net/l2tp/l2tp_core.c

   1 /*
   2  * L2TP core.
   3  *
   4  * Copyright (c) 2008,2009,2010 Katalix Systems Ltd
   5  *
   6  * This file contains some code of the original L2TPv2 pppol2tp
   7  * driver, which has the following copyright:
   8  *
   9  * Authors:     Martijn van Oosterhout <kleptog@svana.org>
  10  *              James Chapman (jchapman@katalix.com)
  11  * Contributors:
  12  *              Michal Ostrowski <mostrows@speakeasy.net>
  13  *              Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
  14  *              David S. Miller (davem@redhat.com)
  15  *
  16  * This program is free software; you can redistribute it and/or modify
  17  * it under the terms of the GNU General Public License version 2 as
  18  * published by the Free Software Foundation.
  19  */
  20
  21 #include <linux/module.h>
  22 #include <linux/string.h>
  23 #include <linux/list.h>
  24 #include <linux/rculist.h>
  25 #include <linux/uaccess.h>
  26
  27 #include <linux/kernel.h>
  28 #include <linux/spinlock.h>
  29 #include <linux/kthread.h>
  30 #include <linux/sched.h>
  31 #include <linux/slab.h>
  32 #include <linux/errno.h>
  33 #include <linux/jiffies.h>
  34
  35 #include <linux/netdevice.h>
  36 #include <linux/net.h>
  37 #include <linux/inetdevice.h>
  38 #include <linux/skbuff.h>
  39 #include <linux/init.h>
  40 #include <linux/in.h>
  41 #include <linux/ip.h>
  42 #include <linux/udp.h>
  43 #include <linux/l2tp.h>
  44 #include <linux/hash.h>
  45 #include <linux/sort.h>
  46 #include <linux/file.h>
  47 #include <linux/nsproxy.h>
  48 #include <net/net_namespace.h>
  49 #include <net/netns/generic.h>
  50 #include <net/dst.h>
  51 #include <net/ip.h>
  52 #include <net/udp.h>
  53 #include <net/inet_common.h>
  54 #include <net/xfrm.h>
  55 #include <net/protocol.h>
  56
  57 #include <asm/byteorder.h>
  58 #include <linux/atomic.h>
  59
  60 #include "l2tp_core.h"
  61
  62 #define L2TP_DRV_VERSION        "V2.0"
  63
  64 /* L2TP header constants */
  65 #define L2TP_HDRFLAG_T     0x8000
  66 #define L2TP_HDRFLAG_L     0x4000
  67 #define L2TP_HDRFLAG_S     0x0800
  68 #define L2TP_HDRFLAG_O     0x0200
  69 #define L2TP_HDRFLAG_P     0x0100
  70
  71 #define L2TP_HDR_VER_MASK  0x000F
  72 #define L2TP_HDR_VER_2     0x0002
  73 #define L2TP_HDR_VER_3     0x0003
  74
  75 /* L2TPv3 default L2-specific sublayer */
  76 #define L2TP_SLFLAG_S      0x40000000
  77 #define L2TP_SL_SEQ_MASK   0x00ffffff
  78
  79 #define L2TP_HDR_SIZE_SEQ               10
  80 #define L2TP_HDR_SIZE_NOSEQ             6
  81
  82 /* Default trace flags */
  83 #define L2TP_DEFAULT_DEBUG_FLAGS        0
  84
  85 #define PRINTK(_mask, _type, _lvl, _fmt, args...)                       \
  86         do {                                                            \
  87                 if ((_mask) & (_type))                                  \
  88                         printk(_lvl "L2TP: " _fmt, ##args);             \
  89         } while (0)
  90
  91 /* Private data stored for received packets in the skb.
  92  */
  93 struct l2tp_skb_cb {
  94         u32                     ns;
  95         u16                     has_seq;
  96         u16                     length;
  97         unsigned long           expires;
  98 };
  99
 100 #define L2TP_SKB_CB(skb)        ((struct l2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])
 101
 102 static atomic_t l2tp_tunnel_count;
 103 static atomic_t l2tp_session_count;
 104
 105 /* per-net private data for this module */
 106 static unsigned int l2tp_net_id;
 107 struct l2tp_net {
 108         struct list_head l2tp_tunnel_list;
 109         spinlock_t l2tp_tunnel_list_lock;
 110         struct hlist_head l2tp_session_hlist[L2TP_HASH_SIZE_2];
 111         spinlock_t l2tp_session_hlist_lock;
 112 };
 113
 114 static void l2tp_session_set_header_len(struct l2tp_session *session, int version);
 115 static void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel);
 116
 117 static inline struct l2tp_net *l2tp_pernet(const struct net *net)
 118 {
 119         BUG_ON(!net);
 120
 121         return net_generic(net, l2tp_net_id);
 122 }
 123
 124
 125 /* Session hash global list for L2TPv3.
 126  * The session_id SHOULD be random according to RFC3931, but several
 127  * L2TP implementations use incrementing session_ids.  So we do a real
 128  * hash on the session_id, rather than a simple bitmask.
 129  */
 130 static inline struct hlist_head *
 131 l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
 132 {
 133         return &pn->l2tp_session_hlist[hash_32(session_id, L2TP_HASH_BITS_2)];
 134
 135 }
 136
 137 /* Lookup a session by id in the global session list
 138  */
 139 static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
 140 {
 141         struct l2tp_net *pn = l2tp_pernet(net);
 142         struct hlist_head *session_list =
 143                 l2tp_session_id_hash_2(pn, session_id);
 144         struct l2tp_session *session;
 145         struct hlist_node *walk;
 146
 147         rcu_read_lock_bh();
 148         hlist_for_each_entry_rcu(session, walk, session_list, global_hlist) {
 149                 if (session->session_id == session_id) {
 150                         rcu_read_unlock_bh();
 151                         return session;
 152                 }
 153         }
 154         rcu_read_unlock_bh();
 155
 156         return NULL;
 157 }
 158
 159 /* Session hash list.
 160  * The session_id SHOULD be random according to RFC2661, but several
 161  * L2TP implementations (Cisco and Microsoft) use incrementing
 162  * session_ids.  So we do a real hash on the session_id, rather than a
 163  * simple bitmask.
 164  */
 165 static inline struct hlist_head *
 166 l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id)
 167 {
 168         return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)];
 169 }
 170
 171 /* Lookup a session by id
 172  */
 173 struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id)
 174 {
 175         struct hlist_head *session_list;
 176         struct l2tp_session *session;
 177         struct hlist_node *walk;
 178
 179         /* In L2TPv3, session_ids are unique over all tunnels and we
 180          * sometimes need to look them up before we know the
 181          * tunnel.
 182          */
 183         if (tunnel == NULL)
 184                 return l2tp_session_find_2(net, session_id);
 185
 186         session_list = l2tp_session_id_hash(tunnel, session_id);
 187         read_lock_bh(&tunnel->hlist_lock);
 188         hlist_for_each_entry(session, walk, session_list, hlist) {
 189                 if (session->session_id == session_id) {
 190                         read_unlock_bh(&tunnel->hlist_lock);
 191                         return session;
 192                 }
 193         }
 194         read_unlock_bh(&tunnel->hlist_lock);
 195
 196         return NULL;
 197 }
 198 EXPORT_SYMBOL_GPL(l2tp_session_find);
 199
 200 /* Lookup a tunnel. A new reference is held on the returned tunnel. */
 201 struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id)
 202 {
 203         const struct l2tp_net *pn = l2tp_pernet(net);
 204         struct l2tp_tunnel *tunnel;
 205
 206         rcu_read_lock_bh();
 207         list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
 208                 if (tunnel->tunnel_id == tunnel_id) {
 209                         l2tp_tunnel_inc_refcount(tunnel);
 210                         rcu_read_unlock_bh();
 211
 212                         return tunnel;
 213                 }
 214         }
 215         rcu_read_unlock_bh();
 216
 217         return NULL;
 218 }
 219 EXPORT_SYMBOL_GPL(l2tp_tunnel_get);
 220
 221 /* Like l2tp_session_find() but takes a reference on the returned session.
 222  * Optionally calls session->ref() too if do_ref is true.
 223  */
 224 struct l2tp_session *l2tp_session_get(const struct net *net,
 225                                       struct l2tp_tunnel *tunnel,
 226                                       u32 session_id, bool do_ref)
 227 {
 228         struct hlist_head *session_list;
 229         struct l2tp_session *session;
 230         struct hlist_node *walk;
 231
 232         if (!tunnel) {
 233                 struct l2tp_net *pn = l2tp_pernet(net);
 234
 235                 session_list = l2tp_session_id_hash_2(pn, session_id);
 236
 237                 rcu_read_lock_bh();
 238                 hlist_for_each_entry_rcu(session, walk, session_list, global_hlist) {
 239                         if (session->session_id == session_id) {
 240                                 l2tp_session_inc_refcount(session);
 241                                 if (do_ref && session->ref)
 242                                         session->ref(session);
 243                                 rcu_read_unlock_bh();
 244
 245                                 return session;
 246                         }
 247                 }
 248                 rcu_read_unlock_bh();
 249
 250                 return NULL;
 251         }
 252
 253         session_list = l2tp_session_id_hash(tunnel, session_id);
 254         read_lock_bh(&tunnel->hlist_lock);
 255         hlist_for_each_entry(session, walk, session_list, hlist) {
 256                 if (session->session_id == session_id) {
 257                         l2tp_session_inc_refcount(session);
 258                         if (do_ref && session->ref)
 259                                 session->ref(session);
 260                         read_unlock_bh(&tunnel->hlist_lock);
 261
 262                         return session;
 263                 }
 264         }
 265         read_unlock_bh(&tunnel->hlist_lock);
 266
 267         return NULL;
 268 }
 269 EXPORT_SYMBOL_GPL(l2tp_session_get);
 270
 271 struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth,
 272                                           bool do_ref)
 273 {
 274         int hash;
 275         struct hlist_node *walk;
 276         struct l2tp_session *session;
 277         int count = 0;
 278
 279         read_lock_bh(&tunnel->hlist_lock);
 280         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
 281                 hlist_for_each_entry(session, walk, &tunnel->session_hlist[hash], hlist) {
 282                         if (++count > nth) {
 283                                 l2tp_session_inc_refcount(session);
 284                                 if (do_ref && session->ref)
 285                                         session->ref(session);
 286                                 read_unlock_bh(&tunnel->hlist_lock);
 287                                 return session;
 288                         }
 289                 }
 290         }
 291
 292         read_unlock_bh(&tunnel->hlist_lock);
 293
 294         return NULL;
 295 }
 296 EXPORT_SYMBOL_GPL(l2tp_session_get_nth);
 297
 298 /* Lookup a session by interface name.
 299  * This is very inefficient but is only used by management interfaces.
 300  */
 301 struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
 302                                                 const char *ifname,
 303                                                 bool do_ref)
 304 {
 305         struct l2tp_net *pn = l2tp_pernet(net);
 306         int hash;
 307         struct hlist_node *walk;
 308         struct l2tp_session *session;
 309
 310         rcu_read_lock_bh();
 311         for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) {
 312                 hlist_for_each_entry_rcu(session, walk, &pn->l2tp_session_hlist[hash], global_hlist) {
 313                         if (!strcmp(session->ifname, ifname)) {
 314                                 l2tp_session_inc_refcount(session);
 315                                 if (do_ref && session->ref)
 316                                         session->ref(session);
 317                                 rcu_read_unlock_bh();
 318
 319                                 return session;
 320                         }
 321                 }
 322         }
 323
 324         rcu_read_unlock_bh();
 325
 326         return NULL;
 327 }
 328 EXPORT_SYMBOL_GPL(l2tp_session_get_by_ifname);
 329
 330 int l2tp_session_register(struct l2tp_session *session,
 331                           struct l2tp_tunnel *tunnel)
 332 {
 333         struct l2tp_session *session_walk;
 334         struct hlist_head *g_head;
 335         struct hlist_head *head;
 336         struct l2tp_net *pn;
 337         struct hlist_node *walk;
 338         int err;
 339
 340         head = l2tp_session_id_hash(tunnel, session->session_id);
 341
 342         write_lock_bh(&tunnel->hlist_lock);
 343         if (!tunnel->acpt_newsess) {
 344                 err = -ENODEV;
 345                 goto err_tlock;
 346         }
 347
 348         hlist_for_each_entry(session_walk, walk, head, hlist)
 349                 if (session_walk->session_id == session->session_id) {
 350                         err = -EEXIST;
 351                         goto err_tlock;
 352                 }
 353
 354         if (tunnel->version == L2TP_HDR_VER_3) {
 355                 pn = l2tp_pernet(tunnel->l2tp_net);
 356                 g_head = l2tp_session_id_hash_2(l2tp_pernet(tunnel->l2tp_net),
 357                                                 session->session_id);
 358
 359                 spin_lock_bh(&pn->l2tp_session_hlist_lock);
 360
 361                 hlist_for_each_entry(session_walk, walk, g_head, global_hlist)
 362                         if (session_walk->session_id == session->session_id) {
 363                                 err = -EEXIST;
 364                                 goto err_tlock_pnlock;
 365                         }
 366
 367                 l2tp_tunnel_inc_refcount(tunnel);
 368                 sock_hold(tunnel->sock);
 369                 hlist_add_head_rcu(&session->global_hlist, g_head);
 370
 371                 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
 372         } else {
 373                 l2tp_tunnel_inc_refcount(tunnel);
 374                 sock_hold(tunnel->sock);
 375         }
 376
 377         hlist_add_head(&session->hlist, head);
 378         write_unlock_bh(&tunnel->hlist_lock);
 379
 380         /* Ignore management session in session count value */
 381         if (session->session_id != 0)
 382                 atomic_inc(&l2tp_session_count);
 383
 384         return 0;
 385
 386 err_tlock_pnlock:
 387         spin_unlock_bh(&pn->l2tp_session_hlist_lock);
 388 err_tlock:
 389         write_unlock_bh(&tunnel->hlist_lock);
 390
 391         return err;
 392 }
 393 EXPORT_SYMBOL_GPL(l2tp_session_register);
 394
 395 /* Lookup a tunnel by id
 396  */
 397 struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id)
 398 {
 399         struct l2tp_tunnel *tunnel;
 400         struct l2tp_net *pn = l2tp_pernet(net);
 401
 402         rcu_read_lock_bh();
 403         list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
 404                 if (tunnel->tunnel_id == tunnel_id) {
 405                         rcu_read_unlock_bh();
 406                         return tunnel;
 407                 }
 408         }
 409         rcu_read_unlock_bh();
 410
 411         return NULL;
 412 }
 413 EXPORT_SYMBOL_GPL(l2tp_tunnel_find);
 414
 415 struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth)
 416 {
 417         struct l2tp_net *pn = l2tp_pernet(net);
 418         struct l2tp_tunnel *tunnel;
 419         int count = 0;
 420
 421         rcu_read_lock_bh();
 422         list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
 423                 if (++count > nth) {
 424                         rcu_read_unlock_bh();
 425                         return tunnel;
 426                 }
 427         }
 428
 429         rcu_read_unlock_bh();
 430
 431         return NULL;
 432 }
 433 EXPORT_SYMBOL_GPL(l2tp_tunnel_find_nth);
 434
 435 /*****************************************************************************
 436  * Receive data handling
 437  *****************************************************************************/
 438
 439 /* Queue a skb in order. We come here only if the skb has an L2TP sequence
 440  * number.
 441  */
 442 static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)
 443 {
 444         struct sk_buff *skbp;
 445         struct sk_buff *tmp;
 446         u32 ns = L2TP_SKB_CB(skb)->ns;
 447
 448         spin_lock_bh(&session->reorder_q.lock);
 449         skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
 450                 if (L2TP_SKB_CB(skbp)->ns > ns) {
 451                         __skb_queue_before(&session->reorder_q, skbp, skb);
 452                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 453                                "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
 454                                session->name, ns, L2TP_SKB_CB(skbp)->ns,
 455                                skb_queue_len(&session->reorder_q));
 456                         session->stats.rx_oos_packets++;
 457                         goto out;
 458                 }
 459         }
 460
 461         __skb_queue_tail(&session->reorder_q, skb);
 462
 463 out:
 464         spin_unlock_bh(&session->reorder_q.lock);
 465 }
 466
 467 /* Dequeue a single skb.
 468  */
 469 static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)
 470 {
 471         struct l2tp_tunnel *tunnel = session->tunnel;
 472         int length = L2TP_SKB_CB(skb)->length;
 473
 474         /* We're about to requeue the skb, so return resources
 475          * to its current owner (a socket receive buffer).
 476          */
 477         skb_orphan(skb);
 478
 479         tunnel->stats.rx_packets++;
 480         tunnel->stats.rx_bytes += length;
 481         session->stats.rx_packets++;
 482         session->stats.rx_bytes += length;
 483
 484         if (L2TP_SKB_CB(skb)->has_seq) {
 485                 /* Bump our Nr */
 486                 session->nr++;
 487                 if (tunnel->version == L2TP_HDR_VER_2)
 488                         session->nr &= 0xffff;
 489                 else
 490                         session->nr &= 0xffffff;
 491
 492                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 493                        "%s: updated nr to %hu\n", session->name, session->nr);
 494         }
 495
 496         /* call private receive handler */
 497         if (session->recv_skb != NULL)
 498                 (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);
 499         else
 500                 kfree_skb(skb);
 501
 502         if (session->deref)
 503                 (*session->deref)(session);
 504 }
 505
 506 /* Dequeue skbs from the session's reorder_q, subject to packet order.
 507  * Skbs that have been in the queue for too long are simply discarded.
 508  */
 509 static void l2tp_recv_dequeue(struct l2tp_session *session)
 510 {
 511         struct sk_buff *skb;
 512         struct sk_buff *tmp;
 513
 514         /* If the pkt at the head of the queue has the nr that we
 515          * expect to send up next, dequeue it and any other
 516          * in-sequence packets behind it.
 517          */
 518 start:
 519         spin_lock_bh(&session->reorder_q.lock);
 520         skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
 521                 if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) {
 522                         session->stats.rx_seq_discards++;
 523                         session->stats.rx_errors++;
 524                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 525                                "%s: oos pkt %u len %d discarded (too old), "
 526                                "waiting for %u, reorder_q_len=%d\n",
 527                                session->name, L2TP_SKB_CB(skb)->ns,
 528                                L2TP_SKB_CB(skb)->length, session->nr,
 529                                skb_queue_len(&session->reorder_q));
 530                         __skb_unlink(skb, &session->reorder_q);
 531                         kfree_skb(skb);
 532                         if (session->deref)
 533                                 (*session->deref)(session);
 534                         continue;
 535                 }
 536
 537                 if (L2TP_SKB_CB(skb)->has_seq) {
 538                         if (L2TP_SKB_CB(skb)->ns != session->nr) {
 539                                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 540                                        "%s: holding oos pkt %u len %d, "
 541                                        "waiting for %u, reorder_q_len=%d\n",
 542                                        session->name, L2TP_SKB_CB(skb)->ns,
 543                                        L2TP_SKB_CB(skb)->length, session->nr,
 544                                        skb_queue_len(&session->reorder_q));
 545                                 goto out;
 546                         }
 547                 }
 548                 __skb_unlink(skb, &session->reorder_q);
 549
 550                 /* Process the skb. We release the queue lock while we
 551                  * do so to let other contexts process the queue.
 552                  */
 553                 spin_unlock_bh(&session->reorder_q.lock);
 554                 l2tp_recv_dequeue_skb(session, skb);
 555                 goto start;
 556         }
 557
 558 out:
 559         spin_unlock_bh(&session->reorder_q.lock);
 560 }
 561
 562 static inline int l2tp_verify_udp_checksum(struct sock *sk,
 563                                            struct sk_buff *skb)
 564 {
 565         struct udphdr *uh = udp_hdr(skb);
 566         u16 ulen = ntohs(uh->len);
 567         struct inet_sock *inet;
 568         __wsum psum;
 569
 570         if (sk->sk_no_check || skb_csum_unnecessary(skb) || !uh->check)
 571                 return 0;
 572
 573         inet = inet_sk(sk);
 574         psum = csum_tcpudp_nofold(inet->inet_saddr, inet->inet_daddr, ulen,
 575                                   IPPROTO_UDP, 0);
 576
 577         if ((skb->ip_summed == CHECKSUM_COMPLETE) &&
 578             !csum_fold(csum_add(psum, skb->csum)))
 579                 return 0;
 580
 581         skb->csum = psum;
 582
 583         return __skb_checksum_complete(skb);
 584 }
 585
 586 /* Do receive processing of L2TP data frames. We handle both L2TPv2
 587  * and L2TPv3 data frames here.
 588  *
 589  * L2TPv2 Data Message Header
 590  *
 591  *  0                   1                   2                   3
 592  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 593  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 594  * |T|L|x|x|S|x|O|P|x|x|x|x|  Ver  |          Length (opt)         |
 595  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 596  * |           Tunnel ID           |           Session ID          |
 597  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 598  * |             Ns (opt)          |             Nr (opt)          |
 599  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 600  * |      Offset Size (opt)        |    Offset pad... (opt)
 601  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 602  *
 603  * Data frames are marked by T=0. All other fields are the same as
 604  * those in L2TP control frames.
 605  *
 606  * L2TPv3 Data Message Header
 607  *
 608  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 609  * |                      L2TP Session Header                      |
 610  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 611  * |                      L2-Specific Sublayer                     |
 612  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 613  * |                        Tunnel Payload                      ...
 614  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 615  *
 616  * L2TPv3 Session Header Over IP
 617  *
 618  *  0                   1                   2                   3
 619  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 620  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 621  * |                           Session ID                          |
 622  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 623  * |               Cookie (optional, maximum 64 bits)...
 624  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 625  *                                                                 |
 626  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 627  *
 628  * L2TPv3 L2-Specific Sublayer Format
 629  *
 630  *  0                   1                   2                   3
 631  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 632  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 633  * |x|S|x|x|x|x|x|x|              Sequence Number                  |
 634  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 635  *
 636  * Cookie value, sublayer format and offset (pad) are negotiated with
 637  * the peer when the session is set up. Unlike L2TPv2, we do not need
 638  * to parse the packet header to determine if optional fields are
 639  * present.
 640  *
 641  * Caller must already have parsed the frame and determined that it is
 642  * a data (not control) frame before coming here. Fields up to the
 643  * session-id have already been parsed and ptr points to the data
 644  * after the session-id.
 645  *
 646  * session->ref() must have been called prior to l2tp_recv_common().
 647  * session->deref() will be called automatically after skb is processed.
 648  */
 649 void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
 650                       unsigned char *ptr, unsigned char *optr, u16 hdrflags,
 651                       int length, int (*payload_hook)(struct sk_buff *skb))
 652 {
 653         struct l2tp_tunnel *tunnel = session->tunnel;
 654         int offset;
 655         u32 ns, nr;
 656
 657         /* Parse and check optional cookie */
 658         if (session->peer_cookie_len > 0) {
 659                 if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
 660                         PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
 661                                "%s: cookie mismatch (%u/%u). Discarding.\n",
 662                                tunnel->name, tunnel->tunnel_id, session->session_id);
 663                         session->stats.rx_cookie_discards++;
 664                         goto discard;
 665                 }
 666                 ptr += session->peer_cookie_len;
 667         }
 668
 669         /* Handle the optional sequence numbers. Sequence numbers are
 670          * in different places for L2TPv2 and L2TPv3.
 671          *
 672          * If we are the LAC, enable/disable sequence numbers under
 673          * the control of the LNS.  If no sequence numbers present but
 674          * we were expecting them, discard frame.
 675          */
 676         ns = nr = 0;
 677         L2TP_SKB_CB(skb)->has_seq = 0;
 678         if (tunnel->version == L2TP_HDR_VER_2) {
 679                 if (hdrflags & L2TP_HDRFLAG_S) {
 680                         ns = ntohs(*(__be16 *) ptr);
 681                         ptr += 2;
 682                         nr = ntohs(*(__be16 *) ptr);
 683                         ptr += 2;
 684
 685                         /* Store L2TP info in the skb */
 686                         L2TP_SKB_CB(skb)->ns = ns;
 687                         L2TP_SKB_CB(skb)->has_seq = 1;
 688
 689                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 690                                "%s: recv data ns=%u, nr=%u, session nr=%u\n",
 691                                session->name, ns, nr, session->nr);
 692                 }
 693         } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
 694                 u32 l2h = ntohl(*(__be32 *) ptr);
 695
 696                 if (l2h & 0x40000000) {
 697                         ns = l2h & 0x00ffffff;
 698
 699                         /* Store L2TP info in the skb */
 700                         L2TP_SKB_CB(skb)->ns = ns;
 701                         L2TP_SKB_CB(skb)->has_seq = 1;
 702
 703                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 704                                "%s: recv data ns=%u, session nr=%u\n",
 705                                session->name, ns, session->nr);
 706                 }
 707         }
 708
 709         /* Advance past L2-specific header, if present */
 710         ptr += session->l2specific_len;
 711
 712         if (L2TP_SKB_CB(skb)->has_seq) {
 713                 /* Received a packet with sequence numbers. If we're the LNS,
 714                  * check if we sre sending sequence numbers and if not,
 715                  * configure it so.
 716                  */
 717                 if ((!session->lns_mode) && (!session->send_seq)) {
 718                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_INFO,
 719                                "%s: requested to enable seq numbers by LNS\n",
 720                                session->name);
 721                         session->send_seq = -1;
 722                         l2tp_session_set_header_len(session, tunnel->version);
 723                 }
 724         } else {
 725                 /* No sequence numbers.
 726                  * If user has configured mandatory sequence numbers, discard.
 727                  */
 728                 if (session->recv_seq) {
 729                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_WARNING,
 730                                "%s: recv data has no seq numbers when required. "
 731                                "Discarding\n", session->name);
 732                         session->stats.rx_seq_discards++;
 733                         goto discard;
 734                 }
 735
 736                 /* If we're the LAC and we're sending sequence numbers, the
 737                  * LNS has requested that we no longer send sequence numbers.
 738                  * If we're the LNS and we're sending sequence numbers, the
 739                  * LAC is broken. Discard the frame.
 740                  */
 741                 if ((!session->lns_mode) && (session->send_seq)) {
 742                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_INFO,
 743                                "%s: requested to disable seq numbers by LNS\n",
 744                                session->name);
 745                         session->send_seq = 0;
 746                         l2tp_session_set_header_len(session, tunnel->version);
 747                 } else if (session->send_seq) {
 748                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_WARNING,
 749                                "%s: recv data has no seq numbers when required. "
 750                                "Discarding\n", session->name);
 751                         session->stats.rx_seq_discards++;
 752                         goto discard;
 753                 }
 754         }
 755
 756         /* Session data offset is handled differently for L2TPv2 and
 757          * L2TPv3. For L2TPv2, there is an optional 16-bit value in
 758          * the header. For L2TPv3, the offset is negotiated using AVPs
 759          * in the session setup control protocol.
 760          */
 761         if (tunnel->version == L2TP_HDR_VER_2) {
 762                 /* If offset bit set, skip it. */
 763                 if (hdrflags & L2TP_HDRFLAG_O) {
 764                         offset = ntohs(*(__be16 *)ptr);
 765                         ptr += 2 + offset;
 766                 }
 767         } else
 768                 ptr += session->offset;
 769
 770         offset = ptr - optr;
 771         if (!pskb_may_pull(skb, offset))
 772                 goto discard;
 773
 774         __skb_pull(skb, offset);
 775
 776         /* If caller wants to process the payload before we queue the
 777          * packet, do so now.
 778          */
 779         if (payload_hook)
 780                 if ((*payload_hook)(skb))
 781                         goto discard;
 782
 783         /* Prepare skb for adding to the session's reorder_q.  Hold
 784          * packets for max reorder_timeout or 1 second if not
 785          * reordering.
 786          */
 787         L2TP_SKB_CB(skb)->length = length;
 788         L2TP_SKB_CB(skb)->expires = jiffies +
 789                 (session->reorder_timeout ? session->reorder_timeout : HZ);
 790
 791         /* Add packet to the session's receive queue. Reordering is done here, if
 792          * enabled. Saved L2TP protocol info is stored in skb->sb[].
 793          */
 794         if (L2TP_SKB_CB(skb)->has_seq) {
 795                 if (session->reorder_timeout != 0) {
 796                         /* Packet reordering enabled. Add skb to session's
 797                          * reorder queue, in order of ns.
 798                          */
 799                         l2tp_recv_queue_skb(session, skb);
 800                 } else {
 801                         /* Packet reordering disabled. Discard out-of-sequence
 802                          * packets
 803                          */
 804                         if (L2TP_SKB_CB(skb)->ns != session->nr) {
 805                                 session->stats.rx_seq_discards++;
 806                                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
 807                                        "%s: oos pkt %u len %d discarded, "
 808                                        "waiting for %u, reorder_q_len=%d\n",
 809                                        session->name, L2TP_SKB_CB(skb)->ns,
 810                                        L2TP_SKB_CB(skb)->length, session->nr,
 811                                        skb_queue_len(&session->reorder_q));
 812                                 goto discard;
 813                         }
 814                         skb_queue_tail(&session->reorder_q, skb);
 815                 }
 816         } else {
 817                 /* No sequence numbers. Add the skb to the tail of the
 818                  * reorder queue. This ensures that it will be
 819                  * delivered after all previous sequenced skbs.
 820                  */
 821                 skb_queue_tail(&session->reorder_q, skb);
 822         }
 823
 824         /* Try to dequeue as many skbs from reorder_q as we can. */
 825         l2tp_recv_dequeue(session);
 826
 827         return;
 828
 829 discard:
 830         session->stats.rx_errors++;
 831         kfree_skb(skb);
 832
 833         if (session->deref)
 834                 (*session->deref)(session);
 835 }
 836 EXPORT_SYMBOL(l2tp_recv_common);
 837
 838 /* Drop skbs from the session's reorder_q
 839  */
 840 int l2tp_session_queue_purge(struct l2tp_session *session)
 841 {
 842         struct sk_buff *skb = NULL;
 843         BUG_ON(!session);
 844         BUG_ON(session->magic != L2TP_SESSION_MAGIC);
 845         while ((skb = skb_dequeue(&session->reorder_q))) {
 846                 session->stats.rx_errors++;
 847                 kfree_skb(skb);
 848                 if (session->deref)
 849                         (*session->deref)(session);
 850         }
 851         return 0;
 852 }
 853 EXPORT_SYMBOL_GPL(l2tp_session_queue_purge);
 854
 855 /* Internal UDP receive frame. Do the real work of receiving an L2TP data frame
 856  * here. The skb is not on a list when we get here.
 857  * Returns 0 if the packet was a data packet and was successfully passed on.
 858  * Returns 1 if the packet was not a good data packet and could not be
 859  * forwarded.  All such packets are passed up to userspace to deal with.
 860  */
 861 static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
 862                               int (*payload_hook)(struct sk_buff *skb))
 863 {
 864         struct l2tp_session *session = NULL;
 865         unsigned char *ptr, *optr;
 866         u16 hdrflags;
 867         u32 tunnel_id, session_id;
 868         int offset;
 869         u16 version;
 870         int length;
 871
 872         if (tunnel->sock && l2tp_verify_udp_checksum(tunnel->sock, skb))
 873                 goto discard_bad_csum;
 874
 875         /* UDP always verifies the packet length. */
 876         __skb_pull(skb, sizeof(struct udphdr));
 877
 878         /* Short packet? */
 879         if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) {
 880                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
 881                        "%s: recv short packet (len=%d)\n", tunnel->name, skb->len);
 882                 goto error;
 883         }
 884
 885         /* Trace packet contents, if enabled */
 886         if (tunnel->debug & L2TP_MSG_DATA) {
 887                 length = min(32u, skb->len);
 888                 if (!pskb_may_pull(skb, length))
 889                         goto error;
 890
 891                 printk(KERN_DEBUG "%s: recv: ", tunnel->name);
 892
 893                 offset = 0;
 894                 do {
 895                         printk(" %02X", skb->data[offset]);
 896                 } while (++offset < length);
 897
 898                 printk("\n");
 899         }
 900
 901         /* Point to L2TP header */
 902         optr = ptr = skb->data;
 903
 904         /* Get L2TP header flags */
 905         hdrflags = ntohs(*(__be16 *) ptr);
 906
 907         /* Check protocol version */
 908         version = hdrflags & L2TP_HDR_VER_MASK;
 909         if (version != tunnel->version) {
 910                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
 911                        "%s: recv protocol version mismatch: got %d expected %d\n",
 912                        tunnel->name, version, tunnel->version);
 913                 goto error;
 914         }
 915
 916         /* Get length of L2TP packet */
 917         length = skb->len;
 918
 919         /* If type is control packet, it is handled by userspace. */
 920         if (hdrflags & L2TP_HDRFLAG_T) {
 921                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_DEBUG,
 922                        "%s: recv control packet, len=%d\n", tunnel->name, length);
 923                 goto error;
 924         }
 925
 926         /* Skip flags */
 927         ptr += 2;
 928
 929         if (tunnel->version == L2TP_HDR_VER_2) {
 930                 /* If length is present, skip it */
 931                 if (hdrflags & L2TP_HDRFLAG_L)
 932                         ptr += 2;
 933
 934                 /* Extract tunnel and session ID */
 935                 tunnel_id = ntohs(*(__be16 *) ptr);
 936                 ptr += 2;
 937                 session_id = ntohs(*(__be16 *) ptr);
 938                 ptr += 2;
 939         } else {
 940                 ptr += 2;       /* skip reserved bits */
 941                 tunnel_id = tunnel->tunnel_id;
 942                 session_id = ntohl(*(__be32 *) ptr);
 943                 ptr += 4;
 944         }
 945
 946         /* Find the session context */
 947         session = l2tp_session_get(tunnel->l2tp_net, tunnel, session_id, true);
 948         if (!session || !session->recv_skb) {
 949                 if (session) {
 950                         if (session->deref)
 951                                 session->deref(session);
 952                         l2tp_session_dec_refcount(session);
 953                 }
 954
 955                 /* Not found? Pass to userspace to deal with */
 956                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
 957                        "%s: no session found (%u/%u). Passing up.\n",
 958                        tunnel->name, tunnel_id, session_id);
 959                 goto error;
 960         }
 961
 962         l2tp_recv_common(session, skb, ptr, optr, hdrflags, length, payload_hook);
 963         l2tp_session_dec_refcount(session);
 964
 965         return 0;
 966
 967 discard_bad_csum:
 968         LIMIT_NETDEBUG("%s: UDP: bad checksum\n", tunnel->name);
 969         UDP_INC_STATS_USER(tunnel->l2tp_net, UDP_MIB_INERRORS, 0);
 970         tunnel->stats.rx_errors++;
 971         kfree_skb(skb);
 972
 973         return 0;
 974
 975 error:
 976         /* Put UDP header back */
 977         __skb_push(skb, sizeof(struct udphdr));
 978
 979         return 1;
 980 }
 981
 982 /* UDP encapsulation receive handler. See net/ipv4/udp.c.
 983  * Return codes:
 984  * 0 : success.
 985  * <0: error
 986  * >0: skb should be passed up to userspace as UDP.
 987  */
 988 int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
 989 {
 990         struct l2tp_tunnel *tunnel;
 991
 992         tunnel = l2tp_sock_to_tunnel(sk);
 993         if (tunnel == NULL)
 994                 goto pass_up;
 995
 996         PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_DEBUG,
 997                "%s: received %d bytes\n", tunnel->name, skb->len);
 998
 999         if (l2tp_udp_recv_core(tunnel, skb, tunnel->recv_payload_hook))
1000                 goto pass_up_put;
1001
1002         sock_put(sk);
1003         return 0;
1004
1005 pass_up_put:
1006         sock_put(sk);
1007 pass_up:
1008         return 1;
1009 }
1010 EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv);
1011
1012 /************************************************************************
1013  * Transmit handling
1014  ***********************************************************************/
1015
1016 /* Build an L2TP header for the session into the buffer provided.
1017  */
1018 static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
1019 {
1020         struct l2tp_tunnel *tunnel = session->tunnel;
1021         __be16 *bufp = buf;
1022         __be16 *optr = buf;
1023         u16 flags = L2TP_HDR_VER_2;
1024         u32 tunnel_id = tunnel->peer_tunnel_id;
1025         u32 session_id = session->peer_session_id;
1026
1027         if (session->send_seq)
1028                 flags |= L2TP_HDRFLAG_S;
1029
1030         /* Setup L2TP header. */
1031         *bufp++ = htons(flags);
1032         *bufp++ = htons(tunnel_id);
1033         *bufp++ = htons(session_id);
1034         if (session->send_seq) {
1035                 *bufp++ = htons(session->ns);
1036                 *bufp++ = 0;
1037                 session->ns++;
1038                 session->ns &= 0xffff;
1039                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
1040                        "%s: updated ns to %u\n", session->name, session->ns);
1041         }
1042
1043         return bufp - optr;
1044 }
1045
1046 static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
1047 {
1048         struct l2tp_tunnel *tunnel = session->tunnel;
1049         char *bufp = buf;
1050         char *optr = bufp;
1051
1052         /* Setup L2TP header. The header differs slightly for UDP and
1053          * IP encapsulations. For UDP, there is 4 bytes of flags.
1054          */
1055         if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
1056                 u16 flags = L2TP_HDR_VER_3;
1057                 *((__be16 *) bufp) = htons(flags);
1058                 bufp += 2;
1059                 *((__be16 *) bufp) = 0;
1060                 bufp += 2;
1061         }
1062
1063         *((__be32 *) bufp) = htonl(session->peer_session_id);
1064         bufp += 4;
1065         if (session->cookie_len) {
1066                 memcpy(bufp, &session->cookie[0], session->cookie_len);
1067                 bufp += session->cookie_len;
1068         }
1069         if (session->l2specific_len) {
1070                 if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
1071                         u32 l2h = 0;
1072                         if (session->send_seq) {
1073                                 l2h = 0x40000000 | session->ns;
1074                                 session->ns++;
1075                                 session->ns &= 0xffffff;
1076                                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
1077                                        "%s: updated ns to %u\n", session->name, session->ns);
1078                         }
1079
1080                         *((__be32 *) bufp) = htonl(l2h);
1081                 }
1082                 bufp += session->l2specific_len;
1083         }
1084         if (session->offset)
1085                 bufp += session->offset;
1086
1087         return bufp - optr;
1088 }
1089
1090 static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
1091                           struct flowi *fl, size_t data_len)
1092 {
1093         struct l2tp_tunnel *tunnel = session->tunnel;
1094         unsigned int len = skb->len;
1095         int error;
1096
1097         /* Debug */
1098         if (session->send_seq)
1099                 PRINTK(session->debug, L2TP_MSG_DATA, KERN_DEBUG,
1100                        "%s: send %Zd bytes, ns=%u\n", session->name,
1101                        data_len, session->ns - 1);
1102         else
1103                 PRINTK(session->debug, L2TP_MSG_DATA, KERN_DEBUG,
1104                        "%s: send %Zd bytes\n", session->name, data_len);
1105
1106         if (session->debug & L2TP_MSG_DATA) {
1107                 int i;
1108                 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1109                 unsigned char *datap = skb->data + uhlen;
1110
1111                 printk(KERN_DEBUG "%s: xmit:", session->name);
1112                 for (i = 0; i < (len - uhlen); i++) {
1113                         printk(" %02X", *datap++);
1114                         if (i == 31) {
1115                                 printk(" ...");
1116                                 break;
1117                         }
1118                 }
1119                 printk("\n");
1120         }
1121
1122         /* Queue the packet to IP for output */
1123         skb->local_df = 1;
1124         error = ip_queue_xmit(skb, fl);
1125
1126         /* Update stats */
1127         if (error >= 0) {
1128                 tunnel->stats.tx_packets++;
1129                 tunnel->stats.tx_bytes += len;
1130                 session->stats.tx_packets++;
1131                 session->stats.tx_bytes += len;
1132         } else {
1133                 tunnel->stats.tx_errors++;
1134                 session->stats.tx_errors++;
1135         }
1136
1137         return 0;
1138 }
1139
1140 /* Automatically called when the skb is freed.
1141  */
1142 static void l2tp_sock_wfree(struct sk_buff *skb)
1143 {
1144         sock_put(skb->sk);
1145 }
1146
1147 /* For data skbs that we transmit, we associate with the tunnel socket
1148  * but don't do accounting.
1149  */
1150 static inline void l2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
1151 {
1152         sock_hold(sk);
1153         skb->sk = sk;
1154         skb->destructor = l2tp_sock_wfree;
1155 }
1156
1157 /* If caller requires the skb to have a ppp header, the header must be
1158  * inserted in the skb data before calling this function.
1159  */
1160 int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len)
1161 {
1162         int data_len = skb->len;
1163         struct l2tp_tunnel *tunnel = session->tunnel;
1164         struct sock *sk = tunnel->sock;
1165         struct flowi *fl;
1166         struct udphdr *uh;
1167         struct inet_sock *inet;
1168         __wsum csum;
1169         int old_headroom;
1170         int new_headroom;
1171         int headroom;
1172         int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1173         int udp_len;
1174
1175         /* Check that there's enough headroom in the skb to insert IP,
1176          * UDP and L2TP headers. If not enough, expand it to
1177          * make room. Adjust truesize.
1178          */
1179         headroom = NET_SKB_PAD + sizeof(struct iphdr) +
1180                 uhlen + hdr_len;
1181         old_headroom = skb_headroom(skb);
1182         if (skb_cow_head(skb, headroom)) {
1183                 dev_kfree_skb(skb);
1184                 goto abort;
1185         }
1186
1187         new_headroom = skb_headroom(skb);
1188         skb_orphan(skb);
1189         skb->truesize += new_headroom - old_headroom;
1190
1191         /* Setup L2TP header */
1192         session->build_header(session, __skb_push(skb, hdr_len));
1193
1194         /* Reset skb netfilter state */
1195         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
1196         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
1197                               IPSKB_REROUTED);
1198         nf_reset(skb);
1199
1200         bh_lock_sock(sk);
1201         if (sock_owned_by_user(sk)) {
1202                 dev_kfree_skb(skb);
1203                 goto out_unlock;
1204         }
1205
1206         /* Get routing info from the tunnel socket */
1207         skb_dst_drop(skb);
1208         skb_dst_set(skb, dst_clone(__sk_dst_check(sk, 0)));
1209
1210         inet = inet_sk(sk);
1211         fl = &inet->cork.fl;
1212         switch (tunnel->encap) {
1213         case L2TP_ENCAPTYPE_UDP:
1214                 /* Setup UDP header */
1215                 __skb_push(skb, sizeof(*uh));
1216                 skb_reset_transport_header(skb);
1217                 uh = udp_hdr(skb);
1218                 uh->source = inet->inet_sport;
1219                 uh->dest = inet->inet_dport;
1220                 udp_len = uhlen + hdr_len + data_len;
1221                 uh->len = htons(udp_len);
1222                 uh->check = 0;
1223
1224                 /* Calculate UDP checksum if configured to do so */
1225                 if (sk->sk_no_check == UDP_CSUM_NOXMIT)
1226                         skb->ip_summed = CHECKSUM_NONE;
1227                 else if ((skb_dst(skb) && skb_dst(skb)->dev) &&
1228                          (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM))) {
1229                         skb->ip_summed = CHECKSUM_COMPLETE;
1230                         csum = skb_checksum(skb, 0, udp_len, 0);
1231                         uh->check = csum_tcpudp_magic(inet->inet_saddr,
1232                                                       inet->inet_daddr,
1233                                                       udp_len, IPPROTO_UDP, csum);
1234                         if (uh->check == 0)
1235                                 uh->check = CSUM_MANGLED_0;
1236                 } else {
1237                         skb->ip_summed = CHECKSUM_PARTIAL;
1238                         skb->csum_start = skb_transport_header(skb) - skb->head;
1239                         skb->csum_offset = offsetof(struct udphdr, check);
1240                         uh->check = ~csum_tcpudp_magic(inet->inet_saddr,
1241                                                        inet->inet_daddr,
1242                                                        udp_len, IPPROTO_UDP, 0);
1243                 }
1244                 break;
1245
1246         case L2TP_ENCAPTYPE_IP:
1247                 break;
1248         }
1249
1250         l2tp_skb_set_owner_w(skb, sk);
1251
1252         l2tp_xmit_core(session, skb, fl, data_len);
1253 out_unlock:
1254         bh_unlock_sock(sk);
1255
1256 abort:
1257         return 0;
1258 }
1259 EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
1260
1261 /*****************************************************************************
1262  * Tinnel and session create/destroy.
1263  *****************************************************************************/
1264
1265 /* Tunnel socket destruct hook.
1266  * The tunnel context is deleted only when all session sockets have been
1267  * closed.
1268  */
1269 static void l2tp_tunnel_destruct(struct sock *sk)
1270 {
1271         struct l2tp_tunnel *tunnel;
1272
1273         tunnel = sk->sk_user_data;
1274         if (tunnel == NULL)
1275                 goto end;
1276
1277         PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
1278                "%s: closing...\n", tunnel->name);
1279
1280         /* Close all sessions */
1281         l2tp_tunnel_closeall(tunnel);
1282
1283         switch (tunnel->encap) {
1284         case L2TP_ENCAPTYPE_UDP:
1285                 /* No longer an encapsulation socket. See net/ipv4/udp.c */
1286                 (udp_sk(sk))->encap_type = 0;
1287                 (udp_sk(sk))->encap_rcv = NULL;
1288                 break;
1289         case L2TP_ENCAPTYPE_IP:
1290                 break;
1291         }
1292
1293         /* Remove hooks into tunnel socket */
1294         tunnel->sock = NULL;
1295         sk->sk_destruct = tunnel->old_sk_destruct;
1296         sk->sk_user_data = NULL;
1297
1298         /* Call the original destructor */
1299         if (sk->sk_destruct)
1300                 (*sk->sk_destruct)(sk);
1301
1302         /* We're finished with the socket */
1303         l2tp_tunnel_dec_refcount(tunnel);
1304
1305 end:
1306         return;
1307 }
1308
1309 /* When the tunnel is closed, all the attached sessions need to go too.
1310  */
1311 static void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
1312 {
1313         int hash;
1314         struct hlist_node *walk;
1315         struct hlist_node *tmp;
1316         struct l2tp_session *session;
1317
1318         BUG_ON(tunnel == NULL);
1319
1320         PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
1321                "%s: closing all sessions...\n", tunnel->name);
1322
1323         write_lock_bh(&tunnel->hlist_lock);
1324         tunnel->acpt_newsess = false;
1325         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
1326 again:
1327                 hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
1328                         session = hlist_entry(walk, struct l2tp_session, hlist);
1329
1330                         PRINTK(session->debug, L2TP_MSG_CONTROL, KERN_INFO,
1331                                "%s: closing session\n", session->name);
1332
1333                         hlist_del_init(&session->hlist);
1334
1335                         /* Since we should hold the sock lock while
1336                          * doing any unbinding, we need to release the
1337                          * lock we're holding before taking that lock.
1338                          * Hold a reference to the sock so it doesn't
1339                          * disappear as we're jumping between locks.
1340                          */
1341                         if (session->ref != NULL)
1342                                 (*session->ref)(session);
1343
1344                         write_unlock_bh(&tunnel->hlist_lock);
1345
1346                         if (tunnel->version != L2TP_HDR_VER_2) {
1347                                 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1348
1349                                 spin_lock_bh(&pn->l2tp_session_hlist_lock);
1350                                 hlist_del_init_rcu(&session->global_hlist);
1351                                 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
1352                                 synchronize_rcu();
1353                         }
1354
1355                         l2tp_session_queue_purge(session);
1356
1357                         if (session->session_close != NULL)
1358                                 (*session->session_close)(session);
1359
1360                         if (session->deref != NULL)
1361                                 (*session->deref)(session);
1362
1363                         write_lock_bh(&tunnel->hlist_lock);
1364
1365                         /* Now restart from the beginning of this hash
1366                          * chain.  We always remove a session from the
1367                          * list so we are guaranteed to make forward
1368                          * progress.
1369                          */
1370                         goto again;
1371                 }
1372         }
1373         write_unlock_bh(&tunnel->hlist_lock);
1374 }
1375
1376 /* Really kill the tunnel.
1377  * Come here only when all sessions have been cleared from the tunnel.
1378  */
1379 void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
1380 {
1381         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1382
1383         BUG_ON(atomic_read(&tunnel->ref_count) != 0);
1384         BUG_ON(tunnel->sock != NULL);
1385
1386         PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
1387                "%s: free...\n", tunnel->name);
1388
1389         /* Remove from tunnel list */
1390         spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1391         list_del_rcu(&tunnel->list);
1392         kfree_rcu(tunnel, rcu);
1393         spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
1394
1395         atomic_dec(&l2tp_tunnel_count);
1396 }
1397 EXPORT_SYMBOL_GPL(l2tp_tunnel_free);
1398
1399 /* Create a socket for the tunnel, if one isn't set up by
1400  * userspace. This is used for static tunnels where there is no
1401  * managing L2TP daemon.
1402  */
1403 static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct socket **sockp)
1404 {
1405         int err = -EINVAL;
1406         struct sockaddr_in udp_addr;
1407         struct sockaddr_l2tpip ip_addr;
1408         struct socket *sock = NULL;
1409
1410         switch (cfg->encap) {
1411         case L2TP_ENCAPTYPE_UDP:
1412                 err = sock_create(AF_INET, SOCK_DGRAM, 0, sockp);
1413                 if (err < 0)
1414                         goto out;
1415
1416                 sock = *sockp;
1417
1418                 memset(&udp_addr, 0, sizeof(udp_addr));
1419                 udp_addr.sin_family = AF_INET;
1420                 udp_addr.sin_addr = cfg->local_ip;
1421                 udp_addr.sin_port = htons(cfg->local_udp_port);
1422                 err = kernel_bind(sock, (struct sockaddr *) &udp_addr, sizeof(udp_addr));
1423                 if (err < 0)
1424                         goto out;
1425
1426                 udp_addr.sin_family = AF_INET;
1427                 udp_addr.sin_addr = cfg->peer_ip;
1428                 udp_addr.sin_port = htons(cfg->peer_udp_port);
1429                 err = kernel_connect(sock, (struct sockaddr *) &udp_addr, sizeof(udp_addr), 0);
1430                 if (err < 0)
1431                         goto out;
1432
1433                 if (!cfg->use_udp_checksums)
1434                         sock->sk->sk_no_check = UDP_CSUM_NOXMIT;
1435
1436                 break;
1437
1438         case L2TP_ENCAPTYPE_IP:
1439                 err = sock_create(AF_INET, SOCK_DGRAM, IPPROTO_L2TP, sockp);
1440                 if (err < 0)
1441                         goto out;
1442
1443                 sock = *sockp;
1444
1445                 memset(&ip_addr, 0, sizeof(ip_addr));
1446                 ip_addr.l2tp_family = AF_INET;
1447                 ip_addr.l2tp_addr = cfg->local_ip;
1448                 ip_addr.l2tp_conn_id = tunnel_id;
1449                 err = kernel_bind(sock, (struct sockaddr *) &ip_addr, sizeof(ip_addr));
1450                 if (err < 0)
1451                         goto out;
1452
1453                 ip_addr.l2tp_family = AF_INET;
1454                 ip_addr.l2tp_addr = cfg->peer_ip;
1455                 ip_addr.l2tp_conn_id = peer_tunnel_id;
1456                 err = kernel_connect(sock, (struct sockaddr *) &ip_addr, sizeof(ip_addr), 0);
1457                 if (err < 0)
1458                         goto out;
1459
1460                 break;
1461
1462         default:
1463                 goto out;
1464         }
1465
1466 out:
1467         if ((err < 0) && sock) {
1468                 sock_release(sock);
1469                 *sockp = NULL;
1470         }
1471
1472         return err;
1473 }
1474
1475 int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp)
1476 {
1477         struct l2tp_tunnel *tunnel = NULL;
1478         int err;
1479         struct socket *sock = NULL;
1480         struct sock *sk = NULL;
1481         struct l2tp_net *pn;
1482         enum l2tp_encap_type encap = L2TP_ENCAPTYPE_UDP;
1483
1484         /* Get the tunnel socket from the fd, which was opened by
1485          * the userspace L2TP daemon. If not specified, create a
1486          * kernel socket.
1487          */
1488         if (fd < 0) {
1489                 err = l2tp_tunnel_sock_create(tunnel_id, peer_tunnel_id, cfg, &sock);
1490                 if (err < 0)
1491                         goto err;
1492         } else {
1493                 err = -EBADF;
1494                 sock = sockfd_lookup(fd, &err);
1495                 if (!sock) {
1496                         printk(KERN_ERR "tunl %hu: sockfd_lookup(fd=%d) returned %d\n",
1497                                tunnel_id, fd, err);
1498                         goto err;
1499                 }
1500         }
1501
1502         sk = sock->sk;
1503
1504         if (cfg != NULL)
1505                 encap = cfg->encap;
1506
1507         /* Quick sanity checks */
1508         switch (encap) {
1509         case L2TP_ENCAPTYPE_UDP:
1510                 err = -EPROTONOSUPPORT;
1511                 if (sk->sk_protocol != IPPROTO_UDP) {
1512                         printk(KERN_ERR "tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
1513                                tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
1514                         goto err;
1515                 }
1516                 break;
1517         case L2TP_ENCAPTYPE_IP:
1518                 err = -EPROTONOSUPPORT;
1519                 if (sk->sk_protocol != IPPROTO_L2TP) {
1520                         printk(KERN_ERR "tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
1521                                tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP);
1522                         goto err;
1523                 }
1524                 break;
1525         }
1526
1527         /* Check if this socket has already been prepped */
1528         tunnel = (struct l2tp_tunnel *)sk->sk_user_data;
1529         if (tunnel != NULL) {
1530                 /* This socket has already been prepped */
1531                 err = -EBUSY;
1532                 goto err;
1533         }
1534
1535         tunnel = kzalloc(sizeof(struct l2tp_tunnel), GFP_KERNEL);
1536         if (tunnel == NULL) {
1537                 err = -ENOMEM;
1538                 goto err;
1539         }
1540
1541         tunnel->version = version;
1542         tunnel->tunnel_id = tunnel_id;
1543         tunnel->peer_tunnel_id = peer_tunnel_id;
1544         tunnel->debug = L2TP_DEFAULT_DEBUG_FLAGS;
1545
1546         tunnel->magic = L2TP_TUNNEL_MAGIC;
1547         sprintf(&tunnel->name[0], "tunl %u", tunnel_id);
1548         rwlock_init(&tunnel->hlist_lock);
1549         tunnel->acpt_newsess = true;
1550
1551         /* The net we belong to */
1552         tunnel->l2tp_net = net;
1553         pn = l2tp_pernet(net);
1554
1555         if (cfg != NULL)
1556                 tunnel->debug = cfg->debug;
1557
1558         /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
1559         tunnel->encap = encap;
1560         if (encap == L2TP_ENCAPTYPE_UDP) {
1561                 /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
1562                 udp_sk(sk)->encap_type = UDP_ENCAP_L2TPINUDP;
1563                 udp_sk(sk)->encap_rcv = l2tp_udp_encap_recv;
1564         }
1565
1566         sk->sk_user_data = tunnel;
1567
1568         /* Hook on the tunnel socket destructor so that we can cleanup
1569          * if the tunnel socket goes away.
1570          */
1571         tunnel->old_sk_destruct = sk->sk_destruct;
1572         sk->sk_destruct = &l2tp_tunnel_destruct;
1573         tunnel->sock = sk;
1574         sk->sk_allocation = GFP_ATOMIC;
1575
1576         /* Add tunnel to our list */
1577         INIT_LIST_HEAD(&tunnel->list);
1578         atomic_inc(&l2tp_tunnel_count);
1579
1580         /* Bump the reference count. The tunnel context is deleted
1581          * only when this drops to zero. Must be done before list insertion
1582          */
1583         l2tp_tunnel_inc_refcount(tunnel);
1584         spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1585         list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
1586         spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
1587
1588         err = 0;
1589 err:
1590         if (tunnelp)
1591                 *tunnelp = tunnel;
1592
1593         /* If tunnel's socket was created by the kernel, it doesn't
1594          *  have a file.
1595          */
1596         if (sock && sock->file)
1597                 sockfd_put(sock);
1598
1599         return err;
1600 }
1601 EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
1602
1603 /* This function is used by the netlink TUNNEL_DELETE command.
1604  */
1605 int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
1606 {
1607         int err = 0;
1608         struct socket *sock = tunnel->sock ? tunnel->sock->sk_socket : NULL;
1609
1610         /* Force the tunnel socket to close. This will eventually
1611          * cause the tunnel to be deleted via the normal socket close
1612          * mechanisms when userspace closes the tunnel socket.
1613          */
1614         if (sock != NULL) {
1615                 err = inet_shutdown(sock, 2);
1616
1617                 /* If the tunnel's socket was created by the kernel,
1618                  * close the socket here since the socket was not
1619                  * created by userspace.
1620                  */
1621                 if (sock->file == NULL)
1622                         err = inet_release(sock);
1623         }
1624
1625         return err;
1626 }
1627 EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
1628
1629 /* Really kill the session.
1630  */
1631 void l2tp_session_free(struct l2tp_session *session)
1632 {
1633         struct l2tp_tunnel *tunnel;
1634
1635         BUG_ON(atomic_read(&session->ref_count) != 0);
1636
1637         tunnel = session->tunnel;
1638         if (tunnel != NULL) {
1639                 BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
1640
1641                 /* Delete the session from the hash */
1642                 write_lock_bh(&tunnel->hlist_lock);
1643                 hlist_del_init(&session->hlist);
1644                 write_unlock_bh(&tunnel->hlist_lock);
1645
1646                 /* Unlink from the global hash if not L2TPv2 */
1647                 if (tunnel->version != L2TP_HDR_VER_2) {
1648                         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1649
1650                         spin_lock_bh(&pn->l2tp_session_hlist_lock);
1651                         hlist_del_init_rcu(&session->global_hlist);
1652                         spin_unlock_bh(&pn->l2tp_session_hlist_lock);
1653                         synchronize_rcu();
1654                 }
1655
1656                 if (session->session_id != 0)
1657                         atomic_dec(&l2tp_session_count);
1658
1659                 sock_put(tunnel->sock);
1660
1661                 /* This will delete the tunnel context if this
1662                  * is the last session on the tunnel.
1663                  */
1664                 session->tunnel = NULL;
1665                 l2tp_tunnel_dec_refcount(tunnel);
1666         }
1667
1668         kfree(session);
1669
1670         return;
1671 }
1672 EXPORT_SYMBOL_GPL(l2tp_session_free);
1673
1674 /* This function is used by the netlink SESSION_DELETE command and by
1675    pseudowire modules.
1676  */
1677 int l2tp_session_delete(struct l2tp_session *session)
1678 {
1679         l2tp_session_queue_purge(session);
1680
1681         if (session->session_close != NULL)
1682                 (*session->session_close)(session);
1683
1684         l2tp_session_dec_refcount(session);
1685
1686         return 0;
1687 }
1688 EXPORT_SYMBOL_GPL(l2tp_session_delete);
1689
1690
1691 /* We come here whenever a session's send_seq, cookie_len or
1692  * l2specific_len parameters are set.
1693  */
1694 static void l2tp_session_set_header_len(struct l2tp_session *session, int version)
1695 {
1696         if (version == L2TP_HDR_VER_2) {
1697                 session->hdr_len = 6;
1698                 if (session->send_seq)
1699                         session->hdr_len += 4;
1700         } else {
1701                 session->hdr_len = 4 + session->cookie_len + session->l2specific_len + session->offset;
1702                 if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)
1703                         session->hdr_len += 4;
1704         }
1705
1706 }
1707
1708 struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
1709 {
1710         struct l2tp_session *session;
1711
1712         session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL);
1713         if (session != NULL) {
1714                 session->magic = L2TP_SESSION_MAGIC;
1715                 session->tunnel = tunnel;
1716
1717                 session->session_id = session_id;
1718                 session->peer_session_id = peer_session_id;
1719                 session->nr = 1;
1720
1721                 sprintf(&session->name[0], "sess %u/%u",
1722                         tunnel->tunnel_id, session->session_id);
1723
1724                 skb_queue_head_init(&session->reorder_q);
1725
1726                 INIT_HLIST_NODE(&session->hlist);
1727                 INIT_HLIST_NODE(&session->global_hlist);
1728
1729                 /* Inherit debug options from tunnel */
1730                 session->debug = tunnel->debug;
1731
1732                 if (cfg) {
1733                         session->pwtype = cfg->pw_type;
1734                         session->debug = cfg->debug;
1735                         session->mtu = cfg->mtu;
1736                         session->mru = cfg->mru;
1737                         session->send_seq = cfg->send_seq;
1738                         session->recv_seq = cfg->recv_seq;
1739                         session->lns_mode = cfg->lns_mode;
1740                         session->reorder_timeout = cfg->reorder_timeout;
1741                         session->offset = cfg->offset;
1742                         session->l2specific_type = cfg->l2specific_type;
1743                         session->l2specific_len = cfg->l2specific_len;
1744                         session->cookie_len = cfg->cookie_len;
1745                         memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);
1746                         session->peer_cookie_len = cfg->peer_cookie_len;
1747                         memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);
1748                 }
1749
1750                 if (tunnel->version == L2TP_HDR_VER_2)
1751                         session->build_header = l2tp_build_l2tpv2_header;
1752                 else
1753                         session->build_header = l2tp_build_l2tpv3_header;
1754
1755                 l2tp_session_set_header_len(session, tunnel->version);
1756
1757                 l2tp_session_inc_refcount(session);
1758
1759                 return session;
1760         }
1761
1762         return ERR_PTR(-ENOMEM);
1763 }
1764 EXPORT_SYMBOL_GPL(l2tp_session_create);
1765
1766 /*****************************************************************************
1767  * Init and cleanup
1768  *****************************************************************************/
1769
1770 static __net_init int l2tp_init_net(struct net *net)
1771 {
1772         struct l2tp_net *pn = net_generic(net, l2tp_net_id);
1773         int hash;
1774
1775         INIT_LIST_HEAD(&pn->l2tp_tunnel_list);
1776         spin_lock_init(&pn->l2tp_tunnel_list_lock);
1777
1778         for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
1779                 INIT_HLIST_HEAD(&pn->l2tp_session_hlist[hash]);
1780
1781         spin_lock_init(&pn->l2tp_session_hlist_lock);
1782
1783         return 0;
1784 }
1785
1786 static struct pernet_operations l2tp_net_ops = {
1787         .init = l2tp_init_net,
1788         .id   = &l2tp_net_id,
1789         .size = sizeof(struct l2tp_net),
1790 };
1791
1792 static int __init l2tp_init(void)
1793 {
1794         int rc = 0;
1795
1796         rc = register_pernet_device(&l2tp_net_ops);
1797         if (rc)
1798                 goto out;
1799
1800         printk(KERN_INFO "L2TP core driver, %s\n", L2TP_DRV_VERSION);
1801
1802 out:
1803         return rc;
1804 }
1805
1806 static void __exit l2tp_exit(void)
1807 {
1808         unregister_pernet_device(&l2tp_net_ops);
1809 }
1810
1811 module_init(l2tp_init);
1812 module_exit(l2tp_exit);
1813
1814 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1815 MODULE_DESCRIPTION("L2TP core");
1816 MODULE_LICENSE("GPL");
1817 MODULE_VERSION(L2TP_DRV_VERSION);
1818