• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*****************************************************************************
2  * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets
3  *
4  * PPPoX    --- Generic PPP encapsulation socket family
5  * PPPoL2TP --- PPP over L2TP (RFC 2661)
6  *
7  * Version:	2.0.0
8  *
9  * Authors:	James Chapman (jchapman@katalix.com)
10  *
11  * Based on original work by Martijn van Oosterhout <kleptog@svana.org>
12  *
13  * License:
14  *		This program is free software; you can redistribute it and/or
15  *		modify it under the terms of the GNU General Public License
16  *		as published by the Free Software Foundation; either version
17  *		2 of the License, or (at your option) any later version.
18  *
19  */
20 
21 /* This driver handles only L2TP data frames; control frames are handled by a
22  * userspace application.
23  *
24  * To send data in an L2TP session, userspace opens a PPPoL2TP socket and
25  * attaches it to a bound UDP socket with local tunnel_id / session_id and
26  * peer tunnel_id / session_id set. Data can then be sent or received using
27  * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket
28  * can be read or modified using ioctl() or [gs]etsockopt() calls.
29  *
30  * When a PPPoL2TP socket is connected with local and peer session_id values
31  * zero, the socket is treated as a special tunnel management socket.
32  *
33  * Here's example userspace code to create a socket for sending/receiving data
34  * over an L2TP session:-
35  *
36  *	struct sockaddr_pppol2tp sax;
37  *	int fd;
38  *	int session_fd;
39  *
40  *	fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
41  *
42  *	sax.sa_family = AF_PPPOX;
43  *	sax.sa_protocol = PX_PROTO_OL2TP;
44  *	sax.pppol2tp.fd = tunnel_fd;	// bound UDP socket
45  *	sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr;
46  *	sax.pppol2tp.addr.sin_port = addr->sin_port;
47  *	sax.pppol2tp.addr.sin_family = AF_INET;
48  *	sax.pppol2tp.s_tunnel  = tunnel_id;
49  *	sax.pppol2tp.s_session = session_id;
50  *	sax.pppol2tp.d_tunnel  = peer_tunnel_id;
51  *	sax.pppol2tp.d_session = peer_session_id;
52  *
53  *	session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax));
54  *
55  * A pppd plugin that allows PPP traffic to be carried over L2TP using
56  * this driver is available from the OpenL2TP project at
57  * http://openl2tp.sourceforge.net.
58  */
59 
60 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
61 
62 #include <linux/module.h>
63 #include <linux/string.h>
64 #include <linux/list.h>
65 #include <linux/uaccess.h>
66 
67 #include <linux/kernel.h>
68 #include <linux/spinlock.h>
69 #include <linux/kthread.h>
70 #include <linux/sched.h>
71 #include <linux/slab.h>
72 #include <linux/errno.h>
73 #include <linux/jiffies.h>
74 
75 #include <linux/netdevice.h>
76 #include <linux/net.h>
77 #include <linux/inetdevice.h>
78 #include <linux/skbuff.h>
79 #include <linux/init.h>
80 #include <linux/ip.h>
81 #include <linux/udp.h>
82 #include <linux/if_pppox.h>
83 #include <linux/if_pppol2tp.h>
84 #include <net/sock.h>
85 #include <linux/ppp_channel.h>
86 #include <linux/ppp_defs.h>
87 #include <linux/ppp-ioctl.h>
88 #include <linux/file.h>
89 #include <linux/hash.h>
90 #include <linux/sort.h>
91 #include <linux/proc_fs.h>
92 #include <linux/l2tp.h>
93 #include <linux/nsproxy.h>
94 #include <net/net_namespace.h>
95 #include <net/netns/generic.h>
96 #include <net/dst.h>
97 #include <net/ip.h>
98 #include <net/udp.h>
99 #include <net/xfrm.h>
100 #include <net/inet_common.h>
101 
102 #include <asm/byteorder.h>
103 #include <linux/atomic.h>
104 
105 #include "l2tp_core.h"
106 
107 #define PPPOL2TP_DRV_VERSION	"V2.0"
108 
109 /* Space for UDP, L2TP and PPP headers */
110 #define PPPOL2TP_HEADER_OVERHEAD	40
111 
112 /* Number of bytes to build transmit L2TP headers.
113  * Unfortunately the size is different depending on whether sequence numbers
114  * are enabled.
115  */
116 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ		10
117 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ		6
118 
119 /* Private data of each session. This data lives at the end of struct
120  * l2tp_session, referenced via session->priv[].
121  */
122 struct pppol2tp_session {
123 	int			owner;		/* pid that opened the socket */
124 
125 	struct mutex		sk_lock;	/* Protects .sk */
126 	struct sock __rcu	*sk;		/* Pointer to the session
127 						 * PPPoX socket */
128 	struct sock		*__sk;		/* Copy of .sk, for cleanup */
129 	struct rcu_head		rcu;		/* For asynchronous release */
130 	struct sock		*tunnel_sock;	/* Pointer to the tunnel UDP
131 						 * socket */
132 	int			flags;		/* accessed by PPPIOCGFLAGS.
133 						 * Unused. */
134 };
135 
136 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);
137 
138 static const struct ppp_channel_ops pppol2tp_chan_ops = {
139 	.start_xmit =  pppol2tp_xmit,
140 };
141 
142 static const struct proto_ops pppol2tp_ops;
143 
144 /* Retrieves the pppol2tp socket associated to a session.
145  * A reference is held on the returned socket, so this function must be paired
146  * with sock_put().
147  */
pppol2tp_session_get_sock(struct l2tp_session * session)148 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session)
149 {
150 	struct pppol2tp_session *ps = l2tp_session_priv(session);
151 	struct sock *sk;
152 
153 	rcu_read_lock();
154 	sk = rcu_dereference(ps->sk);
155 	if (sk)
156 		sock_hold(sk);
157 	rcu_read_unlock();
158 
159 	return sk;
160 }
161 
162 /* Helpers to obtain tunnel/session contexts from sockets.
163  */
pppol2tp_sock_to_session(struct sock * sk)164 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk)
165 {
166 	struct l2tp_session *session;
167 
168 	if (sk == NULL)
169 		return NULL;
170 
171 	sock_hold(sk);
172 	session = (struct l2tp_session *)(sk->sk_user_data);
173 	if (session == NULL) {
174 		sock_put(sk);
175 		goto out;
176 	}
177 
178 	BUG_ON(session->magic != L2TP_SESSION_MAGIC);
179 
180 out:
181 	return session;
182 }
183 
184 /*****************************************************************************
185  * Receive data handling
186  *****************************************************************************/
187 
pppol2tp_recv_payload_hook(struct sk_buff * skb)188 static int pppol2tp_recv_payload_hook(struct sk_buff *skb)
189 {
190 	/* Skip PPP header, if present.	 In testing, Microsoft L2TP clients
191 	 * don't send the PPP header (PPP header compression enabled), but
192 	 * other clients can include the header. So we cope with both cases
193 	 * here. The PPP header is always FF03 when using L2TP.
194 	 *
195 	 * Note that skb->data[] isn't dereferenced from a u16 ptr here since
196 	 * the field may be unaligned.
197 	 */
198 	if (!pskb_may_pull(skb, 2))
199 		return 1;
200 
201 	if ((skb->data[0] == PPP_ALLSTATIONS) && (skb->data[1] == PPP_UI))
202 		skb_pull(skb, 2);
203 
204 	return 0;
205 }
206 
207 /* Receive message. This is the recvmsg for the PPPoL2TP socket.
208  */
pppol2tp_recvmsg(struct socket * sock,struct msghdr * msg,size_t len,int flags)209 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg,
210 			    size_t len, int flags)
211 {
212 	int err;
213 	struct sk_buff *skb;
214 	struct sock *sk = sock->sk;
215 
216 	err = -EIO;
217 	if (sk->sk_state & PPPOX_BOUND)
218 		goto end;
219 
220 	err = 0;
221 	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
222 				flags & MSG_DONTWAIT, &err);
223 	if (!skb)
224 		goto end;
225 
226 	if (len > skb->len)
227 		len = skb->len;
228 	else if (len < skb->len)
229 		msg->msg_flags |= MSG_TRUNC;
230 
231 	err = skb_copy_datagram_msg(skb, 0, msg, len);
232 	if (likely(err == 0))
233 		err = len;
234 
235 	kfree_skb(skb);
236 end:
237 	return err;
238 }
239 
pppol2tp_recv(struct l2tp_session * session,struct sk_buff * skb,int data_len)240 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len)
241 {
242 	struct pppol2tp_session *ps = l2tp_session_priv(session);
243 	struct sock *sk = NULL;
244 
245 	/* If the socket is bound, send it in to PPP's input queue. Otherwise
246 	 * queue it on the session socket.
247 	 */
248 	rcu_read_lock();
249 	sk = rcu_dereference(ps->sk);
250 	if (sk == NULL)
251 		goto no_sock;
252 
253 	if (sk->sk_state & PPPOX_BOUND) {
254 		struct pppox_sock *po;
255 		l2tp_dbg(session, L2TP_MSG_DATA,
256 			 "%s: recv %d byte data frame, passing to ppp\n",
257 			 session->name, data_len);
258 
259 		/* We need to forget all info related to the L2TP packet
260 		 * gathered in the skb as we are going to reuse the same
261 		 * skb for the inner packet.
262 		 * Namely we need to:
263 		 * - reset xfrm (IPSec) information as it applies to
264 		 *   the outer L2TP packet and not to the inner one
265 		 * - release the dst to force a route lookup on the inner
266 		 *   IP packet since skb->dst currently points to the dst
267 		 *   of the UDP tunnel
268 		 * - reset netfilter information as it doesn't apply
269 		 *   to the inner packet either
270 		 */
271 		secpath_reset(skb);
272 		skb_dst_drop(skb);
273 		nf_reset(skb);
274 
275 		po = pppox_sk(sk);
276 		ppp_input(&po->chan, skb);
277 	} else {
278 		l2tp_dbg(session, L2TP_MSG_DATA,
279 			 "%s: recv %d byte data frame, passing to L2TP socket\n",
280 			 session->name, data_len);
281 
282 		if (sock_queue_rcv_skb(sk, skb) < 0) {
283 			atomic_long_inc(&session->stats.rx_errors);
284 			kfree_skb(skb);
285 		}
286 	}
287 	rcu_read_unlock();
288 
289 	return;
290 
291 no_sock:
292 	rcu_read_unlock();
293 	l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name);
294 	kfree_skb(skb);
295 }
296 
297 /************************************************************************
298  * Transmit handling
299  ***********************************************************************/
300 
301 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket.  We come here
302  * when a user application does a sendmsg() on the session socket. L2TP and
303  * PPP headers must be inserted into the user's data.
304  */
pppol2tp_sendmsg(struct socket * sock,struct msghdr * m,size_t total_len)305 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
306 			    size_t total_len)
307 {
308 	struct sock *sk = sock->sk;
309 	struct sk_buff *skb;
310 	int error;
311 	struct l2tp_session *session;
312 	struct l2tp_tunnel *tunnel;
313 	struct pppol2tp_session *ps;
314 	int uhlen;
315 
316 	error = -ENOTCONN;
317 	if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
318 		goto error;
319 
320 	/* Get session and tunnel contexts */
321 	error = -EBADF;
322 	session = pppol2tp_sock_to_session(sk);
323 	if (session == NULL)
324 		goto error;
325 
326 	ps = l2tp_session_priv(session);
327 	tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
328 	if (tunnel == NULL)
329 		goto error_put_sess;
330 
331 	uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
332 
333 	/* Allocate a socket buffer */
334 	error = -ENOMEM;
335 	skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) +
336 			   uhlen + session->hdr_len +
337 			   2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
338 			   0, GFP_KERNEL);
339 	if (!skb)
340 		goto error_put_sess_tun;
341 
342 	/* Reserve space for headers. */
343 	skb_reserve(skb, NET_SKB_PAD);
344 	skb_reset_network_header(skb);
345 	skb_reserve(skb, sizeof(struct iphdr));
346 	skb_reset_transport_header(skb);
347 	skb_reserve(skb, uhlen);
348 
349 	/* Add PPP header */
350 	skb->data[0] = PPP_ALLSTATIONS;
351 	skb->data[1] = PPP_UI;
352 	skb_put(skb, 2);
353 
354 	/* Copy user data into skb */
355 	error = memcpy_from_msg(skb_put(skb, total_len), m, total_len);
356 	if (error < 0) {
357 		kfree_skb(skb);
358 		goto error_put_sess_tun;
359 	}
360 
361 	local_bh_disable();
362 	l2tp_xmit_skb(session, skb, session->hdr_len);
363 	local_bh_enable();
364 
365 	sock_put(ps->tunnel_sock);
366 	sock_put(sk);
367 
368 	return total_len;
369 
370 error_put_sess_tun:
371 	sock_put(ps->tunnel_sock);
372 error_put_sess:
373 	sock_put(sk);
374 error:
375 	return error;
376 }
377 
378 /* Transmit function called by generic PPP driver.  Sends PPP frame
379  * over PPPoL2TP socket.
380  *
381  * This is almost the same as pppol2tp_sendmsg(), but rather than
382  * being called with a msghdr from userspace, it is called with a skb
383  * from the kernel.
384  *
385  * The supplied skb from ppp doesn't have enough headroom for the
386  * insertion of L2TP, UDP and IP headers so we need to allocate more
387  * headroom in the skb. This will create a cloned skb. But we must be
388  * careful in the error case because the caller will expect to free
389  * the skb it supplied, not our cloned skb. So we take care to always
390  * leave the original skb unfreed if we return an error.
391  */
pppol2tp_xmit(struct ppp_channel * chan,struct sk_buff * skb)392 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
393 {
394 	struct sock *sk = (struct sock *) chan->private;
395 	struct sock *sk_tun;
396 	struct l2tp_session *session;
397 	struct l2tp_tunnel *tunnel;
398 	struct pppol2tp_session *ps;
399 	int uhlen, headroom;
400 
401 	if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
402 		goto abort;
403 
404 	/* Get session and tunnel contexts from the socket */
405 	session = pppol2tp_sock_to_session(sk);
406 	if (session == NULL)
407 		goto abort;
408 
409 	ps = l2tp_session_priv(session);
410 	sk_tun = ps->tunnel_sock;
411 	if (sk_tun == NULL)
412 		goto abort_put_sess;
413 	tunnel = l2tp_sock_to_tunnel(sk_tun);
414 	if (tunnel == NULL)
415 		goto abort_put_sess;
416 
417 	uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
418 	headroom = NET_SKB_PAD +
419 		   sizeof(struct iphdr) + /* IP header */
420 		   uhlen +		/* UDP header (if L2TP_ENCAPTYPE_UDP) */
421 		   session->hdr_len +	/* L2TP header */
422 		   2;			/* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
423 	if (skb_cow_head(skb, headroom))
424 		goto abort_put_sess_tun;
425 
426 	/* Setup PPP header */
427 	__skb_push(skb, 2);
428 	skb->data[0] = PPP_ALLSTATIONS;
429 	skb->data[1] = PPP_UI;
430 
431 	local_bh_disable();
432 	l2tp_xmit_skb(session, skb, session->hdr_len);
433 	local_bh_enable();
434 
435 	sock_put(sk_tun);
436 	sock_put(sk);
437 	return 1;
438 
439 abort_put_sess_tun:
440 	sock_put(sk_tun);
441 abort_put_sess:
442 	sock_put(sk);
443 abort:
444 	/* Free the original skb */
445 	kfree_skb(skb);
446 	return 1;
447 }
448 
449 /*****************************************************************************
450  * Session (and tunnel control) socket create/destroy.
451  *****************************************************************************/
452 
453 /* Called by l2tp_core when a session socket is being closed.
454  */
pppol2tp_session_close(struct l2tp_session * session)455 static void pppol2tp_session_close(struct l2tp_session *session)
456 {
457 	struct sock *sk;
458 
459 	BUG_ON(session->magic != L2TP_SESSION_MAGIC);
460 
461 	sk = pppol2tp_session_get_sock(session);
462 	if (sk) {
463 		if (sk->sk_socket)
464 			inet_shutdown(sk->sk_socket, SEND_SHUTDOWN);
465 		sock_put(sk);
466 	}
467 }
468 
469 /* Really kill the session socket. (Called from sock_put() if
470  * refcnt == 0.)
471  */
pppol2tp_session_destruct(struct sock * sk)472 static void pppol2tp_session_destruct(struct sock *sk)
473 {
474 	struct l2tp_session *session = sk->sk_user_data;
475 
476 	skb_queue_purge(&sk->sk_receive_queue);
477 	skb_queue_purge(&sk->sk_write_queue);
478 
479 	if (session) {
480 		sk->sk_user_data = NULL;
481 		BUG_ON(session->magic != L2TP_SESSION_MAGIC);
482 		l2tp_session_dec_refcount(session);
483 	}
484 }
485 
pppol2tp_put_sk(struct rcu_head * head)486 static void pppol2tp_put_sk(struct rcu_head *head)
487 {
488 	struct pppol2tp_session *ps;
489 
490 	ps = container_of(head, typeof(*ps), rcu);
491 	sock_put(ps->__sk);
492 }
493 
494 /* Called when the PPPoX socket (session) is closed.
495  */
pppol2tp_release(struct socket * sock)496 static int pppol2tp_release(struct socket *sock)
497 {
498 	struct sock *sk = sock->sk;
499 	struct l2tp_session *session;
500 	int error;
501 
502 	if (!sk)
503 		return 0;
504 
505 	error = -EBADF;
506 	lock_sock(sk);
507 	if (sock_flag(sk, SOCK_DEAD) != 0)
508 		goto error;
509 
510 	pppox_unbind_sock(sk);
511 
512 	/* Signal the death of the socket. */
513 	sk->sk_state = PPPOX_DEAD;
514 	sock_orphan(sk);
515 	sock->sk = NULL;
516 
517 	session = pppol2tp_sock_to_session(sk);
518 
519 	if (session != NULL) {
520 		struct pppol2tp_session *ps;
521 
522 		l2tp_session_delete(session);
523 
524 		ps = l2tp_session_priv(session);
525 		mutex_lock(&ps->sk_lock);
526 		ps->__sk = rcu_dereference_protected(ps->sk,
527 						     lockdep_is_held(&ps->sk_lock));
528 		RCU_INIT_POINTER(ps->sk, NULL);
529 		mutex_unlock(&ps->sk_lock);
530 		call_rcu(&ps->rcu, pppol2tp_put_sk);
531 
532 		/* Rely on the sock_put() call at the end of the function for
533 		 * dropping the reference held by pppol2tp_sock_to_session().
534 		 * The last reference will be dropped by pppol2tp_put_sk().
535 		 */
536 	}
537 	release_sock(sk);
538 
539 	/* This will delete the session context via
540 	 * pppol2tp_session_destruct() if the socket's refcnt drops to
541 	 * zero.
542 	 */
543 	sock_put(sk);
544 
545 	return 0;
546 
547 error:
548 	release_sock(sk);
549 	return error;
550 }
551 
552 static struct proto pppol2tp_sk_proto = {
553 	.name	  = "PPPOL2TP",
554 	.owner	  = THIS_MODULE,
555 	.obj_size = sizeof(struct pppox_sock),
556 };
557 
pppol2tp_backlog_recv(struct sock * sk,struct sk_buff * skb)558 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb)
559 {
560 	int rc;
561 
562 	rc = l2tp_udp_encap_recv(sk, skb);
563 	if (rc)
564 		kfree_skb(skb);
565 
566 	return NET_RX_SUCCESS;
567 }
568 
569 /* socket() handler. Initialize a new struct sock.
570  */
pppol2tp_create(struct net * net,struct socket * sock,int kern)571 static int pppol2tp_create(struct net *net, struct socket *sock, int kern)
572 {
573 	int error = -ENOMEM;
574 	struct sock *sk;
575 
576 	sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern);
577 	if (!sk)
578 		goto out;
579 
580 	sock_init_data(sock, sk);
581 
582 	sock->state  = SS_UNCONNECTED;
583 	sock->ops    = &pppol2tp_ops;
584 
585 	sk->sk_backlog_rcv = pppol2tp_backlog_recv;
586 	sk->sk_protocol	   = PX_PROTO_OL2TP;
587 	sk->sk_family	   = PF_PPPOX;
588 	sk->sk_state	   = PPPOX_NONE;
589 	sk->sk_type	   = SOCK_STREAM;
590 	sk->sk_destruct	   = pppol2tp_session_destruct;
591 
592 	error = 0;
593 
594 out:
595 	return error;
596 }
597 
598 #if defined(CONFIG_L2TP_DEBUGFS) || defined(CONFIG_L2TP_DEBUGFS_MODULE)
pppol2tp_show(struct seq_file * m,void * arg)599 static void pppol2tp_show(struct seq_file *m, void *arg)
600 {
601 	struct l2tp_session *session = arg;
602 	struct sock *sk;
603 
604 	sk = pppol2tp_session_get_sock(session);
605 	if (sk) {
606 		struct pppox_sock *po = pppox_sk(sk);
607 
608 		seq_printf(m, "   interface %s\n", ppp_dev_name(&po->chan));
609 		sock_put(sk);
610 	}
611 }
612 #endif
613 
pppol2tp_session_init(struct l2tp_session * session)614 static void pppol2tp_session_init(struct l2tp_session *session)
615 {
616 	struct pppol2tp_session *ps;
617 	struct dst_entry *dst;
618 
619 	session->recv_skb = pppol2tp_recv;
620 	session->session_close = pppol2tp_session_close;
621 #if defined(CONFIG_L2TP_DEBUGFS) || defined(CONFIG_L2TP_DEBUGFS_MODULE)
622 	session->show = pppol2tp_show;
623 #endif
624 
625 	ps = l2tp_session_priv(session);
626 	mutex_init(&ps->sk_lock);
627 	ps->tunnel_sock = session->tunnel->sock;
628 	ps->owner = current->pid;
629 
630 	/* If PMTU discovery was enabled, use the MTU that was discovered */
631 	dst = sk_dst_get(session->tunnel->sock);
632 	if (dst) {
633 		u32 pmtu = dst_mtu(dst);
634 
635 		if (pmtu) {
636 			session->mtu = pmtu - PPPOL2TP_HEADER_OVERHEAD;
637 			session->mru = pmtu - PPPOL2TP_HEADER_OVERHEAD;
638 		}
639 		dst_release(dst);
640 	}
641 }
642 
643 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
644  */
pppol2tp_connect(struct socket * sock,struct sockaddr * uservaddr,int sockaddr_len,int flags)645 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
646 			    int sockaddr_len, int flags)
647 {
648 	struct sock *sk = sock->sk;
649 	struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr;
650 	struct pppox_sock *po = pppox_sk(sk);
651 	struct l2tp_session *session = NULL;
652 	struct l2tp_tunnel *tunnel;
653 	struct pppol2tp_session *ps;
654 	struct l2tp_session_cfg cfg = { 0, };
655 	int error = 0;
656 	u32 tunnel_id, peer_tunnel_id;
657 	u32 session_id, peer_session_id;
658 	bool drop_refcnt = false;
659 	int ver = 2;
660 	int fd;
661 
662 	lock_sock(sk);
663 
664 	error = -EINVAL;
665 
666 	if (sockaddr_len != sizeof(struct sockaddr_pppol2tp) &&
667 	    sockaddr_len != sizeof(struct sockaddr_pppol2tpv3) &&
668 	    sockaddr_len != sizeof(struct sockaddr_pppol2tpin6) &&
669 	    sockaddr_len != sizeof(struct sockaddr_pppol2tpv3in6))
670 		goto end;
671 
672 	if (sp->sa_protocol != PX_PROTO_OL2TP)
673 		goto end;
674 
675 	/* Check for already bound sockets */
676 	error = -EBUSY;
677 	if (sk->sk_state & PPPOX_CONNECTED)
678 		goto end;
679 
680 	/* We don't supporting rebinding anyway */
681 	error = -EALREADY;
682 	if (sk->sk_user_data)
683 		goto end; /* socket is already attached */
684 
685 	/* Get params from socket address. Handle L2TPv2 and L2TPv3.
686 	 * This is nasty because there are different sockaddr_pppol2tp
687 	 * structs for L2TPv2, L2TPv3, over IPv4 and IPv6. We use
688 	 * the sockaddr size to determine which structure the caller
689 	 * is using.
690 	 */
691 	peer_tunnel_id = 0;
692 	if (sockaddr_len == sizeof(struct sockaddr_pppol2tp)) {
693 		fd = sp->pppol2tp.fd;
694 		tunnel_id = sp->pppol2tp.s_tunnel;
695 		peer_tunnel_id = sp->pppol2tp.d_tunnel;
696 		session_id = sp->pppol2tp.s_session;
697 		peer_session_id = sp->pppol2tp.d_session;
698 	} else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3)) {
699 		struct sockaddr_pppol2tpv3 *sp3 =
700 			(struct sockaddr_pppol2tpv3 *) sp;
701 		ver = 3;
702 		fd = sp3->pppol2tp.fd;
703 		tunnel_id = sp3->pppol2tp.s_tunnel;
704 		peer_tunnel_id = sp3->pppol2tp.d_tunnel;
705 		session_id = sp3->pppol2tp.s_session;
706 		peer_session_id = sp3->pppol2tp.d_session;
707 	} else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpin6)) {
708 		struct sockaddr_pppol2tpin6 *sp6 =
709 			(struct sockaddr_pppol2tpin6 *) sp;
710 		fd = sp6->pppol2tp.fd;
711 		tunnel_id = sp6->pppol2tp.s_tunnel;
712 		peer_tunnel_id = sp6->pppol2tp.d_tunnel;
713 		session_id = sp6->pppol2tp.s_session;
714 		peer_session_id = sp6->pppol2tp.d_session;
715 	} else if (sockaddr_len == sizeof(struct sockaddr_pppol2tpv3in6)) {
716 		struct sockaddr_pppol2tpv3in6 *sp6 =
717 			(struct sockaddr_pppol2tpv3in6 *) sp;
718 		ver = 3;
719 		fd = sp6->pppol2tp.fd;
720 		tunnel_id = sp6->pppol2tp.s_tunnel;
721 		peer_tunnel_id = sp6->pppol2tp.d_tunnel;
722 		session_id = sp6->pppol2tp.s_session;
723 		peer_session_id = sp6->pppol2tp.d_session;
724 	} else {
725 		error = -EINVAL;
726 		goto end; /* bad socket address */
727 	}
728 
729 	/* Don't bind if tunnel_id is 0 */
730 	error = -EINVAL;
731 	if (tunnel_id == 0)
732 		goto end;
733 
734 	tunnel = l2tp_tunnel_find(sock_net(sk), tunnel_id);
735 
736 	/* Special case: create tunnel context if session_id and
737 	 * peer_session_id is 0. Otherwise look up tunnel using supplied
738 	 * tunnel id.
739 	 */
740 	if ((session_id == 0) && (peer_session_id == 0)) {
741 		if (tunnel == NULL) {
742 			struct l2tp_tunnel_cfg tcfg = {
743 				.encap = L2TP_ENCAPTYPE_UDP,
744 				.debug = 0,
745 			};
746 			error = l2tp_tunnel_create(sock_net(sk), fd, ver, tunnel_id, peer_tunnel_id, &tcfg, &tunnel);
747 			if (error < 0)
748 				goto end;
749 		}
750 	} else {
751 		/* Error if we can't find the tunnel */
752 		error = -ENOENT;
753 		if (tunnel == NULL)
754 			goto end;
755 
756 		/* Error if socket is not prepped */
757 		if (tunnel->sock == NULL)
758 			goto end;
759 	}
760 
761 	if (tunnel->recv_payload_hook == NULL)
762 		tunnel->recv_payload_hook = pppol2tp_recv_payload_hook;
763 
764 	if (tunnel->peer_tunnel_id == 0)
765 		tunnel->peer_tunnel_id = peer_tunnel_id;
766 
767 	session = l2tp_session_get(sock_net(sk), tunnel, session_id, false);
768 	if (session) {
769 		drop_refcnt = true;
770 		ps = l2tp_session_priv(session);
771 
772 		/* Using a pre-existing session is fine as long as it hasn't
773 		 * been connected yet.
774 		 */
775 		mutex_lock(&ps->sk_lock);
776 		if (rcu_dereference_protected(ps->sk,
777 					      lockdep_is_held(&ps->sk_lock))) {
778 			mutex_unlock(&ps->sk_lock);
779 			error = -EEXIST;
780 			goto end;
781 		}
782 
783 		/* consistency checks */
784 		if (ps->tunnel_sock != tunnel->sock) {
785 			mutex_unlock(&ps->sk_lock);
786 			error = -EEXIST;
787 			goto end;
788 		}
789 	} else {
790 		/* Default MTU must allow space for UDP/L2TP/PPP headers */
791 		cfg.mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD;
792 		cfg.mru = cfg.mtu;
793 
794 		session = l2tp_session_create(sizeof(struct pppol2tp_session),
795 					      tunnel, session_id,
796 					      peer_session_id, &cfg);
797 		if (IS_ERR(session)) {
798 			error = PTR_ERR(session);
799 			goto end;
800 		}
801 
802 		pppol2tp_session_init(session);
803 		ps = l2tp_session_priv(session);
804 		l2tp_session_inc_refcount(session);
805 
806 		mutex_lock(&ps->sk_lock);
807 		error = l2tp_session_register(session, tunnel);
808 		if (error < 0) {
809 			mutex_unlock(&ps->sk_lock);
810 			kfree(session);
811 			goto end;
812 		}
813 		drop_refcnt = true;
814 	}
815 
816 	/* Special case: if source & dest session_id == 0x0000, this
817 	 * socket is being created to manage the tunnel. Just set up
818 	 * the internal context for use by ioctl() and sockopt()
819 	 * handlers.
820 	 */
821 	if ((session->session_id == 0) &&
822 	    (session->peer_session_id == 0)) {
823 		error = 0;
824 		goto out_no_ppp;
825 	}
826 
827 	/* The only header we need to worry about is the L2TP
828 	 * header. This size is different depending on whether
829 	 * sequence numbers are enabled for the data channel.
830 	 */
831 	po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
832 
833 	po->chan.private = sk;
834 	po->chan.ops	 = &pppol2tp_chan_ops;
835 	po->chan.mtu	 = session->mtu;
836 
837 	error = ppp_register_net_channel(sock_net(sk), &po->chan);
838 	if (error) {
839 		mutex_unlock(&ps->sk_lock);
840 		goto end;
841 	}
842 
843 out_no_ppp:
844 	/* This is how we get the session context from the socket. */
845 	sk->sk_user_data = session;
846 	rcu_assign_pointer(ps->sk, sk);
847 	mutex_unlock(&ps->sk_lock);
848 
849 	/* Keep the reference we've grabbed on the session: sk doesn't expect
850 	 * the session to disappear. pppol2tp_session_destruct() is responsible
851 	 * for dropping it.
852 	 */
853 	drop_refcnt = false;
854 
855 	sk->sk_state = PPPOX_CONNECTED;
856 	l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n",
857 		  session->name);
858 
859 end:
860 	if (drop_refcnt)
861 		l2tp_session_dec_refcount(session);
862 	release_sock(sk);
863 
864 	return error;
865 }
866 
867 #ifdef CONFIG_L2TP_V3
868 
869 /* Called when creating sessions via the netlink interface. */
pppol2tp_session_create(struct net * net,struct l2tp_tunnel * tunnel,u32 session_id,u32 peer_session_id,struct l2tp_session_cfg * cfg)870 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel,
871 				   u32 session_id, u32 peer_session_id,
872 				   struct l2tp_session_cfg *cfg)
873 {
874 	int error;
875 	struct l2tp_session *session;
876 
877 	/* Error if tunnel socket is not prepped */
878 	if (!tunnel->sock) {
879 		error = -ENOENT;
880 		goto err;
881 	}
882 
883 	/* Default MTU values. */
884 	if (cfg->mtu == 0)
885 		cfg->mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD;
886 	if (cfg->mru == 0)
887 		cfg->mru = cfg->mtu;
888 
889 	/* Allocate and initialize a new session context. */
890 	session = l2tp_session_create(sizeof(struct pppol2tp_session),
891 				      tunnel, session_id,
892 				      peer_session_id, cfg);
893 	if (IS_ERR(session)) {
894 		error = PTR_ERR(session);
895 		goto err;
896 	}
897 
898 	pppol2tp_session_init(session);
899 
900 	error = l2tp_session_register(session, tunnel);
901 	if (error < 0)
902 		goto err_sess;
903 
904 	return 0;
905 
906 err_sess:
907 	kfree(session);
908 err:
909 	return error;
910 }
911 
912 #endif /* CONFIG_L2TP_V3 */
913 
914 /* getname() support.
915  */
pppol2tp_getname(struct socket * sock,struct sockaddr * uaddr,int * usockaddr_len,int peer)916 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
917 			    int *usockaddr_len, int peer)
918 {
919 	int len = 0;
920 	int error = 0;
921 	struct l2tp_session *session;
922 	struct l2tp_tunnel *tunnel;
923 	struct sock *sk = sock->sk;
924 	struct inet_sock *inet;
925 	struct pppol2tp_session *pls;
926 
927 	error = -ENOTCONN;
928 	if (sk == NULL)
929 		goto end;
930 	if (sk->sk_state != PPPOX_CONNECTED)
931 		goto end;
932 
933 	error = -EBADF;
934 	session = pppol2tp_sock_to_session(sk);
935 	if (session == NULL)
936 		goto end;
937 
938 	pls = l2tp_session_priv(session);
939 	tunnel = l2tp_sock_to_tunnel(pls->tunnel_sock);
940 	if (tunnel == NULL)
941 		goto end_put_sess;
942 
943 	inet = inet_sk(tunnel->sock);
944 	if ((tunnel->version == 2) && (tunnel->sock->sk_family == AF_INET)) {
945 		struct sockaddr_pppol2tp sp;
946 		len = sizeof(sp);
947 		memset(&sp, 0, len);
948 		sp.sa_family	= AF_PPPOX;
949 		sp.sa_protocol	= PX_PROTO_OL2TP;
950 		sp.pppol2tp.fd  = tunnel->fd;
951 		sp.pppol2tp.pid = pls->owner;
952 		sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
953 		sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
954 		sp.pppol2tp.s_session = session->session_id;
955 		sp.pppol2tp.d_session = session->peer_session_id;
956 		sp.pppol2tp.addr.sin_family = AF_INET;
957 		sp.pppol2tp.addr.sin_port = inet->inet_dport;
958 		sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
959 		memcpy(uaddr, &sp, len);
960 #if IS_ENABLED(CONFIG_IPV6)
961 	} else if ((tunnel->version == 2) &&
962 		   (tunnel->sock->sk_family == AF_INET6)) {
963 		struct sockaddr_pppol2tpin6 sp;
964 
965 		len = sizeof(sp);
966 		memset(&sp, 0, len);
967 		sp.sa_family	= AF_PPPOX;
968 		sp.sa_protocol	= PX_PROTO_OL2TP;
969 		sp.pppol2tp.fd  = tunnel->fd;
970 		sp.pppol2tp.pid = pls->owner;
971 		sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
972 		sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
973 		sp.pppol2tp.s_session = session->session_id;
974 		sp.pppol2tp.d_session = session->peer_session_id;
975 		sp.pppol2tp.addr.sin6_family = AF_INET6;
976 		sp.pppol2tp.addr.sin6_port = inet->inet_dport;
977 		memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
978 		       sizeof(tunnel->sock->sk_v6_daddr));
979 		memcpy(uaddr, &sp, len);
980 	} else if ((tunnel->version == 3) &&
981 		   (tunnel->sock->sk_family == AF_INET6)) {
982 		struct sockaddr_pppol2tpv3in6 sp;
983 
984 		len = sizeof(sp);
985 		memset(&sp, 0, len);
986 		sp.sa_family	= AF_PPPOX;
987 		sp.sa_protocol	= PX_PROTO_OL2TP;
988 		sp.pppol2tp.fd  = tunnel->fd;
989 		sp.pppol2tp.pid = pls->owner;
990 		sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
991 		sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
992 		sp.pppol2tp.s_session = session->session_id;
993 		sp.pppol2tp.d_session = session->peer_session_id;
994 		sp.pppol2tp.addr.sin6_family = AF_INET6;
995 		sp.pppol2tp.addr.sin6_port = inet->inet_dport;
996 		memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
997 		       sizeof(tunnel->sock->sk_v6_daddr));
998 		memcpy(uaddr, &sp, len);
999 #endif
1000 	} else if (tunnel->version == 3) {
1001 		struct sockaddr_pppol2tpv3 sp;
1002 		len = sizeof(sp);
1003 		memset(&sp, 0, len);
1004 		sp.sa_family	= AF_PPPOX;
1005 		sp.sa_protocol	= PX_PROTO_OL2TP;
1006 		sp.pppol2tp.fd  = tunnel->fd;
1007 		sp.pppol2tp.pid = pls->owner;
1008 		sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
1009 		sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
1010 		sp.pppol2tp.s_session = session->session_id;
1011 		sp.pppol2tp.d_session = session->peer_session_id;
1012 		sp.pppol2tp.addr.sin_family = AF_INET;
1013 		sp.pppol2tp.addr.sin_port = inet->inet_dport;
1014 		sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
1015 		memcpy(uaddr, &sp, len);
1016 	}
1017 
1018 	*usockaddr_len = len;
1019 	error = 0;
1020 
1021 	sock_put(pls->tunnel_sock);
1022 end_put_sess:
1023 	sock_put(sk);
1024 end:
1025 	return error;
1026 }
1027 
1028 /****************************************************************************
1029  * ioctl() handlers.
1030  *
1031  * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
1032  * sockets. However, in order to control kernel tunnel features, we allow
1033  * userspace to create a special "tunnel" PPPoX socket which is used for
1034  * control only.  Tunnel PPPoX sockets have session_id == 0 and simply allow
1035  * the user application to issue L2TP setsockopt(), getsockopt() and ioctl()
1036  * calls.
1037  ****************************************************************************/
1038 
pppol2tp_copy_stats(struct pppol2tp_ioc_stats * dest,struct l2tp_stats * stats)1039 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest,
1040 				struct l2tp_stats *stats)
1041 {
1042 	dest->tx_packets = atomic_long_read(&stats->tx_packets);
1043 	dest->tx_bytes = atomic_long_read(&stats->tx_bytes);
1044 	dest->tx_errors = atomic_long_read(&stats->tx_errors);
1045 	dest->rx_packets = atomic_long_read(&stats->rx_packets);
1046 	dest->rx_bytes = atomic_long_read(&stats->rx_bytes);
1047 	dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards);
1048 	dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets);
1049 	dest->rx_errors = atomic_long_read(&stats->rx_errors);
1050 }
1051 
1052 /* Session ioctl helper.
1053  */
pppol2tp_session_ioctl(struct l2tp_session * session,unsigned int cmd,unsigned long arg)1054 static int pppol2tp_session_ioctl(struct l2tp_session *session,
1055 				  unsigned int cmd, unsigned long arg)
1056 {
1057 	struct ifreq ifr;
1058 	int err = 0;
1059 	struct sock *sk;
1060 	int val = (int) arg;
1061 	struct pppol2tp_session *ps = l2tp_session_priv(session);
1062 	struct l2tp_tunnel *tunnel = session->tunnel;
1063 	struct pppol2tp_ioc_stats stats;
1064 
1065 	l2tp_dbg(session, L2TP_MSG_CONTROL,
1066 		 "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n",
1067 		 session->name, cmd, arg);
1068 
1069 	sk = pppol2tp_session_get_sock(session);
1070 	if (!sk)
1071 		return -EBADR;
1072 
1073 	switch (cmd) {
1074 	case SIOCGIFMTU:
1075 		err = -ENXIO;
1076 		if (!(sk->sk_state & PPPOX_CONNECTED))
1077 			break;
1078 
1079 		err = -EFAULT;
1080 		if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq)))
1081 			break;
1082 		ifr.ifr_mtu = session->mtu;
1083 		if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq)))
1084 			break;
1085 
1086 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mtu=%d\n",
1087 			  session->name, session->mtu);
1088 		err = 0;
1089 		break;
1090 
1091 	case SIOCSIFMTU:
1092 		err = -ENXIO;
1093 		if (!(sk->sk_state & PPPOX_CONNECTED))
1094 			break;
1095 
1096 		err = -EFAULT;
1097 		if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq)))
1098 			break;
1099 
1100 		session->mtu = ifr.ifr_mtu;
1101 
1102 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mtu=%d\n",
1103 			  session->name, session->mtu);
1104 		err = 0;
1105 		break;
1106 
1107 	case PPPIOCGMRU:
1108 		err = -ENXIO;
1109 		if (!(sk->sk_state & PPPOX_CONNECTED))
1110 			break;
1111 
1112 		err = -EFAULT;
1113 		if (put_user(session->mru, (int __user *) arg))
1114 			break;
1115 
1116 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: get mru=%d\n",
1117 			  session->name, session->mru);
1118 		err = 0;
1119 		break;
1120 
1121 	case PPPIOCSMRU:
1122 		err = -ENXIO;
1123 		if (!(sk->sk_state & PPPOX_CONNECTED))
1124 			break;
1125 
1126 		err = -EFAULT;
1127 		if (get_user(val, (int __user *) arg))
1128 			break;
1129 
1130 		session->mru = val;
1131 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: set mru=%d\n",
1132 			  session->name, session->mru);
1133 		err = 0;
1134 		break;
1135 
1136 	case PPPIOCGFLAGS:
1137 		err = -EFAULT;
1138 		if (put_user(ps->flags, (int __user *) arg))
1139 			break;
1140 
1141 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: get flags=%d\n",
1142 			  session->name, ps->flags);
1143 		err = 0;
1144 		break;
1145 
1146 	case PPPIOCSFLAGS:
1147 		err = -EFAULT;
1148 		if (get_user(val, (int __user *) arg))
1149 			break;
1150 		ps->flags = val;
1151 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: set flags=%d\n",
1152 			  session->name, ps->flags);
1153 		err = 0;
1154 		break;
1155 
1156 	case PPPIOCGL2TPSTATS:
1157 		err = -ENXIO;
1158 		if (!(sk->sk_state & PPPOX_CONNECTED))
1159 			break;
1160 
1161 		memset(&stats, 0, sizeof(stats));
1162 		stats.tunnel_id = tunnel->tunnel_id;
1163 		stats.session_id = session->session_id;
1164 		pppol2tp_copy_stats(&stats, &session->stats);
1165 		if (copy_to_user((void __user *) arg, &stats,
1166 				 sizeof(stats)))
1167 			break;
1168 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: get L2TP stats\n",
1169 			  session->name);
1170 		err = 0;
1171 		break;
1172 
1173 	default:
1174 		err = -ENOSYS;
1175 		break;
1176 	}
1177 
1178 	sock_put(sk);
1179 
1180 	return err;
1181 }
1182 
1183 /* Tunnel ioctl helper.
1184  *
1185  * Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data
1186  * specifies a session_id, the session ioctl handler is called. This allows an
1187  * application to retrieve session stats via a tunnel socket.
1188  */
pppol2tp_tunnel_ioctl(struct l2tp_tunnel * tunnel,unsigned int cmd,unsigned long arg)1189 static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel,
1190 				 unsigned int cmd, unsigned long arg)
1191 {
1192 	int err = 0;
1193 	struct sock *sk;
1194 	struct pppol2tp_ioc_stats stats;
1195 
1196 	l2tp_dbg(tunnel, L2TP_MSG_CONTROL,
1197 		 "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n",
1198 		 tunnel->name, cmd, arg);
1199 
1200 	sk = tunnel->sock;
1201 	sock_hold(sk);
1202 
1203 	switch (cmd) {
1204 	case PPPIOCGL2TPSTATS:
1205 		err = -ENXIO;
1206 		if (!(sk->sk_state & PPPOX_CONNECTED))
1207 			break;
1208 
1209 		if (copy_from_user(&stats, (void __user *) arg,
1210 				   sizeof(stats))) {
1211 			err = -EFAULT;
1212 			break;
1213 		}
1214 		if (stats.session_id != 0) {
1215 			/* resend to session ioctl handler */
1216 			struct l2tp_session *session =
1217 				l2tp_session_get(sock_net(sk), tunnel,
1218 						 stats.session_id, true);
1219 
1220 			if (session) {
1221 				err = pppol2tp_session_ioctl(session, cmd,
1222 							     arg);
1223 				if (session->deref)
1224 					session->deref(session);
1225 				l2tp_session_dec_refcount(session);
1226 			} else {
1227 				err = -EBADR;
1228 			}
1229 			break;
1230 		}
1231 #ifdef CONFIG_XFRM
1232 		stats.using_ipsec = (sk->sk_policy[0] || sk->sk_policy[1]) ? 1 : 0;
1233 #endif
1234 		pppol2tp_copy_stats(&stats, &tunnel->stats);
1235 		if (copy_to_user((void __user *) arg, &stats, sizeof(stats))) {
1236 			err = -EFAULT;
1237 			break;
1238 		}
1239 		l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get L2TP stats\n",
1240 			  tunnel->name);
1241 		err = 0;
1242 		break;
1243 
1244 	default:
1245 		err = -ENOSYS;
1246 		break;
1247 	}
1248 
1249 	sock_put(sk);
1250 
1251 	return err;
1252 }
1253 
1254 /* Main ioctl() handler.
1255  * Dispatch to tunnel or session helpers depending on the socket.
1256  */
pppol2tp_ioctl(struct socket * sock,unsigned int cmd,unsigned long arg)1257 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
1258 			  unsigned long arg)
1259 {
1260 	struct sock *sk = sock->sk;
1261 	struct l2tp_session *session;
1262 	struct l2tp_tunnel *tunnel;
1263 	struct pppol2tp_session *ps;
1264 	int err;
1265 
1266 	if (!sk)
1267 		return 0;
1268 
1269 	err = -EBADF;
1270 	if (sock_flag(sk, SOCK_DEAD) != 0)
1271 		goto end;
1272 
1273 	err = -ENOTCONN;
1274 	if ((sk->sk_user_data == NULL) ||
1275 	    (!(sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND))))
1276 		goto end;
1277 
1278 	/* Get session context from the socket */
1279 	err = -EBADF;
1280 	session = pppol2tp_sock_to_session(sk);
1281 	if (session == NULL)
1282 		goto end;
1283 
1284 	/* Special case: if session's session_id is zero, treat ioctl as a
1285 	 * tunnel ioctl
1286 	 */
1287 	ps = l2tp_session_priv(session);
1288 	if ((session->session_id == 0) &&
1289 	    (session->peer_session_id == 0)) {
1290 		err = -EBADF;
1291 		tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
1292 		if (tunnel == NULL)
1293 			goto end_put_sess;
1294 
1295 		err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg);
1296 		sock_put(ps->tunnel_sock);
1297 		goto end_put_sess;
1298 	}
1299 
1300 	err = pppol2tp_session_ioctl(session, cmd, arg);
1301 
1302 end_put_sess:
1303 	sock_put(sk);
1304 end:
1305 	return err;
1306 }
1307 
1308 /*****************************************************************************
1309  * setsockopt() / getsockopt() support.
1310  *
1311  * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
1312  * sockets. In order to control kernel tunnel features, we allow userspace to
1313  * create a special "tunnel" PPPoX socket which is used for control only.
1314  * Tunnel PPPoX sockets have session_id == 0 and simply allow the user
1315  * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls.
1316  *****************************************************************************/
1317 
1318 /* Tunnel setsockopt() helper.
1319  */
pppol2tp_tunnel_setsockopt(struct sock * sk,struct l2tp_tunnel * tunnel,int optname,int val)1320 static int pppol2tp_tunnel_setsockopt(struct sock *sk,
1321 				      struct l2tp_tunnel *tunnel,
1322 				      int optname, int val)
1323 {
1324 	int err = 0;
1325 
1326 	switch (optname) {
1327 	case PPPOL2TP_SO_DEBUG:
1328 		tunnel->debug = val;
1329 		l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: set debug=%x\n",
1330 			  tunnel->name, tunnel->debug);
1331 		break;
1332 
1333 	default:
1334 		err = -ENOPROTOOPT;
1335 		break;
1336 	}
1337 
1338 	return err;
1339 }
1340 
1341 /* Session setsockopt helper.
1342  */
pppol2tp_session_setsockopt(struct sock * sk,struct l2tp_session * session,int optname,int val)1343 static int pppol2tp_session_setsockopt(struct sock *sk,
1344 				       struct l2tp_session *session,
1345 				       int optname, int val)
1346 {
1347 	int err = 0;
1348 
1349 	switch (optname) {
1350 	case PPPOL2TP_SO_RECVSEQ:
1351 		if ((val != 0) && (val != 1)) {
1352 			err = -EINVAL;
1353 			break;
1354 		}
1355 		session->recv_seq = val ? -1 : 0;
1356 		l2tp_info(session, L2TP_MSG_CONTROL,
1357 			  "%s: set recv_seq=%d\n",
1358 			  session->name, session->recv_seq);
1359 		break;
1360 
1361 	case PPPOL2TP_SO_SENDSEQ:
1362 		if ((val != 0) && (val != 1)) {
1363 			err = -EINVAL;
1364 			break;
1365 		}
1366 		session->send_seq = val ? -1 : 0;
1367 		{
1368 			struct pppox_sock *po = pppox_sk(sk);
1369 
1370 			po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
1371 				PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
1372 		}
1373 		l2tp_session_set_header_len(session, session->tunnel->version);
1374 		l2tp_info(session, L2TP_MSG_CONTROL,
1375 			  "%s: set send_seq=%d\n",
1376 			  session->name, session->send_seq);
1377 		break;
1378 
1379 	case PPPOL2TP_SO_LNSMODE:
1380 		if ((val != 0) && (val != 1)) {
1381 			err = -EINVAL;
1382 			break;
1383 		}
1384 		session->lns_mode = val ? -1 : 0;
1385 		l2tp_info(session, L2TP_MSG_CONTROL,
1386 			  "%s: set lns_mode=%d\n",
1387 			  session->name, session->lns_mode);
1388 		break;
1389 
1390 	case PPPOL2TP_SO_DEBUG:
1391 		session->debug = val;
1392 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: set debug=%x\n",
1393 			  session->name, session->debug);
1394 		break;
1395 
1396 	case PPPOL2TP_SO_REORDERTO:
1397 		session->reorder_timeout = msecs_to_jiffies(val);
1398 		l2tp_info(session, L2TP_MSG_CONTROL,
1399 			  "%s: set reorder_timeout=%d\n",
1400 			  session->name, session->reorder_timeout);
1401 		break;
1402 
1403 	default:
1404 		err = -ENOPROTOOPT;
1405 		break;
1406 	}
1407 
1408 	return err;
1409 }
1410 
1411 /* Main setsockopt() entry point.
1412  * Does API checks, then calls either the tunnel or session setsockopt
1413  * handler, according to whether the PPPoL2TP socket is a for a regular
1414  * session or the special tunnel type.
1415  */
pppol2tp_setsockopt(struct socket * sock,int level,int optname,char __user * optval,unsigned int optlen)1416 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
1417 			       char __user *optval, unsigned int optlen)
1418 {
1419 	struct sock *sk = sock->sk;
1420 	struct l2tp_session *session;
1421 	struct l2tp_tunnel *tunnel;
1422 	struct pppol2tp_session *ps;
1423 	int val;
1424 	int err;
1425 
1426 	if (level != SOL_PPPOL2TP)
1427 		return -EINVAL;
1428 
1429 	if (optlen < sizeof(int))
1430 		return -EINVAL;
1431 
1432 	if (get_user(val, (int __user *)optval))
1433 		return -EFAULT;
1434 
1435 	err = -ENOTCONN;
1436 	if (sk->sk_user_data == NULL)
1437 		goto end;
1438 
1439 	/* Get session context from the socket */
1440 	err = -EBADF;
1441 	session = pppol2tp_sock_to_session(sk);
1442 	if (session == NULL)
1443 		goto end;
1444 
1445 	/* Special case: if session_id == 0x0000, treat as operation on tunnel
1446 	 */
1447 	ps = l2tp_session_priv(session);
1448 	if ((session->session_id == 0) &&
1449 	    (session->peer_session_id == 0)) {
1450 		err = -EBADF;
1451 		tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
1452 		if (tunnel == NULL)
1453 			goto end_put_sess;
1454 
1455 		err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
1456 		sock_put(ps->tunnel_sock);
1457 	} else
1458 		err = pppol2tp_session_setsockopt(sk, session, optname, val);
1459 
1460 	err = 0;
1461 
1462 end_put_sess:
1463 	sock_put(sk);
1464 end:
1465 	return err;
1466 }
1467 
1468 /* Tunnel getsockopt helper. Called with sock locked.
1469  */
pppol2tp_tunnel_getsockopt(struct sock * sk,struct l2tp_tunnel * tunnel,int optname,int * val)1470 static int pppol2tp_tunnel_getsockopt(struct sock *sk,
1471 				      struct l2tp_tunnel *tunnel,
1472 				      int optname, int *val)
1473 {
1474 	int err = 0;
1475 
1476 	switch (optname) {
1477 	case PPPOL2TP_SO_DEBUG:
1478 		*val = tunnel->debug;
1479 		l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get debug=%x\n",
1480 			  tunnel->name, tunnel->debug);
1481 		break;
1482 
1483 	default:
1484 		err = -ENOPROTOOPT;
1485 		break;
1486 	}
1487 
1488 	return err;
1489 }
1490 
1491 /* Session getsockopt helper. Called with sock locked.
1492  */
pppol2tp_session_getsockopt(struct sock * sk,struct l2tp_session * session,int optname,int * val)1493 static int pppol2tp_session_getsockopt(struct sock *sk,
1494 				       struct l2tp_session *session,
1495 				       int optname, int *val)
1496 {
1497 	int err = 0;
1498 
1499 	switch (optname) {
1500 	case PPPOL2TP_SO_RECVSEQ:
1501 		*val = session->recv_seq;
1502 		l2tp_info(session, L2TP_MSG_CONTROL,
1503 			  "%s: get recv_seq=%d\n", session->name, *val);
1504 		break;
1505 
1506 	case PPPOL2TP_SO_SENDSEQ:
1507 		*val = session->send_seq;
1508 		l2tp_info(session, L2TP_MSG_CONTROL,
1509 			  "%s: get send_seq=%d\n", session->name, *val);
1510 		break;
1511 
1512 	case PPPOL2TP_SO_LNSMODE:
1513 		*val = session->lns_mode;
1514 		l2tp_info(session, L2TP_MSG_CONTROL,
1515 			  "%s: get lns_mode=%d\n", session->name, *val);
1516 		break;
1517 
1518 	case PPPOL2TP_SO_DEBUG:
1519 		*val = session->debug;
1520 		l2tp_info(session, L2TP_MSG_CONTROL, "%s: get debug=%d\n",
1521 			  session->name, *val);
1522 		break;
1523 
1524 	case PPPOL2TP_SO_REORDERTO:
1525 		*val = (int) jiffies_to_msecs(session->reorder_timeout);
1526 		l2tp_info(session, L2TP_MSG_CONTROL,
1527 			  "%s: get reorder_timeout=%d\n", session->name, *val);
1528 		break;
1529 
1530 	default:
1531 		err = -ENOPROTOOPT;
1532 	}
1533 
1534 	return err;
1535 }
1536 
1537 /* Main getsockopt() entry point.
1538  * Does API checks, then calls either the tunnel or session getsockopt
1539  * handler, according to whether the PPPoX socket is a for a regular session
1540  * or the special tunnel type.
1541  */
pppol2tp_getsockopt(struct socket * sock,int level,int optname,char __user * optval,int __user * optlen)1542 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
1543 			       char __user *optval, int __user *optlen)
1544 {
1545 	struct sock *sk = sock->sk;
1546 	struct l2tp_session *session;
1547 	struct l2tp_tunnel *tunnel;
1548 	int val, len;
1549 	int err;
1550 	struct pppol2tp_session *ps;
1551 
1552 	if (level != SOL_PPPOL2TP)
1553 		return -EINVAL;
1554 
1555 	if (get_user(len, optlen))
1556 		return -EFAULT;
1557 
1558 	len = min_t(unsigned int, len, sizeof(int));
1559 
1560 	if (len < 0)
1561 		return -EINVAL;
1562 
1563 	err = -ENOTCONN;
1564 	if (sk->sk_user_data == NULL)
1565 		goto end;
1566 
1567 	/* Get the session context */
1568 	err = -EBADF;
1569 	session = pppol2tp_sock_to_session(sk);
1570 	if (session == NULL)
1571 		goto end;
1572 
1573 	/* Special case: if session_id == 0x0000, treat as operation on tunnel */
1574 	ps = l2tp_session_priv(session);
1575 	if ((session->session_id == 0) &&
1576 	    (session->peer_session_id == 0)) {
1577 		err = -EBADF;
1578 		tunnel = l2tp_sock_to_tunnel(ps->tunnel_sock);
1579 		if (tunnel == NULL)
1580 			goto end_put_sess;
1581 
1582 		err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
1583 		sock_put(ps->tunnel_sock);
1584 	} else
1585 		err = pppol2tp_session_getsockopt(sk, session, optname, &val);
1586 
1587 	err = -EFAULT;
1588 	if (put_user(len, optlen))
1589 		goto end_put_sess;
1590 
1591 	if (copy_to_user((void __user *) optval, &val, len))
1592 		goto end_put_sess;
1593 
1594 	err = 0;
1595 
1596 end_put_sess:
1597 	sock_put(sk);
1598 end:
1599 	return err;
1600 }
1601 
1602 /*****************************************************************************
1603  * /proc filesystem for debug
1604  * Since the original pppol2tp driver provided /proc/net/pppol2tp for
1605  * L2TPv2, we dump only L2TPv2 tunnels and sessions here.
1606  *****************************************************************************/
1607 
1608 static unsigned int pppol2tp_net_id;
1609 
1610 #ifdef CONFIG_PROC_FS
1611 
1612 struct pppol2tp_seq_data {
1613 	struct seq_net_private p;
1614 	int tunnel_idx;			/* current tunnel */
1615 	int session_idx;		/* index of session within current tunnel */
1616 	struct l2tp_tunnel *tunnel;
1617 	struct l2tp_session *session;	/* NULL means get next tunnel */
1618 };
1619 
pppol2tp_next_tunnel(struct net * net,struct pppol2tp_seq_data * pd)1620 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
1621 {
1622 	for (;;) {
1623 		pd->tunnel = l2tp_tunnel_find_nth(net, pd->tunnel_idx);
1624 		pd->tunnel_idx++;
1625 
1626 		if (pd->tunnel == NULL)
1627 			break;
1628 
1629 		/* Ignore L2TPv3 tunnels */
1630 		if (pd->tunnel->version < 3)
1631 			break;
1632 	}
1633 }
1634 
pppol2tp_next_session(struct net * net,struct pppol2tp_seq_data * pd)1635 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
1636 {
1637 	pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true);
1638 	pd->session_idx++;
1639 
1640 	if (pd->session == NULL) {
1641 		pd->session_idx = 0;
1642 		pppol2tp_next_tunnel(net, pd);
1643 	}
1644 }
1645 
pppol2tp_seq_start(struct seq_file * m,loff_t * offs)1646 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs)
1647 {
1648 	struct pppol2tp_seq_data *pd = SEQ_START_TOKEN;
1649 	loff_t pos = *offs;
1650 	struct net *net;
1651 
1652 	if (!pos)
1653 		goto out;
1654 
1655 	BUG_ON(m->private == NULL);
1656 	pd = m->private;
1657 	net = seq_file_net(m);
1658 
1659 	if (pd->tunnel == NULL)
1660 		pppol2tp_next_tunnel(net, pd);
1661 	else
1662 		pppol2tp_next_session(net, pd);
1663 
1664 	/* NULL tunnel and session indicates end of list */
1665 	if ((pd->tunnel == NULL) && (pd->session == NULL))
1666 		pd = NULL;
1667 
1668 out:
1669 	return pd;
1670 }
1671 
pppol2tp_seq_next(struct seq_file * m,void * v,loff_t * pos)1672 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos)
1673 {
1674 	(*pos)++;
1675 	return NULL;
1676 }
1677 
pppol2tp_seq_stop(struct seq_file * p,void * v)1678 static void pppol2tp_seq_stop(struct seq_file *p, void *v)
1679 {
1680 	/* nothing to do */
1681 }
1682 
pppol2tp_seq_tunnel_show(struct seq_file * m,void * v)1683 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
1684 {
1685 	struct l2tp_tunnel *tunnel = v;
1686 
1687 	seq_printf(m, "\nTUNNEL '%s', %c %d\n",
1688 		   tunnel->name,
1689 		   (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N',
1690 		   atomic_read(&tunnel->ref_count) - 1);
1691 	seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n",
1692 		   tunnel->debug,
1693 		   atomic_long_read(&tunnel->stats.tx_packets),
1694 		   atomic_long_read(&tunnel->stats.tx_bytes),
1695 		   atomic_long_read(&tunnel->stats.tx_errors),
1696 		   atomic_long_read(&tunnel->stats.rx_packets),
1697 		   atomic_long_read(&tunnel->stats.rx_bytes),
1698 		   atomic_long_read(&tunnel->stats.rx_errors));
1699 }
1700 
pppol2tp_seq_session_show(struct seq_file * m,void * v)1701 static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
1702 {
1703 	struct l2tp_session *session = v;
1704 	struct l2tp_tunnel *tunnel = session->tunnel;
1705 	unsigned char state;
1706 	char user_data_ok;
1707 	struct sock *sk;
1708 	u32 ip = 0;
1709 	u16 port = 0;
1710 
1711 	if (tunnel->sock) {
1712 		struct inet_sock *inet = inet_sk(tunnel->sock);
1713 		ip = ntohl(inet->inet_saddr);
1714 		port = ntohs(inet->inet_sport);
1715 	}
1716 
1717 	sk = pppol2tp_session_get_sock(session);
1718 	if (sk) {
1719 		state = sk->sk_state;
1720 		user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N';
1721 	} else {
1722 		state = 0;
1723 		user_data_ok = 'N';
1724 	}
1725 
1726 	seq_printf(m, "  SESSION '%s' %08X/%d %04X/%04X -> "
1727 		   "%04X/%04X %d %c\n",
1728 		   session->name, ip, port,
1729 		   tunnel->tunnel_id,
1730 		   session->session_id,
1731 		   tunnel->peer_tunnel_id,
1732 		   session->peer_session_id,
1733 		   state, user_data_ok);
1734 	seq_printf(m, "   %d/%d/%c/%c/%s %08x %u\n",
1735 		   session->mtu, session->mru,
1736 		   session->recv_seq ? 'R' : '-',
1737 		   session->send_seq ? 'S' : '-',
1738 		   session->lns_mode ? "LNS" : "LAC",
1739 		   session->debug,
1740 		   jiffies_to_msecs(session->reorder_timeout));
1741 	seq_printf(m, "   %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n",
1742 		   session->nr, session->ns,
1743 		   atomic_long_read(&session->stats.tx_packets),
1744 		   atomic_long_read(&session->stats.tx_bytes),
1745 		   atomic_long_read(&session->stats.tx_errors),
1746 		   atomic_long_read(&session->stats.rx_packets),
1747 		   atomic_long_read(&session->stats.rx_bytes),
1748 		   atomic_long_read(&session->stats.rx_errors));
1749 
1750 	if (sk) {
1751 		struct pppox_sock *po = pppox_sk(sk);
1752 
1753 		seq_printf(m, "   interface %s\n", ppp_dev_name(&po->chan));
1754 		sock_put(sk);
1755 	}
1756 }
1757 
pppol2tp_seq_show(struct seq_file * m,void * v)1758 static int pppol2tp_seq_show(struct seq_file *m, void *v)
1759 {
1760 	struct pppol2tp_seq_data *pd = v;
1761 
1762 	/* display header on line 1 */
1763 	if (v == SEQ_START_TOKEN) {
1764 		seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n");
1765 		seq_puts(m, "TUNNEL name, user-data-ok session-count\n");
1766 		seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1767 		seq_puts(m, "  SESSION name, addr/port src-tid/sid "
1768 			 "dest-tid/sid state user-data-ok\n");
1769 		seq_puts(m, "   mtu/mru/rcvseq/sendseq/lns debug reorderto\n");
1770 		seq_puts(m, "   nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1771 		goto out;
1772 	}
1773 
1774 	/* Show the tunnel or session context.
1775 	 */
1776 	if (!pd->session) {
1777 		pppol2tp_seq_tunnel_show(m, pd->tunnel);
1778 	} else {
1779 		pppol2tp_seq_session_show(m, pd->session);
1780 		if (pd->session->deref)
1781 			pd->session->deref(pd->session);
1782 		l2tp_session_dec_refcount(pd->session);
1783 	}
1784 
1785 out:
1786 	return 0;
1787 }
1788 
1789 static const struct seq_operations pppol2tp_seq_ops = {
1790 	.start		= pppol2tp_seq_start,
1791 	.next		= pppol2tp_seq_next,
1792 	.stop		= pppol2tp_seq_stop,
1793 	.show		= pppol2tp_seq_show,
1794 };
1795 
1796 /* Called when our /proc file is opened. We allocate data for use when
1797  * iterating our tunnel / session contexts and store it in the private
1798  * data of the seq_file.
1799  */
pppol2tp_proc_open(struct inode * inode,struct file * file)1800 static int pppol2tp_proc_open(struct inode *inode, struct file *file)
1801 {
1802 	return seq_open_net(inode, file, &pppol2tp_seq_ops,
1803 			    sizeof(struct pppol2tp_seq_data));
1804 }
1805 
1806 static const struct file_operations pppol2tp_proc_fops = {
1807 	.owner		= THIS_MODULE,
1808 	.open		= pppol2tp_proc_open,
1809 	.read		= seq_read,
1810 	.llseek		= seq_lseek,
1811 	.release	= seq_release_net,
1812 };
1813 
1814 #endif /* CONFIG_PROC_FS */
1815 
1816 /*****************************************************************************
1817  * Network namespace
1818  *****************************************************************************/
1819 
pppol2tp_init_net(struct net * net)1820 static __net_init int pppol2tp_init_net(struct net *net)
1821 {
1822 	struct proc_dir_entry *pde;
1823 	int err = 0;
1824 
1825 	pde = proc_create("pppol2tp", S_IRUGO, net->proc_net,
1826 			  &pppol2tp_proc_fops);
1827 	if (!pde) {
1828 		err = -ENOMEM;
1829 		goto out;
1830 	}
1831 
1832 out:
1833 	return err;
1834 }
1835 
pppol2tp_exit_net(struct net * net)1836 static __net_exit void pppol2tp_exit_net(struct net *net)
1837 {
1838 	remove_proc_entry("pppol2tp", net->proc_net);
1839 }
1840 
1841 static struct pernet_operations pppol2tp_net_ops = {
1842 	.init = pppol2tp_init_net,
1843 	.exit = pppol2tp_exit_net,
1844 	.id   = &pppol2tp_net_id,
1845 };
1846 
1847 /*****************************************************************************
1848  * Init and cleanup
1849  *****************************************************************************/
1850 
1851 static const struct proto_ops pppol2tp_ops = {
1852 	.family		= AF_PPPOX,
1853 	.owner		= THIS_MODULE,
1854 	.release	= pppol2tp_release,
1855 	.bind		= sock_no_bind,
1856 	.connect	= pppol2tp_connect,
1857 	.socketpair	= sock_no_socketpair,
1858 	.accept		= sock_no_accept,
1859 	.getname	= pppol2tp_getname,
1860 	.poll		= datagram_poll,
1861 	.listen		= sock_no_listen,
1862 	.shutdown	= sock_no_shutdown,
1863 	.setsockopt	= pppol2tp_setsockopt,
1864 	.getsockopt	= pppol2tp_getsockopt,
1865 	.sendmsg	= pppol2tp_sendmsg,
1866 	.recvmsg	= pppol2tp_recvmsg,
1867 	.mmap		= sock_no_mmap,
1868 	.ioctl		= pppox_ioctl,
1869 #ifdef CONFIG_COMPAT
1870 	.compat_ioctl = pppox_compat_ioctl,
1871 #endif
1872 };
1873 
1874 static const struct pppox_proto pppol2tp_proto = {
1875 	.create		= pppol2tp_create,
1876 	.ioctl		= pppol2tp_ioctl,
1877 	.owner		= THIS_MODULE,
1878 };
1879 
1880 #ifdef CONFIG_L2TP_V3
1881 
1882 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = {
1883 	.session_create	= pppol2tp_session_create,
1884 	.session_delete	= l2tp_session_delete,
1885 };
1886 
1887 #endif /* CONFIG_L2TP_V3 */
1888 
pppol2tp_init(void)1889 static int __init pppol2tp_init(void)
1890 {
1891 	int err;
1892 
1893 	err = register_pernet_device(&pppol2tp_net_ops);
1894 	if (err)
1895 		goto out;
1896 
1897 	err = proto_register(&pppol2tp_sk_proto, 0);
1898 	if (err)
1899 		goto out_unregister_pppol2tp_pernet;
1900 
1901 	err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto);
1902 	if (err)
1903 		goto out_unregister_pppol2tp_proto;
1904 
1905 #ifdef CONFIG_L2TP_V3
1906 	err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops);
1907 	if (err)
1908 		goto out_unregister_pppox;
1909 #endif
1910 
1911 	pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION);
1912 
1913 out:
1914 	return err;
1915 
1916 #ifdef CONFIG_L2TP_V3
1917 out_unregister_pppox:
1918 	unregister_pppox_proto(PX_PROTO_OL2TP);
1919 #endif
1920 out_unregister_pppol2tp_proto:
1921 	proto_unregister(&pppol2tp_sk_proto);
1922 out_unregister_pppol2tp_pernet:
1923 	unregister_pernet_device(&pppol2tp_net_ops);
1924 	goto out;
1925 }
1926 
pppol2tp_exit(void)1927 static void __exit pppol2tp_exit(void)
1928 {
1929 #ifdef CONFIG_L2TP_V3
1930 	l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP);
1931 #endif
1932 	unregister_pppox_proto(PX_PROTO_OL2TP);
1933 	proto_unregister(&pppol2tp_sk_proto);
1934 	unregister_pernet_device(&pppol2tp_net_ops);
1935 }
1936 
1937 module_init(pppol2tp_init);
1938 module_exit(pppol2tp_exit);
1939 
1940 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1941 MODULE_DESCRIPTION("PPP over L2TP over UDP");
1942 MODULE_LICENSE("GPL");
1943 MODULE_VERSION(PPPOL2TP_DRV_VERSION);
1944 MODULE_ALIAS("pppox-proto-" __stringify(PX_PROTO_OL2TP));
1945 MODULE_ALIAS_L2TP_PWTYPE(7);
1946