net/l2tp/l2tp_core.c

   1 /*
   2  * L2TP core.
   3  *
   4  * Copyright (c) 2008,2009,2010 Katalix Systems Ltd
   5  *
   6  * This file contains some code of the original L2TPv2 pppol2tp
   7  * driver, which has the following copyright:
   8  *
   9  * Authors:     Martijn van Oosterhout <kleptog@svana.org>
  10  *              James Chapman (jchapman@katalix.com)
  11  * Contributors:
  12  *              Michal Ostrowski <mostrows@speakeasy.net>
  13  *              Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
  14  *              David S. Miller (davem@redhat.com)
  15  *
  16  * This program is free software; you can redistribute it and/or modify
  17  * it under the terms of the GNU General Public License version 2 as
  18  * published by the Free Software Foundation.
  19  */
  20
  21 #include <linux/module.h>
  22 #include <linux/string.h>
  23 #include <linux/list.h>
  24 #include <linux/uaccess.h>
  25
  26 #include <linux/kernel.h>
  27 #include <linux/spinlock.h>
  28 #include <linux/kthread.h>
  29 #include <linux/sched.h>
  30 #include <linux/slab.h>
  31 #include <linux/errno.h>
  32 #include <linux/jiffies.h>
  33
  34 #include <linux/netdevice.h>
  35 #include <linux/net.h>
  36 #include <linux/inetdevice.h>
  37 #include <linux/skbuff.h>
  38 #include <linux/init.h>
  39 #include <linux/ip.h>
  40 #include <linux/udp.h>
  41 #include <linux/hash.h>
  42 #include <linux/sort.h>
  43 #include <linux/file.h>
  44 #include <linux/nsproxy.h>
  45 #include <net/net_namespace.h>
  46 #include <net/netns/generic.h>
  47 #include <net/dst.h>
  48 #include <net/ip.h>
  49 #include <net/udp.h>
  50 #include <net/xfrm.h>
  51
  52 #include <asm/byteorder.h>
  53 #include <asm/atomic.h>
  54
  55 #include "l2tp_core.h"
  56
  57 #define L2TP_DRV_VERSION        "V2.0"
  58
  59 /* L2TP header constants */
  60 #define L2TP_HDRFLAG_T     0x8000
  61 #define L2TP_HDRFLAG_L     0x4000
  62 #define L2TP_HDRFLAG_S     0x0800
  63 #define L2TP_HDRFLAG_O     0x0200
  64 #define L2TP_HDRFLAG_P     0x0100
  65
  66 #define L2TP_HDR_VER_MASK  0x000F
  67 #define L2TP_HDR_VER_2     0x0002
  68 #define L2TP_HDR_VER_3     0x0003
  69
  70 /* L2TPv3 default L2-specific sublayer */
  71 #define L2TP_SLFLAG_S      0x40000000
  72 #define L2TP_SL_SEQ_MASK   0x00ffffff
  73
  74 #define L2TP_HDR_SIZE_SEQ               10
  75 #define L2TP_HDR_SIZE_NOSEQ             6
  76
  77 /* Default trace flags */
  78 #define L2TP_DEFAULT_DEBUG_FLAGS        0
  79
  80 #define PRINTK(_mask, _type, _lvl, _fmt, args...)                       \
  81         do {                                                            \
  82                 if ((_mask) & (_type))                                  \
  83                         printk(_lvl "L2TP: " _fmt, ##args);             \
  84         } while (0)
  85
  86 /* Private data stored for received packets in the skb.
  87  */
  88 struct l2tp_skb_cb {
  89         u32                     ns;
  90         u16                     has_seq;
  91         u16                     length;
  92         unsigned long           expires;
  93 };
  94
  95 #define L2TP_SKB_CB(skb)        ((struct l2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])
  96
  97 static atomic_t l2tp_tunnel_count;
  98 static atomic_t l2tp_session_count;
  99
 100 /* per-net private data for this module */
 101 static unsigned int l2tp_net_id;
 102 struct l2tp_net {
 103         struct list_head l2tp_tunnel_list;
 104         rwlock_t l2tp_tunnel_list_lock;
 105         struct hlist_head l2tp_session_hlist[L2TP_HASH_SIZE_2];
 106         rwlock_t l2tp_session_hlist_lock;
 107 };
 108
 109 static inline struct l2tp_net *l2tp_pernet(struct net *net)
 110 {
 111         BUG_ON(!net);
 112
 113         return net_generic(net, l2tp_net_id);
 114 }
 115
 116 /* Session hash global list for L2TPv3.
 117  * The session_id SHOULD be random according to RFC3931, but several
 118  * L2TP implementations use incrementing session_ids.  So we do a real
 119  * hash on the session_id, rather than a simple bitmask.
 120  */
 121 static inline struct hlist_head *
 122 l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
 123 {
 124         return &pn->l2tp_session_hlist[hash_32(session_id, L2TP_HASH_BITS_2)];
 125
 126 }
 127
 128 /* Lookup a session by id in the global session list
 129  */
 130 static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
 131 {
 132         struct l2tp_net *pn = l2tp_pernet(net);
 133         struct hlist_head *session_list =
 134                 l2tp_session_id_hash_2(pn, session_id);
 135         struct l2tp_session *session;
 136         struct hlist_node *walk;
 137
 138         read_lock_bh(&pn->l2tp_session_hlist_lock);
 139         hlist_for_each_entry(session, walk, session_list, global_hlist) {
 140                 if (session->session_id == session_id) {
 141                         read_unlock_bh(&pn->l2tp_session_hlist_lock);
 142                         return session;
 143                 }
 144         }
 145         read_unlock_bh(&pn->l2tp_session_hlist_lock);
 146
 147         return NULL;
 148 }
 149
 150 /* Session hash list.
 151  * The session_id SHOULD be random according to RFC2661, but several
 152  * L2TP implementations (Cisco and Microsoft) use incrementing
 153  * session_ids.  So we do a real hash on the session_id, rather than a
 154  * simple bitmask.
 155  */
 156 static inline struct hlist_head *
 157 l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id)
 158 {
 159         return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)];
 160 }
 161
 162 /* Lookup a session by id
 163  */
 164 struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id)
 165 {
 166         struct hlist_head *session_list;
 167         struct l2tp_session *session;
 168         struct hlist_node *walk;
 169
 170         /* In L2TPv3, session_ids are unique over all tunnels and we
 171          * sometimes need to look them up before we know the
 172          * tunnel.
 173          */
 174         if (tunnel == NULL)
 175                 return l2tp_session_find_2(net, session_id);
 176
 177         session_list = l2tp_session_id_hash(tunnel, session_id);
 178         read_lock_bh(&tunnel->hlist_lock);
 179         hlist_for_each_entry(session, walk, session_list, hlist) {
 180                 if (session->session_id == session_id) {
 181                         read_unlock_bh(&tunnel->hlist_lock);
 182                         return session;
 183                 }
 184         }
 185         read_unlock_bh(&tunnel->hlist_lock);
 186
 187         return NULL;
 188 }
 189 EXPORT_SYMBOL_GPL(l2tp_session_find);
 190
 191 struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
 192 {
 193         int hash;
 194         struct hlist_node *walk;
 195         struct l2tp_session *session;
 196         int count = 0;
 197
 198         read_lock_bh(&tunnel->hlist_lock);
 199         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
 200                 hlist_for_each_entry(session, walk, &tunnel->session_hlist[hash], hlist) {
 201                         if (++count > nth) {
 202                                 read_unlock_bh(&tunnel->hlist_lock);
 203                                 return session;
 204                         }
 205                 }
 206         }
 207
 208         read_unlock_bh(&tunnel->hlist_lock);
 209
 210         return NULL;
 211 }
 212 EXPORT_SYMBOL_GPL(l2tp_session_find_nth);
 213
 214 /* Lookup a tunnel by id
 215  */
 216 struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id)
 217 {
 218         struct l2tp_tunnel *tunnel;
 219         struct l2tp_net *pn = l2tp_pernet(net);
 220
 221         read_lock_bh(&pn->l2tp_tunnel_list_lock);
 222         list_for_each_entry(tunnel, &pn->l2tp_tunnel_list, list) {
 223                 if (tunnel->tunnel_id == tunnel_id) {
 224                         read_unlock_bh(&pn->l2tp_tunnel_list_lock);
 225                         return tunnel;
 226                 }
 227         }
 228         read_unlock_bh(&pn->l2tp_tunnel_list_lock);
 229
 230         return NULL;
 231 }
 232 EXPORT_SYMBOL_GPL(l2tp_tunnel_find);
 233
 234 struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth)
 235 {
 236         struct l2tp_net *pn = l2tp_pernet(net);
 237         struct l2tp_tunnel *tunnel;
 238         int count = 0;
 239
 240         read_lock_bh(&pn->l2tp_tunnel_list_lock);
 241         list_for_each_entry(tunnel, &pn->l2tp_tunnel_list, list) {
 242                 if (++count > nth) {
 243                         read_unlock_bh(&pn->l2tp_tunnel_list_lock);
 244                         return tunnel;
 245                 }
 246         }
 247
 248         read_unlock_bh(&pn->l2tp_tunnel_list_lock);
 249
 250         return NULL;
 251 }
 252 EXPORT_SYMBOL_GPL(l2tp_tunnel_find_nth);
 253
 254 /*****************************************************************************
 255  * Receive data handling
 256  *****************************************************************************/
 257
 258 /* Queue a skb in order. We come here only if the skb has an L2TP sequence
 259  * number.
 260  */
 261 static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)
 262 {
 263         struct sk_buff *skbp;
 264         struct sk_buff *tmp;
 265         u32 ns = L2TP_SKB_CB(skb)->ns;
 266
 267         spin_lock_bh(&session->reorder_q.lock);
 268         skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
 269                 if (L2TP_SKB_CB(skbp)->ns > ns) {
 270                         __skb_queue_before(&session->reorder_q, skbp, skb);
 271                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 272                                "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
 273                                session->name, ns, L2TP_SKB_CB(skbp)->ns,
 274                                skb_queue_len(&session->reorder_q));
 275                         session->stats.rx_oos_packets++;
 276                         goto out;
 277                 }
 278         }
 279
 280         __skb_queue_tail(&session->reorder_q, skb);
 281
 282 out:
 283         spin_unlock_bh(&session->reorder_q.lock);
 284 }
 285
 286 /* Dequeue a single skb.
 287  */
 288 static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)
 289 {
 290         struct l2tp_tunnel *tunnel = session->tunnel;
 291         int length = L2TP_SKB_CB(skb)->length;
 292
 293         /* We're about to requeue the skb, so return resources
 294          * to its current owner (a socket receive buffer).
 295          */
 296         skb_orphan(skb);
 297
 298         tunnel->stats.rx_packets++;
 299         tunnel->stats.rx_bytes += length;
 300         session->stats.rx_packets++;
 301         session->stats.rx_bytes += length;
 302
 303         if (L2TP_SKB_CB(skb)->has_seq) {
 304                 /* Bump our Nr */
 305                 session->nr++;
 306                 if (tunnel->version == L2TP_HDR_VER_2)
 307                         session->nr &= 0xffff;
 308                 else
 309                         session->nr &= 0xffffff;
 310
 311                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 312                        "%s: updated nr to %hu\n", session->name, session->nr);
 313         }
 314
 315         /* call private receive handler */
 316         if (session->recv_skb != NULL)
 317                 (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);
 318         else
 319                 kfree_skb(skb);
 320
 321         if (session->deref)
 322                 (*session->deref)(session);
 323 }
 324
 325 /* Dequeue skbs from the session's reorder_q, subject to packet order.
 326  * Skbs that have been in the queue for too long are simply discarded.
 327  */
 328 static void l2tp_recv_dequeue(struct l2tp_session *session)
 329 {
 330         struct sk_buff *skb;
 331         struct sk_buff *tmp;
 332
 333         /* If the pkt at the head of the queue has the nr that we
 334          * expect to send up next, dequeue it and any other
 335          * in-sequence packets behind it.
 336          */
 337         spin_lock_bh(&session->reorder_q.lock);
 338         skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
 339                 if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) {
 340                         session->stats.rx_seq_discards++;
 341                         session->stats.rx_errors++;
 342                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 343                                "%s: oos pkt %u len %d discarded (too old), "
 344                                "waiting for %u, reorder_q_len=%d\n",
 345                                session->name, L2TP_SKB_CB(skb)->ns,
 346                                L2TP_SKB_CB(skb)->length, session->nr,
 347                                skb_queue_len(&session->reorder_q));
 348                         __skb_unlink(skb, &session->reorder_q);
 349                         kfree_skb(skb);
 350                         if (session->deref)
 351                                 (*session->deref)(session);
 352                         continue;
 353                 }
 354
 355                 if (L2TP_SKB_CB(skb)->has_seq) {
 356                         if (L2TP_SKB_CB(skb)->ns != session->nr) {
 357                                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 358                                        "%s: holding oos pkt %u len %d, "
 359                                        "waiting for %u, reorder_q_len=%d\n",
 360                                        session->name, L2TP_SKB_CB(skb)->ns,
 361                                        L2TP_SKB_CB(skb)->length, session->nr,
 362                                        skb_queue_len(&session->reorder_q));
 363                                 goto out;
 364                         }
 365                 }
 366                 __skb_unlink(skb, &session->reorder_q);
 367
 368                 /* Process the skb. We release the queue lock while we
 369                  * do so to let other contexts process the queue.
 370                  */
 371                 spin_unlock_bh(&session->reorder_q.lock);
 372                 l2tp_recv_dequeue_skb(session, skb);
 373                 spin_lock_bh(&session->reorder_q.lock);
 374         }
 375
 376 out:
 377         spin_unlock_bh(&session->reorder_q.lock);
 378 }
 379
 380 static inline int l2tp_verify_udp_checksum(struct sock *sk,
 381                                            struct sk_buff *skb)
 382 {
 383         struct udphdr *uh = udp_hdr(skb);
 384         u16 ulen = ntohs(uh->len);
 385         struct inet_sock *inet;
 386         __wsum psum;
 387
 388         if (sk->sk_no_check || skb_csum_unnecessary(skb) || !uh->check)
 389                 return 0;
 390
 391         inet = inet_sk(sk);
 392         psum = csum_tcpudp_nofold(inet->inet_saddr, inet->inet_daddr, ulen,
 393                                   IPPROTO_UDP, 0);
 394
 395         if ((skb->ip_summed == CHECKSUM_COMPLETE) &&
 396             !csum_fold(csum_add(psum, skb->csum)))
 397                 return 0;
 398
 399         skb->csum = psum;
 400
 401         return __skb_checksum_complete(skb);
 402 }
 403
 404 /* Do receive processing of L2TP data frames. We handle both L2TPv2
 405  * and L2TPv3 data frames here.
 406  *
 407  * L2TPv2 Data Message Header
 408  *
 409  *  0                   1                   2                   3
 410  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 411  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 412  * |T|L|x|x|S|x|O|P|x|x|x|x|  Ver  |          Length (opt)         |
 413  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 414  * |           Tunnel ID           |           Session ID          |
 415  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 416  * |             Ns (opt)          |             Nr (opt)          |
 417  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 418  * |      Offset Size (opt)        |    Offset pad... (opt)
 419  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 420  *
 421  * Data frames are marked by T=0. All other fields are the same as
 422  * those in L2TP control frames.
 423  *
 424  * L2TPv3 Data Message Header
 425  *
 426  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 427  * |                      L2TP Session Header                      |
 428  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 429  * |                      L2-Specific Sublayer                     |
 430  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 431  * |                        Tunnel Payload                      ...
 432  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 433  *
 434  * L2TPv3 Session Header Over IP
 435  *
 436  *  0                   1                   2                   3
 437  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 438  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 439  * |                           Session ID                          |
 440  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 441  * |               Cookie (optional, maximum 64 bits)...
 442  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 443  *                                                                 |
 444  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 445  *
 446  * L2TPv3 L2-Specific Sublayer Format
 447  *
 448  *  0                   1                   2                   3
 449  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 450  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 451  * |x|S|x|x|x|x|x|x|              Sequence Number                  |
 452  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 453  *
 454  * Cookie value, sublayer format and offset (pad) are negotiated with
 455  * the peer when the session is set up. Unlike L2TPv2, we do not need
 456  * to parse the packet header to determine if optional fields are
 457  * present.
 458  *
 459  * Caller must already have parsed the frame and determined that it is
 460  * a data (not control) frame before coming here. Fields up to the
 461  * session-id have already been parsed and ptr points to the data
 462  * after the session-id.
 463  */
 464 void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
 465                       unsigned char *ptr, unsigned char *optr, u16 hdrflags,
 466                       int length, int (*payload_hook)(struct sk_buff *skb))
 467 {
 468         struct l2tp_tunnel *tunnel = session->tunnel;
 469         int offset;
 470         u32 ns, nr;
 471
 472         /* The ref count is increased since we now hold a pointer to
 473          * the session. Take care to decrement the refcnt when exiting
 474          * this function from now on...
 475          */
 476         l2tp_session_inc_refcount(session);
 477         if (session->ref)
 478                 (*session->ref)(session);
 479
 480         /* Parse and check optional cookie */
 481         if (session->peer_cookie_len > 0) {
 482                 if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
 483                         PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
 484                                "%s: cookie mismatch (%u/%u). Discarding.\n",
 485                                tunnel->name, tunnel->tunnel_id, session->session_id);
 486                         session->stats.rx_cookie_discards++;
 487                         goto discard;
 488                 }
 489                 ptr += session->peer_cookie_len;
 490         }
 491
 492         /* Handle the optional sequence numbers. Sequence numbers are
 493          * in different places for L2TPv2 and L2TPv3.
 494          *
 495          * If we are the LAC, enable/disable sequence numbers under
 496          * the control of the LNS.  If no sequence numbers present but
 497          * we were expecting them, discard frame.
 498          */
 499         ns = nr = 0;
 500         L2TP_SKB_CB(skb)->has_seq = 0;
 501         if (tunnel->version == L2TP_HDR_VER_2) {
 502                 if (hdrflags & L2TP_HDRFLAG_S) {
 503                         ns = ntohs(*(__be16 *) ptr);
 504                         ptr += 2;
 505                         nr = ntohs(*(__be16 *) ptr);
 506                         ptr += 2;
 507
 508                         /* Store L2TP info in the skb */
 509                         L2TP_SKB_CB(skb)->ns = ns;
 510                         L2TP_SKB_CB(skb)->has_seq = 1;
 511
 512                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 513                                "%s: recv data ns=%u, nr=%u, session nr=%u\n",
 514                                session->name, ns, nr, session->nr);
 515                 }
 516         } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
 517                 u32 l2h = ntohl(*(__be32 *) ptr);
 518
 519                 if (l2h & 0x40000000) {
 520                         ns = l2h & 0x00ffffff;
 521
 522                         /* Store L2TP info in the skb */
 523                         L2TP_SKB_CB(skb)->ns = ns;
 524                         L2TP_SKB_CB(skb)->has_seq = 1;
 525
 526                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 527                                "%s: recv data ns=%u, session nr=%u\n",
 528                                session->name, ns, session->nr);
 529                 }
 530         }
 531
 532         /* Advance past L2-specific header, if present */
 533         ptr += session->l2specific_len;
 534
 535         if (L2TP_SKB_CB(skb)->has_seq) {
 536                 /* Received a packet with sequence numbers. If we're the LNS,
 537                  * check if we sre sending sequence numbers and if not,
 538                  * configure it so.
 539                  */
 540                 if ((!session->lns_mode) && (!session->send_seq)) {
 541                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_INFO,
 542                                "%s: requested to enable seq numbers by LNS\n",
 543                                session->name);
 544                         session->send_seq = -1;
 545                         l2tp_session_set_header_len(session, tunnel->version);
 546                 }
 547         } else {
 548                 /* No sequence numbers.
 549                  * If user has configured mandatory sequence numbers, discard.
 550                  */
 551                 if (session->recv_seq) {
 552                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_WARNING,
 553                                "%s: recv data has no seq numbers when required. "
 554                                "Discarding\n", session->name);
 555                         session->stats.rx_seq_discards++;
 556                         goto discard;
 557                 }
 558
 559                 /* If we're the LAC and we're sending sequence numbers, the
 560                  * LNS has requested that we no longer send sequence numbers.
 561                  * If we're the LNS and we're sending sequence numbers, the
 562                  * LAC is broken. Discard the frame.
 563                  */
 564                 if ((!session->lns_mode) && (session->send_seq)) {
 565                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_INFO,
 566                                "%s: requested to disable seq numbers by LNS\n",
 567                                session->name);
 568                         session->send_seq = 0;
 569                         l2tp_session_set_header_len(session, tunnel->version);
 570                 } else if (session->send_seq) {
 571                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_WARNING,
 572                                "%s: recv data has no seq numbers when required. "
 573                                "Discarding\n", session->name);
 574                         session->stats.rx_seq_discards++;
 575                         goto discard;
 576                 }
 577         }
 578
 579         /* Session data offset is handled differently for L2TPv2 and
 580          * L2TPv3. For L2TPv2, there is an optional 16-bit value in
 581          * the header. For L2TPv3, the offset is negotiated using AVPs
 582          * in the session setup control protocol.
 583          */
 584         if (tunnel->version == L2TP_HDR_VER_2) {
 585                 /* If offset bit set, skip it. */
 586                 if (hdrflags & L2TP_HDRFLAG_O) {
 587                         offset = ntohs(*(__be16 *)ptr);
 588                         ptr += 2 + offset;
 589                 }
 590         } else
 591                 ptr += session->offset;
 592
 593         offset = ptr - optr;
 594         if (!pskb_may_pull(skb, offset))
 595                 goto discard;
 596
 597         __skb_pull(skb, offset);
 598
 599         /* If caller wants to process the payload before we queue the
 600          * packet, do so now.
 601          */
 602         if (payload_hook)
 603                 if ((*payload_hook)(skb))
 604                         goto discard;
 605
 606         /* Prepare skb for adding to the session's reorder_q.  Hold
 607          * packets for max reorder_timeout or 1 second if not
 608          * reordering.
 609          */
 610         L2TP_SKB_CB(skb)->length = length;
 611         L2TP_SKB_CB(skb)->expires = jiffies +
 612                 (session->reorder_timeout ? session->reorder_timeout : HZ);
 613
 614         /* Add packet to the session's receive queue. Reordering is done here, if
 615          * enabled. Saved L2TP protocol info is stored in skb->sb[].
 616          */
 617         if (L2TP_SKB_CB(skb)->has_seq) {
 618                 if (session->reorder_timeout != 0) {
 619                         /* Packet reordering enabled. Add skb to session's
 620                          * reorder queue, in order of ns.
 621                          */
 622                         l2tp_recv_queue_skb(session, skb);
 623                 } else {
 624                         /* Packet reordering disabled. Discard out-of-sequence
 625                          * packets
 626                          */
 627                         if (L2TP_SKB_CB(skb)->ns != session->nr) {
 628                                 session->stats.rx_seq_discards++;
 629                                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 630                                        "%s: oos pkt %u len %d discarded, "
 631                                        "waiting for %u, reorder_q_len=%d\n",
 632                                        session->name, L2TP_SKB_CB(skb)->ns,
 633                                        L2TP_SKB_CB(skb)->length, session->nr,
 634                                        skb_queue_len(&session->reorder_q));
 635                                 goto discard;
 636                         }
 637                         skb_queue_tail(&session->reorder_q, skb);
 638                 }
 639         } else {
 640                 /* No sequence numbers. Add the skb to the tail of the
 641                  * reorder queue. This ensures that it will be
 642                  * delivered after all previous sequenced skbs.
 643                  */
 644                 skb_queue_tail(&session->reorder_q, skb);
 645         }
 646
 647         /* Try to dequeue as many skbs from reorder_q as we can. */
 648         l2tp_recv_dequeue(session);
 649
 650         l2tp_session_dec_refcount(session);
 651
 652         return;
 653
 654 discard:
 655         session->stats.rx_errors++;
 656         kfree_skb(skb);
 657
 658         if (session->deref)
 659                 (*session->deref)(session);
 660
 661         l2tp_session_dec_refcount(session);
 662 }
 663 EXPORT_SYMBOL(l2tp_recv_common);
 664
 665 /* Internal UDP receive frame. Do the real work of receiving an L2TP data frame
 666  * here. The skb is not on a list when we get here.
 667  * Returns 0 if the packet was a data packet and was successfully passed on.
 668  * Returns 1 if the packet was not a good data packet and could not be
 669  * forwarded.  All such packets are passed up to userspace to deal with.
 670  */
 671 int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
 672                        int (*payload_hook)(struct sk_buff *skb))
 673 {
 674         struct l2tp_session *session = NULL;
 675         unsigned char *ptr, *optr;
 676         u16 hdrflags;
 677         u32 tunnel_id, session_id;
 678         int offset;
 679         u16 version;
 680         int length;
 681
 682         if (tunnel->sock && l2tp_verify_udp_checksum(tunnel->sock, skb))
 683                 goto discard_bad_csum;
 684
 685         /* UDP always verifies the packet length. */
 686         __skb_pull(skb, sizeof(struct udphdr));
 687
 688         /* Short packet? */
 689         if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) {
 690                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
 691                        "%s: recv short packet (len=%d)\n", tunnel->name, skb->len);
 692                 goto error;
 693         }
 694
 695         /* Point to L2TP header */
 696         optr = ptr = skb->data;
 697
 698         /* Trace packet contents, if enabled */
 699         if (tunnel->debug & L2TP_MSG_DATA) {
 700                 length = min(32u, skb->len);
 701                 if (!pskb_may_pull(skb, length))
 702                         goto error;
 703
 704                 printk(KERN_DEBUG "%s: recv: ", tunnel->name);
 705
 706                 offset = 0;
 707                 do {
 708                         printk(" %02X", ptr[offset]);
 709                 } while (++offset < length);
 710
 711                 printk("\n");
 712         }
 713
 714         /* Get L2TP header flags */
 715         hdrflags = ntohs(*(__be16 *) ptr);
 716
 717         /* Check protocol version */
 718         version = hdrflags & L2TP_HDR_VER_MASK;
 719         if (version != tunnel->version) {
 720                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
 721                        "%s: recv protocol version mismatch: got %d expected %d\n",
 722                        tunnel->name, version, tunnel->version);
 723                 goto error;
 724         }
 725
 726         /* Get length of L2TP packet */
 727         length = skb->len;
 728
 729         /* If type is control packet, it is handled by userspace. */
 730         if (hdrflags & L2TP_HDRFLAG_T) {
 731                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_DEBUG,
 732                        "%s: recv control packet, len=%d\n", tunnel->name, length);
 733                 goto error;
 734         }
 735
 736         /* Skip flags */
 737         ptr += 2;
 738
 739         if (tunnel->version == L2TP_HDR_VER_2) {
 740                 /* If length is present, skip it */
 741                 if (hdrflags & L2TP_HDRFLAG_L)
 742                         ptr += 2;
 743
 744                 /* Extract tunnel and session ID */
 745                 tunnel_id = ntohs(*(__be16 *) ptr);
 746                 ptr += 2;
 747                 session_id = ntohs(*(__be16 *) ptr);
 748                 ptr += 2;
 749         } else {
 750                 ptr += 2;       /* skip reserved bits */
 751                 tunnel_id = tunnel->tunnel_id;
 752                 session_id = ntohl(*(__be32 *) ptr);
 753                 ptr += 4;
 754         }
 755
 756         /* Find the session context */
 757         session = l2tp_session_find(tunnel->l2tp_net, tunnel, session_id);
 758         if (!session) {
 759                 /* Not found? Pass to userspace to deal with */
 760                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
 761                        "%s: no session found (%u/%u). Passing up.\n",
 762                        tunnel->name, tunnel_id, session_id);
 763                 goto error;
 764         }
 765
 766         l2tp_recv_common(session, skb, ptr, optr, hdrflags, length, payload_hook);
 767
 768         return 0;
 769
 770 discard_bad_csum:
 771         LIMIT_NETDEBUG("%s: UDP: bad checksum\n", tunnel->name);
 772         UDP_INC_STATS_USER(tunnel->l2tp_net, UDP_MIB_INERRORS, 0);
 773         tunnel->stats.rx_errors++;
 774         kfree_skb(skb);
 775
 776         return 0;
 777
 778 error:
 779         /* Put UDP header back */
 780         __skb_push(skb, sizeof(struct udphdr));
 781
 782         return 1;
 783 }
 784 EXPORT_SYMBOL_GPL(l2tp_udp_recv_core);
 785
 786 /* UDP encapsulation receive handler. See net/ipv4/udp.c.
 787  * Return codes:
 788  * 0 : success.
 789  * <0: error
 790  * >0: skb should be passed up to userspace as UDP.
 791  */
 792 int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
 793 {
 794         struct l2tp_tunnel *tunnel;
 795
 796         tunnel = l2tp_sock_to_tunnel(sk);
 797         if (tunnel == NULL)
 798                 goto pass_up;
 799
 800         PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_DEBUG,
 801                "%s: received %d bytes\n", tunnel->name, skb->len);
 802
 803         if (l2tp_udp_recv_core(tunnel, skb, tunnel->recv_payload_hook))
 804                 goto pass_up_put;
 805
 806         sock_put(sk);
 807         return 0;
 808
 809 pass_up_put:
 810         sock_put(sk);
 811 pass_up:
 812         return 1;
 813 }
 814 EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv);
 815
 816 /************************************************************************
 817  * Transmit handling
 818  ***********************************************************************/
 819
 820 /* Build an L2TP header for the session into the buffer provided.
 821  */
 822 static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
 823 {
 824         struct l2tp_tunnel *tunnel = session->tunnel;
 825         __be16 *bufp = buf;
 826         __be16 *optr = buf;
 827         u16 flags = L2TP_HDR_VER_2;
 828         u32 tunnel_id = tunnel->peer_tunnel_id;
 829         u32 session_id = session->peer_session_id;
 830
 831         if (session->send_seq)
 832                 flags |= L2TP_HDRFLAG_S;
 833
 834         /* Setup L2TP header. */
 835         *bufp++ = htons(flags);
 836         *bufp++ = htons(tunnel_id);
 837         *bufp++ = htons(session_id);
 838         if (session->send_seq) {
 839                 *bufp++ = htons(session->ns);
 840                 *bufp++ = 0;
 841                 session->ns++;
 842                 session->ns &= 0xffff;
 843                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 844                        "%s: updated ns to %u\n", session->name, session->ns);
 845         }
 846
 847         return bufp - optr;
 848 }
 849
 850 static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
 851 {
 852         char *bufp = buf;
 853         char *optr = bufp;
 854         u16 flags = L2TP_HDR_VER_3;
 855
 856         /* Setup L2TP header. */
 857         *((__be16 *) bufp) = htons(flags);
 858         bufp += 2;
 859         *((__be16 *) bufp) = 0;
 860         bufp += 2;
 861         *((__be32 *) bufp) = htonl(session->peer_session_id);
 862         bufp += 4;
 863         if (session->cookie_len) {
 864                 memcpy(bufp, &session->cookie[0], session->cookie_len);
 865                 bufp += session->cookie_len;
 866         }
 867         if (session->l2specific_len) {
 868                 if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
 869                         u32 l2h = 0;
 870                         if (session->send_seq) {
 871                                 l2h = 0x40000000 | session->ns;
 872                                 session->ns++;
 873                                 session->ns &= 0xffffff;
 874                                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 875                                        "%s: updated ns to %u\n", session->name, session->ns);
 876                         }
 877
 878                         *((__be32 *) bufp) = htonl(l2h);
 879                 }
 880                 bufp += session->l2specific_len;
 881         }
 882         if (session->offset)
 883                 bufp += session->offset;
 884
 885         return bufp - optr;
 886 }
 887
 888 int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, size_t data_len)
 889 {
 890         struct l2tp_tunnel *tunnel = session->tunnel;
 891         unsigned int len = skb->len;
 892         int error;
 893
 894         /* Debug */
 895         if (session->send_seq)
 896                 PRINTK(session->debug, L2TP_MSG_DATA, KERN_DEBUG,
 897                        "%s: send %Zd bytes, ns=%u\n", session->name,
 898                        data_len, session->ns - 1);
 899         else
 900                 PRINTK(session->debug, L2TP_MSG_DATA, KERN_DEBUG,
 901                        "%s: send %Zd bytes\n", session->name, data_len);
 902
 903         if (session->debug & L2TP_MSG_DATA) {
 904                 int i;
 905                 unsigned char *datap = skb->data + sizeof(struct udphdr);
 906
 907                 printk(KERN_DEBUG "%s: xmit:", session->name);
 908                 for (i = 0; i < (len - sizeof(struct udphdr)); i++) {
 909                         printk(" %02X", *datap++);
 910                         if (i == 31) {
 911                                 printk(" ...");
 912                                 break;
 913                         }
 914                 }
 915                 printk("\n");
 916         }
 917
 918         /* Queue the packet to IP for output */
 919         error = ip_queue_xmit(skb, 1);
 920
 921         /* Update stats */
 922         if (error >= 0) {
 923                 tunnel->stats.tx_packets++;
 924                 tunnel->stats.tx_bytes += len;
 925                 session->stats.tx_packets++;
 926                 session->stats.tx_bytes += len;
 927         } else {
 928                 tunnel->stats.tx_errors++;
 929                 session->stats.tx_errors++;
 930         }
 931
 932         return 0;
 933 }
 934 EXPORT_SYMBOL_GPL(l2tp_xmit_core);
 935
 936 /* Automatically called when the skb is freed.
 937  */
 938 static void l2tp_sock_wfree(struct sk_buff *skb)
 939 {
 940         sock_put(skb->sk);
 941 }
 942
 943 /* For data skbs that we transmit, we associate with the tunnel socket
 944  * but don't do accounting.
 945  */
 946 static inline void l2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
 947 {
 948         sock_hold(sk);
 949         skb->sk = sk;
 950         skb->destructor = l2tp_sock_wfree;
 951 }
 952
 953 /* If caller requires the skb to have a ppp header, the header must be
 954  * inserted in the skb data before calling this function.
 955  */
 956 int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len)
 957 {
 958         int data_len = skb->len;
 959         struct sock *sk = session->tunnel->sock;
 960         struct udphdr *uh;
 961         unsigned int udp_len;
 962         struct inet_sock *inet;
 963         __wsum csum;
 964         int old_headroom;
 965         int new_headroom;
 966         int headroom;
 967
 968         /* Check that there's enough headroom in the skb to insert IP,
 969          * UDP and L2TP headers. If not enough, expand it to
 970          * make room. Adjust truesize.
 971          */
 972         headroom = NET_SKB_PAD + sizeof(struct iphdr) +
 973                 sizeof(struct udphdr) + hdr_len;
 974         old_headroom = skb_headroom(skb);
 975         if (skb_cow_head(skb, headroom))
 976                 goto abort;
 977
 978         new_headroom = skb_headroom(skb);
 979         skb_orphan(skb);
 980         skb->truesize += new_headroom - old_headroom;
 981
 982         /* Setup L2TP header */
 983         session->build_header(session, __skb_push(skb, hdr_len));
 984         udp_len = sizeof(struct udphdr) + hdr_len + data_len;
 985
 986         /* Setup UDP header */
 987         inet = inet_sk(sk);
 988         __skb_push(skb, sizeof(*uh));
 989         skb_reset_transport_header(skb);
 990         uh = udp_hdr(skb);
 991         uh->source = inet->inet_sport;
 992         uh->dest = inet->inet_dport;
 993         uh->len = htons(udp_len);
 994         uh->check = 0;
 995
 996         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
 997         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
 998                               IPSKB_REROUTED);
 999         nf_reset(skb);
1000
1001         /* Get routing info from the tunnel socket */
1002         skb_dst_drop(skb);
1003         skb_dst_set(skb, dst_clone(__sk_dst_get(sk)));
1004         l2tp_skb_set_owner_w(skb, sk);
1005
1006         /* Calculate UDP checksum if configured to do so */
1007         if (sk->sk_no_check == UDP_CSUM_NOXMIT)
1008                 skb->ip_summed = CHECKSUM_NONE;
1009         else if ((skb_dst(skb) && skb_dst(skb)->dev) &&
1010                  (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM))) {
1011                 skb->ip_summed = CHECKSUM_COMPLETE;
1012                 csum = skb_checksum(skb, 0, udp_len, 0);
1013                 uh->check = csum_tcpudp_magic(inet->inet_saddr,
1014                                               inet->inet_daddr,
1015                                               udp_len, IPPROTO_UDP, csum);
1016                 if (uh->check == 0)
1017                         uh->check = CSUM_MANGLED_0;
1018         } else {
1019                 skb->ip_summed = CHECKSUM_PARTIAL;
1020                 skb->csum_start = skb_transport_header(skb) - skb->head;
1021                 skb->csum_offset = offsetof(struct udphdr, check);
1022                 uh->check = ~csum_tcpudp_magic(inet->inet_saddr,
1023                                                inet->inet_daddr,
1024                                                udp_len, IPPROTO_UDP, 0);
1025         }
1026
1027         l2tp_xmit_core(session, skb, data_len);
1028
1029 abort:
1030         return 0;
1031 }
1032 EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
1033
1034 /*****************************************************************************
1035  * Tinnel and session create/destroy.
1036  *****************************************************************************/
1037
1038 /* Tunnel socket destruct hook.
1039  * The tunnel context is deleted only when all session sockets have been
1040  * closed.
1041  */
1042 void l2tp_tunnel_destruct(struct sock *sk)
1043 {
1044         struct l2tp_tunnel *tunnel;
1045
1046         tunnel = sk->sk_user_data;
1047         if (tunnel == NULL)
1048                 goto end;
1049
1050         PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
1051                "%s: closing...\n", tunnel->name);
1052
1053         /* Close all sessions */
1054         l2tp_tunnel_closeall(tunnel);
1055
1056         /* No longer an encapsulation socket. See net/ipv4/udp.c */
1057         (udp_sk(sk))->encap_type = 0;
1058         (udp_sk(sk))->encap_rcv = NULL;
1059
1060         /* Remove hooks into tunnel socket */
1061         tunnel->sock = NULL;
1062         sk->sk_destruct = tunnel->old_sk_destruct;
1063         sk->sk_user_data = NULL;
1064
1065         /* Call the original destructor */
1066         if (sk->sk_destruct)
1067                 (*sk->sk_destruct)(sk);
1068
1069         /* We're finished with the socket */
1070         l2tp_tunnel_dec_refcount(tunnel);
1071
1072 end:
1073         return;
1074 }
1075 EXPORT_SYMBOL(l2tp_tunnel_destruct);
1076
1077 /* When the tunnel is closed, all the attached sessions need to go too.
1078  */
1079 void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
1080 {
1081         int hash;
1082         struct hlist_node *walk;
1083         struct hlist_node *tmp;
1084         struct l2tp_session *session;
1085
1086         BUG_ON(tunnel == NULL);
1087
1088         PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
1089                "%s: closing all sessions...\n", tunnel->name);
1090
1091         write_lock_bh(&tunnel->hlist_lock);
1092         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
1093 again:
1094                 hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
1095                         session = hlist_entry(walk, struct l2tp_session, hlist);
1096
1097                         PRINTK(session->debug, L2TP_MSG_CONTROL, KERN_INFO,
1098                                "%s: closing session\n", session->name);
1099
1100                         hlist_del_init(&session->hlist);
1101
1102                         /* Since we should hold the sock lock while
1103                          * doing any unbinding, we need to release the
1104                          * lock we're holding before taking that lock.
1105                          * Hold a reference to the sock so it doesn't
1106                          * disappear as we're jumping between locks.
1107                          */
1108                         if (session->ref != NULL)
1109                                 (*session->ref)(session);
1110
1111                         write_unlock_bh(&tunnel->hlist_lock);
1112
1113                         if (tunnel->version != L2TP_HDR_VER_2) {
1114                                 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1115
1116                                 write_lock_bh(&pn->l2tp_session_hlist_lock);
1117                                 hlist_del_init(&session->global_hlist);
1118                                 write_unlock_bh(&pn->l2tp_session_hlist_lock);
1119                         }
1120
1121                         if (session->session_close != NULL)
1122                                 (*session->session_close)(session);
1123
1124                         if (session->deref != NULL)
1125                                 (*session->deref)(session);
1126
1127                         write_lock_bh(&tunnel->hlist_lock);
1128
1129                         /* Now restart from the beginning of this hash
1130                          * chain.  We always remove a session from the
1131                          * list so we are guaranteed to make forward
1132                          * progress.
1133                          */
1134                         goto again;
1135                 }
1136         }
1137         write_unlock_bh(&tunnel->hlist_lock);
1138 }
1139 EXPORT_SYMBOL_GPL(l2tp_tunnel_closeall);
1140
1141 /* Really kill the tunnel.
1142  * Come here only when all sessions have been cleared from the tunnel.
1143  */
1144 void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
1145 {
1146         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1147
1148         BUG_ON(atomic_read(&tunnel->ref_count) != 0);
1149         BUG_ON(tunnel->sock != NULL);
1150
1151         PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
1152                "%s: free...\n", tunnel->name);
1153
1154         /* Remove from tunnel list */
1155         write_lock_bh(&pn->l2tp_tunnel_list_lock);
1156         list_del_init(&tunnel->list);
1157         write_unlock_bh(&pn->l2tp_tunnel_list_lock);
1158
1159         atomic_dec(&l2tp_tunnel_count);
1160         kfree(tunnel);
1161 }
1162 EXPORT_SYMBOL_GPL(l2tp_tunnel_free);
1163
1164 int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp)
1165 {
1166         struct l2tp_tunnel *tunnel = NULL;
1167         int err;
1168         struct socket *sock = NULL;
1169         struct sock *sk = NULL;
1170         struct l2tp_net *pn;
1171
1172         /* Get the tunnel socket from the fd, which was opened by
1173          * the userspace L2TP daemon.
1174          */
1175         err = -EBADF;
1176         sock = sockfd_lookup(fd, &err);
1177         if (!sock) {
1178                 printk(KERN_ERR "tunl %hu: sockfd_lookup(fd=%d) returned %d\n",
1179                        tunnel_id, fd, err);
1180                 goto err;
1181         }
1182
1183         sk = sock->sk;
1184
1185         /* Quick sanity checks */
1186         err = -EPROTONOSUPPORT;
1187         if (sk->sk_protocol != IPPROTO_UDP) {
1188                 printk(KERN_ERR "tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
1189                        tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
1190                 goto err;
1191         }
1192         err = -EAFNOSUPPORT;
1193         if (sock->ops->family != AF_INET) {
1194                 printk(KERN_ERR "tunl %hu: fd %d wrong family, got %d, expected %d\n",
1195                        tunnel_id, fd, sock->ops->family, AF_INET);
1196                 goto err;
1197         }
1198
1199         /* Check if this socket has already been prepped */
1200         tunnel = (struct l2tp_tunnel *)sk->sk_user_data;
1201         if (tunnel != NULL) {
1202                 /* This socket has already been prepped */
1203                 err = -EBUSY;
1204                 goto err;
1205         }
1206
1207         tunnel = kzalloc(sizeof(struct l2tp_tunnel), GFP_KERNEL);
1208         if (tunnel == NULL) {
1209                 err = -ENOMEM;
1210                 goto err;
1211         }
1212
1213         tunnel->version = version;
1214         tunnel->tunnel_id = tunnel_id;
1215         tunnel->peer_tunnel_id = peer_tunnel_id;
1216         tunnel->debug = L2TP_DEFAULT_DEBUG_FLAGS;
1217
1218         tunnel->magic = L2TP_TUNNEL_MAGIC;
1219         sprintf(&tunnel->name[0], "tunl %u", tunnel_id);
1220         rwlock_init(&tunnel->hlist_lock);
1221
1222         /* The net we belong to */
1223         tunnel->l2tp_net = net;
1224         pn = l2tp_pernet(net);
1225
1226         if (cfg)
1227                 tunnel->debug = cfg->debug;
1228
1229         /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
1230         udp_sk(sk)->encap_type = UDP_ENCAP_L2TPINUDP;
1231         udp_sk(sk)->encap_rcv = l2tp_udp_encap_recv;
1232
1233         sk->sk_user_data = tunnel;
1234
1235         /* Hook on the tunnel socket destructor so that we can cleanup
1236          * if the tunnel socket goes away.
1237          */
1238         tunnel->old_sk_destruct = sk->sk_destruct;
1239         sk->sk_destruct = &l2tp_tunnel_destruct;
1240         tunnel->sock = sk;
1241         sk->sk_allocation = GFP_ATOMIC;
1242
1243         /* Add tunnel to our list */
1244         INIT_LIST_HEAD(&tunnel->list);
1245         write_lock_bh(&pn->l2tp_tunnel_list_lock);
1246         list_add(&tunnel->list, &pn->l2tp_tunnel_list);
1247         write_unlock_bh(&pn->l2tp_tunnel_list_lock);
1248         atomic_inc(&l2tp_tunnel_count);
1249
1250         /* Bump the reference count. The tunnel context is deleted
1251          * only when this drops to zero.
1252          */
1253         l2tp_tunnel_inc_refcount(tunnel);
1254
1255         err = 0;
1256 err:
1257         if (tunnelp)
1258                 *tunnelp = tunnel;
1259
1260         if (sock)
1261                 sockfd_put(sock);
1262
1263         return err;
1264 }
1265 EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
1266
1267 /* Really kill the session.
1268  */
1269 void l2tp_session_free(struct l2tp_session *session)
1270 {
1271         struct l2tp_tunnel *tunnel;
1272
1273         BUG_ON(atomic_read(&session->ref_count) != 0);
1274
1275         tunnel = session->tunnel;
1276         if (tunnel != NULL) {
1277                 BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
1278
1279                 /* Delete the session from the hash */
1280                 write_lock_bh(&tunnel->hlist_lock);
1281                 hlist_del_init(&session->hlist);
1282                 write_unlock_bh(&tunnel->hlist_lock);
1283
1284                 /* Unlink from the global hash if not L2TPv2 */
1285                 if (tunnel->version != L2TP_HDR_VER_2) {
1286                         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1287
1288                         write_lock_bh(&pn->l2tp_session_hlist_lock);
1289                         hlist_del_init(&session->global_hlist);
1290                         write_unlock_bh(&pn->l2tp_session_hlist_lock);
1291                 }
1292
1293                 if (session->session_id != 0)
1294                         atomic_dec(&l2tp_session_count);
1295
1296                 sock_put(tunnel->sock);
1297
1298                 /* This will delete the tunnel context if this
1299                  * is the last session on the tunnel.
1300                  */
1301                 session->tunnel = NULL;
1302                 l2tp_tunnel_dec_refcount(tunnel);
1303         }
1304
1305         kfree(session);
1306
1307         return;
1308 }
1309 EXPORT_SYMBOL_GPL(l2tp_session_free);
1310
1311 /* We come here whenever a session's send_seq, cookie_len or
1312  * l2specific_len parameters are set.
1313  */
1314 void l2tp_session_set_header_len(struct l2tp_session *session, int version)
1315 {
1316         if (version == L2TP_HDR_VER_2) {
1317                 session->hdr_len = 6;
1318                 if (session->send_seq)
1319                         session->hdr_len += 4;
1320         } else {
1321                 session->hdr_len = 8 + session->cookie_len + session->l2specific_len + session->offset;
1322         }
1323
1324 }
1325 EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
1326
1327 struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
1328 {
1329         struct l2tp_session *session;
1330
1331         session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL);
1332         if (session != NULL) {
1333                 session->magic = L2TP_SESSION_MAGIC;
1334                 session->tunnel = tunnel;
1335
1336                 session->session_id = session_id;
1337                 session->peer_session_id = peer_session_id;
1338                 session->nr = 1;
1339
1340                 sprintf(&session->name[0], "sess %u/%u",
1341                         tunnel->tunnel_id, session->session_id);
1342
1343                 skb_queue_head_init(&session->reorder_q);
1344
1345                 INIT_HLIST_NODE(&session->hlist);
1346                 INIT_HLIST_NODE(&session->global_hlist);
1347
1348                 /* Inherit debug options from tunnel */
1349                 session->debug = tunnel->debug;
1350
1351                 if (cfg) {
1352                         session->pwtype = cfg->pw_type;
1353                         session->debug = cfg->debug;
1354                         session->mtu = cfg->mtu;
1355                         session->mru = cfg->mru;
1356                         session->send_seq = cfg->send_seq;
1357                         session->recv_seq = cfg->recv_seq;
1358                         session->lns_mode = cfg->lns_mode;
1359                         session->reorder_timeout = cfg->reorder_timeout;
1360                         session->offset = cfg->offset;
1361                         session->l2specific_type = cfg->l2specific_type;
1362                         session->l2specific_len = cfg->l2specific_len;
1363                         session->cookie_len = cfg->cookie_len;
1364                         memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);
1365                         session->peer_cookie_len = cfg->peer_cookie_len;
1366                         memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);
1367                 }
1368
1369                 if (tunnel->version == L2TP_HDR_VER_2)
1370                         session->build_header = l2tp_build_l2tpv2_header;
1371                 else
1372                         session->build_header = l2tp_build_l2tpv3_header;
1373
1374                 l2tp_session_set_header_len(session, tunnel->version);
1375
1376                 /* Bump the reference count. The session context is deleted
1377                  * only when this drops to zero.
1378                  */
1379                 l2tp_session_inc_refcount(session);
1380                 l2tp_tunnel_inc_refcount(tunnel);
1381
1382                 /* Ensure tunnel socket isn't deleted */
1383                 sock_hold(tunnel->sock);
1384
1385                 /* Add session to the tunnel's hash list */
1386                 write_lock_bh(&tunnel->hlist_lock);
1387                 hlist_add_head(&session->hlist,
1388                                l2tp_session_id_hash(tunnel, session_id));
1389                 write_unlock_bh(&tunnel->hlist_lock);
1390
1391                 /* And to the global session list if L2TPv3 */
1392                 if (tunnel->version != L2TP_HDR_VER_2) {
1393                         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1394
1395                         write_lock_bh(&pn->l2tp_session_hlist_lock);
1396                         hlist_add_head(&session->global_hlist,
1397                                        l2tp_session_id_hash_2(pn, session_id));
1398                         write_unlock_bh(&pn->l2tp_session_hlist_lock);
1399                 }
1400
1401                 /* Ignore management session in session count value */
1402                 if (session->session_id != 0)
1403                         atomic_inc(&l2tp_session_count);
1404         }
1405
1406         return session;
1407 }
1408 EXPORT_SYMBOL_GPL(l2tp_session_create);
1409
1410 /*****************************************************************************
1411  * Init and cleanup
1412  *****************************************************************************/
1413
1414 static __net_init int l2tp_init_net(struct net *net)
1415 {
1416         struct l2tp_net *pn;
1417         int err;
1418         int hash;
1419
1420         pn = kzalloc(sizeof(*pn), GFP_KERNEL);
1421         if (!pn)
1422                 return -ENOMEM;
1423
1424         INIT_LIST_HEAD(&pn->l2tp_tunnel_list);
1425         rwlock_init(&pn->l2tp_tunnel_list_lock);
1426
1427         for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
1428                 INIT_HLIST_HEAD(&pn->l2tp_session_hlist[hash]);
1429
1430         rwlock_init(&pn->l2tp_session_hlist_lock);
1431
1432         err = net_assign_generic(net, l2tp_net_id, pn);
1433         if (err)
1434                 goto out;
1435
1436         return 0;
1437
1438 out:
1439         kfree(pn);
1440         return err;
1441 }
1442
1443 static __net_exit void l2tp_exit_net(struct net *net)
1444 {
1445         struct l2tp_net *pn;
1446
1447         pn = net_generic(net, l2tp_net_id);
1448         /*
1449          * if someone has cached our net then
1450          * further net_generic call will return NULL
1451          */
1452         net_assign_generic(net, l2tp_net_id, NULL);
1453         kfree(pn);
1454 }
1455
1456 static struct pernet_operations l2tp_net_ops = {
1457         .init = l2tp_init_net,
1458         .exit = l2tp_exit_net,
1459         .id   = &l2tp_net_id,
1460         .size = sizeof(struct l2tp_net),
1461 };
1462
1463 static int __init l2tp_init(void)
1464 {
1465         int rc = 0;
1466
1467         rc = register_pernet_device(&l2tp_net_ops);
1468         if (rc)
1469                 goto out;
1470
1471         printk(KERN_INFO "L2TP core driver, %s\n", L2TP_DRV_VERSION);
1472
1473 out:
1474         return rc;
1475 }
1476
1477 static void __exit l2tp_exit(void)
1478 {
1479         unregister_pernet_device(&l2tp_net_ops);
1480 }
1481
1482 module_init(l2tp_init);
1483 module_exit(l2tp_exit);
1484
1485 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1486 MODULE_DESCRIPTION("L2TP core");
1487 MODULE_LICENSE("GPL");
1488 MODULE_VERSION(L2TP_DRV_VERSION);
1489