net/l2tp/l2tp_core.c

   1 /*
   2  * L2TP core.
   3  *
   4  * Copyright (c) 2008,2009,2010 Katalix Systems Ltd
   5  *
   6  * This file contains some code of the original L2TPv2 pppol2tp
   7  * driver, which has the following copyright:
   8  *
   9  * Authors:     Martijn van Oosterhout <kleptog@svana.org>
  10  *              James Chapman (jchapman@katalix.com)
  11  * Contributors:
  12  *              Michal Ostrowski <mostrows@speakeasy.net>
  13  *              Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
  14  *              David S. Miller (davem@redhat.com)
  15  *
  16  * This program is free software; you can redistribute it and/or modify
  17  * it under the terms of the GNU General Public License version 2 as
  18  * published by the Free Software Foundation.
  19  */
  20
  21 #include <linux/module.h>
  22 #include <linux/string.h>
  23 #include <linux/list.h>
  24 #include <linux/uaccess.h>
  25
  26 #include <linux/kernel.h>
  27 #include <linux/spinlock.h>
  28 #include <linux/kthread.h>
  29 #include <linux/sched.h>
  30 #include <linux/slab.h>
  31 #include <linux/errno.h>
  32 #include <linux/jiffies.h>
  33
  34 #include <linux/netdevice.h>
  35 #include <linux/net.h>
  36 #include <linux/inetdevice.h>
  37 #include <linux/skbuff.h>
  38 #include <linux/init.h>
  39 #include <linux/in.h>
  40 #include <linux/ip.h>
  41 #include <linux/udp.h>
  42 #include <linux/l2tp.h>
  43 #include <linux/hash.h>
  44 #include <linux/sort.h>
  45 #include <linux/file.h>
  46 #include <linux/nsproxy.h>
  47 #include <net/net_namespace.h>
  48 #include <net/netns/generic.h>
  49 #include <net/dst.h>
  50 #include <net/ip.h>
  51 #include <net/udp.h>
  52 #include <net/xfrm.h>
  53 #include <net/protocol.h>
  54
  55 #include <asm/byteorder.h>
  56 #include <asm/atomic.h>
  57
  58 #include "l2tp_core.h"
  59
  60 #define L2TP_DRV_VERSION        "V2.0"
  61
  62 /* L2TP header constants */
  63 #define L2TP_HDRFLAG_T     0x8000
  64 #define L2TP_HDRFLAG_L     0x4000
  65 #define L2TP_HDRFLAG_S     0x0800
  66 #define L2TP_HDRFLAG_O     0x0200
  67 #define L2TP_HDRFLAG_P     0x0100
  68
  69 #define L2TP_HDR_VER_MASK  0x000F
  70 #define L2TP_HDR_VER_2     0x0002
  71 #define L2TP_HDR_VER_3     0x0003
  72
  73 /* L2TPv3 default L2-specific sublayer */
  74 #define L2TP_SLFLAG_S      0x40000000
  75 #define L2TP_SL_SEQ_MASK   0x00ffffff
  76
  77 #define L2TP_HDR_SIZE_SEQ               10
  78 #define L2TP_HDR_SIZE_NOSEQ             6
  79
  80 /* Default trace flags */
  81 #define L2TP_DEFAULT_DEBUG_FLAGS        0
  82
  83 #define PRINTK(_mask, _type, _lvl, _fmt, args...)                       \
  84         do {                                                            \
  85                 if ((_mask) & (_type))                                  \
  86                         printk(_lvl "L2TP: " _fmt, ##args);             \
  87         } while (0)
  88
  89 /* Private data stored for received packets in the skb.
  90  */
  91 struct l2tp_skb_cb {
  92         u32                     ns;
  93         u16                     has_seq;
  94         u16                     length;
  95         unsigned long           expires;
  96 };
  97
  98 #define L2TP_SKB_CB(skb)        ((struct l2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])
  99
 100 static atomic_t l2tp_tunnel_count;
 101 static atomic_t l2tp_session_count;
 102
 103 /* per-net private data for this module */
 104 static unsigned int l2tp_net_id;
 105 struct l2tp_net {
 106         struct list_head l2tp_tunnel_list;
 107         rwlock_t l2tp_tunnel_list_lock;
 108         struct hlist_head l2tp_session_hlist[L2TP_HASH_SIZE_2];
 109         rwlock_t l2tp_session_hlist_lock;
 110 };
 111
 112 static inline struct l2tp_net *l2tp_pernet(struct net *net)
 113 {
 114         BUG_ON(!net);
 115
 116         return net_generic(net, l2tp_net_id);
 117 }
 118
 119 /* Session hash global list for L2TPv3.
 120  * The session_id SHOULD be random according to RFC3931, but several
 121  * L2TP implementations use incrementing session_ids.  So we do a real
 122  * hash on the session_id, rather than a simple bitmask.
 123  */
 124 static inline struct hlist_head *
 125 l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
 126 {
 127         return &pn->l2tp_session_hlist[hash_32(session_id, L2TP_HASH_BITS_2)];
 128
 129 }
 130
 131 /* Lookup a session by id in the global session list
 132  */
 133 static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
 134 {
 135         struct l2tp_net *pn = l2tp_pernet(net);
 136         struct hlist_head *session_list =
 137                 l2tp_session_id_hash_2(pn, session_id);
 138         struct l2tp_session *session;
 139         struct hlist_node *walk;
 140
 141         read_lock_bh(&pn->l2tp_session_hlist_lock);
 142         hlist_for_each_entry(session, walk, session_list, global_hlist) {
 143                 if (session->session_id == session_id) {
 144                         read_unlock_bh(&pn->l2tp_session_hlist_lock);
 145                         return session;
 146                 }
 147         }
 148         read_unlock_bh(&pn->l2tp_session_hlist_lock);
 149
 150         return NULL;
 151 }
 152
 153 /* Session hash list.
 154  * The session_id SHOULD be random according to RFC2661, but several
 155  * L2TP implementations (Cisco and Microsoft) use incrementing
 156  * session_ids.  So we do a real hash on the session_id, rather than a
 157  * simple bitmask.
 158  */
 159 static inline struct hlist_head *
 160 l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id)
 161 {
 162         return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)];
 163 }
 164
 165 /* Lookup a session by id
 166  */
 167 struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id)
 168 {
 169         struct hlist_head *session_list;
 170         struct l2tp_session *session;
 171         struct hlist_node *walk;
 172
 173         /* In L2TPv3, session_ids are unique over all tunnels and we
 174          * sometimes need to look them up before we know the
 175          * tunnel.
 176          */
 177         if (tunnel == NULL)
 178                 return l2tp_session_find_2(net, session_id);
 179
 180         session_list = l2tp_session_id_hash(tunnel, session_id);
 181         read_lock_bh(&tunnel->hlist_lock);
 182         hlist_for_each_entry(session, walk, session_list, hlist) {
 183                 if (session->session_id == session_id) {
 184                         read_unlock_bh(&tunnel->hlist_lock);
 185                         return session;
 186                 }
 187         }
 188         read_unlock_bh(&tunnel->hlist_lock);
 189
 190         return NULL;
 191 }
 192 EXPORT_SYMBOL_GPL(l2tp_session_find);
 193
 194 struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
 195 {
 196         int hash;
 197         struct hlist_node *walk;
 198         struct l2tp_session *session;
 199         int count = 0;
 200
 201         read_lock_bh(&tunnel->hlist_lock);
 202         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
 203                 hlist_for_each_entry(session, walk, &tunnel->session_hlist[hash], hlist) {
 204                         if (++count > nth) {
 205                                 read_unlock_bh(&tunnel->hlist_lock);
 206                                 return session;
 207                         }
 208                 }
 209         }
 210
 211         read_unlock_bh(&tunnel->hlist_lock);
 212
 213         return NULL;
 214 }
 215 EXPORT_SYMBOL_GPL(l2tp_session_find_nth);
 216
 217 /* Lookup a tunnel by id
 218  */
 219 struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id)
 220 {
 221         struct l2tp_tunnel *tunnel;
 222         struct l2tp_net *pn = l2tp_pernet(net);
 223
 224         read_lock_bh(&pn->l2tp_tunnel_list_lock);
 225         list_for_each_entry(tunnel, &pn->l2tp_tunnel_list, list) {
 226                 if (tunnel->tunnel_id == tunnel_id) {
 227                         read_unlock_bh(&pn->l2tp_tunnel_list_lock);
 228                         return tunnel;
 229                 }
 230         }
 231         read_unlock_bh(&pn->l2tp_tunnel_list_lock);
 232
 233         return NULL;
 234 }
 235 EXPORT_SYMBOL_GPL(l2tp_tunnel_find);
 236
 237 struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth)
 238 {
 239         struct l2tp_net *pn = l2tp_pernet(net);
 240         struct l2tp_tunnel *tunnel;
 241         int count = 0;
 242
 243         read_lock_bh(&pn->l2tp_tunnel_list_lock);
 244         list_for_each_entry(tunnel, &pn->l2tp_tunnel_list, list) {
 245                 if (++count > nth) {
 246                         read_unlock_bh(&pn->l2tp_tunnel_list_lock);
 247                         return tunnel;
 248                 }
 249         }
 250
 251         read_unlock_bh(&pn->l2tp_tunnel_list_lock);
 252
 253         return NULL;
 254 }
 255 EXPORT_SYMBOL_GPL(l2tp_tunnel_find_nth);
 256
 257 /*****************************************************************************
 258  * Receive data handling
 259  *****************************************************************************/
 260
 261 /* Queue a skb in order. We come here only if the skb has an L2TP sequence
 262  * number.
 263  */
 264 static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)
 265 {
 266         struct sk_buff *skbp;
 267         struct sk_buff *tmp;
 268         u32 ns = L2TP_SKB_CB(skb)->ns;
 269
 270         spin_lock_bh(&session->reorder_q.lock);
 271         skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
 272                 if (L2TP_SKB_CB(skbp)->ns > ns) {
 273                         __skb_queue_before(&session->reorder_q, skbp, skb);
 274                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 275                                "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
 276                                session->name, ns, L2TP_SKB_CB(skbp)->ns,
 277                                skb_queue_len(&session->reorder_q));
 278                         session->stats.rx_oos_packets++;
 279                         goto out;
 280                 }
 281         }
 282
 283         __skb_queue_tail(&session->reorder_q, skb);
 284
 285 out:
 286         spin_unlock_bh(&session->reorder_q.lock);
 287 }
 288
 289 /* Dequeue a single skb.
 290  */
 291 static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)
 292 {
 293         struct l2tp_tunnel *tunnel = session->tunnel;
 294         int length = L2TP_SKB_CB(skb)->length;
 295
 296         /* We're about to requeue the skb, so return resources
 297          * to its current owner (a socket receive buffer).
 298          */
 299         skb_orphan(skb);
 300
 301         tunnel->stats.rx_packets++;
 302         tunnel->stats.rx_bytes += length;
 303         session->stats.rx_packets++;
 304         session->stats.rx_bytes += length;
 305
 306         if (L2TP_SKB_CB(skb)->has_seq) {
 307                 /* Bump our Nr */
 308                 session->nr++;
 309                 if (tunnel->version == L2TP_HDR_VER_2)
 310                         session->nr &= 0xffff;
 311                 else
 312                         session->nr &= 0xffffff;
 313
 314                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 315                        "%s: updated nr to %hu\n", session->name, session->nr);
 316         }
 317
 318         /* call private receive handler */
 319         if (session->recv_skb != NULL)
 320                 (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);
 321         else
 322                 kfree_skb(skb);
 323
 324         if (session->deref)
 325                 (*session->deref)(session);
 326 }
 327
 328 /* Dequeue skbs from the session's reorder_q, subject to packet order.
 329  * Skbs that have been in the queue for too long are simply discarded.
 330  */
 331 static void l2tp_recv_dequeue(struct l2tp_session *session)
 332 {
 333         struct sk_buff *skb;
 334         struct sk_buff *tmp;
 335
 336         /* If the pkt at the head of the queue has the nr that we
 337          * expect to send up next, dequeue it and any other
 338          * in-sequence packets behind it.
 339          */
 340         spin_lock_bh(&session->reorder_q.lock);
 341         skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
 342                 if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) {
 343                         session->stats.rx_seq_discards++;
 344                         session->stats.rx_errors++;
 345                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 346                                "%s: oos pkt %u len %d discarded (too old), "
 347                                "waiting for %u, reorder_q_len=%d\n",
 348                                session->name, L2TP_SKB_CB(skb)->ns,
 349                                L2TP_SKB_CB(skb)->length, session->nr,
 350                                skb_queue_len(&session->reorder_q));
 351                         __skb_unlink(skb, &session->reorder_q);
 352                         kfree_skb(skb);
 353                         if (session->deref)
 354                                 (*session->deref)(session);
 355                         continue;
 356                 }
 357
 358                 if (L2TP_SKB_CB(skb)->has_seq) {
 359                         if (L2TP_SKB_CB(skb)->ns != session->nr) {
 360                                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 361                                        "%s: holding oos pkt %u len %d, "
 362                                        "waiting for %u, reorder_q_len=%d\n",
 363                                        session->name, L2TP_SKB_CB(skb)->ns,
 364                                        L2TP_SKB_CB(skb)->length, session->nr,
 365                                        skb_queue_len(&session->reorder_q));
 366                                 goto out;
 367                         }
 368                 }
 369                 __skb_unlink(skb, &session->reorder_q);
 370
 371                 /* Process the skb. We release the queue lock while we
 372                  * do so to let other contexts process the queue.
 373                  */
 374                 spin_unlock_bh(&session->reorder_q.lock);
 375                 l2tp_recv_dequeue_skb(session, skb);
 376                 spin_lock_bh(&session->reorder_q.lock);
 377         }
 378
 379 out:
 380         spin_unlock_bh(&session->reorder_q.lock);
 381 }
 382
 383 static inline int l2tp_verify_udp_checksum(struct sock *sk,
 384                                            struct sk_buff *skb)
 385 {
 386         struct udphdr *uh = udp_hdr(skb);
 387         u16 ulen = ntohs(uh->len);
 388         struct inet_sock *inet;
 389         __wsum psum;
 390
 391         if (sk->sk_no_check || skb_csum_unnecessary(skb) || !uh->check)
 392                 return 0;
 393
 394         inet = inet_sk(sk);
 395         psum = csum_tcpudp_nofold(inet->inet_saddr, inet->inet_daddr, ulen,
 396                                   IPPROTO_UDP, 0);
 397
 398         if ((skb->ip_summed == CHECKSUM_COMPLETE) &&
 399             !csum_fold(csum_add(psum, skb->csum)))
 400                 return 0;
 401
 402         skb->csum = psum;
 403
 404         return __skb_checksum_complete(skb);
 405 }
 406
 407 /* Do receive processing of L2TP data frames. We handle both L2TPv2
 408  * and L2TPv3 data frames here.
 409  *
 410  * L2TPv2 Data Message Header
 411  *
 412  *  0                   1                   2                   3
 413  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 414  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 415  * |T|L|x|x|S|x|O|P|x|x|x|x|  Ver  |          Length (opt)         |
 416  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 417  * |           Tunnel ID           |           Session ID          |
 418  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 419  * |             Ns (opt)          |             Nr (opt)          |
 420  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 421  * |      Offset Size (opt)        |    Offset pad... (opt)
 422  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 423  *
 424  * Data frames are marked by T=0. All other fields are the same as
 425  * those in L2TP control frames.
 426  *
 427  * L2TPv3 Data Message Header
 428  *
 429  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 430  * |                      L2TP Session Header                      |
 431  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 432  * |                      L2-Specific Sublayer                     |
 433  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 434  * |                        Tunnel Payload                      ...
 435  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 436  *
 437  * L2TPv3 Session Header Over IP
 438  *
 439  *  0                   1                   2                   3
 440  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 441  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 442  * |                           Session ID                          |
 443  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 444  * |               Cookie (optional, maximum 64 bits)...
 445  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 446  *                                                                 |
 447  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 448  *
 449  * L2TPv3 L2-Specific Sublayer Format
 450  *
 451  *  0                   1                   2                   3
 452  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 453  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 454  * |x|S|x|x|x|x|x|x|              Sequence Number                  |
 455  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 456  *
 457  * Cookie value, sublayer format and offset (pad) are negotiated with
 458  * the peer when the session is set up. Unlike L2TPv2, we do not need
 459  * to parse the packet header to determine if optional fields are
 460  * present.
 461  *
 462  * Caller must already have parsed the frame and determined that it is
 463  * a data (not control) frame before coming here. Fields up to the
 464  * session-id have already been parsed and ptr points to the data
 465  * after the session-id.
 466  */
 467 void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
 468                       unsigned char *ptr, unsigned char *optr, u16 hdrflags,
 469                       int length, int (*payload_hook)(struct sk_buff *skb))
 470 {
 471         struct l2tp_tunnel *tunnel = session->tunnel;
 472         int offset;
 473         u32 ns, nr;
 474
 475         /* The ref count is increased since we now hold a pointer to
 476          * the session. Take care to decrement the refcnt when exiting
 477          * this function from now on...
 478          */
 479         l2tp_session_inc_refcount(session);
 480         if (session->ref)
 481                 (*session->ref)(session);
 482
 483         /* Parse and check optional cookie */
 484         if (session->peer_cookie_len > 0) {
 485                 if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
 486                         PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
 487                                "%s: cookie mismatch (%u/%u). Discarding.\n",
 488                                tunnel->name, tunnel->tunnel_id, session->session_id);
 489                         session->stats.rx_cookie_discards++;
 490                         goto discard;
 491                 }
 492                 ptr += session->peer_cookie_len;
 493         }
 494
 495         /* Handle the optional sequence numbers. Sequence numbers are
 496          * in different places for L2TPv2 and L2TPv3.
 497          *
 498          * If we are the LAC, enable/disable sequence numbers under
 499          * the control of the LNS.  If no sequence numbers present but
 500          * we were expecting them, discard frame.
 501          */
 502         ns = nr = 0;
 503         L2TP_SKB_CB(skb)->has_seq = 0;
 504         if (tunnel->version == L2TP_HDR_VER_2) {
 505                 if (hdrflags & L2TP_HDRFLAG_S) {
 506                         ns = ntohs(*(__be16 *) ptr);
 507                         ptr += 2;
 508                         nr = ntohs(*(__be16 *) ptr);
 509                         ptr += 2;
 510
 511                         /* Store L2TP info in the skb */
 512                         L2TP_SKB_CB(skb)->ns = ns;
 513                         L2TP_SKB_CB(skb)->has_seq = 1;
 514
 515                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 516                                "%s: recv data ns=%u, nr=%u, session nr=%u\n",
 517                                session->name, ns, nr, session->nr);
 518                 }
 519         } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
 520                 u32 l2h = ntohl(*(__be32 *) ptr);
 521
 522                 if (l2h & 0x40000000) {
 523                         ns = l2h & 0x00ffffff;
 524
 525                         /* Store L2TP info in the skb */
 526                         L2TP_SKB_CB(skb)->ns = ns;
 527                         L2TP_SKB_CB(skb)->has_seq = 1;
 528
 529                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 530                                "%s: recv data ns=%u, session nr=%u\n",
 531                                session->name, ns, session->nr);
 532                 }
 533         }
 534
 535         /* Advance past L2-specific header, if present */
 536         ptr += session->l2specific_len;
 537
 538         if (L2TP_SKB_CB(skb)->has_seq) {
 539                 /* Received a packet with sequence numbers. If we're the LNS,
 540                  * check if we sre sending sequence numbers and if not,
 541                  * configure it so.
 542                  */
 543                 if ((!session->lns_mode) && (!session->send_seq)) {
 544                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_INFO,
 545                                "%s: requested to enable seq numbers by LNS\n",
 546                                session->name);
 547                         session->send_seq = -1;
 548                         l2tp_session_set_header_len(session, tunnel->version);
 549                 }
 550         } else {
 551                 /* No sequence numbers.
 552                  * If user has configured mandatory sequence numbers, discard.
 553                  */
 554                 if (session->recv_seq) {
 555                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_WARNING,
 556                                "%s: recv data has no seq numbers when required. "
 557                                "Discarding\n", session->name);
 558                         session->stats.rx_seq_discards++;
 559                         goto discard;
 560                 }
 561
 562                 /* If we're the LAC and we're sending sequence numbers, the
 563                  * LNS has requested that we no longer send sequence numbers.
 564                  * If we're the LNS and we're sending sequence numbers, the
 565                  * LAC is broken. Discard the frame.
 566                  */
 567                 if ((!session->lns_mode) && (session->send_seq)) {
 568                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_INFO,
 569                                "%s: requested to disable seq numbers by LNS\n",
 570                                session->name);
 571                         session->send_seq = 0;
 572                         l2tp_session_set_header_len(session, tunnel->version);
 573                 } else if (session->send_seq) {
 574                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_WARNING,
 575                                "%s: recv data has no seq numbers when required. "
 576                                "Discarding\n", session->name);
 577                         session->stats.rx_seq_discards++;
 578                         goto discard;
 579                 }
 580         }
 581
 582         /* Session data offset is handled differently for L2TPv2 and
 583          * L2TPv3. For L2TPv2, there is an optional 16-bit value in
 584          * the header. For L2TPv3, the offset is negotiated using AVPs
 585          * in the session setup control protocol.
 586          */
 587         if (tunnel->version == L2TP_HDR_VER_2) {
 588                 /* If offset bit set, skip it. */
 589                 if (hdrflags & L2TP_HDRFLAG_O) {
 590                         offset = ntohs(*(__be16 *)ptr);
 591                         ptr += 2 + offset;
 592                 }
 593         } else
 594                 ptr += session->offset;
 595
 596         offset = ptr - optr;
 597         if (!pskb_may_pull(skb, offset))
 598                 goto discard;
 599
 600         __skb_pull(skb, offset);
 601
 602         /* If caller wants to process the payload before we queue the
 603          * packet, do so now.
 604          */
 605         if (payload_hook)
 606                 if ((*payload_hook)(skb))
 607                         goto discard;
 608
 609         /* Prepare skb for adding to the session's reorder_q.  Hold
 610          * packets for max reorder_timeout or 1 second if not
 611          * reordering.
 612          */
 613         L2TP_SKB_CB(skb)->length = length;
 614         L2TP_SKB_CB(skb)->expires = jiffies +
 615                 (session->reorder_timeout ? session->reorder_timeout : HZ);
 616
 617         /* Add packet to the session's receive queue. Reordering is done here, if
 618          * enabled. Saved L2TP protocol info is stored in skb->sb[].
 619          */
 620         if (L2TP_SKB_CB(skb)->has_seq) {
 621                 if (session->reorder_timeout != 0) {
 622                         /* Packet reordering enabled. Add skb to session's
 623                          * reorder queue, in order of ns.
 624                          */
 625                         l2tp_recv_queue_skb(session, skb);
 626                 } else {
 627                         /* Packet reordering disabled. Discard out-of-sequence
 628                          * packets
 629                          */
 630                         if (L2TP_SKB_CB(skb)->ns != session->nr) {
 631                                 session->stats.rx_seq_discards++;
 632                                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 633                                        "%s: oos pkt %u len %d discarded, "
 634                                        "waiting for %u, reorder_q_len=%d\n",
 635                                        session->name, L2TP_SKB_CB(skb)->ns,
 636                                        L2TP_SKB_CB(skb)->length, session->nr,
 637                                        skb_queue_len(&session->reorder_q));
 638                                 goto discard;
 639                         }
 640                         skb_queue_tail(&session->reorder_q, skb);
 641                 }
 642         } else {
 643                 /* No sequence numbers. Add the skb to the tail of the
 644                  * reorder queue. This ensures that it will be
 645                  * delivered after all previous sequenced skbs.
 646                  */
 647                 skb_queue_tail(&session->reorder_q, skb);
 648         }
 649
 650         /* Try to dequeue as many skbs from reorder_q as we can. */
 651         l2tp_recv_dequeue(session);
 652
 653         l2tp_session_dec_refcount(session);
 654
 655         return;
 656
 657 discard:
 658         session->stats.rx_errors++;
 659         kfree_skb(skb);
 660
 661         if (session->deref)
 662                 (*session->deref)(session);
 663
 664         l2tp_session_dec_refcount(session);
 665 }
 666 EXPORT_SYMBOL(l2tp_recv_common);
 667
 668 /* Internal UDP receive frame. Do the real work of receiving an L2TP data frame
 669  * here. The skb is not on a list when we get here.
 670  * Returns 0 if the packet was a data packet and was successfully passed on.
 671  * Returns 1 if the packet was not a good data packet and could not be
 672  * forwarded.  All such packets are passed up to userspace to deal with.
 673  */
 674 int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
 675                        int (*payload_hook)(struct sk_buff *skb))
 676 {
 677         struct l2tp_session *session = NULL;
 678         unsigned char *ptr, *optr;
 679         u16 hdrflags;
 680         u32 tunnel_id, session_id;
 681         int offset;
 682         u16 version;
 683         int length;
 684
 685         if (tunnel->sock && l2tp_verify_udp_checksum(tunnel->sock, skb))
 686                 goto discard_bad_csum;
 687
 688         /* UDP always verifies the packet length. */
 689         __skb_pull(skb, sizeof(struct udphdr));
 690
 691         /* Short packet? */
 692         if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) {
 693                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
 694                        "%s: recv short packet (len=%d)\n", tunnel->name, skb->len);
 695                 goto error;
 696         }
 697
 698         /* Point to L2TP header */
 699         optr = ptr = skb->data;
 700
 701         /* Trace packet contents, if enabled */
 702         if (tunnel->debug & L2TP_MSG_DATA) {
 703                 length = min(32u, skb->len);
 704                 if (!pskb_may_pull(skb, length))
 705                         goto error;
 706
 707                 printk(KERN_DEBUG "%s: recv: ", tunnel->name);
 708
 709                 offset = 0;
 710                 do {
 711                         printk(" %02X", ptr[offset]);
 712                 } while (++offset < length);
 713
 714                 printk("\n");
 715         }
 716
 717         /* Get L2TP header flags */
 718         hdrflags = ntohs(*(__be16 *) ptr);
 719
 720         /* Check protocol version */
 721         version = hdrflags & L2TP_HDR_VER_MASK;
 722         if (version != tunnel->version) {
 723                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
 724                        "%s: recv protocol version mismatch: got %d expected %d\n",
 725                        tunnel->name, version, tunnel->version);
 726                 goto error;
 727         }
 728
 729         /* Get length of L2TP packet */
 730         length = skb->len;
 731
 732         /* If type is control packet, it is handled by userspace. */
 733         if (hdrflags & L2TP_HDRFLAG_T) {
 734                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_DEBUG,
 735                        "%s: recv control packet, len=%d\n", tunnel->name, length);
 736                 goto error;
 737         }
 738
 739         /* Skip flags */
 740         ptr += 2;
 741
 742         if (tunnel->version == L2TP_HDR_VER_2) {
 743                 /* If length is present, skip it */
 744                 if (hdrflags & L2TP_HDRFLAG_L)
 745                         ptr += 2;
 746
 747                 /* Extract tunnel and session ID */
 748                 tunnel_id = ntohs(*(__be16 *) ptr);
 749                 ptr += 2;
 750                 session_id = ntohs(*(__be16 *) ptr);
 751                 ptr += 2;
 752         } else {
 753                 ptr += 2;       /* skip reserved bits */
 754                 tunnel_id = tunnel->tunnel_id;
 755                 session_id = ntohl(*(__be32 *) ptr);
 756                 ptr += 4;
 757         }
 758
 759         /* Find the session context */
 760         session = l2tp_session_find(tunnel->l2tp_net, tunnel, session_id);
 761         if (!session) {
 762                 /* Not found? Pass to userspace to deal with */
 763                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
 764                        "%s: no session found (%u/%u). Passing up.\n",
 765                        tunnel->name, tunnel_id, session_id);
 766                 goto error;
 767         }
 768
 769         l2tp_recv_common(session, skb, ptr, optr, hdrflags, length, payload_hook);
 770
 771         return 0;
 772
 773 discard_bad_csum:
 774         LIMIT_NETDEBUG("%s: UDP: bad checksum\n", tunnel->name);
 775         UDP_INC_STATS_USER(tunnel->l2tp_net, UDP_MIB_INERRORS, 0);
 776         tunnel->stats.rx_errors++;
 777         kfree_skb(skb);
 778
 779         return 0;
 780
 781 error:
 782         /* Put UDP header back */
 783         __skb_push(skb, sizeof(struct udphdr));
 784
 785         return 1;
 786 }
 787 EXPORT_SYMBOL_GPL(l2tp_udp_recv_core);
 788
 789 /* UDP encapsulation receive handler. See net/ipv4/udp.c.
 790  * Return codes:
 791  * 0 : success.
 792  * <0: error
 793  * >0: skb should be passed up to userspace as UDP.
 794  */
 795 int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
 796 {
 797         struct l2tp_tunnel *tunnel;
 798
 799         tunnel = l2tp_sock_to_tunnel(sk);
 800         if (tunnel == NULL)
 801                 goto pass_up;
 802
 803         PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_DEBUG,
 804                "%s: received %d bytes\n", tunnel->name, skb->len);
 805
 806         if (l2tp_udp_recv_core(tunnel, skb, tunnel->recv_payload_hook))
 807                 goto pass_up_put;
 808
 809         sock_put(sk);
 810         return 0;
 811
 812 pass_up_put:
 813         sock_put(sk);
 814 pass_up:
 815         return 1;
 816 }
 817 EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv);
 818
 819 /************************************************************************
 820  * Transmit handling
 821  ***********************************************************************/
 822
 823 /* Build an L2TP header for the session into the buffer provided.
 824  */
 825 static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
 826 {
 827         struct l2tp_tunnel *tunnel = session->tunnel;
 828         __be16 *bufp = buf;
 829         __be16 *optr = buf;
 830         u16 flags = L2TP_HDR_VER_2;
 831         u32 tunnel_id = tunnel->peer_tunnel_id;
 832         u32 session_id = session->peer_session_id;
 833
 834         if (session->send_seq)
 835                 flags |= L2TP_HDRFLAG_S;
 836
 837         /* Setup L2TP header. */
 838         *bufp++ = htons(flags);
 839         *bufp++ = htons(tunnel_id);
 840         *bufp++ = htons(session_id);
 841         if (session->send_seq) {
 842                 *bufp++ = htons(session->ns);
 843                 *bufp++ = 0;
 844                 session->ns++;
 845                 session->ns &= 0xffff;
 846                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 847                        "%s: updated ns to %u\n", session->name, session->ns);
 848         }
 849
 850         return bufp - optr;
 851 }
 852
 853 static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
 854 {
 855         struct l2tp_tunnel *tunnel = session->tunnel;
 856         char *bufp = buf;
 857         char *optr = bufp;
 858
 859         /* Setup L2TP header. The header differs slightly for UDP and
 860          * IP encapsulations. For UDP, there is 4 bytes of flags.
 861          */
 862         if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
 863                 u16 flags = L2TP_HDR_VER_3;
 864                 *((__be16 *) bufp) = htons(flags);
 865                 bufp += 2;
 866                 *((__be16 *) bufp) = 0;
 867                 bufp += 2;
 868         }
 869
 870         *((__be32 *) bufp) = htonl(session->peer_session_id);
 871         bufp += 4;
 872         if (session->cookie_len) {
 873                 memcpy(bufp, &session->cookie[0], session->cookie_len);
 874                 bufp += session->cookie_len;
 875         }
 876         if (session->l2specific_len) {
 877                 if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
 878                         u32 l2h = 0;
 879                         if (session->send_seq) {
 880                                 l2h = 0x40000000 | session->ns;
 881                                 session->ns++;
 882                                 session->ns &= 0xffffff;
 883                                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 884                                        "%s: updated ns to %u\n", session->name, session->ns);
 885                         }
 886
 887                         *((__be32 *) bufp) = htonl(l2h);
 888                 }
 889                 bufp += session->l2specific_len;
 890         }
 891         if (session->offset)
 892                 bufp += session->offset;
 893
 894         return bufp - optr;
 895 }
 896
 897 int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, size_t data_len)
 898 {
 899         struct l2tp_tunnel *tunnel = session->tunnel;
 900         unsigned int len = skb->len;
 901         int error;
 902
 903         /* Debug */
 904         if (session->send_seq)
 905                 PRINTK(session->debug, L2TP_MSG_DATA, KERN_DEBUG,
 906                        "%s: send %Zd bytes, ns=%u\n", session->name,
 907                        data_len, session->ns - 1);
 908         else
 909                 PRINTK(session->debug, L2TP_MSG_DATA, KERN_DEBUG,
 910                        "%s: send %Zd bytes\n", session->name, data_len);
 911
 912         if (session->debug & L2TP_MSG_DATA) {
 913                 int i;
 914                 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
 915                 unsigned char *datap = skb->data + uhlen;
 916
 917                 printk(KERN_DEBUG "%s: xmit:", session->name);
 918                 for (i = 0; i < (len - uhlen); i++) {
 919                         printk(" %02X", *datap++);
 920                         if (i == 31) {
 921                                 printk(" ...");
 922                                 break;
 923                         }
 924                 }
 925                 printk("\n");
 926         }
 927
 928         /* Queue the packet to IP for output */
 929         error = ip_queue_xmit(skb, 1);
 930
 931         /* Update stats */
 932         if (error >= 0) {
 933                 tunnel->stats.tx_packets++;
 934                 tunnel->stats.tx_bytes += len;
 935                 session->stats.tx_packets++;
 936                 session->stats.tx_bytes += len;
 937         } else {
 938                 tunnel->stats.tx_errors++;
 939                 session->stats.tx_errors++;
 940         }
 941
 942         return 0;
 943 }
 944 EXPORT_SYMBOL_GPL(l2tp_xmit_core);
 945
 946 /* Automatically called when the skb is freed.
 947  */
 948 static void l2tp_sock_wfree(struct sk_buff *skb)
 949 {
 950         sock_put(skb->sk);
 951 }
 952
 953 /* For data skbs that we transmit, we associate with the tunnel socket
 954  * but don't do accounting.
 955  */
 956 static inline void l2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
 957 {
 958         sock_hold(sk);
 959         skb->sk = sk;
 960         skb->destructor = l2tp_sock_wfree;
 961 }
 962
 963 /* If caller requires the skb to have a ppp header, the header must be
 964  * inserted in the skb data before calling this function.
 965  */
 966 int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len)
 967 {
 968         int data_len = skb->len;
 969         struct l2tp_tunnel *tunnel = session->tunnel;
 970         struct sock *sk = tunnel->sock;
 971         struct udphdr *uh;
 972         struct inet_sock *inet;
 973         __wsum csum;
 974         int old_headroom;
 975         int new_headroom;
 976         int headroom;
 977         int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
 978         int udp_len;
 979
 980         /* Check that there's enough headroom in the skb to insert IP,
 981          * UDP and L2TP headers. If not enough, expand it to
 982          * make room. Adjust truesize.
 983          */
 984         headroom = NET_SKB_PAD + sizeof(struct iphdr) +
 985                 uhlen + hdr_len;
 986         old_headroom = skb_headroom(skb);
 987         if (skb_cow_head(skb, headroom))
 988                 goto abort;
 989
 990         new_headroom = skb_headroom(skb);
 991         skb_orphan(skb);
 992         skb->truesize += new_headroom - old_headroom;
 993
 994         /* Setup L2TP header */
 995         session->build_header(session, __skb_push(skb, hdr_len));
 996
 997         /* Reset skb netfilter state */
 998         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
 999         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
1000                               IPSKB_REROUTED);
1001         nf_reset(skb);
1002
1003         /* Get routing info from the tunnel socket */
1004         skb_dst_drop(skb);
1005         skb_dst_set(skb, dst_clone(__sk_dst_get(sk)));
1006
1007         switch (tunnel->encap) {
1008         case L2TP_ENCAPTYPE_UDP:
1009                 /* Setup UDP header */
1010                 inet = inet_sk(sk);
1011                 __skb_push(skb, sizeof(*uh));
1012                 skb_reset_transport_header(skb);
1013                 uh = udp_hdr(skb);
1014                 uh->source = inet->inet_sport;
1015                 uh->dest = inet->inet_dport;
1016                 udp_len = uhlen + hdr_len + data_len;
1017                 uh->len = htons(udp_len);
1018                 uh->check = 0;
1019
1020                 /* Calculate UDP checksum if configured to do so */
1021                 if (sk->sk_no_check == UDP_CSUM_NOXMIT)
1022                         skb->ip_summed = CHECKSUM_NONE;
1023                 else if ((skb_dst(skb) && skb_dst(skb)->dev) &&
1024                          (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM))) {
1025                         skb->ip_summed = CHECKSUM_COMPLETE;
1026                         csum = skb_checksum(skb, 0, udp_len, 0);
1027                         uh->check = csum_tcpudp_magic(inet->inet_saddr,
1028                                                       inet->inet_daddr,
1029                                                       udp_len, IPPROTO_UDP, csum);
1030                         if (uh->check == 0)
1031                                 uh->check = CSUM_MANGLED_0;
1032                 } else {
1033                         skb->ip_summed = CHECKSUM_PARTIAL;
1034                         skb->csum_start = skb_transport_header(skb) - skb->head;
1035                         skb->csum_offset = offsetof(struct udphdr, check);
1036                         uh->check = ~csum_tcpudp_magic(inet->inet_saddr,
1037                                                        inet->inet_daddr,
1038                                                        udp_len, IPPROTO_UDP, 0);
1039                 }
1040                 break;
1041
1042         case L2TP_ENCAPTYPE_IP:
1043                 break;
1044         }
1045
1046         l2tp_skb_set_owner_w(skb, sk);
1047
1048         l2tp_xmit_core(session, skb, data_len);
1049
1050 abort:
1051         return 0;
1052 }
1053 EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
1054
1055 /*****************************************************************************
1056  * Tinnel and session create/destroy.
1057  *****************************************************************************/
1058
1059 /* Tunnel socket destruct hook.
1060  * The tunnel context is deleted only when all session sockets have been
1061  * closed.
1062  */
1063 void l2tp_tunnel_destruct(struct sock *sk)
1064 {
1065         struct l2tp_tunnel *tunnel;
1066
1067         tunnel = sk->sk_user_data;
1068         if (tunnel == NULL)
1069                 goto end;
1070
1071         PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
1072                "%s: closing...\n", tunnel->name);
1073
1074         /* Close all sessions */
1075         l2tp_tunnel_closeall(tunnel);
1076
1077         switch (tunnel->encap) {
1078         case L2TP_ENCAPTYPE_UDP:
1079                 /* No longer an encapsulation socket. See net/ipv4/udp.c */
1080                 (udp_sk(sk))->encap_type = 0;
1081                 (udp_sk(sk))->encap_rcv = NULL;
1082                 break;
1083         case L2TP_ENCAPTYPE_IP:
1084                 break;
1085         }
1086
1087         /* Remove hooks into tunnel socket */
1088         tunnel->sock = NULL;
1089         sk->sk_destruct = tunnel->old_sk_destruct;
1090         sk->sk_user_data = NULL;
1091
1092         /* Call the original destructor */
1093         if (sk->sk_destruct)
1094                 (*sk->sk_destruct)(sk);
1095
1096         /* We're finished with the socket */
1097         l2tp_tunnel_dec_refcount(tunnel);
1098
1099 end:
1100         return;
1101 }
1102 EXPORT_SYMBOL(l2tp_tunnel_destruct);
1103
1104 /* When the tunnel is closed, all the attached sessions need to go too.
1105  */
1106 void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
1107 {
1108         int hash;
1109         struct hlist_node *walk;
1110         struct hlist_node *tmp;
1111         struct l2tp_session *session;
1112
1113         BUG_ON(tunnel == NULL);
1114
1115         PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
1116                "%s: closing all sessions...\n", tunnel->name);
1117
1118         write_lock_bh(&tunnel->hlist_lock);
1119         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
1120 again:
1121                 hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
1122                         session = hlist_entry(walk, struct l2tp_session, hlist);
1123
1124                         PRINTK(session->debug, L2TP_MSG_CONTROL, KERN_INFO,
1125                                "%s: closing session\n", session->name);
1126
1127                         hlist_del_init(&session->hlist);
1128
1129                         /* Since we should hold the sock lock while
1130                          * doing any unbinding, we need to release the
1131                          * lock we're holding before taking that lock.
1132                          * Hold a reference to the sock so it doesn't
1133                          * disappear as we're jumping between locks.
1134                          */
1135                         if (session->ref != NULL)
1136                                 (*session->ref)(session);
1137
1138                         write_unlock_bh(&tunnel->hlist_lock);
1139
1140                         if (tunnel->version != L2TP_HDR_VER_2) {
1141                                 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1142
1143                                 write_lock_bh(&pn->l2tp_session_hlist_lock);
1144                                 hlist_del_init(&session->global_hlist);
1145                                 write_unlock_bh(&pn->l2tp_session_hlist_lock);
1146                         }
1147
1148                         if (session->session_close != NULL)
1149                                 (*session->session_close)(session);
1150
1151                         if (session->deref != NULL)
1152                                 (*session->deref)(session);
1153
1154                         write_lock_bh(&tunnel->hlist_lock);
1155
1156                         /* Now restart from the beginning of this hash
1157                          * chain.  We always remove a session from the
1158                          * list so we are guaranteed to make forward
1159                          * progress.
1160                          */
1161                         goto again;
1162                 }
1163         }
1164         write_unlock_bh(&tunnel->hlist_lock);
1165 }
1166 EXPORT_SYMBOL_GPL(l2tp_tunnel_closeall);
1167
1168 /* Really kill the tunnel.
1169  * Come here only when all sessions have been cleared from the tunnel.
1170  */
1171 void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
1172 {
1173         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1174
1175         BUG_ON(atomic_read(&tunnel->ref_count) != 0);
1176         BUG_ON(tunnel->sock != NULL);
1177
1178         PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
1179                "%s: free...\n", tunnel->name);
1180
1181         /* Remove from tunnel list */
1182         write_lock_bh(&pn->l2tp_tunnel_list_lock);
1183         list_del_init(&tunnel->list);
1184         write_unlock_bh(&pn->l2tp_tunnel_list_lock);
1185
1186         atomic_dec(&l2tp_tunnel_count);
1187         kfree(tunnel);
1188 }
1189 EXPORT_SYMBOL_GPL(l2tp_tunnel_free);
1190
1191 int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp)
1192 {
1193         struct l2tp_tunnel *tunnel = NULL;
1194         int err;
1195         struct socket *sock = NULL;
1196         struct sock *sk = NULL;
1197         struct l2tp_net *pn;
1198         enum l2tp_encap_type encap = L2TP_ENCAPTYPE_UDP;
1199
1200         /* Get the tunnel socket from the fd, which was opened by
1201          * the userspace L2TP daemon.
1202          */
1203         err = -EBADF;
1204         sock = sockfd_lookup(fd, &err);
1205         if (!sock) {
1206                 printk(KERN_ERR "tunl %hu: sockfd_lookup(fd=%d) returned %d\n",
1207                        tunnel_id, fd, err);
1208                 goto err;
1209         }
1210
1211         sk = sock->sk;
1212
1213         if (cfg != NULL)
1214                 encap = cfg->encap;
1215
1216         /* Quick sanity checks */
1217         switch (encap) {
1218         case L2TP_ENCAPTYPE_UDP:
1219                 err = -EPROTONOSUPPORT;
1220                 if (sk->sk_protocol != IPPROTO_UDP) {
1221                         printk(KERN_ERR "tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
1222                                tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
1223                         goto err;
1224                 }
1225                 break;
1226         case L2TP_ENCAPTYPE_IP:
1227                 err = -EPROTONOSUPPORT;
1228                 if (sk->sk_protocol != IPPROTO_L2TP) {
1229                         printk(KERN_ERR "tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
1230                                tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP);
1231                         goto err;
1232                 }
1233                 break;
1234         }
1235
1236         /* Check if this socket has already been prepped */
1237         tunnel = (struct l2tp_tunnel *)sk->sk_user_data;
1238         if (tunnel != NULL) {
1239                 /* This socket has already been prepped */
1240                 err = -EBUSY;
1241                 goto err;
1242         }
1243
1244         tunnel = kzalloc(sizeof(struct l2tp_tunnel), GFP_KERNEL);
1245         if (tunnel == NULL) {
1246                 err = -ENOMEM;
1247                 goto err;
1248         }
1249
1250         tunnel->version = version;
1251         tunnel->tunnel_id = tunnel_id;
1252         tunnel->peer_tunnel_id = peer_tunnel_id;
1253         tunnel->debug = L2TP_DEFAULT_DEBUG_FLAGS;
1254
1255         tunnel->magic = L2TP_TUNNEL_MAGIC;
1256         sprintf(&tunnel->name[0], "tunl %u", tunnel_id);
1257         rwlock_init(&tunnel->hlist_lock);
1258
1259         /* The net we belong to */
1260         tunnel->l2tp_net = net;
1261         pn = l2tp_pernet(net);
1262
1263         if (cfg != NULL)
1264                 tunnel->debug = cfg->debug;
1265
1266         /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
1267         tunnel->encap = encap;
1268         if (encap == L2TP_ENCAPTYPE_UDP) {
1269                 /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
1270                 udp_sk(sk)->encap_type = UDP_ENCAP_L2TPINUDP;
1271                 udp_sk(sk)->encap_rcv = l2tp_udp_encap_recv;
1272         }
1273
1274         sk->sk_user_data = tunnel;
1275
1276         /* Hook on the tunnel socket destructor so that we can cleanup
1277          * if the tunnel socket goes away.
1278          */
1279         tunnel->old_sk_destruct = sk->sk_destruct;
1280         sk->sk_destruct = &l2tp_tunnel_destruct;
1281         tunnel->sock = sk;
1282         sk->sk_allocation = GFP_ATOMIC;
1283
1284         /* Add tunnel to our list */
1285         INIT_LIST_HEAD(&tunnel->list);
1286         write_lock_bh(&pn->l2tp_tunnel_list_lock);
1287         list_add(&tunnel->list, &pn->l2tp_tunnel_list);
1288         write_unlock_bh(&pn->l2tp_tunnel_list_lock);
1289         atomic_inc(&l2tp_tunnel_count);
1290
1291         /* Bump the reference count. The tunnel context is deleted
1292          * only when this drops to zero.
1293          */
1294         l2tp_tunnel_inc_refcount(tunnel);
1295
1296         err = 0;
1297 err:
1298         if (tunnelp)
1299                 *tunnelp = tunnel;
1300
1301         if (sock)
1302                 sockfd_put(sock);
1303
1304         return err;
1305 }
1306 EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
1307
1308 /* Really kill the session.
1309  */
1310 void l2tp_session_free(struct l2tp_session *session)
1311 {
1312         struct l2tp_tunnel *tunnel;
1313
1314         BUG_ON(atomic_read(&session->ref_count) != 0);
1315
1316         tunnel = session->tunnel;
1317         if (tunnel != NULL) {
1318                 BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
1319
1320                 /* Delete the session from the hash */
1321                 write_lock_bh(&tunnel->hlist_lock);
1322                 hlist_del_init(&session->hlist);
1323                 write_unlock_bh(&tunnel->hlist_lock);
1324
1325                 /* Unlink from the global hash if not L2TPv2 */
1326                 if (tunnel->version != L2TP_HDR_VER_2) {
1327                         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1328
1329                         write_lock_bh(&pn->l2tp_session_hlist_lock);
1330                         hlist_del_init(&session->global_hlist);
1331                         write_unlock_bh(&pn->l2tp_session_hlist_lock);
1332                 }
1333
1334                 if (session->session_id != 0)
1335                         atomic_dec(&l2tp_session_count);
1336
1337                 sock_put(tunnel->sock);
1338
1339                 /* This will delete the tunnel context if this
1340                  * is the last session on the tunnel.
1341                  */
1342                 session->tunnel = NULL;
1343                 l2tp_tunnel_dec_refcount(tunnel);
1344         }
1345
1346         kfree(session);
1347
1348         return;
1349 }
1350 EXPORT_SYMBOL_GPL(l2tp_session_free);
1351
1352 /* We come here whenever a session's send_seq, cookie_len or
1353  * l2specific_len parameters are set.
1354  */
1355 void l2tp_session_set_header_len(struct l2tp_session *session, int version)
1356 {
1357         if (version == L2TP_HDR_VER_2) {
1358                 session->hdr_len = 6;
1359                 if (session->send_seq)
1360                         session->hdr_len += 4;
1361         } else {
1362                 session->hdr_len = 4 + session->cookie_len + session->l2specific_len + session->offset;
1363                 if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)
1364                         session->hdr_len += 4;
1365         }
1366
1367 }
1368 EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
1369
1370 struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
1371 {
1372         struct l2tp_session *session;
1373
1374         session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL);
1375         if (session != NULL) {
1376                 session->magic = L2TP_SESSION_MAGIC;
1377                 session->tunnel = tunnel;
1378
1379                 session->session_id = session_id;
1380                 session->peer_session_id = peer_session_id;
1381                 session->nr = 1;
1382
1383                 sprintf(&session->name[0], "sess %u/%u",
1384                         tunnel->tunnel_id, session->session_id);
1385
1386                 skb_queue_head_init(&session->reorder_q);
1387
1388                 INIT_HLIST_NODE(&session->hlist);
1389                 INIT_HLIST_NODE(&session->global_hlist);
1390
1391                 /* Inherit debug options from tunnel */
1392                 session->debug = tunnel->debug;
1393
1394                 if (cfg) {
1395                         session->pwtype = cfg->pw_type;
1396                         session->debug = cfg->debug;
1397                         session->mtu = cfg->mtu;
1398                         session->mru = cfg->mru;
1399                         session->send_seq = cfg->send_seq;
1400                         session->recv_seq = cfg->recv_seq;
1401                         session->lns_mode = cfg->lns_mode;
1402                         session->reorder_timeout = cfg->reorder_timeout;
1403                         session->offset = cfg->offset;
1404                         session->l2specific_type = cfg->l2specific_type;
1405                         session->l2specific_len = cfg->l2specific_len;
1406                         session->cookie_len = cfg->cookie_len;
1407                         memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);
1408                         session->peer_cookie_len = cfg->peer_cookie_len;
1409                         memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);
1410                 }
1411
1412                 if (tunnel->version == L2TP_HDR_VER_2)
1413                         session->build_header = l2tp_build_l2tpv2_header;
1414                 else
1415                         session->build_header = l2tp_build_l2tpv3_header;
1416
1417                 l2tp_session_set_header_len(session, tunnel->version);
1418
1419                 /* Bump the reference count. The session context is deleted
1420                  * only when this drops to zero.
1421                  */
1422                 l2tp_session_inc_refcount(session);
1423                 l2tp_tunnel_inc_refcount(tunnel);
1424
1425                 /* Ensure tunnel socket isn't deleted */
1426                 sock_hold(tunnel->sock);
1427
1428                 /* Add session to the tunnel's hash list */
1429                 write_lock_bh(&tunnel->hlist_lock);
1430                 hlist_add_head(&session->hlist,
1431                                l2tp_session_id_hash(tunnel, session_id));
1432                 write_unlock_bh(&tunnel->hlist_lock);
1433
1434                 /* And to the global session list if L2TPv3 */
1435                 if (tunnel->version != L2TP_HDR_VER_2) {
1436                         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1437
1438                         write_lock_bh(&pn->l2tp_session_hlist_lock);
1439                         hlist_add_head(&session->global_hlist,
1440                                        l2tp_session_id_hash_2(pn, session_id));
1441                         write_unlock_bh(&pn->l2tp_session_hlist_lock);
1442                 }
1443
1444                 /* Ignore management session in session count value */
1445                 if (session->session_id != 0)
1446                         atomic_inc(&l2tp_session_count);
1447         }
1448
1449         return session;
1450 }
1451 EXPORT_SYMBOL_GPL(l2tp_session_create);
1452
1453 /*****************************************************************************
1454  * Init and cleanup
1455  *****************************************************************************/
1456
1457 static __net_init int l2tp_init_net(struct net *net)
1458 {
1459         struct l2tp_net *pn;
1460         int err;
1461         int hash;
1462
1463         pn = kzalloc(sizeof(*pn), GFP_KERNEL);
1464         if (!pn)
1465                 return -ENOMEM;
1466
1467         INIT_LIST_HEAD(&pn->l2tp_tunnel_list);
1468         rwlock_init(&pn->l2tp_tunnel_list_lock);
1469
1470         for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
1471                 INIT_HLIST_HEAD(&pn->l2tp_session_hlist[hash]);
1472
1473         rwlock_init(&pn->l2tp_session_hlist_lock);
1474
1475         err = net_assign_generic(net, l2tp_net_id, pn);
1476         if (err)
1477                 goto out;
1478
1479         return 0;
1480
1481 out:
1482         kfree(pn);
1483         return err;
1484 }
1485
1486 static __net_exit void l2tp_exit_net(struct net *net)
1487 {
1488         struct l2tp_net *pn;
1489
1490         pn = net_generic(net, l2tp_net_id);
1491         /*
1492          * if someone has cached our net then
1493          * further net_generic call will return NULL
1494          */
1495         net_assign_generic(net, l2tp_net_id, NULL);
1496         kfree(pn);
1497 }
1498
1499 static struct pernet_operations l2tp_net_ops = {
1500         .init = l2tp_init_net,
1501         .exit = l2tp_exit_net,
1502         .id   = &l2tp_net_id,
1503         .size = sizeof(struct l2tp_net),
1504 };
1505
1506 static int __init l2tp_init(void)
1507 {
1508         int rc = 0;
1509
1510         rc = register_pernet_device(&l2tp_net_ops);
1511         if (rc)
1512                 goto out;
1513
1514         printk(KERN_INFO "L2TP core driver, %s\n", L2TP_DRV_VERSION);
1515
1516 out:
1517         return rc;
1518 }
1519
1520 static void __exit l2tp_exit(void)
1521 {
1522         unregister_pernet_device(&l2tp_net_ops);
1523 }
1524
1525 module_init(l2tp_init);
1526 module_exit(l2tp_exit);
1527
1528 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1529 MODULE_DESCRIPTION("L2TP core");
1530 MODULE_LICENSE("GPL");
1531 MODULE_VERSION(L2TP_DRV_VERSION);
1532