4 * Copyright (c) 2008,2009,2010 Katalix Systems Ltd
6 * This file contains some code of the original L2TPv2 pppol2tp
7 * driver, which has the following copyright:
9 * Authors: Martijn van Oosterhout <kleptog@svana.org>
10 * James Chapman (jchapman@katalix.com)
12 * Michal Ostrowski <mostrows@speakeasy.net>
13 * Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
14 * David S. Miller (davem@redhat.com)
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2 as
18 * published by the Free Software Foundation.
21 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
23 #include <linux/module.h>
24 #include <linux/string.h>
25 #include <linux/list.h>
26 #include <linux/rculist.h>
27 #include <linux/uaccess.h>
29 #include <linux/kernel.h>
30 #include <linux/spinlock.h>
31 #include <linux/kthread.h>
32 #include <linux/sched.h>
33 #include <linux/slab.h>
34 #include <linux/errno.h>
35 #include <linux/jiffies.h>
37 #include <linux/netdevice.h>
38 #include <linux/net.h>
39 #include <linux/inetdevice.h>
40 #include <linux/skbuff.h>
41 #include <linux/init.h>
44 #include <linux/udp.h>
45 #include <linux/l2tp.h>
46 #include <linux/hash.h>
47 #include <linux/sort.h>
48 #include <linux/file.h>
49 #include <linux/nsproxy.h>
50 #include <net/net_namespace.h>
51 #include <net/netns/generic.h>
55 #include <net/udp_tunnel.h>
56 #include <net/inet_common.h>
58 #include <net/protocol.h>
59 #include <net/inet6_connection_sock.h>
60 #include <net/inet_ecn.h>
61 #include <net/ip6_route.h>
62 #include <net/ip6_checksum.h>
64 #include <asm/byteorder.h>
65 #include <linux/atomic.h>
67 #include "l2tp_core.h"
69 #define L2TP_DRV_VERSION "V2.0"
71 /* L2TP header constants */
72 #define L2TP_HDRFLAG_T 0x8000
73 #define L2TP_HDRFLAG_L 0x4000
74 #define L2TP_HDRFLAG_S 0x0800
75 #define L2TP_HDRFLAG_O 0x0200
76 #define L2TP_HDRFLAG_P 0x0100
78 #define L2TP_HDR_VER_MASK 0x000F
79 #define L2TP_HDR_VER_2 0x0002
80 #define L2TP_HDR_VER_3 0x0003
82 /* L2TPv3 default L2-specific sublayer */
83 #define L2TP_SLFLAG_S 0x40000000
84 #define L2TP_SL_SEQ_MASK 0x00ffffff
86 #define L2TP_HDR_SIZE_SEQ 10
87 #define L2TP_HDR_SIZE_NOSEQ 6
89 /* Default trace flags */
90 #define L2TP_DEFAULT_DEBUG_FLAGS 0
92 /* Private data stored for received packets in the skb.
98 unsigned long expires
;
101 #define L2TP_SKB_CB(skb) ((struct l2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])
103 static atomic_t l2tp_tunnel_count
;
104 static atomic_t l2tp_session_count
;
105 static struct workqueue_struct
*l2tp_wq
;
107 /* per-net private data for this module */
108 static unsigned int l2tp_net_id
;
110 struct list_head l2tp_tunnel_list
;
111 spinlock_t l2tp_tunnel_list_lock
;
112 struct hlist_head l2tp_session_hlist
[L2TP_HASH_SIZE_2
];
113 spinlock_t l2tp_session_hlist_lock
;
117 static inline struct l2tp_tunnel
*l2tp_tunnel(struct sock
*sk
)
119 return sk
->sk_user_data
;
122 static inline struct l2tp_net
*l2tp_pernet(const struct net
*net
)
126 return net_generic(net
, l2tp_net_id
);
129 /* Session hash global list for L2TPv3.
130 * The session_id SHOULD be random according to RFC3931, but several
131 * L2TP implementations use incrementing session_ids. So we do a real
132 * hash on the session_id, rather than a simple bitmask.
134 static inline struct hlist_head
*
135 l2tp_session_id_hash_2(struct l2tp_net
*pn
, u32 session_id
)
137 return &pn
->l2tp_session_hlist
[hash_32(session_id
, L2TP_HASH_BITS_2
)];
141 /* Lookup the tunnel socket, possibly involving the fs code if the socket is
142 * owned by userspace. A struct sock returned from this function must be
143 * released using l2tp_tunnel_sock_put once you're done with it.
145 static struct sock
*l2tp_tunnel_sock_lookup(struct l2tp_tunnel
*tunnel
)
148 struct socket
*sock
= NULL
;
149 struct sock
*sk
= NULL
;
154 if (tunnel
->fd
>= 0) {
155 /* Socket is owned by userspace, who might be in the process
156 * of closing it. Look the socket up using the fd to ensure
159 sock
= sockfd_lookup(tunnel
->fd
, &err
);
163 /* Socket is owned by kernelspace */
172 /* Drop a reference to a tunnel socket obtained via. l2tp_tunnel_sock_put */
173 static void l2tp_tunnel_sock_put(struct sock
*sk
)
175 struct l2tp_tunnel
*tunnel
= l2tp_sock_to_tunnel(sk
);
177 if (tunnel
->fd
>= 0) {
178 /* Socket is owned by userspace */
179 sockfd_put(sk
->sk_socket
);
186 /* Session hash list.
187 * The session_id SHOULD be random according to RFC2661, but several
188 * L2TP implementations (Cisco and Microsoft) use incrementing
189 * session_ids. So we do a real hash on the session_id, rather than a
192 static inline struct hlist_head
*
193 l2tp_session_id_hash(struct l2tp_tunnel
*tunnel
, u32 session_id
)
195 return &tunnel
->session_hlist
[hash_32(session_id
, L2TP_HASH_BITS
)];
198 /* Lookup a tunnel. A new reference is held on the returned tunnel. */
199 struct l2tp_tunnel
*l2tp_tunnel_get(const struct net
*net
, u32 tunnel_id
)
201 const struct l2tp_net
*pn
= l2tp_pernet(net
);
202 struct l2tp_tunnel
*tunnel
;
205 list_for_each_entry_rcu(tunnel
, &pn
->l2tp_tunnel_list
, list
) {
206 if (tunnel
->tunnel_id
== tunnel_id
) {
207 l2tp_tunnel_inc_refcount(tunnel
);
208 rcu_read_unlock_bh();
213 rcu_read_unlock_bh();
217 EXPORT_SYMBOL_GPL(l2tp_tunnel_get
);
219 /* Lookup a session. A new reference is held on the returned session.
220 * Optionally calls session->ref() too if do_ref is true.
222 struct l2tp_session
*l2tp_session_get(const struct net
*net
,
223 struct l2tp_tunnel
*tunnel
,
224 u32 session_id
, bool do_ref
)
226 struct hlist_head
*session_list
;
227 struct l2tp_session
*session
;
230 struct l2tp_net
*pn
= l2tp_pernet(net
);
232 session_list
= l2tp_session_id_hash_2(pn
, session_id
);
235 hlist_for_each_entry_rcu(session
, session_list
, global_hlist
) {
236 if (session
->session_id
== session_id
) {
237 l2tp_session_inc_refcount(session
);
238 if (do_ref
&& session
->ref
)
239 session
->ref(session
);
240 rcu_read_unlock_bh();
245 rcu_read_unlock_bh();
250 session_list
= l2tp_session_id_hash(tunnel
, session_id
);
251 read_lock_bh(&tunnel
->hlist_lock
);
252 hlist_for_each_entry(session
, session_list
, hlist
) {
253 if (session
->session_id
== session_id
) {
254 l2tp_session_inc_refcount(session
);
255 if (do_ref
&& session
->ref
)
256 session
->ref(session
);
257 read_unlock_bh(&tunnel
->hlist_lock
);
262 read_unlock_bh(&tunnel
->hlist_lock
);
266 EXPORT_SYMBOL_GPL(l2tp_session_get
);
268 struct l2tp_session
*l2tp_session_get_nth(struct l2tp_tunnel
*tunnel
, int nth
,
272 struct l2tp_session
*session
;
275 read_lock_bh(&tunnel
->hlist_lock
);
276 for (hash
= 0; hash
< L2TP_HASH_SIZE
; hash
++) {
277 hlist_for_each_entry(session
, &tunnel
->session_hlist
[hash
], hlist
) {
279 l2tp_session_inc_refcount(session
);
280 if (do_ref
&& session
->ref
)
281 session
->ref(session
);
282 read_unlock_bh(&tunnel
->hlist_lock
);
288 read_unlock_bh(&tunnel
->hlist_lock
);
292 EXPORT_SYMBOL_GPL(l2tp_session_get_nth
);
294 /* Lookup a session by interface name.
295 * This is very inefficient but is only used by management interfaces.
297 struct l2tp_session
*l2tp_session_get_by_ifname(const struct net
*net
,
301 struct l2tp_net
*pn
= l2tp_pernet(net
);
303 struct l2tp_session
*session
;
306 for (hash
= 0; hash
< L2TP_HASH_SIZE_2
; hash
++) {
307 hlist_for_each_entry_rcu(session
, &pn
->l2tp_session_hlist
[hash
], global_hlist
) {
308 if (!strcmp(session
->ifname
, ifname
)) {
309 l2tp_session_inc_refcount(session
);
310 if (do_ref
&& session
->ref
)
311 session
->ref(session
);
312 rcu_read_unlock_bh();
319 rcu_read_unlock_bh();
323 EXPORT_SYMBOL_GPL(l2tp_session_get_by_ifname
);
325 static int l2tp_session_add_to_tunnel(struct l2tp_tunnel
*tunnel
,
326 struct l2tp_session
*session
)
328 struct l2tp_session
*session_walk
;
329 struct hlist_head
*g_head
;
330 struct hlist_head
*head
;
334 head
= l2tp_session_id_hash(tunnel
, session
->session_id
);
336 write_lock_bh(&tunnel
->hlist_lock
);
337 if (!tunnel
->acpt_newsess
) {
342 hlist_for_each_entry(session_walk
, head
, hlist
)
343 if (session_walk
->session_id
== session
->session_id
) {
348 if (tunnel
->version
== L2TP_HDR_VER_3
) {
349 pn
= l2tp_pernet(tunnel
->l2tp_net
);
350 g_head
= l2tp_session_id_hash_2(l2tp_pernet(tunnel
->l2tp_net
),
351 session
->session_id
);
353 spin_lock_bh(&pn
->l2tp_session_hlist_lock
);
355 hlist_for_each_entry(session_walk
, g_head
, global_hlist
)
356 if (session_walk
->session_id
== session
->session_id
) {
358 goto err_tlock_pnlock
;
361 l2tp_tunnel_inc_refcount(tunnel
);
362 sock_hold(tunnel
->sock
);
363 hlist_add_head_rcu(&session
->global_hlist
, g_head
);
365 spin_unlock_bh(&pn
->l2tp_session_hlist_lock
);
367 l2tp_tunnel_inc_refcount(tunnel
);
368 sock_hold(tunnel
->sock
);
371 hlist_add_head(&session
->hlist
, head
);
372 write_unlock_bh(&tunnel
->hlist_lock
);
377 spin_unlock_bh(&pn
->l2tp_session_hlist_lock
);
379 write_unlock_bh(&tunnel
->hlist_lock
);
384 /* Lookup a tunnel by id
386 struct l2tp_tunnel
*l2tp_tunnel_find(const struct net
*net
, u32 tunnel_id
)
388 struct l2tp_tunnel
*tunnel
;
389 struct l2tp_net
*pn
= l2tp_pernet(net
);
392 list_for_each_entry_rcu(tunnel
, &pn
->l2tp_tunnel_list
, list
) {
393 if (tunnel
->tunnel_id
== tunnel_id
) {
394 rcu_read_unlock_bh();
398 rcu_read_unlock_bh();
402 EXPORT_SYMBOL_GPL(l2tp_tunnel_find
);
404 struct l2tp_tunnel
*l2tp_tunnel_find_nth(const struct net
*net
, int nth
)
406 struct l2tp_net
*pn
= l2tp_pernet(net
);
407 struct l2tp_tunnel
*tunnel
;
411 list_for_each_entry_rcu(tunnel
, &pn
->l2tp_tunnel_list
, list
) {
413 rcu_read_unlock_bh();
418 rcu_read_unlock_bh();
422 EXPORT_SYMBOL_GPL(l2tp_tunnel_find_nth
);
424 /*****************************************************************************
425 * Receive data handling
426 *****************************************************************************/
428 /* Queue a skb in order. We come here only if the skb has an L2TP sequence
431 static void l2tp_recv_queue_skb(struct l2tp_session
*session
, struct sk_buff
*skb
)
433 struct sk_buff
*skbp
;
435 u32 ns
= L2TP_SKB_CB(skb
)->ns
;
437 spin_lock_bh(&session
->reorder_q
.lock
);
438 skb_queue_walk_safe(&session
->reorder_q
, skbp
, tmp
) {
439 if (L2TP_SKB_CB(skbp
)->ns
> ns
) {
440 __skb_queue_before(&session
->reorder_q
, skbp
, skb
);
441 l2tp_dbg(session
, L2TP_MSG_SEQ
,
442 "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
443 session
->name
, ns
, L2TP_SKB_CB(skbp
)->ns
,
444 skb_queue_len(&session
->reorder_q
));
445 atomic_long_inc(&session
->stats
.rx_oos_packets
);
450 __skb_queue_tail(&session
->reorder_q
, skb
);
453 spin_unlock_bh(&session
->reorder_q
.lock
);
456 /* Dequeue a single skb.
458 static void l2tp_recv_dequeue_skb(struct l2tp_session
*session
, struct sk_buff
*skb
)
460 struct l2tp_tunnel
*tunnel
= session
->tunnel
;
461 int length
= L2TP_SKB_CB(skb
)->length
;
463 /* We're about to requeue the skb, so return resources
464 * to its current owner (a socket receive buffer).
468 atomic_long_inc(&tunnel
->stats
.rx_packets
);
469 atomic_long_add(length
, &tunnel
->stats
.rx_bytes
);
470 atomic_long_inc(&session
->stats
.rx_packets
);
471 atomic_long_add(length
, &session
->stats
.rx_bytes
);
473 if (L2TP_SKB_CB(skb
)->has_seq
) {
476 session
->nr
&= session
->nr_max
;
478 l2tp_dbg(session
, L2TP_MSG_SEQ
, "%s: updated nr to %hu\n",
479 session
->name
, session
->nr
);
482 /* call private receive handler */
483 if (session
->recv_skb
!= NULL
)
484 (*session
->recv_skb
)(session
, skb
, L2TP_SKB_CB(skb
)->length
);
489 (*session
->deref
)(session
);
492 /* Dequeue skbs from the session's reorder_q, subject to packet order.
493 * Skbs that have been in the queue for too long are simply discarded.
495 static void l2tp_recv_dequeue(struct l2tp_session
*session
)
500 /* If the pkt at the head of the queue has the nr that we
501 * expect to send up next, dequeue it and any other
502 * in-sequence packets behind it.
505 spin_lock_bh(&session
->reorder_q
.lock
);
506 skb_queue_walk_safe(&session
->reorder_q
, skb
, tmp
) {
507 if (time_after(jiffies
, L2TP_SKB_CB(skb
)->expires
)) {
508 atomic_long_inc(&session
->stats
.rx_seq_discards
);
509 atomic_long_inc(&session
->stats
.rx_errors
);
510 l2tp_dbg(session
, L2TP_MSG_SEQ
,
511 "%s: oos pkt %u len %d discarded (too old), waiting for %u, reorder_q_len=%d\n",
512 session
->name
, L2TP_SKB_CB(skb
)->ns
,
513 L2TP_SKB_CB(skb
)->length
, session
->nr
,
514 skb_queue_len(&session
->reorder_q
));
515 session
->reorder_skip
= 1;
516 __skb_unlink(skb
, &session
->reorder_q
);
519 (*session
->deref
)(session
);
523 if (L2TP_SKB_CB(skb
)->has_seq
) {
524 if (session
->reorder_skip
) {
525 l2tp_dbg(session
, L2TP_MSG_SEQ
,
526 "%s: advancing nr to next pkt: %u -> %u",
527 session
->name
, session
->nr
,
528 L2TP_SKB_CB(skb
)->ns
);
529 session
->reorder_skip
= 0;
530 session
->nr
= L2TP_SKB_CB(skb
)->ns
;
532 if (L2TP_SKB_CB(skb
)->ns
!= session
->nr
) {
533 l2tp_dbg(session
, L2TP_MSG_SEQ
,
534 "%s: holding oos pkt %u len %d, waiting for %u, reorder_q_len=%d\n",
535 session
->name
, L2TP_SKB_CB(skb
)->ns
,
536 L2TP_SKB_CB(skb
)->length
, session
->nr
,
537 skb_queue_len(&session
->reorder_q
));
541 __skb_unlink(skb
, &session
->reorder_q
);
543 /* Process the skb. We release the queue lock while we
544 * do so to let other contexts process the queue.
546 spin_unlock_bh(&session
->reorder_q
.lock
);
547 l2tp_recv_dequeue_skb(session
, skb
);
552 spin_unlock_bh(&session
->reorder_q
.lock
);
555 static int l2tp_seq_check_rx_window(struct l2tp_session
*session
, u32 nr
)
559 if (nr
>= session
->nr
)
560 nws
= nr
- session
->nr
;
562 nws
= (session
->nr_max
+ 1) - (session
->nr
- nr
);
564 return nws
< session
->nr_window_size
;
567 /* If packet has sequence numbers, queue it if acceptable. Returns 0 if
568 * acceptable, else non-zero.
570 static int l2tp_recv_data_seq(struct l2tp_session
*session
, struct sk_buff
*skb
)
572 if (!l2tp_seq_check_rx_window(session
, L2TP_SKB_CB(skb
)->ns
)) {
573 /* Packet sequence number is outside allowed window.
576 l2tp_dbg(session
, L2TP_MSG_SEQ
,
577 "%s: pkt %u len %d discarded, outside window, nr=%u\n",
578 session
->name
, L2TP_SKB_CB(skb
)->ns
,
579 L2TP_SKB_CB(skb
)->length
, session
->nr
);
583 if (session
->reorder_timeout
!= 0) {
584 /* Packet reordering enabled. Add skb to session's
585 * reorder queue, in order of ns.
587 l2tp_recv_queue_skb(session
, skb
);
591 /* Packet reordering disabled. Discard out-of-sequence packets, while
592 * tracking the number if in-sequence packets after the first OOS packet
593 * is seen. After nr_oos_count_max in-sequence packets, reset the
594 * sequence number to re-enable packet reception.
596 if (L2TP_SKB_CB(skb
)->ns
== session
->nr
) {
597 skb_queue_tail(&session
->reorder_q
, skb
);
599 u32 nr_oos
= L2TP_SKB_CB(skb
)->ns
;
600 u32 nr_next
= (session
->nr_oos
+ 1) & session
->nr_max
;
602 if (nr_oos
== nr_next
)
603 session
->nr_oos_count
++;
605 session
->nr_oos_count
= 0;
607 session
->nr_oos
= nr_oos
;
608 if (session
->nr_oos_count
> session
->nr_oos_count_max
) {
609 session
->reorder_skip
= 1;
610 l2tp_dbg(session
, L2TP_MSG_SEQ
,
611 "%s: %d oos packets received. Resetting sequence numbers\n",
612 session
->name
, session
->nr_oos_count
);
614 if (!session
->reorder_skip
) {
615 atomic_long_inc(&session
->stats
.rx_seq_discards
);
616 l2tp_dbg(session
, L2TP_MSG_SEQ
,
617 "%s: oos pkt %u len %d discarded, waiting for %u, reorder_q_len=%d\n",
618 session
->name
, L2TP_SKB_CB(skb
)->ns
,
619 L2TP_SKB_CB(skb
)->length
, session
->nr
,
620 skb_queue_len(&session
->reorder_q
));
623 skb_queue_tail(&session
->reorder_q
, skb
);
633 /* Do receive processing of L2TP data frames. We handle both L2TPv2
634 * and L2TPv3 data frames here.
636 * L2TPv2 Data Message Header
639 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
640 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
641 * |T|L|x|x|S|x|O|P|x|x|x|x| Ver | Length (opt) |
642 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
643 * | Tunnel ID | Session ID |
644 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
645 * | Ns (opt) | Nr (opt) |
646 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
647 * | Offset Size (opt) | Offset pad... (opt)
648 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
650 * Data frames are marked by T=0. All other fields are the same as
651 * those in L2TP control frames.
653 * L2TPv3 Data Message Header
655 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
656 * | L2TP Session Header |
657 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
658 * | L2-Specific Sublayer |
659 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
660 * | Tunnel Payload ...
661 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
663 * L2TPv3 Session Header Over IP
666 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
667 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
669 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
670 * | Cookie (optional, maximum 64 bits)...
671 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
673 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
675 * L2TPv3 L2-Specific Sublayer Format
678 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
679 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
680 * |x|S|x|x|x|x|x|x| Sequence Number |
681 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
683 * Cookie value, sublayer format and offset (pad) are negotiated with
684 * the peer when the session is set up. Unlike L2TPv2, we do not need
685 * to parse the packet header to determine if optional fields are
688 * Caller must already have parsed the frame and determined that it is
689 * a data (not control) frame before coming here. Fields up to the
690 * session-id have already been parsed and ptr points to the data
691 * after the session-id.
693 * session->ref() must have been called prior to l2tp_recv_common().
694 * session->deref() will be called automatically after skb is processed.
696 void l2tp_recv_common(struct l2tp_session
*session
, struct sk_buff
*skb
,
697 unsigned char *ptr
, unsigned char *optr
, u16 hdrflags
,
698 int length
, int (*payload_hook
)(struct sk_buff
*skb
))
700 struct l2tp_tunnel
*tunnel
= session
->tunnel
;
704 /* Parse and check optional cookie */
705 if (session
->peer_cookie_len
> 0) {
706 if (memcmp(ptr
, &session
->peer_cookie
[0], session
->peer_cookie_len
)) {
707 l2tp_info(tunnel
, L2TP_MSG_DATA
,
708 "%s: cookie mismatch (%u/%u). Discarding.\n",
709 tunnel
->name
, tunnel
->tunnel_id
,
710 session
->session_id
);
711 atomic_long_inc(&session
->stats
.rx_cookie_discards
);
714 ptr
+= session
->peer_cookie_len
;
717 /* Handle the optional sequence numbers. Sequence numbers are
718 * in different places for L2TPv2 and L2TPv3.
720 * If we are the LAC, enable/disable sequence numbers under
721 * the control of the LNS. If no sequence numbers present but
722 * we were expecting them, discard frame.
725 L2TP_SKB_CB(skb
)->has_seq
= 0;
726 if (tunnel
->version
== L2TP_HDR_VER_2
) {
727 if (hdrflags
& L2TP_HDRFLAG_S
) {
728 ns
= ntohs(*(__be16
*) ptr
);
730 nr
= ntohs(*(__be16
*) ptr
);
733 /* Store L2TP info in the skb */
734 L2TP_SKB_CB(skb
)->ns
= ns
;
735 L2TP_SKB_CB(skb
)->has_seq
= 1;
737 l2tp_dbg(session
, L2TP_MSG_SEQ
,
738 "%s: recv data ns=%u, nr=%u, session nr=%u\n",
739 session
->name
, ns
, nr
, session
->nr
);
741 } else if (session
->l2specific_type
== L2TP_L2SPECTYPE_DEFAULT
) {
742 u32 l2h
= ntohl(*(__be32
*) ptr
);
744 if (l2h
& 0x40000000) {
745 ns
= l2h
& 0x00ffffff;
747 /* Store L2TP info in the skb */
748 L2TP_SKB_CB(skb
)->ns
= ns
;
749 L2TP_SKB_CB(skb
)->has_seq
= 1;
751 l2tp_dbg(session
, L2TP_MSG_SEQ
,
752 "%s: recv data ns=%u, session nr=%u\n",
753 session
->name
, ns
, session
->nr
);
757 /* Advance past L2-specific header, if present */
758 ptr
+= session
->l2specific_len
;
760 if (L2TP_SKB_CB(skb
)->has_seq
) {
761 /* Received a packet with sequence numbers. If we're the LNS,
762 * check if we sre sending sequence numbers and if not,
765 if ((!session
->lns_mode
) && (!session
->send_seq
)) {
766 l2tp_info(session
, L2TP_MSG_SEQ
,
767 "%s: requested to enable seq numbers by LNS\n",
769 session
->send_seq
= 1;
770 l2tp_session_set_header_len(session
, tunnel
->version
);
773 /* No sequence numbers.
774 * If user has configured mandatory sequence numbers, discard.
776 if (session
->recv_seq
) {
777 l2tp_warn(session
, L2TP_MSG_SEQ
,
778 "%s: recv data has no seq numbers when required. Discarding.\n",
780 atomic_long_inc(&session
->stats
.rx_seq_discards
);
784 /* If we're the LAC and we're sending sequence numbers, the
785 * LNS has requested that we no longer send sequence numbers.
786 * If we're the LNS and we're sending sequence numbers, the
787 * LAC is broken. Discard the frame.
789 if ((!session
->lns_mode
) && (session
->send_seq
)) {
790 l2tp_info(session
, L2TP_MSG_SEQ
,
791 "%s: requested to disable seq numbers by LNS\n",
793 session
->send_seq
= 0;
794 l2tp_session_set_header_len(session
, tunnel
->version
);
795 } else if (session
->send_seq
) {
796 l2tp_warn(session
, L2TP_MSG_SEQ
,
797 "%s: recv data has no seq numbers when required. Discarding.\n",
799 atomic_long_inc(&session
->stats
.rx_seq_discards
);
804 /* Session data offset is handled differently for L2TPv2 and
805 * L2TPv3. For L2TPv2, there is an optional 16-bit value in
806 * the header. For L2TPv3, the offset is negotiated using AVPs
807 * in the session setup control protocol.
809 if (tunnel
->version
== L2TP_HDR_VER_2
) {
810 /* If offset bit set, skip it. */
811 if (hdrflags
& L2TP_HDRFLAG_O
) {
812 offset
= ntohs(*(__be16
*)ptr
);
816 ptr
+= session
->offset
;
819 if (!pskb_may_pull(skb
, offset
))
822 __skb_pull(skb
, offset
);
824 /* If caller wants to process the payload before we queue the
828 if ((*payload_hook
)(skb
))
831 /* Prepare skb for adding to the session's reorder_q. Hold
832 * packets for max reorder_timeout or 1 second if not
835 L2TP_SKB_CB(skb
)->length
= length
;
836 L2TP_SKB_CB(skb
)->expires
= jiffies
+
837 (session
->reorder_timeout
? session
->reorder_timeout
: HZ
);
839 /* Add packet to the session's receive queue. Reordering is done here, if
840 * enabled. Saved L2TP protocol info is stored in skb->sb[].
842 if (L2TP_SKB_CB(skb
)->has_seq
) {
843 if (l2tp_recv_data_seq(session
, skb
))
846 /* No sequence numbers. Add the skb to the tail of the
847 * reorder queue. This ensures that it will be
848 * delivered after all previous sequenced skbs.
850 skb_queue_tail(&session
->reorder_q
, skb
);
853 /* Try to dequeue as many skbs from reorder_q as we can. */
854 l2tp_recv_dequeue(session
);
859 atomic_long_inc(&session
->stats
.rx_errors
);
863 (*session
->deref
)(session
);
865 EXPORT_SYMBOL(l2tp_recv_common
);
867 /* Drop skbs from the session's reorder_q
869 int l2tp_session_queue_purge(struct l2tp_session
*session
)
871 struct sk_buff
*skb
= NULL
;
873 BUG_ON(session
->magic
!= L2TP_SESSION_MAGIC
);
874 while ((skb
= skb_dequeue(&session
->reorder_q
))) {
875 atomic_long_inc(&session
->stats
.rx_errors
);
878 (*session
->deref
)(session
);
882 EXPORT_SYMBOL_GPL(l2tp_session_queue_purge
);
884 /* Internal UDP receive frame. Do the real work of receiving an L2TP data frame
885 * here. The skb is not on a list when we get here.
886 * Returns 0 if the packet was a data packet and was successfully passed on.
887 * Returns 1 if the packet was not a good data packet and could not be
888 * forwarded. All such packets are passed up to userspace to deal with.
890 static int l2tp_udp_recv_core(struct l2tp_tunnel
*tunnel
, struct sk_buff
*skb
,
891 int (*payload_hook
)(struct sk_buff
*skb
))
893 struct l2tp_session
*session
= NULL
;
894 unsigned char *ptr
, *optr
;
896 u32 tunnel_id
, session_id
;
900 /* UDP has verifed checksum */
902 /* UDP always verifies the packet length. */
903 __skb_pull(skb
, sizeof(struct udphdr
));
906 if (!pskb_may_pull(skb
, L2TP_HDR_SIZE_SEQ
)) {
907 l2tp_info(tunnel
, L2TP_MSG_DATA
,
908 "%s: recv short packet (len=%d)\n",
909 tunnel
->name
, skb
->len
);
913 /* Trace packet contents, if enabled */
914 if (tunnel
->debug
& L2TP_MSG_DATA
) {
915 length
= min(32u, skb
->len
);
916 if (!pskb_may_pull(skb
, length
))
919 pr_debug("%s: recv\n", tunnel
->name
);
920 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET
, skb
->data
, length
);
923 /* Point to L2TP header */
924 optr
= ptr
= skb
->data
;
926 /* Get L2TP header flags */
927 hdrflags
= ntohs(*(__be16
*) ptr
);
929 /* Check protocol version */
930 version
= hdrflags
& L2TP_HDR_VER_MASK
;
931 if (version
!= tunnel
->version
) {
932 l2tp_info(tunnel
, L2TP_MSG_DATA
,
933 "%s: recv protocol version mismatch: got %d expected %d\n",
934 tunnel
->name
, version
, tunnel
->version
);
938 /* Get length of L2TP packet */
941 /* If type is control packet, it is handled by userspace. */
942 if (hdrflags
& L2TP_HDRFLAG_T
) {
943 l2tp_dbg(tunnel
, L2TP_MSG_DATA
,
944 "%s: recv control packet, len=%d\n",
945 tunnel
->name
, length
);
952 if (tunnel
->version
== L2TP_HDR_VER_2
) {
953 /* If length is present, skip it */
954 if (hdrflags
& L2TP_HDRFLAG_L
)
957 /* Extract tunnel and session ID */
958 tunnel_id
= ntohs(*(__be16
*) ptr
);
960 session_id
= ntohs(*(__be16
*) ptr
);
963 ptr
+= 2; /* skip reserved bits */
964 tunnel_id
= tunnel
->tunnel_id
;
965 session_id
= ntohl(*(__be32
*) ptr
);
969 /* Find the session context */
970 session
= l2tp_session_get(tunnel
->l2tp_net
, tunnel
, session_id
, true);
971 if (!session
|| !session
->recv_skb
) {
974 session
->deref(session
);
975 l2tp_session_dec_refcount(session
);
978 /* Not found? Pass to userspace to deal with */
979 l2tp_info(tunnel
, L2TP_MSG_DATA
,
980 "%s: no session found (%u/%u). Passing up.\n",
981 tunnel
->name
, tunnel_id
, session_id
);
985 l2tp_recv_common(session
, skb
, ptr
, optr
, hdrflags
, length
, payload_hook
);
986 l2tp_session_dec_refcount(session
);
991 /* Put UDP header back */
992 __skb_push(skb
, sizeof(struct udphdr
));
997 /* UDP encapsulation receive handler. See net/ipv4/udp.c.
1001 * >0: skb should be passed up to userspace as UDP.
1003 int l2tp_udp_encap_recv(struct sock
*sk
, struct sk_buff
*skb
)
1005 struct l2tp_tunnel
*tunnel
;
1007 tunnel
= l2tp_sock_to_tunnel(sk
);
1011 l2tp_dbg(tunnel
, L2TP_MSG_DATA
, "%s: received %d bytes\n",
1012 tunnel
->name
, skb
->len
);
1014 if (l2tp_udp_recv_core(tunnel
, skb
, tunnel
->recv_payload_hook
))
1025 EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv
);
1027 /************************************************************************
1029 ***********************************************************************/
1031 /* Build an L2TP header for the session into the buffer provided.
1033 static int l2tp_build_l2tpv2_header(struct l2tp_session
*session
, void *buf
)
1035 struct l2tp_tunnel
*tunnel
= session
->tunnel
;
1038 u16 flags
= L2TP_HDR_VER_2
;
1039 u32 tunnel_id
= tunnel
->peer_tunnel_id
;
1040 u32 session_id
= session
->peer_session_id
;
1042 if (session
->send_seq
)
1043 flags
|= L2TP_HDRFLAG_S
;
1045 /* Setup L2TP header. */
1046 *bufp
++ = htons(flags
);
1047 *bufp
++ = htons(tunnel_id
);
1048 *bufp
++ = htons(session_id
);
1049 if (session
->send_seq
) {
1050 *bufp
++ = htons(session
->ns
);
1053 session
->ns
&= 0xffff;
1054 l2tp_dbg(session
, L2TP_MSG_SEQ
, "%s: updated ns to %u\n",
1055 session
->name
, session
->ns
);
1061 static int l2tp_build_l2tpv3_header(struct l2tp_session
*session
, void *buf
)
1063 struct l2tp_tunnel
*tunnel
= session
->tunnel
;
1067 /* Setup L2TP header. The header differs slightly for UDP and
1068 * IP encapsulations. For UDP, there is 4 bytes of flags.
1070 if (tunnel
->encap
== L2TP_ENCAPTYPE_UDP
) {
1071 u16 flags
= L2TP_HDR_VER_3
;
1072 *((__be16
*) bufp
) = htons(flags
);
1074 *((__be16
*) bufp
) = 0;
1078 *((__be32
*) bufp
) = htonl(session
->peer_session_id
);
1080 if (session
->cookie_len
) {
1081 memcpy(bufp
, &session
->cookie
[0], session
->cookie_len
);
1082 bufp
+= session
->cookie_len
;
1084 if (session
->l2specific_len
) {
1085 if (session
->l2specific_type
== L2TP_L2SPECTYPE_DEFAULT
) {
1087 if (session
->send_seq
) {
1088 l2h
= 0x40000000 | session
->ns
;
1090 session
->ns
&= 0xffffff;
1091 l2tp_dbg(session
, L2TP_MSG_SEQ
,
1092 "%s: updated ns to %u\n",
1093 session
->name
, session
->ns
);
1096 *((__be32
*) bufp
) = htonl(l2h
);
1098 bufp
+= session
->l2specific_len
;
1100 if (session
->offset
)
1101 bufp
+= session
->offset
;
1106 static int l2tp_xmit_core(struct l2tp_session
*session
, struct sk_buff
*skb
,
1107 struct flowi
*fl
, size_t data_len
)
1109 struct l2tp_tunnel
*tunnel
= session
->tunnel
;
1110 unsigned int len
= skb
->len
;
1114 if (session
->send_seq
)
1115 l2tp_dbg(session
, L2TP_MSG_DATA
, "%s: send %zd bytes, ns=%u\n",
1116 session
->name
, data_len
, session
->ns
- 1);
1118 l2tp_dbg(session
, L2TP_MSG_DATA
, "%s: send %zd bytes\n",
1119 session
->name
, data_len
);
1121 if (session
->debug
& L2TP_MSG_DATA
) {
1122 int uhlen
= (tunnel
->encap
== L2TP_ENCAPTYPE_UDP
) ? sizeof(struct udphdr
) : 0;
1123 unsigned char *datap
= skb
->data
+ uhlen
;
1125 pr_debug("%s: xmit\n", session
->name
);
1126 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET
,
1127 datap
, min_t(size_t, 32, len
- uhlen
));
1130 /* Queue the packet to IP for output */
1132 #if IS_ENABLED(CONFIG_IPV6)
1133 if (tunnel
->sock
->sk_family
== PF_INET6
&& !tunnel
->v4mapped
)
1134 error
= inet6_csk_xmit(tunnel
->sock
, skb
, NULL
);
1137 error
= ip_queue_xmit(tunnel
->sock
, skb
, fl
);
1141 atomic_long_inc(&tunnel
->stats
.tx_packets
);
1142 atomic_long_add(len
, &tunnel
->stats
.tx_bytes
);
1143 atomic_long_inc(&session
->stats
.tx_packets
);
1144 atomic_long_add(len
, &session
->stats
.tx_bytes
);
1146 atomic_long_inc(&tunnel
->stats
.tx_errors
);
1147 atomic_long_inc(&session
->stats
.tx_errors
);
1153 /* If caller requires the skb to have a ppp header, the header must be
1154 * inserted in the skb data before calling this function.
1156 int l2tp_xmit_skb(struct l2tp_session
*session
, struct sk_buff
*skb
, int hdr_len
)
1158 int data_len
= skb
->len
;
1159 struct l2tp_tunnel
*tunnel
= session
->tunnel
;
1160 struct sock
*sk
= tunnel
->sock
;
1163 struct inet_sock
*inet
;
1165 int uhlen
= (tunnel
->encap
== L2TP_ENCAPTYPE_UDP
) ? sizeof(struct udphdr
) : 0;
1167 int ret
= NET_XMIT_SUCCESS
;
1169 /* Check that there's enough headroom in the skb to insert IP,
1170 * UDP and L2TP headers. If not enough, expand it to
1171 * make room. Adjust truesize.
1173 headroom
= NET_SKB_PAD
+ sizeof(struct iphdr
) +
1175 if (skb_cow_head(skb
, headroom
)) {
1177 return NET_XMIT_DROP
;
1180 /* Setup L2TP header */
1181 session
->build_header(session
, __skb_push(skb
, hdr_len
));
1183 /* Reset skb netfilter state */
1184 memset(&(IPCB(skb
)->opt
), 0, sizeof(IPCB(skb
)->opt
));
1185 IPCB(skb
)->flags
&= ~(IPSKB_XFRM_TUNNEL_SIZE
| IPSKB_XFRM_TRANSFORMED
|
1190 if (sock_owned_by_user(sk
)) {
1192 ret
= NET_XMIT_DROP
;
1196 /* Get routing info from the tunnel socket */
1198 skb_dst_set(skb
, dst_clone(__sk_dst_check(sk
, 0)));
1201 fl
= &inet
->cork
.fl
;
1202 switch (tunnel
->encap
) {
1203 case L2TP_ENCAPTYPE_UDP
:
1204 /* Setup UDP header */
1205 __skb_push(skb
, sizeof(*uh
));
1206 skb_reset_transport_header(skb
);
1208 uh
->source
= inet
->inet_sport
;
1209 uh
->dest
= inet
->inet_dport
;
1210 udp_len
= uhlen
+ hdr_len
+ data_len
;
1211 uh
->len
= htons(udp_len
);
1213 /* Calculate UDP checksum if configured to do so */
1214 #if IS_ENABLED(CONFIG_IPV6)
1215 if (sk
->sk_family
== PF_INET6
&& !tunnel
->v4mapped
)
1216 udp6_set_csum(udp_get_no_check6_tx(sk
),
1217 skb
, &inet6_sk(sk
)->saddr
,
1218 &sk
->sk_v6_daddr
, udp_len
);
1221 udp_set_csum(sk
->sk_no_check_tx
, skb
, inet
->inet_saddr
,
1222 inet
->inet_daddr
, udp_len
);
1225 case L2TP_ENCAPTYPE_IP
:
1229 l2tp_xmit_core(session
, skb
, fl
, data_len
);
1235 EXPORT_SYMBOL_GPL(l2tp_xmit_skb
);
1237 /*****************************************************************************
1238 * Tinnel and session create/destroy.
1239 *****************************************************************************/
1241 /* Tunnel socket destruct hook.
1242 * The tunnel context is deleted only when all session sockets have been
1245 static void l2tp_tunnel_destruct(struct sock
*sk
)
1247 struct l2tp_tunnel
*tunnel
= l2tp_tunnel(sk
);
1248 struct l2tp_net
*pn
;
1253 l2tp_info(tunnel
, L2TP_MSG_CONTROL
, "%s: closing...\n", tunnel
->name
);
1256 /* Disable udp encapsulation */
1257 switch (tunnel
->encap
) {
1258 case L2TP_ENCAPTYPE_UDP
:
1259 /* No longer an encapsulation socket. See net/ipv4/udp.c */
1260 (udp_sk(sk
))->encap_type
= 0;
1261 (udp_sk(sk
))->encap_rcv
= NULL
;
1262 (udp_sk(sk
))->encap_destroy
= NULL
;
1264 case L2TP_ENCAPTYPE_IP
:
1268 /* Remove hooks into tunnel socket */
1269 sk
->sk_destruct
= tunnel
->old_sk_destruct
;
1270 sk
->sk_user_data
= NULL
;
1272 /* Remove the tunnel struct from the tunnel list */
1273 pn
= l2tp_pernet(tunnel
->l2tp_net
);
1274 spin_lock_bh(&pn
->l2tp_tunnel_list_lock
);
1275 list_del_rcu(&tunnel
->list
);
1276 spin_unlock_bh(&pn
->l2tp_tunnel_list_lock
);
1277 atomic_dec(&l2tp_tunnel_count
);
1279 l2tp_tunnel_closeall(tunnel
);
1281 tunnel
->sock
= NULL
;
1282 l2tp_tunnel_dec_refcount(tunnel
);
1284 /* Call the original destructor */
1285 if (sk
->sk_destruct
)
1286 (*sk
->sk_destruct
)(sk
);
1291 /* When the tunnel is closed, all the attached sessions need to go too.
1293 void l2tp_tunnel_closeall(struct l2tp_tunnel
*tunnel
)
1296 struct hlist_node
*walk
;
1297 struct hlist_node
*tmp
;
1298 struct l2tp_session
*session
;
1300 BUG_ON(tunnel
== NULL
);
1302 l2tp_info(tunnel
, L2TP_MSG_CONTROL
, "%s: closing all sessions...\n",
1305 write_lock_bh(&tunnel
->hlist_lock
);
1306 tunnel
->acpt_newsess
= false;
1307 for (hash
= 0; hash
< L2TP_HASH_SIZE
; hash
++) {
1309 hlist_for_each_safe(walk
, tmp
, &tunnel
->session_hlist
[hash
]) {
1310 session
= hlist_entry(walk
, struct l2tp_session
, hlist
);
1312 l2tp_info(session
, L2TP_MSG_CONTROL
,
1313 "%s: closing session\n", session
->name
);
1315 hlist_del_init(&session
->hlist
);
1317 if (session
->ref
!= NULL
)
1318 (*session
->ref
)(session
);
1320 write_unlock_bh(&tunnel
->hlist_lock
);
1322 __l2tp_session_unhash(session
);
1323 l2tp_session_queue_purge(session
);
1325 if (session
->session_close
!= NULL
)
1326 (*session
->session_close
)(session
);
1328 if (session
->deref
!= NULL
)
1329 (*session
->deref
)(session
);
1331 l2tp_session_dec_refcount(session
);
1333 write_lock_bh(&tunnel
->hlist_lock
);
1335 /* Now restart from the beginning of this hash
1336 * chain. We always remove a session from the
1337 * list so we are guaranteed to make forward
1343 write_unlock_bh(&tunnel
->hlist_lock
);
1345 EXPORT_SYMBOL_GPL(l2tp_tunnel_closeall
);
1347 /* Tunnel socket destroy hook for UDP encapsulation */
1348 static void l2tp_udp_encap_destroy(struct sock
*sk
)
1350 struct l2tp_tunnel
*tunnel
= l2tp_sock_to_tunnel(sk
);
1352 l2tp_tunnel_closeall(tunnel
);
1357 /* Workqueue tunnel deletion function */
1358 static void l2tp_tunnel_del_work(struct work_struct
*work
)
1360 struct l2tp_tunnel
*tunnel
= NULL
;
1361 struct socket
*sock
= NULL
;
1362 struct sock
*sk
= NULL
;
1364 tunnel
= container_of(work
, struct l2tp_tunnel
, del_work
);
1366 l2tp_tunnel_closeall(tunnel
);
1368 sk
= l2tp_tunnel_sock_lookup(tunnel
);
1372 sock
= sk
->sk_socket
;
1374 /* If the tunnel socket was created by userspace, then go through the
1375 * inet layer to shut the socket down, and let userspace close it.
1376 * Otherwise, if we created the socket directly within the kernel, use
1377 * the sk API to release it here.
1378 * In either case the tunnel resources are freed in the socket
1379 * destructor when the tunnel socket goes away.
1381 if (tunnel
->fd
>= 0) {
1383 inet_shutdown(sock
, 2);
1386 kernel_sock_shutdown(sock
, SHUT_RDWR
);
1391 l2tp_tunnel_sock_put(sk
);
1393 l2tp_tunnel_dec_refcount(tunnel
);
1396 /* Create a socket for the tunnel, if one isn't set up by
1397 * userspace. This is used for static tunnels where there is no
1398 * managing L2TP daemon.
1400 * Since we don't want these sockets to keep a namespace alive by
1401 * themselves, we drop the socket's namespace refcount after creation.
1402 * These sockets are freed when the namespace exits using the pernet
1405 static int l2tp_tunnel_sock_create(struct net
*net
,
1408 struct l2tp_tunnel_cfg
*cfg
,
1409 struct socket
**sockp
)
1412 struct socket
*sock
= NULL
;
1413 struct udp_port_cfg udp_conf
;
1415 switch (cfg
->encap
) {
1416 case L2TP_ENCAPTYPE_UDP
:
1417 memset(&udp_conf
, 0, sizeof(udp_conf
));
1419 #if IS_ENABLED(CONFIG_IPV6)
1420 if (cfg
->local_ip6
&& cfg
->peer_ip6
) {
1421 udp_conf
.family
= AF_INET6
;
1422 memcpy(&udp_conf
.local_ip6
, cfg
->local_ip6
,
1423 sizeof(udp_conf
.local_ip6
));
1424 memcpy(&udp_conf
.peer_ip6
, cfg
->peer_ip6
,
1425 sizeof(udp_conf
.peer_ip6
));
1426 udp_conf
.use_udp6_tx_checksums
=
1427 ! cfg
->udp6_zero_tx_checksums
;
1428 udp_conf
.use_udp6_rx_checksums
=
1429 ! cfg
->udp6_zero_rx_checksums
;
1433 udp_conf
.family
= AF_INET
;
1434 udp_conf
.local_ip
= cfg
->local_ip
;
1435 udp_conf
.peer_ip
= cfg
->peer_ip
;
1436 udp_conf
.use_udp_checksums
= cfg
->use_udp_checksums
;
1439 udp_conf
.local_udp_port
= htons(cfg
->local_udp_port
);
1440 udp_conf
.peer_udp_port
= htons(cfg
->peer_udp_port
);
1442 err
= udp_sock_create(net
, &udp_conf
, &sock
);
1448 case L2TP_ENCAPTYPE_IP
:
1449 #if IS_ENABLED(CONFIG_IPV6)
1450 if (cfg
->local_ip6
&& cfg
->peer_ip6
) {
1451 struct sockaddr_l2tpip6 ip6_addr
= {0};
1453 err
= sock_create_kern(net
, AF_INET6
, SOCK_DGRAM
,
1454 IPPROTO_L2TP
, &sock
);
1458 ip6_addr
.l2tp_family
= AF_INET6
;
1459 memcpy(&ip6_addr
.l2tp_addr
, cfg
->local_ip6
,
1460 sizeof(ip6_addr
.l2tp_addr
));
1461 ip6_addr
.l2tp_conn_id
= tunnel_id
;
1462 err
= kernel_bind(sock
, (struct sockaddr
*) &ip6_addr
,
1467 ip6_addr
.l2tp_family
= AF_INET6
;
1468 memcpy(&ip6_addr
.l2tp_addr
, cfg
->peer_ip6
,
1469 sizeof(ip6_addr
.l2tp_addr
));
1470 ip6_addr
.l2tp_conn_id
= peer_tunnel_id
;
1471 err
= kernel_connect(sock
,
1472 (struct sockaddr
*) &ip6_addr
,
1473 sizeof(ip6_addr
), 0);
1479 struct sockaddr_l2tpip ip_addr
= {0};
1481 err
= sock_create_kern(net
, AF_INET
, SOCK_DGRAM
,
1482 IPPROTO_L2TP
, &sock
);
1486 ip_addr
.l2tp_family
= AF_INET
;
1487 ip_addr
.l2tp_addr
= cfg
->local_ip
;
1488 ip_addr
.l2tp_conn_id
= tunnel_id
;
1489 err
= kernel_bind(sock
, (struct sockaddr
*) &ip_addr
,
1494 ip_addr
.l2tp_family
= AF_INET
;
1495 ip_addr
.l2tp_addr
= cfg
->peer_ip
;
1496 ip_addr
.l2tp_conn_id
= peer_tunnel_id
;
1497 err
= kernel_connect(sock
, (struct sockaddr
*) &ip_addr
,
1498 sizeof(ip_addr
), 0);
1510 if ((err
< 0) && sock
) {
1511 kernel_sock_shutdown(sock
, SHUT_RDWR
);
1519 static struct lock_class_key l2tp_socket_class
;
1521 int l2tp_tunnel_create(struct net
*net
, int fd
, int version
, u32 tunnel_id
, u32 peer_tunnel_id
, struct l2tp_tunnel_cfg
*cfg
, struct l2tp_tunnel
**tunnelp
)
1523 struct l2tp_tunnel
*tunnel
= NULL
;
1525 struct socket
*sock
= NULL
;
1526 struct sock
*sk
= NULL
;
1527 struct l2tp_net
*pn
;
1528 enum l2tp_encap_type encap
= L2TP_ENCAPTYPE_UDP
;
1530 /* Get the tunnel socket from the fd, which was opened by
1531 * the userspace L2TP daemon. If not specified, create a
1535 err
= l2tp_tunnel_sock_create(net
, tunnel_id
, peer_tunnel_id
,
1540 sock
= sockfd_lookup(fd
, &err
);
1542 pr_err("tunl %u: sockfd_lookup(fd=%d) returned %d\n",
1543 tunnel_id
, fd
, err
);
1548 /* Reject namespace mismatches */
1549 if (!net_eq(sock_net(sock
->sk
), net
)) {
1550 pr_err("tunl %u: netns mismatch\n", tunnel_id
);
1561 /* Quick sanity checks */
1563 case L2TP_ENCAPTYPE_UDP
:
1564 err
= -EPROTONOSUPPORT
;
1565 if (sk
->sk_protocol
!= IPPROTO_UDP
) {
1566 pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
1567 tunnel_id
, fd
, sk
->sk_protocol
, IPPROTO_UDP
);
1571 case L2TP_ENCAPTYPE_IP
:
1572 err
= -EPROTONOSUPPORT
;
1573 if (sk
->sk_protocol
!= IPPROTO_L2TP
) {
1574 pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
1575 tunnel_id
, fd
, sk
->sk_protocol
, IPPROTO_L2TP
);
1581 /* Check if this socket has already been prepped */
1582 tunnel
= l2tp_tunnel(sk
);
1583 if (tunnel
!= NULL
) {
1584 /* This socket has already been prepped */
1589 tunnel
= kzalloc(sizeof(struct l2tp_tunnel
), GFP_KERNEL
);
1590 if (tunnel
== NULL
) {
1595 tunnel
->version
= version
;
1596 tunnel
->tunnel_id
= tunnel_id
;
1597 tunnel
->peer_tunnel_id
= peer_tunnel_id
;
1598 tunnel
->debug
= L2TP_DEFAULT_DEBUG_FLAGS
;
1600 tunnel
->magic
= L2TP_TUNNEL_MAGIC
;
1601 sprintf(&tunnel
->name
[0], "tunl %u", tunnel_id
);
1602 rwlock_init(&tunnel
->hlist_lock
);
1603 tunnel
->acpt_newsess
= true;
1605 /* The net we belong to */
1606 tunnel
->l2tp_net
= net
;
1607 pn
= l2tp_pernet(net
);
1610 tunnel
->debug
= cfg
->debug
;
1612 #if IS_ENABLED(CONFIG_IPV6)
1613 if (sk
->sk_family
== PF_INET6
) {
1614 struct ipv6_pinfo
*np
= inet6_sk(sk
);
1616 if (ipv6_addr_v4mapped(&np
->saddr
) &&
1617 ipv6_addr_v4mapped(&sk
->sk_v6_daddr
)) {
1618 struct inet_sock
*inet
= inet_sk(sk
);
1620 tunnel
->v4mapped
= true;
1621 inet
->inet_saddr
= np
->saddr
.s6_addr32
[3];
1622 inet
->inet_rcv_saddr
= sk
->sk_v6_rcv_saddr
.s6_addr32
[3];
1623 inet
->inet_daddr
= sk
->sk_v6_daddr
.s6_addr32
[3];
1625 tunnel
->v4mapped
= false;
1630 /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
1631 tunnel
->encap
= encap
;
1632 if (encap
== L2TP_ENCAPTYPE_UDP
) {
1633 struct udp_tunnel_sock_cfg udp_cfg
= { };
1635 udp_cfg
.sk_user_data
= tunnel
;
1636 udp_cfg
.encap_type
= UDP_ENCAP_L2TPINUDP
;
1637 udp_cfg
.encap_rcv
= l2tp_udp_encap_recv
;
1638 udp_cfg
.encap_destroy
= l2tp_udp_encap_destroy
;
1640 setup_udp_tunnel_sock(net
, sock
, &udp_cfg
);
1642 sk
->sk_user_data
= tunnel
;
1645 /* Hook on the tunnel socket destructor so that we can cleanup
1646 * if the tunnel socket goes away.
1648 tunnel
->old_sk_destruct
= sk
->sk_destruct
;
1649 sk
->sk_destruct
= &l2tp_tunnel_destruct
;
1652 lockdep_set_class_and_name(&sk
->sk_lock
.slock
, &l2tp_socket_class
, "l2tp_sock");
1654 sk
->sk_allocation
= GFP_ATOMIC
;
1656 /* Init delete workqueue struct */
1657 INIT_WORK(&tunnel
->del_work
, l2tp_tunnel_del_work
);
1659 /* Add tunnel to our list */
1660 INIT_LIST_HEAD(&tunnel
->list
);
1661 atomic_inc(&l2tp_tunnel_count
);
1663 /* Bump the reference count. The tunnel context is deleted
1664 * only when this drops to zero. Must be done before list insertion
1666 refcount_set(&tunnel
->ref_count
, 1);
1667 spin_lock_bh(&pn
->l2tp_tunnel_list_lock
);
1668 list_add_rcu(&tunnel
->list
, &pn
->l2tp_tunnel_list
);
1669 spin_unlock_bh(&pn
->l2tp_tunnel_list_lock
);
1676 /* If tunnel's socket was created by the kernel, it doesn't
1679 if (sock
&& sock
->file
)
1684 EXPORT_SYMBOL_GPL(l2tp_tunnel_create
);
1686 /* This function is used by the netlink TUNNEL_DELETE command.
1688 int l2tp_tunnel_delete(struct l2tp_tunnel
*tunnel
)
1690 l2tp_tunnel_inc_refcount(tunnel
);
1691 if (false == queue_work(l2tp_wq
, &tunnel
->del_work
)) {
1692 l2tp_tunnel_dec_refcount(tunnel
);
1697 EXPORT_SYMBOL_GPL(l2tp_tunnel_delete
);
1699 /* Really kill the session.
1701 void l2tp_session_free(struct l2tp_session
*session
)
1703 struct l2tp_tunnel
*tunnel
= session
->tunnel
;
1705 BUG_ON(refcount_read(&session
->ref_count
) != 0);
1708 BUG_ON(tunnel
->magic
!= L2TP_TUNNEL_MAGIC
);
1709 if (session
->session_id
!= 0)
1710 atomic_dec(&l2tp_session_count
);
1711 sock_put(tunnel
->sock
);
1712 session
->tunnel
= NULL
;
1713 l2tp_tunnel_dec_refcount(tunnel
);
1718 EXPORT_SYMBOL_GPL(l2tp_session_free
);
1720 /* Remove an l2tp session from l2tp_core's hash lists.
1721 * Provides a tidyup interface for pseudowire code which can't just route all
1722 * shutdown via. l2tp_session_delete and a pseudowire-specific session_close
1725 void __l2tp_session_unhash(struct l2tp_session
*session
)
1727 struct l2tp_tunnel
*tunnel
= session
->tunnel
;
1729 /* Remove the session from core hashes */
1731 /* Remove from the per-tunnel hash */
1732 write_lock_bh(&tunnel
->hlist_lock
);
1733 hlist_del_init(&session
->hlist
);
1734 write_unlock_bh(&tunnel
->hlist_lock
);
1736 /* For L2TPv3 we have a per-net hash: remove from there, too */
1737 if (tunnel
->version
!= L2TP_HDR_VER_2
) {
1738 struct l2tp_net
*pn
= l2tp_pernet(tunnel
->l2tp_net
);
1739 spin_lock_bh(&pn
->l2tp_session_hlist_lock
);
1740 hlist_del_init_rcu(&session
->global_hlist
);
1741 spin_unlock_bh(&pn
->l2tp_session_hlist_lock
);
1746 EXPORT_SYMBOL_GPL(__l2tp_session_unhash
);
1748 /* This function is used by the netlink SESSION_DELETE command and by
1751 int l2tp_session_delete(struct l2tp_session
*session
)
1754 (*session
->ref
)(session
);
1755 __l2tp_session_unhash(session
);
1756 l2tp_session_queue_purge(session
);
1757 if (session
->session_close
!= NULL
)
1758 (*session
->session_close
)(session
);
1760 (*session
->deref
)(session
);
1761 l2tp_session_dec_refcount(session
);
1764 EXPORT_SYMBOL_GPL(l2tp_session_delete
);
1766 /* We come here whenever a session's send_seq, cookie_len or
1767 * l2specific_len parameters are set.
1769 void l2tp_session_set_header_len(struct l2tp_session
*session
, int version
)
1771 if (version
== L2TP_HDR_VER_2
) {
1772 session
->hdr_len
= 6;
1773 if (session
->send_seq
)
1774 session
->hdr_len
+= 4;
1776 session
->hdr_len
= 4 + session
->cookie_len
+ session
->l2specific_len
+ session
->offset
;
1777 if (session
->tunnel
->encap
== L2TP_ENCAPTYPE_UDP
)
1778 session
->hdr_len
+= 4;
1782 EXPORT_SYMBOL_GPL(l2tp_session_set_header_len
);
1784 struct l2tp_session
*l2tp_session_create(int priv_size
, struct l2tp_tunnel
*tunnel
, u32 session_id
, u32 peer_session_id
, struct l2tp_session_cfg
*cfg
)
1786 struct l2tp_session
*session
;
1789 session
= kzalloc(sizeof(struct l2tp_session
) + priv_size
, GFP_KERNEL
);
1790 if (session
!= NULL
) {
1791 session
->magic
= L2TP_SESSION_MAGIC
;
1792 session
->tunnel
= tunnel
;
1794 session
->session_id
= session_id
;
1795 session
->peer_session_id
= peer_session_id
;
1797 if (tunnel
->version
== L2TP_HDR_VER_2
)
1798 session
->nr_max
= 0xffff;
1800 session
->nr_max
= 0xffffff;
1801 session
->nr_window_size
= session
->nr_max
/ 2;
1802 session
->nr_oos_count_max
= 4;
1804 /* Use NR of first received packet */
1805 session
->reorder_skip
= 1;
1807 sprintf(&session
->name
[0], "sess %u/%u",
1808 tunnel
->tunnel_id
, session
->session_id
);
1810 skb_queue_head_init(&session
->reorder_q
);
1812 INIT_HLIST_NODE(&session
->hlist
);
1813 INIT_HLIST_NODE(&session
->global_hlist
);
1815 /* Inherit debug options from tunnel */
1816 session
->debug
= tunnel
->debug
;
1819 session
->pwtype
= cfg
->pw_type
;
1820 session
->debug
= cfg
->debug
;
1821 session
->mtu
= cfg
->mtu
;
1822 session
->mru
= cfg
->mru
;
1823 session
->send_seq
= cfg
->send_seq
;
1824 session
->recv_seq
= cfg
->recv_seq
;
1825 session
->lns_mode
= cfg
->lns_mode
;
1826 session
->reorder_timeout
= cfg
->reorder_timeout
;
1827 session
->offset
= cfg
->offset
;
1828 session
->l2specific_type
= cfg
->l2specific_type
;
1829 session
->l2specific_len
= cfg
->l2specific_len
;
1830 session
->cookie_len
= cfg
->cookie_len
;
1831 memcpy(&session
->cookie
[0], &cfg
->cookie
[0], cfg
->cookie_len
);
1832 session
->peer_cookie_len
= cfg
->peer_cookie_len
;
1833 memcpy(&session
->peer_cookie
[0], &cfg
->peer_cookie
[0], cfg
->peer_cookie_len
);
1836 if (tunnel
->version
== L2TP_HDR_VER_2
)
1837 session
->build_header
= l2tp_build_l2tpv2_header
;
1839 session
->build_header
= l2tp_build_l2tpv3_header
;
1841 l2tp_session_set_header_len(session
, tunnel
->version
);
1843 refcount_set(&session
->ref_count
, 1);
1845 err
= l2tp_session_add_to_tunnel(tunnel
, session
);
1849 return ERR_PTR(err
);
1852 /* Ignore management session in session count value */
1853 if (session
->session_id
!= 0)
1854 atomic_inc(&l2tp_session_count
);
1859 return ERR_PTR(-ENOMEM
);
1861 EXPORT_SYMBOL_GPL(l2tp_session_create
);
1863 /*****************************************************************************
1865 *****************************************************************************/
1867 static __net_init
int l2tp_init_net(struct net
*net
)
1869 struct l2tp_net
*pn
= net_generic(net
, l2tp_net_id
);
1872 INIT_LIST_HEAD(&pn
->l2tp_tunnel_list
);
1873 spin_lock_init(&pn
->l2tp_tunnel_list_lock
);
1875 for (hash
= 0; hash
< L2TP_HASH_SIZE_2
; hash
++)
1876 INIT_HLIST_HEAD(&pn
->l2tp_session_hlist
[hash
]);
1878 spin_lock_init(&pn
->l2tp_session_hlist_lock
);
1883 static __net_exit
void l2tp_exit_net(struct net
*net
)
1885 struct l2tp_net
*pn
= l2tp_pernet(net
);
1886 struct l2tp_tunnel
*tunnel
= NULL
;
1889 list_for_each_entry_rcu(tunnel
, &pn
->l2tp_tunnel_list
, list
) {
1890 (void)l2tp_tunnel_delete(tunnel
);
1892 rcu_read_unlock_bh();
1894 flush_workqueue(l2tp_wq
);
1898 static struct pernet_operations l2tp_net_ops
= {
1899 .init
= l2tp_init_net
,
1900 .exit
= l2tp_exit_net
,
1902 .size
= sizeof(struct l2tp_net
),
1905 static int __init
l2tp_init(void)
1909 rc
= register_pernet_device(&l2tp_net_ops
);
1913 l2tp_wq
= alloc_workqueue("l2tp", WQ_UNBOUND
, 0);
1915 pr_err("alloc_workqueue failed\n");
1916 unregister_pernet_device(&l2tp_net_ops
);
1921 pr_info("L2TP core driver, %s\n", L2TP_DRV_VERSION
);
1927 static void __exit
l2tp_exit(void)
1929 unregister_pernet_device(&l2tp_net_ops
);
1931 destroy_workqueue(l2tp_wq
);
1936 module_init(l2tp_init
);
1937 module_exit(l2tp_exit
);
1939 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1940 MODULE_DESCRIPTION("L2TP core");
1941 MODULE_LICENSE("GPL");
1942 MODULE_VERSION(L2TP_DRV_VERSION
);