l2tp_core.c revision e34f4c7050e5471b6d4fb25380713937fc837514
1/* 2 * L2TP core. 3 * 4 * Copyright (c) 2008,2009,2010 Katalix Systems Ltd 5 * 6 * This file contains some code of the original L2TPv2 pppol2tp 7 * driver, which has the following copyright: 8 * 9 * Authors: Martijn van Oosterhout <kleptog@svana.org> 10 * James Chapman (jchapman@katalix.com) 11 * Contributors: 12 * Michal Ostrowski <mostrows@speakeasy.net> 13 * Arnaldo Carvalho de Melo <acme@xconectiva.com.br> 14 * David S. Miller (davem@redhat.com) 15 * 16 * This program is free software; you can redistribute it and/or modify 17 * it under the terms of the GNU General Public License version 2 as 18 * published by the Free Software Foundation. 19 */ 20 21#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 22 23#include <linux/module.h> 24#include <linux/string.h> 25#include <linux/list.h> 26#include <linux/rculist.h> 27#include <linux/uaccess.h> 28 29#include <linux/kernel.h> 30#include <linux/spinlock.h> 31#include <linux/kthread.h> 32#include <linux/sched.h> 33#include <linux/slab.h> 34#include <linux/errno.h> 35#include <linux/jiffies.h> 36 37#include <linux/netdevice.h> 38#include <linux/net.h> 39#include <linux/inetdevice.h> 40#include <linux/skbuff.h> 41#include <linux/init.h> 42#include <linux/in.h> 43#include <linux/ip.h> 44#include <linux/udp.h> 45#include <linux/l2tp.h> 46#include <linux/hash.h> 47#include <linux/sort.h> 48#include <linux/file.h> 49#include <linux/nsproxy.h> 50#include <net/net_namespace.h> 51#include <net/netns/generic.h> 52#include <net/dst.h> 53#include <net/ip.h> 54#include <net/udp.h> 55#include <net/inet_common.h> 56#include <net/xfrm.h> 57#include <net/protocol.h> 58#include <net/inet6_connection_sock.h> 59#include <net/inet_ecn.h> 60#include <net/ip6_route.h> 61#include <net/ip6_checksum.h> 62 63#include <asm/byteorder.h> 64#include <linux/atomic.h> 65 66#include "l2tp_core.h" 67 68#define L2TP_DRV_VERSION "V2.0" 69 70/* L2TP header constants */ 71#define L2TP_HDRFLAG_T 0x8000 72#define L2TP_HDRFLAG_L 0x4000 73#define L2TP_HDRFLAG_S 0x0800 74#define L2TP_HDRFLAG_O 0x0200 75#define L2TP_HDRFLAG_P 0x0100 76 77#define L2TP_HDR_VER_MASK 0x000F 78#define L2TP_HDR_VER_2 0x0002 79#define L2TP_HDR_VER_3 0x0003 80 81/* L2TPv3 default L2-specific sublayer */ 82#define L2TP_SLFLAG_S 0x40000000 83#define L2TP_SL_SEQ_MASK 0x00ffffff 84 85#define L2TP_HDR_SIZE_SEQ 10 86#define L2TP_HDR_SIZE_NOSEQ 6 87 88/* Default trace flags */ 89#define L2TP_DEFAULT_DEBUG_FLAGS 0 90 91/* Private data stored for received packets in the skb. 92 */ 93struct l2tp_skb_cb { 94 u32 ns; 95 u16 has_seq; 96 u16 length; 97 unsigned long expires; 98}; 99 100#define L2TP_SKB_CB(skb) ((struct l2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)]) 101 102static atomic_t l2tp_tunnel_count; 103static atomic_t l2tp_session_count; 104static struct workqueue_struct *l2tp_wq; 105 106/* per-net private data for this module */ 107static unsigned int l2tp_net_id; 108struct l2tp_net { 109 struct list_head l2tp_tunnel_list; 110 spinlock_t l2tp_tunnel_list_lock; 111 struct hlist_head l2tp_session_hlist[L2TP_HASH_SIZE_2]; 112 spinlock_t l2tp_session_hlist_lock; 113}; 114 115static void l2tp_session_set_header_len(struct l2tp_session *session, int version); 116static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel); 117 118static inline struct l2tp_net *l2tp_pernet(struct net *net) 119{ 120 BUG_ON(!net); 121 122 return net_generic(net, l2tp_net_id); 123} 124 125/* Tunnel reference counts. Incremented per session that is added to 126 * the tunnel. 127 */ 128static inline void l2tp_tunnel_inc_refcount_1(struct l2tp_tunnel *tunnel) 129{ 130 atomic_inc(&tunnel->ref_count); 131} 132 133static inline void l2tp_tunnel_dec_refcount_1(struct l2tp_tunnel *tunnel) 134{ 135 if (atomic_dec_and_test(&tunnel->ref_count)) 136 l2tp_tunnel_free(tunnel); 137} 138#ifdef L2TP_REFCNT_DEBUG 139#define l2tp_tunnel_inc_refcount(_t) \ 140do { \ 141 pr_debug("l2tp_tunnel_inc_refcount: %s:%d %s: cnt=%d\n", \ 142 __func__, __LINE__, (_t)->name, \ 143 atomic_read(&_t->ref_count)); \ 144 l2tp_tunnel_inc_refcount_1(_t); \ 145} while (0) 146#define l2tp_tunnel_dec_refcount(_t) 147do { \ 148 pr_debug("l2tp_tunnel_dec_refcount: %s:%d %s: cnt=%d\n", \ 149 __func__, __LINE__, (_t)->name, \ 150 atomic_read(&_t->ref_count)); \ 151 l2tp_tunnel_dec_refcount_1(_t); \ 152} while (0) 153#else 154#define l2tp_tunnel_inc_refcount(t) l2tp_tunnel_inc_refcount_1(t) 155#define l2tp_tunnel_dec_refcount(t) l2tp_tunnel_dec_refcount_1(t) 156#endif 157 158/* Session hash global list for L2TPv3. 159 * The session_id SHOULD be random according to RFC3931, but several 160 * L2TP implementations use incrementing session_ids. So we do a real 161 * hash on the session_id, rather than a simple bitmask. 162 */ 163static inline struct hlist_head * 164l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id) 165{ 166 return &pn->l2tp_session_hlist[hash_32(session_id, L2TP_HASH_BITS_2)]; 167 168} 169 170/* Lookup the tunnel socket, possibly involving the fs code if the socket is 171 * owned by userspace. A struct sock returned from this function must be 172 * released using l2tp_tunnel_sock_put once you're done with it. 173 */ 174struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel) 175{ 176 int err = 0; 177 struct socket *sock = NULL; 178 struct sock *sk = NULL; 179 180 if (!tunnel) 181 goto out; 182 183 if (tunnel->fd >= 0) { 184 /* Socket is owned by userspace, who might be in the process 185 * of closing it. Look the socket up using the fd to ensure 186 * consistency. 187 */ 188 sock = sockfd_lookup(tunnel->fd, &err); 189 if (sock) 190 sk = sock->sk; 191 } else { 192 /* Socket is owned by kernelspace */ 193 sk = tunnel->sock; 194 } 195 196out: 197 return sk; 198} 199EXPORT_SYMBOL_GPL(l2tp_tunnel_sock_lookup); 200 201/* Drop a reference to a tunnel socket obtained via. l2tp_tunnel_sock_put */ 202void l2tp_tunnel_sock_put(struct sock *sk) 203{ 204 struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk); 205 if (tunnel) { 206 if (tunnel->fd >= 0) { 207 /* Socket is owned by userspace */ 208 sockfd_put(sk->sk_socket); 209 } 210 sock_put(sk); 211 } 212} 213EXPORT_SYMBOL_GPL(l2tp_tunnel_sock_put); 214 215/* Lookup a session by id in the global session list 216 */ 217static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id) 218{ 219 struct l2tp_net *pn = l2tp_pernet(net); 220 struct hlist_head *session_list = 221 l2tp_session_id_hash_2(pn, session_id); 222 struct l2tp_session *session; 223 224 rcu_read_lock_bh(); 225 hlist_for_each_entry_rcu(session, session_list, global_hlist) { 226 if (session->session_id == session_id) { 227 rcu_read_unlock_bh(); 228 return session; 229 } 230 } 231 rcu_read_unlock_bh(); 232 233 return NULL; 234} 235 236/* Session hash list. 237 * The session_id SHOULD be random according to RFC2661, but several 238 * L2TP implementations (Cisco and Microsoft) use incrementing 239 * session_ids. So we do a real hash on the session_id, rather than a 240 * simple bitmask. 241 */ 242static inline struct hlist_head * 243l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id) 244{ 245 return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)]; 246} 247 248/* Lookup a session by id 249 */ 250struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id) 251{ 252 struct hlist_head *session_list; 253 struct l2tp_session *session; 254 255 /* In L2TPv3, session_ids are unique over all tunnels and we 256 * sometimes need to look them up before we know the 257 * tunnel. 258 */ 259 if (tunnel == NULL) 260 return l2tp_session_find_2(net, session_id); 261 262 session_list = l2tp_session_id_hash(tunnel, session_id); 263 read_lock_bh(&tunnel->hlist_lock); 264 hlist_for_each_entry(session, session_list, hlist) { 265 if (session->session_id == session_id) { 266 read_unlock_bh(&tunnel->hlist_lock); 267 return session; 268 } 269 } 270 read_unlock_bh(&tunnel->hlist_lock); 271 272 return NULL; 273} 274EXPORT_SYMBOL_GPL(l2tp_session_find); 275 276struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth) 277{ 278 int hash; 279 struct l2tp_session *session; 280 int count = 0; 281 282 read_lock_bh(&tunnel->hlist_lock); 283 for (hash = 0; hash < L2TP_HASH_SIZE; hash++) { 284 hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) { 285 if (++count > nth) { 286 read_unlock_bh(&tunnel->hlist_lock); 287 return session; 288 } 289 } 290 } 291 292 read_unlock_bh(&tunnel->hlist_lock); 293 294 return NULL; 295} 296EXPORT_SYMBOL_GPL(l2tp_session_find_nth); 297 298/* Lookup a session by interface name. 299 * This is very inefficient but is only used by management interfaces. 300 */ 301struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname) 302{ 303 struct l2tp_net *pn = l2tp_pernet(net); 304 int hash; 305 struct l2tp_session *session; 306 307 rcu_read_lock_bh(); 308 for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) { 309 hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) { 310 if (!strcmp(session->ifname, ifname)) { 311 rcu_read_unlock_bh(); 312 return session; 313 } 314 } 315 } 316 317 rcu_read_unlock_bh(); 318 319 return NULL; 320} 321EXPORT_SYMBOL_GPL(l2tp_session_find_by_ifname); 322 323/* Lookup a tunnel by id 324 */ 325struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id) 326{ 327 struct l2tp_tunnel *tunnel; 328 struct l2tp_net *pn = l2tp_pernet(net); 329 330 rcu_read_lock_bh(); 331 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) { 332 if (tunnel->tunnel_id == tunnel_id) { 333 rcu_read_unlock_bh(); 334 return tunnel; 335 } 336 } 337 rcu_read_unlock_bh(); 338 339 return NULL; 340} 341EXPORT_SYMBOL_GPL(l2tp_tunnel_find); 342 343struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth) 344{ 345 struct l2tp_net *pn = l2tp_pernet(net); 346 struct l2tp_tunnel *tunnel; 347 int count = 0; 348 349 rcu_read_lock_bh(); 350 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) { 351 if (++count > nth) { 352 rcu_read_unlock_bh(); 353 return tunnel; 354 } 355 } 356 357 rcu_read_unlock_bh(); 358 359 return NULL; 360} 361EXPORT_SYMBOL_GPL(l2tp_tunnel_find_nth); 362 363/***************************************************************************** 364 * Receive data handling 365 *****************************************************************************/ 366 367/* Queue a skb in order. We come here only if the skb has an L2TP sequence 368 * number. 369 */ 370static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb) 371{ 372 struct sk_buff *skbp; 373 struct sk_buff *tmp; 374 u32 ns = L2TP_SKB_CB(skb)->ns; 375 struct l2tp_stats *sstats; 376 377 spin_lock_bh(&session->reorder_q.lock); 378 sstats = &session->stats; 379 skb_queue_walk_safe(&session->reorder_q, skbp, tmp) { 380 if (L2TP_SKB_CB(skbp)->ns > ns) { 381 __skb_queue_before(&session->reorder_q, skbp, skb); 382 l2tp_dbg(session, L2TP_MSG_SEQ, 383 "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n", 384 session->name, ns, L2TP_SKB_CB(skbp)->ns, 385 skb_queue_len(&session->reorder_q)); 386 u64_stats_update_begin(&sstats->syncp); 387 sstats->rx_oos_packets++; 388 u64_stats_update_end(&sstats->syncp); 389 goto out; 390 } 391 } 392 393 __skb_queue_tail(&session->reorder_q, skb); 394 395out: 396 spin_unlock_bh(&session->reorder_q.lock); 397} 398 399/* Dequeue a single skb. 400 */ 401static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb) 402{ 403 struct l2tp_tunnel *tunnel = session->tunnel; 404 int length = L2TP_SKB_CB(skb)->length; 405 struct l2tp_stats *tstats, *sstats; 406 407 /* We're about to requeue the skb, so return resources 408 * to its current owner (a socket receive buffer). 409 */ 410 skb_orphan(skb); 411 412 tstats = &tunnel->stats; 413 u64_stats_update_begin(&tstats->syncp); 414 sstats = &session->stats; 415 u64_stats_update_begin(&sstats->syncp); 416 tstats->rx_packets++; 417 tstats->rx_bytes += length; 418 sstats->rx_packets++; 419 sstats->rx_bytes += length; 420 u64_stats_update_end(&tstats->syncp); 421 u64_stats_update_end(&sstats->syncp); 422 423 if (L2TP_SKB_CB(skb)->has_seq) { 424 /* Bump our Nr */ 425 session->nr++; 426 if (tunnel->version == L2TP_HDR_VER_2) 427 session->nr &= 0xffff; 428 else 429 session->nr &= 0xffffff; 430 431 l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated nr to %hu\n", 432 session->name, session->nr); 433 } 434 435 /* call private receive handler */ 436 if (session->recv_skb != NULL) 437 (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length); 438 else 439 kfree_skb(skb); 440 441 if (session->deref) 442 (*session->deref)(session); 443} 444 445/* Dequeue skbs from the session's reorder_q, subject to packet order. 446 * Skbs that have been in the queue for too long are simply discarded. 447 */ 448static void l2tp_recv_dequeue(struct l2tp_session *session) 449{ 450 struct sk_buff *skb; 451 struct sk_buff *tmp; 452 struct l2tp_stats *sstats; 453 454 /* If the pkt at the head of the queue has the nr that we 455 * expect to send up next, dequeue it and any other 456 * in-sequence packets behind it. 457 */ 458start: 459 spin_lock_bh(&session->reorder_q.lock); 460 sstats = &session->stats; 461 skb_queue_walk_safe(&session->reorder_q, skb, tmp) { 462 if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) { 463 u64_stats_update_begin(&sstats->syncp); 464 sstats->rx_seq_discards++; 465 sstats->rx_errors++; 466 u64_stats_update_end(&sstats->syncp); 467 l2tp_dbg(session, L2TP_MSG_SEQ, 468 "%s: oos pkt %u len %d discarded (too old), waiting for %u, reorder_q_len=%d\n", 469 session->name, L2TP_SKB_CB(skb)->ns, 470 L2TP_SKB_CB(skb)->length, session->nr, 471 skb_queue_len(&session->reorder_q)); 472 session->reorder_skip = 1; 473 __skb_unlink(skb, &session->reorder_q); 474 kfree_skb(skb); 475 if (session->deref) 476 (*session->deref)(session); 477 continue; 478 } 479 480 if (L2TP_SKB_CB(skb)->has_seq) { 481 if (session->reorder_skip) { 482 l2tp_dbg(session, L2TP_MSG_SEQ, 483 "%s: advancing nr to next pkt: %u -> %u", 484 session->name, session->nr, 485 L2TP_SKB_CB(skb)->ns); 486 session->reorder_skip = 0; 487 session->nr = L2TP_SKB_CB(skb)->ns; 488 } 489 if (L2TP_SKB_CB(skb)->ns != session->nr) { 490 l2tp_dbg(session, L2TP_MSG_SEQ, 491 "%s: holding oos pkt %u len %d, waiting for %u, reorder_q_len=%d\n", 492 session->name, L2TP_SKB_CB(skb)->ns, 493 L2TP_SKB_CB(skb)->length, session->nr, 494 skb_queue_len(&session->reorder_q)); 495 goto out; 496 } 497 } 498 __skb_unlink(skb, &session->reorder_q); 499 500 /* Process the skb. We release the queue lock while we 501 * do so to let other contexts process the queue. 502 */ 503 spin_unlock_bh(&session->reorder_q.lock); 504 l2tp_recv_dequeue_skb(session, skb); 505 goto start; 506 } 507 508out: 509 spin_unlock_bh(&session->reorder_q.lock); 510} 511 512static inline int l2tp_verify_udp_checksum(struct sock *sk, 513 struct sk_buff *skb) 514{ 515 struct udphdr *uh = udp_hdr(skb); 516 u16 ulen = ntohs(uh->len); 517 __wsum psum; 518 519 if (sk->sk_no_check || skb_csum_unnecessary(skb)) 520 return 0; 521 522#if IS_ENABLED(CONFIG_IPV6) 523 if (sk->sk_family == PF_INET6) { 524 if (!uh->check) { 525 LIMIT_NETDEBUG(KERN_INFO "L2TP: IPv6: checksum is 0\n"); 526 return 1; 527 } 528 if ((skb->ip_summed == CHECKSUM_COMPLETE) && 529 !csum_ipv6_magic(&ipv6_hdr(skb)->saddr, 530 &ipv6_hdr(skb)->daddr, ulen, 531 IPPROTO_UDP, skb->csum)) { 532 skb->ip_summed = CHECKSUM_UNNECESSARY; 533 return 0; 534 } 535 skb->csum = ~csum_unfold(csum_ipv6_magic(&ipv6_hdr(skb)->saddr, 536 &ipv6_hdr(skb)->daddr, 537 skb->len, IPPROTO_UDP, 538 0)); 539 } else 540#endif 541 { 542 struct inet_sock *inet; 543 if (!uh->check) 544 return 0; 545 inet = inet_sk(sk); 546 psum = csum_tcpudp_nofold(inet->inet_saddr, inet->inet_daddr, 547 ulen, IPPROTO_UDP, 0); 548 549 if ((skb->ip_summed == CHECKSUM_COMPLETE) && 550 !csum_fold(csum_add(psum, skb->csum))) 551 return 0; 552 skb->csum = psum; 553 } 554 555 return __skb_checksum_complete(skb); 556} 557 558/* Do receive processing of L2TP data frames. We handle both L2TPv2 559 * and L2TPv3 data frames here. 560 * 561 * L2TPv2 Data Message Header 562 * 563 * 0 1 2 3 564 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 565 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 566 * |T|L|x|x|S|x|O|P|x|x|x|x| Ver | Length (opt) | 567 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 568 * | Tunnel ID | Session ID | 569 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 570 * | Ns (opt) | Nr (opt) | 571 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 572 * | Offset Size (opt) | Offset pad... (opt) 573 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 574 * 575 * Data frames are marked by T=0. All other fields are the same as 576 * those in L2TP control frames. 577 * 578 * L2TPv3 Data Message Header 579 * 580 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 581 * | L2TP Session Header | 582 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 583 * | L2-Specific Sublayer | 584 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 585 * | Tunnel Payload ... 586 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 587 * 588 * L2TPv3 Session Header Over IP 589 * 590 * 0 1 2 3 591 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 592 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 593 * | Session ID | 594 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 595 * | Cookie (optional, maximum 64 bits)... 596 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 597 * | 598 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 599 * 600 * L2TPv3 L2-Specific Sublayer Format 601 * 602 * 0 1 2 3 603 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 604 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 605 * |x|S|x|x|x|x|x|x| Sequence Number | 606 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 607 * 608 * Cookie value, sublayer format and offset (pad) are negotiated with 609 * the peer when the session is set up. Unlike L2TPv2, we do not need 610 * to parse the packet header to determine if optional fields are 611 * present. 612 * 613 * Caller must already have parsed the frame and determined that it is 614 * a data (not control) frame before coming here. Fields up to the 615 * session-id have already been parsed and ptr points to the data 616 * after the session-id. 617 */ 618void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb, 619 unsigned char *ptr, unsigned char *optr, u16 hdrflags, 620 int length, int (*payload_hook)(struct sk_buff *skb)) 621{ 622 struct l2tp_tunnel *tunnel = session->tunnel; 623 int offset; 624 u32 ns, nr; 625 struct l2tp_stats *sstats = &session->stats; 626 627 /* The ref count is increased since we now hold a pointer to 628 * the session. Take care to decrement the refcnt when exiting 629 * this function from now on... 630 */ 631 l2tp_session_inc_refcount(session); 632 if (session->ref) 633 (*session->ref)(session); 634 635 /* Parse and check optional cookie */ 636 if (session->peer_cookie_len > 0) { 637 if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) { 638 l2tp_info(tunnel, L2TP_MSG_DATA, 639 "%s: cookie mismatch (%u/%u). Discarding.\n", 640 tunnel->name, tunnel->tunnel_id, 641 session->session_id); 642 u64_stats_update_begin(&sstats->syncp); 643 sstats->rx_cookie_discards++; 644 u64_stats_update_end(&sstats->syncp); 645 goto discard; 646 } 647 ptr += session->peer_cookie_len; 648 } 649 650 /* Handle the optional sequence numbers. Sequence numbers are 651 * in different places for L2TPv2 and L2TPv3. 652 * 653 * If we are the LAC, enable/disable sequence numbers under 654 * the control of the LNS. If no sequence numbers present but 655 * we were expecting them, discard frame. 656 */ 657 ns = nr = 0; 658 L2TP_SKB_CB(skb)->has_seq = 0; 659 if (tunnel->version == L2TP_HDR_VER_2) { 660 if (hdrflags & L2TP_HDRFLAG_S) { 661 ns = ntohs(*(__be16 *) ptr); 662 ptr += 2; 663 nr = ntohs(*(__be16 *) ptr); 664 ptr += 2; 665 666 /* Store L2TP info in the skb */ 667 L2TP_SKB_CB(skb)->ns = ns; 668 L2TP_SKB_CB(skb)->has_seq = 1; 669 670 l2tp_dbg(session, L2TP_MSG_SEQ, 671 "%s: recv data ns=%u, nr=%u, session nr=%u\n", 672 session->name, ns, nr, session->nr); 673 } 674 } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) { 675 u32 l2h = ntohl(*(__be32 *) ptr); 676 677 if (l2h & 0x40000000) { 678 ns = l2h & 0x00ffffff; 679 680 /* Store L2TP info in the skb */ 681 L2TP_SKB_CB(skb)->ns = ns; 682 L2TP_SKB_CB(skb)->has_seq = 1; 683 684 l2tp_dbg(session, L2TP_MSG_SEQ, 685 "%s: recv data ns=%u, session nr=%u\n", 686 session->name, ns, session->nr); 687 } 688 } 689 690 /* Advance past L2-specific header, if present */ 691 ptr += session->l2specific_len; 692 693 if (L2TP_SKB_CB(skb)->has_seq) { 694 /* Received a packet with sequence numbers. If we're the LNS, 695 * check if we sre sending sequence numbers and if not, 696 * configure it so. 697 */ 698 if ((!session->lns_mode) && (!session->send_seq)) { 699 l2tp_info(session, L2TP_MSG_SEQ, 700 "%s: requested to enable seq numbers by LNS\n", 701 session->name); 702 session->send_seq = -1; 703 l2tp_session_set_header_len(session, tunnel->version); 704 } 705 } else { 706 /* No sequence numbers. 707 * If user has configured mandatory sequence numbers, discard. 708 */ 709 if (session->recv_seq) { 710 l2tp_warn(session, L2TP_MSG_SEQ, 711 "%s: recv data has no seq numbers when required. Discarding.\n", 712 session->name); 713 u64_stats_update_begin(&sstats->syncp); 714 sstats->rx_seq_discards++; 715 u64_stats_update_end(&sstats->syncp); 716 goto discard; 717 } 718 719 /* If we're the LAC and we're sending sequence numbers, the 720 * LNS has requested that we no longer send sequence numbers. 721 * If we're the LNS and we're sending sequence numbers, the 722 * LAC is broken. Discard the frame. 723 */ 724 if ((!session->lns_mode) && (session->send_seq)) { 725 l2tp_info(session, L2TP_MSG_SEQ, 726 "%s: requested to disable seq numbers by LNS\n", 727 session->name); 728 session->send_seq = 0; 729 l2tp_session_set_header_len(session, tunnel->version); 730 } else if (session->send_seq) { 731 l2tp_warn(session, L2TP_MSG_SEQ, 732 "%s: recv data has no seq numbers when required. Discarding.\n", 733 session->name); 734 u64_stats_update_begin(&sstats->syncp); 735 sstats->rx_seq_discards++; 736 u64_stats_update_end(&sstats->syncp); 737 goto discard; 738 } 739 } 740 741 /* Session data offset is handled differently for L2TPv2 and 742 * L2TPv3. For L2TPv2, there is an optional 16-bit value in 743 * the header. For L2TPv3, the offset is negotiated using AVPs 744 * in the session setup control protocol. 745 */ 746 if (tunnel->version == L2TP_HDR_VER_2) { 747 /* If offset bit set, skip it. */ 748 if (hdrflags & L2TP_HDRFLAG_O) { 749 offset = ntohs(*(__be16 *)ptr); 750 ptr += 2 + offset; 751 } 752 } else 753 ptr += session->offset; 754 755 offset = ptr - optr; 756 if (!pskb_may_pull(skb, offset)) 757 goto discard; 758 759 __skb_pull(skb, offset); 760 761 /* If caller wants to process the payload before we queue the 762 * packet, do so now. 763 */ 764 if (payload_hook) 765 if ((*payload_hook)(skb)) 766 goto discard; 767 768 /* Prepare skb for adding to the session's reorder_q. Hold 769 * packets for max reorder_timeout or 1 second if not 770 * reordering. 771 */ 772 L2TP_SKB_CB(skb)->length = length; 773 L2TP_SKB_CB(skb)->expires = jiffies + 774 (session->reorder_timeout ? session->reorder_timeout : HZ); 775 776 /* Add packet to the session's receive queue. Reordering is done here, if 777 * enabled. Saved L2TP protocol info is stored in skb->sb[]. 778 */ 779 if (L2TP_SKB_CB(skb)->has_seq) { 780 if (session->reorder_timeout != 0) { 781 /* Packet reordering enabled. Add skb to session's 782 * reorder queue, in order of ns. 783 */ 784 l2tp_recv_queue_skb(session, skb); 785 } else { 786 /* Packet reordering disabled. Discard out-of-sequence 787 * packets 788 */ 789 if (L2TP_SKB_CB(skb)->ns != session->nr) { 790 u64_stats_update_begin(&sstats->syncp); 791 sstats->rx_seq_discards++; 792 u64_stats_update_end(&sstats->syncp); 793 l2tp_dbg(session, L2TP_MSG_SEQ, 794 "%s: oos pkt %u len %d discarded, waiting for %u, reorder_q_len=%d\n", 795 session->name, L2TP_SKB_CB(skb)->ns, 796 L2TP_SKB_CB(skb)->length, session->nr, 797 skb_queue_len(&session->reorder_q)); 798 goto discard; 799 } 800 skb_queue_tail(&session->reorder_q, skb); 801 } 802 } else { 803 /* No sequence numbers. Add the skb to the tail of the 804 * reorder queue. This ensures that it will be 805 * delivered after all previous sequenced skbs. 806 */ 807 skb_queue_tail(&session->reorder_q, skb); 808 } 809 810 /* Try to dequeue as many skbs from reorder_q as we can. */ 811 l2tp_recv_dequeue(session); 812 813 l2tp_session_dec_refcount(session); 814 815 return; 816 817discard: 818 u64_stats_update_begin(&sstats->syncp); 819 sstats->rx_errors++; 820 u64_stats_update_end(&sstats->syncp); 821 kfree_skb(skb); 822 823 if (session->deref) 824 (*session->deref)(session); 825 826 l2tp_session_dec_refcount(session); 827} 828EXPORT_SYMBOL(l2tp_recv_common); 829 830/* Internal UDP receive frame. Do the real work of receiving an L2TP data frame 831 * here. The skb is not on a list when we get here. 832 * Returns 0 if the packet was a data packet and was successfully passed on. 833 * Returns 1 if the packet was not a good data packet and could not be 834 * forwarded. All such packets are passed up to userspace to deal with. 835 */ 836static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb, 837 int (*payload_hook)(struct sk_buff *skb)) 838{ 839 struct l2tp_session *session = NULL; 840 unsigned char *ptr, *optr; 841 u16 hdrflags; 842 u32 tunnel_id, session_id; 843 u16 version; 844 int length; 845 struct l2tp_stats *tstats; 846 847 if (tunnel->sock && l2tp_verify_udp_checksum(tunnel->sock, skb)) 848 goto discard_bad_csum; 849 850 /* UDP always verifies the packet length. */ 851 __skb_pull(skb, sizeof(struct udphdr)); 852 853 /* Short packet? */ 854 if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) { 855 l2tp_info(tunnel, L2TP_MSG_DATA, 856 "%s: recv short packet (len=%d)\n", 857 tunnel->name, skb->len); 858 goto error; 859 } 860 861 /* Trace packet contents, if enabled */ 862 if (tunnel->debug & L2TP_MSG_DATA) { 863 length = min(32u, skb->len); 864 if (!pskb_may_pull(skb, length)) 865 goto error; 866 867 pr_debug("%s: recv\n", tunnel->name); 868 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length); 869 } 870 871 /* Point to L2TP header */ 872 optr = ptr = skb->data; 873 874 /* Get L2TP header flags */ 875 hdrflags = ntohs(*(__be16 *) ptr); 876 877 /* Check protocol version */ 878 version = hdrflags & L2TP_HDR_VER_MASK; 879 if (version != tunnel->version) { 880 l2tp_info(tunnel, L2TP_MSG_DATA, 881 "%s: recv protocol version mismatch: got %d expected %d\n", 882 tunnel->name, version, tunnel->version); 883 goto error; 884 } 885 886 /* Get length of L2TP packet */ 887 length = skb->len; 888 889 /* If type is control packet, it is handled by userspace. */ 890 if (hdrflags & L2TP_HDRFLAG_T) { 891 l2tp_dbg(tunnel, L2TP_MSG_DATA, 892 "%s: recv control packet, len=%d\n", 893 tunnel->name, length); 894 goto error; 895 } 896 897 /* Skip flags */ 898 ptr += 2; 899 900 if (tunnel->version == L2TP_HDR_VER_2) { 901 /* If length is present, skip it */ 902 if (hdrflags & L2TP_HDRFLAG_L) 903 ptr += 2; 904 905 /* Extract tunnel and session ID */ 906 tunnel_id = ntohs(*(__be16 *) ptr); 907 ptr += 2; 908 session_id = ntohs(*(__be16 *) ptr); 909 ptr += 2; 910 } else { 911 ptr += 2; /* skip reserved bits */ 912 tunnel_id = tunnel->tunnel_id; 913 session_id = ntohl(*(__be32 *) ptr); 914 ptr += 4; 915 } 916 917 /* Find the session context */ 918 session = l2tp_session_find(tunnel->l2tp_net, tunnel, session_id); 919 if (!session || !session->recv_skb) { 920 /* Not found? Pass to userspace to deal with */ 921 l2tp_info(tunnel, L2TP_MSG_DATA, 922 "%s: no session found (%u/%u). Passing up.\n", 923 tunnel->name, tunnel_id, session_id); 924 goto error; 925 } 926 927 l2tp_recv_common(session, skb, ptr, optr, hdrflags, length, payload_hook); 928 929 return 0; 930 931discard_bad_csum: 932 LIMIT_NETDEBUG("%s: UDP: bad checksum\n", tunnel->name); 933 UDP_INC_STATS_USER(tunnel->l2tp_net, UDP_MIB_INERRORS, 0); 934 tstats = &tunnel->stats; 935 u64_stats_update_begin(&tstats->syncp); 936 tstats->rx_errors++; 937 u64_stats_update_end(&tstats->syncp); 938 kfree_skb(skb); 939 940 return 0; 941 942error: 943 /* Put UDP header back */ 944 __skb_push(skb, sizeof(struct udphdr)); 945 946 return 1; 947} 948 949/* UDP encapsulation receive handler. See net/ipv4/udp.c. 950 * Return codes: 951 * 0 : success. 952 * <0: error 953 * >0: skb should be passed up to userspace as UDP. 954 */ 955int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb) 956{ 957 struct l2tp_tunnel *tunnel; 958 959 tunnel = l2tp_sock_to_tunnel(sk); 960 if (tunnel == NULL) 961 goto pass_up; 962 963 l2tp_dbg(tunnel, L2TP_MSG_DATA, "%s: received %d bytes\n", 964 tunnel->name, skb->len); 965 966 if (l2tp_udp_recv_core(tunnel, skb, tunnel->recv_payload_hook)) 967 goto pass_up_put; 968 969 sock_put(sk); 970 return 0; 971 972pass_up_put: 973 sock_put(sk); 974pass_up: 975 return 1; 976} 977EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv); 978 979/************************************************************************ 980 * Transmit handling 981 ***********************************************************************/ 982 983/* Build an L2TP header for the session into the buffer provided. 984 */ 985static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf) 986{ 987 struct l2tp_tunnel *tunnel = session->tunnel; 988 __be16 *bufp = buf; 989 __be16 *optr = buf; 990 u16 flags = L2TP_HDR_VER_2; 991 u32 tunnel_id = tunnel->peer_tunnel_id; 992 u32 session_id = session->peer_session_id; 993 994 if (session->send_seq) 995 flags |= L2TP_HDRFLAG_S; 996 997 /* Setup L2TP header. */ 998 *bufp++ = htons(flags); 999 *bufp++ = htons(tunnel_id); 1000 *bufp++ = htons(session_id); 1001 if (session->send_seq) { 1002 *bufp++ = htons(session->ns); 1003 *bufp++ = 0; 1004 session->ns++; 1005 session->ns &= 0xffff; 1006 l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated ns to %u\n", 1007 session->name, session->ns); 1008 } 1009 1010 return bufp - optr; 1011} 1012 1013static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf) 1014{ 1015 struct l2tp_tunnel *tunnel = session->tunnel; 1016 char *bufp = buf; 1017 char *optr = bufp; 1018 1019 /* Setup L2TP header. The header differs slightly for UDP and 1020 * IP encapsulations. For UDP, there is 4 bytes of flags. 1021 */ 1022 if (tunnel->encap == L2TP_ENCAPTYPE_UDP) { 1023 u16 flags = L2TP_HDR_VER_3; 1024 *((__be16 *) bufp) = htons(flags); 1025 bufp += 2; 1026 *((__be16 *) bufp) = 0; 1027 bufp += 2; 1028 } 1029 1030 *((__be32 *) bufp) = htonl(session->peer_session_id); 1031 bufp += 4; 1032 if (session->cookie_len) { 1033 memcpy(bufp, &session->cookie[0], session->cookie_len); 1034 bufp += session->cookie_len; 1035 } 1036 if (session->l2specific_len) { 1037 if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) { 1038 u32 l2h = 0; 1039 if (session->send_seq) { 1040 l2h = 0x40000000 | session->ns; 1041 session->ns++; 1042 session->ns &= 0xffffff; 1043 l2tp_dbg(session, L2TP_MSG_SEQ, 1044 "%s: updated ns to %u\n", 1045 session->name, session->ns); 1046 } 1047 1048 *((__be32 *) bufp) = htonl(l2h); 1049 } 1050 bufp += session->l2specific_len; 1051 } 1052 if (session->offset) 1053 bufp += session->offset; 1054 1055 return bufp - optr; 1056} 1057 1058static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, 1059 struct flowi *fl, size_t data_len) 1060{ 1061 struct l2tp_tunnel *tunnel = session->tunnel; 1062 unsigned int len = skb->len; 1063 int error; 1064 struct l2tp_stats *tstats, *sstats; 1065 1066 /* Debug */ 1067 if (session->send_seq) 1068 l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %Zd bytes, ns=%u\n", 1069 session->name, data_len, session->ns - 1); 1070 else 1071 l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %Zd bytes\n", 1072 session->name, data_len); 1073 1074 if (session->debug & L2TP_MSG_DATA) { 1075 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 1076 unsigned char *datap = skb->data + uhlen; 1077 1078 pr_debug("%s: xmit\n", session->name); 1079 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, 1080 datap, min_t(size_t, 32, len - uhlen)); 1081 } 1082 1083 /* Queue the packet to IP for output */ 1084 skb->local_df = 1; 1085#if IS_ENABLED(CONFIG_IPV6) 1086 if (skb->sk->sk_family == PF_INET6) 1087 error = inet6_csk_xmit(skb, NULL); 1088 else 1089#endif 1090 error = ip_queue_xmit(skb, fl); 1091 1092 /* Update stats */ 1093 tstats = &tunnel->stats; 1094 u64_stats_update_begin(&tstats->syncp); 1095 sstats = &session->stats; 1096 u64_stats_update_begin(&sstats->syncp); 1097 if (error >= 0) { 1098 tstats->tx_packets++; 1099 tstats->tx_bytes += len; 1100 sstats->tx_packets++; 1101 sstats->tx_bytes += len; 1102 } else { 1103 tstats->tx_errors++; 1104 sstats->tx_errors++; 1105 } 1106 u64_stats_update_end(&tstats->syncp); 1107 u64_stats_update_end(&sstats->syncp); 1108 1109 return 0; 1110} 1111 1112/* Automatically called when the skb is freed. 1113 */ 1114static void l2tp_sock_wfree(struct sk_buff *skb) 1115{ 1116 sock_put(skb->sk); 1117} 1118 1119/* For data skbs that we transmit, we associate with the tunnel socket 1120 * but don't do accounting. 1121 */ 1122static inline void l2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk) 1123{ 1124 sock_hold(sk); 1125 skb->sk = sk; 1126 skb->destructor = l2tp_sock_wfree; 1127} 1128 1129#if IS_ENABLED(CONFIG_IPV6) 1130static void l2tp_xmit_ipv6_csum(struct sock *sk, struct sk_buff *skb, 1131 int udp_len) 1132{ 1133 struct ipv6_pinfo *np = inet6_sk(sk); 1134 struct udphdr *uh = udp_hdr(skb); 1135 1136 if (!skb_dst(skb) || !skb_dst(skb)->dev || 1137 !(skb_dst(skb)->dev->features & NETIF_F_IPV6_CSUM)) { 1138 __wsum csum = skb_checksum(skb, 0, udp_len, 0); 1139 skb->ip_summed = CHECKSUM_UNNECESSARY; 1140 uh->check = csum_ipv6_magic(&np->saddr, &np->daddr, udp_len, 1141 IPPROTO_UDP, csum); 1142 if (uh->check == 0) 1143 uh->check = CSUM_MANGLED_0; 1144 } else { 1145 skb->ip_summed = CHECKSUM_PARTIAL; 1146 skb->csum_start = skb_transport_header(skb) - skb->head; 1147 skb->csum_offset = offsetof(struct udphdr, check); 1148 uh->check = ~csum_ipv6_magic(&np->saddr, &np->daddr, 1149 udp_len, IPPROTO_UDP, 0); 1150 } 1151} 1152#endif 1153 1154/* If caller requires the skb to have a ppp header, the header must be 1155 * inserted in the skb data before calling this function. 1156 */ 1157int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len) 1158{ 1159 int data_len = skb->len; 1160 struct l2tp_tunnel *tunnel = session->tunnel; 1161 struct sock *sk = tunnel->sock; 1162 struct flowi *fl; 1163 struct udphdr *uh; 1164 struct inet_sock *inet; 1165 __wsum csum; 1166 int headroom; 1167 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; 1168 int udp_len; 1169 int ret = NET_XMIT_SUCCESS; 1170 1171 /* Check that there's enough headroom in the skb to insert IP, 1172 * UDP and L2TP headers. If not enough, expand it to 1173 * make room. Adjust truesize. 1174 */ 1175 headroom = NET_SKB_PAD + sizeof(struct iphdr) + 1176 uhlen + hdr_len; 1177 if (skb_cow_head(skb, headroom)) { 1178 kfree_skb(skb); 1179 return NET_XMIT_DROP; 1180 } 1181 1182 skb_orphan(skb); 1183 /* Setup L2TP header */ 1184 session->build_header(session, __skb_push(skb, hdr_len)); 1185 1186 /* Reset skb netfilter state */ 1187 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); 1188 IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED | 1189 IPSKB_REROUTED); 1190 nf_reset(skb); 1191 1192 bh_lock_sock(sk); 1193 if (sock_owned_by_user(sk)) { 1194 kfree_skb(skb); 1195 ret = NET_XMIT_DROP; 1196 goto out_unlock; 1197 } 1198 1199 /* Get routing info from the tunnel socket */ 1200 skb_dst_drop(skb); 1201 skb_dst_set(skb, dst_clone(__sk_dst_check(sk, 0))); 1202 1203 inet = inet_sk(sk); 1204 fl = &inet->cork.fl; 1205 switch (tunnel->encap) { 1206 case L2TP_ENCAPTYPE_UDP: 1207 /* Setup UDP header */ 1208 __skb_push(skb, sizeof(*uh)); 1209 skb_reset_transport_header(skb); 1210 uh = udp_hdr(skb); 1211 uh->source = inet->inet_sport; 1212 uh->dest = inet->inet_dport; 1213 udp_len = uhlen + hdr_len + data_len; 1214 uh->len = htons(udp_len); 1215 uh->check = 0; 1216 1217 /* Calculate UDP checksum if configured to do so */ 1218#if IS_ENABLED(CONFIG_IPV6) 1219 if (sk->sk_family == PF_INET6) 1220 l2tp_xmit_ipv6_csum(sk, skb, udp_len); 1221 else 1222#endif 1223 if (sk->sk_no_check == UDP_CSUM_NOXMIT) 1224 skb->ip_summed = CHECKSUM_NONE; 1225 else if ((skb_dst(skb) && skb_dst(skb)->dev) && 1226 (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM))) { 1227 skb->ip_summed = CHECKSUM_COMPLETE; 1228 csum = skb_checksum(skb, 0, udp_len, 0); 1229 uh->check = csum_tcpudp_magic(inet->inet_saddr, 1230 inet->inet_daddr, 1231 udp_len, IPPROTO_UDP, csum); 1232 if (uh->check == 0) 1233 uh->check = CSUM_MANGLED_0; 1234 } else { 1235 skb->ip_summed = CHECKSUM_PARTIAL; 1236 skb->csum_start = skb_transport_header(skb) - skb->head; 1237 skb->csum_offset = offsetof(struct udphdr, check); 1238 uh->check = ~csum_tcpudp_magic(inet->inet_saddr, 1239 inet->inet_daddr, 1240 udp_len, IPPROTO_UDP, 0); 1241 } 1242 break; 1243 1244 case L2TP_ENCAPTYPE_IP: 1245 break; 1246 } 1247 1248 l2tp_skb_set_owner_w(skb, sk); 1249 1250 l2tp_xmit_core(session, skb, fl, data_len); 1251out_unlock: 1252 bh_unlock_sock(sk); 1253 1254 return ret; 1255} 1256EXPORT_SYMBOL_GPL(l2tp_xmit_skb); 1257 1258/***************************************************************************** 1259 * Tinnel and session create/destroy. 1260 *****************************************************************************/ 1261 1262/* Tunnel socket destruct hook. 1263 * The tunnel context is deleted only when all session sockets have been 1264 * closed. 1265 */ 1266static void l2tp_tunnel_destruct(struct sock *sk) 1267{ 1268 struct l2tp_tunnel *tunnel; 1269 struct l2tp_net *pn; 1270 1271 tunnel = sk->sk_user_data; 1272 if (tunnel == NULL) 1273 goto end; 1274 1275 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing...\n", tunnel->name); 1276 1277 1278 /* Disable udp encapsulation */ 1279 switch (tunnel->encap) { 1280 case L2TP_ENCAPTYPE_UDP: 1281 /* No longer an encapsulation socket. See net/ipv4/udp.c */ 1282 (udp_sk(sk))->encap_type = 0; 1283 (udp_sk(sk))->encap_rcv = NULL; 1284 (udp_sk(sk))->encap_destroy = NULL; 1285 break; 1286 case L2TP_ENCAPTYPE_IP: 1287 break; 1288 } 1289 1290 /* Remove hooks into tunnel socket */ 1291 sk->sk_destruct = tunnel->old_sk_destruct; 1292 sk->sk_user_data = NULL; 1293 tunnel->sock = NULL; 1294 1295 /* Remove the tunnel struct from the tunnel list */ 1296 pn = l2tp_pernet(tunnel->l2tp_net); 1297 spin_lock_bh(&pn->l2tp_tunnel_list_lock); 1298 list_del_rcu(&tunnel->list); 1299 spin_unlock_bh(&pn->l2tp_tunnel_list_lock); 1300 atomic_dec(&l2tp_tunnel_count); 1301 1302 l2tp_tunnel_closeall(tunnel); 1303 l2tp_tunnel_dec_refcount(tunnel); 1304 1305 /* Call the original destructor */ 1306 if (sk->sk_destruct) 1307 (*sk->sk_destruct)(sk); 1308end: 1309 return; 1310} 1311 1312/* When the tunnel is closed, all the attached sessions need to go too. 1313 */ 1314void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel) 1315{ 1316 int hash; 1317 struct hlist_node *walk; 1318 struct hlist_node *tmp; 1319 struct l2tp_session *session; 1320 1321 BUG_ON(tunnel == NULL); 1322 1323 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing all sessions...\n", 1324 tunnel->name); 1325 1326 write_lock_bh(&tunnel->hlist_lock); 1327 for (hash = 0; hash < L2TP_HASH_SIZE; hash++) { 1328again: 1329 hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) { 1330 session = hlist_entry(walk, struct l2tp_session, hlist); 1331 1332 l2tp_info(session, L2TP_MSG_CONTROL, 1333 "%s: closing session\n", session->name); 1334 1335 hlist_del_init(&session->hlist); 1336 1337 /* Since we should hold the sock lock while 1338 * doing any unbinding, we need to release the 1339 * lock we're holding before taking that lock. 1340 * Hold a reference to the sock so it doesn't 1341 * disappear as we're jumping between locks. 1342 */ 1343 if (session->ref != NULL) 1344 (*session->ref)(session); 1345 1346 write_unlock_bh(&tunnel->hlist_lock); 1347 1348 if (tunnel->version != L2TP_HDR_VER_2) { 1349 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net); 1350 1351 spin_lock_bh(&pn->l2tp_session_hlist_lock); 1352 hlist_del_init_rcu(&session->global_hlist); 1353 spin_unlock_bh(&pn->l2tp_session_hlist_lock); 1354 synchronize_rcu(); 1355 } 1356 1357 if (session->session_close != NULL) 1358 (*session->session_close)(session); 1359 1360 if (session->deref != NULL) 1361 (*session->deref)(session); 1362 1363 l2tp_session_dec_refcount(session); 1364 1365 write_lock_bh(&tunnel->hlist_lock); 1366 1367 /* Now restart from the beginning of this hash 1368 * chain. We always remove a session from the 1369 * list so we are guaranteed to make forward 1370 * progress. 1371 */ 1372 goto again; 1373 } 1374 } 1375 write_unlock_bh(&tunnel->hlist_lock); 1376} 1377EXPORT_SYMBOL_GPL(l2tp_tunnel_closeall); 1378 1379/* Tunnel socket destroy hook for UDP encapsulation */ 1380static void l2tp_udp_encap_destroy(struct sock *sk) 1381{ 1382 struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk); 1383 if (tunnel) { 1384 l2tp_tunnel_closeall(tunnel); 1385 sock_put(sk); 1386 } 1387} 1388 1389/* Really kill the tunnel. 1390 * Come here only when all sessions have been cleared from the tunnel. 1391 */ 1392static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel) 1393{ 1394 BUG_ON(atomic_read(&tunnel->ref_count) != 0); 1395 BUG_ON(tunnel->sock != NULL); 1396 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: free...\n", tunnel->name); 1397 kfree_rcu(tunnel, rcu); 1398} 1399 1400/* Workqueue tunnel deletion function */ 1401static void l2tp_tunnel_del_work(struct work_struct *work) 1402{ 1403 struct l2tp_tunnel *tunnel = NULL; 1404 struct socket *sock = NULL; 1405 struct sock *sk = NULL; 1406 1407 tunnel = container_of(work, struct l2tp_tunnel, del_work); 1408 sk = l2tp_tunnel_sock_lookup(tunnel); 1409 if (!sk) 1410 return; 1411 1412 sock = sk->sk_socket; 1413 BUG_ON(!sock); 1414 1415 /* If the tunnel socket was created directly by the kernel, use the 1416 * sk_* API to release the socket now. Otherwise go through the 1417 * inet_* layer to shut the socket down, and let userspace close it. 1418 * In either case the tunnel resources are freed in the socket 1419 * destructor when the tunnel socket goes away. 1420 */ 1421 if (sock->file == NULL) { 1422 kernel_sock_shutdown(sock, SHUT_RDWR); 1423 sk_release_kernel(sk); 1424 } else { 1425 inet_shutdown(sock, 2); 1426 } 1427 1428 l2tp_tunnel_sock_put(sk); 1429} 1430 1431/* Create a socket for the tunnel, if one isn't set up by 1432 * userspace. This is used for static tunnels where there is no 1433 * managing L2TP daemon. 1434 * 1435 * Since we don't want these sockets to keep a namespace alive by 1436 * themselves, we drop the socket's namespace refcount after creation. 1437 * These sockets are freed when the namespace exits using the pernet 1438 * exit hook. 1439 */ 1440static int l2tp_tunnel_sock_create(struct net *net, 1441 u32 tunnel_id, 1442 u32 peer_tunnel_id, 1443 struct l2tp_tunnel_cfg *cfg, 1444 struct socket **sockp) 1445{ 1446 int err = -EINVAL; 1447 struct socket *sock = NULL; 1448 struct sockaddr_in udp_addr = {0}; 1449 struct sockaddr_l2tpip ip_addr = {0}; 1450#if IS_ENABLED(CONFIG_IPV6) 1451 struct sockaddr_in6 udp6_addr = {0}; 1452 struct sockaddr_l2tpip6 ip6_addr = {0}; 1453#endif 1454 1455 switch (cfg->encap) { 1456 case L2TP_ENCAPTYPE_UDP: 1457#if IS_ENABLED(CONFIG_IPV6) 1458 if (cfg->local_ip6 && cfg->peer_ip6) { 1459 err = sock_create_kern(AF_INET6, SOCK_DGRAM, 0, &sock); 1460 if (err < 0) 1461 goto out; 1462 1463 sk_change_net(sock->sk, net); 1464 1465 udp6_addr.sin6_family = AF_INET6; 1466 memcpy(&udp6_addr.sin6_addr, cfg->local_ip6, 1467 sizeof(udp6_addr.sin6_addr)); 1468 udp6_addr.sin6_port = htons(cfg->local_udp_port); 1469 err = kernel_bind(sock, (struct sockaddr *) &udp6_addr, 1470 sizeof(udp6_addr)); 1471 if (err < 0) 1472 goto out; 1473 1474 udp6_addr.sin6_family = AF_INET6; 1475 memcpy(&udp6_addr.sin6_addr, cfg->peer_ip6, 1476 sizeof(udp6_addr.sin6_addr)); 1477 udp6_addr.sin6_port = htons(cfg->peer_udp_port); 1478 err = kernel_connect(sock, 1479 (struct sockaddr *) &udp6_addr, 1480 sizeof(udp6_addr), 0); 1481 if (err < 0) 1482 goto out; 1483 } else 1484#endif 1485 { 1486 err = sock_create_kern(AF_INET, SOCK_DGRAM, 0, &sock); 1487 if (err < 0) 1488 goto out; 1489 1490 sk_change_net(sock->sk, net); 1491 1492 udp_addr.sin_family = AF_INET; 1493 udp_addr.sin_addr = cfg->local_ip; 1494 udp_addr.sin_port = htons(cfg->local_udp_port); 1495 err = kernel_bind(sock, (struct sockaddr *) &udp_addr, 1496 sizeof(udp_addr)); 1497 if (err < 0) 1498 goto out; 1499 1500 udp_addr.sin_family = AF_INET; 1501 udp_addr.sin_addr = cfg->peer_ip; 1502 udp_addr.sin_port = htons(cfg->peer_udp_port); 1503 err = kernel_connect(sock, 1504 (struct sockaddr *) &udp_addr, 1505 sizeof(udp_addr), 0); 1506 if (err < 0) 1507 goto out; 1508 } 1509 1510 if (!cfg->use_udp_checksums) 1511 sock->sk->sk_no_check = UDP_CSUM_NOXMIT; 1512 1513 break; 1514 1515 case L2TP_ENCAPTYPE_IP: 1516#if IS_ENABLED(CONFIG_IPV6) 1517 if (cfg->local_ip6 && cfg->peer_ip6) { 1518 err = sock_create_kern(AF_INET6, SOCK_DGRAM, 1519 IPPROTO_L2TP, &sock); 1520 if (err < 0) 1521 goto out; 1522 1523 sk_change_net(sock->sk, net); 1524 1525 ip6_addr.l2tp_family = AF_INET6; 1526 memcpy(&ip6_addr.l2tp_addr, cfg->local_ip6, 1527 sizeof(ip6_addr.l2tp_addr)); 1528 ip6_addr.l2tp_conn_id = tunnel_id; 1529 err = kernel_bind(sock, (struct sockaddr *) &ip6_addr, 1530 sizeof(ip6_addr)); 1531 if (err < 0) 1532 goto out; 1533 1534 ip6_addr.l2tp_family = AF_INET6; 1535 memcpy(&ip6_addr.l2tp_addr, cfg->peer_ip6, 1536 sizeof(ip6_addr.l2tp_addr)); 1537 ip6_addr.l2tp_conn_id = peer_tunnel_id; 1538 err = kernel_connect(sock, 1539 (struct sockaddr *) &ip6_addr, 1540 sizeof(ip6_addr), 0); 1541 if (err < 0) 1542 goto out; 1543 } else 1544#endif 1545 { 1546 err = sock_create_kern(AF_INET, SOCK_DGRAM, 1547 IPPROTO_L2TP, &sock); 1548 if (err < 0) 1549 goto out; 1550 1551 sk_change_net(sock->sk, net); 1552 1553 ip_addr.l2tp_family = AF_INET; 1554 ip_addr.l2tp_addr = cfg->local_ip; 1555 ip_addr.l2tp_conn_id = tunnel_id; 1556 err = kernel_bind(sock, (struct sockaddr *) &ip_addr, 1557 sizeof(ip_addr)); 1558 if (err < 0) 1559 goto out; 1560 1561 ip_addr.l2tp_family = AF_INET; 1562 ip_addr.l2tp_addr = cfg->peer_ip; 1563 ip_addr.l2tp_conn_id = peer_tunnel_id; 1564 err = kernel_connect(sock, (struct sockaddr *) &ip_addr, 1565 sizeof(ip_addr), 0); 1566 if (err < 0) 1567 goto out; 1568 } 1569 break; 1570 1571 default: 1572 goto out; 1573 } 1574 1575out: 1576 *sockp = sock; 1577 if ((err < 0) && sock) { 1578 kernel_sock_shutdown(sock, SHUT_RDWR); 1579 sk_release_kernel(sock->sk); 1580 *sockp = NULL; 1581 } 1582 1583 return err; 1584} 1585 1586static struct lock_class_key l2tp_socket_class; 1587 1588int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp) 1589{ 1590 struct l2tp_tunnel *tunnel = NULL; 1591 int err; 1592 struct socket *sock = NULL; 1593 struct sock *sk = NULL; 1594 struct l2tp_net *pn; 1595 enum l2tp_encap_type encap = L2TP_ENCAPTYPE_UDP; 1596 1597 /* Get the tunnel socket from the fd, which was opened by 1598 * the userspace L2TP daemon. If not specified, create a 1599 * kernel socket. 1600 */ 1601 if (fd < 0) { 1602 err = l2tp_tunnel_sock_create(net, tunnel_id, peer_tunnel_id, 1603 cfg, &sock); 1604 if (err < 0) 1605 goto err; 1606 } else { 1607 sock = sockfd_lookup(fd, &err); 1608 if (!sock) { 1609 pr_err("tunl %u: sockfd_lookup(fd=%d) returned %d\n", 1610 tunnel_id, fd, err); 1611 err = -EBADF; 1612 goto err; 1613 } 1614 1615 /* Reject namespace mismatches */ 1616 if (!net_eq(sock_net(sock->sk), net)) { 1617 pr_err("tunl %u: netns mismatch\n", tunnel_id); 1618 err = -EINVAL; 1619 goto err; 1620 } 1621 } 1622 1623 sk = sock->sk; 1624 1625 if (cfg != NULL) 1626 encap = cfg->encap; 1627 1628 /* Quick sanity checks */ 1629 switch (encap) { 1630 case L2TP_ENCAPTYPE_UDP: 1631 err = -EPROTONOSUPPORT; 1632 if (sk->sk_protocol != IPPROTO_UDP) { 1633 pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n", 1634 tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP); 1635 goto err; 1636 } 1637 break; 1638 case L2TP_ENCAPTYPE_IP: 1639 err = -EPROTONOSUPPORT; 1640 if (sk->sk_protocol != IPPROTO_L2TP) { 1641 pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n", 1642 tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP); 1643 goto err; 1644 } 1645 break; 1646 } 1647 1648 /* Check if this socket has already been prepped */ 1649 tunnel = (struct l2tp_tunnel *)sk->sk_user_data; 1650 if (tunnel != NULL) { 1651 /* This socket has already been prepped */ 1652 err = -EBUSY; 1653 goto err; 1654 } 1655 1656 tunnel = kzalloc(sizeof(struct l2tp_tunnel), GFP_KERNEL); 1657 if (tunnel == NULL) { 1658 err = -ENOMEM; 1659 goto err; 1660 } 1661 1662 tunnel->version = version; 1663 tunnel->tunnel_id = tunnel_id; 1664 tunnel->peer_tunnel_id = peer_tunnel_id; 1665 tunnel->debug = L2TP_DEFAULT_DEBUG_FLAGS; 1666 1667 tunnel->magic = L2TP_TUNNEL_MAGIC; 1668 sprintf(&tunnel->name[0], "tunl %u", tunnel_id); 1669 rwlock_init(&tunnel->hlist_lock); 1670 1671 /* The net we belong to */ 1672 tunnel->l2tp_net = net; 1673 pn = l2tp_pernet(net); 1674 1675 if (cfg != NULL) 1676 tunnel->debug = cfg->debug; 1677 1678 /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */ 1679 tunnel->encap = encap; 1680 if (encap == L2TP_ENCAPTYPE_UDP) { 1681 /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */ 1682 udp_sk(sk)->encap_type = UDP_ENCAP_L2TPINUDP; 1683 udp_sk(sk)->encap_rcv = l2tp_udp_encap_recv; 1684 udp_sk(sk)->encap_destroy = l2tp_udp_encap_destroy; 1685#if IS_ENABLED(CONFIG_IPV6) 1686 if (sk->sk_family == PF_INET6) 1687 udpv6_encap_enable(); 1688 else 1689#endif 1690 udp_encap_enable(); 1691 } 1692 1693 sk->sk_user_data = tunnel; 1694 1695 /* Hook on the tunnel socket destructor so that we can cleanup 1696 * if the tunnel socket goes away. 1697 */ 1698 tunnel->old_sk_destruct = sk->sk_destruct; 1699 sk->sk_destruct = &l2tp_tunnel_destruct; 1700 tunnel->sock = sk; 1701 tunnel->fd = fd; 1702 lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock"); 1703 1704 sk->sk_allocation = GFP_ATOMIC; 1705 1706 /* Init delete workqueue struct */ 1707 INIT_WORK(&tunnel->del_work, l2tp_tunnel_del_work); 1708 1709 /* Add tunnel to our list */ 1710 INIT_LIST_HEAD(&tunnel->list); 1711 atomic_inc(&l2tp_tunnel_count); 1712 1713 /* Bump the reference count. The tunnel context is deleted 1714 * only when this drops to zero. Must be done before list insertion 1715 */ 1716 l2tp_tunnel_inc_refcount(tunnel); 1717 spin_lock_bh(&pn->l2tp_tunnel_list_lock); 1718 list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list); 1719 spin_unlock_bh(&pn->l2tp_tunnel_list_lock); 1720 1721 err = 0; 1722err: 1723 if (tunnelp) 1724 *tunnelp = tunnel; 1725 1726 /* If tunnel's socket was created by the kernel, it doesn't 1727 * have a file. 1728 */ 1729 if (sock && sock->file) 1730 sockfd_put(sock); 1731 1732 return err; 1733} 1734EXPORT_SYMBOL_GPL(l2tp_tunnel_create); 1735 1736/* This function is used by the netlink TUNNEL_DELETE command. 1737 */ 1738int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) 1739{ 1740 return (false == queue_work(l2tp_wq, &tunnel->del_work)); 1741} 1742EXPORT_SYMBOL_GPL(l2tp_tunnel_delete); 1743 1744/* Really kill the session. 1745 */ 1746void l2tp_session_free(struct l2tp_session *session) 1747{ 1748 struct l2tp_tunnel *tunnel; 1749 1750 BUG_ON(atomic_read(&session->ref_count) != 0); 1751 1752 tunnel = session->tunnel; 1753 if (tunnel != NULL) { 1754 BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC); 1755 1756 /* Delete the session from the hash */ 1757 write_lock_bh(&tunnel->hlist_lock); 1758 hlist_del_init(&session->hlist); 1759 write_unlock_bh(&tunnel->hlist_lock); 1760 1761 /* Unlink from the global hash if not L2TPv2 */ 1762 if (tunnel->version != L2TP_HDR_VER_2) { 1763 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net); 1764 1765 spin_lock_bh(&pn->l2tp_session_hlist_lock); 1766 hlist_del_init_rcu(&session->global_hlist); 1767 spin_unlock_bh(&pn->l2tp_session_hlist_lock); 1768 synchronize_rcu(); 1769 } 1770 1771 if (session->session_id != 0) 1772 atomic_dec(&l2tp_session_count); 1773 1774 sock_put(tunnel->sock); 1775 1776 /* This will delete the tunnel context if this 1777 * is the last session on the tunnel. 1778 */ 1779 session->tunnel = NULL; 1780 l2tp_tunnel_dec_refcount(tunnel); 1781 } 1782 1783 kfree(session); 1784 1785 return; 1786} 1787EXPORT_SYMBOL_GPL(l2tp_session_free); 1788 1789/* This function is used by the netlink SESSION_DELETE command and by 1790 pseudowire modules. 1791 */ 1792int l2tp_session_delete(struct l2tp_session *session) 1793{ 1794 if (session->session_close != NULL) 1795 (*session->session_close)(session); 1796 1797 l2tp_session_dec_refcount(session); 1798 1799 return 0; 1800} 1801EXPORT_SYMBOL_GPL(l2tp_session_delete); 1802 1803 1804/* We come here whenever a session's send_seq, cookie_len or 1805 * l2specific_len parameters are set. 1806 */ 1807static void l2tp_session_set_header_len(struct l2tp_session *session, int version) 1808{ 1809 if (version == L2TP_HDR_VER_2) { 1810 session->hdr_len = 6; 1811 if (session->send_seq) 1812 session->hdr_len += 4; 1813 } else { 1814 session->hdr_len = 4 + session->cookie_len + session->l2specific_len + session->offset; 1815 if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP) 1816 session->hdr_len += 4; 1817 } 1818 1819} 1820 1821struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg) 1822{ 1823 struct l2tp_session *session; 1824 1825 session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL); 1826 if (session != NULL) { 1827 session->magic = L2TP_SESSION_MAGIC; 1828 session->tunnel = tunnel; 1829 1830 session->session_id = session_id; 1831 session->peer_session_id = peer_session_id; 1832 session->nr = 0; 1833 1834 sprintf(&session->name[0], "sess %u/%u", 1835 tunnel->tunnel_id, session->session_id); 1836 1837 skb_queue_head_init(&session->reorder_q); 1838 1839 INIT_HLIST_NODE(&session->hlist); 1840 INIT_HLIST_NODE(&session->global_hlist); 1841 1842 /* Inherit debug options from tunnel */ 1843 session->debug = tunnel->debug; 1844 1845 if (cfg) { 1846 session->pwtype = cfg->pw_type; 1847 session->debug = cfg->debug; 1848 session->mtu = cfg->mtu; 1849 session->mru = cfg->mru; 1850 session->send_seq = cfg->send_seq; 1851 session->recv_seq = cfg->recv_seq; 1852 session->lns_mode = cfg->lns_mode; 1853 session->reorder_timeout = cfg->reorder_timeout; 1854 session->offset = cfg->offset; 1855 session->l2specific_type = cfg->l2specific_type; 1856 session->l2specific_len = cfg->l2specific_len; 1857 session->cookie_len = cfg->cookie_len; 1858 memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len); 1859 session->peer_cookie_len = cfg->peer_cookie_len; 1860 memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len); 1861 } 1862 1863 if (tunnel->version == L2TP_HDR_VER_2) 1864 session->build_header = l2tp_build_l2tpv2_header; 1865 else 1866 session->build_header = l2tp_build_l2tpv3_header; 1867 1868 l2tp_session_set_header_len(session, tunnel->version); 1869 1870 /* Bump the reference count. The session context is deleted 1871 * only when this drops to zero. 1872 */ 1873 l2tp_session_inc_refcount(session); 1874 l2tp_tunnel_inc_refcount(tunnel); 1875 1876 /* Ensure tunnel socket isn't deleted */ 1877 sock_hold(tunnel->sock); 1878 1879 /* Add session to the tunnel's hash list */ 1880 write_lock_bh(&tunnel->hlist_lock); 1881 hlist_add_head(&session->hlist, 1882 l2tp_session_id_hash(tunnel, session_id)); 1883 write_unlock_bh(&tunnel->hlist_lock); 1884 1885 /* And to the global session list if L2TPv3 */ 1886 if (tunnel->version != L2TP_HDR_VER_2) { 1887 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net); 1888 1889 spin_lock_bh(&pn->l2tp_session_hlist_lock); 1890 hlist_add_head_rcu(&session->global_hlist, 1891 l2tp_session_id_hash_2(pn, session_id)); 1892 spin_unlock_bh(&pn->l2tp_session_hlist_lock); 1893 } 1894 1895 /* Ignore management session in session count value */ 1896 if (session->session_id != 0) 1897 atomic_inc(&l2tp_session_count); 1898 } 1899 1900 return session; 1901} 1902EXPORT_SYMBOL_GPL(l2tp_session_create); 1903 1904/***************************************************************************** 1905 * Init and cleanup 1906 *****************************************************************************/ 1907 1908static __net_init int l2tp_init_net(struct net *net) 1909{ 1910 struct l2tp_net *pn = net_generic(net, l2tp_net_id); 1911 int hash; 1912 1913 INIT_LIST_HEAD(&pn->l2tp_tunnel_list); 1914 spin_lock_init(&pn->l2tp_tunnel_list_lock); 1915 1916 for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) 1917 INIT_HLIST_HEAD(&pn->l2tp_session_hlist[hash]); 1918 1919 spin_lock_init(&pn->l2tp_session_hlist_lock); 1920 1921 return 0; 1922} 1923 1924static __net_exit void l2tp_exit_net(struct net *net) 1925{ 1926 struct l2tp_net *pn = l2tp_pernet(net); 1927 struct l2tp_tunnel *tunnel = NULL; 1928 1929 rcu_read_lock_bh(); 1930 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) { 1931 (void)l2tp_tunnel_delete(tunnel); 1932 } 1933 rcu_read_unlock_bh(); 1934} 1935 1936static struct pernet_operations l2tp_net_ops = { 1937 .init = l2tp_init_net, 1938 .exit = l2tp_exit_net, 1939 .id = &l2tp_net_id, 1940 .size = sizeof(struct l2tp_net), 1941}; 1942 1943static int __init l2tp_init(void) 1944{ 1945 int rc = 0; 1946 1947 rc = register_pernet_device(&l2tp_net_ops); 1948 if (rc) 1949 goto out; 1950 1951 l2tp_wq = alloc_workqueue("l2tp", WQ_NON_REENTRANT | WQ_UNBOUND, 0); 1952 if (!l2tp_wq) { 1953 pr_err("alloc_workqueue failed\n"); 1954 rc = -ENOMEM; 1955 goto out; 1956 } 1957 1958 pr_info("L2TP core driver, %s\n", L2TP_DRV_VERSION); 1959 1960out: 1961 return rc; 1962} 1963 1964static void __exit l2tp_exit(void) 1965{ 1966 unregister_pernet_device(&l2tp_net_ops); 1967 if (l2tp_wq) { 1968 destroy_workqueue(l2tp_wq); 1969 l2tp_wq = NULL; 1970 } 1971} 1972 1973module_init(l2tp_init); 1974module_exit(l2tp_exit); 1975 1976MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 1977MODULE_DESCRIPTION("L2TP core"); 1978MODULE_LICENSE("GPL"); 1979MODULE_VERSION(L2TP_DRV_VERSION); 1980 1981