1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*****************************************************************************
   3 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets
   4 *
   5 * PPPoX    --- Generic PPP encapsulation socket family
   6 * PPPoL2TP --- PPP over L2TP (RFC 2661)
   7 *
   8 * Version:	2.0.0
   9 *
  10 * Authors:	James Chapman (jchapman@katalix.com)
  11 *
  12 * Based on original work by Martijn van Oosterhout <kleptog@svana.org>
  13 *
  14 * License:
  15 */
  16
  17/* This driver handles only L2TP data frames; control frames are handled by a
  18 * userspace application.
  19 *
  20 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and
  21 * attaches it to a bound UDP socket with local tunnel_id / session_id and
  22 * peer tunnel_id / session_id set. Data can then be sent or received using
  23 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket
  24 * can be read or modified using ioctl() or [gs]etsockopt() calls.
  25 *
  26 * When a PPPoL2TP socket is connected with local and peer session_id values
  27 * zero, the socket is treated as a special tunnel management socket.
  28 *
  29 * Here's example userspace code to create a socket for sending/receiving data
  30 * over an L2TP session:-
  31 *
  32 *	struct sockaddr_pppol2tp sax;
  33 *	int fd;
  34 *	int session_fd;
  35 *
  36 *	fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
  37 *
  38 *	sax.sa_family = AF_PPPOX;
  39 *	sax.sa_protocol = PX_PROTO_OL2TP;
  40 *	sax.pppol2tp.fd = tunnel_fd;	// bound UDP socket
  41 *	sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr;
  42 *	sax.pppol2tp.addr.sin_port = addr->sin_port;
  43 *	sax.pppol2tp.addr.sin_family = AF_INET;
  44 *	sax.pppol2tp.s_tunnel  = tunnel_id;
  45 *	sax.pppol2tp.s_session = session_id;
  46 *	sax.pppol2tp.d_tunnel  = peer_tunnel_id;
  47 *	sax.pppol2tp.d_session = peer_session_id;
  48 *
  49 *	session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax));
  50 *
  51 * A pppd plugin that allows PPP traffic to be carried over L2TP using
  52 * this driver is available from the OpenL2TP project at
  53 * http://openl2tp.sourceforge.net.
  54 */
  55
  56#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  57
  58#include <linux/module.h>
  59#include <linux/string.h>
  60#include <linux/list.h>
  61#include <linux/uaccess.h>
  62
  63#include <linux/kernel.h>
  64#include <linux/spinlock.h>
  65#include <linux/kthread.h>
  66#include <linux/sched.h>
  67#include <linux/slab.h>
  68#include <linux/errno.h>
  69#include <linux/jiffies.h>
  70
  71#include <linux/netdevice.h>
  72#include <linux/net.h>
  73#include <linux/inetdevice.h>
  74#include <linux/skbuff.h>
  75#include <linux/init.h>
  76#include <linux/ip.h>
  77#include <linux/udp.h>
  78#include <linux/if_pppox.h>
  79#include <linux/if_pppol2tp.h>
  80#include <net/sock.h>
  81#include <linux/ppp_channel.h>
  82#include <linux/ppp_defs.h>
  83#include <linux/ppp-ioctl.h>
  84#include <linux/file.h>
  85#include <linux/hash.h>
  86#include <linux/sort.h>
  87#include <linux/proc_fs.h>
  88#include <linux/l2tp.h>
  89#include <linux/nsproxy.h>
  90#include <net/net_namespace.h>
  91#include <net/netns/generic.h>
  92#include <net/ip.h>
  93#include <net/udp.h>
  94#include <net/inet_common.h>
  95
  96#include <asm/byteorder.h>
  97#include <linux/atomic.h>
  98
  99#include "l2tp_core.h"
 100
 101#define PPPOL2TP_DRV_VERSION	"V2.0"
 102
 103/* Space for UDP, L2TP and PPP headers */
 104#define PPPOL2TP_HEADER_OVERHEAD	40
 105
 106/* Number of bytes to build transmit L2TP headers.
 107 * Unfortunately the size is different depending on whether sequence numbers
 108 * are enabled.
 109 */
 110#define PPPOL2TP_L2TP_HDR_SIZE_SEQ		10
 111#define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ		6
 112
 113/* Private data of each session. This data lives at the end of struct
 114 * l2tp_session, referenced via session->priv[].
 115 */
 116struct pppol2tp_session {
 117	int			owner;		/* pid that opened the socket */
 118
 119	struct mutex		sk_lock;	/* Protects .sk */
 120	struct sock __rcu	*sk;		/* Pointer to the session PPPoX socket */
 121	struct sock		*__sk;		/* Copy of .sk, for cleanup */
 
 122};
 123
 124static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);
 125
 126static const struct ppp_channel_ops pppol2tp_chan_ops = {
 127	.start_xmit =  pppol2tp_xmit,
 128};
 129
 130static const struct proto_ops pppol2tp_ops;
 131
 132/* Retrieves the pppol2tp socket associated to a session.
 133 * A reference is held on the returned socket, so this function must be paired
 134 * with sock_put().
 135 */
 136static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session)
 137{
 138	struct pppol2tp_session *ps = l2tp_session_priv(session);
 139	struct sock *sk;
 140
 141	rcu_read_lock();
 142	sk = rcu_dereference(ps->sk);
 143	if (sk)
 144		sock_hold(sk);
 145	rcu_read_unlock();
 146
 147	return sk;
 148}
 149
 150/* Helpers to obtain tunnel/session contexts from sockets.
 151 */
 152static struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk)
 153{
 154	struct l2tp_session *session;
 155
 156	if (!sk)
 157		return NULL;
 158
 159	rcu_read_lock();
 160	session = rcu_dereference_sk_user_data(sk);
 161	if (session && refcount_inc_not_zero(&session->ref_count)) {
 162		rcu_read_unlock();
 163		WARN_ON_ONCE(session->magic != L2TP_SESSION_MAGIC);
 164		return session;
 
 
 
 
 165	}
 166	rcu_read_unlock();
 167
 168	return NULL;
 
 169}
 170
 171/*****************************************************************************
 172 * Receive data handling
 173 *****************************************************************************/
 174
 175/* Receive message. This is the recvmsg for the PPPoL2TP socket.
 176 */
 177static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg,
 178			    size_t len, int flags)
 179{
 180	int err;
 181	struct sk_buff *skb;
 182	struct sock *sk = sock->sk;
 183
 184	err = -EIO;
 185	if (sk->sk_state & PPPOX_BOUND)
 186		goto end;
 187
 188	err = 0;
 189	skb = skb_recv_datagram(sk, flags, &err);
 
 190	if (!skb)
 191		goto end;
 192
 193	if (len > skb->len)
 194		len = skb->len;
 195	else if (len < skb->len)
 196		msg->msg_flags |= MSG_TRUNC;
 197
 198	err = skb_copy_datagram_msg(skb, 0, msg, len);
 199	if (likely(err == 0))
 200		err = len;
 201
 202	kfree_skb(skb);
 203end:
 204	return err;
 205}
 206
 207static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len)
 208{
 209	struct pppol2tp_session *ps = l2tp_session_priv(session);
 210	struct sock *sk = NULL;
 211
 212	/* If the socket is bound, send it in to PPP's input queue. Otherwise
 213	 * queue it on the session socket.
 214	 */
 215	rcu_read_lock();
 216	sk = rcu_dereference(ps->sk);
 217	if (!sk)
 218		goto no_sock;
 219
 220	/* If the first two bytes are 0xFF03, consider that it is the PPP's
 221	 * Address and Control fields and skip them. The L2TP module has always
 222	 * worked this way, although, in theory, the use of these fields should
 223	 * be negotiated and handled at the PPP layer. These fields are
 224	 * constant: 0xFF is the All-Stations Address and 0x03 the Unnumbered
 225	 * Information command with Poll/Final bit set to zero (RFC 1662).
 226	 */
 227	if (pskb_may_pull(skb, 2) && skb->data[0] == PPP_ALLSTATIONS &&
 228	    skb->data[1] == PPP_UI)
 229		skb_pull(skb, 2);
 230
 231	if (sk->sk_state & PPPOX_BOUND) {
 232		struct pppox_sock *po;
 233
 
 
 
 
 234		po = pppox_sk(sk);
 235		ppp_input(&po->chan, skb);
 236	} else {
 
 
 
 
 237		if (sock_queue_rcv_skb(sk, skb) < 0) {
 238			atomic_long_inc(&session->stats.rx_errors);
 239			kfree_skb(skb);
 240		}
 241	}
 242	rcu_read_unlock();
 243
 244	return;
 245
 246no_sock:
 247	rcu_read_unlock();
 248	pr_warn_ratelimited("%s: no socket in recv\n", session->name);
 249	kfree_skb(skb);
 250}
 251
 252/************************************************************************
 253 * Transmit handling
 254 ***********************************************************************/
 255
 256/* This is the sendmsg for the PPPoL2TP pppol2tp_session socket.  We come here
 257 * when a user application does a sendmsg() on the session socket. L2TP and
 258 * PPP headers must be inserted into the user's data.
 259 */
 260static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
 261			    size_t total_len)
 262{
 263	struct sock *sk = sock->sk;
 264	struct sk_buff *skb;
 265	int error;
 266	struct l2tp_session *session;
 267	struct l2tp_tunnel *tunnel;
 268	int uhlen;
 269
 270	error = -ENOTCONN;
 271	if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
 272		goto error;
 273
 274	/* Get session and tunnel contexts */
 275	error = -EBADF;
 276	session = pppol2tp_sock_to_session(sk);
 277	if (!session)
 278		goto error;
 279
 280	tunnel = session->tunnel;
 281
 282	uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
 283
 284	/* Allocate a socket buffer */
 285	error = -ENOMEM;
 286	skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) +
 287			   uhlen + session->hdr_len +
 288			   2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
 289			   0, GFP_KERNEL);
 290	if (!skb)
 291		goto error_put_sess;
 292
 293	/* Reserve space for headers. */
 294	skb_reserve(skb, NET_SKB_PAD);
 295	skb_reset_network_header(skb);
 296	skb_reserve(skb, sizeof(struct iphdr));
 297	skb_reset_transport_header(skb);
 298	skb_reserve(skb, uhlen);
 299
 300	/* Add PPP header */
 301	skb->data[0] = PPP_ALLSTATIONS;
 302	skb->data[1] = PPP_UI;
 303	skb_put(skb, 2);
 304
 305	/* Copy user data into skb */
 306	error = memcpy_from_msg(skb_put(skb, total_len), m, total_len);
 307	if (error < 0) {
 308		kfree_skb(skb);
 309		goto error_put_sess;
 310	}
 311
 312	local_bh_disable();
 313	l2tp_xmit_skb(session, skb);
 314	local_bh_enable();
 315
 316	l2tp_session_put(session);
 317
 318	return total_len;
 319
 320error_put_sess:
 321	l2tp_session_put(session);
 322error:
 323	return error;
 324}
 325
 326/* Transmit function called by generic PPP driver.  Sends PPP frame
 327 * over PPPoL2TP socket.
 328 *
 329 * This is almost the same as pppol2tp_sendmsg(), but rather than
 330 * being called with a msghdr from userspace, it is called with a skb
 331 * from the kernel.
 332 *
 333 * The supplied skb from ppp doesn't have enough headroom for the
 334 * insertion of L2TP, UDP and IP headers so we need to allocate more
 335 * headroom in the skb. This will create a cloned skb. But we must be
 336 * careful in the error case because the caller will expect to free
 337 * the skb it supplied, not our cloned skb. So we take care to always
 338 * leave the original skb unfreed if we return an error.
 339 */
 340static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
 341{
 342	struct sock *sk = (struct sock *)chan->private;
 343	struct l2tp_session *session;
 344	struct l2tp_tunnel *tunnel;
 345	int uhlen, headroom;
 346
 347	if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
 348		goto abort;
 349
 350	/* Get session and tunnel contexts from the socket */
 351	session = pppol2tp_sock_to_session(sk);
 352	if (!session)
 353		goto abort;
 354
 355	tunnel = session->tunnel;
 356
 357	uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
 358	headroom = NET_SKB_PAD +
 359		   sizeof(struct iphdr) + /* IP header */
 360		   uhlen +		/* UDP header (if L2TP_ENCAPTYPE_UDP) */
 361		   session->hdr_len +	/* L2TP header */
 362		   2;			/* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
 363	if (skb_cow_head(skb, headroom))
 364		goto abort_put_sess;
 365
 366	/* Setup PPP header */
 367	__skb_push(skb, 2);
 368	skb->data[0] = PPP_ALLSTATIONS;
 369	skb->data[1] = PPP_UI;
 370
 371	local_bh_disable();
 372	l2tp_xmit_skb(session, skb);
 373	local_bh_enable();
 374
 375	l2tp_session_put(session);
 376
 377	return 1;
 378
 379abort_put_sess:
 380	l2tp_session_put(session);
 381abort:
 382	/* Free the original skb */
 383	kfree_skb(skb);
 384	return 1;
 385}
 386
 387/*****************************************************************************
 388 * Session (and tunnel control) socket create/destroy.
 389 *****************************************************************************/
 390
 
 
 
 
 
 
 
 
 391/* Really kill the session socket. (Called from sock_put() if
 392 * refcnt == 0.)
 393 */
 394static void pppol2tp_session_destruct(struct sock *sk)
 395{
 
 
 396	skb_queue_purge(&sk->sk_receive_queue);
 397	skb_queue_purge(&sk->sk_write_queue);
 398}
 399
 400static void pppol2tp_session_close(struct l2tp_session *session)
 401{
 402	struct pppol2tp_session *ps;
 403
 404	ps = l2tp_session_priv(session);
 405	mutex_lock(&ps->sk_lock);
 406	ps->__sk = rcu_dereference_protected(ps->sk,
 407					     lockdep_is_held(&ps->sk_lock));
 408	RCU_INIT_POINTER(ps->sk, NULL);
 409	mutex_unlock(&ps->sk_lock);
 410	if (ps->__sk) {
 411		/* detach socket */
 412		rcu_assign_sk_user_data(ps->__sk, NULL);
 413		sock_put(ps->__sk);
 414
 415		/* drop ref taken when we referenced socket via sk_user_data */
 416		l2tp_session_put(session);
 417	}
 418}
 419
 420/* Called when the PPPoX socket (session) is closed.
 421 */
 422static int pppol2tp_release(struct socket *sock)
 423{
 424	struct sock *sk = sock->sk;
 425	struct l2tp_session *session;
 426	int error;
 427
 428	if (!sk)
 429		return 0;
 430
 431	error = -EBADF;
 432	lock_sock(sk);
 433	if (sock_flag(sk, SOCK_DEAD) != 0)
 434		goto error;
 435
 436	pppox_unbind_sock(sk);
 437
 438	/* Signal the death of the socket. */
 439	sk->sk_state = PPPOX_DEAD;
 440	sock_orphan(sk);
 441	sock->sk = NULL;
 442
 443	session = pppol2tp_sock_to_session(sk);
 444	if (session) {
 
 
 445		l2tp_session_delete(session);
 446		/* drop ref taken by pppol2tp_sock_to_session */
 447		l2tp_session_put(session);
 
 
 
 
 
 
 
 
 
 
 
 448	}
 449
 450	release_sock(sk);
 451
 
 
 
 
 452	sock_put(sk);
 453
 454	return 0;
 455
 456error:
 457	release_sock(sk);
 458	return error;
 459}
 460
 461static struct proto pppol2tp_sk_proto = {
 462	.name	  = "PPPOL2TP",
 463	.owner	  = THIS_MODULE,
 464	.obj_size = sizeof(struct pppox_sock),
 465};
 466
 467static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb)
 468{
 469	int rc;
 470
 471	rc = l2tp_udp_encap_recv(sk, skb);
 472	if (rc)
 473		kfree_skb(skb);
 474
 475	return NET_RX_SUCCESS;
 476}
 477
 478/* socket() handler. Initialize a new struct sock.
 479 */
 480static int pppol2tp_create(struct net *net, struct socket *sock, int kern)
 481{
 482	int error = -ENOMEM;
 483	struct sock *sk;
 484
 485	sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern);
 486	if (!sk)
 487		goto out;
 488
 489	sock_init_data(sock, sk);
 490	sock_set_flag(sk, SOCK_RCU_FREE);
 491
 492	sock->state  = SS_UNCONNECTED;
 493	sock->ops    = &pppol2tp_ops;
 494
 495	sk->sk_backlog_rcv = pppol2tp_backlog_recv;
 496	sk->sk_protocol	   = PX_PROTO_OL2TP;
 497	sk->sk_family	   = PF_PPPOX;
 498	sk->sk_state	   = PPPOX_NONE;
 499	sk->sk_type	   = SOCK_STREAM;
 500	sk->sk_destruct	   = pppol2tp_session_destruct;
 501
 502	error = 0;
 503
 504out:
 505	return error;
 506}
 507
 508static void pppol2tp_show(struct seq_file *m, void *arg)
 509{
 510	struct l2tp_session *session = arg;
 511	struct sock *sk;
 512
 513	sk = pppol2tp_session_get_sock(session);
 514	if (sk) {
 515		struct pppox_sock *po = pppox_sk(sk);
 516
 517		seq_printf(m, "   interface %s\n", ppp_dev_name(&po->chan));
 518		sock_put(sk);
 519	}
 520}
 521
 522static void pppol2tp_session_init(struct l2tp_session *session)
 523{
 524	struct pppol2tp_session *ps;
 525
 526	session->recv_skb = pppol2tp_recv;
 527	session->session_close = pppol2tp_session_close;
 528	if (IS_ENABLED(CONFIG_L2TP_DEBUGFS))
 529		session->show = pppol2tp_show;
 530
 531	ps = l2tp_session_priv(session);
 532	mutex_init(&ps->sk_lock);
 533	ps->owner = current->pid;
 534}
 535
 536struct l2tp_connect_info {
 537	u8 version;
 538	int fd;
 539	u32 tunnel_id;
 540	u32 peer_tunnel_id;
 541	u32 session_id;
 542	u32 peer_session_id;
 543};
 544
 545static int pppol2tp_sockaddr_get_info(const void *sa, int sa_len,
 546				      struct l2tp_connect_info *info)
 547{
 548	switch (sa_len) {
 549	case sizeof(struct sockaddr_pppol2tp):
 550	{
 551		const struct sockaddr_pppol2tp *sa_v2in4 = sa;
 552
 553		if (sa_v2in4->sa_protocol != PX_PROTO_OL2TP)
 554			return -EINVAL;
 555
 556		info->version = 2;
 557		info->fd = sa_v2in4->pppol2tp.fd;
 558		info->tunnel_id = sa_v2in4->pppol2tp.s_tunnel;
 559		info->peer_tunnel_id = sa_v2in4->pppol2tp.d_tunnel;
 560		info->session_id = sa_v2in4->pppol2tp.s_session;
 561		info->peer_session_id = sa_v2in4->pppol2tp.d_session;
 562
 563		break;
 564	}
 565	case sizeof(struct sockaddr_pppol2tpv3):
 566	{
 567		const struct sockaddr_pppol2tpv3 *sa_v3in4 = sa;
 568
 569		if (sa_v3in4->sa_protocol != PX_PROTO_OL2TP)
 570			return -EINVAL;
 571
 572		info->version = 3;
 573		info->fd = sa_v3in4->pppol2tp.fd;
 574		info->tunnel_id = sa_v3in4->pppol2tp.s_tunnel;
 575		info->peer_tunnel_id = sa_v3in4->pppol2tp.d_tunnel;
 576		info->session_id = sa_v3in4->pppol2tp.s_session;
 577		info->peer_session_id = sa_v3in4->pppol2tp.d_session;
 578
 579		break;
 580	}
 581	case sizeof(struct sockaddr_pppol2tpin6):
 582	{
 583		const struct sockaddr_pppol2tpin6 *sa_v2in6 = sa;
 584
 585		if (sa_v2in6->sa_protocol != PX_PROTO_OL2TP)
 586			return -EINVAL;
 587
 588		info->version = 2;
 589		info->fd = sa_v2in6->pppol2tp.fd;
 590		info->tunnel_id = sa_v2in6->pppol2tp.s_tunnel;
 591		info->peer_tunnel_id = sa_v2in6->pppol2tp.d_tunnel;
 592		info->session_id = sa_v2in6->pppol2tp.s_session;
 593		info->peer_session_id = sa_v2in6->pppol2tp.d_session;
 594
 595		break;
 596	}
 597	case sizeof(struct sockaddr_pppol2tpv3in6):
 598	{
 599		const struct sockaddr_pppol2tpv3in6 *sa_v3in6 = sa;
 600
 601		if (sa_v3in6->sa_protocol != PX_PROTO_OL2TP)
 602			return -EINVAL;
 603
 604		info->version = 3;
 605		info->fd = sa_v3in6->pppol2tp.fd;
 606		info->tunnel_id = sa_v3in6->pppol2tp.s_tunnel;
 607		info->peer_tunnel_id = sa_v3in6->pppol2tp.d_tunnel;
 608		info->session_id = sa_v3in6->pppol2tp.s_session;
 609		info->peer_session_id = sa_v3in6->pppol2tp.d_session;
 610
 611		break;
 612	}
 613	default:
 614		return -EINVAL;
 615	}
 616
 617	return 0;
 618}
 619
 620/* Rough estimation of the maximum payload size a tunnel can transmit without
 621 * fragmenting at the lower IP layer. Assumes L2TPv2 with sequence
 622 * numbers and no IP option. Not quite accurate, but the result is mostly
 623 * unused anyway.
 624 */
 625static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel)
 626{
 627	int mtu;
 628
 629	mtu = l2tp_tunnel_dst_mtu(tunnel);
 630	if (mtu <= PPPOL2TP_HEADER_OVERHEAD)
 631		return 1500 - PPPOL2TP_HEADER_OVERHEAD;
 632
 633	return mtu - PPPOL2TP_HEADER_OVERHEAD;
 634}
 635
 636static struct l2tp_tunnel *pppol2tp_tunnel_get(struct net *net,
 637					       const struct l2tp_connect_info *info,
 638					       bool *new_tunnel)
 639{
 640	struct l2tp_tunnel *tunnel;
 641	int error;
 642
 643	*new_tunnel = false;
 644
 645	tunnel = l2tp_tunnel_get(net, info->tunnel_id);
 646
 647	/* Special case: create tunnel context if session_id and
 648	 * peer_session_id is 0. Otherwise look up tunnel using supplied
 649	 * tunnel id.
 650	 */
 651	if (!info->session_id && !info->peer_session_id) {
 652		if (!tunnel) {
 653			struct l2tp_tunnel_cfg tcfg = {
 654				.encap = L2TP_ENCAPTYPE_UDP,
 655			};
 656
 657			/* Prevent l2tp_tunnel_register() from trying to set up
 658			 * a kernel socket.
 659			 */
 660			if (info->fd < 0)
 661				return ERR_PTR(-EBADF);
 662
 663			error = l2tp_tunnel_create(info->fd,
 664						   info->version,
 665						   info->tunnel_id,
 666						   info->peer_tunnel_id, &tcfg,
 667						   &tunnel);
 668			if (error < 0)
 669				return ERR_PTR(error);
 670
 671			refcount_inc(&tunnel->ref_count);
 672			error = l2tp_tunnel_register(tunnel, net, &tcfg);
 673			if (error < 0) {
 674				kfree(tunnel);
 675				return ERR_PTR(error);
 676			}
 677
 678			*new_tunnel = true;
 679		}
 680	} else {
 681		/* Error if we can't find the tunnel */
 682		if (!tunnel)
 683			return ERR_PTR(-ENOENT);
 684
 685		/* Error if socket is not prepped */
 686		if (!tunnel->sock) {
 687			l2tp_tunnel_put(tunnel);
 688			return ERR_PTR(-ENOENT);
 689		}
 690	}
 691
 692	return tunnel;
 693}
 694
 695/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
 696 */
 697static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
 698			    int sockaddr_len, int flags)
 699{
 700	struct sock *sk = sock->sk;
 701	struct pppox_sock *po = pppox_sk(sk);
 702	struct l2tp_session *session = NULL;
 703	struct l2tp_connect_info info;
 704	struct l2tp_tunnel *tunnel;
 705	struct pppol2tp_session *ps;
 706	struct l2tp_session_cfg cfg = { 0, };
 707	bool drop_refcnt = false;
 
 708	bool new_session = false;
 709	bool new_tunnel = false;
 710	int error;
 711
 712	error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info);
 713	if (error < 0)
 714		return error;
 715
 716	/* Don't bind if tunnel_id is 0 */
 717	if (!info.tunnel_id)
 718		return -EINVAL;
 719
 720	tunnel = pppol2tp_tunnel_get(sock_net(sk), &info, &new_tunnel);
 721	if (IS_ERR(tunnel))
 722		return PTR_ERR(tunnel);
 723
 724	lock_sock(sk);
 725
 726	/* Check for already bound sockets */
 727	error = -EBUSY;
 728	if (sk->sk_state & PPPOX_CONNECTED)
 729		goto end;
 730
 731	/* We don't supporting rebinding anyway */
 732	error = -EALREADY;
 733	if (sk->sk_user_data)
 734		goto end; /* socket is already attached */
 735
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 736	if (tunnel->peer_tunnel_id == 0)
 737		tunnel->peer_tunnel_id = info.peer_tunnel_id;
 738
 739	session = l2tp_session_get(sock_net(sk), tunnel->sock, tunnel->version,
 740				   info.tunnel_id, info.session_id);
 741	if (session) {
 742		drop_refcnt = true;
 743
 744		if (session->pwtype != L2TP_PWTYPE_PPP) {
 745			error = -EPROTOTYPE;
 746			goto end;
 747		}
 748
 749		ps = l2tp_session_priv(session);
 750
 751		/* Using a pre-existing session is fine as long as it hasn't
 752		 * been connected yet.
 753		 */
 754		mutex_lock(&ps->sk_lock);
 755		if (rcu_dereference_protected(ps->sk,
 756					      lockdep_is_held(&ps->sk_lock)) ||
 757		    ps->__sk) {
 758			mutex_unlock(&ps->sk_lock);
 759			error = -EEXIST;
 760			goto end;
 761		}
 762	} else {
 763		cfg.pw_type = L2TP_PWTYPE_PPP;
 764
 765		session = l2tp_session_create(sizeof(struct pppol2tp_session),
 766					      tunnel, info.session_id,
 767					      info.peer_session_id, &cfg);
 768		if (IS_ERR(session)) {
 769			error = PTR_ERR(session);
 770			goto end;
 771		}
 772
 773		drop_refcnt = true;
 774
 775		pppol2tp_session_init(session);
 776		ps = l2tp_session_priv(session);
 777		refcount_inc(&session->ref_count);
 778
 779		mutex_lock(&ps->sk_lock);
 780		error = l2tp_session_register(session, tunnel);
 781		if (error < 0) {
 782			mutex_unlock(&ps->sk_lock);
 783			l2tp_session_put(session);
 784			goto end;
 785		}
 786
 787		new_session = true;
 788	}
 789
 790	/* Special case: if source & dest session_id == 0x0000, this
 791	 * socket is being created to manage the tunnel. Just set up
 792	 * the internal context for use by ioctl() and sockopt()
 793	 * handlers.
 794	 */
 795	if (session->session_id == 0 && session->peer_session_id == 0) {
 796		error = 0;
 797		goto out_no_ppp;
 798	}
 799
 800	/* The only header we need to worry about is the L2TP
 801	 * header. This size is different depending on whether
 802	 * sequence numbers are enabled for the data channel.
 803	 */
 804	po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
 805
 806	po->chan.private = sk;
 807	po->chan.ops	 = &pppol2tp_chan_ops;
 808	po->chan.mtu	 = pppol2tp_tunnel_mtu(tunnel);
 809
 810	error = ppp_register_net_channel(sock_net(sk), &po->chan);
 811	if (error) {
 812		mutex_unlock(&ps->sk_lock);
 813		goto end;
 814	}
 815
 816out_no_ppp:
 817	/* This is how we get the session context from the socket. */
 818	sock_hold(sk);
 819	rcu_assign_sk_user_data(sk, session);
 820	rcu_assign_pointer(ps->sk, sk);
 821	mutex_unlock(&ps->sk_lock);
 822
 823	/* Keep the reference we've grabbed on the session: sk doesn't expect
 824	 * the session to disappear. pppol2tp_session_close() is responsible
 825	 * for dropping it.
 826	 */
 827	drop_refcnt = false;
 828
 829	sk->sk_state = PPPOX_CONNECTED;
 
 
 830
 831end:
 832	if (error) {
 833		if (new_session)
 834			l2tp_session_delete(session);
 835		if (new_tunnel)
 836			l2tp_tunnel_delete(tunnel);
 837	}
 838	if (drop_refcnt)
 839		l2tp_session_put(session);
 840	l2tp_tunnel_put(tunnel);
 
 841	release_sock(sk);
 842
 843	return error;
 844}
 845
 846#ifdef CONFIG_L2TP_V3
 847
 848/* Called when creating sessions via the netlink interface. */
 849static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel,
 850				   u32 session_id, u32 peer_session_id,
 851				   struct l2tp_session_cfg *cfg)
 852{
 853	int error;
 854	struct l2tp_session *session;
 855
 856	/* Error if tunnel socket is not prepped */
 857	if (!tunnel->sock) {
 858		error = -ENOENT;
 859		goto err;
 860	}
 861
 862	/* Allocate and initialize a new session context. */
 863	session = l2tp_session_create(sizeof(struct pppol2tp_session),
 864				      tunnel, session_id,
 865				      peer_session_id, cfg);
 866	if (IS_ERR(session)) {
 867		error = PTR_ERR(session);
 868		goto err;
 869	}
 870
 871	pppol2tp_session_init(session);
 872
 873	error = l2tp_session_register(session, tunnel);
 874	if (error < 0)
 875		goto err_sess;
 876
 877	return 0;
 878
 879err_sess:
 880	l2tp_session_put(session);
 881err:
 882	return error;
 883}
 884
 885#endif /* CONFIG_L2TP_V3 */
 886
 887/* getname() support.
 888 */
 889static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
 890			    int peer)
 891{
 892	int len = 0;
 893	int error = 0;
 894	struct l2tp_session *session;
 895	struct l2tp_tunnel *tunnel;
 896	struct sock *sk = sock->sk;
 897	struct inet_sock *inet;
 898	struct pppol2tp_session *pls;
 899
 900	error = -ENOTCONN;
 901	if (!sk)
 902		goto end;
 903	if (!(sk->sk_state & PPPOX_CONNECTED))
 904		goto end;
 905
 906	error = -EBADF;
 907	session = pppol2tp_sock_to_session(sk);
 908	if (!session)
 909		goto end;
 910
 911	pls = l2tp_session_priv(session);
 912	tunnel = session->tunnel;
 913
 914	inet = inet_sk(tunnel->sock);
 915	if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET) {
 916		struct sockaddr_pppol2tp sp;
 917
 918		len = sizeof(sp);
 919		memset(&sp, 0, len);
 920		sp.sa_family	= AF_PPPOX;
 921		sp.sa_protocol	= PX_PROTO_OL2TP;
 922		sp.pppol2tp.fd  = tunnel->fd;
 923		sp.pppol2tp.pid = pls->owner;
 924		sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
 925		sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
 926		sp.pppol2tp.s_session = session->session_id;
 927		sp.pppol2tp.d_session = session->peer_session_id;
 928		sp.pppol2tp.addr.sin_family = AF_INET;
 929		sp.pppol2tp.addr.sin_port = inet->inet_dport;
 930		sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
 931		memcpy(uaddr, &sp, len);
 932#if IS_ENABLED(CONFIG_IPV6)
 933	} else if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET6) {
 934		struct sockaddr_pppol2tpin6 sp;
 935
 936		len = sizeof(sp);
 937		memset(&sp, 0, len);
 938		sp.sa_family	= AF_PPPOX;
 939		sp.sa_protocol	= PX_PROTO_OL2TP;
 940		sp.pppol2tp.fd  = tunnel->fd;
 941		sp.pppol2tp.pid = pls->owner;
 942		sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
 943		sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
 944		sp.pppol2tp.s_session = session->session_id;
 945		sp.pppol2tp.d_session = session->peer_session_id;
 946		sp.pppol2tp.addr.sin6_family = AF_INET6;
 947		sp.pppol2tp.addr.sin6_port = inet->inet_dport;
 948		memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
 949		       sizeof(tunnel->sock->sk_v6_daddr));
 950		memcpy(uaddr, &sp, len);
 951	} else if (tunnel->version == 3 && tunnel->sock->sk_family == AF_INET6) {
 952		struct sockaddr_pppol2tpv3in6 sp;
 953
 954		len = sizeof(sp);
 955		memset(&sp, 0, len);
 956		sp.sa_family	= AF_PPPOX;
 957		sp.sa_protocol	= PX_PROTO_OL2TP;
 958		sp.pppol2tp.fd  = tunnel->fd;
 959		sp.pppol2tp.pid = pls->owner;
 960		sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
 961		sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
 962		sp.pppol2tp.s_session = session->session_id;
 963		sp.pppol2tp.d_session = session->peer_session_id;
 964		sp.pppol2tp.addr.sin6_family = AF_INET6;
 965		sp.pppol2tp.addr.sin6_port = inet->inet_dport;
 966		memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
 967		       sizeof(tunnel->sock->sk_v6_daddr));
 968		memcpy(uaddr, &sp, len);
 969#endif
 970	} else if (tunnel->version == 3) {
 971		struct sockaddr_pppol2tpv3 sp;
 972
 973		len = sizeof(sp);
 974		memset(&sp, 0, len);
 975		sp.sa_family	= AF_PPPOX;
 976		sp.sa_protocol	= PX_PROTO_OL2TP;
 977		sp.pppol2tp.fd  = tunnel->fd;
 978		sp.pppol2tp.pid = pls->owner;
 979		sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
 980		sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
 981		sp.pppol2tp.s_session = session->session_id;
 982		sp.pppol2tp.d_session = session->peer_session_id;
 983		sp.pppol2tp.addr.sin_family = AF_INET;
 984		sp.pppol2tp.addr.sin_port = inet->inet_dport;
 985		sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
 986		memcpy(uaddr, &sp, len);
 987	}
 988
 989	error = len;
 990
 991	l2tp_session_put(session);
 992end:
 993	return error;
 994}
 995
 996/****************************************************************************
 997 * ioctl() handlers.
 998 *
 999 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
1000 * sockets. However, in order to control kernel tunnel features, we allow
1001 * userspace to create a special "tunnel" PPPoX socket which is used for
1002 * control only.  Tunnel PPPoX sockets have session_id == 0 and simply allow
1003 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl()
1004 * calls.
1005 ****************************************************************************/
1006
1007static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest,
1008				const struct l2tp_stats *stats)
1009{
1010	memset(dest, 0, sizeof(*dest));
1011
1012	dest->tx_packets = atomic_long_read(&stats->tx_packets);
1013	dest->tx_bytes = atomic_long_read(&stats->tx_bytes);
1014	dest->tx_errors = atomic_long_read(&stats->tx_errors);
1015	dest->rx_packets = atomic_long_read(&stats->rx_packets);
1016	dest->rx_bytes = atomic_long_read(&stats->rx_bytes);
1017	dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards);
1018	dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets);
1019	dest->rx_errors = atomic_long_read(&stats->rx_errors);
1020}
1021
1022static int pppol2tp_tunnel_copy_stats(struct pppol2tp_ioc_stats *stats,
1023				      struct l2tp_tunnel *tunnel)
1024{
1025	struct l2tp_session *session;
1026
1027	if (!stats->session_id) {
1028		pppol2tp_copy_stats(stats, &tunnel->stats);
1029		return 0;
1030	}
1031
1032	/* If session_id is set, search the corresponding session in the
1033	 * context of this tunnel and record the session's statistics.
1034	 */
1035	session = l2tp_session_get(tunnel->l2tp_net, tunnel->sock, tunnel->version,
1036				   tunnel->tunnel_id, stats->session_id);
1037	if (!session)
1038		return -EBADR;
1039
1040	if (session->pwtype != L2TP_PWTYPE_PPP) {
1041		l2tp_session_put(session);
1042		return -EBADR;
1043	}
1044
1045	pppol2tp_copy_stats(stats, &session->stats);
1046	l2tp_session_put(session);
1047
1048	return 0;
1049}
1050
1051static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
1052			  unsigned long arg)
1053{
1054	struct pppol2tp_ioc_stats stats;
1055	struct l2tp_session *session;
1056
1057	switch (cmd) {
1058	case PPPIOCGMRU:
1059	case PPPIOCGFLAGS:
1060		session = sock->sk->sk_user_data;
1061		if (!session)
1062			return -ENOTCONN;
1063
1064		if (WARN_ON(session->magic != L2TP_SESSION_MAGIC))
1065			return -EBADF;
1066
1067		/* Not defined for tunnels */
1068		if (!session->session_id && !session->peer_session_id)
1069			return -ENOSYS;
1070
1071		if (put_user(0, (int __user *)arg))
1072			return -EFAULT;
1073		break;
1074
1075	case PPPIOCSMRU:
1076	case PPPIOCSFLAGS:
1077		session = sock->sk->sk_user_data;
1078		if (!session)
1079			return -ENOTCONN;
1080
1081		if (WARN_ON(session->magic != L2TP_SESSION_MAGIC))
1082			return -EBADF;
1083
1084		/* Not defined for tunnels */
1085		if (!session->session_id && !session->peer_session_id)
1086			return -ENOSYS;
1087
1088		if (!access_ok((int __user *)arg, sizeof(int)))
1089			return -EFAULT;
1090		break;
1091
1092	case PPPIOCGL2TPSTATS:
1093		session = sock->sk->sk_user_data;
1094		if (!session)
1095			return -ENOTCONN;
1096
1097		if (WARN_ON(session->magic != L2TP_SESSION_MAGIC))
1098			return -EBADF;
1099
1100		/* Session 0 represents the parent tunnel */
1101		if (!session->session_id && !session->peer_session_id) {
1102			u32 session_id;
1103			int err;
1104
1105			if (copy_from_user(&stats, (void __user *)arg,
1106					   sizeof(stats)))
1107				return -EFAULT;
1108
1109			session_id = stats.session_id;
1110			err = pppol2tp_tunnel_copy_stats(&stats,
1111							 session->tunnel);
1112			if (err < 0)
1113				return err;
1114
1115			stats.session_id = session_id;
1116		} else {
1117			pppol2tp_copy_stats(&stats, &session->stats);
1118			stats.session_id = session->session_id;
1119		}
1120		stats.tunnel_id = session->tunnel->tunnel_id;
1121		stats.using_ipsec = l2tp_tunnel_uses_xfrm(session->tunnel);
1122
1123		if (copy_to_user((void __user *)arg, &stats, sizeof(stats)))
1124			return -EFAULT;
1125		break;
1126
1127	default:
1128		return -ENOIOCTLCMD;
1129	}
1130
1131	return 0;
1132}
1133
1134/*****************************************************************************
1135 * setsockopt() / getsockopt() support.
1136 *
1137 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
1138 * sockets. In order to control kernel tunnel features, we allow userspace to
1139 * create a special "tunnel" PPPoX socket which is used for control only.
1140 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user
1141 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls.
1142 *****************************************************************************/
1143
1144/* Tunnel setsockopt() helper.
1145 */
1146static int pppol2tp_tunnel_setsockopt(struct sock *sk,
1147				      struct l2tp_tunnel *tunnel,
1148				      int optname, int val)
1149{
1150	int err = 0;
1151
1152	switch (optname) {
1153	case PPPOL2TP_SO_DEBUG:
1154		/* Tunnel debug flags option is deprecated */
 
 
1155		break;
1156
1157	default:
1158		err = -ENOPROTOOPT;
1159		break;
1160	}
1161
1162	return err;
1163}
1164
1165/* Session setsockopt helper.
1166 */
1167static int pppol2tp_session_setsockopt(struct sock *sk,
1168				       struct l2tp_session *session,
1169				       int optname, int val)
1170{
1171	int err = 0;
1172
1173	switch (optname) {
1174	case PPPOL2TP_SO_RECVSEQ:
1175		if (val != 0 && val != 1) {
1176			err = -EINVAL;
1177			break;
1178		}
1179		session->recv_seq = !!val;
 
 
 
1180		break;
1181
1182	case PPPOL2TP_SO_SENDSEQ:
1183		if (val != 0 && val != 1) {
1184			err = -EINVAL;
1185			break;
1186		}
1187		session->send_seq = !!val;
1188		{
1189			struct pppox_sock *po = pppox_sk(sk);
1190
1191			po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
1192				PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
1193		}
1194		l2tp_session_set_header_len(session, session->tunnel->version,
1195					    session->tunnel->encap);
 
 
1196		break;
1197
1198	case PPPOL2TP_SO_LNSMODE:
1199		if (val != 0 && val != 1) {
1200			err = -EINVAL;
1201			break;
1202		}
1203		session->lns_mode = !!val;
 
 
 
1204		break;
1205
1206	case PPPOL2TP_SO_DEBUG:
1207		/* Session debug flags option is deprecated */
 
 
1208		break;
1209
1210	case PPPOL2TP_SO_REORDERTO:
1211		session->reorder_timeout = msecs_to_jiffies(val);
 
 
 
1212		break;
1213
1214	default:
1215		err = -ENOPROTOOPT;
1216		break;
1217	}
1218
1219	return err;
1220}
1221
1222/* Main setsockopt() entry point.
1223 * Does API checks, then calls either the tunnel or session setsockopt
1224 * handler, according to whether the PPPoL2TP socket is a for a regular
1225 * session or the special tunnel type.
1226 */
1227static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
1228			       sockptr_t optval, unsigned int optlen)
1229{
1230	struct sock *sk = sock->sk;
1231	struct l2tp_session *session;
1232	struct l2tp_tunnel *tunnel;
1233	int val;
1234	int err;
1235
1236	if (level != SOL_PPPOL2TP)
1237		return -EINVAL;
1238
1239	if (optlen < sizeof(int))
1240		return -EINVAL;
1241
1242	if (copy_from_sockptr(&val, optval, sizeof(int)))
1243		return -EFAULT;
1244
1245	err = -ENOTCONN;
1246	if (!sk->sk_user_data)
1247		goto end;
1248
1249	/* Get session context from the socket */
1250	err = -EBADF;
1251	session = pppol2tp_sock_to_session(sk);
1252	if (!session)
1253		goto end;
1254
1255	/* Special case: if session_id == 0x0000, treat as operation on tunnel
1256	 */
1257	if (session->session_id == 0 && session->peer_session_id == 0) {
1258		tunnel = session->tunnel;
1259		err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
1260	} else {
1261		err = pppol2tp_session_setsockopt(sk, session, optname, val);
1262	}
1263
1264	l2tp_session_put(session);
1265end:
1266	return err;
1267}
1268
1269/* Tunnel getsockopt helper. Called with sock locked.
1270 */
1271static int pppol2tp_tunnel_getsockopt(struct sock *sk,
1272				      struct l2tp_tunnel *tunnel,
1273				      int optname, int *val)
1274{
1275	int err = 0;
1276
1277	switch (optname) {
1278	case PPPOL2TP_SO_DEBUG:
1279		/* Tunnel debug flags option is deprecated */
1280		*val = 0;
 
1281		break;
1282
1283	default:
1284		err = -ENOPROTOOPT;
1285		break;
1286	}
1287
1288	return err;
1289}
1290
1291/* Session getsockopt helper. Called with sock locked.
1292 */
1293static int pppol2tp_session_getsockopt(struct sock *sk,
1294				       struct l2tp_session *session,
1295				       int optname, int *val)
1296{
1297	int err = 0;
1298
1299	switch (optname) {
1300	case PPPOL2TP_SO_RECVSEQ:
1301		*val = session->recv_seq;
 
 
1302		break;
1303
1304	case PPPOL2TP_SO_SENDSEQ:
1305		*val = session->send_seq;
 
 
1306		break;
1307
1308	case PPPOL2TP_SO_LNSMODE:
1309		*val = session->lns_mode;
 
 
1310		break;
1311
1312	case PPPOL2TP_SO_DEBUG:
1313		/* Session debug flags option is deprecated */
1314		*val = 0;
 
1315		break;
1316
1317	case PPPOL2TP_SO_REORDERTO:
1318		*val = (int)jiffies_to_msecs(session->reorder_timeout);
 
 
1319		break;
1320
1321	default:
1322		err = -ENOPROTOOPT;
1323	}
1324
1325	return err;
1326}
1327
1328/* Main getsockopt() entry point.
1329 * Does API checks, then calls either the tunnel or session getsockopt
1330 * handler, according to whether the PPPoX socket is a for a regular session
1331 * or the special tunnel type.
1332 */
1333static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
1334			       char __user *optval, int __user *optlen)
1335{
1336	struct sock *sk = sock->sk;
1337	struct l2tp_session *session;
1338	struct l2tp_tunnel *tunnel;
1339	int val, len;
1340	int err;
1341
1342	if (level != SOL_PPPOL2TP)
1343		return -EINVAL;
1344
1345	if (get_user(len, optlen))
1346		return -EFAULT;
1347
 
 
1348	if (len < 0)
1349		return -EINVAL;
1350
1351	len = min_t(unsigned int, len, sizeof(int));
1352
1353	err = -ENOTCONN;
1354	if (!sk->sk_user_data)
1355		goto end;
1356
1357	/* Get the session context */
1358	err = -EBADF;
1359	session = pppol2tp_sock_to_session(sk);
1360	if (!session)
1361		goto end;
1362
1363	/* Special case: if session_id == 0x0000, treat as operation on tunnel */
1364	if (session->session_id == 0 && session->peer_session_id == 0) {
1365		tunnel = session->tunnel;
1366		err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
1367		if (err)
1368			goto end_put_sess;
1369	} else {
1370		err = pppol2tp_session_getsockopt(sk, session, optname, &val);
1371		if (err)
1372			goto end_put_sess;
1373	}
1374
1375	err = -EFAULT;
1376	if (put_user(len, optlen))
1377		goto end_put_sess;
1378
1379	if (copy_to_user((void __user *)optval, &val, len))
1380		goto end_put_sess;
1381
1382	err = 0;
1383
1384end_put_sess:
1385	l2tp_session_put(session);
1386end:
1387	return err;
1388}
1389
1390/*****************************************************************************
1391 * /proc filesystem for debug
1392 * Since the original pppol2tp driver provided /proc/net/pppol2tp for
1393 * L2TPv2, we dump only L2TPv2 tunnels and sessions here.
1394 *****************************************************************************/
1395
 
 
1396#ifdef CONFIG_PROC_FS
1397
1398struct pppol2tp_seq_data {
1399	struct seq_net_private p;
1400	unsigned long tkey;		/* lookup key of current tunnel */
1401	unsigned long skey;		/* lookup key of current session */
1402	struct l2tp_tunnel *tunnel;
1403	struct l2tp_session *session;	/* NULL means get next tunnel */
1404};
1405
1406static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
1407{
1408	/* Drop reference taken during previous invocation */
1409	if (pd->tunnel)
1410		l2tp_tunnel_put(pd->tunnel);
1411
1412	for (;;) {
1413		pd->tunnel = l2tp_tunnel_get_next(net, &pd->tkey);
1414		pd->tkey++;
1415
1416		/* Only accept L2TPv2 tunnels */
1417		if (!pd->tunnel || pd->tunnel->version == 2)
1418			return;
1419
1420		l2tp_tunnel_put(pd->tunnel);
1421	}
1422}
1423
1424static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
1425{
1426	/* Drop reference taken during previous invocation */
1427	if (pd->session)
1428		l2tp_session_put(pd->session);
1429
1430	pd->session = l2tp_session_get_next(net, pd->tunnel->sock,
1431					    pd->tunnel->version,
1432					    pd->tunnel->tunnel_id, &pd->skey);
1433	pd->skey++;
1434
1435	if (!pd->session) {
1436		pd->skey = 0;
1437		pppol2tp_next_tunnel(net, pd);
1438	}
1439}
1440
1441static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs)
1442{
1443	struct pppol2tp_seq_data *pd = SEQ_START_TOKEN;
1444	loff_t pos = *offs;
1445	struct net *net;
1446
1447	if (!pos)
1448		goto out;
1449
1450	if (WARN_ON(!m->private)) {
1451		pd = NULL;
1452		goto out;
1453	}
1454
1455	pd = m->private;
1456	net = seq_file_net(m);
1457
1458	if (!pd->tunnel)
1459		pppol2tp_next_tunnel(net, pd);
1460	else
1461		pppol2tp_next_session(net, pd);
1462
1463	/* NULL tunnel and session indicates end of list */
1464	if (!pd->tunnel && !pd->session)
1465		pd = NULL;
1466
1467out:
1468	return pd;
1469}
1470
1471static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos)
1472{
1473	(*pos)++;
1474	return NULL;
1475}
1476
1477static void pppol2tp_seq_stop(struct seq_file *p, void *v)
1478{
1479	struct pppol2tp_seq_data *pd = v;
1480
1481	if (!pd || pd == SEQ_START_TOKEN)
1482		return;
1483
1484	/* Drop reference taken by last invocation of pppol2tp_next_session()
1485	 * or pppol2tp_next_tunnel().
1486	 */
1487	if (pd->session) {
1488		l2tp_session_put(pd->session);
1489		pd->session = NULL;
1490	}
1491	if (pd->tunnel) {
1492		l2tp_tunnel_put(pd->tunnel);
1493		pd->tunnel = NULL;
1494	}
1495}
1496
1497static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
1498{
1499	struct l2tp_tunnel *tunnel = v;
1500
1501	seq_printf(m, "\nTUNNEL '%s', %c %d\n",
1502		   tunnel->name,
1503		   tunnel->sock ? 'Y' : 'N',
1504		   refcount_read(&tunnel->ref_count) - 1);
1505	seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n",
1506		   0,
1507		   atomic_long_read(&tunnel->stats.tx_packets),
1508		   atomic_long_read(&tunnel->stats.tx_bytes),
1509		   atomic_long_read(&tunnel->stats.tx_errors),
1510		   atomic_long_read(&tunnel->stats.rx_packets),
1511		   atomic_long_read(&tunnel->stats.rx_bytes),
1512		   atomic_long_read(&tunnel->stats.rx_errors));
1513}
1514
1515static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
1516{
1517	struct l2tp_session *session = v;
1518	struct l2tp_tunnel *tunnel = session->tunnel;
1519	unsigned char state;
1520	char user_data_ok;
1521	struct sock *sk;
1522	u32 ip = 0;
1523	u16 port = 0;
1524
1525	if (tunnel->sock) {
1526		struct inet_sock *inet = inet_sk(tunnel->sock);
1527
1528		ip = ntohl(inet->inet_saddr);
1529		port = ntohs(inet->inet_sport);
1530	}
1531
1532	sk = pppol2tp_session_get_sock(session);
1533	if (sk) {
1534		state = sk->sk_state;
1535		user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N';
1536	} else {
1537		state = 0;
1538		user_data_ok = 'N';
1539	}
1540
1541	seq_printf(m, "  SESSION '%s' %08X/%d %04X/%04X -> %04X/%04X %d %c\n",
1542		   session->name, ip, port,
1543		   tunnel->tunnel_id,
1544		   session->session_id,
1545		   tunnel->peer_tunnel_id,
1546		   session->peer_session_id,
1547		   state, user_data_ok);
1548	seq_printf(m, "   0/0/%c/%c/%s %08x %u\n",
1549		   session->recv_seq ? 'R' : '-',
1550		   session->send_seq ? 'S' : '-',
1551		   session->lns_mode ? "LNS" : "LAC",
1552		   0,
1553		   jiffies_to_msecs(session->reorder_timeout));
1554	seq_printf(m, "   %u/%u %ld/%ld/%ld %ld/%ld/%ld\n",
1555		   session->nr, session->ns,
1556		   atomic_long_read(&session->stats.tx_packets),
1557		   atomic_long_read(&session->stats.tx_bytes),
1558		   atomic_long_read(&session->stats.tx_errors),
1559		   atomic_long_read(&session->stats.rx_packets),
1560		   atomic_long_read(&session->stats.rx_bytes),
1561		   atomic_long_read(&session->stats.rx_errors));
1562
1563	if (sk) {
1564		struct pppox_sock *po = pppox_sk(sk);
1565
1566		seq_printf(m, "   interface %s\n", ppp_dev_name(&po->chan));
1567		sock_put(sk);
1568	}
1569}
1570
1571static int pppol2tp_seq_show(struct seq_file *m, void *v)
1572{
1573	struct pppol2tp_seq_data *pd = v;
1574
1575	/* display header on line 1 */
1576	if (v == SEQ_START_TOKEN) {
1577		seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n");
1578		seq_puts(m, "TUNNEL name, user-data-ok session-count\n");
1579		seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1580		seq_puts(m, "  SESSION name, addr/port src-tid/sid dest-tid/sid state user-data-ok\n");
1581		seq_puts(m, "   mtu/mru/rcvseq/sendseq/lns debug reorderto\n");
1582		seq_puts(m, "   nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1583		goto out;
1584	}
1585
1586	if (!pd->session)
1587		pppol2tp_seq_tunnel_show(m, pd->tunnel);
1588	else
1589		pppol2tp_seq_session_show(m, pd->session);
1590
1591out:
1592	return 0;
1593}
1594
1595static const struct seq_operations pppol2tp_seq_ops = {
1596	.start		= pppol2tp_seq_start,
1597	.next		= pppol2tp_seq_next,
1598	.stop		= pppol2tp_seq_stop,
1599	.show		= pppol2tp_seq_show,
1600};
1601#endif /* CONFIG_PROC_FS */
1602
1603/*****************************************************************************
1604 * Network namespace
1605 *****************************************************************************/
1606
1607static __net_init int pppol2tp_init_net(struct net *net)
1608{
1609	struct proc_dir_entry *pde;
1610	int err = 0;
1611
1612	pde = proc_create_net("pppol2tp", 0444, net->proc_net,
1613			      &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data));
1614	if (!pde) {
1615		err = -ENOMEM;
1616		goto out;
1617	}
1618
1619out:
1620	return err;
1621}
1622
1623static __net_exit void pppol2tp_exit_net(struct net *net)
1624{
1625	remove_proc_entry("pppol2tp", net->proc_net);
1626}
1627
1628static struct pernet_operations pppol2tp_net_ops = {
1629	.init = pppol2tp_init_net,
1630	.exit = pppol2tp_exit_net,
 
1631};
1632
1633/*****************************************************************************
1634 * Init and cleanup
1635 *****************************************************************************/
1636
1637static const struct proto_ops pppol2tp_ops = {
1638	.family		= AF_PPPOX,
1639	.owner		= THIS_MODULE,
1640	.release	= pppol2tp_release,
1641	.bind		= sock_no_bind,
1642	.connect	= pppol2tp_connect,
1643	.socketpair	= sock_no_socketpair,
1644	.accept		= sock_no_accept,
1645	.getname	= pppol2tp_getname,
1646	.poll		= datagram_poll,
1647	.listen		= sock_no_listen,
1648	.shutdown	= sock_no_shutdown,
1649	.setsockopt	= pppol2tp_setsockopt,
1650	.getsockopt	= pppol2tp_getsockopt,
1651	.sendmsg	= pppol2tp_sendmsg,
1652	.recvmsg	= pppol2tp_recvmsg,
1653	.mmap		= sock_no_mmap,
1654	.ioctl		= pppox_ioctl,
1655#ifdef CONFIG_COMPAT
1656	.compat_ioctl = pppox_compat_ioctl,
1657#endif
1658};
1659
1660static const struct pppox_proto pppol2tp_proto = {
1661	.create		= pppol2tp_create,
1662	.ioctl		= pppol2tp_ioctl,
1663	.owner		= THIS_MODULE,
1664};
1665
1666#ifdef CONFIG_L2TP_V3
1667
1668static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = {
1669	.session_create	= pppol2tp_session_create,
1670	.session_delete	= l2tp_session_delete,
1671};
1672
1673#endif /* CONFIG_L2TP_V3 */
1674
1675static int __init pppol2tp_init(void)
1676{
1677	int err;
1678
1679	err = register_pernet_device(&pppol2tp_net_ops);
1680	if (err)
1681		goto out;
1682
1683	err = proto_register(&pppol2tp_sk_proto, 0);
1684	if (err)
1685		goto out_unregister_pppol2tp_pernet;
1686
1687	err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto);
1688	if (err)
1689		goto out_unregister_pppol2tp_proto;
1690
1691#ifdef CONFIG_L2TP_V3
1692	err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops);
1693	if (err)
1694		goto out_unregister_pppox;
1695#endif
1696
1697	pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION);
1698
1699out:
1700	return err;
1701
1702#ifdef CONFIG_L2TP_V3
1703out_unregister_pppox:
1704	unregister_pppox_proto(PX_PROTO_OL2TP);
1705#endif
1706out_unregister_pppol2tp_proto:
1707	proto_unregister(&pppol2tp_sk_proto);
1708out_unregister_pppol2tp_pernet:
1709	unregister_pernet_device(&pppol2tp_net_ops);
1710	goto out;
1711}
1712
1713static void __exit pppol2tp_exit(void)
1714{
1715#ifdef CONFIG_L2TP_V3
1716	l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP);
1717#endif
1718	unregister_pppox_proto(PX_PROTO_OL2TP);
1719	proto_unregister(&pppol2tp_sk_proto);
1720	unregister_pernet_device(&pppol2tp_net_ops);
1721}
1722
1723module_init(pppol2tp_init);
1724module_exit(pppol2tp_exit);
1725
1726MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1727MODULE_DESCRIPTION("PPP over L2TP over UDP");
1728MODULE_LICENSE("GPL");
1729MODULE_VERSION(PPPOL2TP_DRV_VERSION);
1730MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP);
1731MODULE_ALIAS_L2TP_PWTYPE(7);