1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*****************************************************************************
3 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets
5 * PPPoX --- Generic PPP encapsulation socket family
6 * PPPoL2TP --- PPP over L2TP (RFC 2661)
10 * Authors: James Chapman (jchapman@katalix.com)
12 * Based on original work by Martijn van Oosterhout <kleptog@svana.org>
17 /* This driver handles only L2TP data frames; control frames are handled by a
18 * userspace application.
20 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and
21 * attaches it to a bound UDP socket with local tunnel_id / session_id and
22 * peer tunnel_id / session_id set. Data can then be sent or received using
23 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket
24 * can be read or modified using ioctl() or [gs]etsockopt() calls.
26 * When a PPPoL2TP socket is connected with local and peer session_id values
27 * zero, the socket is treated as a special tunnel management socket.
29 * Here's example userspace code to create a socket for sending/receiving data
30 * over an L2TP session:-
32 * struct sockaddr_pppol2tp sax;
36 * fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
38 * sax.sa_family = AF_PPPOX;
39 * sax.sa_protocol = PX_PROTO_OL2TP;
40 * sax.pppol2tp.fd = tunnel_fd; // bound UDP socket
41 * sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr;
42 * sax.pppol2tp.addr.sin_port = addr->sin_port;
43 * sax.pppol2tp.addr.sin_family = AF_INET;
44 * sax.pppol2tp.s_tunnel = tunnel_id;
45 * sax.pppol2tp.s_session = session_id;
46 * sax.pppol2tp.d_tunnel = peer_tunnel_id;
47 * sax.pppol2tp.d_session = peer_session_id;
49 * session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax));
51 * A pppd plugin that allows PPP traffic to be carried over L2TP using
52 * this driver is available from the OpenL2TP project at
53 * http://openl2tp.sourceforge.net.
56 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
58 #include <linux/module.h>
59 #include <linux/string.h>
60 #include <linux/list.h>
61 #include <linux/uaccess.h>
63 #include <linux/kernel.h>
64 #include <linux/spinlock.h>
65 #include <linux/kthread.h>
66 #include <linux/sched.h>
67 #include <linux/slab.h>
68 #include <linux/errno.h>
69 #include <linux/jiffies.h>
71 #include <linux/netdevice.h>
72 #include <linux/net.h>
73 #include <linux/inetdevice.h>
74 #include <linux/skbuff.h>
75 #include <linux/init.h>
77 #include <linux/udp.h>
78 #include <linux/if_pppox.h>
79 #include <linux/if_pppol2tp.h>
81 #include <linux/ppp_channel.h>
82 #include <linux/ppp_defs.h>
83 #include <linux/ppp-ioctl.h>
84 #include <linux/file.h>
85 #include <linux/hash.h>
86 #include <linux/sort.h>
87 #include <linux/proc_fs.h>
88 #include <linux/l2tp.h>
89 #include <linux/nsproxy.h>
90 #include <net/net_namespace.h>
91 #include <net/netns/generic.h>
94 #include <net/inet_common.h>
96 #include <asm/byteorder.h>
97 #include <linux/atomic.h>
99 #include "l2tp_core.h"
101 #define PPPOL2TP_DRV_VERSION "V2.0"
103 /* Space for UDP, L2TP and PPP headers */
104 #define PPPOL2TP_HEADER_OVERHEAD 40
106 /* Number of bytes to build transmit L2TP headers.
107 * Unfortunately the size is different depending on whether sequence numbers
110 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10
111 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6
113 /* Private data of each session. This data lives at the end of struct
114 * l2tp_session, referenced via session->priv[].
116 struct pppol2tp_session {
117 int owner; /* pid that opened the socket */
119 struct mutex sk_lock; /* Protects .sk */
120 struct sock __rcu *sk; /* Pointer to the session PPPoX socket */
121 struct sock *__sk; /* Copy of .sk, for cleanup */
122 struct rcu_head rcu; /* For asynchronous release */
125 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);
127 static const struct ppp_channel_ops pppol2tp_chan_ops = {
128 .start_xmit = pppol2tp_xmit,
131 static const struct proto_ops pppol2tp_ops;
133 /* Retrieves the pppol2tp socket associated to a session.
134 * A reference is held on the returned socket, so this function must be paired
137 static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session)
139 struct pppol2tp_session *ps = l2tp_session_priv(session);
143 sk = rcu_dereference(ps->sk);
151 /* Helpers to obtain tunnel/session contexts from sockets.
153 static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk)
155 struct l2tp_session *session;
161 session = (struct l2tp_session *)(sk->sk_user_data);
167 BUG_ON(session->magic != L2TP_SESSION_MAGIC);
173 /*****************************************************************************
174 * Receive data handling
175 *****************************************************************************/
177 /* Receive message. This is the recvmsg for the PPPoL2TP socket.
179 static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg,
180 size_t len, int flags)
184 struct sock *sk = sock->sk;
187 if (sk->sk_state & PPPOX_BOUND)
191 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
192 flags & MSG_DONTWAIT, &err);
198 else if (len < skb->len)
199 msg->msg_flags |= MSG_TRUNC;
201 err = skb_copy_datagram_msg(skb, 0, msg, len);
202 if (likely(err == 0))
210 static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len)
212 struct pppol2tp_session *ps = l2tp_session_priv(session);
213 struct sock *sk = NULL;
215 /* If the socket is bound, send it in to PPP's input queue. Otherwise
216 * queue it on the session socket.
219 sk = rcu_dereference(ps->sk);
223 /* If the first two bytes are 0xFF03, consider that it is the PPP's
224 * Address and Control fields and skip them. The L2TP module has always
225 * worked this way, although, in theory, the use of these fields should
226 * be negociated and handled at the PPP layer. These fields are
227 * constant: 0xFF is the All-Stations Address and 0x03 the Unnumbered
228 * Information command with Poll/Final bit set to zero (RFC 1662).
230 if (pskb_may_pull(skb, 2) && skb->data[0] == PPP_ALLSTATIONS &&
231 skb->data[1] == PPP_UI)
234 if (sk->sk_state & PPPOX_BOUND) {
235 struct pppox_sock *po;
237 l2tp_dbg(session, L2TP_MSG_DATA,
238 "%s: recv %d byte data frame, passing to ppp\n",
239 session->name, data_len);
242 ppp_input(&po->chan, skb);
244 l2tp_dbg(session, L2TP_MSG_DATA,
245 "%s: recv %d byte data frame, passing to L2TP socket\n",
246 session->name, data_len);
248 if (sock_queue_rcv_skb(sk, skb) < 0) {
249 atomic_long_inc(&session->stats.rx_errors);
259 l2tp_info(session, L2TP_MSG_DATA, "%s: no socket\n", session->name);
263 /************************************************************************
265 ***********************************************************************/
267 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here
268 * when a user application does a sendmsg() on the session socket. L2TP and
269 * PPP headers must be inserted into the user's data.
271 static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
274 struct sock *sk = sock->sk;
277 struct l2tp_session *session;
278 struct l2tp_tunnel *tunnel;
282 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
285 /* Get session and tunnel contexts */
287 session = pppol2tp_sock_to_session(sk);
291 tunnel = session->tunnel;
293 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
295 /* Allocate a socket buffer */
297 skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) +
298 uhlen + session->hdr_len +
299 2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
304 /* Reserve space for headers. */
305 skb_reserve(skb, NET_SKB_PAD);
306 skb_reset_network_header(skb);
307 skb_reserve(skb, sizeof(struct iphdr));
308 skb_reset_transport_header(skb);
309 skb_reserve(skb, uhlen);
312 skb->data[0] = PPP_ALLSTATIONS;
313 skb->data[1] = PPP_UI;
316 /* Copy user data into skb */
317 error = memcpy_from_msg(skb_put(skb, total_len), m, total_len);
324 l2tp_xmit_skb(session, skb, session->hdr_len);
337 /* Transmit function called by generic PPP driver. Sends PPP frame
338 * over PPPoL2TP socket.
340 * This is almost the same as pppol2tp_sendmsg(), but rather than
341 * being called with a msghdr from userspace, it is called with a skb
344 * The supplied skb from ppp doesn't have enough headroom for the
345 * insertion of L2TP, UDP and IP headers so we need to allocate more
346 * headroom in the skb. This will create a cloned skb. But we must be
347 * careful in the error case because the caller will expect to free
348 * the skb it supplied, not our cloned skb. So we take care to always
349 * leave the original skb unfreed if we return an error.
351 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
353 struct sock *sk = (struct sock *)chan->private;
354 struct l2tp_session *session;
355 struct l2tp_tunnel *tunnel;
358 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
361 /* Get session and tunnel contexts from the socket */
362 session = pppol2tp_sock_to_session(sk);
366 tunnel = session->tunnel;
368 uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
369 headroom = NET_SKB_PAD +
370 sizeof(struct iphdr) + /* IP header */
371 uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */
372 session->hdr_len + /* L2TP header */
373 2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
374 if (skb_cow_head(skb, headroom))
377 /* Setup PPP header */
379 skb->data[0] = PPP_ALLSTATIONS;
380 skb->data[1] = PPP_UI;
383 l2tp_xmit_skb(session, skb, session->hdr_len);
393 /* Free the original skb */
398 /*****************************************************************************
399 * Session (and tunnel control) socket create/destroy.
400 *****************************************************************************/
402 static void pppol2tp_put_sk(struct rcu_head *head)
404 struct pppol2tp_session *ps;
406 ps = container_of(head, typeof(*ps), rcu);
410 /* Really kill the session socket. (Called from sock_put() if
413 static void pppol2tp_session_destruct(struct sock *sk)
415 struct l2tp_session *session = sk->sk_user_data;
417 skb_queue_purge(&sk->sk_receive_queue);
418 skb_queue_purge(&sk->sk_write_queue);
421 sk->sk_user_data = NULL;
422 BUG_ON(session->magic != L2TP_SESSION_MAGIC);
423 l2tp_session_dec_refcount(session);
427 /* Called when the PPPoX socket (session) is closed.
429 static int pppol2tp_release(struct socket *sock)
431 struct sock *sk = sock->sk;
432 struct l2tp_session *session;
440 if (sock_flag(sk, SOCK_DEAD) != 0)
443 pppox_unbind_sock(sk);
445 /* Signal the death of the socket. */
446 sk->sk_state = PPPOX_DEAD;
450 session = pppol2tp_sock_to_session(sk);
452 struct pppol2tp_session *ps;
454 l2tp_session_delete(session);
456 ps = l2tp_session_priv(session);
457 mutex_lock(&ps->sk_lock);
458 ps->__sk = rcu_dereference_protected(ps->sk,
459 lockdep_is_held(&ps->sk_lock));
460 RCU_INIT_POINTER(ps->sk, NULL);
461 mutex_unlock(&ps->sk_lock);
462 call_rcu(&ps->rcu, pppol2tp_put_sk);
464 /* Rely on the sock_put() call at the end of the function for
465 * dropping the reference held by pppol2tp_sock_to_session().
466 * The last reference will be dropped by pppol2tp_put_sk().
472 /* This will delete the session context via
473 * pppol2tp_session_destruct() if the socket's refcnt drops to
485 static struct proto pppol2tp_sk_proto = {
487 .owner = THIS_MODULE,
488 .obj_size = sizeof(struct pppox_sock),
491 static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb)
495 rc = l2tp_udp_encap_recv(sk, skb);
499 return NET_RX_SUCCESS;
502 /* socket() handler. Initialize a new struct sock.
504 static int pppol2tp_create(struct net *net, struct socket *sock, int kern)
509 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, kern);
513 sock_init_data(sock, sk);
515 sock->state = SS_UNCONNECTED;
516 sock->ops = &pppol2tp_ops;
518 sk->sk_backlog_rcv = pppol2tp_backlog_recv;
519 sk->sk_protocol = PX_PROTO_OL2TP;
520 sk->sk_family = PF_PPPOX;
521 sk->sk_state = PPPOX_NONE;
522 sk->sk_type = SOCK_STREAM;
523 sk->sk_destruct = pppol2tp_session_destruct;
531 static void pppol2tp_show(struct seq_file *m, void *arg)
533 struct l2tp_session *session = arg;
536 sk = pppol2tp_session_get_sock(session);
538 struct pppox_sock *po = pppox_sk(sk);
540 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan));
545 static void pppol2tp_session_init(struct l2tp_session *session)
547 struct pppol2tp_session *ps;
549 session->recv_skb = pppol2tp_recv;
550 if (IS_ENABLED(CONFIG_L2TP_DEBUGFS))
551 session->show = pppol2tp_show;
553 ps = l2tp_session_priv(session);
554 mutex_init(&ps->sk_lock);
555 ps->owner = current->pid;
558 struct l2tp_connect_info {
567 static int pppol2tp_sockaddr_get_info(const void *sa, int sa_len,
568 struct l2tp_connect_info *info)
571 case sizeof(struct sockaddr_pppol2tp):
573 const struct sockaddr_pppol2tp *sa_v2in4 = sa;
575 if (sa_v2in4->sa_protocol != PX_PROTO_OL2TP)
579 info->fd = sa_v2in4->pppol2tp.fd;
580 info->tunnel_id = sa_v2in4->pppol2tp.s_tunnel;
581 info->peer_tunnel_id = sa_v2in4->pppol2tp.d_tunnel;
582 info->session_id = sa_v2in4->pppol2tp.s_session;
583 info->peer_session_id = sa_v2in4->pppol2tp.d_session;
587 case sizeof(struct sockaddr_pppol2tpv3):
589 const struct sockaddr_pppol2tpv3 *sa_v3in4 = sa;
591 if (sa_v3in4->sa_protocol != PX_PROTO_OL2TP)
595 info->fd = sa_v3in4->pppol2tp.fd;
596 info->tunnel_id = sa_v3in4->pppol2tp.s_tunnel;
597 info->peer_tunnel_id = sa_v3in4->pppol2tp.d_tunnel;
598 info->session_id = sa_v3in4->pppol2tp.s_session;
599 info->peer_session_id = sa_v3in4->pppol2tp.d_session;
603 case sizeof(struct sockaddr_pppol2tpin6):
605 const struct sockaddr_pppol2tpin6 *sa_v2in6 = sa;
607 if (sa_v2in6->sa_protocol != PX_PROTO_OL2TP)
611 info->fd = sa_v2in6->pppol2tp.fd;
612 info->tunnel_id = sa_v2in6->pppol2tp.s_tunnel;
613 info->peer_tunnel_id = sa_v2in6->pppol2tp.d_tunnel;
614 info->session_id = sa_v2in6->pppol2tp.s_session;
615 info->peer_session_id = sa_v2in6->pppol2tp.d_session;
619 case sizeof(struct sockaddr_pppol2tpv3in6):
621 const struct sockaddr_pppol2tpv3in6 *sa_v3in6 = sa;
623 if (sa_v3in6->sa_protocol != PX_PROTO_OL2TP)
627 info->fd = sa_v3in6->pppol2tp.fd;
628 info->tunnel_id = sa_v3in6->pppol2tp.s_tunnel;
629 info->peer_tunnel_id = sa_v3in6->pppol2tp.d_tunnel;
630 info->session_id = sa_v3in6->pppol2tp.s_session;
631 info->peer_session_id = sa_v3in6->pppol2tp.d_session;
642 /* Rough estimation of the maximum payload size a tunnel can transmit without
643 * fragmenting at the lower IP layer. Assumes L2TPv2 with sequence
644 * numbers and no IP option. Not quite accurate, but the result is mostly
647 static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel)
651 mtu = l2tp_tunnel_dst_mtu(tunnel);
652 if (mtu <= PPPOL2TP_HEADER_OVERHEAD)
653 return 1500 - PPPOL2TP_HEADER_OVERHEAD;
655 return mtu - PPPOL2TP_HEADER_OVERHEAD;
658 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
660 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
661 int sockaddr_len, int flags)
663 struct sock *sk = sock->sk;
664 struct pppox_sock *po = pppox_sk(sk);
665 struct l2tp_session *session = NULL;
666 struct l2tp_connect_info info;
667 struct l2tp_tunnel *tunnel;
668 struct pppol2tp_session *ps;
669 struct l2tp_session_cfg cfg = { 0, };
670 bool drop_refcnt = false;
671 bool drop_tunnel = false;
672 bool new_session = false;
673 bool new_tunnel = false;
676 error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info);
682 /* Check for already bound sockets */
684 if (sk->sk_state & PPPOX_CONNECTED)
687 /* We don't supporting rebinding anyway */
689 if (sk->sk_user_data)
690 goto end; /* socket is already attached */
692 /* Don't bind if tunnel_id is 0 */
697 tunnel = l2tp_tunnel_get(sock_net(sk), info.tunnel_id);
701 /* Special case: create tunnel context if session_id and
702 * peer_session_id is 0. Otherwise look up tunnel using supplied
705 if (!info.session_id && !info.peer_session_id) {
707 struct l2tp_tunnel_cfg tcfg = {
708 .encap = L2TP_ENCAPTYPE_UDP,
712 /* Prevent l2tp_tunnel_register() from trying to set up
720 error = l2tp_tunnel_create(sock_net(sk), info.fd,
723 info.peer_tunnel_id, &tcfg,
728 l2tp_tunnel_inc_refcount(tunnel);
729 error = l2tp_tunnel_register(tunnel, sock_net(sk),
739 /* Error if we can't find the tunnel */
744 /* Error if socket is not prepped */
749 if (tunnel->peer_tunnel_id == 0)
750 tunnel->peer_tunnel_id = info.peer_tunnel_id;
752 session = l2tp_tunnel_get_session(tunnel, info.session_id);
756 if (session->pwtype != L2TP_PWTYPE_PPP) {
761 ps = l2tp_session_priv(session);
763 /* Using a pre-existing session is fine as long as it hasn't
764 * been connected yet.
766 mutex_lock(&ps->sk_lock);
767 if (rcu_dereference_protected(ps->sk,
768 lockdep_is_held(&ps->sk_lock)) ||
770 mutex_unlock(&ps->sk_lock);
775 cfg.pw_type = L2TP_PWTYPE_PPP;
777 session = l2tp_session_create(sizeof(struct pppol2tp_session),
778 tunnel, info.session_id,
779 info.peer_session_id, &cfg);
780 if (IS_ERR(session)) {
781 error = PTR_ERR(session);
785 pppol2tp_session_init(session);
786 ps = l2tp_session_priv(session);
787 l2tp_session_inc_refcount(session);
789 mutex_lock(&ps->sk_lock);
790 error = l2tp_session_register(session, tunnel);
792 mutex_unlock(&ps->sk_lock);
800 /* Special case: if source & dest session_id == 0x0000, this
801 * socket is being created to manage the tunnel. Just set up
802 * the internal context for use by ioctl() and sockopt()
805 if (session->session_id == 0 && session->peer_session_id == 0) {
810 /* The only header we need to worry about is the L2TP
811 * header. This size is different depending on whether
812 * sequence numbers are enabled for the data channel.
814 po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
816 po->chan.private = sk;
817 po->chan.ops = &pppol2tp_chan_ops;
818 po->chan.mtu = pppol2tp_tunnel_mtu(tunnel);
820 error = ppp_register_net_channel(sock_net(sk), &po->chan);
822 mutex_unlock(&ps->sk_lock);
827 /* This is how we get the session context from the socket. */
828 sk->sk_user_data = session;
829 rcu_assign_pointer(ps->sk, sk);
830 mutex_unlock(&ps->sk_lock);
832 /* Keep the reference we've grabbed on the session: sk doesn't expect
833 * the session to disappear. pppol2tp_session_destruct() is responsible
838 sk->sk_state = PPPOX_CONNECTED;
839 l2tp_info(session, L2TP_MSG_CONTROL, "%s: created\n",
845 l2tp_session_delete(session);
847 l2tp_tunnel_delete(tunnel);
850 l2tp_session_dec_refcount(session);
852 l2tp_tunnel_dec_refcount(tunnel);
858 #ifdef CONFIG_L2TP_V3
860 /* Called when creating sessions via the netlink interface. */
861 static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel,
862 u32 session_id, u32 peer_session_id,
863 struct l2tp_session_cfg *cfg)
866 struct l2tp_session *session;
868 /* Error if tunnel socket is not prepped */
874 /* Allocate and initialize a new session context. */
875 session = l2tp_session_create(sizeof(struct pppol2tp_session),
877 peer_session_id, cfg);
878 if (IS_ERR(session)) {
879 error = PTR_ERR(session);
883 pppol2tp_session_init(session);
885 error = l2tp_session_register(session, tunnel);
897 #endif /* CONFIG_L2TP_V3 */
899 /* getname() support.
901 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
906 struct l2tp_session *session;
907 struct l2tp_tunnel *tunnel;
908 struct sock *sk = sock->sk;
909 struct inet_sock *inet;
910 struct pppol2tp_session *pls;
915 if (!(sk->sk_state & PPPOX_CONNECTED))
919 session = pppol2tp_sock_to_session(sk);
923 pls = l2tp_session_priv(session);
924 tunnel = session->tunnel;
926 inet = inet_sk(tunnel->sock);
927 if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET) {
928 struct sockaddr_pppol2tp sp;
932 sp.sa_family = AF_PPPOX;
933 sp.sa_protocol = PX_PROTO_OL2TP;
934 sp.pppol2tp.fd = tunnel->fd;
935 sp.pppol2tp.pid = pls->owner;
936 sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
937 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
938 sp.pppol2tp.s_session = session->session_id;
939 sp.pppol2tp.d_session = session->peer_session_id;
940 sp.pppol2tp.addr.sin_family = AF_INET;
941 sp.pppol2tp.addr.sin_port = inet->inet_dport;
942 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
943 memcpy(uaddr, &sp, len);
944 #if IS_ENABLED(CONFIG_IPV6)
945 } else if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET6) {
946 struct sockaddr_pppol2tpin6 sp;
950 sp.sa_family = AF_PPPOX;
951 sp.sa_protocol = PX_PROTO_OL2TP;
952 sp.pppol2tp.fd = tunnel->fd;
953 sp.pppol2tp.pid = pls->owner;
954 sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
955 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
956 sp.pppol2tp.s_session = session->session_id;
957 sp.pppol2tp.d_session = session->peer_session_id;
958 sp.pppol2tp.addr.sin6_family = AF_INET6;
959 sp.pppol2tp.addr.sin6_port = inet->inet_dport;
960 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
961 sizeof(tunnel->sock->sk_v6_daddr));
962 memcpy(uaddr, &sp, len);
963 } else if (tunnel->version == 3 && tunnel->sock->sk_family == AF_INET6) {
964 struct sockaddr_pppol2tpv3in6 sp;
968 sp.sa_family = AF_PPPOX;
969 sp.sa_protocol = PX_PROTO_OL2TP;
970 sp.pppol2tp.fd = tunnel->fd;
971 sp.pppol2tp.pid = pls->owner;
972 sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
973 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
974 sp.pppol2tp.s_session = session->session_id;
975 sp.pppol2tp.d_session = session->peer_session_id;
976 sp.pppol2tp.addr.sin6_family = AF_INET6;
977 sp.pppol2tp.addr.sin6_port = inet->inet_dport;
978 memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
979 sizeof(tunnel->sock->sk_v6_daddr));
980 memcpy(uaddr, &sp, len);
982 } else if (tunnel->version == 3) {
983 struct sockaddr_pppol2tpv3 sp;
987 sp.sa_family = AF_PPPOX;
988 sp.sa_protocol = PX_PROTO_OL2TP;
989 sp.pppol2tp.fd = tunnel->fd;
990 sp.pppol2tp.pid = pls->owner;
991 sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
992 sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
993 sp.pppol2tp.s_session = session->session_id;
994 sp.pppol2tp.d_session = session->peer_session_id;
995 sp.pppol2tp.addr.sin_family = AF_INET;
996 sp.pppol2tp.addr.sin_port = inet->inet_dport;
997 sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
998 memcpy(uaddr, &sp, len);
1008 /****************************************************************************
1011 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
1012 * sockets. However, in order to control kernel tunnel features, we allow
1013 * userspace to create a special "tunnel" PPPoX socket which is used for
1014 * control only. Tunnel PPPoX sockets have session_id == 0 and simply allow
1015 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl()
1017 ****************************************************************************/
1019 static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest,
1020 const struct l2tp_stats *stats)
1022 memset(dest, 0, sizeof(*dest));
1024 dest->tx_packets = atomic_long_read(&stats->tx_packets);
1025 dest->tx_bytes = atomic_long_read(&stats->tx_bytes);
1026 dest->tx_errors = atomic_long_read(&stats->tx_errors);
1027 dest->rx_packets = atomic_long_read(&stats->rx_packets);
1028 dest->rx_bytes = atomic_long_read(&stats->rx_bytes);
1029 dest->rx_seq_discards = atomic_long_read(&stats->rx_seq_discards);
1030 dest->rx_oos_packets = atomic_long_read(&stats->rx_oos_packets);
1031 dest->rx_errors = atomic_long_read(&stats->rx_errors);
1034 static int pppol2tp_tunnel_copy_stats(struct pppol2tp_ioc_stats *stats,
1035 struct l2tp_tunnel *tunnel)
1037 struct l2tp_session *session;
1039 if (!stats->session_id) {
1040 pppol2tp_copy_stats(stats, &tunnel->stats);
1044 /* If session_id is set, search the corresponding session in the
1045 * context of this tunnel and record the session's statistics.
1047 session = l2tp_tunnel_get_session(tunnel, stats->session_id);
1051 if (session->pwtype != L2TP_PWTYPE_PPP) {
1052 l2tp_session_dec_refcount(session);
1056 pppol2tp_copy_stats(stats, &session->stats);
1057 l2tp_session_dec_refcount(session);
1062 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
1065 struct pppol2tp_ioc_stats stats;
1066 struct l2tp_session *session;
1071 session = sock->sk->sk_user_data;
1075 /* Not defined for tunnels */
1076 if (!session->session_id && !session->peer_session_id)
1079 if (put_user(0, (int __user *)arg))
1085 session = sock->sk->sk_user_data;
1089 /* Not defined for tunnels */
1090 if (!session->session_id && !session->peer_session_id)
1093 if (!access_ok((int __user *)arg, sizeof(int)))
1097 case PPPIOCGL2TPSTATS:
1098 session = sock->sk->sk_user_data;
1102 /* Session 0 represents the parent tunnel */
1103 if (!session->session_id && !session->peer_session_id) {
1107 if (copy_from_user(&stats, (void __user *)arg,
1111 session_id = stats.session_id;
1112 err = pppol2tp_tunnel_copy_stats(&stats,
1117 stats.session_id = session_id;
1119 pppol2tp_copy_stats(&stats, &session->stats);
1120 stats.session_id = session->session_id;
1122 stats.tunnel_id = session->tunnel->tunnel_id;
1123 stats.using_ipsec = l2tp_tunnel_uses_xfrm(session->tunnel);
1125 if (copy_to_user((void __user *)arg, &stats, sizeof(stats)))
1130 return -ENOIOCTLCMD;
1136 /*****************************************************************************
1137 * setsockopt() / getsockopt() support.
1139 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
1140 * sockets. In order to control kernel tunnel features, we allow userspace to
1141 * create a special "tunnel" PPPoX socket which is used for control only.
1142 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user
1143 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls.
1144 *****************************************************************************/
1146 /* Tunnel setsockopt() helper.
1148 static int pppol2tp_tunnel_setsockopt(struct sock *sk,
1149 struct l2tp_tunnel *tunnel,
1150 int optname, int val)
1155 case PPPOL2TP_SO_DEBUG:
1156 tunnel->debug = val;
1157 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: set debug=%x\n",
1158 tunnel->name, tunnel->debug);
1169 /* Session setsockopt helper.
1171 static int pppol2tp_session_setsockopt(struct sock *sk,
1172 struct l2tp_session *session,
1173 int optname, int val)
1178 case PPPOL2TP_SO_RECVSEQ:
1179 if (val != 0 && val != 1) {
1183 session->recv_seq = !!val;
1184 l2tp_info(session, L2TP_MSG_CONTROL,
1185 "%s: set recv_seq=%d\n",
1186 session->name, session->recv_seq);
1189 case PPPOL2TP_SO_SENDSEQ:
1190 if (val != 0 && val != 1) {
1194 session->send_seq = !!val;
1196 struct pppox_sock *po = pppox_sk(sk);
1198 po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
1199 PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
1201 l2tp_session_set_header_len(session, session->tunnel->version);
1202 l2tp_info(session, L2TP_MSG_CONTROL,
1203 "%s: set send_seq=%d\n",
1204 session->name, session->send_seq);
1207 case PPPOL2TP_SO_LNSMODE:
1208 if (val != 0 && val != 1) {
1212 session->lns_mode = !!val;
1213 l2tp_info(session, L2TP_MSG_CONTROL,
1214 "%s: set lns_mode=%d\n",
1215 session->name, session->lns_mode);
1218 case PPPOL2TP_SO_DEBUG:
1219 session->debug = val;
1220 l2tp_info(session, L2TP_MSG_CONTROL, "%s: set debug=%x\n",
1221 session->name, session->debug);
1224 case PPPOL2TP_SO_REORDERTO:
1225 session->reorder_timeout = msecs_to_jiffies(val);
1226 l2tp_info(session, L2TP_MSG_CONTROL,
1227 "%s: set reorder_timeout=%d\n",
1228 session->name, session->reorder_timeout);
1239 /* Main setsockopt() entry point.
1240 * Does API checks, then calls either the tunnel or session setsockopt
1241 * handler, according to whether the PPPoL2TP socket is a for a regular
1242 * session or the special tunnel type.
1244 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
1245 sockptr_t optval, unsigned int optlen)
1247 struct sock *sk = sock->sk;
1248 struct l2tp_session *session;
1249 struct l2tp_tunnel *tunnel;
1253 if (level != SOL_PPPOL2TP)
1256 if (optlen < sizeof(int))
1259 if (copy_from_sockptr(&val, optval, sizeof(int)))
1263 if (!sk->sk_user_data)
1266 /* Get session context from the socket */
1268 session = pppol2tp_sock_to_session(sk);
1272 /* Special case: if session_id == 0x0000, treat as operation on tunnel
1274 if (session->session_id == 0 && session->peer_session_id == 0) {
1275 tunnel = session->tunnel;
1276 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
1278 err = pppol2tp_session_setsockopt(sk, session, optname, val);
1286 /* Tunnel getsockopt helper. Called with sock locked.
1288 static int pppol2tp_tunnel_getsockopt(struct sock *sk,
1289 struct l2tp_tunnel *tunnel,
1290 int optname, int *val)
1295 case PPPOL2TP_SO_DEBUG:
1296 *val = tunnel->debug;
1297 l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: get debug=%x\n",
1298 tunnel->name, tunnel->debug);
1309 /* Session getsockopt helper. Called with sock locked.
1311 static int pppol2tp_session_getsockopt(struct sock *sk,
1312 struct l2tp_session *session,
1313 int optname, int *val)
1318 case PPPOL2TP_SO_RECVSEQ:
1319 *val = session->recv_seq;
1320 l2tp_info(session, L2TP_MSG_CONTROL,
1321 "%s: get recv_seq=%d\n", session->name, *val);
1324 case PPPOL2TP_SO_SENDSEQ:
1325 *val = session->send_seq;
1326 l2tp_info(session, L2TP_MSG_CONTROL,
1327 "%s: get send_seq=%d\n", session->name, *val);
1330 case PPPOL2TP_SO_LNSMODE:
1331 *val = session->lns_mode;
1332 l2tp_info(session, L2TP_MSG_CONTROL,
1333 "%s: get lns_mode=%d\n", session->name, *val);
1336 case PPPOL2TP_SO_DEBUG:
1337 *val = session->debug;
1338 l2tp_info(session, L2TP_MSG_CONTROL, "%s: get debug=%d\n",
1339 session->name, *val);
1342 case PPPOL2TP_SO_REORDERTO:
1343 *val = (int)jiffies_to_msecs(session->reorder_timeout);
1344 l2tp_info(session, L2TP_MSG_CONTROL,
1345 "%s: get reorder_timeout=%d\n", session->name, *val);
1355 /* Main getsockopt() entry point.
1356 * Does API checks, then calls either the tunnel or session getsockopt
1357 * handler, according to whether the PPPoX socket is a for a regular session
1358 * or the special tunnel type.
1360 static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
1361 char __user *optval, int __user *optlen)
1363 struct sock *sk = sock->sk;
1364 struct l2tp_session *session;
1365 struct l2tp_tunnel *tunnel;
1369 if (level != SOL_PPPOL2TP)
1372 if (get_user(len, optlen))
1375 len = min_t(unsigned int, len, sizeof(int));
1381 if (!sk->sk_user_data)
1384 /* Get the session context */
1386 session = pppol2tp_sock_to_session(sk);
1390 /* Special case: if session_id == 0x0000, treat as operation on tunnel */
1391 if (session->session_id == 0 && session->peer_session_id == 0) {
1392 tunnel = session->tunnel;
1393 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
1397 err = pppol2tp_session_getsockopt(sk, session, optname, &val);
1403 if (put_user(len, optlen))
1406 if (copy_to_user((void __user *)optval, &val, len))
1417 /*****************************************************************************
1418 * /proc filesystem for debug
1419 * Since the original pppol2tp driver provided /proc/net/pppol2tp for
1420 * L2TPv2, we dump only L2TPv2 tunnels and sessions here.
1421 *****************************************************************************/
1423 static unsigned int pppol2tp_net_id;
1425 #ifdef CONFIG_PROC_FS
1427 struct pppol2tp_seq_data {
1428 struct seq_net_private p;
1429 int tunnel_idx; /* current tunnel */
1430 int session_idx; /* index of session within current tunnel */
1431 struct l2tp_tunnel *tunnel;
1432 struct l2tp_session *session; /* NULL means get next tunnel */
1435 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
1437 /* Drop reference taken during previous invocation */
1439 l2tp_tunnel_dec_refcount(pd->tunnel);
1442 pd->tunnel = l2tp_tunnel_get_nth(net, pd->tunnel_idx);
1445 /* Only accept L2TPv2 tunnels */
1446 if (!pd->tunnel || pd->tunnel->version == 2)
1449 l2tp_tunnel_dec_refcount(pd->tunnel);
1453 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
1455 /* Drop reference taken during previous invocation */
1457 l2tp_session_dec_refcount(pd->session);
1459 pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx);
1463 pd->session_idx = 0;
1464 pppol2tp_next_tunnel(net, pd);
1468 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs)
1470 struct pppol2tp_seq_data *pd = SEQ_START_TOKEN;
1477 BUG_ON(!m->private);
1479 net = seq_file_net(m);
1482 pppol2tp_next_tunnel(net, pd);
1484 pppol2tp_next_session(net, pd);
1486 /* NULL tunnel and session indicates end of list */
1487 if (!pd->tunnel && !pd->session)
1494 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos)
1500 static void pppol2tp_seq_stop(struct seq_file *p, void *v)
1502 struct pppol2tp_seq_data *pd = v;
1504 if (!pd || pd == SEQ_START_TOKEN)
1507 /* Drop reference taken by last invocation of pppol2tp_next_session()
1508 * or pppol2tp_next_tunnel().
1511 l2tp_session_dec_refcount(pd->session);
1515 l2tp_tunnel_dec_refcount(pd->tunnel);
1520 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
1522 struct l2tp_tunnel *tunnel = v;
1524 seq_printf(m, "\nTUNNEL '%s', %c %d\n",
1526 (tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N',
1527 refcount_read(&tunnel->ref_count) - 1);
1528 seq_printf(m, " %08x %ld/%ld/%ld %ld/%ld/%ld\n",
1530 atomic_long_read(&tunnel->stats.tx_packets),
1531 atomic_long_read(&tunnel->stats.tx_bytes),
1532 atomic_long_read(&tunnel->stats.tx_errors),
1533 atomic_long_read(&tunnel->stats.rx_packets),
1534 atomic_long_read(&tunnel->stats.rx_bytes),
1535 atomic_long_read(&tunnel->stats.rx_errors));
1538 static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
1540 struct l2tp_session *session = v;
1541 struct l2tp_tunnel *tunnel = session->tunnel;
1542 unsigned char state;
1549 struct inet_sock *inet = inet_sk(tunnel->sock);
1551 ip = ntohl(inet->inet_saddr);
1552 port = ntohs(inet->inet_sport);
1555 sk = pppol2tp_session_get_sock(session);
1557 state = sk->sk_state;
1558 user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N';
1564 seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> %04X/%04X %d %c\n",
1565 session->name, ip, port,
1567 session->session_id,
1568 tunnel->peer_tunnel_id,
1569 session->peer_session_id,
1570 state, user_data_ok);
1571 seq_printf(m, " 0/0/%c/%c/%s %08x %u\n",
1572 session->recv_seq ? 'R' : '-',
1573 session->send_seq ? 'S' : '-',
1574 session->lns_mode ? "LNS" : "LAC",
1576 jiffies_to_msecs(session->reorder_timeout));
1577 seq_printf(m, " %hu/%hu %ld/%ld/%ld %ld/%ld/%ld\n",
1578 session->nr, session->ns,
1579 atomic_long_read(&session->stats.tx_packets),
1580 atomic_long_read(&session->stats.tx_bytes),
1581 atomic_long_read(&session->stats.tx_errors),
1582 atomic_long_read(&session->stats.rx_packets),
1583 atomic_long_read(&session->stats.rx_bytes),
1584 atomic_long_read(&session->stats.rx_errors));
1587 struct pppox_sock *po = pppox_sk(sk);
1589 seq_printf(m, " interface %s\n", ppp_dev_name(&po->chan));
1594 static int pppol2tp_seq_show(struct seq_file *m, void *v)
1596 struct pppol2tp_seq_data *pd = v;
1598 /* display header on line 1 */
1599 if (v == SEQ_START_TOKEN) {
1600 seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n");
1601 seq_puts(m, "TUNNEL name, user-data-ok session-count\n");
1602 seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1603 seq_puts(m, " SESSION name, addr/port src-tid/sid dest-tid/sid state user-data-ok\n");
1604 seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n");
1605 seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1610 pppol2tp_seq_tunnel_show(m, pd->tunnel);
1612 pppol2tp_seq_session_show(m, pd->session);
1618 static const struct seq_operations pppol2tp_seq_ops = {
1619 .start = pppol2tp_seq_start,
1620 .next = pppol2tp_seq_next,
1621 .stop = pppol2tp_seq_stop,
1622 .show = pppol2tp_seq_show,
1624 #endif /* CONFIG_PROC_FS */
1626 /*****************************************************************************
1628 *****************************************************************************/
1630 static __net_init int pppol2tp_init_net(struct net *net)
1632 struct proc_dir_entry *pde;
1635 pde = proc_create_net("pppol2tp", 0444, net->proc_net,
1636 &pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data));
1646 static __net_exit void pppol2tp_exit_net(struct net *net)
1648 remove_proc_entry("pppol2tp", net->proc_net);
1651 static struct pernet_operations pppol2tp_net_ops = {
1652 .init = pppol2tp_init_net,
1653 .exit = pppol2tp_exit_net,
1654 .id = &pppol2tp_net_id,
1657 /*****************************************************************************
1659 *****************************************************************************/
1661 static const struct proto_ops pppol2tp_ops = {
1663 .owner = THIS_MODULE,
1664 .release = pppol2tp_release,
1665 .bind = sock_no_bind,
1666 .connect = pppol2tp_connect,
1667 .socketpair = sock_no_socketpair,
1668 .accept = sock_no_accept,
1669 .getname = pppol2tp_getname,
1670 .poll = datagram_poll,
1671 .listen = sock_no_listen,
1672 .shutdown = sock_no_shutdown,
1673 .setsockopt = pppol2tp_setsockopt,
1674 .getsockopt = pppol2tp_getsockopt,
1675 .sendmsg = pppol2tp_sendmsg,
1676 .recvmsg = pppol2tp_recvmsg,
1677 .mmap = sock_no_mmap,
1678 .ioctl = pppox_ioctl,
1679 #ifdef CONFIG_COMPAT
1680 .compat_ioctl = pppox_compat_ioctl,
1684 static const struct pppox_proto pppol2tp_proto = {
1685 .create = pppol2tp_create,
1686 .ioctl = pppol2tp_ioctl,
1687 .owner = THIS_MODULE,
1690 #ifdef CONFIG_L2TP_V3
1692 static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = {
1693 .session_create = pppol2tp_session_create,
1694 .session_delete = l2tp_session_delete,
1697 #endif /* CONFIG_L2TP_V3 */
1699 static int __init pppol2tp_init(void)
1703 err = register_pernet_device(&pppol2tp_net_ops);
1707 err = proto_register(&pppol2tp_sk_proto, 0);
1709 goto out_unregister_pppol2tp_pernet;
1711 err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto);
1713 goto out_unregister_pppol2tp_proto;
1715 #ifdef CONFIG_L2TP_V3
1716 err = l2tp_nl_register_ops(L2TP_PWTYPE_PPP, &pppol2tp_nl_cmd_ops);
1718 goto out_unregister_pppox;
1721 pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION);
1726 #ifdef CONFIG_L2TP_V3
1727 out_unregister_pppox:
1728 unregister_pppox_proto(PX_PROTO_OL2TP);
1730 out_unregister_pppol2tp_proto:
1731 proto_unregister(&pppol2tp_sk_proto);
1732 out_unregister_pppol2tp_pernet:
1733 unregister_pernet_device(&pppol2tp_net_ops);
1737 static void __exit pppol2tp_exit(void)
1739 #ifdef CONFIG_L2TP_V3
1740 l2tp_nl_unregister_ops(L2TP_PWTYPE_PPP);
1742 unregister_pppox_proto(PX_PROTO_OL2TP);
1743 proto_unregister(&pppol2tp_sk_proto);
1744 unregister_pernet_device(&pppol2tp_net_ops);
1747 module_init(pppol2tp_init);
1748 module_exit(pppol2tp_exit);
1750 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1751 MODULE_DESCRIPTION("PPP over L2TP over UDP");
1752 MODULE_LICENSE("GPL");
1753 MODULE_VERSION(PPPOL2TP_DRV_VERSION);
1754 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP);
1755 MODULE_ALIAS_L2TP_PWTYPE(7);