l2tp_core.c 51 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889
  1. /*
  2. * L2TP core.
  3. *
  4. * Copyright (c) 2008,2009,2010 Katalix Systems Ltd
  5. *
  6. * This file contains some code of the original L2TPv2 pppol2tp
  7. * driver, which has the following copyright:
  8. *
  9. * Authors: Martijn van Oosterhout <kleptog@svana.org>
  10. * James Chapman (jchapman@katalix.com)
  11. * Contributors:
  12. * Michal Ostrowski <mostrows@speakeasy.net>
  13. * Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
  14. * David S. Miller (davem@redhat.com)
  15. *
  16. * This program is free software; you can redistribute it and/or modify
  17. * it under the terms of the GNU General Public License version 2 as
  18. * published by the Free Software Foundation.
  19. */
  20. #include <linux/module.h>
  21. #include <linux/string.h>
  22. #include <linux/list.h>
  23. #include <linux/rculist.h>
  24. #include <linux/uaccess.h>
  25. #include <linux/kernel.h>
  26. #include <linux/spinlock.h>
  27. #include <linux/kthread.h>
  28. #include <linux/sched.h>
  29. #include <linux/slab.h>
  30. #include <linux/errno.h>
  31. #include <linux/jiffies.h>
  32. #include <linux/netdevice.h>
  33. #include <linux/net.h>
  34. #include <linux/inetdevice.h>
  35. #include <linux/skbuff.h>
  36. #include <linux/init.h>
  37. #include <linux/in.h>
  38. #include <linux/ip.h>
  39. #include <linux/udp.h>
  40. #include <linux/l2tp.h>
  41. #include <linux/hash.h>
  42. #include <linux/sort.h>
  43. #include <linux/file.h>
  44. #include <linux/nsproxy.h>
  45. #include <net/net_namespace.h>
  46. #include <net/netns/generic.h>
  47. #include <net/dst.h>
  48. #include <net/ip.h>
  49. #include <net/udp.h>
  50. #include <net/inet_common.h>
  51. #include <net/xfrm.h>
  52. #include <net/protocol.h>
  53. #include <net/inet6_connection_sock.h>
  54. #include <net/inet_ecn.h>
  55. #include <net/ip6_route.h>
  56. #include <net/ip6_checksum.h>
  57. #include <asm/byteorder.h>
  58. #include <linux/atomic.h>
  59. #include "l2tp_core.h"
  60. #define L2TP_DRV_VERSION "V2.0"
  61. /* L2TP header constants */
  62. #define L2TP_HDRFLAG_T 0x8000
  63. #define L2TP_HDRFLAG_L 0x4000
  64. #define L2TP_HDRFLAG_S 0x0800
  65. #define L2TP_HDRFLAG_O 0x0200
  66. #define L2TP_HDRFLAG_P 0x0100
  67. #define L2TP_HDR_VER_MASK 0x000F
  68. #define L2TP_HDR_VER_2 0x0002
  69. #define L2TP_HDR_VER_3 0x0003
  70. /* L2TPv3 default L2-specific sublayer */
  71. #define L2TP_SLFLAG_S 0x40000000
  72. #define L2TP_SL_SEQ_MASK 0x00ffffff
  73. #define L2TP_HDR_SIZE_SEQ 10
  74. #define L2TP_HDR_SIZE_NOSEQ 6
  75. /* Default trace flags */
  76. #define L2TP_DEFAULT_DEBUG_FLAGS 0
  77. #define PRINTK(_mask, _type, _lvl, _fmt, args...) \
  78. do { \
  79. if ((_mask) & (_type)) \
  80. printk(_lvl "L2TP: " _fmt, ##args); \
  81. } while (0)
  82. /* Private data stored for received packets in the skb.
  83. */
  84. struct l2tp_skb_cb {
  85. u32 ns;
  86. u16 has_seq;
  87. u16 length;
  88. unsigned long expires;
  89. };
  90. #define L2TP_SKB_CB(skb) ((struct l2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])
  91. static atomic_t l2tp_tunnel_count;
  92. static atomic_t l2tp_session_count;
  93. /* per-net private data for this module */
  94. static unsigned int l2tp_net_id;
  95. struct l2tp_net {
  96. struct list_head l2tp_tunnel_list;
  97. spinlock_t l2tp_tunnel_list_lock;
  98. struct hlist_head l2tp_session_hlist[L2TP_HASH_SIZE_2];
  99. spinlock_t l2tp_session_hlist_lock;
  100. };
  101. static void l2tp_session_set_header_len(struct l2tp_session *session, int version);
  102. static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
  103. static void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel);
  104. static inline struct l2tp_net *l2tp_pernet(struct net *net)
  105. {
  106. BUG_ON(!net);
  107. return net_generic(net, l2tp_net_id);
  108. }
  109. /* Tunnel reference counts. Incremented per session that is added to
  110. * the tunnel.
  111. */
  112. static inline void l2tp_tunnel_inc_refcount_1(struct l2tp_tunnel *tunnel)
  113. {
  114. atomic_inc(&tunnel->ref_count);
  115. }
  116. static inline void l2tp_tunnel_dec_refcount_1(struct l2tp_tunnel *tunnel)
  117. {
  118. if (atomic_dec_and_test(&tunnel->ref_count))
  119. l2tp_tunnel_free(tunnel);
  120. }
  121. #ifdef L2TP_REFCNT_DEBUG
  122. #define l2tp_tunnel_inc_refcount(_t) do { \
  123. printk(KERN_DEBUG "l2tp_tunnel_inc_refcount: %s:%d %s: cnt=%d\n", __func__, __LINE__, (_t)->name, atomic_read(&_t->ref_count)); \
  124. l2tp_tunnel_inc_refcount_1(_t); \
  125. } while (0)
  126. #define l2tp_tunnel_dec_refcount(_t) do { \
  127. printk(KERN_DEBUG "l2tp_tunnel_dec_refcount: %s:%d %s: cnt=%d\n", __func__, __LINE__, (_t)->name, atomic_read(&_t->ref_count)); \
  128. l2tp_tunnel_dec_refcount_1(_t); \
  129. } while (0)
  130. #else
  131. #define l2tp_tunnel_inc_refcount(t) l2tp_tunnel_inc_refcount_1(t)
  132. #define l2tp_tunnel_dec_refcount(t) l2tp_tunnel_dec_refcount_1(t)
  133. #endif
  134. /* Session hash global list for L2TPv3.
  135. * The session_id SHOULD be random according to RFC3931, but several
  136. * L2TP implementations use incrementing session_ids. So we do a real
  137. * hash on the session_id, rather than a simple bitmask.
  138. */
  139. static inline struct hlist_head *
  140. l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
  141. {
  142. return &pn->l2tp_session_hlist[hash_32(session_id, L2TP_HASH_BITS_2)];
  143. }
  144. /* Lookup a session by id in the global session list
  145. */
  146. static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
  147. {
  148. struct l2tp_net *pn = l2tp_pernet(net);
  149. struct hlist_head *session_list =
  150. l2tp_session_id_hash_2(pn, session_id);
  151. struct l2tp_session *session;
  152. struct hlist_node *walk;
  153. rcu_read_lock_bh();
  154. hlist_for_each_entry_rcu(session, walk, session_list, global_hlist) {
  155. if (session->session_id == session_id) {
  156. rcu_read_unlock_bh();
  157. return session;
  158. }
  159. }
  160. rcu_read_unlock_bh();
  161. return NULL;
  162. }
  163. /* Session hash list.
  164. * The session_id SHOULD be random according to RFC2661, but several
  165. * L2TP implementations (Cisco and Microsoft) use incrementing
  166. * session_ids. So we do a real hash on the session_id, rather than a
  167. * simple bitmask.
  168. */
  169. static inline struct hlist_head *
  170. l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id)
  171. {
  172. return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)];
  173. }
  174. /* Lookup a session by id
  175. */
  176. struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id)
  177. {
  178. struct hlist_head *session_list;
  179. struct l2tp_session *session;
  180. struct hlist_node *walk;
  181. /* In L2TPv3, session_ids are unique over all tunnels and we
  182. * sometimes need to look them up before we know the
  183. * tunnel.
  184. */
  185. if (tunnel == NULL)
  186. return l2tp_session_find_2(net, session_id);
  187. session_list = l2tp_session_id_hash(tunnel, session_id);
  188. read_lock_bh(&tunnel->hlist_lock);
  189. hlist_for_each_entry(session, walk, session_list, hlist) {
  190. if (session->session_id == session_id) {
  191. read_unlock_bh(&tunnel->hlist_lock);
  192. return session;
  193. }
  194. }
  195. read_unlock_bh(&tunnel->hlist_lock);
  196. return NULL;
  197. }
  198. EXPORT_SYMBOL_GPL(l2tp_session_find);
  199. struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
  200. {
  201. int hash;
  202. struct hlist_node *walk;
  203. struct l2tp_session *session;
  204. int count = 0;
  205. read_lock_bh(&tunnel->hlist_lock);
  206. for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
  207. hlist_for_each_entry(session, walk, &tunnel->session_hlist[hash], hlist) {
  208. if (++count > nth) {
  209. read_unlock_bh(&tunnel->hlist_lock);
  210. return session;
  211. }
  212. }
  213. }
  214. read_unlock_bh(&tunnel->hlist_lock);
  215. return NULL;
  216. }
  217. EXPORT_SYMBOL_GPL(l2tp_session_find_nth);
  218. /* Lookup a session by interface name.
  219. * This is very inefficient but is only used by management interfaces.
  220. */
  221. struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname)
  222. {
  223. struct l2tp_net *pn = l2tp_pernet(net);
  224. int hash;
  225. struct hlist_node *walk;
  226. struct l2tp_session *session;
  227. rcu_read_lock_bh();
  228. for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) {
  229. hlist_for_each_entry_rcu(session, walk, &pn->l2tp_session_hlist[hash], global_hlist) {
  230. if (!strcmp(session->ifname, ifname)) {
  231. rcu_read_unlock_bh();
  232. return session;
  233. }
  234. }
  235. }
  236. rcu_read_unlock_bh();
  237. return NULL;
  238. }
  239. EXPORT_SYMBOL_GPL(l2tp_session_find_by_ifname);
  240. /* Lookup a tunnel by id
  241. */
  242. struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id)
  243. {
  244. struct l2tp_tunnel *tunnel;
  245. struct l2tp_net *pn = l2tp_pernet(net);
  246. rcu_read_lock_bh();
  247. list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
  248. if (tunnel->tunnel_id == tunnel_id) {
  249. rcu_read_unlock_bh();
  250. return tunnel;
  251. }
  252. }
  253. rcu_read_unlock_bh();
  254. return NULL;
  255. }
  256. EXPORT_SYMBOL_GPL(l2tp_tunnel_find);
  257. struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth)
  258. {
  259. struct l2tp_net *pn = l2tp_pernet(net);
  260. struct l2tp_tunnel *tunnel;
  261. int count = 0;
  262. rcu_read_lock_bh();
  263. list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
  264. if (++count > nth) {
  265. rcu_read_unlock_bh();
  266. return tunnel;
  267. }
  268. }
  269. rcu_read_unlock_bh();
  270. return NULL;
  271. }
  272. EXPORT_SYMBOL_GPL(l2tp_tunnel_find_nth);
  273. /*****************************************************************************
  274. * Receive data handling
  275. *****************************************************************************/
  276. /* Queue a skb in order. We come here only if the skb has an L2TP sequence
  277. * number.
  278. */
  279. static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)
  280. {
  281. struct sk_buff *skbp;
  282. struct sk_buff *tmp;
  283. u32 ns = L2TP_SKB_CB(skb)->ns;
  284. struct l2tp_stats *sstats;
  285. spin_lock_bh(&session->reorder_q.lock);
  286. sstats = &session->stats;
  287. skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
  288. if (L2TP_SKB_CB(skbp)->ns > ns) {
  289. __skb_queue_before(&session->reorder_q, skbp, skb);
  290. PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
  291. "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
  292. session->name, ns, L2TP_SKB_CB(skbp)->ns,
  293. skb_queue_len(&session->reorder_q));
  294. u64_stats_update_begin(&sstats->syncp);
  295. sstats->rx_oos_packets++;
  296. u64_stats_update_end(&sstats->syncp);
  297. goto out;
  298. }
  299. }
  300. __skb_queue_tail(&session->reorder_q, skb);
  301. out:
  302. spin_unlock_bh(&session->reorder_q.lock);
  303. }
  304. /* Dequeue a single skb.
  305. */
  306. static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)
  307. {
  308. struct l2tp_tunnel *tunnel = session->tunnel;
  309. int length = L2TP_SKB_CB(skb)->length;
  310. struct l2tp_stats *tstats, *sstats;
  311. /* We're about to requeue the skb, so return resources
  312. * to its current owner (a socket receive buffer).
  313. */
  314. skb_orphan(skb);
  315. tstats = &tunnel->stats;
  316. u64_stats_update_begin(&tstats->syncp);
  317. sstats = &session->stats;
  318. u64_stats_update_begin(&sstats->syncp);
  319. tstats->rx_packets++;
  320. tstats->rx_bytes += length;
  321. sstats->rx_packets++;
  322. sstats->rx_bytes += length;
  323. u64_stats_update_end(&tstats->syncp);
  324. u64_stats_update_end(&sstats->syncp);
  325. if (L2TP_SKB_CB(skb)->has_seq) {
  326. /* Bump our Nr */
  327. session->nr++;
  328. if (tunnel->version == L2TP_HDR_VER_2)
  329. session->nr &= 0xffff;
  330. else
  331. session->nr &= 0xffffff;
  332. PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
  333. "%s: updated nr to %hu\n", session->name, session->nr);
  334. }
  335. /* call private receive handler */
  336. if (session->recv_skb != NULL)
  337. (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);
  338. else
  339. kfree_skb(skb);
  340. if (session->deref)
  341. (*session->deref)(session);
  342. }
  343. /* Dequeue skbs from the session's reorder_q, subject to packet order.
  344. * Skbs that have been in the queue for too long are simply discarded.
  345. */
  346. static void l2tp_recv_dequeue(struct l2tp_session *session)
  347. {
  348. struct sk_buff *skb;
  349. struct sk_buff *tmp;
  350. struct l2tp_stats *sstats;
  351. /* If the pkt at the head of the queue has the nr that we
  352. * expect to send up next, dequeue it and any other
  353. * in-sequence packets behind it.
  354. */
  355. start:
  356. spin_lock_bh(&session->reorder_q.lock);
  357. sstats = &session->stats;
  358. skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
  359. if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) {
  360. u64_stats_update_begin(&sstats->syncp);
  361. sstats->rx_seq_discards++;
  362. sstats->rx_errors++;
  363. u64_stats_update_end(&sstats->syncp);
  364. PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
  365. "%s: oos pkt %u len %d discarded (too old), "
  366. "waiting for %u, reorder_q_len=%d\n",
  367. session->name, L2TP_SKB_CB(skb)->ns,
  368. L2TP_SKB_CB(skb)->length, session->nr,
  369. skb_queue_len(&session->reorder_q));
  370. session->reorder_skip = 1;
  371. __skb_unlink(skb, &session->reorder_q);
  372. kfree_skb(skb);
  373. if (session->deref)
  374. (*session->deref)(session);
  375. continue;
  376. }
  377. if (L2TP_SKB_CB(skb)->has_seq) {
  378. if (session->reorder_skip) {
  379. PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
  380. "%s: advancing nr to next pkt: %u -> %u",
  381. session->name, session->nr,
  382. L2TP_SKB_CB(skb)->ns);
  383. session->reorder_skip = 0;
  384. session->nr = L2TP_SKB_CB(skb)->ns;
  385. }
  386. if (L2TP_SKB_CB(skb)->ns != session->nr) {
  387. PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
  388. "%s: holding oos pkt %u len %d, "
  389. "waiting for %u, reorder_q_len=%d\n",
  390. session->name, L2TP_SKB_CB(skb)->ns,
  391. L2TP_SKB_CB(skb)->length, session->nr,
  392. skb_queue_len(&session->reorder_q));
  393. goto out;
  394. }
  395. }
  396. __skb_unlink(skb, &session->reorder_q);
  397. /* Process the skb. We release the queue lock while we
  398. * do so to let other contexts process the queue.
  399. */
  400. spin_unlock_bh(&session->reorder_q.lock);
  401. l2tp_recv_dequeue_skb(session, skb);
  402. goto start;
  403. }
  404. out:
  405. spin_unlock_bh(&session->reorder_q.lock);
  406. }
  407. static inline int l2tp_verify_udp_checksum(struct sock *sk,
  408. struct sk_buff *skb)
  409. {
  410. struct udphdr *uh = udp_hdr(skb);
  411. u16 ulen = ntohs(uh->len);
  412. __wsum psum;
  413. if (sk->sk_no_check || skb_csum_unnecessary(skb))
  414. return 0;
  415. #if IS_ENABLED(CONFIG_IPV6)
  416. if (sk->sk_family == PF_INET6) {
  417. if (!uh->check) {
  418. LIMIT_NETDEBUG(KERN_INFO "L2TP: IPv6: checksum is 0\n");
  419. return 1;
  420. }
  421. if ((skb->ip_summed == CHECKSUM_COMPLETE) &&
  422. !csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
  423. &ipv6_hdr(skb)->daddr, ulen,
  424. IPPROTO_UDP, skb->csum)) {
  425. skb->ip_summed = CHECKSUM_UNNECESSARY;
  426. return 0;
  427. }
  428. skb->csum = ~csum_unfold(csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
  429. &ipv6_hdr(skb)->daddr,
  430. skb->len, IPPROTO_UDP,
  431. 0));
  432. } else
  433. #endif
  434. {
  435. struct inet_sock *inet;
  436. if (!uh->check)
  437. return 0;
  438. inet = inet_sk(sk);
  439. psum = csum_tcpudp_nofold(inet->inet_saddr, inet->inet_daddr,
  440. ulen, IPPROTO_UDP, 0);
  441. if ((skb->ip_summed == CHECKSUM_COMPLETE) &&
  442. !csum_fold(csum_add(psum, skb->csum)))
  443. return 0;
  444. skb->csum = psum;
  445. }
  446. return __skb_checksum_complete(skb);
  447. }
  448. /* Do receive processing of L2TP data frames. We handle both L2TPv2
  449. * and L2TPv3 data frames here.
  450. *
  451. * L2TPv2 Data Message Header
  452. *
  453. * 0 1 2 3
  454. * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  455. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  456. * |T|L|x|x|S|x|O|P|x|x|x|x| Ver | Length (opt) |
  457. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  458. * | Tunnel ID | Session ID |
  459. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  460. * | Ns (opt) | Nr (opt) |
  461. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  462. * | Offset Size (opt) | Offset pad... (opt)
  463. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  464. *
  465. * Data frames are marked by T=0. All other fields are the same as
  466. * those in L2TP control frames.
  467. *
  468. * L2TPv3 Data Message Header
  469. *
  470. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  471. * | L2TP Session Header |
  472. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  473. * | L2-Specific Sublayer |
  474. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  475. * | Tunnel Payload ...
  476. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  477. *
  478. * L2TPv3 Session Header Over IP
  479. *
  480. * 0 1 2 3
  481. * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  482. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  483. * | Session ID |
  484. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  485. * | Cookie (optional, maximum 64 bits)...
  486. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  487. * |
  488. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  489. *
  490. * L2TPv3 L2-Specific Sublayer Format
  491. *
  492. * 0 1 2 3
  493. * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  494. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  495. * |x|S|x|x|x|x|x|x| Sequence Number |
  496. * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  497. *
  498. * Cookie value, sublayer format and offset (pad) are negotiated with
  499. * the peer when the session is set up. Unlike L2TPv2, we do not need
  500. * to parse the packet header to determine if optional fields are
  501. * present.
  502. *
  503. * Caller must already have parsed the frame and determined that it is
  504. * a data (not control) frame before coming here. Fields up to the
  505. * session-id have already been parsed and ptr points to the data
  506. * after the session-id.
  507. */
  508. void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
  509. unsigned char *ptr, unsigned char *optr, u16 hdrflags,
  510. int length, int (*payload_hook)(struct sk_buff *skb))
  511. {
  512. struct l2tp_tunnel *tunnel = session->tunnel;
  513. int offset;
  514. u32 ns, nr;
  515. struct l2tp_stats *sstats = &session->stats;
  516. /* The ref count is increased since we now hold a pointer to
  517. * the session. Take care to decrement the refcnt when exiting
  518. * this function from now on...
  519. */
  520. l2tp_session_inc_refcount(session);
  521. if (session->ref)
  522. (*session->ref)(session);
  523. /* Parse and check optional cookie */
  524. if (session->peer_cookie_len > 0) {
  525. if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
  526. PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
  527. "%s: cookie mismatch (%u/%u). Discarding.\n",
  528. tunnel->name, tunnel->tunnel_id, session->session_id);
  529. u64_stats_update_begin(&sstats->syncp);
  530. sstats->rx_cookie_discards++;
  531. u64_stats_update_end(&sstats->syncp);
  532. goto discard;
  533. }
  534. ptr += session->peer_cookie_len;
  535. }
  536. /* Handle the optional sequence numbers. Sequence numbers are
  537. * in different places for L2TPv2 and L2TPv3.
  538. *
  539. * If we are the LAC, enable/disable sequence numbers under
  540. * the control of the LNS. If no sequence numbers present but
  541. * we were expecting them, discard frame.
  542. */
  543. ns = nr = 0;
  544. L2TP_SKB_CB(skb)->has_seq = 0;
  545. if (tunnel->version == L2TP_HDR_VER_2) {
  546. if (hdrflags & L2TP_HDRFLAG_S) {
  547. ns = ntohs(*(__be16 *) ptr);
  548. ptr += 2;
  549. nr = ntohs(*(__be16 *) ptr);
  550. ptr += 2;
  551. /* Store L2TP info in the skb */
  552. L2TP_SKB_CB(skb)->ns = ns;
  553. L2TP_SKB_CB(skb)->has_seq = 1;
  554. PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
  555. "%s: recv data ns=%u, nr=%u, session nr=%u\n",
  556. session->name, ns, nr, session->nr);
  557. }
  558. } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
  559. u32 l2h = ntohl(*(__be32 *) ptr);
  560. if (l2h & 0x40000000) {
  561. ns = l2h & 0x00ffffff;
  562. /* Store L2TP info in the skb */
  563. L2TP_SKB_CB(skb)->ns = ns;
  564. L2TP_SKB_CB(skb)->has_seq = 1;
  565. PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
  566. "%s: recv data ns=%u, session nr=%u\n",
  567. session->name, ns, session->nr);
  568. }
  569. }
  570. /* Advance past L2-specific header, if present */
  571. ptr += session->l2specific_len;
  572. if (L2TP_SKB_CB(skb)->has_seq) {
  573. /* Received a packet with sequence numbers. If we're the LNS,
  574. * check if we sre sending sequence numbers and if not,
  575. * configure it so.
  576. */
  577. if ((!session->lns_mode) && (!session->send_seq)) {
  578. PRINTK(session->debug, L2TP_MSG_SEQ, KERN_INFO,
  579. "%s: requested to enable seq numbers by LNS\n",
  580. session->name);
  581. session->send_seq = -1;
  582. l2tp_session_set_header_len(session, tunnel->version);
  583. }
  584. } else {
  585. /* No sequence numbers.
  586. * If user has configured mandatory sequence numbers, discard.
  587. */
  588. if (session->recv_seq) {
  589. PRINTK(session->debug, L2TP_MSG_SEQ, KERN_WARNING,
  590. "%s: recv data has no seq numbers when required. "
  591. "Discarding\n", session->name);
  592. u64_stats_update_begin(&sstats->syncp);
  593. sstats->rx_seq_discards++;
  594. u64_stats_update_end(&sstats->syncp);
  595. goto discard;
  596. }
  597. /* If we're the LAC and we're sending sequence numbers, the
  598. * LNS has requested that we no longer send sequence numbers.
  599. * If we're the LNS and we're sending sequence numbers, the
  600. * LAC is broken. Discard the frame.
  601. */
  602. if ((!session->lns_mode) && (session->send_seq)) {
  603. PRINTK(session->debug, L2TP_MSG_SEQ, KERN_INFO,
  604. "%s: requested to disable seq numbers by LNS\n",
  605. session->name);
  606. session->send_seq = 0;
  607. l2tp_session_set_header_len(session, tunnel->version);
  608. } else if (session->send_seq) {
  609. PRINTK(session->debug, L2TP_MSG_SEQ, KERN_WARNING,
  610. "%s: recv data has no seq numbers when required. "
  611. "Discarding\n", session->name);
  612. u64_stats_update_begin(&sstats->syncp);
  613. sstats->rx_seq_discards++;
  614. u64_stats_update_end(&sstats->syncp);
  615. goto discard;
  616. }
  617. }
  618. /* Session data offset is handled differently for L2TPv2 and
  619. * L2TPv3. For L2TPv2, there is an optional 16-bit value in
  620. * the header. For L2TPv3, the offset is negotiated using AVPs
  621. * in the session setup control protocol.
  622. */
  623. if (tunnel->version == L2TP_HDR_VER_2) {
  624. /* If offset bit set, skip it. */
  625. if (hdrflags & L2TP_HDRFLAG_O) {
  626. offset = ntohs(*(__be16 *)ptr);
  627. ptr += 2 + offset;
  628. }
  629. } else
  630. ptr += session->offset;
  631. offset = ptr - optr;
  632. if (!pskb_may_pull(skb, offset))
  633. goto discard;
  634. __skb_pull(skb, offset);
  635. /* If caller wants to process the payload before we queue the
  636. * packet, do so now.
  637. */
  638. if (payload_hook)
  639. if ((*payload_hook)(skb))
  640. goto discard;
  641. /* Prepare skb for adding to the session's reorder_q. Hold
  642. * packets for max reorder_timeout or 1 second if not
  643. * reordering.
  644. */
  645. L2TP_SKB_CB(skb)->length = length;
  646. L2TP_SKB_CB(skb)->expires = jiffies +
  647. (session->reorder_timeout ? session->reorder_timeout : HZ);
  648. /* Add packet to the session's receive queue. Reordering is done here, if
  649. * enabled. Saved L2TP protocol info is stored in skb->sb[].
  650. */
  651. if (L2TP_SKB_CB(skb)->has_seq) {
  652. if (session->reorder_timeout != 0) {
  653. /* Packet reordering enabled. Add skb to session's
  654. * reorder queue, in order of ns.
  655. */
  656. l2tp_recv_queue_skb(session, skb);
  657. } else {
  658. /* Packet reordering disabled. Discard out-of-sequence
  659. * packets
  660. */
  661. if (L2TP_SKB_CB(skb)->ns != session->nr) {
  662. u64_stats_update_begin(&sstats->syncp);
  663. sstats->rx_seq_discards++;
  664. u64_stats_update_end(&sstats->syncp);
  665. PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
  666. "%s: oos pkt %u len %d discarded, "
  667. "waiting for %u, reorder_q_len=%d\n",
  668. session->name, L2TP_SKB_CB(skb)->ns,
  669. L2TP_SKB_CB(skb)->length, session->nr,
  670. skb_queue_len(&session->reorder_q));
  671. goto discard;
  672. }
  673. skb_queue_tail(&session->reorder_q, skb);
  674. }
  675. } else {
  676. /* No sequence numbers. Add the skb to the tail of the
  677. * reorder queue. This ensures that it will be
  678. * delivered after all previous sequenced skbs.
  679. */
  680. skb_queue_tail(&session->reorder_q, skb);
  681. }
  682. /* Try to dequeue as many skbs from reorder_q as we can. */
  683. l2tp_recv_dequeue(session);
  684. l2tp_session_dec_refcount(session);
  685. return;
  686. discard:
  687. u64_stats_update_begin(&sstats->syncp);
  688. sstats->rx_errors++;
  689. u64_stats_update_end(&sstats->syncp);
  690. kfree_skb(skb);
  691. if (session->deref)
  692. (*session->deref)(session);
  693. l2tp_session_dec_refcount(session);
  694. }
  695. EXPORT_SYMBOL(l2tp_recv_common);
  696. /* Internal UDP receive frame. Do the real work of receiving an L2TP data frame
  697. * here. The skb is not on a list when we get here.
  698. * Returns 0 if the packet was a data packet and was successfully passed on.
  699. * Returns 1 if the packet was not a good data packet and could not be
  700. * forwarded. All such packets are passed up to userspace to deal with.
  701. */
  702. static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
  703. int (*payload_hook)(struct sk_buff *skb))
  704. {
  705. struct l2tp_session *session = NULL;
  706. unsigned char *ptr, *optr;
  707. u16 hdrflags;
  708. u32 tunnel_id, session_id;
  709. int offset;
  710. u16 version;
  711. int length;
  712. struct l2tp_stats *tstats;
  713. if (tunnel->sock && l2tp_verify_udp_checksum(tunnel->sock, skb))
  714. goto discard_bad_csum;
  715. /* UDP always verifies the packet length. */
  716. __skb_pull(skb, sizeof(struct udphdr));
  717. /* Short packet? */
  718. if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) {
  719. PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
  720. "%s: recv short packet (len=%d)\n", tunnel->name, skb->len);
  721. goto error;
  722. }
  723. /* Trace packet contents, if enabled */
  724. if (tunnel->debug & L2TP_MSG_DATA) {
  725. length = min(32u, skb->len);
  726. if (!pskb_may_pull(skb, length))
  727. goto error;
  728. printk(KERN_DEBUG "%s: recv: ", tunnel->name);
  729. offset = 0;
  730. do {
  731. printk(" %02X", skb->data[offset]);
  732. } while (++offset < length);
  733. printk("\n");
  734. }
  735. /* Point to L2TP header */
  736. optr = ptr = skb->data;
  737. /* Get L2TP header flags */
  738. hdrflags = ntohs(*(__be16 *) ptr);
  739. /* Check protocol version */
  740. version = hdrflags & L2TP_HDR_VER_MASK;
  741. if (version != tunnel->version) {
  742. PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
  743. "%s: recv protocol version mismatch: got %d expected %d\n",
  744. tunnel->name, version, tunnel->version);
  745. goto error;
  746. }
  747. /* Get length of L2TP packet */
  748. length = skb->len;
  749. /* If type is control packet, it is handled by userspace. */
  750. if (hdrflags & L2TP_HDRFLAG_T) {
  751. PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_DEBUG,
  752. "%s: recv control packet, len=%d\n", tunnel->name, length);
  753. goto error;
  754. }
  755. /* Skip flags */
  756. ptr += 2;
  757. if (tunnel->version == L2TP_HDR_VER_2) {
  758. /* If length is present, skip it */
  759. if (hdrflags & L2TP_HDRFLAG_L)
  760. ptr += 2;
  761. /* Extract tunnel and session ID */
  762. tunnel_id = ntohs(*(__be16 *) ptr);
  763. ptr += 2;
  764. session_id = ntohs(*(__be16 *) ptr);
  765. ptr += 2;
  766. } else {
  767. ptr += 2; /* skip reserved bits */
  768. tunnel_id = tunnel->tunnel_id;
  769. session_id = ntohl(*(__be32 *) ptr);
  770. ptr += 4;
  771. }
  772. /* Find the session context */
  773. session = l2tp_session_find(tunnel->l2tp_net, tunnel, session_id);
  774. if (!session || !session->recv_skb) {
  775. /* Not found? Pass to userspace to deal with */
  776. PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
  777. "%s: no session found (%u/%u). Passing up.\n",
  778. tunnel->name, tunnel_id, session_id);
  779. goto error;
  780. }
  781. l2tp_recv_common(session, skb, ptr, optr, hdrflags, length, payload_hook);
  782. return 0;
  783. discard_bad_csum:
  784. LIMIT_NETDEBUG("%s: UDP: bad checksum\n", tunnel->name);
  785. UDP_INC_STATS_USER(tunnel->l2tp_net, UDP_MIB_INERRORS, 0);
  786. tstats = &tunnel->stats;
  787. u64_stats_update_begin(&tstats->syncp);
  788. tstats->rx_errors++;
  789. u64_stats_update_end(&tstats->syncp);
  790. kfree_skb(skb);
  791. return 0;
  792. error:
  793. /* Put UDP header back */
  794. __skb_push(skb, sizeof(struct udphdr));
  795. return 1;
  796. }
  797. /* UDP encapsulation receive handler. See net/ipv4/udp.c.
  798. * Return codes:
  799. * 0 : success.
  800. * <0: error
  801. * >0: skb should be passed up to userspace as UDP.
  802. */
  803. int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
  804. {
  805. struct l2tp_tunnel *tunnel;
  806. tunnel = l2tp_sock_to_tunnel(sk);
  807. if (tunnel == NULL)
  808. goto pass_up;
  809. PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_DEBUG,
  810. "%s: received %d bytes\n", tunnel->name, skb->len);
  811. if (l2tp_udp_recv_core(tunnel, skb, tunnel->recv_payload_hook))
  812. goto pass_up_put;
  813. sock_put(sk);
  814. return 0;
  815. pass_up_put:
  816. sock_put(sk);
  817. pass_up:
  818. return 1;
  819. }
  820. EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv);
  821. /************************************************************************
  822. * Transmit handling
  823. ***********************************************************************/
  824. /* Build an L2TP header for the session into the buffer provided.
  825. */
  826. static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
  827. {
  828. struct l2tp_tunnel *tunnel = session->tunnel;
  829. __be16 *bufp = buf;
  830. __be16 *optr = buf;
  831. u16 flags = L2TP_HDR_VER_2;
  832. u32 tunnel_id = tunnel->peer_tunnel_id;
  833. u32 session_id = session->peer_session_id;
  834. if (session->send_seq)
  835. flags |= L2TP_HDRFLAG_S;
  836. /* Setup L2TP header. */
  837. *bufp++ = htons(flags);
  838. *bufp++ = htons(tunnel_id);
  839. *bufp++ = htons(session_id);
  840. if (session->send_seq) {
  841. *bufp++ = htons(session->ns);
  842. *bufp++ = 0;
  843. session->ns++;
  844. session->ns &= 0xffff;
  845. PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
  846. "%s: updated ns to %u\n", session->name, session->ns);
  847. }
  848. return bufp - optr;
  849. }
  850. static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
  851. {
  852. struct l2tp_tunnel *tunnel = session->tunnel;
  853. char *bufp = buf;
  854. char *optr = bufp;
  855. /* Setup L2TP header. The header differs slightly for UDP and
  856. * IP encapsulations. For UDP, there is 4 bytes of flags.
  857. */
  858. if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
  859. u16 flags = L2TP_HDR_VER_3;
  860. *((__be16 *) bufp) = htons(flags);
  861. bufp += 2;
  862. *((__be16 *) bufp) = 0;
  863. bufp += 2;
  864. }
  865. *((__be32 *) bufp) = htonl(session->peer_session_id);
  866. bufp += 4;
  867. if (session->cookie_len) {
  868. memcpy(bufp, &session->cookie[0], session->cookie_len);
  869. bufp += session->cookie_len;
  870. }
  871. if (session->l2specific_len) {
  872. if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
  873. u32 l2h = 0;
  874. if (session->send_seq) {
  875. l2h = 0x40000000 | session->ns;
  876. session->ns++;
  877. session->ns &= 0xffffff;
  878. PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
  879. "%s: updated ns to %u\n", session->name, session->ns);
  880. }
  881. *((__be32 *) bufp) = htonl(l2h);
  882. }
  883. bufp += session->l2specific_len;
  884. }
  885. if (session->offset)
  886. bufp += session->offset;
  887. return bufp - optr;
  888. }
  889. static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
  890. struct flowi *fl, size_t data_len)
  891. {
  892. struct l2tp_tunnel *tunnel = session->tunnel;
  893. unsigned int len = skb->len;
  894. int error;
  895. struct l2tp_stats *tstats, *sstats;
  896. /* Debug */
  897. if (session->send_seq)
  898. PRINTK(session->debug, L2TP_MSG_DATA, KERN_DEBUG,
  899. "%s: send %Zd bytes, ns=%u\n", session->name,
  900. data_len, session->ns - 1);
  901. else
  902. PRINTK(session->debug, L2TP_MSG_DATA, KERN_DEBUG,
  903. "%s: send %Zd bytes\n", session->name, data_len);
  904. if (session->debug & L2TP_MSG_DATA) {
  905. int i;
  906. int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
  907. unsigned char *datap = skb->data + uhlen;
  908. printk(KERN_DEBUG "%s: xmit:", session->name);
  909. for (i = 0; i < (len - uhlen); i++) {
  910. printk(" %02X", *datap++);
  911. if (i == 31) {
  912. printk(" ...");
  913. break;
  914. }
  915. }
  916. printk("\n");
  917. }
  918. /* Queue the packet to IP for output */
  919. skb->local_df = 1;
  920. #if IS_ENABLED(CONFIG_IPV6)
  921. if (skb->sk->sk_family == PF_INET6)
  922. error = inet6_csk_xmit(skb, NULL);
  923. else
  924. #endif
  925. error = ip_queue_xmit(skb, fl);
  926. /* Update stats */
  927. tstats = &tunnel->stats;
  928. u64_stats_update_begin(&tstats->syncp);
  929. sstats = &session->stats;
  930. u64_stats_update_begin(&sstats->syncp);
  931. if (error >= 0) {
  932. tstats->tx_packets++;
  933. tstats->tx_bytes += len;
  934. sstats->tx_packets++;
  935. sstats->tx_bytes += len;
  936. } else {
  937. tstats->tx_errors++;
  938. sstats->tx_errors++;
  939. }
  940. u64_stats_update_end(&tstats->syncp);
  941. u64_stats_update_end(&sstats->syncp);
  942. return 0;
  943. }
  944. /* Automatically called when the skb is freed.
  945. */
  946. static void l2tp_sock_wfree(struct sk_buff *skb)
  947. {
  948. sock_put(skb->sk);
  949. }
  950. /* For data skbs that we transmit, we associate with the tunnel socket
  951. * but don't do accounting.
  952. */
  953. static inline void l2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
  954. {
  955. sock_hold(sk);
  956. skb->sk = sk;
  957. skb->destructor = l2tp_sock_wfree;
  958. }
  959. #if IS_ENABLED(CONFIG_IPV6)
  960. static void l2tp_xmit_ipv6_csum(struct sock *sk, struct sk_buff *skb,
  961. int udp_len)
  962. {
  963. struct ipv6_pinfo *np = inet6_sk(sk);
  964. struct udphdr *uh = udp_hdr(skb);
  965. if (!skb_dst(skb) || !skb_dst(skb)->dev ||
  966. !(skb_dst(skb)->dev->features & NETIF_F_IPV6_CSUM)) {
  967. __wsum csum = skb_checksum(skb, 0, udp_len, 0);
  968. skb->ip_summed = CHECKSUM_UNNECESSARY;
  969. uh->check = csum_ipv6_magic(&np->saddr, &np->daddr, udp_len,
  970. IPPROTO_UDP, csum);
  971. if (uh->check == 0)
  972. uh->check = CSUM_MANGLED_0;
  973. } else {
  974. skb->ip_summed = CHECKSUM_PARTIAL;
  975. skb->csum_start = skb_transport_header(skb) - skb->head;
  976. skb->csum_offset = offsetof(struct udphdr, check);
  977. uh->check = ~csum_ipv6_magic(&np->saddr, &np->daddr,
  978. udp_len, IPPROTO_UDP, 0);
  979. }
  980. }
  981. #endif
  982. /* If caller requires the skb to have a ppp header, the header must be
  983. * inserted in the skb data before calling this function.
  984. */
  985. int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len)
  986. {
  987. int data_len = skb->len;
  988. struct l2tp_tunnel *tunnel = session->tunnel;
  989. struct sock *sk = tunnel->sock;
  990. struct flowi *fl;
  991. struct udphdr *uh;
  992. struct inet_sock *inet;
  993. __wsum csum;
  994. int old_headroom;
  995. int new_headroom;
  996. int headroom;
  997. int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
  998. int udp_len;
  999. /* Check that there's enough headroom in the skb to insert IP,
  1000. * UDP and L2TP headers. If not enough, expand it to
  1001. * make room. Adjust truesize.
  1002. */
  1003. headroom = NET_SKB_PAD + sizeof(struct iphdr) +
  1004. uhlen + hdr_len;
  1005. old_headroom = skb_headroom(skb);
  1006. if (skb_cow_head(skb, headroom)) {
  1007. dev_kfree_skb(skb);
  1008. goto abort;
  1009. }
  1010. new_headroom = skb_headroom(skb);
  1011. skb_orphan(skb);
  1012. skb->truesize += new_headroom - old_headroom;
  1013. /* Setup L2TP header */
  1014. session->build_header(session, __skb_push(skb, hdr_len));
  1015. /* Reset skb netfilter state */
  1016. memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
  1017. IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
  1018. IPSKB_REROUTED);
  1019. nf_reset(skb);
  1020. bh_lock_sock(sk);
  1021. if (sock_owned_by_user(sk)) {
  1022. dev_kfree_skb(skb);
  1023. goto out_unlock;
  1024. }
  1025. /* Get routing info from the tunnel socket */
  1026. skb_dst_drop(skb);
  1027. skb_dst_set(skb, dst_clone(__sk_dst_check(sk, 0)));
  1028. inet = inet_sk(sk);
  1029. fl = &inet->cork.fl;
  1030. switch (tunnel->encap) {
  1031. case L2TP_ENCAPTYPE_UDP:
  1032. /* Setup UDP header */
  1033. __skb_push(skb, sizeof(*uh));
  1034. skb_reset_transport_header(skb);
  1035. uh = udp_hdr(skb);
  1036. uh->source = inet->inet_sport;
  1037. uh->dest = inet->inet_dport;
  1038. udp_len = uhlen + hdr_len + data_len;
  1039. uh->len = htons(udp_len);
  1040. uh->check = 0;
  1041. /* Calculate UDP checksum if configured to do so */
  1042. #if IS_ENABLED(CONFIG_IPV6)
  1043. if (sk->sk_family == PF_INET6)
  1044. l2tp_xmit_ipv6_csum(sk, skb, udp_len);
  1045. else
  1046. #endif
  1047. if (sk->sk_no_check == UDP_CSUM_NOXMIT)
  1048. skb->ip_summed = CHECKSUM_NONE;
  1049. else if ((skb_dst(skb) && skb_dst(skb)->dev) &&
  1050. (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM))) {
  1051. skb->ip_summed = CHECKSUM_COMPLETE;
  1052. csum = skb_checksum(skb, 0, udp_len, 0);
  1053. uh->check = csum_tcpudp_magic(inet->inet_saddr,
  1054. inet->inet_daddr,
  1055. udp_len, IPPROTO_UDP, csum);
  1056. if (uh->check == 0)
  1057. uh->check = CSUM_MANGLED_0;
  1058. } else {
  1059. skb->ip_summed = CHECKSUM_PARTIAL;
  1060. skb->csum_start = skb_transport_header(skb) - skb->head;
  1061. skb->csum_offset = offsetof(struct udphdr, check);
  1062. uh->check = ~csum_tcpudp_magic(inet->inet_saddr,
  1063. inet->inet_daddr,
  1064. udp_len, IPPROTO_UDP, 0);
  1065. }
  1066. break;
  1067. case L2TP_ENCAPTYPE_IP:
  1068. break;
  1069. }
  1070. l2tp_skb_set_owner_w(skb, sk);
  1071. l2tp_xmit_core(session, skb, fl, data_len);
  1072. out_unlock:
  1073. bh_unlock_sock(sk);
  1074. abort:
  1075. return 0;
  1076. }
  1077. EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
  1078. /*****************************************************************************
  1079. * Tinnel and session create/destroy.
  1080. *****************************************************************************/
  1081. /* Tunnel socket destruct hook.
  1082. * The tunnel context is deleted only when all session sockets have been
  1083. * closed.
  1084. */
  1085. static void l2tp_tunnel_destruct(struct sock *sk)
  1086. {
  1087. struct l2tp_tunnel *tunnel;
  1088. tunnel = sk->sk_user_data;
  1089. if (tunnel == NULL)
  1090. goto end;
  1091. PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
  1092. "%s: closing...\n", tunnel->name);
  1093. /* Close all sessions */
  1094. l2tp_tunnel_closeall(tunnel);
  1095. switch (tunnel->encap) {
  1096. case L2TP_ENCAPTYPE_UDP:
  1097. /* No longer an encapsulation socket. See net/ipv4/udp.c */
  1098. (udp_sk(sk))->encap_type = 0;
  1099. (udp_sk(sk))->encap_rcv = NULL;
  1100. break;
  1101. case L2TP_ENCAPTYPE_IP:
  1102. break;
  1103. }
  1104. /* Remove hooks into tunnel socket */
  1105. tunnel->sock = NULL;
  1106. sk->sk_destruct = tunnel->old_sk_destruct;
  1107. sk->sk_user_data = NULL;
  1108. /* Call the original destructor */
  1109. if (sk->sk_destruct)
  1110. (*sk->sk_destruct)(sk);
  1111. /* We're finished with the socket */
  1112. l2tp_tunnel_dec_refcount(tunnel);
  1113. end:
  1114. return;
  1115. }
  1116. /* When the tunnel is closed, all the attached sessions need to go too.
  1117. */
  1118. static void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
  1119. {
  1120. int hash;
  1121. struct hlist_node *walk;
  1122. struct hlist_node *tmp;
  1123. struct l2tp_session *session;
  1124. BUG_ON(tunnel == NULL);
  1125. PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
  1126. "%s: closing all sessions...\n", tunnel->name);
  1127. write_lock_bh(&tunnel->hlist_lock);
  1128. for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
  1129. again:
  1130. hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
  1131. session = hlist_entry(walk, struct l2tp_session, hlist);
  1132. PRINTK(session->debug, L2TP_MSG_CONTROL, KERN_INFO,
  1133. "%s: closing session\n", session->name);
  1134. hlist_del_init(&session->hlist);
  1135. /* Since we should hold the sock lock while
  1136. * doing any unbinding, we need to release the
  1137. * lock we're holding before taking that lock.
  1138. * Hold a reference to the sock so it doesn't
  1139. * disappear as we're jumping between locks.
  1140. */
  1141. if (session->ref != NULL)
  1142. (*session->ref)(session);
  1143. write_unlock_bh(&tunnel->hlist_lock);
  1144. if (tunnel->version != L2TP_HDR_VER_2) {
  1145. struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
  1146. spin_lock_bh(&pn->l2tp_session_hlist_lock);
  1147. hlist_del_init_rcu(&session->global_hlist);
  1148. spin_unlock_bh(&pn->l2tp_session_hlist_lock);
  1149. synchronize_rcu();
  1150. }
  1151. if (session->session_close != NULL)
  1152. (*session->session_close)(session);
  1153. if (session->deref != NULL)
  1154. (*session->deref)(session);
  1155. write_lock_bh(&tunnel->hlist_lock);
  1156. /* Now restart from the beginning of this hash
  1157. * chain. We always remove a session from the
  1158. * list so we are guaranteed to make forward
  1159. * progress.
  1160. */
  1161. goto again;
  1162. }
  1163. }
  1164. write_unlock_bh(&tunnel->hlist_lock);
  1165. }
  1166. /* Really kill the tunnel.
  1167. * Come here only when all sessions have been cleared from the tunnel.
  1168. */
  1169. static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
  1170. {
  1171. struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
  1172. BUG_ON(atomic_read(&tunnel->ref_count) != 0);
  1173. BUG_ON(tunnel->sock != NULL);
  1174. PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
  1175. "%s: free...\n", tunnel->name);
  1176. /* Remove from tunnel list */
  1177. spin_lock_bh(&pn->l2tp_tunnel_list_lock);
  1178. list_del_rcu(&tunnel->list);
  1179. spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
  1180. synchronize_rcu();
  1181. atomic_dec(&l2tp_tunnel_count);
  1182. kfree(tunnel);
  1183. }
  1184. /* Create a socket for the tunnel, if one isn't set up by
  1185. * userspace. This is used for static tunnels where there is no
  1186. * managing L2TP daemon.
  1187. */
  1188. static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct socket **sockp)
  1189. {
  1190. int err = -EINVAL;
  1191. struct sockaddr_in udp_addr;
  1192. #if IS_ENABLED(CONFIG_IPV6)
  1193. struct sockaddr_in6 udp6_addr;
  1194. struct sockaddr_l2tpip6 ip6_addr;
  1195. #endif
  1196. struct sockaddr_l2tpip ip_addr;
  1197. struct socket *sock = NULL;
  1198. switch (cfg->encap) {
  1199. case L2TP_ENCAPTYPE_UDP:
  1200. #if IS_ENABLED(CONFIG_IPV6)
  1201. if (cfg->local_ip6 && cfg->peer_ip6) {
  1202. err = sock_create(AF_INET6, SOCK_DGRAM, 0, sockp);
  1203. if (err < 0)
  1204. goto out;
  1205. sock = *sockp;
  1206. memset(&udp6_addr, 0, sizeof(udp6_addr));
  1207. udp6_addr.sin6_family = AF_INET6;
  1208. memcpy(&udp6_addr.sin6_addr, cfg->local_ip6,
  1209. sizeof(udp6_addr.sin6_addr));
  1210. udp6_addr.sin6_port = htons(cfg->local_udp_port);
  1211. err = kernel_bind(sock, (struct sockaddr *) &udp6_addr,
  1212. sizeof(udp6_addr));
  1213. if (err < 0)
  1214. goto out;
  1215. udp6_addr.sin6_family = AF_INET6;
  1216. memcpy(&udp6_addr.sin6_addr, cfg->peer_ip6,
  1217. sizeof(udp6_addr.sin6_addr));
  1218. udp6_addr.sin6_port = htons(cfg->peer_udp_port);
  1219. err = kernel_connect(sock,
  1220. (struct sockaddr *) &udp6_addr,
  1221. sizeof(udp6_addr), 0);
  1222. if (err < 0)
  1223. goto out;
  1224. } else
  1225. #endif
  1226. {
  1227. err = sock_create(AF_INET, SOCK_DGRAM, 0, sockp);
  1228. if (err < 0)
  1229. goto out;
  1230. sock = *sockp;
  1231. memset(&udp_addr, 0, sizeof(udp_addr));
  1232. udp_addr.sin_family = AF_INET;
  1233. udp_addr.sin_addr = cfg->local_ip;
  1234. udp_addr.sin_port = htons(cfg->local_udp_port);
  1235. err = kernel_bind(sock, (struct sockaddr *) &udp_addr,
  1236. sizeof(udp_addr));
  1237. if (err < 0)
  1238. goto out;
  1239. udp_addr.sin_family = AF_INET;
  1240. udp_addr.sin_addr = cfg->peer_ip;
  1241. udp_addr.sin_port = htons(cfg->peer_udp_port);
  1242. err = kernel_connect(sock,
  1243. (struct sockaddr *) &udp_addr,
  1244. sizeof(udp_addr), 0);
  1245. if (err < 0)
  1246. goto out;
  1247. }
  1248. if (!cfg->use_udp_checksums)
  1249. sock->sk->sk_no_check = UDP_CSUM_NOXMIT;
  1250. break;
  1251. case L2TP_ENCAPTYPE_IP:
  1252. #if IS_ENABLED(CONFIG_IPV6)
  1253. if (cfg->local_ip6 && cfg->peer_ip6) {
  1254. err = sock_create(AF_INET6, SOCK_DGRAM, IPPROTO_L2TP,
  1255. sockp);
  1256. if (err < 0)
  1257. goto out;
  1258. sock = *sockp;
  1259. memset(&ip6_addr, 0, sizeof(ip6_addr));
  1260. ip6_addr.l2tp_family = AF_INET6;
  1261. memcpy(&ip6_addr.l2tp_addr, cfg->local_ip6,
  1262. sizeof(ip6_addr.l2tp_addr));
  1263. ip6_addr.l2tp_conn_id = tunnel_id;
  1264. err = kernel_bind(sock, (struct sockaddr *) &ip6_addr,
  1265. sizeof(ip6_addr));
  1266. if (err < 0)
  1267. goto out;
  1268. ip6_addr.l2tp_family = AF_INET6;
  1269. memcpy(&ip6_addr.l2tp_addr, cfg->peer_ip6,
  1270. sizeof(ip6_addr.l2tp_addr));
  1271. ip6_addr.l2tp_conn_id = peer_tunnel_id;
  1272. err = kernel_connect(sock,
  1273. (struct sockaddr *) &ip6_addr,
  1274. sizeof(ip6_addr), 0);
  1275. if (err < 0)
  1276. goto out;
  1277. } else
  1278. #endif
  1279. {
  1280. err = sock_create(AF_INET, SOCK_DGRAM, IPPROTO_L2TP,
  1281. sockp);
  1282. if (err < 0)
  1283. goto out;
  1284. sock = *sockp;
  1285. memset(&ip_addr, 0, sizeof(ip_addr));
  1286. ip_addr.l2tp_family = AF_INET;
  1287. ip_addr.l2tp_addr = cfg->local_ip;
  1288. ip_addr.l2tp_conn_id = tunnel_id;
  1289. err = kernel_bind(sock, (struct sockaddr *) &ip_addr,
  1290. sizeof(ip_addr));
  1291. if (err < 0)
  1292. goto out;
  1293. ip_addr.l2tp_family = AF_INET;
  1294. ip_addr.l2tp_addr = cfg->peer_ip;
  1295. ip_addr.l2tp_conn_id = peer_tunnel_id;
  1296. err = kernel_connect(sock, (struct sockaddr *) &ip_addr,
  1297. sizeof(ip_addr), 0);
  1298. if (err < 0)
  1299. goto out;
  1300. }
  1301. break;
  1302. default:
  1303. goto out;
  1304. }
  1305. out:
  1306. if ((err < 0) && sock) {
  1307. sock_release(sock);
  1308. *sockp = NULL;
  1309. }
  1310. return err;
  1311. }
  1312. int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp)
  1313. {
  1314. struct l2tp_tunnel *tunnel = NULL;
  1315. int err;
  1316. struct socket *sock = NULL;
  1317. struct sock *sk = NULL;
  1318. struct l2tp_net *pn;
  1319. enum l2tp_encap_type encap = L2TP_ENCAPTYPE_UDP;
  1320. /* Get the tunnel socket from the fd, which was opened by
  1321. * the userspace L2TP daemon. If not specified, create a
  1322. * kernel socket.
  1323. */
  1324. if (fd < 0) {
  1325. err = l2tp_tunnel_sock_create(tunnel_id, peer_tunnel_id, cfg, &sock);
  1326. if (err < 0)
  1327. goto err;
  1328. } else {
  1329. err = -EBADF;
  1330. sock = sockfd_lookup(fd, &err);
  1331. if (!sock) {
  1332. printk(KERN_ERR "tunl %hu: sockfd_lookup(fd=%d) returned %d\n",
  1333. tunnel_id, fd, err);
  1334. goto err;
  1335. }
  1336. }
  1337. sk = sock->sk;
  1338. if (cfg != NULL)
  1339. encap = cfg->encap;
  1340. /* Quick sanity checks */
  1341. switch (encap) {
  1342. case L2TP_ENCAPTYPE_UDP:
  1343. err = -EPROTONOSUPPORT;
  1344. if (sk->sk_protocol != IPPROTO_UDP) {
  1345. printk(KERN_ERR "tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
  1346. tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
  1347. goto err;
  1348. }
  1349. break;
  1350. case L2TP_ENCAPTYPE_IP:
  1351. err = -EPROTONOSUPPORT;
  1352. if (sk->sk_protocol != IPPROTO_L2TP) {
  1353. printk(KERN_ERR "tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
  1354. tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP);
  1355. goto err;
  1356. }
  1357. break;
  1358. }
  1359. /* Check if this socket has already been prepped */
  1360. tunnel = (struct l2tp_tunnel *)sk->sk_user_data;
  1361. if (tunnel != NULL) {
  1362. /* This socket has already been prepped */
  1363. err = -EBUSY;
  1364. goto err;
  1365. }
  1366. tunnel = kzalloc(sizeof(struct l2tp_tunnel), GFP_KERNEL);
  1367. if (tunnel == NULL) {
  1368. err = -ENOMEM;
  1369. goto err;
  1370. }
  1371. tunnel->version = version;
  1372. tunnel->tunnel_id = tunnel_id;
  1373. tunnel->peer_tunnel_id = peer_tunnel_id;
  1374. tunnel->debug = L2TP_DEFAULT_DEBUG_FLAGS;
  1375. tunnel->magic = L2TP_TUNNEL_MAGIC;
  1376. sprintf(&tunnel->name[0], "tunl %u", tunnel_id);
  1377. rwlock_init(&tunnel->hlist_lock);
  1378. /* The net we belong to */
  1379. tunnel->l2tp_net = net;
  1380. pn = l2tp_pernet(net);
  1381. if (cfg != NULL)
  1382. tunnel->debug = cfg->debug;
  1383. /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
  1384. tunnel->encap = encap;
  1385. if (encap == L2TP_ENCAPTYPE_UDP) {
  1386. /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
  1387. udp_sk(sk)->encap_type = UDP_ENCAP_L2TPINUDP;
  1388. udp_sk(sk)->encap_rcv = l2tp_udp_encap_recv;
  1389. #if IS_ENABLED(CONFIG_IPV6)
  1390. if (sk->sk_family == PF_INET6)
  1391. udpv6_encap_enable();
  1392. else
  1393. #endif
  1394. udp_encap_enable();
  1395. }
  1396. sk->sk_user_data = tunnel;
  1397. /* Hook on the tunnel socket destructor so that we can cleanup
  1398. * if the tunnel socket goes away.
  1399. */
  1400. tunnel->old_sk_destruct = sk->sk_destruct;
  1401. sk->sk_destruct = &l2tp_tunnel_destruct;
  1402. tunnel->sock = sk;
  1403. sk->sk_allocation = GFP_ATOMIC;
  1404. /* Add tunnel to our list */
  1405. INIT_LIST_HEAD(&tunnel->list);
  1406. atomic_inc(&l2tp_tunnel_count);
  1407. /* Bump the reference count. The tunnel context is deleted
  1408. * only when this drops to zero. Must be done before list insertion
  1409. */
  1410. l2tp_tunnel_inc_refcount(tunnel);
  1411. spin_lock_bh(&pn->l2tp_tunnel_list_lock);
  1412. list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
  1413. spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
  1414. err = 0;
  1415. err:
  1416. if (tunnelp)
  1417. *tunnelp = tunnel;
  1418. /* If tunnel's socket was created by the kernel, it doesn't
  1419. * have a file.
  1420. */
  1421. if (sock && sock->file)
  1422. sockfd_put(sock);
  1423. return err;
  1424. }
  1425. EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
  1426. /* This function is used by the netlink TUNNEL_DELETE command.
  1427. */
  1428. int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
  1429. {
  1430. int err = 0;
  1431. struct socket *sock = tunnel->sock ? tunnel->sock->sk_socket : NULL;
  1432. /* Force the tunnel socket to close. This will eventually
  1433. * cause the tunnel to be deleted via the normal socket close
  1434. * mechanisms when userspace closes the tunnel socket.
  1435. */
  1436. if (sock != NULL) {
  1437. err = inet_shutdown(sock, 2);
  1438. /* If the tunnel's socket was created by the kernel,
  1439. * close the socket here since the socket was not
  1440. * created by userspace.
  1441. */
  1442. if (sock->file == NULL)
  1443. err = inet_release(sock);
  1444. }
  1445. return err;
  1446. }
  1447. EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
  1448. /* Really kill the session.
  1449. */
  1450. void l2tp_session_free(struct l2tp_session *session)
  1451. {
  1452. struct l2tp_tunnel *tunnel;
  1453. BUG_ON(atomic_read(&session->ref_count) != 0);
  1454. tunnel = session->tunnel;
  1455. if (tunnel != NULL) {
  1456. BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
  1457. /* Delete the session from the hash */
  1458. write_lock_bh(&tunnel->hlist_lock);
  1459. hlist_del_init(&session->hlist);
  1460. write_unlock_bh(&tunnel->hlist_lock);
  1461. /* Unlink from the global hash if not L2TPv2 */
  1462. if (tunnel->version != L2TP_HDR_VER_2) {
  1463. struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
  1464. spin_lock_bh(&pn->l2tp_session_hlist_lock);
  1465. hlist_del_init_rcu(&session->global_hlist);
  1466. spin_unlock_bh(&pn->l2tp_session_hlist_lock);
  1467. synchronize_rcu();
  1468. }
  1469. if (session->session_id != 0)
  1470. atomic_dec(&l2tp_session_count);
  1471. sock_put(tunnel->sock);
  1472. /* This will delete the tunnel context if this
  1473. * is the last session on the tunnel.
  1474. */
  1475. session->tunnel = NULL;
  1476. l2tp_tunnel_dec_refcount(tunnel);
  1477. }
  1478. kfree(session);
  1479. return;
  1480. }
  1481. EXPORT_SYMBOL_GPL(l2tp_session_free);
  1482. /* This function is used by the netlink SESSION_DELETE command and by
  1483. pseudowire modules.
  1484. */
  1485. int l2tp_session_delete(struct l2tp_session *session)
  1486. {
  1487. if (session->session_close != NULL)
  1488. (*session->session_close)(session);
  1489. l2tp_session_dec_refcount(session);
  1490. return 0;
  1491. }
  1492. EXPORT_SYMBOL_GPL(l2tp_session_delete);
  1493. /* We come here whenever a session's send_seq, cookie_len or
  1494. * l2specific_len parameters are set.
  1495. */
  1496. static void l2tp_session_set_header_len(struct l2tp_session *session, int version)
  1497. {
  1498. if (version == L2TP_HDR_VER_2) {
  1499. session->hdr_len = 6;
  1500. if (session->send_seq)
  1501. session->hdr_len += 4;
  1502. } else {
  1503. session->hdr_len = 4 + session->cookie_len + session->l2specific_len + session->offset;
  1504. if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)
  1505. session->hdr_len += 4;
  1506. }
  1507. }
  1508. struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
  1509. {
  1510. struct l2tp_session *session;
  1511. session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL);
  1512. if (session != NULL) {
  1513. session->magic = L2TP_SESSION_MAGIC;
  1514. session->tunnel = tunnel;
  1515. session->session_id = session_id;
  1516. session->peer_session_id = peer_session_id;
  1517. session->nr = 0;
  1518. sprintf(&session->name[0], "sess %u/%u",
  1519. tunnel->tunnel_id, session->session_id);
  1520. skb_queue_head_init(&session->reorder_q);
  1521. INIT_HLIST_NODE(&session->hlist);
  1522. INIT_HLIST_NODE(&session->global_hlist);
  1523. /* Inherit debug options from tunnel */
  1524. session->debug = tunnel->debug;
  1525. if (cfg) {
  1526. session->pwtype = cfg->pw_type;
  1527. session->debug = cfg->debug;
  1528. session->mtu = cfg->mtu;
  1529. session->mru = cfg->mru;
  1530. session->send_seq = cfg->send_seq;
  1531. session->recv_seq = cfg->recv_seq;
  1532. session->lns_mode = cfg->lns_mode;
  1533. session->reorder_timeout = cfg->reorder_timeout;
  1534. session->offset = cfg->offset;
  1535. session->l2specific_type = cfg->l2specific_type;
  1536. session->l2specific_len = cfg->l2specific_len;
  1537. session->cookie_len = cfg->cookie_len;
  1538. memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);
  1539. session->peer_cookie_len = cfg->peer_cookie_len;
  1540. memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);
  1541. }
  1542. if (tunnel->version == L2TP_HDR_VER_2)
  1543. session->build_header = l2tp_build_l2tpv2_header;
  1544. else
  1545. session->build_header = l2tp_build_l2tpv3_header;
  1546. l2tp_session_set_header_len(session, tunnel->version);
  1547. /* Bump the reference count. The session context is deleted
  1548. * only when this drops to zero.
  1549. */
  1550. l2tp_session_inc_refcount(session);
  1551. l2tp_tunnel_inc_refcount(tunnel);
  1552. /* Ensure tunnel socket isn't deleted */
  1553. sock_hold(tunnel->sock);
  1554. /* Add session to the tunnel's hash list */
  1555. write_lock_bh(&tunnel->hlist_lock);
  1556. hlist_add_head(&session->hlist,
  1557. l2tp_session_id_hash(tunnel, session_id));
  1558. write_unlock_bh(&tunnel->hlist_lock);
  1559. /* And to the global session list if L2TPv3 */
  1560. if (tunnel->version != L2TP_HDR_VER_2) {
  1561. struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
  1562. spin_lock_bh(&pn->l2tp_session_hlist_lock);
  1563. hlist_add_head_rcu(&session->global_hlist,
  1564. l2tp_session_id_hash_2(pn, session_id));
  1565. spin_unlock_bh(&pn->l2tp_session_hlist_lock);
  1566. }
  1567. /* Ignore management session in session count value */
  1568. if (session->session_id != 0)
  1569. atomic_inc(&l2tp_session_count);
  1570. }
  1571. return session;
  1572. }
  1573. EXPORT_SYMBOL_GPL(l2tp_session_create);
  1574. /*****************************************************************************
  1575. * Init and cleanup
  1576. *****************************************************************************/
  1577. static __net_init int l2tp_init_net(struct net *net)
  1578. {
  1579. struct l2tp_net *pn = net_generic(net, l2tp_net_id);
  1580. int hash;
  1581. INIT_LIST_HEAD(&pn->l2tp_tunnel_list);
  1582. spin_lock_init(&pn->l2tp_tunnel_list_lock);
  1583. for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
  1584. INIT_HLIST_HEAD(&pn->l2tp_session_hlist[hash]);
  1585. spin_lock_init(&pn->l2tp_session_hlist_lock);
  1586. return 0;
  1587. }
  1588. static struct pernet_operations l2tp_net_ops = {
  1589. .init = l2tp_init_net,
  1590. .id = &l2tp_net_id,
  1591. .size = sizeof(struct l2tp_net),
  1592. };
  1593. static int __init l2tp_init(void)
  1594. {
  1595. int rc = 0;
  1596. rc = register_pernet_device(&l2tp_net_ops);
  1597. if (rc)
  1598. goto out;
  1599. printk(KERN_INFO "L2TP core driver, %s\n", L2TP_DRV_VERSION);
  1600. out:
  1601. return rc;
  1602. }
  1603. static void __exit l2tp_exit(void)
  1604. {
  1605. unregister_pernet_device(&l2tp_net_ops);
  1606. }
  1607. module_init(l2tp_init);
  1608. module_exit(l2tp_exit);
  1609. MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
  1610. MODULE_DESCRIPTION("L2TP core");
  1611. MODULE_LICENSE("GPL");
  1612. MODULE_VERSION(L2TP_DRV_VERSION);