1 // SPDX-License-Identifier: GPL-2.0-only
4 * Copyright (c) 2008,2009,2010 Katalix Systems Ltd
6 * This file contains some code of the original L2TPv2 pppol2tp
7 * driver, which has the following copyright:
9 * Authors: Martijn van Oosterhout <kleptog@svana.org>
10 * James Chapman (jchapman@katalix.com)
12 * Michal Ostrowski <mostrows@speakeasy.net>
13 * Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
14 * David S. Miller (davem@redhat.com)
17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
19 #include <linux/module.h>
20 #include <linux/string.h>
21 #include <linux/list.h>
22 #include <linux/rculist.h>
23 #include <linux/uaccess.h>
25 #include <linux/kernel.h>
26 #include <linux/spinlock.h>
27 #include <linux/kthread.h>
28 #include <linux/sched.h>
29 #include <linux/slab.h>
30 #include <linux/errno.h>
31 #include <linux/jiffies.h>
33 #include <linux/netdevice.h>
34 #include <linux/net.h>
35 #include <linux/inetdevice.h>
36 #include <linux/skbuff.h>
37 #include <linux/init.h>
40 #include <linux/udp.h>
41 #include <linux/l2tp.h>
42 #include <linux/hash.h>
43 #include <linux/sort.h>
44 #include <linux/file.h>
45 #include <linux/nsproxy.h>
46 #include <net/net_namespace.h>
47 #include <net/netns/generic.h>
51 #include <net/udp_tunnel.h>
52 #include <net/inet_common.h>
54 #include <net/protocol.h>
55 #include <net/inet6_connection_sock.h>
56 #include <net/inet_ecn.h>
57 #include <net/ip6_route.h>
58 #include <net/ip6_checksum.h>
60 #include <asm/byteorder.h>
61 #include <linux/atomic.h>
63 #include "l2tp_core.h"
65 #define L2TP_DRV_VERSION "V2.0"
67 /* L2TP header constants */
68 #define L2TP_HDRFLAG_T 0x8000
69 #define L2TP_HDRFLAG_L 0x4000
70 #define L2TP_HDRFLAG_S 0x0800
71 #define L2TP_HDRFLAG_O 0x0200
72 #define L2TP_HDRFLAG_P 0x0100
74 #define L2TP_HDR_VER_MASK 0x000F
75 #define L2TP_HDR_VER_2 0x0002
76 #define L2TP_HDR_VER_3 0x0003
78 /* L2TPv3 default L2-specific sublayer */
79 #define L2TP_SLFLAG_S 0x40000000
80 #define L2TP_SL_SEQ_MASK 0x00ffffff
82 #define L2TP_HDR_SIZE_MAX 14
84 /* Default trace flags */
85 #define L2TP_DEFAULT_DEBUG_FLAGS 0
87 /* Private data stored for received packets in the skb.
93 unsigned long expires;
96 #define L2TP_SKB_CB(skb) ((struct l2tp_skb_cb *)&(skb)->cb[sizeof(struct inet_skb_parm)])
98 static struct workqueue_struct *l2tp_wq;
100 /* per-net private data for this module */
101 static unsigned int l2tp_net_id;
103 struct list_head l2tp_tunnel_list;
104 /* Lock for write access to l2tp_tunnel_list */
105 spinlock_t l2tp_tunnel_list_lock;
106 struct hlist_head l2tp_session_hlist[L2TP_HASH_SIZE_2];
107 /* Lock for write access to l2tp_session_hlist */
108 spinlock_t l2tp_session_hlist_lock;
111 #if IS_ENABLED(CONFIG_IPV6)
112 static bool l2tp_sk_is_v6(struct sock *sk)
114 return sk->sk_family == PF_INET6 &&
115 !ipv6_addr_v4mapped(&sk->sk_v6_daddr);
119 static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk)
121 return sk->sk_user_data;
124 static inline struct l2tp_net *l2tp_pernet(const struct net *net)
126 return net_generic(net, l2tp_net_id);
129 /* Session hash global list for L2TPv3.
130 * The session_id SHOULD be random according to RFC3931, but several
131 * L2TP implementations use incrementing session_ids. So we do a real
132 * hash on the session_id, rather than a simple bitmask.
134 static inline struct hlist_head *
135 l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
137 return &pn->l2tp_session_hlist[hash_32(session_id, L2TP_HASH_BITS_2)];
140 /* Session hash list.
141 * The session_id SHOULD be random according to RFC2661, but several
142 * L2TP implementations (Cisco and Microsoft) use incrementing
143 * session_ids. So we do a real hash on the session_id, rather than a
146 static inline struct hlist_head *
147 l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id)
149 return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)];
152 static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
154 sock_put(tunnel->sock);
155 /* the tunnel is freed in the socket destructor */
158 static void l2tp_session_free(struct l2tp_session *session)
160 struct l2tp_tunnel *tunnel = session->tunnel;
163 if (WARN_ON(tunnel->magic != L2TP_TUNNEL_MAGIC))
165 l2tp_tunnel_dec_refcount(tunnel);
172 void l2tp_tunnel_inc_refcount(struct l2tp_tunnel *tunnel)
174 refcount_inc(&tunnel->ref_count);
176 EXPORT_SYMBOL_GPL(l2tp_tunnel_inc_refcount);
178 void l2tp_tunnel_dec_refcount(struct l2tp_tunnel *tunnel)
180 if (refcount_dec_and_test(&tunnel->ref_count))
181 l2tp_tunnel_free(tunnel);
183 EXPORT_SYMBOL_GPL(l2tp_tunnel_dec_refcount);
185 void l2tp_session_inc_refcount(struct l2tp_session *session)
187 refcount_inc(&session->ref_count);
189 EXPORT_SYMBOL_GPL(l2tp_session_inc_refcount);
191 void l2tp_session_dec_refcount(struct l2tp_session *session)
193 if (refcount_dec_and_test(&session->ref_count))
194 l2tp_session_free(session);
196 EXPORT_SYMBOL_GPL(l2tp_session_dec_refcount);
198 /* Lookup a tunnel. A new reference is held on the returned tunnel. */
199 struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id)
201 const struct l2tp_net *pn = l2tp_pernet(net);
202 struct l2tp_tunnel *tunnel;
205 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
206 if (tunnel->tunnel_id == tunnel_id &&
207 refcount_inc_not_zero(&tunnel->ref_count)) {
208 rcu_read_unlock_bh();
213 rcu_read_unlock_bh();
217 EXPORT_SYMBOL_GPL(l2tp_tunnel_get);
219 struct l2tp_tunnel *l2tp_tunnel_get_nth(const struct net *net, int nth)
221 const struct l2tp_net *pn = l2tp_pernet(net);
222 struct l2tp_tunnel *tunnel;
226 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
228 refcount_inc_not_zero(&tunnel->ref_count)) {
229 rcu_read_unlock_bh();
233 rcu_read_unlock_bh();
237 EXPORT_SYMBOL_GPL(l2tp_tunnel_get_nth);
239 struct l2tp_session *l2tp_tunnel_get_session(struct l2tp_tunnel *tunnel,
242 struct hlist_head *session_list;
243 struct l2tp_session *session;
245 session_list = l2tp_session_id_hash(tunnel, session_id);
247 read_lock_bh(&tunnel->hlist_lock);
248 hlist_for_each_entry(session, session_list, hlist)
249 if (session->session_id == session_id) {
250 l2tp_session_inc_refcount(session);
251 read_unlock_bh(&tunnel->hlist_lock);
255 read_unlock_bh(&tunnel->hlist_lock);
259 EXPORT_SYMBOL_GPL(l2tp_tunnel_get_session);
261 struct l2tp_session *l2tp_session_get(const struct net *net, u32 session_id)
263 struct hlist_head *session_list;
264 struct l2tp_session *session;
266 session_list = l2tp_session_id_hash_2(l2tp_pernet(net), session_id);
269 hlist_for_each_entry_rcu(session, session_list, global_hlist)
270 if (session->session_id == session_id) {
271 l2tp_session_inc_refcount(session);
272 rcu_read_unlock_bh();
276 rcu_read_unlock_bh();
280 EXPORT_SYMBOL_GPL(l2tp_session_get);
282 struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth)
285 struct l2tp_session *session;
288 read_lock_bh(&tunnel->hlist_lock);
289 for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
290 hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {
292 l2tp_session_inc_refcount(session);
293 read_unlock_bh(&tunnel->hlist_lock);
299 read_unlock_bh(&tunnel->hlist_lock);
303 EXPORT_SYMBOL_GPL(l2tp_session_get_nth);
305 /* Lookup a session by interface name.
306 * This is very inefficient but is only used by management interfaces.
308 struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
311 struct l2tp_net *pn = l2tp_pernet(net);
313 struct l2tp_session *session;
316 for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) {
317 hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {
318 if (!strcmp(session->ifname, ifname)) {
319 l2tp_session_inc_refcount(session);
320 rcu_read_unlock_bh();
327 rcu_read_unlock_bh();
331 EXPORT_SYMBOL_GPL(l2tp_session_get_by_ifname);
333 int l2tp_session_register(struct l2tp_session *session,
334 struct l2tp_tunnel *tunnel)
336 struct l2tp_session *session_walk;
337 struct hlist_head *g_head;
338 struct hlist_head *head;
342 head = l2tp_session_id_hash(tunnel, session->session_id);
344 write_lock_bh(&tunnel->hlist_lock);
345 if (!tunnel->acpt_newsess) {
350 hlist_for_each_entry(session_walk, head, hlist)
351 if (session_walk->session_id == session->session_id) {
356 if (tunnel->version == L2TP_HDR_VER_3) {
357 pn = l2tp_pernet(tunnel->l2tp_net);
358 g_head = l2tp_session_id_hash_2(pn, session->session_id);
360 spin_lock_bh(&pn->l2tp_session_hlist_lock);
362 /* IP encap expects session IDs to be globally unique, while
365 hlist_for_each_entry(session_walk, g_head, global_hlist)
366 if (session_walk->session_id == session->session_id &&
367 (session_walk->tunnel->encap == L2TP_ENCAPTYPE_IP ||
368 tunnel->encap == L2TP_ENCAPTYPE_IP)) {
370 goto err_tlock_pnlock;
373 l2tp_tunnel_inc_refcount(tunnel);
374 hlist_add_head_rcu(&session->global_hlist, g_head);
376 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
378 l2tp_tunnel_inc_refcount(tunnel);
381 hlist_add_head(&session->hlist, head);
382 write_unlock_bh(&tunnel->hlist_lock);
387 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
389 write_unlock_bh(&tunnel->hlist_lock);
393 EXPORT_SYMBOL_GPL(l2tp_session_register);
395 /*****************************************************************************
396 * Receive data handling
397 *****************************************************************************/
399 /* Queue a skb in order. We come here only if the skb has an L2TP sequence
402 static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)
404 struct sk_buff *skbp;
406 u32 ns = L2TP_SKB_CB(skb)->ns;
408 spin_lock_bh(&session->reorder_q.lock);
409 skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
410 if (L2TP_SKB_CB(skbp)->ns > ns) {
411 __skb_queue_before(&session->reorder_q, skbp, skb);
412 l2tp_dbg(session, L2TP_MSG_SEQ,
413 "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
414 session->name, ns, L2TP_SKB_CB(skbp)->ns,
415 skb_queue_len(&session->reorder_q));
416 atomic_long_inc(&session->stats.rx_oos_packets);
421 __skb_queue_tail(&session->reorder_q, skb);
424 spin_unlock_bh(&session->reorder_q.lock);
427 /* Dequeue a single skb.
429 static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)
431 struct l2tp_tunnel *tunnel = session->tunnel;
432 int length = L2TP_SKB_CB(skb)->length;
434 /* We're about to requeue the skb, so return resources
435 * to its current owner (a socket receive buffer).
439 atomic_long_inc(&tunnel->stats.rx_packets);
440 atomic_long_add(length, &tunnel->stats.rx_bytes);
441 atomic_long_inc(&session->stats.rx_packets);
442 atomic_long_add(length, &session->stats.rx_bytes);
444 if (L2TP_SKB_CB(skb)->has_seq) {
447 session->nr &= session->nr_max;
449 l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated nr to %hu\n",
450 session->name, session->nr);
453 /* call private receive handler */
454 if (session->recv_skb)
455 (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);
460 /* Dequeue skbs from the session's reorder_q, subject to packet order.
461 * Skbs that have been in the queue for too long are simply discarded.
463 static void l2tp_recv_dequeue(struct l2tp_session *session)
468 /* If the pkt at the head of the queue has the nr that we
469 * expect to send up next, dequeue it and any other
470 * in-sequence packets behind it.
473 spin_lock_bh(&session->reorder_q.lock);
474 skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
475 if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) {
476 atomic_long_inc(&session->stats.rx_seq_discards);
477 atomic_long_inc(&session->stats.rx_errors);
478 l2tp_dbg(session, L2TP_MSG_SEQ,
479 "%s: oos pkt %u len %d discarded (too old), waiting for %u, reorder_q_len=%d\n",
480 session->name, L2TP_SKB_CB(skb)->ns,
481 L2TP_SKB_CB(skb)->length, session->nr,
482 skb_queue_len(&session->reorder_q));
483 session->reorder_skip = 1;
484 __skb_unlink(skb, &session->reorder_q);
489 if (L2TP_SKB_CB(skb)->has_seq) {
490 if (session->reorder_skip) {
491 l2tp_dbg(session, L2TP_MSG_SEQ,
492 "%s: advancing nr to next pkt: %u -> %u",
493 session->name, session->nr,
494 L2TP_SKB_CB(skb)->ns);
495 session->reorder_skip = 0;
496 session->nr = L2TP_SKB_CB(skb)->ns;
498 if (L2TP_SKB_CB(skb)->ns != session->nr) {
499 l2tp_dbg(session, L2TP_MSG_SEQ,
500 "%s: holding oos pkt %u len %d, waiting for %u, reorder_q_len=%d\n",
501 session->name, L2TP_SKB_CB(skb)->ns,
502 L2TP_SKB_CB(skb)->length, session->nr,
503 skb_queue_len(&session->reorder_q));
507 __skb_unlink(skb, &session->reorder_q);
509 /* Process the skb. We release the queue lock while we
510 * do so to let other contexts process the queue.
512 spin_unlock_bh(&session->reorder_q.lock);
513 l2tp_recv_dequeue_skb(session, skb);
518 spin_unlock_bh(&session->reorder_q.lock);
521 static int l2tp_seq_check_rx_window(struct l2tp_session *session, u32 nr)
525 if (nr >= session->nr)
526 nws = nr - session->nr;
528 nws = (session->nr_max + 1) - (session->nr - nr);
530 return nws < session->nr_window_size;
533 /* If packet has sequence numbers, queue it if acceptable. Returns 0 if
534 * acceptable, else non-zero.
536 static int l2tp_recv_data_seq(struct l2tp_session *session, struct sk_buff *skb)
538 if (!l2tp_seq_check_rx_window(session, L2TP_SKB_CB(skb)->ns)) {
539 /* Packet sequence number is outside allowed window.
542 l2tp_dbg(session, L2TP_MSG_SEQ,
543 "%s: pkt %u len %d discarded, outside window, nr=%u\n",
544 session->name, L2TP_SKB_CB(skb)->ns,
545 L2TP_SKB_CB(skb)->length, session->nr);
549 if (session->reorder_timeout != 0) {
550 /* Packet reordering enabled. Add skb to session's
551 * reorder queue, in order of ns.
553 l2tp_recv_queue_skb(session, skb);
557 /* Packet reordering disabled. Discard out-of-sequence packets, while
558 * tracking the number if in-sequence packets after the first OOS packet
559 * is seen. After nr_oos_count_max in-sequence packets, reset the
560 * sequence number to re-enable packet reception.
562 if (L2TP_SKB_CB(skb)->ns == session->nr) {
563 skb_queue_tail(&session->reorder_q, skb);
565 u32 nr_oos = L2TP_SKB_CB(skb)->ns;
566 u32 nr_next = (session->nr_oos + 1) & session->nr_max;
568 if (nr_oos == nr_next)
569 session->nr_oos_count++;
571 session->nr_oos_count = 0;
573 session->nr_oos = nr_oos;
574 if (session->nr_oos_count > session->nr_oos_count_max) {
575 session->reorder_skip = 1;
576 l2tp_dbg(session, L2TP_MSG_SEQ,
577 "%s: %d oos packets received. Resetting sequence numbers\n",
578 session->name, session->nr_oos_count);
580 if (!session->reorder_skip) {
581 atomic_long_inc(&session->stats.rx_seq_discards);
582 l2tp_dbg(session, L2TP_MSG_SEQ,
583 "%s: oos pkt %u len %d discarded, waiting for %u, reorder_q_len=%d\n",
584 session->name, L2TP_SKB_CB(skb)->ns,
585 L2TP_SKB_CB(skb)->length, session->nr,
586 skb_queue_len(&session->reorder_q));
589 skb_queue_tail(&session->reorder_q, skb);
599 /* Do receive processing of L2TP data frames. We handle both L2TPv2
600 * and L2TPv3 data frames here.
602 * L2TPv2 Data Message Header
605 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
606 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
607 * |T|L|x|x|S|x|O|P|x|x|x|x| Ver | Length (opt) |
608 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
609 * | Tunnel ID | Session ID |
610 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
611 * | Ns (opt) | Nr (opt) |
612 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
613 * | Offset Size (opt) | Offset pad... (opt)
614 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
616 * Data frames are marked by T=0. All other fields are the same as
617 * those in L2TP control frames.
619 * L2TPv3 Data Message Header
621 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
622 * | L2TP Session Header |
623 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
624 * | L2-Specific Sublayer |
625 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
626 * | Tunnel Payload ...
627 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
629 * L2TPv3 Session Header Over IP
632 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
633 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
635 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
636 * | Cookie (optional, maximum 64 bits)...
637 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
639 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
641 * L2TPv3 L2-Specific Sublayer Format
644 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
645 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
646 * |x|S|x|x|x|x|x|x| Sequence Number |
647 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
649 * Cookie value and sublayer format are negotiated with the peer when
650 * the session is set up. Unlike L2TPv2, we do not need to parse the
651 * packet header to determine if optional fields are present.
653 * Caller must already have parsed the frame and determined that it is
654 * a data (not control) frame before coming here. Fields up to the
655 * session-id have already been parsed and ptr points to the data
656 * after the session-id.
658 void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
659 unsigned char *ptr, unsigned char *optr, u16 hdrflags,
662 struct l2tp_tunnel *tunnel = session->tunnel;
665 /* Parse and check optional cookie */
666 if (session->peer_cookie_len > 0) {
667 if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
668 pr_warn_ratelimited("%s: cookie mismatch (%u/%u). Discarding.\n",
669 tunnel->name, tunnel->tunnel_id,
670 session->session_id);
671 atomic_long_inc(&session->stats.rx_cookie_discards);
674 ptr += session->peer_cookie_len;
677 /* Handle the optional sequence numbers. Sequence numbers are
678 * in different places for L2TPv2 and L2TPv3.
680 * If we are the LAC, enable/disable sequence numbers under
681 * the control of the LNS. If no sequence numbers present but
682 * we were expecting them, discard frame.
684 L2TP_SKB_CB(skb)->has_seq = 0;
685 if (tunnel->version == L2TP_HDR_VER_2) {
686 if (hdrflags & L2TP_HDRFLAG_S) {
687 /* Store L2TP info in the skb */
688 L2TP_SKB_CB(skb)->ns = ntohs(*(__be16 *)ptr);
689 L2TP_SKB_CB(skb)->has_seq = 1;
691 /* Skip past nr in the header */
695 } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
696 u32 l2h = ntohl(*(__be32 *)ptr);
698 if (l2h & 0x40000000) {
699 /* Store L2TP info in the skb */
700 L2TP_SKB_CB(skb)->ns = l2h & 0x00ffffff;
701 L2TP_SKB_CB(skb)->has_seq = 1;
706 if (L2TP_SKB_CB(skb)->has_seq) {
707 /* Received a packet with sequence numbers. If we're the LAC,
708 * check if we sre sending sequence numbers and if not,
711 if (!session->lns_mode && !session->send_seq) {
712 l2tp_info(session, L2TP_MSG_SEQ,
713 "%s: requested to enable seq numbers by LNS\n",
715 session->send_seq = 1;
716 l2tp_session_set_header_len(session, tunnel->version);
719 /* No sequence numbers.
720 * If user has configured mandatory sequence numbers, discard.
722 if (session->recv_seq) {
723 pr_warn_ratelimited("%s: recv data has no seq numbers when required. Discarding.\n",
725 atomic_long_inc(&session->stats.rx_seq_discards);
729 /* If we're the LAC and we're sending sequence numbers, the
730 * LNS has requested that we no longer send sequence numbers.
731 * If we're the LNS and we're sending sequence numbers, the
732 * LAC is broken. Discard the frame.
734 if (!session->lns_mode && session->send_seq) {
735 l2tp_info(session, L2TP_MSG_SEQ,
736 "%s: requested to disable seq numbers by LNS\n",
738 session->send_seq = 0;
739 l2tp_session_set_header_len(session, tunnel->version);
740 } else if (session->send_seq) {
741 pr_warn_ratelimited("%s: recv data has no seq numbers when required. Discarding.\n",
743 atomic_long_inc(&session->stats.rx_seq_discards);
748 /* Session data offset is defined only for L2TPv2 and is
749 * indicated by an optional 16-bit value in the header.
751 if (tunnel->version == L2TP_HDR_VER_2) {
752 /* If offset bit set, skip it. */
753 if (hdrflags & L2TP_HDRFLAG_O) {
754 offset = ntohs(*(__be16 *)ptr);
760 if (!pskb_may_pull(skb, offset))
763 __skb_pull(skb, offset);
765 /* Prepare skb for adding to the session's reorder_q. Hold
766 * packets for max reorder_timeout or 1 second if not
769 L2TP_SKB_CB(skb)->length = length;
770 L2TP_SKB_CB(skb)->expires = jiffies +
771 (session->reorder_timeout ? session->reorder_timeout : HZ);
773 /* Add packet to the session's receive queue. Reordering is done here, if
774 * enabled. Saved L2TP protocol info is stored in skb->sb[].
776 if (L2TP_SKB_CB(skb)->has_seq) {
777 if (l2tp_recv_data_seq(session, skb))
780 /* No sequence numbers. Add the skb to the tail of the
781 * reorder queue. This ensures that it will be
782 * delivered after all previous sequenced skbs.
784 skb_queue_tail(&session->reorder_q, skb);
787 /* Try to dequeue as many skbs from reorder_q as we can. */
788 l2tp_recv_dequeue(session);
793 atomic_long_inc(&session->stats.rx_errors);
796 EXPORT_SYMBOL_GPL(l2tp_recv_common);
798 /* Drop skbs from the session's reorder_q
800 static void l2tp_session_queue_purge(struct l2tp_session *session)
802 struct sk_buff *skb = NULL;
804 if (WARN_ON(session->magic != L2TP_SESSION_MAGIC))
807 while ((skb = skb_dequeue(&session->reorder_q))) {
808 atomic_long_inc(&session->stats.rx_errors);
813 /* Internal UDP receive frame. Do the real work of receiving an L2TP data frame
814 * here. The skb is not on a list when we get here.
815 * Returns 0 if the packet was a data packet and was successfully passed on.
816 * Returns 1 if the packet was not a good data packet and could not be
817 * forwarded. All such packets are passed up to userspace to deal with.
819 static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb)
821 struct l2tp_session *session = NULL;
822 unsigned char *ptr, *optr;
824 u32 tunnel_id, session_id;
828 /* UDP has verifed checksum */
830 /* UDP always verifies the packet length. */
831 __skb_pull(skb, sizeof(struct udphdr));
834 if (!pskb_may_pull(skb, L2TP_HDR_SIZE_MAX)) {
835 pr_warn_ratelimited("%s: recv short packet (len=%d)\n",
836 tunnel->name, skb->len);
840 /* Point to L2TP header */
844 /* Get L2TP header flags */
845 hdrflags = ntohs(*(__be16 *)ptr);
847 /* Check protocol version */
848 version = hdrflags & L2TP_HDR_VER_MASK;
849 if (version != tunnel->version) {
850 pr_warn_ratelimited("%s: recv protocol version mismatch: got %d expected %d\n",
851 tunnel->name, version, tunnel->version);
855 /* Get length of L2TP packet */
858 /* If type is control packet, it is handled by userspace. */
859 if (hdrflags & L2TP_HDRFLAG_T)
865 if (tunnel->version == L2TP_HDR_VER_2) {
866 /* If length is present, skip it */
867 if (hdrflags & L2TP_HDRFLAG_L)
870 /* Extract tunnel and session ID */
871 tunnel_id = ntohs(*(__be16 *)ptr);
873 session_id = ntohs(*(__be16 *)ptr);
876 ptr += 2; /* skip reserved bits */
877 tunnel_id = tunnel->tunnel_id;
878 session_id = ntohl(*(__be32 *)ptr);
882 /* Find the session context */
883 session = l2tp_tunnel_get_session(tunnel, session_id);
884 if (!session || !session->recv_skb) {
886 l2tp_session_dec_refcount(session);
888 /* Not found? Pass to userspace to deal with */
889 pr_warn_ratelimited("%s: no session found (%u/%u). Passing up.\n",
890 tunnel->name, tunnel_id, session_id);
894 if (tunnel->version == L2TP_HDR_VER_3 &&
895 l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr))
898 l2tp_recv_common(session, skb, ptr, optr, hdrflags, length);
899 l2tp_session_dec_refcount(session);
904 /* Put UDP header back */
905 __skb_push(skb, sizeof(struct udphdr));
910 /* UDP encapsulation receive handler. See net/ipv4/udp.c.
914 * >0: skb should be passed up to userspace as UDP.
916 int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
918 struct l2tp_tunnel *tunnel;
920 tunnel = rcu_dereference_sk_user_data(sk);
924 if (l2tp_udp_recv_core(tunnel, skb))
932 EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv);
934 /************************************************************************
936 ***********************************************************************/
938 /* Build an L2TP header for the session into the buffer provided.
940 static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
942 struct l2tp_tunnel *tunnel = session->tunnel;
945 u16 flags = L2TP_HDR_VER_2;
946 u32 tunnel_id = tunnel->peer_tunnel_id;
947 u32 session_id = session->peer_session_id;
949 if (session->send_seq)
950 flags |= L2TP_HDRFLAG_S;
952 /* Setup L2TP header. */
953 *bufp++ = htons(flags);
954 *bufp++ = htons(tunnel_id);
955 *bufp++ = htons(session_id);
956 if (session->send_seq) {
957 *bufp++ = htons(session->ns);
960 session->ns &= 0xffff;
961 l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated ns to %u\n",
962 session->name, session->ns);
968 static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
970 struct l2tp_tunnel *tunnel = session->tunnel;
974 /* Setup L2TP header. The header differs slightly for UDP and
975 * IP encapsulations. For UDP, there is 4 bytes of flags.
977 if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
978 u16 flags = L2TP_HDR_VER_3;
979 *((__be16 *)bufp) = htons(flags);
981 *((__be16 *)bufp) = 0;
985 *((__be32 *)bufp) = htonl(session->peer_session_id);
987 if (session->cookie_len) {
988 memcpy(bufp, &session->cookie[0], session->cookie_len);
989 bufp += session->cookie_len;
991 if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
994 if (session->send_seq) {
995 l2h = 0x40000000 | session->ns;
997 session->ns &= 0xffffff;
998 l2tp_dbg(session, L2TP_MSG_SEQ,
999 "%s: updated ns to %u\n",
1000 session->name, session->ns);
1003 *((__be32 *)bufp) = htonl(l2h);
1010 static void l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
1011 struct flowi *fl, size_t data_len)
1013 struct l2tp_tunnel *tunnel = session->tunnel;
1014 unsigned int len = skb->len;
1017 /* Queue the packet to IP for output */
1020 #if IS_ENABLED(CONFIG_IPV6)
1021 if (l2tp_sk_is_v6(tunnel->sock))
1022 error = inet6_csk_xmit(tunnel->sock, skb, NULL);
1025 error = ip_queue_xmit(tunnel->sock, skb, fl);
1029 atomic_long_inc(&tunnel->stats.tx_packets);
1030 atomic_long_add(len, &tunnel->stats.tx_bytes);
1031 atomic_long_inc(&session->stats.tx_packets);
1032 atomic_long_add(len, &session->stats.tx_bytes);
1034 atomic_long_inc(&tunnel->stats.tx_errors);
1035 atomic_long_inc(&session->stats.tx_errors);
1039 /* If caller requires the skb to have a ppp header, the header must be
1040 * inserted in the skb data before calling this function.
1042 int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len)
1044 int data_len = skb->len;
1045 struct l2tp_tunnel *tunnel = session->tunnel;
1046 struct sock *sk = tunnel->sock;
1049 struct inet_sock *inet;
1051 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1053 int ret = NET_XMIT_SUCCESS;
1055 /* Check that there's enough headroom in the skb to insert IP,
1056 * UDP and L2TP headers. If not enough, expand it to
1057 * make room. Adjust truesize.
1059 headroom = NET_SKB_PAD + sizeof(struct iphdr) +
1061 if (skb_cow_head(skb, headroom)) {
1063 return NET_XMIT_DROP;
1066 /* Setup L2TP header */
1067 if (tunnel->version == L2TP_HDR_VER_2)
1068 l2tp_build_l2tpv2_header(session, __skb_push(skb, hdr_len));
1070 l2tp_build_l2tpv3_header(session, __skb_push(skb, hdr_len));
1072 /* Reset skb netfilter state */
1073 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
1074 IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
1079 if (sock_owned_by_user(sk)) {
1081 ret = NET_XMIT_DROP;
1085 /* The user-space may change the connection status for the user-space
1086 * provided socket at run time: we must check it under the socket lock
1088 if (tunnel->fd >= 0 && sk->sk_state != TCP_ESTABLISHED) {
1090 ret = NET_XMIT_DROP;
1095 fl = &inet->cork.fl;
1096 switch (tunnel->encap) {
1097 case L2TP_ENCAPTYPE_UDP:
1098 /* Setup UDP header */
1099 __skb_push(skb, sizeof(*uh));
1100 skb_reset_transport_header(skb);
1102 uh->source = inet->inet_sport;
1103 uh->dest = inet->inet_dport;
1104 udp_len = uhlen + hdr_len + data_len;
1105 uh->len = htons(udp_len);
1107 /* Calculate UDP checksum if configured to do so */
1108 #if IS_ENABLED(CONFIG_IPV6)
1109 if (l2tp_sk_is_v6(sk))
1110 udp6_set_csum(udp_get_no_check6_tx(sk),
1111 skb, &inet6_sk(sk)->saddr,
1112 &sk->sk_v6_daddr, udp_len);
1115 udp_set_csum(sk->sk_no_check_tx, skb, inet->inet_saddr,
1116 inet->inet_daddr, udp_len);
1119 case L2TP_ENCAPTYPE_IP:
1123 l2tp_xmit_core(session, skb, fl, data_len);
1129 EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
1131 /*****************************************************************************
1132 * Tinnel and session create/destroy.
1133 *****************************************************************************/
1135 /* Tunnel socket destruct hook.
1136 * The tunnel context is deleted only when all session sockets have been
1139 static void l2tp_tunnel_destruct(struct sock *sk)
1141 struct l2tp_tunnel *tunnel = l2tp_tunnel(sk);
1146 /* Disable udp encapsulation */
1147 switch (tunnel->encap) {
1148 case L2TP_ENCAPTYPE_UDP:
1149 /* No longer an encapsulation socket. See net/ipv4/udp.c */
1150 (udp_sk(sk))->encap_type = 0;
1151 (udp_sk(sk))->encap_rcv = NULL;
1152 (udp_sk(sk))->encap_destroy = NULL;
1154 case L2TP_ENCAPTYPE_IP:
1158 /* Remove hooks into tunnel socket */
1159 sk->sk_destruct = tunnel->old_sk_destruct;
1160 sk->sk_user_data = NULL;
1162 /* Call the original destructor */
1163 if (sk->sk_destruct)
1164 (*sk->sk_destruct)(sk);
1166 kfree_rcu(tunnel, rcu);
1171 /* Remove an l2tp session from l2tp_core's hash lists. */
1172 static void l2tp_session_unhash(struct l2tp_session *session)
1174 struct l2tp_tunnel *tunnel = session->tunnel;
1176 /* Remove the session from core hashes */
1178 /* Remove from the per-tunnel hash */
1179 write_lock_bh(&tunnel->hlist_lock);
1180 hlist_del_init(&session->hlist);
1181 write_unlock_bh(&tunnel->hlist_lock);
1183 /* For L2TPv3 we have a per-net hash: remove from there, too */
1184 if (tunnel->version != L2TP_HDR_VER_2) {
1185 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1187 spin_lock_bh(&pn->l2tp_session_hlist_lock);
1188 hlist_del_init_rcu(&session->global_hlist);
1189 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
1195 /* When the tunnel is closed, all the attached sessions need to go too.
1197 static void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
1200 struct hlist_node *walk;
1201 struct hlist_node *tmp;
1202 struct l2tp_session *session;
1204 write_lock_bh(&tunnel->hlist_lock);
1205 tunnel->acpt_newsess = false;
1206 for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
1208 hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
1209 session = hlist_entry(walk, struct l2tp_session, hlist);
1211 hlist_del_init(&session->hlist);
1213 if (test_and_set_bit(0, &session->dead))
1216 write_unlock_bh(&tunnel->hlist_lock);
1218 l2tp_session_unhash(session);
1219 l2tp_session_queue_purge(session);
1221 if (session->session_close)
1222 (*session->session_close)(session);
1224 l2tp_session_dec_refcount(session);
1226 write_lock_bh(&tunnel->hlist_lock);
1228 /* Now restart from the beginning of this hash
1229 * chain. We always remove a session from the
1230 * list so we are guaranteed to make forward
1236 write_unlock_bh(&tunnel->hlist_lock);
1239 /* Tunnel socket destroy hook for UDP encapsulation */
1240 static void l2tp_udp_encap_destroy(struct sock *sk)
1242 struct l2tp_tunnel *tunnel = l2tp_tunnel(sk);
1245 l2tp_tunnel_delete(tunnel);
1248 /* Workqueue tunnel deletion function */
1249 static void l2tp_tunnel_del_work(struct work_struct *work)
1251 struct l2tp_tunnel *tunnel = container_of(work, struct l2tp_tunnel,
1253 struct sock *sk = tunnel->sock;
1254 struct socket *sock = sk->sk_socket;
1255 struct l2tp_net *pn;
1257 l2tp_tunnel_closeall(tunnel);
1259 /* If the tunnel socket was created within the kernel, use
1260 * the sk API to release it here.
1262 if (tunnel->fd < 0) {
1264 kernel_sock_shutdown(sock, SHUT_RDWR);
1269 /* Remove the tunnel struct from the tunnel list */
1270 pn = l2tp_pernet(tunnel->l2tp_net);
1271 spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1272 list_del_rcu(&tunnel->list);
1273 spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
1275 /* drop initial ref */
1276 l2tp_tunnel_dec_refcount(tunnel);
1278 /* drop workqueue ref */
1279 l2tp_tunnel_dec_refcount(tunnel);
1282 /* Create a socket for the tunnel, if one isn't set up by
1283 * userspace. This is used for static tunnels where there is no
1284 * managing L2TP daemon.
1286 * Since we don't want these sockets to keep a namespace alive by
1287 * themselves, we drop the socket's namespace refcount after creation.
1288 * These sockets are freed when the namespace exits using the pernet
1291 static int l2tp_tunnel_sock_create(struct net *net,
1294 struct l2tp_tunnel_cfg *cfg,
1295 struct socket **sockp)
1298 struct socket *sock = NULL;
1299 struct udp_port_cfg udp_conf;
1301 switch (cfg->encap) {
1302 case L2TP_ENCAPTYPE_UDP:
1303 memset(&udp_conf, 0, sizeof(udp_conf));
1305 #if IS_ENABLED(CONFIG_IPV6)
1306 if (cfg->local_ip6 && cfg->peer_ip6) {
1307 udp_conf.family = AF_INET6;
1308 memcpy(&udp_conf.local_ip6, cfg->local_ip6,
1309 sizeof(udp_conf.local_ip6));
1310 memcpy(&udp_conf.peer_ip6, cfg->peer_ip6,
1311 sizeof(udp_conf.peer_ip6));
1312 udp_conf.use_udp6_tx_checksums =
1313 !cfg->udp6_zero_tx_checksums;
1314 udp_conf.use_udp6_rx_checksums =
1315 !cfg->udp6_zero_rx_checksums;
1319 udp_conf.family = AF_INET;
1320 udp_conf.local_ip = cfg->local_ip;
1321 udp_conf.peer_ip = cfg->peer_ip;
1322 udp_conf.use_udp_checksums = cfg->use_udp_checksums;
1325 udp_conf.local_udp_port = htons(cfg->local_udp_port);
1326 udp_conf.peer_udp_port = htons(cfg->peer_udp_port);
1328 err = udp_sock_create(net, &udp_conf, &sock);
1334 case L2TP_ENCAPTYPE_IP:
1335 #if IS_ENABLED(CONFIG_IPV6)
1336 if (cfg->local_ip6 && cfg->peer_ip6) {
1337 struct sockaddr_l2tpip6 ip6_addr = {0};
1339 err = sock_create_kern(net, AF_INET6, SOCK_DGRAM,
1340 IPPROTO_L2TP, &sock);
1344 ip6_addr.l2tp_family = AF_INET6;
1345 memcpy(&ip6_addr.l2tp_addr, cfg->local_ip6,
1346 sizeof(ip6_addr.l2tp_addr));
1347 ip6_addr.l2tp_conn_id = tunnel_id;
1348 err = kernel_bind(sock, (struct sockaddr *)&ip6_addr,
1353 ip6_addr.l2tp_family = AF_INET6;
1354 memcpy(&ip6_addr.l2tp_addr, cfg->peer_ip6,
1355 sizeof(ip6_addr.l2tp_addr));
1356 ip6_addr.l2tp_conn_id = peer_tunnel_id;
1357 err = kernel_connect(sock,
1358 (struct sockaddr *)&ip6_addr,
1359 sizeof(ip6_addr), 0);
1365 struct sockaddr_l2tpip ip_addr = {0};
1367 err = sock_create_kern(net, AF_INET, SOCK_DGRAM,
1368 IPPROTO_L2TP, &sock);
1372 ip_addr.l2tp_family = AF_INET;
1373 ip_addr.l2tp_addr = cfg->local_ip;
1374 ip_addr.l2tp_conn_id = tunnel_id;
1375 err = kernel_bind(sock, (struct sockaddr *)&ip_addr,
1380 ip_addr.l2tp_family = AF_INET;
1381 ip_addr.l2tp_addr = cfg->peer_ip;
1382 ip_addr.l2tp_conn_id = peer_tunnel_id;
1383 err = kernel_connect(sock, (struct sockaddr *)&ip_addr,
1384 sizeof(ip_addr), 0);
1396 if (err < 0 && sock) {
1397 kernel_sock_shutdown(sock, SHUT_RDWR);
1405 static struct lock_class_key l2tp_socket_class;
1407 int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id,
1408 struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp)
1410 struct l2tp_tunnel *tunnel = NULL;
1412 enum l2tp_encap_type encap = L2TP_ENCAPTYPE_UDP;
1417 tunnel = kzalloc(sizeof(*tunnel), GFP_KERNEL);
1423 tunnel->version = version;
1424 tunnel->tunnel_id = tunnel_id;
1425 tunnel->peer_tunnel_id = peer_tunnel_id;
1426 tunnel->debug = L2TP_DEFAULT_DEBUG_FLAGS;
1428 tunnel->magic = L2TP_TUNNEL_MAGIC;
1429 sprintf(&tunnel->name[0], "tunl %u", tunnel_id);
1430 rwlock_init(&tunnel->hlist_lock);
1431 tunnel->acpt_newsess = true;
1434 tunnel->debug = cfg->debug;
1436 tunnel->encap = encap;
1438 refcount_set(&tunnel->ref_count, 1);
1441 /* Init delete workqueue struct */
1442 INIT_WORK(&tunnel->del_work, l2tp_tunnel_del_work);
1444 INIT_LIST_HEAD(&tunnel->list);
1453 EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
1455 static int l2tp_validate_socket(const struct sock *sk, const struct net *net,
1456 enum l2tp_encap_type encap)
1458 if (!net_eq(sock_net(sk), net))
1461 if (sk->sk_type != SOCK_DGRAM)
1462 return -EPROTONOSUPPORT;
1464 if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)
1465 return -EPROTONOSUPPORT;
1467 if ((encap == L2TP_ENCAPTYPE_UDP && sk->sk_protocol != IPPROTO_UDP) ||
1468 (encap == L2TP_ENCAPTYPE_IP && sk->sk_protocol != IPPROTO_L2TP))
1469 return -EPROTONOSUPPORT;
1471 if (sk->sk_user_data)
1477 int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
1478 struct l2tp_tunnel_cfg *cfg)
1480 struct l2tp_tunnel *tunnel_walk;
1481 struct l2tp_net *pn;
1482 struct socket *sock;
1486 if (tunnel->fd < 0) {
1487 ret = l2tp_tunnel_sock_create(net, tunnel->tunnel_id,
1488 tunnel->peer_tunnel_id, cfg,
1493 sock = sockfd_lookup(tunnel->fd, &ret);
1497 ret = l2tp_validate_socket(sock->sk, net, tunnel->encap);
1502 tunnel->l2tp_net = net;
1503 pn = l2tp_pernet(net);
1505 spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1506 list_for_each_entry(tunnel_walk, &pn->l2tp_tunnel_list, list) {
1507 if (tunnel_walk->tunnel_id == tunnel->tunnel_id) {
1508 spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
1514 list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
1515 spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
1521 if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
1522 struct udp_tunnel_sock_cfg udp_cfg = {
1523 .sk_user_data = tunnel,
1524 .encap_type = UDP_ENCAP_L2TPINUDP,
1525 .encap_rcv = l2tp_udp_encap_recv,
1526 .encap_destroy = l2tp_udp_encap_destroy,
1529 setup_udp_tunnel_sock(net, sock, &udp_cfg);
1531 sk->sk_user_data = tunnel;
1534 tunnel->old_sk_destruct = sk->sk_destruct;
1535 sk->sk_destruct = &l2tp_tunnel_destruct;
1536 lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class,
1538 sk->sk_allocation = GFP_ATOMIC;
1540 if (tunnel->fd >= 0)
1553 EXPORT_SYMBOL_GPL(l2tp_tunnel_register);
1555 /* This function is used by the netlink TUNNEL_DELETE command.
1557 void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
1559 if (!test_and_set_bit(0, &tunnel->dead)) {
1560 l2tp_tunnel_inc_refcount(tunnel);
1561 queue_work(l2tp_wq, &tunnel->del_work);
1564 EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
1566 void l2tp_session_delete(struct l2tp_session *session)
1568 if (test_and_set_bit(0, &session->dead))
1571 l2tp_session_unhash(session);
1572 l2tp_session_queue_purge(session);
1573 if (session->session_close)
1574 (*session->session_close)(session);
1576 l2tp_session_dec_refcount(session);
1578 EXPORT_SYMBOL_GPL(l2tp_session_delete);
1580 /* We come here whenever a session's send_seq, cookie_len or
1581 * l2specific_type parameters are set.
1583 void l2tp_session_set_header_len(struct l2tp_session *session, int version)
1585 if (version == L2TP_HDR_VER_2) {
1586 session->hdr_len = 6;
1587 if (session->send_seq)
1588 session->hdr_len += 4;
1590 session->hdr_len = 4 + session->cookie_len;
1591 session->hdr_len += l2tp_get_l2specific_len(session);
1592 if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)
1593 session->hdr_len += 4;
1596 EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
1598 struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id,
1599 u32 peer_session_id, struct l2tp_session_cfg *cfg)
1601 struct l2tp_session *session;
1603 session = kzalloc(sizeof(*session) + priv_size, GFP_KERNEL);
1605 session->magic = L2TP_SESSION_MAGIC;
1606 session->tunnel = tunnel;
1608 session->session_id = session_id;
1609 session->peer_session_id = peer_session_id;
1611 if (tunnel->version == L2TP_HDR_VER_2)
1612 session->nr_max = 0xffff;
1614 session->nr_max = 0xffffff;
1615 session->nr_window_size = session->nr_max / 2;
1616 session->nr_oos_count_max = 4;
1618 /* Use NR of first received packet */
1619 session->reorder_skip = 1;
1621 sprintf(&session->name[0], "sess %u/%u",
1622 tunnel->tunnel_id, session->session_id);
1624 skb_queue_head_init(&session->reorder_q);
1626 INIT_HLIST_NODE(&session->hlist);
1627 INIT_HLIST_NODE(&session->global_hlist);
1629 /* Inherit debug options from tunnel */
1630 session->debug = tunnel->debug;
1633 session->pwtype = cfg->pw_type;
1634 session->debug = cfg->debug;
1635 session->send_seq = cfg->send_seq;
1636 session->recv_seq = cfg->recv_seq;
1637 session->lns_mode = cfg->lns_mode;
1638 session->reorder_timeout = cfg->reorder_timeout;
1639 session->l2specific_type = cfg->l2specific_type;
1640 session->cookie_len = cfg->cookie_len;
1641 memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);
1642 session->peer_cookie_len = cfg->peer_cookie_len;
1643 memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);
1646 l2tp_session_set_header_len(session, tunnel->version);
1648 refcount_set(&session->ref_count, 1);
1653 return ERR_PTR(-ENOMEM);
1655 EXPORT_SYMBOL_GPL(l2tp_session_create);
1657 /*****************************************************************************
1659 *****************************************************************************/
1661 static __net_init int l2tp_init_net(struct net *net)
1663 struct l2tp_net *pn = net_generic(net, l2tp_net_id);
1666 INIT_LIST_HEAD(&pn->l2tp_tunnel_list);
1667 spin_lock_init(&pn->l2tp_tunnel_list_lock);
1669 for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
1670 INIT_HLIST_HEAD(&pn->l2tp_session_hlist[hash]);
1672 spin_lock_init(&pn->l2tp_session_hlist_lock);
1677 static __net_exit void l2tp_exit_net(struct net *net)
1679 struct l2tp_net *pn = l2tp_pernet(net);
1680 struct l2tp_tunnel *tunnel = NULL;
1684 list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
1685 l2tp_tunnel_delete(tunnel);
1687 rcu_read_unlock_bh();
1690 flush_workqueue(l2tp_wq);
1693 for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
1694 WARN_ON_ONCE(!hlist_empty(&pn->l2tp_session_hlist[hash]));
1697 static struct pernet_operations l2tp_net_ops = {
1698 .init = l2tp_init_net,
1699 .exit = l2tp_exit_net,
1701 .size = sizeof(struct l2tp_net),
1704 static int __init l2tp_init(void)
1708 rc = register_pernet_device(&l2tp_net_ops);
1712 l2tp_wq = alloc_workqueue("l2tp", WQ_UNBOUND, 0);
1714 pr_err("alloc_workqueue failed\n");
1715 unregister_pernet_device(&l2tp_net_ops);
1720 pr_info("L2TP core driver, %s\n", L2TP_DRV_VERSION);
1726 static void __exit l2tp_exit(void)
1728 unregister_pernet_device(&l2tp_net_ops);
1730 destroy_workqueue(l2tp_wq);
1735 module_init(l2tp_init);
1736 module_exit(l2tp_exit);
1738 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1739 MODULE_DESCRIPTION("L2TP core");
1740 MODULE_LICENSE("GPL");
1741 MODULE_VERSION(L2TP_DRV_VERSION);