanfd558d12010-04-02 06:18:33 +00001179 }
1180
1181 return 0;
1182}
James Chapmanfd558d12010-04-02 06:18:33 +00001183
James Chapmanfd558d12010-04-02 06:18:33 +00001184/* If caller requires the skb to have a ppp header, the header must be
1185 * inserted in the skb data before calling this function.
1186 */
1187int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len)
1188{
1189 int data_len = skb->len;
James Chapman0d767512010-04-02 06:19:00 +00001190 struct l2tp_tunnel *tunnel = session->tunnel;
1191 struct sock *sk = tunnel->sock;
David S. Millerd9d8da82011-05-06 22:23:20 -07001192 struct flowi *fl;
James Chapmanfd558d12010-04-02 06:18:33 +00001193 struct udphdr *uh;
James Chapmanfd558d12010-04-02 06:18:33 +00001194 struct inet_sock *inet;
James Chapmanfd558d12010-04-02 06:18:33 +00001195 int headroom;
James Chapman0d767512010-04-02 06:19:00 +00001196 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1197 int udp_len;
Eric Dumazetb8c84302012-06-28 20:15:13 +00001198 int ret = NET_XMIT_SUCCESS;
James Chapmanfd558d12010-04-02 06:18:33 +00001199
1200 /* Check that there's enough headroom in the skb to insert IP,
1201 * UDP and L2TP headers. If not enough, expand it to
1202 * make room. Adjust truesize.
1203 */
1204 headroom = NET_SKB_PAD + sizeof(struct iphdr) +
James Chapman0d767512010-04-02 06:19:00 +00001205 uhlen + hdr_len;
Eric Dumazet835acf52011-10-07 05:35:46 +00001206 if (skb_cow_head(skb, headroom)) {
Eric Dumazetb8c84302012-06-28 20:15:13 +00001207 kfree_skb(skb);
1208 return NET_XMIT_DROP;
Eric Dumazet835acf52011-10-07 05:35:46 +00001209 }
James Chapmanfd558d12010-04-02 06:18:33 +00001210
James Chapmanfd558d12010-04-02 06:18:33 +00001211 /* Setup L2TP header */
James Chapmanf7faffa2010-04-02 06:18:49 +00001212 session->build_header(session, __skb_push(skb, hdr_len));
James Chapmanfd558d12010-04-02 06:18:33 +00001213
James Chapman0d767512010-04-02 06:19:00 +00001214 /* Reset skb netfilter state */
James Chapmanfd558d12010-04-02 06:18:33 +00001215 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
1216 IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
1217 IPSKB_REROUTED);
1218 nf_reset(skb);
1219
David S. Miller6af88da2011-05-08 13:45:20 -07001220 bh_lock_sock(sk);
1221 if (sock_owned_by_user(sk)) {
Eric Dumazetb8c84302012-06-28 20:15:13 +00001222 kfree_skb(skb);
1223 ret = NET_XMIT_DROP;
David S. Miller6af88da2011-05-08 13:45:20 -07001224 goto out_unlock;
1225 }
1226
James Chapmanfd558d12010-04-02 06:18:33 +00001227 /* Get routing info from the tunnel socket */
1228 skb_dst_drop(skb);
Wei Wangae7d5062018-08-10 11:14:56 -07001229 skb_dst_set(skb, sk_dst_check(sk, 0));
James Chapmanfd558d12010-04-02 06:18:33 +00001230
David S. Millerd9d8da82011-05-06 22:23:20 -07001231 inet = inet_sk(sk);
1232 fl = &inet->cork.fl;
James Chapman0d767512010-04-02 06:19:00 +00001233 switch (tunnel->encap) {
1234 case L2TP_ENCAPTYPE_UDP:
1235 /* Setup UDP header */
James Chapman0d767512010-04-02 06:19:00 +00001236 __skb_push(skb, sizeof(*uh));
1237 skb_reset_transport_header(skb);
1238 uh = udp_hdr(skb);
1239 uh->source = inet->inet_sport;
1240 uh->dest = inet->inet_dport;
1241 udp_len = uhlen + hdr_len + data_len;
1242 uh->len = htons(udp_len);
James Chapman0d767512010-04-02 06:19:00 +00001243
1244 /* Calculate UDP checksum if configured to do so */
Benjamin LaHaised2cf3362012-04-27 08:24:18 +00001245#if IS_ENABLED(CONFIG_IPV6)
François Cachereule18503f2013-10-02 10:16:02 +02001246 if (sk->sk_family == PF_INET6 && !tunnel->v4mapped)
Tom Herbert77157e12014-06-04 17:19:56 -07001247 udp6_set_csum(udp_get_no_check6_tx(sk),
1248 skb, &inet6_sk(sk)->saddr,
1249 &sk->sk_v6_daddr, udp_len);
Benjamin LaHaised2cf3362012-04-27 08:24:18 +00001250 else
1251#endif
Tom Herbert77157e12014-06-04 17:19:56 -07001252 udp_set_csum(sk->sk_no_check_tx, skb, inet->inet_saddr,
1253 inet->inet_daddr, udp_len);
James Chapman0d767512010-04-02 06:19:00 +00001254 break;
1255
1256 case L2TP_ENCAPTYPE_IP:
1257 break;
James Chapmanfd558d12010-04-02 06:18:33 +00001258 }
1259
David S. Millerd9d8da82011-05-06 22:23:20 -07001260 l2tp_xmit_core(session, skb, fl, data_len);
David S. Miller6af88da2011-05-08 13:45:20 -07001261out_unlock:
1262 bh_unlock_sock(sk);
James Chapmanfd558d12010-04-02 06:18:33 +00001263
Eric Dumazetb8c84302012-06-28 20:15:13 +00001264 return ret;
James Chapmanfd558d12010-04-02 06:18:33 +00001265}
1266EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
1267
1268/*****************************************************************************
1269 * Tinnel and session create/destroy.
1270 *****************************************************************************/
1271
1272/* Tunnel socket destruct hook.
1273 * The tunnel context is deleted only when all session sockets have been
1274 * closed.
1275 */
stephen hemmingerfc130842010-10-21 07:50:46 +00001276static void l2tp_tunnel_destruct(struct sock *sk)
James Chapmanfd558d12010-04-02 06:18:33 +00001277{
David S. Miller8d8a51e2013-10-08 15:44:26 -04001278 struct l2tp_tunnel *tunnel = l2tp_tunnel(sk);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001279 struct l2tp_net *pn;
James Chapmanfd558d12010-04-02 06:18:33 +00001280
James Chapmanfd558d12010-04-02 06:18:33 +00001281 if (tunnel == NULL)
1282 goto end;
1283
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001284 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing...\n", tunnel->name);
James Chapmanfd558d12010-04-02 06:18:33 +00001285
James Chapmanfd558d12010-04-02 06:18:33 +00001286
Tom Parkinf8ccac02013-01-31 23:43:00 +00001287 /* Disable udp encapsulation */
James Chapman0d767512010-04-02 06:19:00 +00001288 switch (tunnel->encap) {
1289 case L2TP_ENCAPTYPE_UDP:
1290 /* No longer an encapsulation socket. See net/ipv4/udp.c */
1291 (udp_sk(sk))->encap_type = 0;
1292 (udp_sk(sk))->encap_rcv = NULL;
Tom Parkin9980d002013-03-19 06:11:13 +00001293 (udp_sk(sk))->encap_destroy = NULL;
James Chapman0d767512010-04-02 06:19:00 +00001294 break;
1295 case L2TP_ENCAPTYPE_IP:
1296 break;
1297 }
James Chapmanfd558d12010-04-02 06:18:33 +00001298
1299 /* Remove hooks into tunnel socket */
James Chapmanfd558d12010-04-02 06:18:33 +00001300 sk->sk_destruct = tunnel->old_sk_destruct;
1301 sk->sk_user_data = NULL;
Tom Parkinf8ccac02013-01-31 23:43:00 +00001302 tunnel->sock = NULL;
1303
1304 /* Remove the tunnel struct from the tunnel list */
1305 pn = l2tp_pernet(tunnel->l2tp_net);
1306 spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1307 list_del_rcu(&tunnel->list);
1308 spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
1309 atomic_dec(&l2tp_tunnel_count);
1310
1311 l2tp_tunnel_closeall(tunnel);
1312 l2tp_tunnel_dec_refcount(tunnel);
James Chapmanfd558d12010-04-02 06:18:33 +00001313
1314 /* Call the original destructor */
1315 if (sk->sk_destruct)
1316 (*sk->sk_destruct)(sk);
James Chapmanfd558d12010-04-02 06:18:33 +00001317end:
1318 return;
1319}
James Chapmanfd558d12010-04-02 06:18:33 +00001320
1321/* When the tunnel is closed, all the attached sessions need to go too.
1322 */
Tom Parkine34f4c72013-03-19 06:11:14 +00001323void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
James Chapmanfd558d12010-04-02 06:18:33 +00001324{
1325 int hash;
1326 struct hlist_node *walk;
1327 struct hlist_node *tmp;
1328 struct l2tp_session *session;
1329
1330 BUG_ON(tunnel == NULL);
1331
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001332 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing all sessions...\n",
1333 tunnel->name);
James Chapmanfd558d12010-04-02 06:18:33 +00001334
1335 write_lock_bh(&tunnel->hlist_lock);
1336 for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
1337again:
1338 hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
1339 session = hlist_entry(walk, struct l2tp_session, hlist);
1340
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001341 l2tp_info(session, L2TP_MSG_CONTROL,
1342 "%s: closing session\n", session->name);
James Chapmanfd558d12010-04-02 06:18:33 +00001343
1344 hlist_del_init(&session->hlist);
1345
James Chapmanfd558d12010-04-02 06:18:33 +00001346 if (session->ref != NULL)
1347 (*session->ref)(session);
1348
1349 write_unlock_bh(&tunnel->hlist_lock);
1350
Tom Parkinf6e16b22013-03-19 06:11:23 +00001351 __l2tp_session_unhash(session);
Tom Parkin4c6e2fd2013-03-19 06:11:20 +00001352 l2tp_session_queue_purge(session);
1353
James Chapmanfd558d12010-04-02 06:18:33 +00001354 if (session->session_close != NULL)
1355 (*session->session_close)(session);
1356
1357 if (session->deref != NULL)
1358 (*session->deref)(session);
1359
Tom Parkin9980d002013-03-19 06:11:13 +00001360 l2tp_session_dec_refcount(session);
1361
James Chapmanfd558d12010-04-02 06:18:33 +00001362 write_lock_bh(&tunnel->hlist_lock);
1363
1364 /* Now restart from the beginning of this hash
1365 * chain. We always remove a session from the
1366 * list so we are guaranteed to make forward
1367 * progress.
1368 */
1369 goto again;
1370 }
1371 }
1372 write_unlock_bh(&tunnel->hlist_lock);
1373}
Tom Parkine34f4c72013-03-19 06:11:14 +00001374EXPORT_SYMBOL_GPL(l2tp_tunnel_closeall);
James Chapmanfd558d12010-04-02 06:18:33 +00001375
Tom Parkin9980d002013-03-19 06:11:13 +00001376/* Tunnel socket destroy hook for UDP encapsulation */
1377static void l2tp_udp_encap_destroy(struct sock *sk)
1378{
1379 struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
1380 if (tunnel) {
1381 l2tp_tunnel_closeall(tunnel);
1382 sock_put(sk);
1383 }
1384}
1385
James Chapmanfd558d12010-04-02 06:18:33 +00001386/* Really kill the tunnel.
1387 * Come here only when all sessions have been cleared from the tunnel.
1388 */
stephen hemmingerfc130842010-10-21 07:50:46 +00001389static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
James Chapmanfd558d12010-04-02 06:18:33 +00001390{
James Chapmanfd558d12010-04-02 06:18:33 +00001391 BUG_ON(atomic_read(&tunnel->ref_count) != 0);
1392 BUG_ON(tunnel->sock != NULL);
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001393 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: free...\n", tunnel->name);
xeb@mail.ru99469c32012-08-24 01:07:38 +00001394 kfree_rcu(tunnel, rcu);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001395}
James Chapmanfd558d12010-04-02 06:18:33 +00001396
Tom Parkinf8ccac02013-01-31 23:43:00 +00001397/* Workqueue tunnel deletion function */
1398static void l2tp_tunnel_del_work(struct work_struct *work)
1399{
1400 struct l2tp_tunnel *tunnel = NULL;
1401 struct socket *sock = NULL;
1402 struct sock *sk = NULL;
1403
1404 tunnel = container_of(work, struct l2tp_tunnel, del_work);
Ridge Kennedye5941132017-02-22 14:59:49 +13001405
1406 l2tp_tunnel_closeall(tunnel);
1407
Tom Parkinf8ccac02013-01-31 23:43:00 +00001408 sk = l2tp_tunnel_sock_lookup(tunnel);
1409 if (!sk)
Alexander Couzens06a15f52015-09-28 11:32:42 +02001410 goto out;
Tom Parkinf8ccac02013-01-31 23:43:00 +00001411
1412 sock = sk->sk_socket;
Tom Parkinf8ccac02013-01-31 23:43:00 +00001413
Tom Parkin02d13ed2013-03-19 06:11:18 +00001414 /* If the tunnel socket was created by userspace, then go through the
1415 * inet layer to shut the socket down, and let userspace close it.
1416 * Otherwise, if we created the socket directly within the kernel, use
1417 * the sk API to release it here.
Tom Parkin167eb172013-01-31 23:43:03 +00001418 * In either case the tunnel resources are freed in the socket
1419 * destructor when the tunnel socket goes away.
Tom Parkinf8ccac02013-01-31 23:43:00 +00001420 */
Tom Parkin02d13ed2013-03-19 06:11:18 +00001421 if (tunnel->fd >= 0) {
1422 if (sock)
1423 inet_shutdown(sock, 2);
Tom Parkin167eb172013-01-31 23:43:03 +00001424 } else {
Eric W. Biederman26abe142015-05-08 21:10:31 -05001425 if (sock) {
Tom Parkin02d13ed2013-03-19 06:11:18 +00001426 kernel_sock_shutdown(sock, SHUT_RDWR);
Eric W. Biederman26abe142015-05-08 21:10:31 -05001427 sock_release(sock);
1428 }
Tom Parkin167eb172013-01-31 23:43:03 +00001429 }
Tom Parkinf8ccac02013-01-31 23:43:00 +00001430
1431 l2tp_tunnel_sock_put(sk);
Alexander Couzens06a15f52015-09-28 11:32:42 +02001432out:
1433 l2tp_tunnel_dec_refcount(tunnel);
James Chapmanfd558d12010-04-02 06:18:33 +00001434}
James Chapmanfd558d12010-04-02 06:18:33 +00001435
James Chapman789a4a22010-04-02 06:19:40 +00001436/* Create a socket for the tunnel, if one isn't set up by
1437 * userspace. This is used for static tunnels where there is no
1438 * managing L2TP daemon.
Tom Parkin167eb172013-01-31 23:43:03 +00001439 *
1440 * Since we don't want these sockets to keep a namespace alive by
1441 * themselves, we drop the socket's namespace refcount after creation.
1442 * These sockets are freed when the namespace exits using the pernet
1443 * exit hook.
James Chapman789a4a22010-04-02 06:19:40 +00001444 */
Tom Parkin167eb172013-01-31 23:43:03 +00001445static int l2tp_tunnel_sock_create(struct net *net,
1446 u32 tunnel_id,
1447 u32 peer_tunnel_id,
1448 struct l2tp_tunnel_cfg *cfg,
1449 struct socket **sockp)
James Chapman789a4a22010-04-02 06:19:40 +00001450{
1451 int err = -EINVAL;
Eric Dumazet7bddd0d2010-04-04 01:02:46 -07001452 struct socket *sock = NULL;
Tom Herbert85644b42014-07-13 19:49:48 -07001453 struct udp_port_cfg udp_conf;
James Chapman789a4a22010-04-02 06:19:40 +00001454
1455 switch (cfg->encap) {
1456 case L2TP_ENCAPTYPE_UDP:
Tom Herbert85644b42014-07-13 19:49:48 -07001457 memset(&udp_conf, 0, sizeof(udp_conf));
1458
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001459#if IS_ENABLED(CONFIG_IPV6)
1460 if (cfg->local_ip6 && cfg->peer_ip6) {
Tom Herbert85644b42014-07-13 19:49:48 -07001461 udp_conf.family = AF_INET6;
1462 memcpy(&udp_conf.local_ip6, cfg->local_ip6,
1463 sizeof(udp_conf.local_ip6));
1464 memcpy(&udp_conf.peer_ip6, cfg->peer_ip6,
1465 sizeof(udp_conf.peer_ip6));
1466 udp_conf.use_udp6_tx_checksums =
Wang Shanker018f8252016-04-29 01:29:43 +08001467 ! cfg->udp6_zero_tx_checksums;
Tom Herbert85644b42014-07-13 19:49:48 -07001468 udp_conf.use_udp6_rx_checksums =
Wang Shanker018f8252016-04-29 01:29:43 +08001469 ! cfg->udp6_zero_rx_checksums;
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001470 } else
1471#endif
1472 {
Tom Herbert85644b42014-07-13 19:49:48 -07001473 udp_conf.family = AF_INET;
1474 udp_conf.local_ip = cfg->local_ip;
1475 udp_conf.peer_ip = cfg->peer_ip;
1476 udp_conf.use_udp_checksums = cfg->use_udp_checksums;
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001477 }
James Chapman789a4a22010-04-02 06:19:40 +00001478
Tom Herbert85644b42014-07-13 19:49:48 -07001479 udp_conf.local_udp_port = htons(cfg->local_udp_port);
1480 udp_conf.peer_udp_port = htons(cfg->peer_udp_port);
1481
1482 err = udp_sock_create(net, &udp_conf, &sock);
1483 if (err < 0)
1484 goto out;
James Chapman789a4a22010-04-02 06:19:40 +00001485
1486 break;
1487
1488 case L2TP_ENCAPTYPE_IP:
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001489#if IS_ENABLED(CONFIG_IPV6)
1490 if (cfg->local_ip6 && cfg->peer_ip6) {
Tom Herbert85644b42014-07-13 19:49:48 -07001491 struct sockaddr_l2tpip6 ip6_addr = {0};
1492
Eric W. Biederman26abe142015-05-08 21:10:31 -05001493 err = sock_create_kern(net, AF_INET6, SOCK_DGRAM,
Tom Parkin167eb172013-01-31 23:43:03 +00001494 IPPROTO_L2TP, &sock);
James Chapman5dac94e2012-04-29 21:48:55 +00001495 if (err < 0)
1496 goto out;
1497
James Chapman5dac94e2012-04-29 21:48:55 +00001498 ip6_addr.l2tp_family = AF_INET6;
1499 memcpy(&ip6_addr.l2tp_addr, cfg->local_ip6,
1500 sizeof(ip6_addr.l2tp_addr));
1501 ip6_addr.l2tp_conn_id = tunnel_id;
1502 err = kernel_bind(sock, (struct sockaddr *) &ip6_addr,
1503 sizeof(ip6_addr));
1504 if (err < 0)
1505 goto out;
1506
1507 ip6_addr.l2tp_family = AF_INET6;
1508 memcpy(&ip6_addr.l2tp_addr, cfg->peer_ip6,
1509 sizeof(ip6_addr.l2tp_addr));
1510 ip6_addr.l2tp_conn_id = peer_tunnel_id;
1511 err = kernel_connect(sock,
1512 (struct sockaddr *) &ip6_addr,
1513 sizeof(ip6_addr), 0);
1514 if (err < 0)
1515 goto out;
1516 } else
Chris Elstonf9bac8d2012-04-29 21:48:52 +00001517#endif
James Chapman5dac94e2012-04-29 21:48:55 +00001518 {
Tom Herbert85644b42014-07-13 19:49:48 -07001519 struct sockaddr_l2tpip ip_addr = {0};
1520
Eric W. Biederman26abe142015-05-08 21:10:31 -05001521 err = sock_create_kern(net, AF_INET, SOCK_DGRAM,
Tom Parkin167eb172013-01-31 23:43:03 +00001522 IPPROTO_L2TP, &sock);
James Chapman5dac94e2012-04-29 21:48:55 +00001523 if (err < 0)
1524 goto out;
James Chapman789a4a22010-04-02 06:19:40 +00001525
James Chapman5dac94e2012-04-29 21:48:55 +00001526 ip_addr.l2tp_family = AF_INET;
1527 ip_addr.l2tp_addr = cfg->local_ip;
1528 ip_addr.l2tp_conn_id = tunnel_id;
1529 err = kernel_bind(sock, (struct sockaddr *) &ip_addr,
1530 sizeof(ip_addr));
1531 if (err < 0)
1532 goto out;
James Chapman789a4a22010-04-02 06:19:40 +00001533
James Chapman5dac94e2012-04-29 21:48:55 +00001534 ip_addr.l2tp_family = AF_INET;
1535 ip_addr.l2tp_addr = cfg->peer_ip;
1536 ip_addr.l2tp_conn_id = peer_tunnel_id;
1537 err = kernel_connect(sock, (struct sockaddr *) &ip_addr,
1538 sizeof(ip_addr), 0);
1539 if (err < 0)
1540 goto out;
1541 }
James Chapman789a4a22010-04-02 06:19:40 +00001542 break;
1543
1544 default:
1545 goto out;
1546 }
1547
1548out:
Tom Parkin167eb172013-01-31 23:43:03 +00001549 *sockp = sock;
James Chapman789a4a22010-04-02 06:19:40 +00001550 if ((err < 0) && sock) {
Tom Parkin167eb172013-01-31 23:43:03 +00001551 kernel_sock_shutdown(sock, SHUT_RDWR);
Eric W. Biederman26abe142015-05-08 21:10:31 -05001552 sock_release(sock);
James Chapman789a4a22010-04-02 06:19:40 +00001553 *sockp = NULL;
1554 }
1555
1556 return err;
1557}
1558
Eric Dumazet37159ef2012-09-04 07:18:57 +00001559static struct lock_class_key l2tp_socket_class;
1560
James Chapmanfd558d12010-04-02 06:18:33 +00001561int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp)
1562{
1563 struct l2tp_tunnel *tunnel = NULL;
1564 int err;
1565 struct socket *sock = NULL;
1566 struct sock *sk = NULL;
1567 struct l2tp_net *pn;
James Chapman0d767512010-04-02 06:19:00 +00001568 enum l2tp_encap_type encap = L2TP_ENCAPTYPE_UDP;
James Chapmanfd558d12010-04-02 06:18:33 +00001569
1570 /* Get the tunnel socket from the fd, which was opened by
James Chapman789a4a22010-04-02 06:19:40 +00001571 * the userspace L2TP daemon. If not specified, create a
1572 * kernel socket.
James Chapmanfd558d12010-04-02 06:18:33 +00001573 */
James Chapman789a4a22010-04-02 06:19:40 +00001574 if (fd < 0) {
Tom Parkin167eb172013-01-31 23:43:03 +00001575 err = l2tp_tunnel_sock_create(net, tunnel_id, peer_tunnel_id,
1576 cfg, &sock);
James Chapman789a4a22010-04-02 06:19:40 +00001577 if (err < 0)
1578 goto err;
1579 } else {
James Chapman789a4a22010-04-02 06:19:40 +00001580 sock = sockfd_lookup(fd, &err);
1581 if (!sock) {
Tom Parkincbb95e02013-01-31 23:43:02 +00001582 pr_err("tunl %u: sockfd_lookup(fd=%d) returned %d\n",
James Chapman789a4a22010-04-02 06:19:40 +00001583 tunnel_id, fd, err);
Tom Parkincbb95e02013-01-31 23:43:02 +00001584 err = -EBADF;
1585 goto err;
1586 }
1587
1588 /* Reject namespace mismatches */
1589 if (!net_eq(sock_net(sock->sk), net)) {
1590 pr_err("tunl %u: netns mismatch\n", tunnel_id);
1591 err = -EINVAL;
James Chapman789a4a22010-04-02 06:19:40 +00001592 goto err;
1593 }
James Chapmanfd558d12010-04-02 06:18:33 +00001594 }
1595
1596 sk = sock->sk;
1597
James Chapman0d767512010-04-02 06:19:00 +00001598 if (cfg != NULL)
1599 encap = cfg->encap;
1600
James Chapmanfd558d12010-04-02 06:18:33 +00001601 /* Quick sanity checks */
Eric Dumazet84fc2d72018-03-06 07:54:53 -08001602 err = -EPROTONOSUPPORT;
1603 if (sk->sk_type != SOCK_DGRAM) {
1604 pr_debug("tunl %hu: fd %d wrong socket type\n",
1605 tunnel_id, fd);
1606 goto err;
1607 }
James Chapman0d767512010-04-02 06:19:00 +00001608 switch (encap) {
1609 case L2TP_ENCAPTYPE_UDP:
James Chapman0d767512010-04-02 06:19:00 +00001610 if (sk->sk_protocol != IPPROTO_UDP) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001611 pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
James Chapman0d767512010-04-02 06:19:00 +00001612 tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
1613 goto err;
1614 }
1615 break;
1616 case L2TP_ENCAPTYPE_IP:
James Chapman0d767512010-04-02 06:19:00 +00001617 if (sk->sk_protocol != IPPROTO_L2TP) {
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001618 pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
James Chapman0d767512010-04-02 06:19:00 +00001619 tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP);
1620 goto err;
1621 }
1622 break;
James Chapmanfd558d12010-04-02 06:18:33 +00001623 }
1624
1625 /* Check if this socket has already been prepped */
David S. Miller8d8a51e2013-10-08 15:44:26 -04001626 tunnel = l2tp_tunnel(sk);
James Chapmanfd558d12010-04-02 06:18:33 +00001627 if (tunnel != NULL) {
1628 /* This socket has already been prepped */
1629 err = -EBUSY;
1630 goto err;
1631 }
1632
James Chapmanfd558d12010-04-02 06:18:33 +00001633 tunnel = kzalloc(sizeof(struct l2tp_tunnel), GFP_KERNEL);
1634 if (tunnel == NULL) {
1635 err = -ENOMEM;
1636 goto err;
1637 }
1638
1639 tunnel->version = version;
1640 tunnel->tunnel_id = tunnel_id;
1641 tunnel->peer_tunnel_id = peer_tunnel_id;
1642 tunnel->debug = L2TP_DEFAULT_DEBUG_FLAGS;
1643
1644 tunnel->magic = L2TP_TUNNEL_MAGIC;
1645 sprintf(&tunnel->name[0], "tunl %u", tunnel_id);
1646 rwlock_init(&tunnel->hlist_lock);
1647
1648 /* The net we belong to */
1649 tunnel->l2tp_net = net;
1650 pn = l2tp_pernet(net);
1651
James Chapman0d767512010-04-02 06:19:00 +00001652 if (cfg != NULL)
James Chapmanfd558d12010-04-02 06:18:33 +00001653 tunnel->debug = cfg->debug;
1654
François Cachereule18503f2013-10-02 10:16:02 +02001655#if IS_ENABLED(CONFIG_IPV6)
1656 if (sk->sk_family == PF_INET6) {
1657 struct ipv6_pinfo *np = inet6_sk(sk);
1658
1659 if (ipv6_addr_v4mapped(&np->saddr) &&
Eric Dumazetefe42082013-10-03 15:42:29 -07001660 ipv6_addr_v4mapped(&sk->sk_v6_daddr)) {
François Cachereule18503f2013-10-02 10:16:02 +02001661 struct inet_sock *inet = inet_sk(sk);
1662
1663 tunnel->v4mapped = true;
1664 inet->inet_saddr = np->saddr.s6_addr32[3];
Eric Dumazetefe42082013-10-03 15:42:29 -07001665 inet->inet_rcv_saddr = sk->sk_v6_rcv_saddr.s6_addr32[3];
1666 inet->inet_daddr = sk->sk_v6_daddr.s6_addr32[3];
François Cachereule18503f2013-10-02 10:16:02 +02001667 } else {
1668 tunnel->v4mapped = false;
1669 }
1670 }
1671#endif
1672
James Chapmanfd558d12010-04-02 06:18:33 +00001673 /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
James Chapman0d767512010-04-02 06:19:00 +00001674 tunnel->encap = encap;
1675 if (encap == L2TP_ENCAPTYPE_UDP) {
Guillaume Naulta5c5e2d2016-06-08 12:59:17 +02001676 struct udp_tunnel_sock_cfg udp_cfg = { };
James Chapmanfd558d12010-04-02 06:18:33 +00001677
Andy Zhouc8fffce2014-09-16 17:31:19 -07001678 udp_cfg.sk_user_data = tunnel;
1679 udp_cfg.encap_type = UDP_ENCAP_L2TPINUDP;
1680 udp_cfg.encap_rcv = l2tp_udp_encap_recv;
1681 udp_cfg.encap_destroy = l2tp_udp_encap_destroy;
1682
1683 setup_udp_tunnel_sock(net, sock, &udp_cfg);
1684 } else {
1685 sk->sk_user_data = tunnel;
1686 }
James Chapmanfd558d12010-04-02 06:18:33 +00001687
1688 /* Hook on the tunnel socket destructor so that we can cleanup
1689 * if the tunnel socket goes away.
1690 */
1691 tunnel->old_sk_destruct = sk->sk_destruct;
1692 sk->sk_destruct = &l2tp_tunnel_destruct;
1693 tunnel->sock = sk;
Tom Parkin80d84ef2013-01-22 05:13:48 +00001694 tunnel->fd = fd;
Eric Dumazet37159ef2012-09-04 07:18:57 +00001695 lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock");
1696
James Chapmanfd558d12010-04-02 06:18:33 +00001697 sk->sk_allocation = GFP_ATOMIC;
1698
Tom Parkinf8ccac02013-01-31 23:43:00 +00001699 /* Init delete workqueue struct */
1700 INIT_WORK(&tunnel->del_work, l2tp_tunnel_del_work);
1701
James Chapmanfd558d12010-04-02 06:18:33 +00001702 /* Add tunnel to our list */
1703 INIT_LIST_HEAD(&tunnel->list);
James Chapmanfd558d12010-04-02 06:18:33 +00001704 atomic_inc(&l2tp_tunnel_count);
1705
1706 /* Bump the reference count. The tunnel context is deleted
Eric Dumazet17691922011-05-11 18:22:36 +00001707 * only when this drops to zero. Must be done before list insertion
James Chapmanfd558d12010-04-02 06:18:33 +00001708 */
1709 l2tp_tunnel_inc_refcount(tunnel);
Eric Dumazet17691922011-05-11 18:22:36 +00001710 spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1711 list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
1712 spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
James Chapmanfd558d12010-04-02 06:18:33 +00001713
1714 err = 0;
1715err:
1716 if (tunnelp)
1717 *tunnelp = tunnel;
1718
James Chapman789a4a22010-04-02 06:19:40 +00001719 /* If tunnel's socket was created by the kernel, it doesn't
1720 * have a file.
1721 */
1722 if (sock && sock->file)
James Chapmanfd558d12010-04-02 06:18:33 +00001723 sockfd_put(sock);
1724
1725 return err;
1726}
1727EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
1728
James Chapman309795f2010-04-02 06:19:10 +00001729/* This function is used by the netlink TUNNEL_DELETE command.
1730 */
Sabrina Dubrocab4a9b122017-09-26 16:16:43 +02001731void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
James Chapman309795f2010-04-02 06:19:10 +00001732{
Sabrina Dubrocab4a9b122017-09-26 16:16:43 +02001733 if (!test_and_set_bit(0, &tunnel->dead)) {
1734 l2tp_tunnel_inc_refcount(tunnel);
1735 queue_work(l2tp_wq, &tunnel->del_work);
Alexander Couzens06a15f52015-09-28 11:32:42 +02001736 }
James Chapman309795f2010-04-02 06:19:10 +00001737}
1738EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
1739
James Chapmanfd558d12010-04-02 06:18:33 +00001740/* Really kill the session.
1741 */
1742void l2tp_session_free(struct l2tp_session *session)
1743{
Tom Parkinf6e16b22013-03-19 06:11:23 +00001744 struct l2tp_tunnel *tunnel = session->tunnel;
James Chapmanfd558d12010-04-02 06:18:33 +00001745
1746 BUG_ON(atomic_read(&session->ref_count) != 0);
1747
Tom Parkinf6e16b22013-03-19 06:11:23 +00001748 if (tunnel) {
James Chapmanfd558d12010-04-02 06:18:33 +00001749 BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
James Chapmanfd558d12010-04-02 06:18:33 +00001750 if (session->session_id != 0)
1751 atomic_dec(&l2tp_session_count);
James Chapmanfd558d12010-04-02 06:18:33 +00001752 sock_put(tunnel->sock);
James Chapmanfd558d12010-04-02 06:18:33 +00001753 session->tunnel = NULL;
1754 l2tp_tunnel_dec_refcount(tunnel);
1755 }
1756
1757 kfree(session);
James Chapmanfd558d12010-04-02 06:18:33 +00001758}
1759EXPORT_SYMBOL_GPL(l2tp_session_free);
1760
Tom Parkinf6e16b22013-03-19 06:11:23 +00001761/* Remove an l2tp session from l2tp_core's hash lists.
1762 * Provides a tidyup interface for pseudowire code which can't just route all
1763 * shutdown via. l2tp_session_delete and a pseudowire-specific session_close
1764 * callback.
1765 */
1766void __l2tp_session_unhash(struct l2tp_session *session)
1767{
1768 struct l2tp_tunnel *tunnel = session->tunnel;
1769
1770 /* Remove the session from core hashes */
1771 if (tunnel) {
1772 /* Remove from the per-tunnel hash */
1773 write_lock_bh(&tunnel->hlist_lock);
1774 hlist_del_init(&session->hlist);
1775 write_unlock_bh(&tunnel->hlist_lock);
1776
1777 /* For L2TPv3 we have a per-net hash: remove from there, too */
1778 if (tunnel->version != L2TP_HDR_VER_2) {
1779 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1780 spin_lock_bh(&pn->l2tp_session_hlist_lock);
1781 hlist_del_init_rcu(&session->global_hlist);
1782 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
1783 synchronize_rcu();
1784 }
1785 }
1786}
1787EXPORT_SYMBOL_GPL(__l2tp_session_unhash);
1788
James Chapman309795f2010-04-02 06:19:10 +00001789/* This function is used by the netlink SESSION_DELETE command and by
1790 pseudowire modules.
1791 */
1792int l2tp_session_delete(struct l2tp_session *session)
1793{
Tom Parkinf6e16b22013-03-19 06:11:23 +00001794 if (session->ref)
1795 (*session->ref)(session);
1796 __l2tp_session_unhash(session);
Tom Parkin4c6e2fd2013-03-19 06:11:20 +00001797 l2tp_session_queue_purge(session);
James Chapman309795f2010-04-02 06:19:10 +00001798 if (session->session_close != NULL)
1799 (*session->session_close)(session);
Tom Parkinf6e16b22013-03-19 06:11:23 +00001800 if (session->deref)
Dan Carpenter1b7c92b2013-03-22 21:33:15 +03001801 (*session->deref)(session);
James Chapman309795f2010-04-02 06:19:10 +00001802 l2tp_session_dec_refcount(session);
James Chapman309795f2010-04-02 06:19:10 +00001803 return 0;
1804}
1805EXPORT_SYMBOL_GPL(l2tp_session_delete);
1806
James Chapmanf7faffa2010-04-02 06:18:49 +00001807/* We come here whenever a session's send_seq, cookie_len or
1808 * l2specific_len parameters are set.
1809 */
Guillaume Naultbb5016e2014-03-06 11:14:30 +01001810void l2tp_session_set_header_len(struct l2tp_session *session, int version)
James Chapmanf7faffa2010-04-02 06:18:49 +00001811{
1812 if (version == L2TP_HDR_VER_2) {
1813 session->hdr_len = 6;
1814 if (session->send_seq)
1815 session->hdr_len += 4;
1816 } else {
James Chapman65b05d02018-01-03 22:48:06 +00001817 session->hdr_len = 4 + session->cookie_len + session->l2specific_len;
James Chapman0d767512010-04-02 06:19:00 +00001818 if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)
1819 session->hdr_len += 4;
James Chapmanf7faffa2010-04-02 06:18:49 +00001820 }
1821
1822}
Guillaume Naultbb5016e2014-03-06 11:14:30 +01001823EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
James Chapmanf7faffa2010-04-02 06:18:49 +00001824
James Chapmanfd558d12010-04-02 06:18:33 +00001825struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
1826{
1827 struct l2tp_session *session;
Guillaume Naultd9face62017-03-31 13:02:27 +02001828 int err;
James Chapmanfd558d12010-04-02 06:18:33 +00001829
1830 session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL);
1831 if (session != NULL) {
1832 session->magic = L2TP_SESSION_MAGIC;
1833 session->tunnel = tunnel;
1834
1835 session->session_id = session_id;
1836 session->peer_session_id = peer_session_id;
James Chapmand301e322012-05-09 23:43:09 +00001837 session->nr = 0;
James Chapman8a1631d2013-07-02 20:28:59 +01001838 if (tunnel->version == L2TP_HDR_VER_2)
1839 session->nr_max = 0xffff;
1840 else
1841 session->nr_max = 0xffffff;
1842 session->nr_window_size = session->nr_max / 2;
James Chapmana0dbd822013-07-02 20:29:00 +01001843 session->nr_oos_count_max = 4;
1844
1845 /* Use NR of first received packet */
1846 session->reorder_skip = 1;
James Chapmanfd558d12010-04-02 06:18:33 +00001847
1848 sprintf(&session->name[0], "sess %u/%u",
1849 tunnel->tunnel_id, session->session_id);
1850
1851 skb_queue_head_init(&session->reorder_q);
1852
1853 INIT_HLIST_NODE(&session->hlist);
James Chapmanf7faffa2010-04-02 06:18:49 +00001854 INIT_HLIST_NODE(&session->global_hlist);
James Chapmanfd558d12010-04-02 06:18:33 +00001855
1856 /* Inherit debug options from tunnel */
1857 session->debug = tunnel->debug;
1858
1859 if (cfg) {
James Chapmanf7faffa2010-04-02 06:18:49 +00001860 session->pwtype = cfg->pw_type;
James Chapmanfd558d12010-04-02 06:18:33 +00001861 session->debug = cfg->debug;
James Chapmanfd558d12010-04-02 06:18:33 +00001862 session->mtu = cfg->mtu;
1863 session->mru = cfg->mru;
1864 session->send_seq = cfg->send_seq;
1865 session->recv_seq = cfg->recv_seq;
1866 session->lns_mode = cfg->lns_mode;
James Chapmanf7faffa2010-04-02 06:18:49 +00001867 session->reorder_timeout = cfg->reorder_timeout;
James Chapmanf7faffa2010-04-02 06:18:49 +00001868 session->l2specific_type = cfg->l2specific_type;
1869 session->l2specific_len = cfg->l2specific_len;
1870 session->cookie_len = cfg->cookie_len;
1871 memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);
1872 session->peer_cookie_len = cfg->peer_cookie_len;
1873 memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);
James Chapmanfd558d12010-04-02 06:18:33 +00001874 }
1875
James Chapmanf7faffa2010-04-02 06:18:49 +00001876 if (tunnel->version == L2TP_HDR_VER_2)
1877 session->build_header = l2tp_build_l2tpv2_header;
1878 else
1879 session->build_header = l2tp_build_l2tpv3_header;
1880
1881 l2tp_session_set_header_len(session, tunnel->version);
1882
Guillaume Naultd9face62017-03-31 13:02:27 +02001883 err = l2tp_session_add_to_tunnel(tunnel, session);
1884 if (err) {
1885 kfree(session);
1886
1887 return ERR_PTR(err);
1888 }
1889
James Chapmanfd558d12010-04-02 06:18:33 +00001890 /* Bump the reference count. The session context is deleted
1891 * only when this drops to zero.
1892 */
1893 l2tp_session_inc_refcount(session);
1894 l2tp_tunnel_inc_refcount(tunnel);
1895
1896 /* Ensure tunnel socket isn't deleted */
1897 sock_hold(tunnel->sock);
1898
James Chapmanfd558d12010-04-02 06:18:33 +00001899 /* Ignore management session in session count value */
1900 if (session->session_id != 0)
1901 atomic_inc(&l2tp_session_count);
Guillaume Naultd9face62017-03-31 13:02:27 +02001902
1903 return session;
James Chapmanfd558d12010-04-02 06:18:33 +00001904 }
1905
Guillaume Naultd9face62017-03-31 13:02:27 +02001906 return ERR_PTR(-ENOMEM);
James Chapmanfd558d12010-04-02 06:18:33 +00001907}
1908EXPORT_SYMBOL_GPL(l2tp_session_create);
1909
1910/*****************************************************************************
1911 * Init and cleanup
1912 *****************************************************************************/
1913
1914static __net_init int l2tp_init_net(struct net *net)
1915{
Jiri Pirkoe773aaf2010-04-23 00:53:39 +00001916 struct l2tp_net *pn = net_generic(net, l2tp_net_id);
James Chapmanf7faffa2010-04-02 06:18:49 +00001917 int hash;
James Chapmanfd558d12010-04-02 06:18:33 +00001918
James Chapmanfd558d12010-04-02 06:18:33 +00001919 INIT_LIST_HEAD(&pn->l2tp_tunnel_list);
James Chapmane02d4942010-04-02 06:19:16 +00001920 spin_lock_init(&pn->l2tp_tunnel_list_lock);
James Chapmanfd558d12010-04-02 06:18:33 +00001921
James Chapmanf7faffa2010-04-02 06:18:49 +00001922 for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
1923 INIT_HLIST_HEAD(&pn->l2tp_session_hlist[hash]);
1924
James Chapmane02d4942010-04-02 06:19:16 +00001925 spin_lock_init(&pn->l2tp_session_hlist_lock);
James Chapmanf7faffa2010-04-02 06:18:49 +00001926
James Chapmanfd558d12010-04-02 06:18:33 +00001927 return 0;
James Chapmanfd558d12010-04-02 06:18:33 +00001928}
1929
Tom Parkin167eb172013-01-31 23:43:03 +00001930static __net_exit void l2tp_exit_net(struct net *net)
1931{
1932 struct l2tp_net *pn = l2tp_pernet(net);
1933 struct l2tp_tunnel *tunnel = NULL;
1934
1935 rcu_read_lock_bh();
1936 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
Jiri Slabyfc4177e2017-10-25 15:57:55 +02001937 l2tp_tunnel_delete(tunnel);
Tom Parkin167eb172013-01-31 23:43:03 +00001938 }
1939 rcu_read_unlock_bh();
Sabrina Dubroca2f869532016-09-02 10:22:54 +02001940
1941 flush_workqueue(l2tp_wq);
1942 rcu_barrier();
Tom Parkin167eb172013-01-31 23:43:03 +00001943}
1944
James Chapmanfd558d12010-04-02 06:18:33 +00001945static struct pernet_operations l2tp_net_ops = {
1946 .init = l2tp_init_net,
Tom Parkin167eb172013-01-31 23:43:03 +00001947 .exit = l2tp_exit_net,
James Chapmanfd558d12010-04-02 06:18:33 +00001948 .id = &l2tp_net_id,
1949 .size = sizeof(struct l2tp_net),
1950};
1951
1952static int __init l2tp_init(void)
1953{
1954 int rc = 0;
1955
1956 rc = register_pernet_device(&l2tp_net_ops);
1957 if (rc)
1958 goto out;
1959
ZhangZhen59ff3eb2014-03-27 09:41:47 +08001960 l2tp_wq = alloc_workqueue("l2tp", WQ_UNBOUND, 0);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001961 if (!l2tp_wq) {
1962 pr_err("alloc_workqueue failed\n");
WANG Cong67e04c22015-04-03 13:46:09 -07001963 unregister_pernet_device(&l2tp_net_ops);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001964 rc = -ENOMEM;
1965 goto out;
1966 }
1967
Joe Perchesa4ca44f2012-05-16 09:55:56 +00001968 pr_info("L2TP core driver, %s\n", L2TP_DRV_VERSION);
James Chapmanfd558d12010-04-02 06:18:33 +00001969
1970out:
1971 return rc;
1972}
1973
1974static void __exit l2tp_exit(void)
1975{
1976 unregister_pernet_device(&l2tp_net_ops);
Tom Parkinf8ccac02013-01-31 23:43:00 +00001977 if (l2tp_wq) {
1978 destroy_workqueue(l2tp_wq);
1979 l2tp_wq = NULL;
1980 }
James Chapmanfd558d12010-04-02 06:18:33 +00001981}
1982
1983module_init(l2tp_init);
1984module_exit(l2tp_exit);
1985
1986MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1987MODULE_DESCRIPTION("L2TP core");
1988MODULE_LICENSE("GPL");
1989MODULE_VERSION(L2TP_DRV_VERSION);
1990