Doug / smarc-fsl-linux-kernel

1

/*****************************************************************************

1

/*****************************************************************************

2

* Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets

2

* Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets

3

*

3

*

4

* PPPoX --- Generic PPP encapsulation socket family

4

* PPPoX --- Generic PPP encapsulation socket family

5

* PPPoL2TP --- PPP over L2TP (RFC 2661)

5

* PPPoL2TP --- PPP over L2TP (RFC 2661)

6

*

6

*

7

* Version: 1.0.0

7

* Version: 1.0.0

8

*

8

*

9

* Authors: Martijn van Oosterhout <kleptog@svana.org>

9

* Authors: Martijn van Oosterhout <kleptog@svana.org>

10

* James Chapman (jchapman@katalix.com)

10

* James Chapman (jchapman@katalix.com)

11

* Contributors:

11

* Contributors:

12

* Michal Ostrowski <mostrows@speakeasy.net>

12

* Michal Ostrowski <mostrows@speakeasy.net>

13

* Arnaldo Carvalho de Melo <acme@xconectiva.com.br>

13

* Arnaldo Carvalho de Melo <acme@xconectiva.com.br>

14

* David S. Miller (davem@redhat.com)

14

* David S. Miller (davem@redhat.com)

15

*

15

*

16

* License:

16

* License:

17

* This program is free software; you can redistribute it and/or

17

* This program is free software; you can redistribute it and/or

18

* modify it under the terms of the GNU General Public License

18

* modify it under the terms of the GNU General Public License

19

* as published by the Free Software Foundation; either version

19

* as published by the Free Software Foundation; either version

20

* 2 of the License, or (at your option) any later version.

20

* 2 of the License, or (at your option) any later version.

21

*

21

*

22

*/

22

*/

23

24

/* This driver handles only L2TP data frames; control frames are handled by a

24

/* This driver handles only L2TP data frames; control frames are handled by a

25

* userspace application.

25

* userspace application.

26

*

26

*

27

* To send data in an L2TP session, userspace opens a PPPoL2TP socket and

27

* To send data in an L2TP session, userspace opens a PPPoL2TP socket and

28

* attaches it to a bound UDP socket with local tunnel_id / session_id and

28

* attaches it to a bound UDP socket with local tunnel_id / session_id and

29

* peer tunnel_id / session_id set. Data can then be sent or received using

29

* peer tunnel_id / session_id set. Data can then be sent or received using

30

* regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket

30

* regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket

31

* can be read or modified using ioctl() or [gs]etsockopt() calls.

31

* can be read or modified using ioctl() or [gs]etsockopt() calls.

32

*

32

*

33

* When a PPPoL2TP socket is connected with local and peer session_id values

33

* When a PPPoL2TP socket is connected with local and peer session_id values

34

* zero, the socket is treated as a special tunnel management socket.

34

* zero, the socket is treated as a special tunnel management socket.

35

*

35

*

36

* Here's example userspace code to create a socket for sending/receiving data

36

* Here's example userspace code to create a socket for sending/receiving data

37

* over an L2TP session:-

37

* over an L2TP session:-

38

*

38

*

39

* struct sockaddr_pppol2tp sax;

39

* struct sockaddr_pppol2tp sax;

40

* int fd;

40

* int fd;

41

* int session_fd;

41

* int session_fd;

42

*

42

*

43

* fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);

43

* fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);

44

*

44

*

45

* sax.sa_family = AF_PPPOX;

45

* sax.sa_family = AF_PPPOX;

46

* sax.sa_protocol = PX_PROTO_OL2TP;

46

* sax.sa_protocol = PX_PROTO_OL2TP;

47

* sax.pppol2tp.fd = tunnel_fd; // bound UDP socket

47

* sax.pppol2tp.fd = tunnel_fd; // bound UDP socket

48

* sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr;

48

* sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr;

49

* sax.pppol2tp.addr.sin_port = addr->sin_port;

49

* sax.pppol2tp.addr.sin_port = addr->sin_port;

50

* sax.pppol2tp.addr.sin_family = AF_INET;

50

* sax.pppol2tp.addr.sin_family = AF_INET;

51

* sax.pppol2tp.s_tunnel = tunnel_id;

51

* sax.pppol2tp.s_tunnel = tunnel_id;

52

* sax.pppol2tp.s_session = session_id;

52

* sax.pppol2tp.s_session = session_id;

53

* sax.pppol2tp.d_tunnel = peer_tunnel_id;

53

* sax.pppol2tp.d_tunnel = peer_tunnel_id;

54

* sax.pppol2tp.d_session = peer_session_id;

54

* sax.pppol2tp.d_session = peer_session_id;

55

*

55

*

56

* session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax));

56

* session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax));

57

*

57

*

58

* A pppd plugin that allows PPP traffic to be carried over L2TP using

58

* A pppd plugin that allows PPP traffic to be carried over L2TP using

59

* this driver is available from the OpenL2TP project at

59

* this driver is available from the OpenL2TP project at

60

* http://openl2tp.sourceforge.net.

60

* http://openl2tp.sourceforge.net.

61

*/

61

*/

62

63

#include <linux/module.h>

63

#include <linux/module.h>

64

#include <linux/string.h>

64

#include <linux/string.h>

65

#include <linux/list.h>

65

#include <linux/list.h>

66

#include <asm/uaccess.h>

66

#include <asm/uaccess.h>

67

68

#include <linux/kernel.h>

68

#include <linux/kernel.h>

69

#include <linux/spinlock.h>

69

#include <linux/spinlock.h>

70

#include <linux/kthread.h>

70

#include <linux/kthread.h>

71

#include <linux/sched.h>

71

#include <linux/sched.h>

72

#include <linux/slab.h>

72

#include <linux/slab.h>

73

#include <linux/errno.h>

73

#include <linux/errno.h>

74

#include <linux/jiffies.h>

74

#include <linux/jiffies.h>

75

76

#include <linux/netdevice.h>

76

#include <linux/netdevice.h>

77

#include <linux/net.h>

77

#include <linux/net.h>

78

#include <linux/inetdevice.h>

78

#include <linux/inetdevice.h>

79

#include <linux/skbuff.h>

79

#include <linux/skbuff.h>

80

#include <linux/init.h>

80

#include <linux/init.h>

81

#include <linux/ip.h>

81

#include <linux/ip.h>

82

#include <linux/udp.h>

82

#include <linux/udp.h>

83

#include <linux/if_pppox.h>

83

#include <linux/if_pppox.h>

84

#include <linux/if_pppol2tp.h>

84

#include <linux/if_pppol2tp.h>

85

#include <net/sock.h>

85

#include <net/sock.h>

86

#include <linux/ppp_channel.h>

86

#include <linux/ppp_channel.h>

87

#include <linux/ppp_defs.h>

87

#include <linux/ppp_defs.h>

88

#include <linux/if_ppp.h>

88

#include <linux/if_ppp.h>

89

#include <linux/file.h>

89

#include <linux/file.h>

90

#include <linux/hash.h>

90

#include <linux/hash.h>

91

#include <linux/sort.h>

91

#include <linux/sort.h>

92

#include <linux/proc_fs.h>

92

#include <linux/proc_fs.h>

93

#include <linux/nsproxy.h>

93

#include <linux/nsproxy.h>

94

#include <net/net_namespace.h>

94

#include <net/net_namespace.h>

95

#include <net/netns/generic.h>

95

#include <net/netns/generic.h>

96

#include <net/dst.h>

96

#include <net/dst.h>

97

#include <net/ip.h>

97

#include <net/ip.h>

98

#include <net/udp.h>

98

#include <net/udp.h>

99

#include <net/xfrm.h>

99

#include <net/xfrm.h>

100

101

#include <asm/byteorder.h>

101

#include <asm/byteorder.h>

102

#include <asm/atomic.h>

102

#include <asm/atomic.h>

103

104

105

#define PPPOL2TP_DRV_VERSION "V1.0"

105

#define PPPOL2TP_DRV_VERSION "V1.0"

106

107

/* L2TP header constants */

107

/* L2TP header constants */

108

#define L2TP_HDRFLAG_T 0x8000

108

#define L2TP_HDRFLAG_T 0x8000

109

#define L2TP_HDRFLAG_L 0x4000

109

#define L2TP_HDRFLAG_L 0x4000

110

#define L2TP_HDRFLAG_S 0x0800

110

#define L2TP_HDRFLAG_S 0x0800

111

#define L2TP_HDRFLAG_O 0x0200

111

#define L2TP_HDRFLAG_O 0x0200

112

#define L2TP_HDRFLAG_P 0x0100

112

#define L2TP_HDRFLAG_P 0x0100

113

114

#define L2TP_HDR_VER_MASK 0x000F

114

#define L2TP_HDR_VER_MASK 0x000F

115

#define L2TP_HDR_VER 0x0002

115

#define L2TP_HDR_VER 0x0002

116

117

/* Space for UDP, L2TP and PPP headers */

117

/* Space for UDP, L2TP and PPP headers */

118

#define PPPOL2TP_HEADER_OVERHEAD 40

118

#define PPPOL2TP_HEADER_OVERHEAD 40

119

120

/* Just some random numbers */

120

/* Just some random numbers */

121

#define L2TP_TUNNEL_MAGIC 0x42114DDA

121

#define L2TP_TUNNEL_MAGIC 0x42114DDA

122

#define L2TP_SESSION_MAGIC 0x0C04EB7D

122

#define L2TP_SESSION_MAGIC 0x0C04EB7D

123

124

#define PPPOL2TP_HASH_BITS 4

124

#define PPPOL2TP_HASH_BITS 4

125

#define PPPOL2TP_HASH_SIZE (1 << PPPOL2TP_HASH_BITS)

125

#define PPPOL2TP_HASH_SIZE (1 << PPPOL2TP_HASH_BITS)

126

127

/* Default trace flags */

127

/* Default trace flags */

128

#define PPPOL2TP_DEFAULT_DEBUG_FLAGS 0

128

#define PPPOL2TP_DEFAULT_DEBUG_FLAGS 0

129

130

#define PRINTK(_mask, _type, _lvl, _fmt, args...) \

130

#define PRINTK(_mask, _type, _lvl, _fmt, args...) \

131

do { \

131

do { \

132

if ((_mask) & (_type)) \

132

if ((_mask) & (_type)) \

133

printk(_lvl "PPPOL2TP: " _fmt, ##args); \

133

printk(_lvl "PPPOL2TP: " _fmt, ##args); \

134

} while(0)

134

} while(0)

135

136

/* Number of bytes to build transmit L2TP headers.

136

/* Number of bytes to build transmit L2TP headers.

137

* Unfortunately the size is different depending on whether sequence numbers

137

* Unfortunately the size is different depending on whether sequence numbers

138

* are enabled.

138

* are enabled.

139

*/

139

*/

140

#define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10

140

#define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10

141

#define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6

141

#define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6

142

143

struct pppol2tp_tunnel;

143

struct pppol2tp_tunnel;

144

145

/* Describes a session. It is the sk_user_data field in the PPPoL2TP

145

/* Describes a session. It is the sk_user_data field in the PPPoL2TP

146

* socket. Contains information to determine incoming packets and transmit

146

* socket. Contains information to determine incoming packets and transmit

147

* outgoing ones.

147

* outgoing ones.

148

*/

148

*/

149

struct pppol2tp_session

149

struct pppol2tp_session

150

{

150

{

151

int magic; /* should be

151

int magic; /* should be

152

* L2TP_SESSION_MAGIC */

152

* L2TP_SESSION_MAGIC */

153

int owner; /* pid that opened the socket */

153

int owner; /* pid that opened the socket */

154

155

struct sock *sock; /* Pointer to the session

155

struct sock *sock; /* Pointer to the session

156

* PPPoX socket */

156

* PPPoX socket */

157

struct sock *tunnel_sock; /* Pointer to the tunnel UDP

157

struct sock *tunnel_sock; /* Pointer to the tunnel UDP

158

* socket */

158

* socket */

159

160

struct pppol2tp_addr tunnel_addr; /* Description of tunnel */

160

struct pppol2tp_addr tunnel_addr; /* Description of tunnel */

161

162

struct pppol2tp_tunnel *tunnel; /* back pointer to tunnel

162

struct pppol2tp_tunnel *tunnel; /* back pointer to tunnel

163

* context */

163

* context */

164

165

char name[20]; /* "sess xxxxx/yyyyy", where

165

char name[20]; /* "sess xxxxx/yyyyy", where

166

* x=tunnel_id, y=session_id */

166

* x=tunnel_id, y=session_id */

167

int mtu;

167

int mtu;

168

int mru;

168

int mru;

169

int flags; /* accessed by PPPIOCGFLAGS.

169

int flags; /* accessed by PPPIOCGFLAGS.

170

* Unused. */

170

* Unused. */

171

unsigned recv_seq:1; /* expect receive packets with

171

unsigned recv_seq:1; /* expect receive packets with

172

* sequence numbers? */

172

* sequence numbers? */

173

unsigned send_seq:1; /* send packets with sequence

173

unsigned send_seq:1; /* send packets with sequence

174

* numbers? */

174

* numbers? */

175

unsigned lns_mode:1; /* behave as LNS? LAC enables

175

unsigned lns_mode:1; /* behave as LNS? LAC enables

176

* sequence numbers under

176

* sequence numbers under

177

* control of LNS. */

177

* control of LNS. */

178

int debug; /* bitmask of debug message

178

int debug; /* bitmask of debug message

179

* categories */

179

* categories */

180

int reorder_timeout; /* configured reorder timeout

180

int reorder_timeout; /* configured reorder timeout

181

* (in jiffies) */

181

* (in jiffies) */

182

u16 nr; /* session NR state (receive) */

182

u16 nr; /* session NR state (receive) */

183

u16 ns; /* session NR state (send) */

183

u16 ns; /* session NR state (send) */

184

struct sk_buff_head reorder_q; /* receive reorder queue */

184

struct sk_buff_head reorder_q; /* receive reorder queue */

185

struct pppol2tp_ioc_stats stats;

185

struct pppol2tp_ioc_stats stats;

186

struct hlist_node hlist; /* Hash list node */

186

struct hlist_node hlist; /* Hash list node */

187

};

187

};

188

189

/* The sk_user_data field of the tunnel's UDP socket. It contains info to track

189

/* The sk_user_data field of the tunnel's UDP socket. It contains info to track

190

* all the associated sessions so incoming packets can be sorted out

190

* all the associated sessions so incoming packets can be sorted out

191

*/

191

*/

192

struct pppol2tp_tunnel

192

struct pppol2tp_tunnel

193

{

193

{

194

int magic; /* Should be L2TP_TUNNEL_MAGIC */

194

int magic; /* Should be L2TP_TUNNEL_MAGIC */

195

rwlock_t hlist_lock; /* protect session_hlist */

195

rwlock_t hlist_lock; /* protect session_hlist */

196

struct hlist_head session_hlist[PPPOL2TP_HASH_SIZE];

196

struct hlist_head session_hlist[PPPOL2TP_HASH_SIZE];

197

/* hashed list of sessions,

197

/* hashed list of sessions,

198

* hashed by id */

198

* hashed by id */

199

int debug; /* bitmask of debug message

199

int debug; /* bitmask of debug message

200

* categories */

200

* categories */

201

char name[12]; /* "tunl xxxxx" */

201

char name[12]; /* "tunl xxxxx" */

202

struct pppol2tp_ioc_stats stats;

202

struct pppol2tp_ioc_stats stats;

203

204

void (*old_sk_destruct)(struct sock *);

204

void (*old_sk_destruct)(struct sock *);

205

206

struct sock *sock; /* Parent socket */

206

struct sock *sock; /* Parent socket */

207

struct list_head list; /* Keep a list of all open

207

struct list_head list; /* Keep a list of all open

208

* prepared sockets */

208

* prepared sockets */

209

struct net *pppol2tp_net; /* the net we belong to */

209

struct net *pppol2tp_net; /* the net we belong to */

210

211

atomic_t ref_count;

211

atomic_t ref_count;

212

};

212

};

213

214

/* Private data stored for received packets in the skb.

214

/* Private data stored for received packets in the skb.

215

*/

215

*/

216

struct pppol2tp_skb_cb {

216

struct pppol2tp_skb_cb {

217

u16 ns;

217

u16 ns;

218

u16 nr;

218

u16 nr;

219

u16 has_seq;

219

u16 has_seq;

220

u16 length;

220

u16 length;

221

unsigned long expires;

221

unsigned long expires;

222

};

222

};

223

224

#define PPPOL2TP_SKB_CB(skb) ((struct pppol2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])

224

#define PPPOL2TP_SKB_CB(skb) ((struct pppol2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])

225

226

static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);

226

static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);

227

static void pppol2tp_tunnel_free(struct pppol2tp_tunnel *tunnel);

227

static void pppol2tp_tunnel_free(struct pppol2tp_tunnel *tunnel);

228

229

static atomic_t pppol2tp_tunnel_count;

229

static atomic_t pppol2tp_tunnel_count;

230

static atomic_t pppol2tp_session_count;

230

static atomic_t pppol2tp_session_count;

231

static struct ppp_channel_ops pppol2tp_chan_ops = { pppol2tp_xmit , NULL };

231

static struct ppp_channel_ops pppol2tp_chan_ops = { pppol2tp_xmit , NULL };

232

static const struct proto_ops pppol2tp_ops;

232

static const struct proto_ops pppol2tp_ops;

233

234

/* per-net private data for this module */

234

/* per-net private data for this module */

235

static int pppol2tp_net_id __read_mostly;

235

static int pppol2tp_net_id __read_mostly;

236

struct pppol2tp_net {

236

struct pppol2tp_net {

237

struct list_head pppol2tp_tunnel_list;

237

struct list_head pppol2tp_tunnel_list;

238

rwlock_t pppol2tp_tunnel_list_lock;

238

rwlock_t pppol2tp_tunnel_list_lock;

239

};

239

};

240

241

static inline struct pppol2tp_net *pppol2tp_pernet(struct net *net)

241

static inline struct pppol2tp_net *pppol2tp_pernet(struct net *net)

242

{

242

{

243

BUG_ON(!net);

243

BUG_ON(!net);

244

245

return net_generic(net, pppol2tp_net_id);

245

return net_generic(net, pppol2tp_net_id);

246

}

246

}

247

248

/* Helpers to obtain tunnel/session contexts from sockets.

248

/* Helpers to obtain tunnel/session contexts from sockets.

249

*/

249

*/

250

static inline struct pppol2tp_session *pppol2tp_sock_to_session(struct sock *sk)

250

static inline struct pppol2tp_session *pppol2tp_sock_to_session(struct sock *sk)

251

{

251

{

252

struct pppol2tp_session *session;

252

struct pppol2tp_session *session;

253

254

if (sk == NULL)

254

if (sk == NULL)

255

return NULL;

255

return NULL;

256

257

sock_hold(sk);

257

sock_hold(sk);

258

session = (struct pppol2tp_session *)(sk->sk_user_data);

258

session = (struct pppol2tp_session *)(sk->sk_user_data);

259

if (session == NULL) {

259

if (session == NULL) {

260

sock_put(sk);

260

sock_put(sk);

261

goto out;

261

goto out;

262

}

262

}

263

264

BUG_ON(session->magic != L2TP_SESSION_MAGIC);

264

BUG_ON(session->magic != L2TP_SESSION_MAGIC);

265

out:

265

out:

266

return session;

266

return session;

267

}

267

}

268

269

static inline struct pppol2tp_tunnel *pppol2tp_sock_to_tunnel(struct sock *sk)

269

static inline struct pppol2tp_tunnel *pppol2tp_sock_to_tunnel(struct sock *sk)

270

{

270

{

271

struct pppol2tp_tunnel *tunnel;

271

struct pppol2tp_tunnel *tunnel;

272

273

if (sk == NULL)

273

if (sk == NULL)

274

return NULL;

274

return NULL;

275

276

sock_hold(sk);

276

sock_hold(sk);

277

tunnel = (struct pppol2tp_tunnel *)(sk->sk_user_data);

277

tunnel = (struct pppol2tp_tunnel *)(sk->sk_user_data);

278

if (tunnel == NULL) {

278

if (tunnel == NULL) {

279

sock_put(sk);

279

sock_put(sk);

280

goto out;

280

goto out;

281

}

281

}

282

283

BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);

283

BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);

284

out:

284

out:

285

return tunnel;

285

return tunnel;

286

}

286

}

287

288

/* Tunnel reference counts. Incremented per session that is added to

288

/* Tunnel reference counts. Incremented per session that is added to

289

* the tunnel.

289

* the tunnel.

290

*/

290

*/

291

static inline void pppol2tp_tunnel_inc_refcount(struct pppol2tp_tunnel *tunnel)

291

static inline void pppol2tp_tunnel_inc_refcount(struct pppol2tp_tunnel *tunnel)

292

{

292

{

293

atomic_inc(&tunnel->ref_count);

293

atomic_inc(&tunnel->ref_count);

294

}

294

}

295

296

static inline void pppol2tp_tunnel_dec_refcount(struct pppol2tp_tunnel *tunnel)

296

static inline void pppol2tp_tunnel_dec_refcount(struct pppol2tp_tunnel *tunnel)

297

{

297

{

298

if (atomic_dec_and_test(&tunnel->ref_count))

298

if (atomic_dec_and_test(&tunnel->ref_count))

299

pppol2tp_tunnel_free(tunnel);

299

pppol2tp_tunnel_free(tunnel);

300

}

300

}

301

302

/* Session hash list.

302

/* Session hash list.

303

* The session_id SHOULD be random according to RFC2661, but several

303

* The session_id SHOULD be random according to RFC2661, but several

304

* L2TP implementations (Cisco and Microsoft) use incrementing

304

* L2TP implementations (Cisco and Microsoft) use incrementing

305

* session_ids. So we do a real hash on the session_id, rather than a

305

* session_ids. So we do a real hash on the session_id, rather than a

306

* simple bitmask.

306

* simple bitmask.

307

*/

307

*/

308

static inline struct hlist_head *

308

static inline struct hlist_head *

309

pppol2tp_session_id_hash(struct pppol2tp_tunnel *tunnel, u16 session_id)

309

pppol2tp_session_id_hash(struct pppol2tp_tunnel *tunnel, u16 session_id)

310

{

310

{

311

unsigned long hash_val = (unsigned long) session_id;

311

unsigned long hash_val = (unsigned long) session_id;

312

return &tunnel->session_hlist[hash_long(hash_val, PPPOL2TP_HASH_BITS)];

312

return &tunnel->session_hlist[hash_long(hash_val, PPPOL2TP_HASH_BITS)];

313

}

313

}

314

315

/* Lookup a session by id

315

/* Lookup a session by id

316

*/

316

*/

317

static struct pppol2tp_session *

317

static struct pppol2tp_session *

318

pppol2tp_session_find(struct pppol2tp_tunnel *tunnel, u16 session_id)

318

pppol2tp_session_find(struct pppol2tp_tunnel *tunnel, u16 session_id)

319

{

319

{

320

struct hlist_head *session_list =

320

struct hlist_head *session_list =

321

pppol2tp_session_id_hash(tunnel, session_id);

321

pppol2tp_session_id_hash(tunnel, session_id);

322

struct pppol2tp_session *session;

322

struct pppol2tp_session *session;

323

struct hlist_node *walk;

323

struct hlist_node *walk;

324

325

read_lock_bh(&tunnel->hlist_lock);

325

read_lock_bh(&tunnel->hlist_lock);

326

hlist_for_each_entry(session, walk, session_list, hlist) {

326

hlist_for_each_entry(session, walk, session_list, hlist) {

327

if (session->tunnel_addr.s_session == session_id) {

327

if (session->tunnel_addr.s_session == session_id) {

328

read_unlock_bh(&tunnel->hlist_lock);

328

read_unlock_bh(&tunnel->hlist_lock);

329

return session;

329

return session;

330

}

330

}

331

}

331

}

332

read_unlock_bh(&tunnel->hlist_lock);

332

read_unlock_bh(&tunnel->hlist_lock);

333

334

return NULL;

334

return NULL;

335

}

335

}

336

337

/* Lookup a tunnel by id

337

/* Lookup a tunnel by id

338

*/

338

*/

339

static struct pppol2tp_tunnel *pppol2tp_tunnel_find(struct net *net, u16 tunnel_id)

339

static struct pppol2tp_tunnel *pppol2tp_tunnel_find(struct net *net, u16 tunnel_id)

340

{

340

{

341

struct pppol2tp_tunnel *tunnel;

341

struct pppol2tp_tunnel *tunnel;

342

struct pppol2tp_net *pn = pppol2tp_pernet(net);

342

struct pppol2tp_net *pn = pppol2tp_pernet(net);

343

344

read_lock_bh(&pn->pppol2tp_tunnel_list_lock);

344

read_lock_bh(&pn->pppol2tp_tunnel_list_lock);

345

list_for_each_entry(tunnel, &pn->pppol2tp_tunnel_list, list) {

345

list_for_each_entry(tunnel, &pn->pppol2tp_tunnel_list, list) {

346

if (tunnel->stats.tunnel_id == tunnel_id) {

346

if (tunnel->stats.tunnel_id == tunnel_id) {

347

read_unlock_bh(&pn->pppol2tp_tunnel_list_lock);

347

read_unlock_bh(&pn->pppol2tp_tunnel_list_lock);

348

return tunnel;

348

return tunnel;

349

}

349

}

350

}

350

}

351

read_unlock_bh(&pn->pppol2tp_tunnel_list_lock);

351

read_unlock_bh(&pn->pppol2tp_tunnel_list_lock);

352

353

return NULL;

353

return NULL;

354

}

354

}

355

356

/*****************************************************************************

356

/*****************************************************************************

357

* Receive data handling

357

* Receive data handling

358

*****************************************************************************/

358

*****************************************************************************/

359

360

/* Queue a skb in order. We come here only if the skb has an L2TP sequence

360

/* Queue a skb in order. We come here only if the skb has an L2TP sequence

361

* number.

361

* number.

362

*/

362

*/

363

static void pppol2tp_recv_queue_skb(struct pppol2tp_session *session, struct sk_buff *skb)

363

static void pppol2tp_recv_queue_skb(struct pppol2tp_session *session, struct sk_buff *skb)

364

{

364

{

365

struct sk_buff *skbp;

365

struct sk_buff *skbp;

366

struct sk_buff *tmp;

366

struct sk_buff *tmp;

367

u16 ns = PPPOL2TP_SKB_CB(skb)->ns;

367

u16 ns = PPPOL2TP_SKB_CB(skb)->ns;

368

369

spin_lock_bh(&session->reorder_q.lock);

369

spin_lock_bh(&session->reorder_q.lock);

370

skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {

370

skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {

371

if (PPPOL2TP_SKB_CB(skbp)->ns > ns) {

371

if (PPPOL2TP_SKB_CB(skbp)->ns > ns) {

372

__skb_queue_before(&session->reorder_q, skbp, skb);

372

__skb_queue_before(&session->reorder_q, skbp, skb);

373

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,

373

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,

374

"%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",

374

"%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",

375

session->name, ns, PPPOL2TP_SKB_CB(skbp)->ns,

375

session->name, ns, PPPOL2TP_SKB_CB(skbp)->ns,

376

skb_queue_len(&session->reorder_q));

376

skb_queue_len(&session->reorder_q));

377

session->stats.rx_oos_packets++;

377

session->stats.rx_oos_packets++;

378

goto out;

378

goto out;

379

}

379

}

380

}

380

}

381

382

__skb_queue_tail(&session->reorder_q, skb);

382

__skb_queue_tail(&session->reorder_q, skb);

383

384

out:

384

out:

385

spin_unlock_bh(&session->reorder_q.lock);

385

spin_unlock_bh(&session->reorder_q.lock);

386

}

386

}

387

388

/* Dequeue a single skb.

388

/* Dequeue a single skb.

389

*/

389

*/

390

static void pppol2tp_recv_dequeue_skb(struct pppol2tp_session *session, struct sk_buff *skb)

390

static void pppol2tp_recv_dequeue_skb(struct pppol2tp_session *session, struct sk_buff *skb)

391

{

391

{

392

struct pppol2tp_tunnel *tunnel = session->tunnel;

392

struct pppol2tp_tunnel *tunnel = session->tunnel;

393

int length = PPPOL2TP_SKB_CB(skb)->length;

393

int length = PPPOL2TP_SKB_CB(skb)->length;

394

struct sock *session_sock = NULL;

394

struct sock *session_sock = NULL;

395

396

/* We're about to requeue the skb, so return resources

396

/* We're about to requeue the skb, so return resources

397

* to its current owner (a socket receive buffer).

397

* to its current owner (a socket receive buffer).

398

*/

398

*/

399

skb_orphan(skb);

399

skb_orphan(skb);

400

401

tunnel->stats.rx_packets++;

401

tunnel->stats.rx_packets++;

402

tunnel->stats.rx_bytes += length;

402

tunnel->stats.rx_bytes += length;

403

session->stats.rx_packets++;

403

session->stats.rx_packets++;

404

session->stats.rx_bytes += length;

404

session->stats.rx_bytes += length;

405

406

if (PPPOL2TP_SKB_CB(skb)->has_seq) {

406

if (PPPOL2TP_SKB_CB(skb)->has_seq) {

407

/* Bump our Nr */

407

/* Bump our Nr */

408

session->nr++;

408

session->nr++;

409

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,

409

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,

410

"%s: updated nr to %hu\n", session->name, session->nr);

410

"%s: updated nr to %hu\n", session->name, session->nr);

411

}

411

}

412

413

/* If the socket is bound, send it in to PPP's input queue. Otherwise

413

/* If the socket is bound, send it in to PPP's input queue. Otherwise

414

* queue it on the session socket.

414

* queue it on the session socket.

415

*/

415

*/

416

session_sock = session->sock;

416

session_sock = session->sock;

417

if (session_sock->sk_state & PPPOX_BOUND) {

417

if (session_sock->sk_state & PPPOX_BOUND) {

418

struct pppox_sock *po;

418

struct pppox_sock *po;

419

PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,

419

PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,

420

"%s: recv %d byte data frame, passing to ppp\n",

420

"%s: recv %d byte data frame, passing to ppp\n",

421

session->name, length);

421

session->name, length);

422

423

/* We need to forget all info related to the L2TP packet

423

/* We need to forget all info related to the L2TP packet

424

* gathered in the skb as we are going to reuse the same

424

* gathered in the skb as we are going to reuse the same

425

* skb for the inner packet.

425

* skb for the inner packet.

426

* Namely we need to:

426

* Namely we need to:

427

* - reset xfrm (IPSec) information as it applies to

427

* - reset xfrm (IPSec) information as it applies to

428

* the outer L2TP packet and not to the inner one

428

* the outer L2TP packet and not to the inner one

429

* - release the dst to force a route lookup on the inner

429

* - release the dst to force a route lookup on the inner

430

* IP packet since skb->dst currently points to the dst

430

* IP packet since skb->dst currently points to the dst

431

* of the UDP tunnel

431

* of the UDP tunnel

432

* - reset netfilter information as it doesn't apply

432

* - reset netfilter information as it doesn't apply

433

* to the inner packet either

433

* to the inner packet either

434

*/

434

*/

435

secpath_reset(skb);

435

secpath_reset(skb);

436

skb_dst_drop(skb);

436

skb_dst_drop(skb);

437

nf_reset(skb);

437

nf_reset(skb);

438

439

po = pppox_sk(session_sock);

439

po = pppox_sk(session_sock);

440

ppp_input(&po->chan, skb);

440

ppp_input(&po->chan, skb);

441

} else {

441

} else {

442

PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_INFO,

442

PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_INFO,

443

"%s: socket not bound\n", session->name);

443

"%s: socket not bound\n", session->name);

444

445

/* Not bound. Nothing we can do, so discard. */

445

/* Not bound. Nothing we can do, so discard. */

446

session->stats.rx_errors++;

446

session->stats.rx_errors++;

447

kfree_skb(skb);

447

kfree_skb(skb);

448

}

448

}

449

450

sock_put(session->sock);

450

sock_put(session->sock);

451

}

451

}

452

453

/* Dequeue skbs from the session's reorder_q, subject to packet order.

453

/* Dequeue skbs from the session's reorder_q, subject to packet order.

454

* Skbs that have been in the queue for too long are simply discarded.

454

* Skbs that have been in the queue for too long are simply discarded.

455

*/

455

*/

456

static void pppol2tp_recv_dequeue(struct pppol2tp_session *session)

456

static void pppol2tp_recv_dequeue(struct pppol2tp_session *session)

457

{

457

{

458

struct sk_buff *skb;

458

struct sk_buff *skb;

459

struct sk_buff *tmp;

459

struct sk_buff *tmp;

460

461

/* If the pkt at the head of the queue has the nr that we

461

/* If the pkt at the head of the queue has the nr that we

462

* expect to send up next, dequeue it and any other

462

* expect to send up next, dequeue it and any other

463

* in-sequence packets behind it.

463

* in-sequence packets behind it.

464

*/

464

*/

465

spin_lock_bh(&session->reorder_q.lock);

465

spin_lock_bh(&session->reorder_q.lock);

466

skb_queue_walk_safe(&session->reorder_q, skb, tmp) {

466

skb_queue_walk_safe(&session->reorder_q, skb, tmp) {

467

if (time_after(jiffies, PPPOL2TP_SKB_CB(skb)->expires)) {

467

if (time_after(jiffies, PPPOL2TP_SKB_CB(skb)->expires)) {

468

session->stats.rx_seq_discards++;

468

session->stats.rx_seq_discards++;

469

session->stats.rx_errors++;

469

session->stats.rx_errors++;

470

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,

470

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,

471

"%s: oos pkt %hu len %d discarded (too old), "

471

"%s: oos pkt %hu len %d discarded (too old), "

472

"waiting for %hu, reorder_q_len=%d\n",

472

"waiting for %hu, reorder_q_len=%d\n",

473

session->name, PPPOL2TP_SKB_CB(skb)->ns,

473

session->name, PPPOL2TP_SKB_CB(skb)->ns,

474

PPPOL2TP_SKB_CB(skb)->length, session->nr,

474

PPPOL2TP_SKB_CB(skb)->length, session->nr,

475

skb_queue_len(&session->reorder_q));

475

skb_queue_len(&session->reorder_q));

476

__skb_unlink(skb, &session->reorder_q);

476

__skb_unlink(skb, &session->reorder_q);

477

kfree_skb(skb);

477

kfree_skb(skb);

478

sock_put(session->sock);

478

sock_put(session->sock);

479

continue;

479

continue;

480

}

480

}

481

482

if (PPPOL2TP_SKB_CB(skb)->has_seq) {

482

if (PPPOL2TP_SKB_CB(skb)->has_seq) {

483

if (PPPOL2TP_SKB_CB(skb)->ns != session->nr) {

483

if (PPPOL2TP_SKB_CB(skb)->ns != session->nr) {

484

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,

484

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,

485

"%s: holding oos pkt %hu len %d, "

485

"%s: holding oos pkt %hu len %d, "

486

"waiting for %hu, reorder_q_len=%d\n",

486

"waiting for %hu, reorder_q_len=%d\n",

487

session->name, PPPOL2TP_SKB_CB(skb)->ns,

487

session->name, PPPOL2TP_SKB_CB(skb)->ns,

488

PPPOL2TP_SKB_CB(skb)->length, session->nr,

488

PPPOL2TP_SKB_CB(skb)->length, session->nr,

489

skb_queue_len(&session->reorder_q));

489

skb_queue_len(&session->reorder_q));

490

goto out;

490

goto out;

491

}

491

}

492

}

492

}

493

__skb_unlink(skb, &session->reorder_q);

493

__skb_unlink(skb, &session->reorder_q);

494

495

/* Process the skb. We release the queue lock while we

495

/* Process the skb. We release the queue lock while we

496

* do so to let other contexts process the queue.

496

* do so to let other contexts process the queue.

497

*/

497

*/

498

spin_unlock_bh(&session->reorder_q.lock);

498

spin_unlock_bh(&session->reorder_q.lock);

499

pppol2tp_recv_dequeue_skb(session, skb);

499

pppol2tp_recv_dequeue_skb(session, skb);

500

spin_lock_bh(&session->reorder_q.lock);

500

spin_lock_bh(&session->reorder_q.lock);

501

}

501

}

502

503

out:

503

out:

504

spin_unlock_bh(&session->reorder_q.lock);

504

spin_unlock_bh(&session->reorder_q.lock);

505

}

505

}

506

507

static inline int pppol2tp_verify_udp_checksum(struct sock *sk,

507

static inline int pppol2tp_verify_udp_checksum(struct sock *sk,

508

struct sk_buff *skb)

508

struct sk_buff *skb)

509

{

509

{

510

struct udphdr *uh = udp_hdr(skb);

510

struct udphdr *uh = udp_hdr(skb);

511

u16 ulen = ntohs(uh->len);

511

u16 ulen = ntohs(uh->len);

512

struct inet_sock *inet;

512

struct inet_sock *inet;

513

__wsum psum;

513

__wsum psum;

514

515

if (sk->sk_no_check || skb_csum_unnecessary(skb) || !uh->check)

515

if (sk->sk_no_check || skb_csum_unnecessary(skb) || !uh->check)

516

return 0;

516

return 0;

517

518

inet = inet_sk(sk);

518

inet = inet_sk(sk);

519

psum = csum_tcpudp_nofold(inet->inet_saddr, inet->inet_daddr, ulen,

519

psum = csum_tcpudp_nofold(inet->inet_saddr, inet->inet_daddr, ulen,

520

IPPROTO_UDP, 0);

520

IPPROTO_UDP, 0);

521

522

if ((skb->ip_summed == CHECKSUM_COMPLETE) &&

522

if ((skb->ip_summed == CHECKSUM_COMPLETE) &&

523

!csum_fold(csum_add(psum, skb->csum)))

523

!csum_fold(csum_add(psum, skb->csum)))

524

return 0;

524

return 0;

525

526

skb->csum = psum;

526

skb->csum = psum;

527

528

return __skb_checksum_complete(skb);

528

return __skb_checksum_complete(skb);

529

}

529

}

530

531

/* Internal receive frame. Do the real work of receiving an L2TP data frame

531

/* Internal receive frame. Do the real work of receiving an L2TP data frame

532

* here. The skb is not on a list when we get here.

532

* here. The skb is not on a list when we get here.

533

* Returns 0 if the packet was a data packet and was successfully passed on.

533

* Returns 0 if the packet was a data packet and was successfully passed on.

534

* Returns 1 if the packet was not a good data packet and could not be

534

* Returns 1 if the packet was not a good data packet and could not be

535

* forwarded. All such packets are passed up to userspace to deal with.

535

* forwarded. All such packets are passed up to userspace to deal with.

536

*/

536

*/

537

static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)

537

static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)

538

{

538

{

539

struct pppol2tp_session *session = NULL;

539

struct pppol2tp_session *session = NULL;

540

struct pppol2tp_tunnel *tunnel;

540

struct pppol2tp_tunnel *tunnel;

541

unsigned char *ptr, *optr;

541

unsigned char *ptr, *optr;

542

u16 hdrflags;

542

u16 hdrflags;

543

u16 tunnel_id, session_id;

543

u16 tunnel_id, session_id;

544

int length;

544

int length;

545

int offset;

545

int offset;

546

547

tunnel = pppol2tp_sock_to_tunnel(sock);

547

tunnel = pppol2tp_sock_to_tunnel(sock);

548

if (tunnel == NULL)

548

if (tunnel == NULL)

549

goto no_tunnel;

549

goto no_tunnel;

550

551

if (tunnel->sock && pppol2tp_verify_udp_checksum(tunnel->sock, skb))

551

if (tunnel->sock && pppol2tp_verify_udp_checksum(tunnel->sock, skb))

552

goto discard_bad_csum;

552

goto discard_bad_csum;

553

554

/* UDP always verifies the packet length. */

554

/* UDP always verifies the packet length. */

555

__skb_pull(skb, sizeof(struct udphdr));

555

__skb_pull(skb, sizeof(struct udphdr));

556

557

/* Short packet? */

557

/* Short packet? */

558

if (!pskb_may_pull(skb, 12)) {

558

if (!pskb_may_pull(skb, 12)) {

559

PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_INFO,

559

PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_INFO,

560

"%s: recv short packet (len=%d)\n", tunnel->name, skb->len);

560

"%s: recv short packet (len=%d)\n", tunnel->name, skb->len);

561

goto error;

561

goto error;

562

}

562

}

563

564

/* Point to L2TP header */

564

/* Point to L2TP header */

565

optr = ptr = skb->data;

565

optr = ptr = skb->data;

566

567

/* Get L2TP header flags */

567

/* Get L2TP header flags */

568

hdrflags = ntohs(*(__be16*)ptr);

568

hdrflags = ntohs(*(__be16*)ptr);

569

570

/* Trace packet contents, if enabled */

570

/* Trace packet contents, if enabled */

571

if (tunnel->debug & PPPOL2TP_MSG_DATA) {

571

if (tunnel->debug & PPPOL2TP_MSG_DATA) {

572

length = min(16u, skb->len);

572

length = min(16u, skb->len);

573

if (!pskb_may_pull(skb, length))

573

if (!pskb_may_pull(skb, length))

574

goto error;

574

goto error;

575

576

printk(KERN_DEBUG "%s: recv: ", tunnel->name);

576

printk(KERN_DEBUG "%s: recv: ", tunnel->name);

577

578

offset = 0;

578

offset = 0;

579

do {

579

do {

580

printk(" %02X", ptr[offset]);

580

printk(" %02X", ptr[offset]);

581

} while (++offset < length);

581

} while (++offset < length);

582

583

printk("\n");

583

printk("\n");

584

}

584

}

585

586

/* Get length of L2TP packet */

586

/* Get length of L2TP packet */

587

length = skb->len;

587

length = skb->len;

588

589

/* If type is control packet, it is handled by userspace. */

589

/* If type is control packet, it is handled by userspace. */

590

if (hdrflags & L2TP_HDRFLAG_T) {

590

if (hdrflags & L2TP_HDRFLAG_T) {

591

PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,

591

PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,

592

"%s: recv control packet, len=%d\n", tunnel->name, length);

592

"%s: recv control packet, len=%d\n", tunnel->name, length);

593

goto error;

593

goto error;

594

}

594

}

595

596

/* Skip flags */

596

/* Skip flags */

597

ptr += 2;

597

ptr += 2;

598

599

/* If length is present, skip it */

599

/* If length is present, skip it */

600

if (hdrflags & L2TP_HDRFLAG_L)

600

if (hdrflags & L2TP_HDRFLAG_L)

601

ptr += 2;

601

ptr += 2;

602

603

/* Extract tunnel and session ID */

603

/* Extract tunnel and session ID */

604

tunnel_id = ntohs(*(__be16 *) ptr);

604

tunnel_id = ntohs(*(__be16 *) ptr);

605

ptr += 2;

605

ptr += 2;

606

session_id = ntohs(*(__be16 *) ptr);

606

session_id = ntohs(*(__be16 *) ptr);

607

ptr += 2;

607

ptr += 2;

608

609

/* Find the session context */

609

/* Find the session context */

610

session = pppol2tp_session_find(tunnel, session_id);

610

session = pppol2tp_session_find(tunnel, session_id);

611

if (!session) {

611

if (!session) {

612

/* Not found? Pass to userspace to deal with */

612

/* Not found? Pass to userspace to deal with */

613

PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_INFO,

613

PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_INFO,

614

"%s: no socket found (%hu/%hu). Passing up.\n",

614

"%s: no socket found (%hu/%hu). Passing up.\n",

615

tunnel->name, tunnel_id, session_id);

615

tunnel->name, tunnel_id, session_id);

616

goto error;

616

goto error;

617

}

617

}

618

sock_hold(session->sock);

618

sock_hold(session->sock);

619

620

/* The ref count on the socket was increased by the above call since

620

/* The ref count on the socket was increased by the above call since

621

* we now hold a pointer to the session. Take care to do sock_put()

621

* we now hold a pointer to the session. Take care to do sock_put()

622

* when exiting this function from now on...

622

* when exiting this function from now on...

623

*/

623

*/

624

625

/* Handle the optional sequence numbers. If we are the LAC,

625

/* Handle the optional sequence numbers. If we are the LAC,

626

* enable/disable sequence numbers under the control of the LNS. If

626

* enable/disable sequence numbers under the control of the LNS. If

627

* no sequence numbers present but we were expecting them, discard

627

* no sequence numbers present but we were expecting them, discard

628

* frame.

628

* frame.

629

*/

629

*/

630

if (hdrflags & L2TP_HDRFLAG_S) {

630

if (hdrflags & L2TP_HDRFLAG_S) {

631

u16 ns, nr;

631

u16 ns, nr;

632

ns = ntohs(*(__be16 *) ptr);

632

ns = ntohs(*(__be16 *) ptr);

633

ptr += 2;

633

ptr += 2;

634

nr = ntohs(*(__be16 *) ptr);

634

nr = ntohs(*(__be16 *) ptr);

635

ptr += 2;

635

ptr += 2;

636

637

/* Received a packet with sequence numbers. If we're the LNS,

637

/* Received a packet with sequence numbers. If we're the LNS,

638

* check if we sre sending sequence numbers and if not,

638

* check if we sre sending sequence numbers and if not,

639

* configure it so.

639

* configure it so.

640

*/

640

*/

641

if ((!session->lns_mode) && (!session->send_seq)) {

641

if ((!session->lns_mode) && (!session->send_seq)) {

642

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_INFO,

642

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_INFO,

643

"%s: requested to enable seq numbers by LNS\n",

643

"%s: requested to enable seq numbers by LNS\n",

644

session->name);

644

session->name);

645

session->send_seq = -1;

645

session->send_seq = -1;

646

}

646

}

647

648

/* Store L2TP info in the skb */

648

/* Store L2TP info in the skb */

649

PPPOL2TP_SKB_CB(skb)->ns = ns;

649

PPPOL2TP_SKB_CB(skb)->ns = ns;

650

PPPOL2TP_SKB_CB(skb)->nr = nr;

650

PPPOL2TP_SKB_CB(skb)->nr = nr;

651

PPPOL2TP_SKB_CB(skb)->has_seq = 1;

651

PPPOL2TP_SKB_CB(skb)->has_seq = 1;

652

653

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,

653

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,

654

"%s: recv data ns=%hu, nr=%hu, session nr=%hu\n",

654

"%s: recv data ns=%hu, nr=%hu, session nr=%hu\n",

655

session->name, ns, nr, session->nr);

655

session->name, ns, nr, session->nr);

656

} else {

656

} else {

657

/* No sequence numbers.

657

/* No sequence numbers.

658

* If user has configured mandatory sequence numbers, discard.

658

* If user has configured mandatory sequence numbers, discard.

659

*/

659

*/

660

if (session->recv_seq) {

660

if (session->recv_seq) {

661

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_WARNING,

661

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_WARNING,

662

"%s: recv data has no seq numbers when required. "

662

"%s: recv data has no seq numbers when required. "

663

"Discarding\n", session->name);

663

"Discarding\n", session->name);

664

session->stats.rx_seq_discards++;

664

session->stats.rx_seq_discards++;

665

goto discard;

665

goto discard;

666

}

666

}

667

668

/* If we're the LAC and we're sending sequence numbers, the

668

/* If we're the LAC and we're sending sequence numbers, the

669

* LNS has requested that we no longer send sequence numbers.

669

* LNS has requested that we no longer send sequence numbers.

670

* If we're the LNS and we're sending sequence numbers, the

670

* If we're the LNS and we're sending sequence numbers, the

671

* LAC is broken. Discard the frame.

671

* LAC is broken. Discard the frame.

672

*/

672

*/

673

if ((!session->lns_mode) && (session->send_seq)) {

673

if ((!session->lns_mode) && (session->send_seq)) {

674

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_INFO,

674

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_INFO,

675

"%s: requested to disable seq numbers by LNS\n",

675

"%s: requested to disable seq numbers by LNS\n",

676

session->name);

676

session->name);

677

session->send_seq = 0;

677

session->send_seq = 0;

678

} else if (session->send_seq) {

678

} else if (session->send_seq) {

679

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_WARNING,

679

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_WARNING,

680

"%s: recv data has no seq numbers when required. "

680

"%s: recv data has no seq numbers when required. "

681

"Discarding\n", session->name);

681

"Discarding\n", session->name);

682

session->stats.rx_seq_discards++;

682

session->stats.rx_seq_discards++;

683

goto discard;

683

goto discard;

684

}

684

}

685

686

/* Store L2TP info in the skb */

686

/* Store L2TP info in the skb */

687

PPPOL2TP_SKB_CB(skb)->has_seq = 0;

687

PPPOL2TP_SKB_CB(skb)->has_seq = 0;

688

}

688

}

689

690

/* If offset bit set, skip it. */

690

/* If offset bit set, skip it. */

691

if (hdrflags & L2TP_HDRFLAG_O) {

691

if (hdrflags & L2TP_HDRFLAG_O) {

692

offset = ntohs(*(__be16 *)ptr);

692

offset = ntohs(*(__be16 *)ptr);

693

ptr += 2 + offset;

693

ptr += 2 + offset;

694

}

694

}

695

696

offset = ptr - optr;

696

offset = ptr - optr;

697

if (!pskb_may_pull(skb, offset))

697

if (!pskb_may_pull(skb, offset))

698

goto discard;

698

goto discard;

699

700

__skb_pull(skb, offset);

700

__skb_pull(skb, offset);

701

702

/* Skip PPP header, if present. In testing, Microsoft L2TP clients

702

/* Skip PPP header, if present. In testing, Microsoft L2TP clients

703

* don't send the PPP header (PPP header compression enabled), but

703

* don't send the PPP header (PPP header compression enabled), but

704

* other clients can include the header. So we cope with both cases

704

* other clients can include the header. So we cope with both cases

705

* here. The PPP header is always FF03 when using L2TP.

705

* here. The PPP header is always FF03 when using L2TP.

706

*

706

*

707

* Note that skb->data[] isn't dereferenced from a u16 ptr here since

707

* Note that skb->data[] isn't dereferenced from a u16 ptr here since

708

* the field may be unaligned.

708

* the field may be unaligned.

709

*/

709

*/

710

if (!pskb_may_pull(skb, 2))

710

if (!pskb_may_pull(skb, 2))

711

goto discard;

711

goto discard;

712

713

if ((skb->data[0] == 0xff) && (skb->data[1] == 0x03))

713

if ((skb->data[0] == 0xff) && (skb->data[1] == 0x03))

714

skb_pull(skb, 2);

714

skb_pull(skb, 2);

715

716

/* Prepare skb for adding to the session's reorder_q. Hold

716

/* Prepare skb for adding to the session's reorder_q. Hold

717

* packets for max reorder_timeout or 1 second if not

717

* packets for max reorder_timeout or 1 second if not

718

* reordering.

718

* reordering.

719

*/

719

*/

720

PPPOL2TP_SKB_CB(skb)->length = length;

720

PPPOL2TP_SKB_CB(skb)->length = length;

721

PPPOL2TP_SKB_CB(skb)->expires = jiffies +

721

PPPOL2TP_SKB_CB(skb)->expires = jiffies +

722

(session->reorder_timeout ? session->reorder_timeout : HZ);

722

(session->reorder_timeout ? session->reorder_timeout : HZ);

723

724

/* Add packet to the session's receive queue. Reordering is done here, if

724

/* Add packet to the session's receive queue. Reordering is done here, if

725

* enabled. Saved L2TP protocol info is stored in skb->sb[].

725

* enabled. Saved L2TP protocol info is stored in skb->sb[].

726

*/

726

*/

727

if (PPPOL2TP_SKB_CB(skb)->has_seq) {

727

if (PPPOL2TP_SKB_CB(skb)->has_seq) {

728

if (session->reorder_timeout != 0) {

728

if (session->reorder_timeout != 0) {

729

/* Packet reordering enabled. Add skb to session's

729

/* Packet reordering enabled. Add skb to session's

730

* reorder queue, in order of ns.

730

* reorder queue, in order of ns.

731

*/

731

*/

732

pppol2tp_recv_queue_skb(session, skb);

732

pppol2tp_recv_queue_skb(session, skb);

733

} else {

733

} else {

734

/* Packet reordering disabled. Discard out-of-sequence

734

/* Packet reordering disabled. Discard out-of-sequence

735

* packets

735

* packets

736

*/

736

*/

737

if (PPPOL2TP_SKB_CB(skb)->ns != session->nr) {

737

if (PPPOL2TP_SKB_CB(skb)->ns != session->nr) {

738

session->stats.rx_seq_discards++;

738

session->stats.rx_seq_discards++;

739

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,

739

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,

740

"%s: oos pkt %hu len %d discarded, "

740

"%s: oos pkt %hu len %d discarded, "

741

"waiting for %hu, reorder_q_len=%d\n",

741

"waiting for %hu, reorder_q_len=%d\n",

742

session->name, PPPOL2TP_SKB_CB(skb)->ns,

742

session->name, PPPOL2TP_SKB_CB(skb)->ns,

743

PPPOL2TP_SKB_CB(skb)->length, session->nr,

743

PPPOL2TP_SKB_CB(skb)->length, session->nr,

744

skb_queue_len(&session->reorder_q));

744

skb_queue_len(&session->reorder_q));

745

goto discard;

745

goto discard;

746

}

746

}

747

skb_queue_tail(&session->reorder_q, skb);

747

skb_queue_tail(&session->reorder_q, skb);

748

}

748

}

749

} else {

749

} else {

750

/* No sequence numbers. Add the skb to the tail of the

750

/* No sequence numbers. Add the skb to the tail of the

751

* reorder queue. This ensures that it will be

751

* reorder queue. This ensures that it will be

752

* delivered after all previous sequenced skbs.

752

* delivered after all previous sequenced skbs.

753

*/

753

*/

754

skb_queue_tail(&session->reorder_q, skb);

754

skb_queue_tail(&session->reorder_q, skb);

755

}

755

}

756

757

/* Try to dequeue as many skbs from reorder_q as we can. */

757

/* Try to dequeue as many skbs from reorder_q as we can. */

758

pppol2tp_recv_dequeue(session);

758

pppol2tp_recv_dequeue(session);

759

760

return 0;

760

return 0;

761

762

discard:

762

discard:

763

session->stats.rx_errors++;

763

session->stats.rx_errors++;

764

kfree_skb(skb);

764

kfree_skb(skb);

765

sock_put(session->sock);

765

sock_put(session->sock);

766

sock_put(sock);

766

sock_put(sock);

767

768

return 0;

768

return 0;

769

770

discard_bad_csum:

770

discard_bad_csum:

771

LIMIT_NETDEBUG("%s: UDP: bad checksum\n", tunnel->name);

771

LIMIT_NETDEBUG("%s: UDP: bad checksum\n", tunnel->name);

772

UDP_INC_STATS_USER(&init_net, UDP_MIB_INERRORS, 0);

772

UDP_INC_STATS_USER(&init_net, UDP_MIB_INERRORS, 0);

773

tunnel->stats.rx_errors++;

773

tunnel->stats.rx_errors++;

774

kfree_skb(skb);

774

kfree_skb(skb);

775

776

return 0;

776

return 0;

777

778

error:

778

error:

779

/* Put UDP header back */

779

/* Put UDP header back */

780

__skb_push(skb, sizeof(struct udphdr));

780

__skb_push(skb, sizeof(struct udphdr));

781

sock_put(sock);

781

sock_put(sock);

782

783

no_tunnel:

783

no_tunnel:

784

return 1;

784

return 1;

785

}

785

}

786

787

/* UDP encapsulation receive handler. See net/ipv4/udp.c.

787

/* UDP encapsulation receive handler. See net/ipv4/udp.c.

788

* Return codes:

788

* Return codes:

789

* 0 : success.

789

* 0 : success.

790

* <0: error

790

* <0: error

791

* >0: skb should be passed up to userspace as UDP.

791

* >0: skb should be passed up to userspace as UDP.

792

*/

792

*/

793

static int pppol2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)

793

static int pppol2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)

794

{

794

{

795

struct pppol2tp_tunnel *tunnel;

795

struct pppol2tp_tunnel *tunnel;

796

797

tunnel = pppol2tp_sock_to_tunnel(sk);

797

tunnel = pppol2tp_sock_to_tunnel(sk);

798

if (tunnel == NULL)

798

if (tunnel == NULL)

799

goto pass_up;

799

goto pass_up;

800

801

PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,

801

PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,

802

"%s: received %d bytes\n", tunnel->name, skb->len);

802

"%s: received %d bytes\n", tunnel->name, skb->len);

803

804

if (pppol2tp_recv_core(sk, skb))

804

if (pppol2tp_recv_core(sk, skb))

805

goto pass_up_put;

805

goto pass_up_put;

806

807

sock_put(sk);

807

sock_put(sk);

808

return 0;

808

return 0;

809

810

pass_up_put:

810

pass_up_put:

811

sock_put(sk);

811

sock_put(sk);

812

pass_up:

812

pass_up:

813

return 1;

813

return 1;

814

}

814

}

815

816

/* Receive message. This is the recvmsg for the PPPoL2TP socket.

816

/* Receive message. This is the recvmsg for the PPPoL2TP socket.

817

*/

817

*/

818

static int pppol2tp_recvmsg(struct kiocb *iocb, struct socket *sock,

818

static int pppol2tp_recvmsg(struct kiocb *iocb, struct socket *sock,

819

struct msghdr *msg, size_t len,

819

struct msghdr *msg, size_t len,

820

int flags)

820

int flags)

821

{

821

{

822

int err;

822

int err;

823

struct sk_buff *skb;

823

struct sk_buff *skb;

824

struct sock *sk = sock->sk;

824

struct sock *sk = sock->sk;

825

826

err = -EIO;

826

err = -EIO;

827

if (sk->sk_state & PPPOX_BOUND)

827

if (sk->sk_state & PPPOX_BOUND)

828

goto end;

828

goto end;

829

830

msg->msg_namelen = 0;

830

msg->msg_namelen = 0;

831

832

err = 0;

832

err = 0;

833

skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,

833

skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,

834

flags & MSG_DONTWAIT, &err);

834

flags & MSG_DONTWAIT, &err);

835

if (!skb)

835

if (!skb)

836

goto end;

836

goto end;

837

838

if (len > skb->len)

838

if (len > skb->len)

839

len = skb->len;

839

len = skb->len;

840

else if (len < skb->len)

840

else if (len < skb->len)

841

msg->msg_flags |= MSG_TRUNC;

841

msg->msg_flags |= MSG_TRUNC;

842

843

err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, len);

843

err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, len);

844

if (likely(err == 0))

844

if (likely(err == 0))

845

err = len;

845

err = len;

846

847

kfree_skb(skb);

847

kfree_skb(skb);

848

end:

848

end:

849

return err;

849

return err;

850

}

850

}

851

852

/************************************************************************

852

/************************************************************************

853

* Transmit handling

853

* Transmit handling

854

***********************************************************************/

854

***********************************************************************/

855

856

/* Tell how big L2TP headers are for a particular session. This

856

/* Tell how big L2TP headers are for a particular session. This

857

* depends on whether sequence numbers are being used.

857

* depends on whether sequence numbers are being used.

858

*/

858

*/

859

static inline int pppol2tp_l2tp_header_len(struct pppol2tp_session *session)

859

static inline int pppol2tp_l2tp_header_len(struct pppol2tp_session *session)

860

{

860

{

861

if (session->send_seq)

861

if (session->send_seq)

862

return PPPOL2TP_L2TP_HDR_SIZE_SEQ;

862

return PPPOL2TP_L2TP_HDR_SIZE_SEQ;

863

864

return PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;

864

return PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;

865

}

865

}

866

867

/* Build an L2TP header for the session into the buffer provided.

867

/* Build an L2TP header for the session into the buffer provided.

868

*/

868

*/

869

static void pppol2tp_build_l2tp_header(struct pppol2tp_session *session,

869

static void pppol2tp_build_l2tp_header(struct pppol2tp_session *session,

870

void *buf)

870

void *buf)

871

{

871

{

872

__be16 *bufp = buf;

872

__be16 *bufp = buf;

873

u16 flags = L2TP_HDR_VER;

873

u16 flags = L2TP_HDR_VER;

874

875

if (session->send_seq)

875

if (session->send_seq)

876

flags |= L2TP_HDRFLAG_S;

876

flags |= L2TP_HDRFLAG_S;

877

878

/* Setup L2TP header.

878

/* Setup L2TP header.

879

* FIXME: Can this ever be unaligned? Is direct dereferencing of

879

* FIXME: Can this ever be unaligned? Is direct dereferencing of

880

* 16-bit header fields safe here for all architectures?

880

* 16-bit header fields safe here for all architectures?

881

*/

881

*/

882

*bufp++ = htons(flags);

882

*bufp++ = htons(flags);

883

*bufp++ = htons(session->tunnel_addr.d_tunnel);

883

*bufp++ = htons(session->tunnel_addr.d_tunnel);

884

*bufp++ = htons(session->tunnel_addr.d_session);

884

*bufp++ = htons(session->tunnel_addr.d_session);

885

if (session->send_seq) {

885

if (session->send_seq) {

886

*bufp++ = htons(session->ns);

886

*bufp++ = htons(session->ns);

887

*bufp++ = 0;

887

*bufp++ = 0;

888

session->ns++;

888

session->ns++;

889

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,

889

PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,

890

"%s: updated ns to %hu\n", session->name, session->ns);

890

"%s: updated ns to %hu\n", session->name, session->ns);

891

}

891

}

892

}

892

}

893

894

/* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here

894

/* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here

895

* when a user application does a sendmsg() on the session socket. L2TP and

895

* when a user application does a sendmsg() on the session socket. L2TP and

896

* PPP headers must be inserted into the user's data.

896

* PPP headers must be inserted into the user's data.

897

*/

897

*/

898

static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,

898

static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,

899

size_t total_len)

899

size_t total_len)

900

{

900

{

901

static const unsigned char ppph[2] = { 0xff, 0x03 };

901

static const unsigned char ppph[2] = { 0xff, 0x03 };

902

struct sock *sk = sock->sk;

902

struct sock *sk = sock->sk;

903

struct inet_sock *inet;

903

struct inet_sock *inet;

904

__wsum csum;

904

__wsum csum;

905

struct sk_buff *skb;

905

struct sk_buff *skb;

906

int error;

906

int error;

907

int hdr_len;

907

int hdr_len;

908

struct pppol2tp_session *session;

908

struct pppol2tp_session *session;

909

struct pppol2tp_tunnel *tunnel;

909

struct pppol2tp_tunnel *tunnel;

910

struct udphdr *uh;

910

struct udphdr *uh;

911

unsigned int len;

911

unsigned int len;

912

struct sock *sk_tun;

912

struct sock *sk_tun;

913

u16 udp_len;

913

u16 udp_len;

914

915

error = -ENOTCONN;

915

error = -ENOTCONN;

916

if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))

916

if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))

917

goto error;

917

goto error;

918

919

/* Get session and tunnel contexts */

919

/* Get session and tunnel contexts */

920

error = -EBADF;

920

error = -EBADF;

921

session = pppol2tp_sock_to_session(sk);

921

session = pppol2tp_sock_to_session(sk);

922

if (session == NULL)

922

if (session == NULL)

923

goto error;

923

goto error;

924

925

sk_tun = session->tunnel_sock;

925

sk_tun = session->tunnel_sock;

926

tunnel = pppol2tp_sock_to_tunnel(sk_tun);

926

tunnel = pppol2tp_sock_to_tunnel(sk_tun);

927

if (tunnel == NULL)

927

if (tunnel == NULL)

928

goto error_put_sess;

928

goto error_put_sess;

929

930

/* What header length is configured for this session? */

930

/* What header length is configured for this session? */

931

hdr_len = pppol2tp_l2tp_header_len(session);

931

hdr_len = pppol2tp_l2tp_header_len(session);

932

933

/* Allocate a socket buffer */

933

/* Allocate a socket buffer */

934

error = -ENOMEM;

934

error = -ENOMEM;

935

skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) +

935

skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) +

936

sizeof(struct udphdr) + hdr_len +

936

sizeof(struct udphdr) + hdr_len +

937

sizeof(ppph) + total_len,

937

sizeof(ppph) + total_len,

938

0, GFP_KERNEL);

938

0, GFP_KERNEL);

939

if (!skb)

939

if (!skb)

940

goto error_put_sess_tun;

940

goto error_put_sess_tun;

941

942

/* Reserve space for headers. */

942

/* Reserve space for headers. */

943

skb_reserve(skb, NET_SKB_PAD);

943

skb_reserve(skb, NET_SKB_PAD);

944

skb_reset_network_header(skb);

944

skb_reset_network_header(skb);

945

skb_reserve(skb, sizeof(struct iphdr));

945

skb_reserve(skb, sizeof(struct iphdr));

946

skb_reset_transport_header(skb);

946

skb_reset_transport_header(skb);

947

948

/* Build UDP header */

948

/* Build UDP header */

949

inet = inet_sk(sk_tun);

949

inet = inet_sk(sk_tun);

950

udp_len = hdr_len + sizeof(ppph) + total_len;

950

udp_len = hdr_len + sizeof(ppph) + total_len;

951

uh = (struct udphdr *) skb->data;

951

uh = (struct udphdr *) skb->data;

952

uh->source = inet->inet_sport;

952

uh->source = inet->inet_sport;

953

uh->dest = inet->inet_dport;

953

uh->dest = inet->inet_dport;

954

uh->len = htons(udp_len);

954

uh->len = htons(udp_len);

955

uh->check = 0;

955

uh->check = 0;

956

skb_put(skb, sizeof(struct udphdr));

956

skb_put(skb, sizeof(struct udphdr));

957

958

/* Build L2TP header */

958

/* Build L2TP header */

959

pppol2tp_build_l2tp_header(session, skb->data);

959

pppol2tp_build_l2tp_header(session, skb->data);

960

skb_put(skb, hdr_len);

960

skb_put(skb, hdr_len);

961

962

/* Add PPP header */

962

/* Add PPP header */

963

skb->data[0] = ppph[0];

963

skb->data[0] = ppph[0];

964

skb->data[1] = ppph[1];

964

skb->data[1] = ppph[1];

965

skb_put(skb, 2);

965

skb_put(skb, 2);

966

967

/* Copy user data into skb */

967

/* Copy user data into skb */

968

error = memcpy_fromiovec(skb->data, m->msg_iov, total_len);

968

error = memcpy_fromiovec(skb->data, m->msg_iov, total_len);

969

if (error < 0) {

969

if (error < 0) {

970

kfree_skb(skb);

970

kfree_skb(skb);

971

goto error_put_sess_tun;

971

goto error_put_sess_tun;

972

}

972

}

973

skb_put(skb, total_len);

973

skb_put(skb, total_len);

974

975

/* Calculate UDP checksum if configured to do so */

975

/* Calculate UDP checksum if configured to do so */

976

if (sk_tun->sk_no_check == UDP_CSUM_NOXMIT)

976

if (sk_tun->sk_no_check == UDP_CSUM_NOXMIT)

977

skb->ip_summed = CHECKSUM_NONE;

977

skb->ip_summed = CHECKSUM_NONE;

978

else if (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM)) {

978

else if (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM)) {

979

skb->ip_summed = CHECKSUM_COMPLETE;

979

skb->ip_summed = CHECKSUM_COMPLETE;

980

csum = skb_checksum(skb, 0, udp_len, 0);

980

csum = skb_checksum(skb, 0, udp_len, 0);

981

uh->check = csum_tcpudp_magic(inet->inet_saddr,

981

uh->check = csum_tcpudp_magic(inet->inet_saddr,

982

inet->inet_daddr,

982

inet->inet_daddr,

983

udp_len, IPPROTO_UDP, csum);

983

udp_len, IPPROTO_UDP, csum);

984

if (uh->check == 0)

984

if (uh->check == 0)

985

uh->check = CSUM_MANGLED_0;

985

uh->check = CSUM_MANGLED_0;

986

} else {

986

} else {

987

skb->ip_summed = CHECKSUM_PARTIAL;

987

skb->ip_summed = CHECKSUM_PARTIAL;

988

skb->csum_start = skb_transport_header(skb) - skb->head;

988

skb->csum_start = skb_transport_header(skb) - skb->head;

989

skb->csum_offset = offsetof(struct udphdr, check);

989

skb->csum_offset = offsetof(struct udphdr, check);

990

uh->check = ~csum_tcpudp_magic(inet->inet_saddr,

990

uh->check = ~csum_tcpudp_magic(inet->inet_saddr,

991

inet->inet_daddr,

991

inet->inet_daddr,

992

udp_len, IPPROTO_UDP, 0);

992

udp_len, IPPROTO_UDP, 0);

993

}

993

}

994

995

/* Debug */

995

/* Debug */

996

if (session->send_seq)

996

if (session->send_seq)

997

PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,

997

PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,

998

"%s: send %Zd bytes, ns=%hu\n", session->name,

998

"%s: send %Zd bytes, ns=%hu\n", session->name,

999

total_len, session->ns - 1);

999

total_len, session->ns - 1);

1000

else

1000

else

1001

PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,

1001

PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,

1002

"%s: send %Zd bytes\n", session->name, total_len);

1002

"%s: send %Zd bytes\n", session->name, total_len);

1003

1004

if (session->debug & PPPOL2TP_MSG_DATA) {

1004

if (session->debug & PPPOL2TP_MSG_DATA) {

1005

int i;

1005

int i;

1006

unsigned char *datap = skb->data;

1006

unsigned char *datap = skb->data;

1007

1008

printk(KERN_DEBUG "%s: xmit:", session->name);

1008

printk(KERN_DEBUG "%s: xmit:", session->name);

1009

for (i = 0; i < total_len; i++) {

1009

for (i = 0; i < total_len; i++) {

1010

printk(" %02X", *datap++);

1010

printk(" %02X", *datap++);

1011

if (i == 15) {

1011

if (i == 15) {

1012

printk(" ...");

1012

printk(" ...");

1013

break;

1013

break;

1014

}

1014

}

1015

}

1015

}

1016

printk("\n");

1016

printk("\n");

1017

}

1017

}

1018

1019

/* Queue the packet to IP for output */

1019

/* Queue the packet to IP for output */

1020

len = skb->len;

1020

len = skb->len;

1021

error = ip_queue_xmit(skb, 1);

1021

error = ip_queue_xmit(skb, 1);

1022

1023

/* Update stats */

1023

/* Update stats */

1024

if (error >= 0) {

1024

if (error >= 0) {

1025

tunnel->stats.tx_packets++;

1025

tunnel->stats.tx_packets++;

1026

tunnel->stats.tx_bytes += len;

1026

tunnel->stats.tx_bytes += len;

1027

session->stats.tx_packets++;

1027

session->stats.tx_packets++;

1028

session->stats.tx_bytes += len;

1028

session->stats.tx_bytes += len;

1029

} else {

1029

} else {

1030

tunnel->stats.tx_errors++;

1030

tunnel->stats.tx_errors++;

1031

session->stats.tx_errors++;

1031

session->stats.tx_errors++;

1032

}

1032

}

1033

1034

return error;

1034

return error;

1035

1036

error_put_sess_tun:

1036

error_put_sess_tun:

1037

sock_put(session->tunnel_sock);

1037

sock_put(session->tunnel_sock);

1038

error_put_sess:

1038

error_put_sess:

1039

sock_put(sk);

1039

sock_put(sk);

1040

error:

1040

error:

1041

return error;

1041

return error;

1042

}

1042

}

1043

1044

/* Automatically called when the skb is freed.

1044

/* Automatically called when the skb is freed.

1045

*/

1045

*/

1046

static void pppol2tp_sock_wfree(struct sk_buff *skb)

1046

static void pppol2tp_sock_wfree(struct sk_buff *skb)

1047

{

1047

{

1048

sock_put(skb->sk);

1048

sock_put(skb->sk);

1049

}

1049

}

1050

1051

/* For data skbs that we transmit, we associate with the tunnel socket

1051

/* For data skbs that we transmit, we associate with the tunnel socket

1052

* but don't do accounting.

1052

* but don't do accounting.

1053

*/

1053

*/

1054

static inline void pppol2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)

1054

static inline void pppol2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)

1055

{

1055

{

1056

sock_hold(sk);

1056

sock_hold(sk);

1057

skb->sk = sk;

1057

skb->sk = sk;

1058

skb->destructor = pppol2tp_sock_wfree;

1058

skb->destructor = pppol2tp_sock_wfree;

1059

}

1059

}

1060

1061

/* Transmit function called by generic PPP driver. Sends PPP frame

1061

/* Transmit function called by generic PPP driver. Sends PPP frame

1062

* over PPPoL2TP socket.

1062

* over PPPoL2TP socket.

1063

*

1063

*

1064

* This is almost the same as pppol2tp_sendmsg(), but rather than

1064

* This is almost the same as pppol2tp_sendmsg(), but rather than

1065

* being called with a msghdr from userspace, it is called with a skb

1065

* being called with a msghdr from userspace, it is called with a skb

1066

* from the kernel.

1066

* from the kernel.

1067

*

1067

*

1068

* The supplied skb from ppp doesn't have enough headroom for the

1068

* The supplied skb from ppp doesn't have enough headroom for the

1069

* insertion of L2TP, UDP and IP headers so we need to allocate more

1069

* insertion of L2TP, UDP and IP headers so we need to allocate more

1070

* headroom in the skb. This will create a cloned skb. But we must be

1070

* headroom in the skb. This will create a cloned skb. But we must be

1071

* careful in the error case because the caller will expect to free

1071

* careful in the error case because the caller will expect to free

1072

* the skb it supplied, not our cloned skb. So we take care to always

1072

* the skb it supplied, not our cloned skb. So we take care to always

1073

* leave the original skb unfreed if we return an error.

1073

* leave the original skb unfreed if we return an error.

1074

*/

1074

*/

1075

static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)

1075

static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)

1076

{

1076

{

1077

static const u8 ppph[2] = { 0xff, 0x03 };

1077

static const u8 ppph[2] = { 0xff, 0x03 };

1078

struct sock *sk = (struct sock *) chan->private;

1078

struct sock *sk = (struct sock *) chan->private;

1079

struct sock *sk_tun;

1079

struct sock *sk_tun;

1080

int hdr_len;

1080

int hdr_len;

1081

u16 udp_len;

1081

u16 udp_len;

1082

struct pppol2tp_session *session;

1082

struct pppol2tp_session *session;

1083

struct pppol2tp_tunnel *tunnel;

1083

struct pppol2tp_tunnel *tunnel;

1084

int rc;

1084

int rc;

1085

int headroom;

1085

int headroom;

1086

int data_len = skb->len;

1086

int data_len = skb->len;

1087

struct inet_sock *inet;

1087

struct inet_sock *inet;

1088

__wsum csum;

1088

__wsum csum;

1089

struct udphdr *uh;

1089

struct udphdr *uh;

1090

unsigned int len;

1090

unsigned int len;

1091

int old_headroom;

1091

int old_headroom;

1092

int new_headroom;

1092

int new_headroom;

1093

1094

if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))

1094

if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))

1095

goto abort;

1095

goto abort;

1096

1097

/* Get session and tunnel contexts from the socket */

1097

/* Get session and tunnel contexts from the socket */

1098

session = pppol2tp_sock_to_session(sk);

1098

session = pppol2tp_sock_to_session(sk);

1099

if (session == NULL)

1099

if (session == NULL)

1100

goto abort;

1100

goto abort;

1101

1102

sk_tun = session->tunnel_sock;

1102

sk_tun = session->tunnel_sock;

1103

if (sk_tun == NULL)

1103

if (sk_tun == NULL)

1104

goto abort_put_sess;

1104

goto abort_put_sess;

1105

tunnel = pppol2tp_sock_to_tunnel(sk_tun);

1105

tunnel = pppol2tp_sock_to_tunnel(sk_tun);

1106

if (tunnel == NULL)

1106

if (tunnel == NULL)

1107

goto abort_put_sess;

1107

goto abort_put_sess;

1108

1109

/* What header length is configured for this session? */

1109

/* What header length is configured for this session? */

1110

hdr_len = pppol2tp_l2tp_header_len(session);

1110

hdr_len = pppol2tp_l2tp_header_len(session);

1111

1112

/* Check that there's enough headroom in the skb to insert IP,

1112

/* Check that there's enough headroom in the skb to insert IP,

1113

* UDP and L2TP and PPP headers. If not enough, expand it to

1113

* UDP and L2TP and PPP headers. If not enough, expand it to

1114

* make room. Adjust truesize.

1114

* make room. Adjust truesize.

1115

*/

1115

*/

1116

headroom = NET_SKB_PAD + sizeof(struct iphdr) +

1116

headroom = NET_SKB_PAD + sizeof(struct iphdr) +

1117

sizeof(struct udphdr) + hdr_len + sizeof(ppph);

1117

sizeof(struct udphdr) + hdr_len + sizeof(ppph);

1118

old_headroom = skb_headroom(skb);

1118

old_headroom = skb_headroom(skb);

1119

if (skb_cow_head(skb, headroom))

1119

if (skb_cow_head(skb, headroom))

1120

goto abort_put_sess_tun;

1120

goto abort_put_sess_tun;

1121

1122

new_headroom = skb_headroom(skb);

1122

new_headroom = skb_headroom(skb);

1123

skb_orphan(skb);

1123

skb_orphan(skb);

1124

skb->truesize += new_headroom - old_headroom;

1124

skb->truesize += new_headroom - old_headroom;

1125

1126

/* Setup PPP header */

1126

/* Setup PPP header */

1127

__skb_push(skb, sizeof(ppph));

1127

__skb_push(skb, sizeof(ppph));

1128

skb->data[0] = ppph[0];

1128

skb->data[0] = ppph[0];

1129

skb->data[1] = ppph[1];

1129

skb->data[1] = ppph[1];

1130

1131

/* Setup L2TP header */

1131

/* Setup L2TP header */

1132

pppol2tp_build_l2tp_header(session, __skb_push(skb, hdr_len));

1132

pppol2tp_build_l2tp_header(session, __skb_push(skb, hdr_len));

1133

1134

udp_len = sizeof(struct udphdr) + hdr_len + sizeof(ppph) + data_len;

1134

udp_len = sizeof(struct udphdr) + hdr_len + sizeof(ppph) + data_len;

1135

1136

/* Setup UDP header */

1136

/* Setup UDP header */

1137

inet = inet_sk(sk_tun);

1137

inet = inet_sk(sk_tun);

1138

__skb_push(skb, sizeof(*uh));

1138

__skb_push(skb, sizeof(*uh));

1139

skb_reset_transport_header(skb);

1139

skb_reset_transport_header(skb);

1140

uh = udp_hdr(skb);

1140

uh = udp_hdr(skb);

1141

uh->source = inet->inet_sport;

1141

uh->source = inet->inet_sport;

1142

uh->dest = inet->inet_dport;

1142

uh->dest = inet->inet_dport;

1143

uh->len = htons(udp_len);

1143

uh->len = htons(udp_len);

1144

uh->check = 0;

1144

uh->check = 0;

1145

1146

/* Debug */

1146

/* Debug */

1147

if (session->send_seq)

1147

if (session->send_seq)

1148

PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,

1148

PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,

1149

"%s: send %d bytes, ns=%hu\n", session->name,

1149

"%s: send %d bytes, ns=%hu\n", session->name,

1150

data_len, session->ns - 1);

1150

data_len, session->ns - 1);

1151

else

1151

else

1152

PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,

1152

PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,

1153

"%s: send %d bytes\n", session->name, data_len);

1153

"%s: send %d bytes\n", session->name, data_len);

1154

1155

if (session->debug & PPPOL2TP_MSG_DATA) {

1155

if (session->debug & PPPOL2TP_MSG_DATA) {

1156

int i;

1156

int i;

1157

unsigned char *datap = skb->data;

1157

unsigned char *datap = skb->data;

1158

1159

printk(KERN_DEBUG "%s: xmit:", session->name);

1159

printk(KERN_DEBUG "%s: xmit:", session->name);

1160

for (i = 0; i < data_len; i++) {

1160

for (i = 0; i < data_len; i++) {

1161

printk(" %02X", *datap++);

1161

printk(" %02X", *datap++);

1162

if (i == 31) {

1162

if (i == 31) {

1163

printk(" ...");

1163

printk(" ...");

1164

break;

1164

break;

1165

}

1165

}

1166

}

1166

}

1167

printk("\n");

1167

printk("\n");

1168

}

1168

}

1169

1170

memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));

1170

memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));

1171

IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |

1171

IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |

1172

IPSKB_REROUTED);

1172

IPSKB_REROUTED);

1173

nf_reset(skb);

1173

nf_reset(skb);

1174

1175

/* Get routing info from the tunnel socket */

1175

/* Get routing info from the tunnel socket */

1176

skb_dst_drop(skb);

1176

skb_dst_drop(skb);

1177

skb_dst_set(skb, dst_clone(__sk_dst_get(sk_tun)));

1177

skb_dst_set(skb, dst_clone(__sk_dst_get(sk_tun)));

1178

pppol2tp_skb_set_owner_w(skb, sk_tun);

1178

pppol2tp_skb_set_owner_w(skb, sk_tun);

1179

1180

/* Calculate UDP checksum if configured to do so */

1180

/* Calculate UDP checksum if configured to do so */

1181

if (sk_tun->sk_no_check == UDP_CSUM_NOXMIT)

1181

if (sk_tun->sk_no_check == UDP_CSUM_NOXMIT)

1182

skb->ip_summed = CHECKSUM_NONE;

1182

skb->ip_summed = CHECKSUM_NONE;

1183

else if (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM)) {

1183

else if (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM)) {

1184

skb->ip_summed = CHECKSUM_COMPLETE;

1184

skb->ip_summed = CHECKSUM_COMPLETE;

1185

csum = skb_checksum(skb, 0, udp_len, 0);

1185

csum = skb_checksum(skb, 0, udp_len, 0);

1186

uh->check = csum_tcpudp_magic(inet->inet_saddr,

1186

uh->check = csum_tcpudp_magic(inet->inet_saddr,

1187

inet->inet_daddr,

1187

inet->inet_daddr,

1188

udp_len, IPPROTO_UDP, csum);

1188

udp_len, IPPROTO_UDP, csum);

1189

if (uh->check == 0)

1189

if (uh->check == 0)

1190

uh->check = CSUM_MANGLED_0;

1190

uh->check = CSUM_MANGLED_0;

1191

} else {

1191

} else {

1192

skb->ip_summed = CHECKSUM_PARTIAL;

1192

skb->ip_summed = CHECKSUM_PARTIAL;

1193

skb->csum_start = skb_transport_header(skb) - skb->head;

1193

skb->csum_start = skb_transport_header(skb) - skb->head;

1194

skb->csum_offset = offsetof(struct udphdr, check);

1194

skb->csum_offset = offsetof(struct udphdr, check);

1195

uh->check = ~csum_tcpudp_magic(inet->inet_saddr,

1195

uh->check = ~csum_tcpudp_magic(inet->inet_saddr,

1196

inet->inet_daddr,

1196

inet->inet_daddr,

1197

udp_len, IPPROTO_UDP, 0);

1197

udp_len, IPPROTO_UDP, 0);

1198

}

1198

}

1199

1200

/* Queue the packet to IP for output */

1200

/* Queue the packet to IP for output */

1201

len = skb->len;

1201

len = skb->len;

1202

rc = ip_queue_xmit(skb, 1);

1202

rc = ip_queue_xmit(skb, 1);

1203

1204

/* Update stats */

1204

/* Update stats */

1205

if (rc >= 0) {

1205

if (rc >= 0) {

1206

tunnel->stats.tx_packets++;

1206

tunnel->stats.tx_packets++;

1207

tunnel->stats.tx_bytes += len;

1207

tunnel->stats.tx_bytes += len;

1208

session->stats.tx_packets++;

1208

session->stats.tx_packets++;

1209

session->stats.tx_bytes += len;

1209

session->stats.tx_bytes += len;

1210

} else {

1210

} else {

1211

tunnel->stats.tx_errors++;

1211

tunnel->stats.tx_errors++;

1212

session->stats.tx_errors++;

1212

session->stats.tx_errors++;

1213

}

1213

}

1214

1215

sock_put(sk_tun);

1215

sock_put(sk_tun);

1216

sock_put(sk);

1216

sock_put(sk);

1217

return 1;

1217

return 1;

1218

1219

abort_put_sess_tun:

1219

abort_put_sess_tun:

1220

sock_put(sk_tun);

1220

sock_put(sk_tun);

1221

abort_put_sess:

1221

abort_put_sess:

1222

sock_put(sk);

1222

sock_put(sk);

1223

abort:

1223

abort:

1224

/* Free the original skb */

1224

/* Free the original skb */

1225

kfree_skb(skb);

1225

kfree_skb(skb);

1226

return 1;

1226

return 1;

1227

}

1227

}

1228

1229

/*****************************************************************************

1229

/*****************************************************************************

1230

* Session (and tunnel control) socket create/destroy.

1230

* Session (and tunnel control) socket create/destroy.

1231

*****************************************************************************/

1231

*****************************************************************************/

1232

1233

/* When the tunnel UDP socket is closed, all the attached sockets need to go

1233

/* When the tunnel UDP socket is closed, all the attached sockets need to go

1234

* too.

1234

* too.

1235

*/

1235

*/

1236

static void pppol2tp_tunnel_closeall(struct pppol2tp_tunnel *tunnel)

1236

static void pppol2tp_tunnel_closeall(struct pppol2tp_tunnel *tunnel)

1237

{

1237

{

1238

int hash;

1238

int hash;

1239

struct hlist_node *walk;

1239

struct hlist_node *walk;

1240

struct hlist_node *tmp;

1240

struct hlist_node *tmp;

1241

struct pppol2tp_session *session;

1241

struct pppol2tp_session *session;

1242

struct sock *sk;

1242

struct sock *sk;

1243

1244

BUG_ON(tunnel == NULL);

1244

BUG_ON(tunnel == NULL);

1245

1246

PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1246

PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1247

"%s: closing all sessions...\n", tunnel->name);

1247

"%s: closing all sessions...\n", tunnel->name);

1248

1249

write_lock_bh(&tunnel->hlist_lock);

1249

write_lock_bh(&tunnel->hlist_lock);

1250

for (hash = 0; hash < PPPOL2TP_HASH_SIZE; hash++) {

1250

for (hash = 0; hash < PPPOL2TP_HASH_SIZE; hash++) {

1251

again:

1251

again:

1252

hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {

1252

hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {

1253

struct sk_buff *skb;

1253

struct sk_buff *skb;

1254

1255

session = hlist_entry(walk, struct pppol2tp_session, hlist);

1255

session = hlist_entry(walk, struct pppol2tp_session, hlist);

1256

1257

sk = session->sock;

1257

sk = session->sock;

1258

1259

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1259

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1260

"%s: closing session\n", session->name);

1260

"%s: closing session\n", session->name);

1261

1262

hlist_del_init(&session->hlist);

1262

hlist_del_init(&session->hlist);

1263

1264

/* Since we should hold the sock lock while

1264

/* Since we should hold the sock lock while

1265

* doing any unbinding, we need to release the

1265

* doing any unbinding, we need to release the

1266

* lock we're holding before taking that lock.

1266

* lock we're holding before taking that lock.

1267

* Hold a reference to the sock so it doesn't

1267

* Hold a reference to the sock so it doesn't

1268

* disappear as we're jumping between locks.

1268

* disappear as we're jumping between locks.

1269

*/

1269

*/

1270

sock_hold(sk);

1270

sock_hold(sk);

1271

write_unlock_bh(&tunnel->hlist_lock);

1271

write_unlock_bh(&tunnel->hlist_lock);

1272

lock_sock(sk);

1272

lock_sock(sk);

1273

1274

if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {

1274

if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {

1275

pppox_unbind_sock(sk);

1275

pppox_unbind_sock(sk);

1276

sk->sk_state = PPPOX_DEAD;

1276

sk->sk_state = PPPOX_DEAD;

1277

sk->sk_state_change(sk);

1277

sk->sk_state_change(sk);

1278

}

1278

}

1279

1280

/* Purge any queued data */

1280

/* Purge any queued data */

1281

skb_queue_purge(&sk->sk_receive_queue);

1281

skb_queue_purge(&sk->sk_receive_queue);

1282

skb_queue_purge(&sk->sk_write_queue);

1282

skb_queue_purge(&sk->sk_write_queue);

1283

while ((skb = skb_dequeue(&session->reorder_q))) {

1283

while ((skb = skb_dequeue(&session->reorder_q))) {

1284

kfree_skb(skb);

1284

kfree_skb(skb);

1285

sock_put(sk);

1285

sock_put(sk);

1286

}

1286

}

1287

1288

release_sock(sk);

1288

release_sock(sk);

1289

sock_put(sk);

1289

sock_put(sk);

1290

1291

/* Now restart from the beginning of this hash

1291

/* Now restart from the beginning of this hash

1292

* chain. We always remove a session from the

1292

* chain. We always remove a session from the

1293

* list so we are guaranteed to make forward

1293

* list so we are guaranteed to make forward

1294

* progress.

1294

* progress.

1295

*/

1295

*/

1296

write_lock_bh(&tunnel->hlist_lock);

1296

write_lock_bh(&tunnel->hlist_lock);

1297

goto again;

1297

goto again;

1298

}

1298

}

1299

}

1299

}

1300

write_unlock_bh(&tunnel->hlist_lock);

1300

write_unlock_bh(&tunnel->hlist_lock);

1301

}

1301

}

1302

1303

/* Really kill the tunnel.

1303

/* Really kill the tunnel.

1304

* Come here only when all sessions have been cleared from the tunnel.

1304

* Come here only when all sessions have been cleared from the tunnel.

1305

*/

1305

*/

1306

static void pppol2tp_tunnel_free(struct pppol2tp_tunnel *tunnel)

1306

static void pppol2tp_tunnel_free(struct pppol2tp_tunnel *tunnel)

1307

{

1307

{

1308

struct pppol2tp_net *pn = pppol2tp_pernet(tunnel->pppol2tp_net);

1308

struct pppol2tp_net *pn = pppol2tp_pernet(tunnel->pppol2tp_net);

1309

1310

/* Remove from socket list */

1310

/* Remove from socket list */

1311

write_lock_bh(&pn->pppol2tp_tunnel_list_lock);

1311

write_lock_bh(&pn->pppol2tp_tunnel_list_lock);

1312

list_del_init(&tunnel->list);

1312

list_del_init(&tunnel->list);

1313

write_unlock_bh(&pn->pppol2tp_tunnel_list_lock);

1313

write_unlock_bh(&pn->pppol2tp_tunnel_list_lock);

1314

1315

atomic_dec(&pppol2tp_tunnel_count);

1315

atomic_dec(&pppol2tp_tunnel_count);

1316

kfree(tunnel);

1316

kfree(tunnel);

1317

}

1317

}

1318

1319

/* Tunnel UDP socket destruct hook.

1319

/* Tunnel UDP socket destruct hook.

1320

* The tunnel context is deleted only when all session sockets have been

1320

* The tunnel context is deleted only when all session sockets have been

1321

* closed.

1321

* closed.

1322

*/

1322

*/

1323

static void pppol2tp_tunnel_destruct(struct sock *sk)

1323

static void pppol2tp_tunnel_destruct(struct sock *sk)

1324

{

1324

{

1325

struct pppol2tp_tunnel *tunnel;

1325

struct pppol2tp_tunnel *tunnel;

1326

1327

tunnel = sk->sk_user_data;

1327

tunnel = sk->sk_user_data;

1328

if (tunnel == NULL)

1328

if (tunnel == NULL)

1329

goto end;

1329

goto end;

1330

1331

PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1331

PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1332

"%s: closing...\n", tunnel->name);

1332

"%s: closing...\n", tunnel->name);

1333

1334

/* Close all sessions */

1334

/* Close all sessions */

1335

pppol2tp_tunnel_closeall(tunnel);

1335

pppol2tp_tunnel_closeall(tunnel);

1336

1337

/* No longer an encapsulation socket. See net/ipv4/udp.c */

1337

/* No longer an encapsulation socket. See net/ipv4/udp.c */

1338

(udp_sk(sk))->encap_type = 0;

1338

(udp_sk(sk))->encap_type = 0;

1339

(udp_sk(sk))->encap_rcv = NULL;

1339

(udp_sk(sk))->encap_rcv = NULL;

1340

1341

/* Remove hooks into tunnel socket */

1341

/* Remove hooks into tunnel socket */

1342

tunnel->sock = NULL;

1342

tunnel->sock = NULL;

1343

sk->sk_destruct = tunnel->old_sk_destruct;

1343

sk->sk_destruct = tunnel->old_sk_destruct;

1344

sk->sk_user_data = NULL;

1344

sk->sk_user_data = NULL;

1345

1346

/* Call original (UDP) socket descructor */

1346

/* Call original (UDP) socket descructor */

1347

if (sk->sk_destruct != NULL)

1347

if (sk->sk_destruct != NULL)

1348

(*sk->sk_destruct)(sk);

1348

(*sk->sk_destruct)(sk);

1349

1350

pppol2tp_tunnel_dec_refcount(tunnel);

1350

pppol2tp_tunnel_dec_refcount(tunnel);

1351

1352

end:

1352

end:

1353

return;

1353

return;

1354

}

1354

}

1355

1356

/* Really kill the session socket. (Called from sock_put() if

1356

/* Really kill the session socket. (Called from sock_put() if

1357

* refcnt == 0.)

1357

* refcnt == 0.)

1358

*/

1358

*/

1359

static void pppol2tp_session_destruct(struct sock *sk)

1359

static void pppol2tp_session_destruct(struct sock *sk)

1360

{

1360

{

1361

struct pppol2tp_session *session = NULL;

1361

struct pppol2tp_session *session = NULL;

1362

1363

if (sk->sk_user_data != NULL) {

1363

if (sk->sk_user_data != NULL) {

1364

struct pppol2tp_tunnel *tunnel;

1364

struct pppol2tp_tunnel *tunnel;

1365

1366

session = sk->sk_user_data;

1366

session = sk->sk_user_data;

1367

if (session == NULL)

1367

if (session == NULL)

1368

goto out;

1368

goto out;

1369

1370

BUG_ON(session->magic != L2TP_SESSION_MAGIC);

1370

BUG_ON(session->magic != L2TP_SESSION_MAGIC);

1371

1372

/* Don't use pppol2tp_sock_to_tunnel() here to

1372

/* Don't use pppol2tp_sock_to_tunnel() here to

1373

* get the tunnel context because the tunnel

1373

* get the tunnel context because the tunnel

1374

* socket might have already been closed (its

1374

* socket might have already been closed (its

1375

* sk->sk_user_data will be NULL) so use the

1375

* sk->sk_user_data will be NULL) so use the

1376

* session's private tunnel ptr instead.

1376

* session's private tunnel ptr instead.

1377

*/

1377

*/

1378

tunnel = session->tunnel;

1378

tunnel = session->tunnel;

1379

if (tunnel != NULL) {

1379

if (tunnel != NULL) {

1380

BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);

1380

BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);

1381

1382

/* If session_id is zero, this is a null

1382

/* If session_id is zero, this is a null

1383

* session context, which was created for a

1383

* session context, which was created for a

1384

* socket that is being used only to manage

1384

* socket that is being used only to manage

1385

* tunnels.

1385

* tunnels.

1386

*/

1386

*/

1387

if (session->tunnel_addr.s_session != 0) {

1387

if (session->tunnel_addr.s_session != 0) {

1388

/* Delete the session socket from the

1388

/* Delete the session socket from the

1389

* hash

1389

* hash

1390

*/

1390

*/

1391

write_lock_bh(&tunnel->hlist_lock);

1391

write_lock_bh(&tunnel->hlist_lock);

1392

hlist_del_init(&session->hlist);

1392

hlist_del_init(&session->hlist);

1393

write_unlock_bh(&tunnel->hlist_lock);

1393

write_unlock_bh(&tunnel->hlist_lock);

1394

1395

atomic_dec(&pppol2tp_session_count);

1395

atomic_dec(&pppol2tp_session_count);

1396

}

1396

}

1397

1398

/* This will delete the tunnel context if this

1398

/* This will delete the tunnel context if this

1399

* is the last session on the tunnel.

1399

* is the last session on the tunnel.

1400

*/

1400

*/

1401

session->tunnel = NULL;

1401

session->tunnel = NULL;

1402

session->tunnel_sock = NULL;

1402

session->tunnel_sock = NULL;

1403

pppol2tp_tunnel_dec_refcount(tunnel);

1403

pppol2tp_tunnel_dec_refcount(tunnel);

1404

}

1404

}

1405

}

1405

}

1406

1407

kfree(session);

1407

kfree(session);

1408

out:

1408

out:

1409

return;

1409

return;

1410

}

1410

}

1411

1412

/* Called when the PPPoX socket (session) is closed.

1412

/* Called when the PPPoX socket (session) is closed.

1413

*/

1413

*/

1414

static int pppol2tp_release(struct socket *sock)

1414

static int pppol2tp_release(struct socket *sock)

1415

{

1415

{

1416

struct sock *sk = sock->sk;

1416

struct sock *sk = sock->sk;

1417

struct pppol2tp_session *session;

1417

struct pppol2tp_session *session;

1418

int error;

1418

int error;

1419

1420

if (!sk)

1420

if (!sk)

1421

return 0;

1421

return 0;

1422

1423

error = -EBADF;

1423

error = -EBADF;

1424

lock_sock(sk);

1424

lock_sock(sk);

1425

if (sock_flag(sk, SOCK_DEAD) != 0)

1425

if (sock_flag(sk, SOCK_DEAD) != 0)

1426

goto error;

1426

goto error;

1427

1428

pppox_unbind_sock(sk);

1428

pppox_unbind_sock(sk);

1429

1430

/* Signal the death of the socket. */

1430

/* Signal the death of the socket. */

1431

sk->sk_state = PPPOX_DEAD;

1431

sk->sk_state = PPPOX_DEAD;

1432

sock_orphan(sk);

1432

sock_orphan(sk);

1433

sock->sk = NULL;

1433

sock->sk = NULL;

1434

1435

session = pppol2tp_sock_to_session(sk);

1435

session = pppol2tp_sock_to_session(sk);

1436

1437

/* Purge any queued data */

1437

/* Purge any queued data */

1438

skb_queue_purge(&sk->sk_receive_queue);

1438

skb_queue_purge(&sk->sk_receive_queue);

1439

skb_queue_purge(&sk->sk_write_queue);

1439

skb_queue_purge(&sk->sk_write_queue);

1440

if (session != NULL) {

1440

if (session != NULL) {

1441

struct sk_buff *skb;

1441

struct sk_buff *skb;

1442

while ((skb = skb_dequeue(&session->reorder_q))) {

1442

while ((skb = skb_dequeue(&session->reorder_q))) {

1443

kfree_skb(skb);

1443

kfree_skb(skb);

1444

sock_put(sk);

1444

sock_put(sk);

1445

}

1445

}

1446

sock_put(sk);

1446

sock_put(sk);

1447

}

1447

}

1448

1449

release_sock(sk);

1449

release_sock(sk);

1450

1451

/* This will delete the session context via

1451

/* This will delete the session context via

1452

* pppol2tp_session_destruct() if the socket's refcnt drops to

1452

* pppol2tp_session_destruct() if the socket's refcnt drops to

1453

* zero.

1453

* zero.

1454

*/

1454

*/

1455

sock_put(sk);

1455

sock_put(sk);

1456

1457

return 0;

1457

return 0;

1458

1459

error:

1459

error:

1460

release_sock(sk);

1460

release_sock(sk);

1461

return error;

1461

return error;

1462

}

1462

}

1463

1464

/* Internal function to prepare a tunnel (UDP) socket to have PPPoX

1464

/* Internal function to prepare a tunnel (UDP) socket to have PPPoX

1465

* sockets attached to it.

1465

* sockets attached to it.

1466

*/

1466

*/

1467

static struct sock *pppol2tp_prepare_tunnel_socket(struct net *net,

1467

static struct sock *pppol2tp_prepare_tunnel_socket(struct net *net,

1468

int fd, u16 tunnel_id, int *error)

1468

int fd, u16 tunnel_id, int *error)

1469

{

1469

{

1470

int err;

1470

int err;

1471

struct socket *sock = NULL;

1471

struct socket *sock = NULL;

1472

struct sock *sk;

1472

struct sock *sk;

1473

struct pppol2tp_tunnel *tunnel;

1473

struct pppol2tp_tunnel *tunnel;

1474

struct pppol2tp_net *pn;

1474

struct pppol2tp_net *pn;

1475

struct sock *ret = NULL;

1475

struct sock *ret = NULL;

1476

1477

/* Get the tunnel UDP socket from the fd, which was opened by

1477

/* Get the tunnel UDP socket from the fd, which was opened by

1478

* the userspace L2TP daemon.

1478

* the userspace L2TP daemon.

1479

*/

1479

*/

1480

err = -EBADF;

1480

err = -EBADF;

1481

sock = sockfd_lookup(fd, &err);

1481

sock = sockfd_lookup(fd, &err);

1482

if (!sock) {

1482

if (!sock) {

1483

PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_ERR,

1483

PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_ERR,

1484

"tunl %hu: sockfd_lookup(fd=%d) returned %d\n",

1484

"tunl %hu: sockfd_lookup(fd=%d) returned %d\n",

1485

tunnel_id, fd, err);

1485

tunnel_id, fd, err);

1486

goto err;

1486

goto err;

1487

}

1487

}

1488

1489

sk = sock->sk;

1489

sk = sock->sk;

1490

1491

/* Quick sanity checks */

1491

/* Quick sanity checks */

1492

err = -EPROTONOSUPPORT;

1492

err = -EPROTONOSUPPORT;

1493

if (sk->sk_protocol != IPPROTO_UDP) {

1493

if (sk->sk_protocol != IPPROTO_UDP) {

1494

PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_ERR,

1494

PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_ERR,

1495

"tunl %hu: fd %d wrong protocol, got %d, expected %d\n",

1495

"tunl %hu: fd %d wrong protocol, got %d, expected %d\n",

1496

tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);

1496

tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);

1497

goto err;

1497

goto err;

1498

}

1498

}

1499

err = -EAFNOSUPPORT;

1499

err = -EAFNOSUPPORT;

1500

if (sock->ops->family != AF_INET) {

1500

if (sock->ops->family != AF_INET) {

1501

PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_ERR,

1501

PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_ERR,

1502

"tunl %hu: fd %d wrong family, got %d, expected %d\n",

1502

"tunl %hu: fd %d wrong family, got %d, expected %d\n",

1503

tunnel_id, fd, sock->ops->family, AF_INET);

1503

tunnel_id, fd, sock->ops->family, AF_INET);

1504

goto err;

1504

goto err;

1505

}

1505

}

1506

1507

err = -ENOTCONN;

1507

err = -ENOTCONN;

1508

1509

/* Check if this socket has already been prepped */

1509

/* Check if this socket has already been prepped */

1510

tunnel = (struct pppol2tp_tunnel *)sk->sk_user_data;

1510

tunnel = (struct pppol2tp_tunnel *)sk->sk_user_data;

1511

if (tunnel != NULL) {

1511

if (tunnel != NULL) {

1512

/* User-data field already set */

1512

/* User-data field already set */

1513

err = -EBUSY;

1513

err = -EBUSY;

1514

BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);

1514

BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);

1515

1516

/* This socket has already been prepped */

1516

/* This socket has already been prepped */

1517

ret = tunnel->sock;

1517

ret = tunnel->sock;

1518

goto out;

1518

goto out;

1519

}

1519

}

1520

1521

/* This socket is available and needs prepping. Create a new tunnel

1521

/* This socket is available and needs prepping. Create a new tunnel

1522

* context and init it.

1522

* context and init it.

1523

*/

1523

*/

1524

sk->sk_user_data = tunnel = kzalloc(sizeof(struct pppol2tp_tunnel), GFP_KERNEL);

1524

sk->sk_user_data = tunnel = kzalloc(sizeof(struct pppol2tp_tunnel), GFP_KERNEL);

1525

if (sk->sk_user_data == NULL) {

1525

if (sk->sk_user_data == NULL) {

1526

err = -ENOMEM;

1526

err = -ENOMEM;

1527

goto err;

1527

goto err;

1528

}

1528

}

1529

1530

tunnel->magic = L2TP_TUNNEL_MAGIC;

1530

tunnel->magic = L2TP_TUNNEL_MAGIC;

1531

sprintf(&tunnel->name[0], "tunl %hu", tunnel_id);

1531

sprintf(&tunnel->name[0], "tunl %hu", tunnel_id);

1532

1533

tunnel->stats.tunnel_id = tunnel_id;

1533

tunnel->stats.tunnel_id = tunnel_id;

1534

tunnel->debug = PPPOL2TP_DEFAULT_DEBUG_FLAGS;

1534

tunnel->debug = PPPOL2TP_DEFAULT_DEBUG_FLAGS;

1535

1536

/* Hook on the tunnel socket destructor so that we can cleanup

1536

/* Hook on the tunnel socket destructor so that we can cleanup

1537

* if the tunnel socket goes away.

1537

* if the tunnel socket goes away.

1538

*/

1538

*/

1539

tunnel->old_sk_destruct = sk->sk_destruct;

1539

tunnel->old_sk_destruct = sk->sk_destruct;

1540

sk->sk_destruct = pppol2tp_tunnel_destruct;

1540

sk->sk_destruct = pppol2tp_tunnel_destruct;

1541

1542

tunnel->sock = sk;

1542

tunnel->sock = sk;

1543

sk->sk_allocation = GFP_ATOMIC;

1543

sk->sk_allocation = GFP_ATOMIC;

1544

1545

/* Misc init */

1545

/* Misc init */

1546

rwlock_init(&tunnel->hlist_lock);

1546

rwlock_init(&tunnel->hlist_lock);

1547

1548

/* The net we belong to */

1548

/* The net we belong to */

1549

tunnel->pppol2tp_net = net;

1549

tunnel->pppol2tp_net = net;

1550

pn = pppol2tp_pernet(net);

1550

pn = pppol2tp_pernet(net);

1551

1552

/* Add tunnel to our list */

1552

/* Add tunnel to our list */

1553

INIT_LIST_HEAD(&tunnel->list);

1553

INIT_LIST_HEAD(&tunnel->list);

1554

write_lock_bh(&pn->pppol2tp_tunnel_list_lock);

1554

write_lock_bh(&pn->pppol2tp_tunnel_list_lock);

1555

list_add(&tunnel->list, &pn->pppol2tp_tunnel_list);

1555

list_add(&tunnel->list, &pn->pppol2tp_tunnel_list);

1556

write_unlock_bh(&pn->pppol2tp_tunnel_list_lock);

1556

write_unlock_bh(&pn->pppol2tp_tunnel_list_lock);

1557

atomic_inc(&pppol2tp_tunnel_count);

1557

atomic_inc(&pppol2tp_tunnel_count);

1558

1559

/* Bump the reference count. The tunnel context is deleted

1559

/* Bump the reference count. The tunnel context is deleted

1560

* only when this drops to zero.

1560

* only when this drops to zero.

1561

*/

1561

*/

1562

pppol2tp_tunnel_inc_refcount(tunnel);

1562

pppol2tp_tunnel_inc_refcount(tunnel);

1563

1564

/* Mark socket as an encapsulation socket. See net/ipv4/udp.c */

1564

/* Mark socket as an encapsulation socket. See net/ipv4/udp.c */

1565

(udp_sk(sk))->encap_type = UDP_ENCAP_L2TPINUDP;

1565

(udp_sk(sk))->encap_type = UDP_ENCAP_L2TPINUDP;

1566

(udp_sk(sk))->encap_rcv = pppol2tp_udp_encap_recv;

1566

(udp_sk(sk))->encap_rcv = pppol2tp_udp_encap_recv;

1567

1568

ret = tunnel->sock;

1568

ret = tunnel->sock;

1569

1570

*error = 0;

1570

*error = 0;

1571

out:

1571

out:

1572

if (sock)

1572

if (sock)

1573

sockfd_put(sock);

1573

sockfd_put(sock);

1574

1575

return ret;

1575

return ret;

1576

1577

err:

1577

err:

1578

*error = err;

1578

*error = err;

1579

goto out;

1579

goto out;

1580

}

1580

}

1581

1582

static struct proto pppol2tp_sk_proto = {

1582

static struct proto pppol2tp_sk_proto = {

1583

.name = "PPPOL2TP",

1583

.name = "PPPOL2TP",

1584

.owner = THIS_MODULE,

1584

.owner = THIS_MODULE,

1585

.obj_size = sizeof(struct pppox_sock),

1585

.obj_size = sizeof(struct pppox_sock),

1586

};

1586

};

1587

1588

/* socket() handler. Initialize a new struct sock.

1588

/* socket() handler. Initialize a new struct sock.

1589

*/

1589

*/

1590

static int pppol2tp_create(struct net *net, struct socket *sock)

1590

static int pppol2tp_create(struct net *net, struct socket *sock)

1591

{

1591

{

1592

int error = -ENOMEM;

1592

int error = -ENOMEM;

1593

struct sock *sk;

1593

struct sock *sk;

1594

1595

sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto);

1595

sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto);

1596

if (!sk)

1596

if (!sk)

1597

goto out;

1597

goto out;

1598

1599

sock_init_data(sock, sk);

1599

sock_init_data(sock, sk);

1600

1601

sock->state = SS_UNCONNECTED;

1601

sock->state = SS_UNCONNECTED;

1602

sock->ops = &pppol2tp_ops;

1602

sock->ops = &pppol2tp_ops;

1603

1604

sk->sk_backlog_rcv = pppol2tp_recv_core;

1604

sk->sk_backlog_rcv = pppol2tp_recv_core;

1605

sk->sk_protocol = PX_PROTO_OL2TP;

1605

sk->sk_protocol = PX_PROTO_OL2TP;

1606

sk->sk_family = PF_PPPOX;

1606

sk->sk_family = PF_PPPOX;

1607

sk->sk_state = PPPOX_NONE;

1607

sk->sk_state = PPPOX_NONE;

1608

sk->sk_type = SOCK_STREAM;

1608

sk->sk_type = SOCK_STREAM;

1609

sk->sk_destruct = pppol2tp_session_destruct;

1609

sk->sk_destruct = pppol2tp_session_destruct;

1610

1611

error = 0;

1611

error = 0;

1612

1613

out:

1613

out:

1614

return error;

1614

return error;

1615

}

1615

}

1616

1617

/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket

1617

/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket

1618

*/

1618

*/

1619

static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,

1619

static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,

1620

int sockaddr_len, int flags)

1620

int sockaddr_len, int flags)

1621

{

1621

{

1622

struct sock *sk = sock->sk;

1622

struct sock *sk = sock->sk;

1623

struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr;

1623

struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr;

1624

struct pppox_sock *po = pppox_sk(sk);

1624

struct pppox_sock *po = pppox_sk(sk);

1625

struct sock *tunnel_sock = NULL;

1625

struct sock *tunnel_sock = NULL;

1626

struct pppol2tp_session *session = NULL;

1626

struct pppol2tp_session *session = NULL;

1627

struct pppol2tp_tunnel *tunnel;

1627

struct pppol2tp_tunnel *tunnel;

1628

struct dst_entry *dst;

1628

struct dst_entry *dst;

1629

int error = 0;

1629

int error = 0;

1630

1631

lock_sock(sk);

1631

lock_sock(sk);

1632

1633

error = -EINVAL;

1633

error = -EINVAL;

1634

if (sp->sa_protocol != PX_PROTO_OL2TP)

1634

if (sp->sa_protocol != PX_PROTO_OL2TP)

1635

goto end;

1635

goto end;

1636

1637

/* Check for already bound sockets */

1637

/* Check for already bound sockets */

1638

error = -EBUSY;

1638

error = -EBUSY;

1639

if (sk->sk_state & PPPOX_CONNECTED)

1639

if (sk->sk_state & PPPOX_CONNECTED)

1640

goto end;

1640

goto end;

1641

1642

/* We don't supporting rebinding anyway */

1642

/* We don't supporting rebinding anyway */

1643

error = -EALREADY;

1643

error = -EALREADY;

1644

if (sk->sk_user_data)

1644

if (sk->sk_user_data)

1645

goto end; /* socket is already attached */

1645

goto end; /* socket is already attached */

1646

1647

/* Don't bind if s_tunnel is 0 */

1647

/* Don't bind if s_tunnel is 0 */

1648

error = -EINVAL;

1648

error = -EINVAL;

1649

if (sp->pppol2tp.s_tunnel == 0)

1649

if (sp->pppol2tp.s_tunnel == 0)

1650

goto end;

1650

goto end;

1651

1652

/* Special case: prepare tunnel socket if s_session and

1652

/* Special case: prepare tunnel socket if s_session and

1653

* d_session is 0. Otherwise look up tunnel using supplied

1653

* d_session is 0. Otherwise look up tunnel using supplied

1654

* tunnel id.

1654

* tunnel id.

1655

*/

1655

*/

1656

if ((sp->pppol2tp.s_session == 0) && (sp->pppol2tp.d_session == 0)) {

1656

if ((sp->pppol2tp.s_session == 0) && (sp->pppol2tp.d_session == 0)) {

1657

tunnel_sock = pppol2tp_prepare_tunnel_socket(sock_net(sk),

1657

tunnel_sock = pppol2tp_prepare_tunnel_socket(sock_net(sk),

1658

sp->pppol2tp.fd,

1658

sp->pppol2tp.fd,

1659

sp->pppol2tp.s_tunnel,

1659

sp->pppol2tp.s_tunnel,

1660

&error);

1660

&error);

1661

if (tunnel_sock == NULL)

1661

if (tunnel_sock == NULL)

1662

goto end;

1662

goto end;

1663

1664

tunnel = tunnel_sock->sk_user_data;

1664

tunnel = tunnel_sock->sk_user_data;

1665

} else {

1665

} else {

1666

tunnel = pppol2tp_tunnel_find(sock_net(sk), sp->pppol2tp.s_tunnel);

1666

tunnel = pppol2tp_tunnel_find(sock_net(sk), sp->pppol2tp.s_tunnel);

1667

1668

/* Error if we can't find the tunnel */

1668

/* Error if we can't find the tunnel */

1669

error = -ENOENT;

1669

error = -ENOENT;

1670

if (tunnel == NULL)

1670

if (tunnel == NULL)

1671

goto end;

1671

goto end;

1672

1673

tunnel_sock = tunnel->sock;

1673

tunnel_sock = tunnel->sock;

1674

}

1674

}

1675

1676

/* Check that this session doesn't already exist */

1676

/* Check that this session doesn't already exist */

1677

error = -EEXIST;

1677

error = -EEXIST;

1678

session = pppol2tp_session_find(tunnel, sp->pppol2tp.s_session);

1678

session = pppol2tp_session_find(tunnel, sp->pppol2tp.s_session);

1679

if (session != NULL)

1679

if (session != NULL)

1680

goto end;

1680

goto end;

1681

1682

/* Allocate and initialize a new session context. */

1682

/* Allocate and initialize a new session context. */

1683

session = kzalloc(sizeof(struct pppol2tp_session), GFP_KERNEL);

1683

session = kzalloc(sizeof(struct pppol2tp_session), GFP_KERNEL);

1684

if (session == NULL) {

1684

if (session == NULL) {

1685

error = -ENOMEM;

1685

error = -ENOMEM;

1686

goto end;

1686

goto end;

1687

}

1687

}

1688

1689

skb_queue_head_init(&session->reorder_q);

1689

skb_queue_head_init(&session->reorder_q);

1690

1691

session->magic = L2TP_SESSION_MAGIC;

1691

session->magic = L2TP_SESSION_MAGIC;

1692

session->owner = current->pid;

1692

session->owner = current->pid;

1693

session->sock = sk;

1693

session->sock = sk;

1694

session->tunnel = tunnel;

1694

session->tunnel = tunnel;

1695

session->tunnel_sock = tunnel_sock;

1695

session->tunnel_sock = tunnel_sock;

1696

session->tunnel_addr = sp->pppol2tp;

1696

session->tunnel_addr = sp->pppol2tp;

1697

sprintf(&session->name[0], "sess %hu/%hu",

1697

sprintf(&session->name[0], "sess %hu/%hu",

1698

session->tunnel_addr.s_tunnel,

1698

session->tunnel_addr.s_tunnel,

1699

session->tunnel_addr.s_session);

1699

session->tunnel_addr.s_session);

1700

1701

session->stats.tunnel_id = session->tunnel_addr.s_tunnel;

1701

session->stats.tunnel_id = session->tunnel_addr.s_tunnel;

1702

session->stats.session_id = session->tunnel_addr.s_session;

1702

session->stats.session_id = session->tunnel_addr.s_session;

1703

1704

INIT_HLIST_NODE(&session->hlist);

1704

INIT_HLIST_NODE(&session->hlist);

1705

1706

/* Inherit debug options from tunnel */

1706

/* Inherit debug options from tunnel */

1707

session->debug = tunnel->debug;

1707

session->debug = tunnel->debug;

1708

1709

/* Default MTU must allow space for UDP/L2TP/PPP

1709

/* Default MTU must allow space for UDP/L2TP/PPP

1710

* headers.

1710

* headers.

1711

*/

1711

*/

1712

session->mtu = session->mru = 1500 - PPPOL2TP_HEADER_OVERHEAD;

1712

session->mtu = session->mru = 1500 - PPPOL2TP_HEADER_OVERHEAD;

1713

1714

/* If PMTU discovery was enabled, use the MTU that was discovered */

1714

/* If PMTU discovery was enabled, use the MTU that was discovered */

1715

dst = sk_dst_get(sk);

1715

dst = sk_dst_get(sk);

1716

if (dst != NULL) {

1716

if (dst != NULL) {

1717

u32 pmtu = dst_mtu(__sk_dst_get(sk));

1717

u32 pmtu = dst_mtu(__sk_dst_get(sk));

1718

if (pmtu != 0)

1718

if (pmtu != 0)

1719

session->mtu = session->mru = pmtu -

1719

session->mtu = session->mru = pmtu -

1720

PPPOL2TP_HEADER_OVERHEAD;

1720

PPPOL2TP_HEADER_OVERHEAD;

1721

dst_release(dst);

1721

dst_release(dst);

1722

}

1722

}

1723

1724

/* Special case: if source & dest session_id == 0x0000, this socket is

1724

/* Special case: if source & dest session_id == 0x0000, this socket is

1725

* being created to manage the tunnel. Don't add the session to the

1725

* being created to manage the tunnel. Don't add the session to the

1726

* session hash list, just set up the internal context for use by

1726

* session hash list, just set up the internal context for use by

1727

* ioctl() and sockopt() handlers.

1727

* ioctl() and sockopt() handlers.

1728

*/

1728

*/

1729

if ((session->tunnel_addr.s_session == 0) &&

1729

if ((session->tunnel_addr.s_session == 0) &&

1730

(session->tunnel_addr.d_session == 0)) {

1730

(session->tunnel_addr.d_session == 0)) {

1731

error = 0;

1731

error = 0;

1732

sk->sk_user_data = session;

1732

sk->sk_user_data = session;

1733

goto out_no_ppp;

1733

goto out_no_ppp;

1734

}

1734

}

1735

1736

/* Get tunnel context from the tunnel socket */

1736

/* Get tunnel context from the tunnel socket */

1737

tunnel = pppol2tp_sock_to_tunnel(tunnel_sock);

1737

tunnel = pppol2tp_sock_to_tunnel(tunnel_sock);

1738

if (tunnel == NULL) {

1738

if (tunnel == NULL) {

1739

error = -EBADF;

1739

error = -EBADF;

1740

goto end;

1740

goto end;

1741

}

1741

}

1742

1743

/* Right now, because we don't have a way to push the incoming skb's

1743

/* Right now, because we don't have a way to push the incoming skb's

1744

* straight through the UDP layer, the only header we need to worry

1744

* straight through the UDP layer, the only header we need to worry

1745

* about is the L2TP header. This size is different depending on

1745

* about is the L2TP header. This size is different depending on

1746

* whether sequence numbers are enabled for the data channel.

1746

* whether sequence numbers are enabled for the data channel.

1747

*/

1747

*/

1748

po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;

1748

po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;

1749

1750

po->chan.private = sk;

1750

po->chan.private = sk;

1751

po->chan.ops = &pppol2tp_chan_ops;

1751

po->chan.ops = &pppol2tp_chan_ops;

1752

po->chan.mtu = session->mtu;

1752

po->chan.mtu = session->mtu;

1753

1754

error = ppp_register_net_channel(sock_net(sk), &po->chan);

1754

error = ppp_register_net_channel(sock_net(sk), &po->chan);

1755

if (error)

1755

if (error)

1756

goto end_put_tun;

1756

goto end_put_tun;

1757

1758

/* This is how we get the session context from the socket. */

1758

/* This is how we get the session context from the socket. */

1759

sk->sk_user_data = session;

1759

sk->sk_user_data = session;

1760

1761

/* Add session to the tunnel's hash list */

1761

/* Add session to the tunnel's hash list */

1762

write_lock_bh(&tunnel->hlist_lock);

1762

write_lock_bh(&tunnel->hlist_lock);

1763

hlist_add_head(&session->hlist,

1763

hlist_add_head(&session->hlist,

1764

pppol2tp_session_id_hash(tunnel,

1764

pppol2tp_session_id_hash(tunnel,

1765

session->tunnel_addr.s_session));

1765

session->tunnel_addr.s_session));

1766

write_unlock_bh(&tunnel->hlist_lock);

1766

write_unlock_bh(&tunnel->hlist_lock);

1767

1768

atomic_inc(&pppol2tp_session_count);

1768

atomic_inc(&pppol2tp_session_count);

1769

1770

out_no_ppp:

1770

out_no_ppp:

1771

pppol2tp_tunnel_inc_refcount(tunnel);

1771

pppol2tp_tunnel_inc_refcount(tunnel);

1772

sk->sk_state = PPPOX_CONNECTED;

1772

sk->sk_state = PPPOX_CONNECTED;

1773

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1773

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1774

"%s: created\n", session->name);

1774

"%s: created\n", session->name);

1775

1776

end_put_tun:

1776

end_put_tun:

1777

sock_put(tunnel_sock);

1777

sock_put(tunnel_sock);

1778

end:

1778

end:

1779

release_sock(sk);

1779

release_sock(sk);

1780

1781

if (error != 0) {

1781

if (error != 0) {

1782

if (session)

1782

if (session)

1783

PRINTK(session->debug,

1783

PRINTK(session->debug,

1784

PPPOL2TP_MSG_CONTROL, KERN_WARNING,

1784

PPPOL2TP_MSG_CONTROL, KERN_WARNING,

1785

"%s: connect failed: %d\n",

1785

"%s: connect failed: %d\n",

1786

session->name, error);

1786

session->name, error);

1787

else

1787

else

1788

PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_WARNING,

1788

PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_WARNING,

1789

"connect failed: %d\n", error);

1789

"connect failed: %d\n", error);

1790

}

1790

}

1791

1792

return error;

1792

return error;

1793

}

1793

}

1794

1795

/* getname() support.

1795

/* getname() support.

1796

*/

1796

*/

1797

static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,

1797

static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,

1798

int *usockaddr_len, int peer)

1798

int *usockaddr_len, int peer)

1799

{

1799

{

1800

int len = sizeof(struct sockaddr_pppol2tp);

1800

int len = sizeof(struct sockaddr_pppol2tp);

1801

struct sockaddr_pppol2tp sp;

1801

struct sockaddr_pppol2tp sp;

1802

int error = 0;

1802

int error = 0;

1803

struct pppol2tp_session *session;

1803

struct pppol2tp_session *session;

1804

1805

error = -ENOTCONN;

1805

error = -ENOTCONN;

1806

if (sock->sk->sk_state != PPPOX_CONNECTED)

1806

if (sock->sk->sk_state != PPPOX_CONNECTED)

1807

goto end;

1807

goto end;

1808

1809

session = pppol2tp_sock_to_session(sock->sk);

1809

session = pppol2tp_sock_to_session(sock->sk);

1810

if (session == NULL) {

1810

if (session == NULL) {

1811

error = -EBADF;

1811

error = -EBADF;

1812

goto end;

1812

goto end;

1813

}

1813

}

1814

1815

sp.sa_family = AF_PPPOX;

1815

sp.sa_family = AF_PPPOX;

1816

sp.sa_protocol = PX_PROTO_OL2TP;

1816

sp.sa_protocol = PX_PROTO_OL2TP;

1817

memcpy(&sp.pppol2tp, &session->tunnel_addr,

1817

memcpy(&sp.pppol2tp, &session->tunnel_addr,

1818

sizeof(struct pppol2tp_addr));

1818

sizeof(struct pppol2tp_addr));

1819

1820

memcpy(uaddr, &sp, len);

1820

memcpy(uaddr, &sp, len);

1821

1822

*usockaddr_len = len;

1822

*usockaddr_len = len;

1823

1824

error = 0;

1824

error = 0;

1825

sock_put(sock->sk);

1825

sock_put(sock->sk);

1826

1827

end:

1827

end:

1828

return error;

1828

return error;

1829

}

1829

}

1830

1831

/****************************************************************************

1831

/****************************************************************************

1832

* ioctl() handlers.

1832

* ioctl() handlers.

1833

*

1833

*

1834

* The PPPoX socket is created for L2TP sessions: tunnels have their own UDP

1834

* The PPPoX socket is created for L2TP sessions: tunnels have their own UDP

1835

* sockets. However, in order to control kernel tunnel features, we allow

1835

* sockets. However, in order to control kernel tunnel features, we allow

1836

* userspace to create a special "tunnel" PPPoX socket which is used for

1836

* userspace to create a special "tunnel" PPPoX socket which is used for

1837

* control only. Tunnel PPPoX sockets have session_id == 0 and simply allow

1837

* control only. Tunnel PPPoX sockets have session_id == 0 and simply allow

1838

* the user application to issue L2TP setsockopt(), getsockopt() and ioctl()

1838

* the user application to issue L2TP setsockopt(), getsockopt() and ioctl()

1839

* calls.

1839

* calls.

1840

****************************************************************************/

1840

****************************************************************************/

1841

1842

/* Session ioctl helper.

1842

/* Session ioctl helper.

1843

*/

1843

*/

1844

static int pppol2tp_session_ioctl(struct pppol2tp_session *session,

1844

static int pppol2tp_session_ioctl(struct pppol2tp_session *session,

1845

unsigned int cmd, unsigned long arg)

1845

unsigned int cmd, unsigned long arg)

1846

{

1846

{

1847

struct ifreq ifr;

1847

struct ifreq ifr;

1848

int err = 0;

1848

int err = 0;

1849

struct sock *sk = session->sock;

1849

struct sock *sk = session->sock;

1850

int val = (int) arg;

1850

int val = (int) arg;

1851

1852

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_DEBUG,

1852

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_DEBUG,

1853

"%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n",

1853

"%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n",

1854

session->name, cmd, arg);

1854

session->name, cmd, arg);

1855

1856

sock_hold(sk);

1856

sock_hold(sk);

1857

1858

switch (cmd) {

1858

switch (cmd) {

1859

case SIOCGIFMTU:

1859

case SIOCGIFMTU:

1860

err = -ENXIO;

1860

err = -ENXIO;

1861

if (!(sk->sk_state & PPPOX_CONNECTED))

1861

if (!(sk->sk_state & PPPOX_CONNECTED))

1862

break;

1862

break;

1863

1864

err = -EFAULT;

1864

err = -EFAULT;

1865

if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq)))

1865

if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq)))

1866

break;

1866

break;

1867

ifr.ifr_mtu = session->mtu;

1867

ifr.ifr_mtu = session->mtu;

1868

if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq)))

1868

if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq)))

1869

break;

1869

break;

1870

1871

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1871

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1872

"%s: get mtu=%d\n", session->name, session->mtu);

1872

"%s: get mtu=%d\n", session->name, session->mtu);

1873

err = 0;

1873

err = 0;

1874

break;

1874

break;

1875

1876

case SIOCSIFMTU:

1876

case SIOCSIFMTU:

1877

err = -ENXIO;

1877

err = -ENXIO;

1878

if (!(sk->sk_state & PPPOX_CONNECTED))

1878

if (!(sk->sk_state & PPPOX_CONNECTED))

1879

break;

1879

break;

1880

1881

err = -EFAULT;

1881

err = -EFAULT;

1882

if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq)))

1882

if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq)))

1883

break;

1883

break;

1884

1885

session->mtu = ifr.ifr_mtu;

1885

session->mtu = ifr.ifr_mtu;

1886

1887

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1887

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1888

"%s: set mtu=%d\n", session->name, session->mtu);

1888

"%s: set mtu=%d\n", session->name, session->mtu);

1889

err = 0;

1889

err = 0;

1890

break;

1890

break;

1891

1892

case PPPIOCGMRU:

1892

case PPPIOCGMRU:

1893

err = -ENXIO;

1893

err = -ENXIO;

1894

if (!(sk->sk_state & PPPOX_CONNECTED))

1894

if (!(sk->sk_state & PPPOX_CONNECTED))

1895

break;

1895

break;

1896

1897

err = -EFAULT;

1897

err = -EFAULT;

1898

if (put_user(session->mru, (int __user *) arg))

1898

if (put_user(session->mru, (int __user *) arg))

1899

break;

1899

break;

1900

1901

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1901

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1902

"%s: get mru=%d\n", session->name, session->mru);

1902

"%s: get mru=%d\n", session->name, session->mru);

1903

err = 0;

1903

err = 0;

1904

break;

1904

break;

1905

1906

case PPPIOCSMRU:

1906

case PPPIOCSMRU:

1907

err = -ENXIO;

1907

err = -ENXIO;

1908

if (!(sk->sk_state & PPPOX_CONNECTED))

1908

if (!(sk->sk_state & PPPOX_CONNECTED))

1909

break;

1909

break;

1910

1911

err = -EFAULT;

1911

err = -EFAULT;

1912

if (get_user(val,(int __user *) arg))

1912

if (get_user(val,(int __user *) arg))

1913

break;

1913

break;

1914

1915

session->mru = val;

1915

session->mru = val;

1916

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1916

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1917

"%s: set mru=%d\n", session->name, session->mru);

1917

"%s: set mru=%d\n", session->name, session->mru);

1918

err = 0;

1918

err = 0;

1919

break;

1919

break;

1920

1921

case PPPIOCGFLAGS:

1921

case PPPIOCGFLAGS:

1922

err = -EFAULT;

1922

err = -EFAULT;

1923

if (put_user(session->flags, (int __user *) arg))

1923

if (put_user(session->flags, (int __user *) arg))

1924

break;

1924

break;

1925

1926

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1926

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1927

"%s: get flags=%d\n", session->name, session->flags);

1927

"%s: get flags=%d\n", session->name, session->flags);

1928

err = 0;

1928

err = 0;

1929

break;

1929

break;

1930

1931

case PPPIOCSFLAGS:

1931

case PPPIOCSFLAGS:

1932

err = -EFAULT;

1932

err = -EFAULT;

1933

if (get_user(val, (int __user *) arg))

1933

if (get_user(val, (int __user *) arg))

1934

break;

1934

break;

1935

session->flags = val;

1935

session->flags = val;

1936

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1936

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1937

"%s: set flags=%d\n", session->name, session->flags);

1937

"%s: set flags=%d\n", session->name, session->flags);

1938

err = 0;

1938

err = 0;

1939

break;

1939

break;

1940

1941

case PPPIOCGL2TPSTATS:

1941

case PPPIOCGL2TPSTATS:

1942

err = -ENXIO;

1942

err = -ENXIO;

1943

if (!(sk->sk_state & PPPOX_CONNECTED))

1943

if (!(sk->sk_state & PPPOX_CONNECTED))

1944

break;

1944

break;

1945

1946

if (copy_to_user((void __user *) arg, &session->stats,

1946

if (copy_to_user((void __user *) arg, &session->stats,

1947

sizeof(session->stats)))

1947

sizeof(session->stats)))

1948

break;

1948

break;

1949

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1949

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

1950

"%s: get L2TP stats\n", session->name);

1950

"%s: get L2TP stats\n", session->name);

1951

err = 0;

1951

err = 0;

1952

break;

1952

break;

1953

1954

default:

1954

default:

1955

err = -ENOSYS;

1955

err = -ENOSYS;

1956

break;

1956

break;

1957

}

1957

}

1958

1959

sock_put(sk);

1959

sock_put(sk);

1960

1961

return err;

1961

return err;

1962

}

1962

}

1963

1964

/* Tunnel ioctl helper.

1964

/* Tunnel ioctl helper.

1965

*

1965

*

1966

* Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data

1966

* Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data

1967

* specifies a session_id, the session ioctl handler is called. This allows an

1967

* specifies a session_id, the session ioctl handler is called. This allows an

1968

* application to retrieve session stats via a tunnel socket.

1968

* application to retrieve session stats via a tunnel socket.

1969

*/

1969

*/

1970

static int pppol2tp_tunnel_ioctl(struct pppol2tp_tunnel *tunnel,

1970

static int pppol2tp_tunnel_ioctl(struct pppol2tp_tunnel *tunnel,

1971

unsigned int cmd, unsigned long arg)

1971

unsigned int cmd, unsigned long arg)

1972

{

1972

{

1973

int err = 0;

1973

int err = 0;

1974

struct sock *sk = tunnel->sock;

1974

struct sock *sk = tunnel->sock;

1975

struct pppol2tp_ioc_stats stats_req;

1975

struct pppol2tp_ioc_stats stats_req;

1976

1977

PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_DEBUG,

1977

PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_DEBUG,

1978

"%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n", tunnel->name,

1978

"%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n", tunnel->name,

1979

cmd, arg);

1979

cmd, arg);

1980

1981

sock_hold(sk);

1981

sock_hold(sk);

1982

1983

switch (cmd) {

1983

switch (cmd) {

1984

case PPPIOCGL2TPSTATS:

1984

case PPPIOCGL2TPSTATS:

1985

err = -ENXIO;

1985

err = -ENXIO;

1986

if (!(sk->sk_state & PPPOX_CONNECTED))

1986

if (!(sk->sk_state & PPPOX_CONNECTED))

1987

break;

1987

break;

1988

1989

if (copy_from_user(&stats_req, (void __user *) arg,

1989

if (copy_from_user(&stats_req, (void __user *) arg,

1990

sizeof(stats_req))) {

1990

sizeof(stats_req))) {

1991

err = -EFAULT;

1991

err = -EFAULT;

1992

break;

1992

break;

1993

}

1993

}

1994

if (stats_req.session_id != 0) {

1994

if (stats_req.session_id != 0) {

1995

/* resend to session ioctl handler */

1995

/* resend to session ioctl handler */

1996

struct pppol2tp_session *session =

1996

struct pppol2tp_session *session =

1997

pppol2tp_session_find(tunnel, stats_req.session_id);

1997

pppol2tp_session_find(tunnel, stats_req.session_id);

1998

if (session != NULL)

1998

if (session != NULL)

1999

err = pppol2tp_session_ioctl(session, cmd, arg);

1999

err = pppol2tp_session_ioctl(session, cmd, arg);

2000

else

2000

else

2001

err = -EBADR;

2001

err = -EBADR;

2002

break;

2002

break;

2003

}

2003

}

2004

#ifdef CONFIG_XFRM

2004

#ifdef CONFIG_XFRM

2005

tunnel->stats.using_ipsec = (sk->sk_policy[0] || sk->sk_policy[1]) ? 1 : 0;

2005

tunnel->stats.using_ipsec = (sk->sk_policy[0] || sk->sk_policy[1]) ? 1 : 0;

2006

#endif

2006

#endif

2007

if (copy_to_user((void __user *) arg, &tunnel->stats,

2007

if (copy_to_user((void __user *) arg, &tunnel->stats,

2008

sizeof(tunnel->stats))) {

2008

sizeof(tunnel->stats))) {

2009

err = -EFAULT;

2009

err = -EFAULT;

2010

break;

2010

break;

2011

}

2011

}

2012

PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2012

PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2013

"%s: get L2TP stats\n", tunnel->name);

2013

"%s: get L2TP stats\n", tunnel->name);

2014

err = 0;

2014

err = 0;

2015

break;

2015

break;

2016

2017

default:

2017

default:

2018

err = -ENOSYS;

2018

err = -ENOSYS;

2019

break;

2019

break;

2020

}

2020

}

2021

2022

sock_put(sk);

2022

sock_put(sk);

2023

2024

return err;

2024

return err;

2025

}

2025

}

2026

2027

/* Main ioctl() handler.

2027

/* Main ioctl() handler.

2028

* Dispatch to tunnel or session helpers depending on the socket.

2028

* Dispatch to tunnel or session helpers depending on the socket.

2029

*/

2029

*/

2030

static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,

2030

static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,

2031

unsigned long arg)

2031

unsigned long arg)

2032

{

2032

{

2033

struct sock *sk = sock->sk;

2033

struct sock *sk = sock->sk;

2034

struct pppol2tp_session *session;

2034

struct pppol2tp_session *session;

2035

struct pppol2tp_tunnel *tunnel;

2035

struct pppol2tp_tunnel *tunnel;

2036

int err;

2036

int err;

2037

2038

if (!sk)

2038

if (!sk)

2039

return 0;

2039

return 0;

2040

2041

err = -EBADF;

2041

err = -EBADF;

2042

if (sock_flag(sk, SOCK_DEAD) != 0)

2042

if (sock_flag(sk, SOCK_DEAD) != 0)

2043

goto end;

2043

goto end;

2044

2045

err = -ENOTCONN;

2045

err = -ENOTCONN;

2046

if ((sk->sk_user_data == NULL) ||

2046

if ((sk->sk_user_data == NULL) ||

2047

(!(sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND))))

2047

(!(sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND))))

2048

goto end;

2048

goto end;

2049

2050

/* Get session context from the socket */

2050

/* Get session context from the socket */

2051

err = -EBADF;

2051

err = -EBADF;

2052

session = pppol2tp_sock_to_session(sk);

2052

session = pppol2tp_sock_to_session(sk);

2053

if (session == NULL)

2053

if (session == NULL)

2054

goto end;

2054

goto end;

2055

2056

/* Special case: if session's session_id is zero, treat ioctl as a

2056

/* Special case: if session's session_id is zero, treat ioctl as a

2057

* tunnel ioctl

2057

* tunnel ioctl

2058

*/

2058

*/

2059

if ((session->tunnel_addr.s_session == 0) &&

2059

if ((session->tunnel_addr.s_session == 0) &&

2060

(session->tunnel_addr.d_session == 0)) {

2060

(session->tunnel_addr.d_session == 0)) {

2061

err = -EBADF;

2061

err = -EBADF;

2062

tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);

2062

tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);

2063

if (tunnel == NULL)

2063

if (tunnel == NULL)

2064

goto end_put_sess;

2064

goto end_put_sess;

2065

2066

err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg);

2066

err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg);

2067

sock_put(session->tunnel_sock);

2067

sock_put(session->tunnel_sock);

2068

goto end_put_sess;

2068

goto end_put_sess;

2069

}

2069

}

2070

2071

err = pppol2tp_session_ioctl(session, cmd, arg);

2071

err = pppol2tp_session_ioctl(session, cmd, arg);

2072

2073

end_put_sess:

2073

end_put_sess:

2074

sock_put(sk);

2074

sock_put(sk);

2075

end:

2075

end:

2076

return err;

2076

return err;

2077

}

2077

}

2078

2079

/*****************************************************************************

2079

/*****************************************************************************

2080

* setsockopt() / getsockopt() support.

2080

* setsockopt() / getsockopt() support.

2081

*

2081

*

2082

* The PPPoX socket is created for L2TP sessions: tunnels have their own UDP

2082

* The PPPoX socket is created for L2TP sessions: tunnels have their own UDP

2083

* sockets. In order to control kernel tunnel features, we allow userspace to

2083

* sockets. In order to control kernel tunnel features, we allow userspace to

2084

* create a special "tunnel" PPPoX socket which is used for control only.

2084

* create a special "tunnel" PPPoX socket which is used for control only.

2085

* Tunnel PPPoX sockets have session_id == 0 and simply allow the user

2085

* Tunnel PPPoX sockets have session_id == 0 and simply allow the user

2086

* application to issue L2TP setsockopt(), getsockopt() and ioctl() calls.

2086

* application to issue L2TP setsockopt(), getsockopt() and ioctl() calls.

2087

*****************************************************************************/

2087

*****************************************************************************/

2088

2089

/* Tunnel setsockopt() helper.

2089

/* Tunnel setsockopt() helper.

2090

*/

2090

*/

2091

static int pppol2tp_tunnel_setsockopt(struct sock *sk,

2091

static int pppol2tp_tunnel_setsockopt(struct sock *sk,

2092

struct pppol2tp_tunnel *tunnel,

2092

struct pppol2tp_tunnel *tunnel,

2093

int optname, int val)

2093

int optname, int val)

2094

{

2094

{

2095

int err = 0;

2095

int err = 0;

2096

2097

switch (optname) {

2097

switch (optname) {

2098

case PPPOL2TP_SO_DEBUG:

2098

case PPPOL2TP_SO_DEBUG:

2099

tunnel->debug = val;

2099

tunnel->debug = val;

2100

PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2100

PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2101

"%s: set debug=%x\n", tunnel->name, tunnel->debug);

2101

"%s: set debug=%x\n", tunnel->name, tunnel->debug);

2102

break;

2102

break;

2103

2104

default:

2104

default:

2105

err = -ENOPROTOOPT;

2105

err = -ENOPROTOOPT;

2106

break;

2106

break;

2107

}

2107

}

2108

2109

return err;

2109

return err;

2110

}

2110

}

2111

2112

/* Session setsockopt helper.

2112

/* Session setsockopt helper.

2113

*/

2113

*/

2114

static int pppol2tp_session_setsockopt(struct sock *sk,

2114

static int pppol2tp_session_setsockopt(struct sock *sk,

2115

struct pppol2tp_session *session,

2115

struct pppol2tp_session *session,

2116

int optname, int val)

2116

int optname, int val)

2117

{

2117

{

2118

int err = 0;

2118

int err = 0;

2119

2120

switch (optname) {

2120

switch (optname) {

2121

case PPPOL2TP_SO_RECVSEQ:

2121

case PPPOL2TP_SO_RECVSEQ:

2122

if ((val != 0) && (val != 1)) {

2122

if ((val != 0) && (val != 1)) {

2123

err = -EINVAL;

2123

err = -EINVAL;

2124

break;

2124

break;

2125

}

2125

}

2126

session->recv_seq = val ? -1 : 0;

2126

session->recv_seq = val ? -1 : 0;

2127

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2127

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2128

"%s: set recv_seq=%d\n", session->name,

2128

"%s: set recv_seq=%d\n", session->name,

2129

session->recv_seq);

2129

session->recv_seq);

2130

break;

2130

break;

2131

2132

case PPPOL2TP_SO_SENDSEQ:

2132

case PPPOL2TP_SO_SENDSEQ:

2133

if ((val != 0) && (val != 1)) {

2133

if ((val != 0) && (val != 1)) {

2134

err = -EINVAL;

2134

err = -EINVAL;

2135

break;

2135

break;

2136

}

2136

}

2137

session->send_seq = val ? -1 : 0;

2137

session->send_seq = val ? -1 : 0;

2138

{

2138

{

2139

struct sock *ssk = session->sock;

2139

struct sock *ssk = session->sock;

2140

struct pppox_sock *po = pppox_sk(ssk);

2140

struct pppox_sock *po = pppox_sk(ssk);

2141

po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :

2141

po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :

2142

PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;

2142

PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;

2143

}

2143

}

2144

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2144

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2145

"%s: set send_seq=%d\n", session->name, session->send_seq);

2145

"%s: set send_seq=%d\n", session->name, session->send_seq);

2146

break;

2146

break;

2147

2148

case PPPOL2TP_SO_LNSMODE:

2148

case PPPOL2TP_SO_LNSMODE:

2149

if ((val != 0) && (val != 1)) {

2149

if ((val != 0) && (val != 1)) {

2150

err = -EINVAL;

2150

err = -EINVAL;

2151

break;

2151

break;

2152

}

2152

}

2153

session->lns_mode = val ? -1 : 0;

2153

session->lns_mode = val ? -1 : 0;

2154

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2154

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2155

"%s: set lns_mode=%d\n", session->name,

2155

"%s: set lns_mode=%d\n", session->name,

2156

session->lns_mode);

2156

session->lns_mode);

2157

break;

2157

break;

2158

2159

case PPPOL2TP_SO_DEBUG:

2159

case PPPOL2TP_SO_DEBUG:

2160

session->debug = val;

2160

session->debug = val;

2161

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2161

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2162

"%s: set debug=%x\n", session->name, session->debug);

2162

"%s: set debug=%x\n", session->name, session->debug);

2163

break;

2163

break;

2164

2165

case PPPOL2TP_SO_REORDERTO:

2165

case PPPOL2TP_SO_REORDERTO:

2166

session->reorder_timeout = msecs_to_jiffies(val);

2166

session->reorder_timeout = msecs_to_jiffies(val);

2167

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2167

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2168

"%s: set reorder_timeout=%d\n", session->name,

2168

"%s: set reorder_timeout=%d\n", session->name,

2169

session->reorder_timeout);

2169

session->reorder_timeout);

2170

break;

2170

break;

2171

2172

default:

2172

default:

2173

err = -ENOPROTOOPT;

2173

err = -ENOPROTOOPT;

2174

break;

2174

break;

2175

}

2175

}

2176

2177

return err;

2177

return err;

2178

}

2178

}

2179

2180

/* Main setsockopt() entry point.

2180

/* Main setsockopt() entry point.

2181

* Does API checks, then calls either the tunnel or session setsockopt

2181

* Does API checks, then calls either the tunnel or session setsockopt

2182

* handler, according to whether the PPPoL2TP socket is a for a regular

2182

* handler, according to whether the PPPoL2TP socket is a for a regular

2183

* session or the special tunnel type.

2183

* session or the special tunnel type.

2184

*/

2184

*/

2185

static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,

2185

static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,

2186

char __user *optval, unsigned int optlen)

2186

char __user *optval, unsigned int optlen)

2187

{

2187

{

2188

struct sock *sk = sock->sk;

2188

struct sock *sk = sock->sk;

2189

struct pppol2tp_session *session = sk->sk_user_data;

2189

struct pppol2tp_session *session = sk->sk_user_data;

2190

struct pppol2tp_tunnel *tunnel;

2190

struct pppol2tp_tunnel *tunnel;

2191

int val;

2191

int val;

2192

int err;

2192

int err;

2193

2194

if (level != SOL_PPPOL2TP)

2194

if (level != SOL_PPPOL2TP)

2195

return udp_prot.setsockopt(sk, level, optname, optval, optlen);

2195

return udp_prot.setsockopt(sk, level, optname, optval, optlen);

2196

2197

if (optlen < sizeof(int))

2197

if (optlen < sizeof(int))

2198

return -EINVAL;

2198

return -EINVAL;

2199

2200

if (get_user(val, (int __user *)optval))

2200

if (get_user(val, (int __user *)optval))

2201

return -EFAULT;

2201

return -EFAULT;

2202

2203

err = -ENOTCONN;

2203

err = -ENOTCONN;

2204

if (sk->sk_user_data == NULL)

2204

if (sk->sk_user_data == NULL)

2205

goto end;

2205

goto end;

2206

2207

/* Get session context from the socket */

2207

/* Get session context from the socket */

2208

err = -EBADF;

2208

err = -EBADF;

2209

session = pppol2tp_sock_to_session(sk);

2209

session = pppol2tp_sock_to_session(sk);

2210

if (session == NULL)

2210

if (session == NULL)

2211

goto end;

2211

goto end;

2212

2213

/* Special case: if session_id == 0x0000, treat as operation on tunnel

2213

/* Special case: if session_id == 0x0000, treat as operation on tunnel

2214

*/

2214

*/

2215

if ((session->tunnel_addr.s_session == 0) &&

2215

if ((session->tunnel_addr.s_session == 0) &&

2216

(session->tunnel_addr.d_session == 0)) {

2216

(session->tunnel_addr.d_session == 0)) {

2217

err = -EBADF;

2217

err = -EBADF;

2218

tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);

2218

tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);

2219

if (tunnel == NULL)

2219

if (tunnel == NULL)

2220

goto end_put_sess;

2220

goto end_put_sess;

2221

2222

err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);

2222

err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);

2223

sock_put(session->tunnel_sock);

2223

sock_put(session->tunnel_sock);

2224

} else

2224

} else

2225

err = pppol2tp_session_setsockopt(sk, session, optname, val);

2225

err = pppol2tp_session_setsockopt(sk, session, optname, val);

2226

2227

err = 0;

2227

err = 0;

2228

2229

end_put_sess:

2229

end_put_sess:

2230

sock_put(sk);

2230

sock_put(sk);

2231

end:

2231

end:

2232

return err;

2232

return err;

2233

}

2233

}

2234

2235

/* Tunnel getsockopt helper. Called with sock locked.

2235

/* Tunnel getsockopt helper. Called with sock locked.

2236

*/

2236

*/

2237

static int pppol2tp_tunnel_getsockopt(struct sock *sk,

2237

static int pppol2tp_tunnel_getsockopt(struct sock *sk,

2238

struct pppol2tp_tunnel *tunnel,

2238

struct pppol2tp_tunnel *tunnel,

2239

int optname, int *val)

2239

int optname, int *val)

2240

{

2240

{

2241

int err = 0;

2241

int err = 0;

2242

2243

switch (optname) {

2243

switch (optname) {

2244

case PPPOL2TP_SO_DEBUG:

2244

case PPPOL2TP_SO_DEBUG:

2245

*val = tunnel->debug;

2245

*val = tunnel->debug;

2246

PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2246

PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2247

"%s: get debug=%x\n", tunnel->name, tunnel->debug);

2247

"%s: get debug=%x\n", tunnel->name, tunnel->debug);

2248

break;

2248

break;

2249

2250

default:

2250

default:

2251

err = -ENOPROTOOPT;

2251

err = -ENOPROTOOPT;

2252

break;

2252

break;

2253

}

2253

}

2254

2255

return err;

2255

return err;

2256

}

2256

}

2257

2258

/* Session getsockopt helper. Called with sock locked.

2258

/* Session getsockopt helper. Called with sock locked.

2259

*/

2259

*/

2260

static int pppol2tp_session_getsockopt(struct sock *sk,

2260

static int pppol2tp_session_getsockopt(struct sock *sk,

2261

struct pppol2tp_session *session,

2261

struct pppol2tp_session *session,

2262

int optname, int *val)

2262

int optname, int *val)

2263

{

2263

{

2264

int err = 0;

2264

int err = 0;

2265

2266

switch (optname) {

2266

switch (optname) {

2267

case PPPOL2TP_SO_RECVSEQ:

2267

case PPPOL2TP_SO_RECVSEQ:

2268

*val = session->recv_seq;

2268

*val = session->recv_seq;

2269

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2269

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2270

"%s: get recv_seq=%d\n", session->name, *val);

2270

"%s: get recv_seq=%d\n", session->name, *val);

2271

break;

2271

break;

2272

2273

case PPPOL2TP_SO_SENDSEQ:

2273

case PPPOL2TP_SO_SENDSEQ:

2274

*val = session->send_seq;

2274

*val = session->send_seq;

2275

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2275

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2276

"%s: get send_seq=%d\n", session->name, *val);

2276

"%s: get send_seq=%d\n", session->name, *val);

2277

break;

2277

break;

2278

2279

case PPPOL2TP_SO_LNSMODE:

2279

case PPPOL2TP_SO_LNSMODE:

2280

*val = session->lns_mode;

2280

*val = session->lns_mode;

2281

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2281

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2282

"%s: get lns_mode=%d\n", session->name, *val);

2282

"%s: get lns_mode=%d\n", session->name, *val);

2283

break;

2283

break;

2284

2285

case PPPOL2TP_SO_DEBUG:

2285

case PPPOL2TP_SO_DEBUG:

2286

*val = session->debug;

2286

*val = session->debug;

2287

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2287

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2288

"%s: get debug=%d\n", session->name, *val);

2288

"%s: get debug=%d\n", session->name, *val);

2289

break;

2289

break;

2290

2291

case PPPOL2TP_SO_REORDERTO:

2291

case PPPOL2TP_SO_REORDERTO:

2292

*val = (int) jiffies_to_msecs(session->reorder_timeout);

2292

*val = (int) jiffies_to_msecs(session->reorder_timeout);

2293

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2293

PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,

2294

"%s: get reorder_timeout=%d\n", session->name, *val);

2294

"%s: get reorder_timeout=%d\n", session->name, *val);

2295

break;

2295

break;

2296

2297

default:

2297

default:

2298

err = -ENOPROTOOPT;

2298

err = -ENOPROTOOPT;

2299

}

2299

}

2300

2301

return err;

2301

return err;

2302

}

2302

}

2303

2304

/* Main getsockopt() entry point.

2304

/* Main getsockopt() entry point.

2305

* Does API checks, then calls either the tunnel or session getsockopt

2305

* Does API checks, then calls either the tunnel or session getsockopt

2306

* handler, according to whether the PPPoX socket is a for a regular session

2306

* handler, according to whether the PPPoX socket is a for a regular session

2307

* or the special tunnel type.

2307

* or the special tunnel type.

2308

*/

2308

*/

2309

static int pppol2tp_getsockopt(struct socket *sock, int level,

2309

static int pppol2tp_getsockopt(struct socket *sock, int level,

2310

int optname, char __user *optval, int __user *optlen)

2310

int optname, char __user *optval, int __user *optlen)

2311

{

2311

{

2312

struct sock *sk = sock->sk;

2312

struct sock *sk = sock->sk;

2313

struct pppol2tp_session *session = sk->sk_user_data;

2313

struct pppol2tp_session *session = sk->sk_user_data;

2314

struct pppol2tp_tunnel *tunnel;

2314

struct pppol2tp_tunnel *tunnel;

2315

int val, len;

2315

int val, len;

2316

int err;

2316

int err;

2317

2318

if (level != SOL_PPPOL2TP)

2318

if (level != SOL_PPPOL2TP)

2319

return udp_prot.getsockopt(sk, level, optname, optval, optlen);

2319

return udp_prot.getsockopt(sk, level, optname, optval, optlen);

2320

2321

if (get_user(len, (int __user *) optlen))

2321

if (get_user(len, (int __user *) optlen))

2322

return -EFAULT;

2322

return -EFAULT;

2323

2324

len = min_t(unsigned int, len, sizeof(int));

2324

len = min_t(unsigned int, len, sizeof(int));

2325

2326

if (len < 0)

2326

if (len < 0)

2327

return -EINVAL;

2327

return -EINVAL;

2328

2329

err = -ENOTCONN;

2329

err = -ENOTCONN;

2330

if (sk->sk_user_data == NULL)

2330

if (sk->sk_user_data == NULL)

2331

goto end;

2331

goto end;

2332

2333

/* Get the session context */

2333

/* Get the session context */

2334

err = -EBADF;

2334

err = -EBADF;

2335

session = pppol2tp_sock_to_session(sk);

2335

session = pppol2tp_sock_to_session(sk);

2336

if (session == NULL)

2336

if (session == NULL)

2337

goto end;

2337

goto end;

2338

2339

/* Special case: if session_id == 0x0000, treat as operation on tunnel */

2339

/* Special case: if session_id == 0x0000, treat as operation on tunnel */

2340

if ((session->tunnel_addr.s_session == 0) &&

2340

if ((session->tunnel_addr.s_session == 0) &&

2341

(session->tunnel_addr.d_session == 0)) {

2341

(session->tunnel_addr.d_session == 0)) {

2342

err = -EBADF;

2342

err = -EBADF;

2343

tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);

2343

tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);

2344

if (tunnel == NULL)

2344

if (tunnel == NULL)

2345

goto end_put_sess;

2345

goto end_put_sess;

2346

2347

err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);

2347

err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);

2348

sock_put(session->tunnel_sock);

2348

sock_put(session->tunnel_sock);

2349

} else

2349

} else

2350

err = pppol2tp_session_getsockopt(sk, session, optname, &val);

2350

err = pppol2tp_session_getsockopt(sk, session, optname, &val);

2351

2352

err = -EFAULT;

2352

err = -EFAULT;

2353

if (put_user(len, (int __user *) optlen))

2353

if (put_user(len, (int __user *) optlen))

2354

goto end_put_sess;

2354

goto end_put_sess;

2355

2356

if (copy_to_user((void __user *) optval, &val, len))

2356

if (copy_to_user((void __user *) optval, &val, len))

2357

goto end_put_sess;

2357

goto end_put_sess;

2358

2359

err = 0;

2359

err = 0;

2360

2361

end_put_sess:

2361

end_put_sess:

2362

sock_put(sk);

2362

sock_put(sk);

2363

end:

2363

end:

2364

return err;

2364

return err;

2365

}

2365

}

2366

2367

/*****************************************************************************

2367

/*****************************************************************************

2368

* /proc filesystem for debug

2368

* /proc filesystem for debug

2369

*****************************************************************************/

2369

*****************************************************************************/

2370

2371

#ifdef CONFIG_PROC_FS

2371

#ifdef CONFIG_PROC_FS

2372

2373

#include <linux/seq_file.h>

2373

#include <linux/seq_file.h>

2374

2375

struct pppol2tp_seq_data {

2375

struct pppol2tp_seq_data {

2376

struct seq_net_private p;

2376

struct seq_net_private p;

2377

struct pppol2tp_tunnel *tunnel; /* current tunnel */

2377

struct pppol2tp_tunnel *tunnel; /* current tunnel */

2378

struct pppol2tp_session *session; /* NULL means get first session in tunnel */

2378

struct pppol2tp_session *session; /* NULL means get first session in tunnel */

2379

};

2379

};

2380

2381

static struct pppol2tp_session *next_session(struct pppol2tp_tunnel *tunnel, struct pppol2tp_session *curr)

2381

static struct pppol2tp_session *next_session(struct pppol2tp_tunnel *tunnel, struct pppol2tp_session *curr)

2382

{

2382

{

2383

struct pppol2tp_session *session = NULL;

2383

struct pppol2tp_session *session = NULL;

2384

struct hlist_node *walk;

2384

struct hlist_node *walk;

2385

int found = 0;

2385

int found = 0;

2386

int next = 0;

2386

int next = 0;

2387

int i;

2387

int i;

2388

2389

read_lock_bh(&tunnel->hlist_lock);

2389

read_lock_bh(&tunnel->hlist_lock);

2390

for (i = 0; i < PPPOL2TP_HASH_SIZE; i++) {

2390

for (i = 0; i < PPPOL2TP_HASH_SIZE; i++) {

2391

hlist_for_each_entry(session, walk, &tunnel->session_hlist[i], hlist) {

2391

hlist_for_each_entry(session, walk, &tunnel->session_hlist[i], hlist) {

2392

if (curr == NULL) {

2392

if (curr == NULL) {

2393

found = 1;

2393

found = 1;

2394

goto out;

2394

goto out;

2395

}

2395

}

2396

if (session == curr) {

2396

if (session == curr) {

2397

next = 1;

2397

next = 1;

2398

continue;

2398

continue;

2399

}

2399

}

2400

if (next) {

2400

if (next) {

2401

found = 1;

2401

found = 1;

2402

goto out;

2402

goto out;

2403

}

2403

}

2404

}

2404

}

2405

}

2405

}

2406

out:

2406

out:

2407

read_unlock_bh(&tunnel->hlist_lock);

2407

read_unlock_bh(&tunnel->hlist_lock);

2408

if (!found)

2408

if (!found)

2409

session = NULL;

2409

session = NULL;

2410

2411

return session;

2411

return session;

2412

}

2412

}

2413

2414

static struct pppol2tp_tunnel *next_tunnel(struct pppol2tp_net *pn,

2414

static struct pppol2tp_tunnel *next_tunnel(struct pppol2tp_net *pn,

2415

struct pppol2tp_tunnel *curr)

2415

struct pppol2tp_tunnel *curr)

2416

{

2416

{

2417

struct pppol2tp_tunnel *tunnel = NULL;

2417

struct pppol2tp_tunnel *tunnel = NULL;

2418

2419

read_lock_bh(&pn->pppol2tp_tunnel_list_lock);

2419

read_lock_bh(&pn->pppol2tp_tunnel_list_lock);

2420

if (list_is_last(&curr->list, &pn->pppol2tp_tunnel_list)) {

2420

if (list_is_last(&curr->list, &pn->pppol2tp_tunnel_list)) {

2421

goto out;

2421

goto out;

2422

}

2422

}

2423

tunnel = list_entry(curr->list.next, struct pppol2tp_tunnel, list);

2423

tunnel = list_entry(curr->list.next, struct pppol2tp_tunnel, list);

2424

out:

2424

out:

2425

read_unlock_bh(&pn->pppol2tp_tunnel_list_lock);

2425

read_unlock_bh(&pn->pppol2tp_tunnel_list_lock);

2426

2427

return tunnel;

2427

return tunnel;

2428

}

2428

}

2429

2430

static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs)

2430

static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs)

2431

{

2431

{

2432

struct pppol2tp_seq_data *pd = SEQ_START_TOKEN;

2432

struct pppol2tp_seq_data *pd = SEQ_START_TOKEN;

2433

struct pppol2tp_net *pn;

2433

struct pppol2tp_net *pn;

2434

loff_t pos = *offs;

2434

loff_t pos = *offs;

2435

2436

if (!pos)

2436

if (!pos)

2437

goto out;

2437

goto out;

2438

2439

BUG_ON(m->private == NULL);

2439

BUG_ON(m->private == NULL);

2440

pd = m->private;

2440

pd = m->private;

2441

pn = pppol2tp_pernet(seq_file_net(m));

2441

pn = pppol2tp_pernet(seq_file_net(m));

2442

2443

if (pd->tunnel == NULL) {

2443

if (pd->tunnel == NULL) {

2444

if (!list_empty(&pn->pppol2tp_tunnel_list))

2444

if (!list_empty(&pn->pppol2tp_tunnel_list))

2445

pd->tunnel = list_entry(pn->pppol2tp_tunnel_list.next, struct pppol2tp_tunnel, list);

2445

pd->tunnel = list_entry(pn->pppol2tp_tunnel_list.next, struct pppol2tp_tunnel, list);

2446

} else {

2446

} else {

2447

pd->session = next_session(pd->tunnel, pd->session);

2447

pd->session = next_session(pd->tunnel, pd->session);

2448

if (pd->session == NULL) {

2448

if (pd->session == NULL) {

2449

pd->tunnel = next_tunnel(pn, pd->tunnel);

2449

pd->tunnel = next_tunnel(pn, pd->tunnel);

2450

}

2450

}

2451

}

2451

}

2452

2453

/* NULL tunnel and session indicates end of list */

2453

/* NULL tunnel and session indicates end of list */

2454

if ((pd->tunnel == NULL) && (pd->session == NULL))

2454

if ((pd->tunnel == NULL) && (pd->session == NULL))

2455

pd = NULL;

2455

pd = NULL;

2456

2457

out:

2457

out:

2458

return pd;

2458

return pd;

2459

}

2459

}

2460

2461

static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos)

2461

static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos)

2462

{

2462

{

2463

(*pos)++;

2463

(*pos)++;

2464

return NULL;

2464

return NULL;

2465

}

2465

}

2466

2467

static void pppol2tp_seq_stop(struct seq_file *p, void *v)

2467

static void pppol2tp_seq_stop(struct seq_file *p, void *v)

2468

{

2468

{

2469

/* nothing to do */

2469

/* nothing to do */

2470

}

2470

}

2471

2472

static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)

2472

static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)

2473

{

2473

{

2474

struct pppol2tp_tunnel *tunnel = v;

2474

struct pppol2tp_tunnel *tunnel = v;

2475

2476

seq_printf(m, "\nTUNNEL '%s', %c %d\n",

2476

seq_printf(m, "\nTUNNEL '%s', %c %d\n",

2477

tunnel->name,

2477

tunnel->name,

2478

(tunnel == tunnel->sock->sk_user_data) ? 'Y':'N',

2478

(tunnel == tunnel->sock->sk_user_data) ? 'Y':'N',

2479

atomic_read(&tunnel->ref_count) - 1);

2479

atomic_read(&tunnel->ref_count) - 1);

2480

seq_printf(m, " %08x %llu/%llu/%llu %llu/%llu/%llu\n",

2480

seq_printf(m, " %08x %llu/%llu/%llu %llu/%llu/%llu\n",

2481

tunnel->debug,

2481

tunnel->debug,

2482

(unsigned long long)tunnel->stats.tx_packets,

2482

(unsigned long long)tunnel->stats.tx_packets,

2483

(unsigned long long)tunnel->stats.tx_bytes,

2483

(unsigned long long)tunnel->stats.tx_bytes,

2484

(unsigned long long)tunnel->stats.tx_errors,

2484

(unsigned long long)tunnel->stats.tx_errors,

2485

(unsigned long long)tunnel->stats.rx_packets,

2485

(unsigned long long)tunnel->stats.rx_packets,

2486

(unsigned long long)tunnel->stats.rx_bytes,

2486

(unsigned long long)tunnel->stats.rx_bytes,

2487

(unsigned long long)tunnel->stats.rx_errors);

2487

(unsigned long long)tunnel->stats.rx_errors);

2488

}

2488

}

2489

2490

static void pppol2tp_seq_session_show(struct seq_file *m, void *v)

2490

static void pppol2tp_seq_session_show(struct seq_file *m, void *v)

2491

{

2491

{

2492

struct pppol2tp_session *session = v;

2492

struct pppol2tp_session *session = v;

2493

2494

seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> "

2494

seq_printf(m, " SESSION '%s' %08X/%d %04X/%04X -> "

2495

"%04X/%04X %d %c\n",

2495

"%04X/%04X %d %c\n",

2496

session->name,

2496

session->name,

2497

ntohl(session->tunnel_addr.addr.sin_addr.s_addr),

2497

ntohl(session->tunnel_addr.addr.sin_addr.s_addr),

2498

ntohs(session->tunnel_addr.addr.sin_port),

2498

ntohs(session->tunnel_addr.addr.sin_port),

2499

session->tunnel_addr.s_tunnel,

2499

session->tunnel_addr.s_tunnel,

2500

session->tunnel_addr.s_session,

2500

session->tunnel_addr.s_session,

2501

session->tunnel_addr.d_tunnel,

2501

session->tunnel_addr.d_tunnel,

2502

session->tunnel_addr.d_session,

2502

session->tunnel_addr.d_session,

2503

session->sock->sk_state,

2503

session->sock->sk_state,

2504

(session == session->sock->sk_user_data) ?

2504

(session == session->sock->sk_user_data) ?

2505

'Y' : 'N');

2505

'Y' : 'N');

2506

seq_printf(m, " %d/%d/%c/%c/%s %08x %u\n",

2506

seq_printf(m, " %d/%d/%c/%c/%s %08x %u\n",

2507

session->mtu, session->mru,

2507

session->mtu, session->mru,

2508

session->recv_seq ? 'R' : '-',

2508

session->recv_seq ? 'R' : '-',

2509

session->send_seq ? 'S' : '-',

2509

session->send_seq ? 'S' : '-',

2510

session->lns_mode ? "LNS" : "LAC",

2510

session->lns_mode ? "LNS" : "LAC",

2511

session->debug,

2511

session->debug,

2512

jiffies_to_msecs(session->reorder_timeout));

2512

jiffies_to_msecs(session->reorder_timeout));

2513

seq_printf(m, " %hu/%hu %llu/%llu/%llu %llu/%llu/%llu\n",

2513

seq_printf(m, " %hu/%hu %llu/%llu/%llu %llu/%llu/%llu\n",

2514

session->nr, session->ns,

2514

session->nr, session->ns,

2515

(unsigned long long)session->stats.tx_packets,

2515

(unsigned long long)session->stats.tx_packets,

2516

(unsigned long long)session->stats.tx_bytes,

2516

(unsigned long long)session->stats.tx_bytes,

2517

(unsigned long long)session->stats.tx_errors,

2517

(unsigned long long)session->stats.tx_errors,

2518

(unsigned long long)session->stats.rx_packets,

2518

(unsigned long long)session->stats.rx_packets,

2519

(unsigned long long)session->stats.rx_bytes,

2519

(unsigned long long)session->stats.rx_bytes,

2520

(unsigned long long)session->stats.rx_errors);

2520

(unsigned long long)session->stats.rx_errors);

2521

}

2521

}

2522

2523

static int pppol2tp_seq_show(struct seq_file *m, void *v)

2523

static int pppol2tp_seq_show(struct seq_file *m, void *v)

2524

{

2524

{

2525

struct pppol2tp_seq_data *pd = v;

2525

struct pppol2tp_seq_data *pd = v;

2526

2527

/* display header on line 1 */

2527

/* display header on line 1 */

2528

if (v == SEQ_START_TOKEN) {

2528

if (v == SEQ_START_TOKEN) {

2529

seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n");

2529

seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n");

2530

seq_puts(m, "TUNNEL name, user-data-ok session-count\n");

2530

seq_puts(m, "TUNNEL name, user-data-ok session-count\n");

2531

seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n");

2531

seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n");

2532

seq_puts(m, " SESSION name, addr/port src-tid/sid "

2532

seq_puts(m, " SESSION name, addr/port src-tid/sid "

2533

"dest-tid/sid state user-data-ok\n");

2533

"dest-tid/sid state user-data-ok\n");

2534

seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n");

2534

seq_puts(m, " mtu/mru/rcvseq/sendseq/lns debug reorderto\n");

2535

seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n");

2535

seq_puts(m, " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n");

2536

goto out;

2536

goto out;

2537

}

2537

}

2538

2539

/* Show the tunnel or session context.

2539

/* Show the tunnel or session context.

2540

*/

2540

*/

2541

if (pd->session == NULL)

2541

if (pd->session == NULL)

2542

pppol2tp_seq_tunnel_show(m, pd->tunnel);

2542

pppol2tp_seq_tunnel_show(m, pd->tunnel);

2543

else

2543

else

2544

pppol2tp_seq_session_show(m, pd->session);

2544

pppol2tp_seq_session_show(m, pd->session);

2545

2546

out:

2546

out:

2547

return 0;

2547

return 0;

2548

}

2548

}

2549

2550

static const struct seq_operations pppol2tp_seq_ops = {

2550

static const struct seq_operations pppol2tp_seq_ops = {

2551

.start = pppol2tp_seq_start,

2551

.start = pppol2tp_seq_start,

2552

.next = pppol2tp_seq_next,

2552

.next = pppol2tp_seq_next,

2553

.stop = pppol2tp_seq_stop,

2553

.stop = pppol2tp_seq_stop,

2554

.show = pppol2tp_seq_show,

2554

.show = pppol2tp_seq_show,

2555

};

2555

};

2556

2557

/* Called when our /proc file is opened. We allocate data for use when

2557

/* Called when our /proc file is opened. We allocate data for use when

2558

* iterating our tunnel / session contexts and store it in the private

2558

* iterating our tunnel / session contexts and store it in the private

2559

* data of the seq_file.

2559

* data of the seq_file.

2560

*/

2560

*/

2561

static int pppol2tp_proc_open(struct inode *inode, struct file *file)

2561

static int pppol2tp_proc_open(struct inode *inode, struct file *file)

2562

{

2562

{

2563

return seq_open_net(inode, file, &pppol2tp_seq_ops,

2563

return seq_open_net(inode, file, &pppol2tp_seq_ops,

2564

sizeof(struct pppol2tp_seq_data));

2564

sizeof(struct pppol2tp_seq_data));

2565

}

2565

}

2566

2567

static const struct file_operations pppol2tp_proc_fops = {

2567

static const struct file_operations pppol2tp_proc_fops = {

2568

.owner = THIS_MODULE,

2568

.owner = THIS_MODULE,

2569

.open = pppol2tp_proc_open,

2569

.open = pppol2tp_proc_open,

2570

.read = seq_read,

2570

.read = seq_read,

2571

.llseek = seq_lseek,

2571

.llseek = seq_lseek,

2572

.release = seq_release_net,

2572

.release = seq_release_net,

2573

};

2573

};

2574

2575

#endif /* CONFIG_PROC_FS */

2575

#endif /* CONFIG_PROC_FS */

2576

2577

/*****************************************************************************

2577

/*****************************************************************************

2578

* Init and cleanup

2578

* Init and cleanup

2579

*****************************************************************************/

2579

*****************************************************************************/

2580

2581

static const struct proto_ops pppol2tp_ops = {

2581

static const struct proto_ops pppol2tp_ops = {

2582

.family = AF_PPPOX,

2582

.family = AF_PPPOX,

2583

.owner = THIS_MODULE,

2583

.owner = THIS_MODULE,

2584

.release = pppol2tp_release,

2584

.release = pppol2tp_release,

2585

.bind = sock_no_bind,

2585

.bind = sock_no_bind,

2586

.connect = pppol2tp_connect,

2586

.connect = pppol2tp_connect,

2587

.socketpair = sock_no_socketpair,

2587

.socketpair = sock_no_socketpair,

2588

.accept = sock_no_accept,

2588

.accept = sock_no_accept,

2589

.getname = pppol2tp_getname,

2589

.getname = pppol2tp_getname,

2590

.poll = datagram_poll,

2590

.poll = datagram_poll,

2591

.listen = sock_no_listen,

2591

.listen = sock_no_listen,

2592

.shutdown = sock_no_shutdown,

2592

.shutdown = sock_no_shutdown,

2593

.setsockopt = pppol2tp_setsockopt,

2593

.setsockopt = pppol2tp_setsockopt,

2594

.getsockopt = pppol2tp_getsockopt,

2594

.getsockopt = pppol2tp_getsockopt,

2595

.sendmsg = pppol2tp_sendmsg,

2595

.sendmsg = pppol2tp_sendmsg,

2596

.recvmsg = pppol2tp_recvmsg,

2596

.recvmsg = pppol2tp_recvmsg,

2597

.mmap = sock_no_mmap,

2597

.mmap = sock_no_mmap,

2598

.ioctl = pppox_ioctl,

2598

.ioctl = pppox_ioctl,

2599

};

2599

};

2600

2601

static struct pppox_proto pppol2tp_proto = {

2601

static struct pppox_proto pppol2tp_proto = {

2602

.create = pppol2tp_create,

2602

.create = pppol2tp_create,

2603

.ioctl = pppol2tp_ioctl

2603

.ioctl = pppol2tp_ioctl

2604

};

2604

};

2605

2606

static __net_init int pppol2tp_init_net(struct net *net)

2606

static __net_init int pppol2tp_init_net(struct net *net)

2607

{

2607

{

2608

struct pppol2tp_net *pn;

2608

struct pppol2tp_net *pn = pppol2tp_pernet(net);

2609

struct proc_dir_entry *pde;

2609

struct proc_dir_entry *pde;

2610

int err;

2611

2610

2612

pn = kzalloc(sizeof(*pn), GFP_KERNEL);

2613

if (!pn)

2614

return -ENOMEM;

2615

2616

INIT_LIST_HEAD(&pn->pppol2tp_tunnel_list);

2611

INIT_LIST_HEAD(&pn->pppol2tp_tunnel_list);

2617

rwlock_init(&pn->pppol2tp_tunnel_list_lock);

2612

rwlock_init(&pn->pppol2tp_tunnel_list_lock);

2618

2613

2619

err = net_assign_generic(net, pppol2tp_net_id, pn);

2620

if (err)

2621

goto out;

2622

2623

pde = proc_net_fops_create(net, "pppol2tp", S_IRUGO, &pppol2tp_proc_fops);

2614

pde = proc_net_fops_create(net, "pppol2tp", S_IRUGO, &pppol2tp_proc_fops);

2624

#ifdef CONFIG_PROC_FS

2615

#ifdef CONFIG_PROC_FS

2625

if (!pde) {

2616

if (!pde)

2626

err = -ENOMEM;

2617

return -ENOMEM;

2627

goto out;

2628

}

2629

#endif

2618

#endif

2630

2619

2631

return 0;

2620

return 0;

2632

2633

out:

2634

kfree(pn);

2635

return err;

2636

}

2621

}

2637

2622

2638

static __net_exit void pppol2tp_exit_net(struct net *net)

2623

static __net_exit void pppol2tp_exit_net(struct net *net)

2639

{

2624

{

2640

struct pppoe_net *pn;

2641

2642

proc_net_remove(net, "pppol2tp");

2625

proc_net_remove(net, "pppol2tp");

2643

pn = net_generic(net, pppol2tp_net_id);

2644

/*

2645

* if someone has cached our net then

2646

* further net_generic call will return NULL

2647

*/

2648

net_assign_generic(net, pppol2tp_net_id, NULL);

2649

kfree(pn);

2650

}

2626

}

2651

2627

2652

static struct pernet_operations pppol2tp_net_ops = {

2628

static struct pernet_operations pppol2tp_net_ops = {

2653

.init = pppol2tp_init_net,

2629

.init = pppol2tp_init_net,

2654

.exit = pppol2tp_exit_net,

2630

.exit = pppol2tp_exit_net,

2631

.id = &pppol2tp_net_id,

2632

.size = sizeof(struct pppol2tp_net),

2655

};

2633

};

2656

2634

2657

static int __init pppol2tp_init(void)

2635

static int __init pppol2tp_init(void)

2658

{

2636

{

2659

int err;

2637

int err;

2660

2638

2661

err = proto_register(&pppol2tp_sk_proto, 0);

2639

err = proto_register(&pppol2tp_sk_proto, 0);

2662

if (err)

2640

if (err)

2663

goto out;

2641

goto out;

2664

err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto);

2642

err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto);

2665

if (err)

2643

if (err)

2666

goto out_unregister_pppol2tp_proto;

2644

goto out_unregister_pppol2tp_proto;

2667

2645

2668

err = register_pernet_gen_device(&pppol2tp_net_id, &pppol2tp_net_ops);

2646

err = register_pernet_device(&pppol2tp_net_ops);

2669

if (err)

2647

if (err)

2670

goto out_unregister_pppox_proto;

2648

goto out_unregister_pppox_proto;

2671

2649

2672

printk(KERN_INFO "PPPoL2TP kernel driver, %s\n",

2650

printk(KERN_INFO "PPPoL2TP kernel driver, %s\n",

2673

PPPOL2TP_DRV_VERSION);

2651

PPPOL2TP_DRV_VERSION);

2674

2652

2675

out:

2653

out:

2676

return err;

2654

return err;

2677

out_unregister_pppox_proto:

2655

out_unregister_pppox_proto:

2678

unregister_pppox_proto(PX_PROTO_OL2TP);

2656

unregister_pppox_proto(PX_PROTO_OL2TP);

2679

out_unregister_pppol2tp_proto:

2657

out_unregister_pppol2tp_proto:

2680

proto_unregister(&pppol2tp_sk_proto);

2658

proto_unregister(&pppol2tp_sk_proto);

2681

goto out;

2659

goto out;

2682

}

2660

}

2683

2661

2684

static void __exit pppol2tp_exit(void)

2662

static void __exit pppol2tp_exit(void)

2685

{

2663

{

2686

unregister_pppox_proto(PX_PROTO_OL2TP);

2664

unregister_pppox_proto(PX_PROTO_OL2TP);

2687

unregister_pernet_gen_device(pppol2tp_net_id, &pppol2tp_net_ops);

2665

unregister_pernet_device(&pppol2tp_net_ops);

2688

proto_unregister(&pppol2tp_sk_proto);

2666

proto_unregister(&pppol2tp_sk_proto);

2689

}

2667

}

2690

2668

2691

module_init(pppol2tp_init);

2669

module_init(pppol2tp_init);

2692

module_exit(pppol2tp_exit);

2670

module_exit(pppol2tp_exit);

2693

2671

2694

MODULE_AUTHOR("Martijn van Oosterhout <kleptog@svana.org>, "

2672

MODULE_AUTHOR("Martijn van Oosterhout <kleptog@svana.org>, "

2695

"James Chapman <jchapman@katalix.com>");

2673

"James Chapman <jchapman@katalix.com>");

2696

MODULE_DESCRIPTION("PPP over L2TP over UDP");

2674

MODULE_DESCRIPTION("PPP over L2TP over UDP");

2697

MODULE_LICENSE("GPL");

2675

MODULE_LICENSE("GPL");

GITLAB

net: Simplify pppol2tp pernet operations.

 /*****************************************************************************
  * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets
  *
  * PPPoX    --- Generic PPP encapsulation socket family
  * PPPoL2TP --- PPP over L2TP (RFC 2661)
  *
  * Version:	1.0.0
  *
  * Authors:	Martijn van Oosterhout <kleptog@svana.org>
  *		James Chapman (jchapman@katalix.com)
  * Contributors:
  *		Michal Ostrowski <mostrows@speakeasy.net>
  *		Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
  *		David S. Miller (davem@redhat.com)
  *
  * License:
  *		This program is free software; you can redistribute it and/or
  *		modify it under the terms of the GNU General Public License
  *		as published by the Free Software Foundation; either version
  *		2 of the License, or (at your option) any later version.
  *
  */
 /* This driver handles only L2TP data frames; control frames are handled by a
  * userspace application.
  *
  * To send data in an L2TP session, userspace opens a PPPoL2TP socket and
  * attaches it to a bound UDP socket with local tunnel_id / session_id and
  * peer tunnel_id / session_id set. Data can then be sent or received using
  * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket
  * can be read or modified using ioctl() or [gs]etsockopt() calls.
  *
  * When a PPPoL2TP socket is connected with local and peer session_id values
  * zero, the socket is treated as a special tunnel management socket.
  *
  * Here's example userspace code to create a socket for sending/receiving data
  * over an L2TP session:-
  *
  *	struct sockaddr_pppol2tp sax;
  *	int fd;
  *	int session_fd;
  *
  *	fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
  *
  *	sax.sa_family = AF_PPPOX;
  *	sax.sa_protocol = PX_PROTO_OL2TP;
  *	sax.pppol2tp.fd = tunnel_fd;	// bound UDP socket
  *	sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr;
  *	sax.pppol2tp.addr.sin_port = addr->sin_port;
  *	sax.pppol2tp.addr.sin_family = AF_INET;
  *	sax.pppol2tp.s_tunnel  = tunnel_id;
  *	sax.pppol2tp.s_session = session_id;
  *	sax.pppol2tp.d_tunnel  = peer_tunnel_id;
  *	sax.pppol2tp.d_session = peer_session_id;
  *
  *	session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax));
  *
  * A pppd plugin that allows PPP traffic to be carried over L2TP using
  * this driver is available from the OpenL2TP project at
  * http://openl2tp.sourceforge.net.
  */
 #include <linux/module.h>
 #include <linux/string.h>
 #include <linux/list.h>
 #include <asm/uaccess.h>
 #include <linux/kernel.h>
 #include <linux/spinlock.h>
 #include <linux/kthread.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/jiffies.h>
 #include <linux/netdevice.h>
 #include <linux/net.h>
 #include <linux/inetdevice.h>
 #include <linux/skbuff.h>
 #include <linux/init.h>
 #include <linux/ip.h>
 #include <linux/udp.h>
 #include <linux/if_pppox.h>
 #include <linux/if_pppol2tp.h>
 #include <net/sock.h>
 #include <linux/ppp_channel.h>
 #include <linux/ppp_defs.h>
 #include <linux/if_ppp.h>
 #include <linux/file.h>
 #include <linux/hash.h>
 #include <linux/sort.h>
 #include <linux/proc_fs.h>
 #include <linux/nsproxy.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <net/dst.h>
 #include <net/ip.h>
 #include <net/udp.h>
 #include <net/xfrm.h>
 #include <asm/byteorder.h>
 #include <asm/atomic.h>
 #define PPPOL2TP_DRV_VERSION	"V1.0"
 /* L2TP header constants */
 #define L2TP_HDRFLAG_T	   0x8000
 #define L2TP_HDRFLAG_L	   0x4000
 #define L2TP_HDRFLAG_S	   0x0800
 #define L2TP_HDRFLAG_O	   0x0200
 #define L2TP_HDRFLAG_P	   0x0100
 #define L2TP_HDR_VER_MASK  0x000F
 #define L2TP_HDR_VER	   0x0002
 /* Space for UDP, L2TP and PPP headers */
 #define PPPOL2TP_HEADER_OVERHEAD	40
 /* Just some random numbers */
 #define L2TP_TUNNEL_MAGIC	0x42114DDA
 #define L2TP_SESSION_MAGIC	0x0C04EB7D
 #define PPPOL2TP_HASH_BITS	4
 #define PPPOL2TP_HASH_SIZE	(1 << PPPOL2TP_HASH_BITS)
 /* Default trace flags */
 #define PPPOL2TP_DEFAULT_DEBUG_FLAGS	0
 #define PRINTK(_mask, _type, _lvl, _fmt, args...)			\
 	do {								\
 		if ((_mask) & (_type))					\
 			printk(_lvl "PPPOL2TP: " _fmt, ##args);		\
 	} while(0)
 /* Number of bytes to build transmit L2TP headers.
  * Unfortunately the size is different depending on whether sequence numbers
  * are enabled.
  */
 #define PPPOL2TP_L2TP_HDR_SIZE_SEQ		10
 #define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ		6
 struct pppol2tp_tunnel;
 /* Describes a session. It is the sk_user_data field in the PPPoL2TP
  * socket. Contains information to determine incoming packets and transmit
  * outgoing ones.
  */
 struct pppol2tp_session
 {
 	int			magic;		/* should be
 						 * L2TP_SESSION_MAGIC */
 	int			owner;		/* pid that opened the socket */
 	struct sock		*sock;		/* Pointer to the session
 						 * PPPoX socket */
 	struct sock		*tunnel_sock;	/* Pointer to the tunnel UDP
 						 * socket */
 	struct pppol2tp_addr	tunnel_addr;	/* Description of tunnel */
 	struct pppol2tp_tunnel	*tunnel;	/* back pointer to tunnel
 						 * context */
 	char			name[20];	/* "sess xxxxx/yyyyy", where
 						 * x=tunnel_id, y=session_id */
 	int			mtu;
 	int			mru;
 	int			flags;		/* accessed by PPPIOCGFLAGS.
 						 * Unused. */
 	unsigned		recv_seq:1;	/* expect receive packets with
 						 * sequence numbers? */
 	unsigned		send_seq:1;	/* send packets with sequence
 						 * numbers? */
 	unsigned		lns_mode:1;	/* behave as LNS? LAC enables
 						 * sequence numbers under
 						 * control of LNS. */
 	int			debug;		/* bitmask of debug message
 						 * categories */
 	int			reorder_timeout; /* configured reorder timeout
 						  * (in jiffies) */
 	u16			nr;		/* session NR state (receive) */
 	u16			ns;		/* session NR state (send) */
 	struct sk_buff_head	reorder_q;	/* receive reorder queue */
 	struct pppol2tp_ioc_stats stats;
 	struct hlist_node	hlist;		/* Hash list node */
 };
 /* The sk_user_data field of the tunnel's UDP socket. It contains info to track
  * all the associated sessions so incoming packets can be sorted out
  */
 struct pppol2tp_tunnel
 {
 	int			magic;		/* Should be L2TP_TUNNEL_MAGIC */
 	rwlock_t		hlist_lock;	/* protect session_hlist */
 	struct hlist_head	session_hlist[PPPOL2TP_HASH_SIZE];
 						/* hashed list of sessions,
 						 * hashed by id */
 	int			debug;		/* bitmask of debug message
 						 * categories */
 	char			name[12];	/* "tunl xxxxx" */
 	struct pppol2tp_ioc_stats stats;
 	void (*old_sk_destruct)(struct sock *);
 	struct sock		*sock;		/* Parent socket */
 	struct list_head	list;		/* Keep a list of all open
 						 * prepared sockets */
 	struct net		*pppol2tp_net;	/* the net we belong to */
 	atomic_t		ref_count;
 };
 /* Private data stored for received packets in the skb.
  */
 struct pppol2tp_skb_cb {
 	u16			ns;
 	u16			nr;
 	u16			has_seq;
 	u16			length;
 	unsigned long		expires;
 };
 #define PPPOL2TP_SKB_CB(skb)	((struct pppol2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])
 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);
 static void pppol2tp_tunnel_free(struct pppol2tp_tunnel *tunnel);
 static atomic_t pppol2tp_tunnel_count;
 static atomic_t pppol2tp_session_count;
 static struct ppp_channel_ops pppol2tp_chan_ops = { pppol2tp_xmit , NULL };
 static const struct proto_ops pppol2tp_ops;
 /* per-net private data for this module */
 static int pppol2tp_net_id __read_mostly;
 struct pppol2tp_net {
 	struct list_head pppol2tp_tunnel_list;
 	rwlock_t pppol2tp_tunnel_list_lock;
 };
 static inline struct pppol2tp_net *pppol2tp_pernet(struct net *net)
 {
 	BUG_ON(!net);
 	return net_generic(net, pppol2tp_net_id);
 }
 /* Helpers to obtain tunnel/session contexts from sockets.
  */
 static inline struct pppol2tp_session *pppol2tp_sock_to_session(struct sock *sk)
 {
 	struct pppol2tp_session *session;
 	if (sk == NULL)
 		return NULL;
 	sock_hold(sk);
 	session = (struct pppol2tp_session *)(sk->sk_user_data);
 	if (session == NULL) {
 		sock_put(sk);
 		goto out;
 	}
 	BUG_ON(session->magic != L2TP_SESSION_MAGIC);
 out:
 	return session;
 }
 static inline struct pppol2tp_tunnel *pppol2tp_sock_to_tunnel(struct sock *sk)
 {
 	struct pppol2tp_tunnel *tunnel;
 	if (sk == NULL)
 		return NULL;
 	sock_hold(sk);
 	tunnel = (struct pppol2tp_tunnel *)(sk->sk_user_data);
 	if (tunnel == NULL) {
 		sock_put(sk);
 		goto out;
 	}
 	BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
 out:
 	return tunnel;
 }
 /* Tunnel reference counts. Incremented per session that is added to
  * the tunnel.
  */
 static inline void pppol2tp_tunnel_inc_refcount(struct pppol2tp_tunnel *tunnel)
 {
 	atomic_inc(&tunnel->ref_count);
 }
 static inline void pppol2tp_tunnel_dec_refcount(struct pppol2tp_tunnel *tunnel)
 {
 	if (atomic_dec_and_test(&tunnel->ref_count))
 		pppol2tp_tunnel_free(tunnel);
 }
 /* Session hash list.
  * The session_id SHOULD be random according to RFC2661, but several
  * L2TP implementations (Cisco and Microsoft) use incrementing
  * session_ids.  So we do a real hash on the session_id, rather than a
  * simple bitmask.
  */
 static inline struct hlist_head *
 pppol2tp_session_id_hash(struct pppol2tp_tunnel *tunnel, u16 session_id)
 {
 	unsigned long hash_val = (unsigned long) session_id;
 	return &tunnel->session_hlist[hash_long(hash_val, PPPOL2TP_HASH_BITS)];
 }
 /* Lookup a session by id
  */
 static struct pppol2tp_session *
 pppol2tp_session_find(struct pppol2tp_tunnel *tunnel, u16 session_id)
 {
 	struct hlist_head *session_list =
 		pppol2tp_session_id_hash(tunnel, session_id);
 	struct pppol2tp_session *session;
 	struct hlist_node *walk;
 	read_lock_bh(&tunnel->hlist_lock);
 	hlist_for_each_entry(session, walk, session_list, hlist) {
 		if (session->tunnel_addr.s_session == session_id) {
 			read_unlock_bh(&tunnel->hlist_lock);
 			return session;
 		}
 	}
 	read_unlock_bh(&tunnel->hlist_lock);
 	return NULL;
 }
 /* Lookup a tunnel by id
  */
 static struct pppol2tp_tunnel *pppol2tp_tunnel_find(struct net *net, u16 tunnel_id)
 {
 	struct pppol2tp_tunnel *tunnel;
 	struct pppol2tp_net *pn = pppol2tp_pernet(net);
 	read_lock_bh(&pn->pppol2tp_tunnel_list_lock);
 	list_for_each_entry(tunnel, &pn->pppol2tp_tunnel_list, list) {
 		if (tunnel->stats.tunnel_id == tunnel_id) {
 			read_unlock_bh(&pn->pppol2tp_tunnel_list_lock);
 			return tunnel;
 		}
 	}
 	read_unlock_bh(&pn->pppol2tp_tunnel_list_lock);
 	return NULL;
 }
 /*****************************************************************************
  * Receive data handling
  *****************************************************************************/
 /* Queue a skb in order. We come here only if the skb has an L2TP sequence
  * number.
  */
 static void pppol2tp_recv_queue_skb(struct pppol2tp_session *session, struct sk_buff *skb)
 {
 	struct sk_buff *skbp;
 	struct sk_buff *tmp;
 	u16 ns = PPPOL2TP_SKB_CB(skb)->ns;
 	spin_lock_bh(&session->reorder_q.lock);
 	skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
 		if (PPPOL2TP_SKB_CB(skbp)->ns > ns) {
 			__skb_queue_before(&session->reorder_q, skbp, skb);
 			PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
 			       "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
 			       session->name, ns, PPPOL2TP_SKB_CB(skbp)->ns,
 			       skb_queue_len(&session->reorder_q));
 			session->stats.rx_oos_packets++;
 			goto out;
 		}
 	}
 	__skb_queue_tail(&session->reorder_q, skb);
 out:
 	spin_unlock_bh(&session->reorder_q.lock);
 }
 /* Dequeue a single skb.
  */
 static void pppol2tp_recv_dequeue_skb(struct pppol2tp_session *session, struct sk_buff *skb)
 {
 	struct pppol2tp_tunnel *tunnel = session->tunnel;
 	int length = PPPOL2TP_SKB_CB(skb)->length;
 	struct sock *session_sock = NULL;
 	/* We're about to requeue the skb, so return resources
 	 * to its current owner (a socket receive buffer).
 	 */
 	skb_orphan(skb);
 	tunnel->stats.rx_packets++;
 	tunnel->stats.rx_bytes += length;
 	session->stats.rx_packets++;
 	session->stats.rx_bytes += length;
 	if (PPPOL2TP_SKB_CB(skb)->has_seq) {
 		/* Bump our Nr */
 		session->nr++;
 		PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
 		       "%s: updated nr to %hu\n", session->name, session->nr);
 	}
 	/* If the socket is bound, send it in to PPP's input queue. Otherwise
 	 * queue it on the session socket.
 	 */
 	session_sock = session->sock;
 	if (session_sock->sk_state & PPPOX_BOUND) {
 		struct pppox_sock *po;
 		PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
 		       "%s: recv %d byte data frame, passing to ppp\n",
 		       session->name, length);
 		/* We need to forget all info related to the L2TP packet
 		 * gathered in the skb as we are going to reuse the same
 		 * skb for the inner packet.
 		 * Namely we need to:
 		 * - reset xfrm (IPSec) information as it applies to
 		 *   the outer L2TP packet and not to the inner one
 		 * - release the dst to force a route lookup on the inner
 		 *   IP packet since skb->dst currently points to the dst
 		 *   of the UDP tunnel
 		 * - reset netfilter information as it doesn't apply
 		 *   to the inner packet either
 		 */
 		secpath_reset(skb);
 		skb_dst_drop(skb);
 		nf_reset(skb);
 		po = pppox_sk(session_sock);
 		ppp_input(&po->chan, skb);
 	} else {
 		PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_INFO,
 		       "%s: socket not bound\n", session->name);
 		/* Not bound. Nothing we can do, so discard. */
 		session->stats.rx_errors++;
 		kfree_skb(skb);
 	}
 	sock_put(session->sock);
 }
 /* Dequeue skbs from the session's reorder_q, subject to packet order.
  * Skbs that have been in the queue for too long are simply discarded.
  */
 static void pppol2tp_recv_dequeue(struct pppol2tp_session *session)
 {
 	struct sk_buff *skb;
 	struct sk_buff *tmp;
 	/* If the pkt at the head of the queue has the nr that we
 	 * expect to send up next, dequeue it and any other
 	 * in-sequence packets behind it.
 	 */
 	spin_lock_bh(&session->reorder_q.lock);
 	skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
 		if (time_after(jiffies, PPPOL2TP_SKB_CB(skb)->expires)) {
 			session->stats.rx_seq_discards++;
 			session->stats.rx_errors++;
 			PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
 			       "%s: oos pkt %hu len %d discarded (too old), "
 			       "waiting for %hu, reorder_q_len=%d\n",
 			       session->name, PPPOL2TP_SKB_CB(skb)->ns,
 			       PPPOL2TP_SKB_CB(skb)->length, session->nr,
 			       skb_queue_len(&session->reorder_q));
 			__skb_unlink(skb, &session->reorder_q);
 			kfree_skb(skb);
 			sock_put(session->sock);
 			continue;
 		}
 		if (PPPOL2TP_SKB_CB(skb)->has_seq) {
 			if (PPPOL2TP_SKB_CB(skb)->ns != session->nr) {
 				PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
 				       "%s: holding oos pkt %hu len %d, "
 				       "waiting for %hu, reorder_q_len=%d\n",
 				       session->name, PPPOL2TP_SKB_CB(skb)->ns,
 				       PPPOL2TP_SKB_CB(skb)->length, session->nr,
 				       skb_queue_len(&session->reorder_q));
 				goto out;
 			}
 		}
 		__skb_unlink(skb, &session->reorder_q);
 		/* Process the skb. We release the queue lock while we
 		 * do so to let other contexts process the queue.
 		 */
 		spin_unlock_bh(&session->reorder_q.lock);
 		pppol2tp_recv_dequeue_skb(session, skb);
 		spin_lock_bh(&session->reorder_q.lock);
 	}
 out:
 	spin_unlock_bh(&session->reorder_q.lock);
 }
 static inline int pppol2tp_verify_udp_checksum(struct sock *sk,
 					       struct sk_buff *skb)
 {
 	struct udphdr *uh = udp_hdr(skb);
 	u16 ulen = ntohs(uh->len);
 	struct inet_sock *inet;
 	__wsum psum;
 	if (sk->sk_no_check || skb_csum_unnecessary(skb) || !uh->check)
 		return 0;
 	inet = inet_sk(sk);
 	psum = csum_tcpudp_nofold(inet->inet_saddr, inet->inet_daddr, ulen,
 				  IPPROTO_UDP, 0);
 	if ((skb->ip_summed == CHECKSUM_COMPLETE) &&
 	    !csum_fold(csum_add(psum, skb->csum)))
 		return 0;
 	skb->csum = psum;
 	return __skb_checksum_complete(skb);
 }
 /* Internal receive frame. Do the real work of receiving an L2TP data frame
  * here. The skb is not on a list when we get here.
  * Returns 0 if the packet was a data packet and was successfully passed on.
  * Returns 1 if the packet was not a good data packet and could not be
  * forwarded.  All such packets are passed up to userspace to deal with.
  */
 static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
 {
 	struct pppol2tp_session *session = NULL;
 	struct pppol2tp_tunnel *tunnel;
 	unsigned char *ptr, *optr;
 	u16 hdrflags;
 	u16 tunnel_id, session_id;
 	int length;
 	int offset;
 	tunnel = pppol2tp_sock_to_tunnel(sock);
 	if (tunnel == NULL)
 		goto no_tunnel;
 	if (tunnel->sock && pppol2tp_verify_udp_checksum(tunnel->sock, skb))
 		goto discard_bad_csum;
 	/* UDP always verifies the packet length. */
 	__skb_pull(skb, sizeof(struct udphdr));
 	/* Short packet? */
 	if (!pskb_may_pull(skb, 12)) {
 		PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_INFO,
 		       "%s: recv short packet (len=%d)\n", tunnel->name, skb->len);
 		goto error;
 	}
 	/* Point to L2TP header */
 	optr = ptr = skb->data;
 	/* Get L2TP header flags */
 	hdrflags = ntohs(*(__be16*)ptr);
 	/* Trace packet contents, if enabled */
 	if (tunnel->debug & PPPOL2TP_MSG_DATA) {
 		length = min(16u, skb->len);
 		if (!pskb_may_pull(skb, length))
 			goto error;
 		printk(KERN_DEBUG "%s: recv: ", tunnel->name);
 		offset = 0;
 		do {
 			printk(" %02X", ptr[offset]);
 		} while (++offset < length);
 		printk("\n");
 	}
 	/* Get length of L2TP packet */
 	length = skb->len;
 	/* If type is control packet, it is handled by userspace. */
 	if (hdrflags & L2TP_HDRFLAG_T) {
 		PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
 		       "%s: recv control packet, len=%d\n", tunnel->name, length);
 		goto error;
 	}
 	/* Skip flags */
 	ptr += 2;
 	/* If length is present, skip it */
 	if (hdrflags & L2TP_HDRFLAG_L)
 		ptr += 2;
 	/* Extract tunnel and session ID */
 	tunnel_id = ntohs(*(__be16 *) ptr);
 	ptr += 2;
 	session_id = ntohs(*(__be16 *) ptr);
 	ptr += 2;
 	/* Find the session context */
 	session = pppol2tp_session_find(tunnel, session_id);
 	if (!session) {
 		/* Not found? Pass to userspace to deal with */
 		PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_INFO,
 		       "%s: no socket found (%hu/%hu). Passing up.\n",
 		       tunnel->name, tunnel_id, session_id);
 		goto error;
 	}
 	sock_hold(session->sock);
 	/* The ref count on the socket was increased by the above call since
 	 * we now hold a pointer to the session. Take care to do sock_put()
 	 * when exiting this function from now on...
 	 */
 	/* Handle the optional sequence numbers.  If we are the LAC,
 	 * enable/disable sequence numbers under the control of the LNS.  If
 	 * no sequence numbers present but we were expecting them, discard
 	 * frame.
 	 */
 	if (hdrflags & L2TP_HDRFLAG_S) {
 		u16 ns, nr;
 		ns = ntohs(*(__be16 *) ptr);
 		ptr += 2;
 		nr = ntohs(*(__be16 *) ptr);
 		ptr += 2;
 		/* Received a packet with sequence numbers. If we're the LNS,
 		 * check if we sre sending sequence numbers and if not,
 		 * configure it so.
 		 */
 		if ((!session->lns_mode) && (!session->send_seq)) {
 			PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_INFO,
 			       "%s: requested to enable seq numbers by LNS\n",
 			       session->name);
 			session->send_seq = -1;
 		}
 		/* Store L2TP info in the skb */
 		PPPOL2TP_SKB_CB(skb)->ns = ns;
 		PPPOL2TP_SKB_CB(skb)->nr = nr;
 		PPPOL2TP_SKB_CB(skb)->has_seq = 1;
 		PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
 		       "%s: recv data ns=%hu, nr=%hu, session nr=%hu\n",
 		       session->name, ns, nr, session->nr);
 	} else {
 		/* No sequence numbers.
 		 * If user has configured mandatory sequence numbers, discard.
 		 */
 		if (session->recv_seq) {
 			PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_WARNING,
 			       "%s: recv data has no seq numbers when required. "
 			       "Discarding\n", session->name);
 			session->stats.rx_seq_discards++;
 			goto discard;
 		}
 		/* If we're the LAC and we're sending sequence numbers, the
 		 * LNS has requested that we no longer send sequence numbers.
 		 * If we're the LNS and we're sending sequence numbers, the
 		 * LAC is broken. Discard the frame.
 		 */
 		if ((!session->lns_mode) && (session->send_seq)) {
 			PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_INFO,
 			       "%s: requested to disable seq numbers by LNS\n",
 			       session->name);
 			session->send_seq = 0;
 		} else if (session->send_seq) {
 			PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_WARNING,
 			       "%s: recv data has no seq numbers when required. "
 			       "Discarding\n", session->name);
 			session->stats.rx_seq_discards++;
 			goto discard;
 		}
 		/* Store L2TP info in the skb */
 		PPPOL2TP_SKB_CB(skb)->has_seq = 0;
 	}
 	/* If offset bit set, skip it. */
 	if (hdrflags & L2TP_HDRFLAG_O) {
 		offset = ntohs(*(__be16 *)ptr);
 		ptr += 2 + offset;
 	}
 	offset = ptr - optr;
 	if (!pskb_may_pull(skb, offset))
 		goto discard;
 	__skb_pull(skb, offset);
 	/* Skip PPP header, if present.	 In testing, Microsoft L2TP clients
 	 * don't send the PPP header (PPP header compression enabled), but
 	 * other clients can include the header. So we cope with both cases
 	 * here. The PPP header is always FF03 when using L2TP.
 	 *
 	 * Note that skb->data[] isn't dereferenced from a u16 ptr here since
 	 * the field may be unaligned.
 	 */
 	if (!pskb_may_pull(skb, 2))
 		goto discard;
 	if ((skb->data[0] == 0xff) && (skb->data[1] == 0x03))
 		skb_pull(skb, 2);
 	/* Prepare skb for adding to the session's reorder_q.  Hold
 	 * packets for max reorder_timeout or 1 second if not
 	 * reordering.
 	 */
 	PPPOL2TP_SKB_CB(skb)->length = length;
 	PPPOL2TP_SKB_CB(skb)->expires = jiffies +
 		(session->reorder_timeout ? session->reorder_timeout : HZ);
 	/* Add packet to the session's receive queue. Reordering is done here, if
 	 * enabled. Saved L2TP protocol info is stored in skb->sb[].
 	 */
 	if (PPPOL2TP_SKB_CB(skb)->has_seq) {
 		if (session->reorder_timeout != 0) {
 			/* Packet reordering enabled. Add skb to session's
 			 * reorder queue, in order of ns.
 			 */
 			pppol2tp_recv_queue_skb(session, skb);
 		} else {
 			/* Packet reordering disabled. Discard out-of-sequence
 			 * packets
 			 */
 			if (PPPOL2TP_SKB_CB(skb)->ns != session->nr) {
 				session->stats.rx_seq_discards++;
 				PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
 				       "%s: oos pkt %hu len %d discarded, "
 				       "waiting for %hu, reorder_q_len=%d\n",
 				       session->name, PPPOL2TP_SKB_CB(skb)->ns,
 				       PPPOL2TP_SKB_CB(skb)->length, session->nr,
 				       skb_queue_len(&session->reorder_q));
 				goto discard;
 			}
 			skb_queue_tail(&session->reorder_q, skb);
 		}
 	} else {
 		/* No sequence numbers. Add the skb to the tail of the
 		 * reorder queue. This ensures that it will be
 		 * delivered after all previous sequenced skbs.
 		 */
 		skb_queue_tail(&session->reorder_q, skb);
 	}
 	/* Try to dequeue as many skbs from reorder_q as we can. */
 	pppol2tp_recv_dequeue(session);
 	return 0;
 discard:
 	session->stats.rx_errors++;
 	kfree_skb(skb);
 	sock_put(session->sock);
 	sock_put(sock);
 	return 0;
 discard_bad_csum:
 	LIMIT_NETDEBUG("%s: UDP: bad checksum\n", tunnel->name);
 	UDP_INC_STATS_USER(&init_net, UDP_MIB_INERRORS, 0);
 	tunnel->stats.rx_errors++;
 	kfree_skb(skb);
 	return 0;
 error:
 	/* Put UDP header back */
 	__skb_push(skb, sizeof(struct udphdr));
 	sock_put(sock);
 no_tunnel:
 	return 1;
 }
 /* UDP encapsulation receive handler. See net/ipv4/udp.c.
  * Return codes:
  * 0 : success.
  * <0: error
  * >0: skb should be passed up to userspace as UDP.
  */
 static int pppol2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
 {
 	struct pppol2tp_tunnel *tunnel;
 	tunnel = pppol2tp_sock_to_tunnel(sk);
 	if (tunnel == NULL)
 		goto pass_up;
 	PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
 	       "%s: received %d bytes\n", tunnel->name, skb->len);
 	if (pppol2tp_recv_core(sk, skb))
 		goto pass_up_put;
 	sock_put(sk);
 	return 0;
 pass_up_put:
 	sock_put(sk);
 pass_up:
 	return 1;
 }
 /* Receive message. This is the recvmsg for the PPPoL2TP socket.
  */
 static int pppol2tp_recvmsg(struct kiocb *iocb, struct socket *sock,
 			    struct msghdr *msg, size_t len,
 			    int flags)
 {
 	int err;
 	struct sk_buff *skb;
 	struct sock *sk = sock->sk;
 	err = -EIO;
 	if (sk->sk_state & PPPOX_BOUND)
 		goto end;
 	msg->msg_namelen = 0;
 	err = 0;
 	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
 				flags & MSG_DONTWAIT, &err);
 	if (!skb)
 		goto end;
 	if (len > skb->len)
 		len = skb->len;
 	else if (len < skb->len)
 		msg->msg_flags |= MSG_TRUNC;
 	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, len);
 	if (likely(err == 0))
 		err = len;
 	kfree_skb(skb);
 end:
 	return err;
 }
 /************************************************************************
  * Transmit handling
  ***********************************************************************/
 /* Tell how big L2TP headers are for a particular session. This
  * depends on whether sequence numbers are being used.
  */
 static inline int pppol2tp_l2tp_header_len(struct pppol2tp_session *session)
 {
 	if (session->send_seq)
 		return PPPOL2TP_L2TP_HDR_SIZE_SEQ;
 	return PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
 }
 /* Build an L2TP header for the session into the buffer provided.
  */
 static void pppol2tp_build_l2tp_header(struct pppol2tp_session *session,
 				       void *buf)
 {
 	__be16 *bufp = buf;
 	u16 flags = L2TP_HDR_VER;
 	if (session->send_seq)
 		flags |= L2TP_HDRFLAG_S;
 	/* Setup L2TP header.
 	 * FIXME: Can this ever be unaligned? Is direct dereferencing of
 	 * 16-bit header fields safe here for all architectures?
 	 */
 	*bufp++ = htons(flags);
 	*bufp++ = htons(session->tunnel_addr.d_tunnel);
 	*bufp++ = htons(session->tunnel_addr.d_session);
 	if (session->send_seq) {
 		*bufp++ = htons(session->ns);
 		*bufp++ = 0;
 		session->ns++;
 		PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
 		       "%s: updated ns to %hu\n", session->name, session->ns);
 	}
 }
 /* This is the sendmsg for the PPPoL2TP pppol2tp_session socket.  We come here
  * when a user application does a sendmsg() on the session socket. L2TP and
  * PPP headers must be inserted into the user's data.
  */
 static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
 			    size_t total_len)
 {
 	static const unsigned char ppph[2] = { 0xff, 0x03 };
 	struct sock *sk = sock->sk;
 	struct inet_sock *inet;
 	__wsum csum;
 	struct sk_buff *skb;
 	int error;
 	int hdr_len;
 	struct pppol2tp_session *session;
 	struct pppol2tp_tunnel *tunnel;
 	struct udphdr *uh;
 	unsigned int len;
 	struct sock *sk_tun;
 	u16 udp_len;
 	error = -ENOTCONN;
 	if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
 		goto error;
 	/* Get session and tunnel contexts */
 	error = -EBADF;
 	session = pppol2tp_sock_to_session(sk);
 	if (session == NULL)
 		goto error;
 	sk_tun = session->tunnel_sock;
 	tunnel = pppol2tp_sock_to_tunnel(sk_tun);
 	if (tunnel == NULL)
 		goto error_put_sess;
 	/* What header length is configured for this session? */
 	hdr_len = pppol2tp_l2tp_header_len(session);
 	/* Allocate a socket buffer */
 	error = -ENOMEM;
 	skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) +
 			   sizeof(struct udphdr) + hdr_len +
 			   sizeof(ppph) + total_len,
 			   0, GFP_KERNEL);
 	if (!skb)
 		goto error_put_sess_tun;
 	/* Reserve space for headers. */
 	skb_reserve(skb, NET_SKB_PAD);
 	skb_reset_network_header(skb);
 	skb_reserve(skb, sizeof(struct iphdr));
 	skb_reset_transport_header(skb);
 	/* Build UDP header */
 	inet = inet_sk(sk_tun);
 	udp_len = hdr_len + sizeof(ppph) + total_len;
 	uh = (struct udphdr *) skb->data;
 	uh->source = inet->inet_sport;
 	uh->dest = inet->inet_dport;
 	uh->len = htons(udp_len);
 	uh->check = 0;
 	skb_put(skb, sizeof(struct udphdr));
 	/* Build L2TP header */
 	pppol2tp_build_l2tp_header(session, skb->data);
 	skb_put(skb, hdr_len);
 	/* Add PPP header */
 	skb->data[0] = ppph[0];
 	skb->data[1] = ppph[1];
 	skb_put(skb, 2);
 	/* Copy user data into skb */
 	error = memcpy_fromiovec(skb->data, m->msg_iov, total_len);
 	if (error < 0) {
 		kfree_skb(skb);
 		goto error_put_sess_tun;
 	}
 	skb_put(skb, total_len);
 	/* Calculate UDP checksum if configured to do so */
 	if (sk_tun->sk_no_check == UDP_CSUM_NOXMIT)
 		skb->ip_summed = CHECKSUM_NONE;
 	else if (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM)) {
 		skb->ip_summed = CHECKSUM_COMPLETE;
 		csum = skb_checksum(skb, 0, udp_len, 0);
 		uh->check = csum_tcpudp_magic(inet->inet_saddr,
 					      inet->inet_daddr,
 					      udp_len, IPPROTO_UDP, csum);
 		if (uh->check == 0)
 			uh->check = CSUM_MANGLED_0;
 	} else {
 		skb->ip_summed = CHECKSUM_PARTIAL;
 		skb->csum_start = skb_transport_header(skb) - skb->head;
 		skb->csum_offset = offsetof(struct udphdr, check);
 		uh->check = ~csum_tcpudp_magic(inet->inet_saddr,
 					       inet->inet_daddr,
 					       udp_len, IPPROTO_UDP, 0);
 	}
 	/* Debug */
 	if (session->send_seq)
 		PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
 		       "%s: send %Zd bytes, ns=%hu\n", session->name,
 		       total_len, session->ns - 1);
 	else
 		PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
 		       "%s: send %Zd bytes\n", session->name, total_len);
 	if (session->debug & PPPOL2TP_MSG_DATA) {
 		int i;
 		unsigned char *datap = skb->data;
 		printk(KERN_DEBUG "%s: xmit:", session->name);
 		for (i = 0; i < total_len; i++) {
 			printk(" %02X", *datap++);
 			if (i == 15) {
 				printk(" ...");
 				break;
 			}
 		}
 		printk("\n");
 	}
 	/* Queue the packet to IP for output */
 	len = skb->len;
 	error = ip_queue_xmit(skb, 1);
 	/* Update stats */
 	if (error >= 0) {
 		tunnel->stats.tx_packets++;
 		tunnel->stats.tx_bytes += len;
 		session->stats.tx_packets++;
 		session->stats.tx_bytes += len;
 	} else {
 		tunnel->stats.tx_errors++;
 		session->stats.tx_errors++;
 	}
 	return error;
 error_put_sess_tun:
 	sock_put(session->tunnel_sock);
 error_put_sess:
 	sock_put(sk);
 error:
 	return error;
 }
 /* Automatically called when the skb is freed.
  */
 static void pppol2tp_sock_wfree(struct sk_buff *skb)
 {
 	sock_put(skb->sk);
 }
 /* For data skbs that we transmit, we associate with the tunnel socket
  * but don't do accounting.
  */
 static inline void pppol2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
 {
 	sock_hold(sk);
 	skb->sk = sk;
 	skb->destructor = pppol2tp_sock_wfree;
 }
 /* Transmit function called by generic PPP driver.  Sends PPP frame
  * over PPPoL2TP socket.
  *
  * This is almost the same as pppol2tp_sendmsg(), but rather than
  * being called with a msghdr from userspace, it is called with a skb
  * from the kernel.
  *
  * The supplied skb from ppp doesn't have enough headroom for the
  * insertion of L2TP, UDP and IP headers so we need to allocate more
  * headroom in the skb. This will create a cloned skb. But we must be
  * careful in the error case because the caller will expect to free
  * the skb it supplied, not our cloned skb. So we take care to always
  * leave the original skb unfreed if we return an error.
  */
 static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
 {
 	static const u8 ppph[2] = { 0xff, 0x03 };
 	struct sock *sk = (struct sock *) chan->private;
 	struct sock *sk_tun;
 	int hdr_len;
 	u16 udp_len;
 	struct pppol2tp_session *session;
 	struct pppol2tp_tunnel *tunnel;
 	int rc;
 	int headroom;
 	int data_len = skb->len;
 	struct inet_sock *inet;
 	__wsum csum;
 	struct udphdr *uh;
 	unsigned int len;
 	int old_headroom;
 	int new_headroom;
 	if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
 		goto abort;
 	/* Get session and tunnel contexts from the socket */
 	session = pppol2tp_sock_to_session(sk);
 	if (session == NULL)
 		goto abort;
 	sk_tun = session->tunnel_sock;
 	if (sk_tun == NULL)
 		goto abort_put_sess;
 	tunnel = pppol2tp_sock_to_tunnel(sk_tun);
 	if (tunnel == NULL)
 		goto abort_put_sess;
 	/* What header length is configured for this session? */
 	hdr_len = pppol2tp_l2tp_header_len(session);
 	/* Check that there's enough headroom in the skb to insert IP,
 	 * UDP and L2TP and PPP headers. If not enough, expand it to
 	 * make room. Adjust truesize.
 	 */
 	headroom = NET_SKB_PAD + sizeof(struct iphdr) +
 		sizeof(struct udphdr) + hdr_len + sizeof(ppph);
 	old_headroom = skb_headroom(skb);
 	if (skb_cow_head(skb, headroom))
 		goto abort_put_sess_tun;
 	new_headroom = skb_headroom(skb);
 	skb_orphan(skb);
 	skb->truesize += new_headroom - old_headroom;
 	/* Setup PPP header */
 	__skb_push(skb, sizeof(ppph));
 	skb->data[0] = ppph[0];
 	skb->data[1] = ppph[1];
 	/* Setup L2TP header */
 	pppol2tp_build_l2tp_header(session, __skb_push(skb, hdr_len));
 	udp_len = sizeof(struct udphdr) + hdr_len + sizeof(ppph) + data_len;
 	/* Setup UDP header */
 	inet = inet_sk(sk_tun);
 	__skb_push(skb, sizeof(*uh));
 	skb_reset_transport_header(skb);
 	uh = udp_hdr(skb);
 	uh->source = inet->inet_sport;
 	uh->dest = inet->inet_dport;
 	uh->len = htons(udp_len);
 	uh->check = 0;
 	/* Debug */
 	if (session->send_seq)
 		PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
 		       "%s: send %d bytes, ns=%hu\n", session->name,
 		       data_len, session->ns - 1);
 	else
 		PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
 		       "%s: send %d bytes\n", session->name, data_len);
 	if (session->debug & PPPOL2TP_MSG_DATA) {
 		int i;
 		unsigned char *datap = skb->data;
 		printk(KERN_DEBUG "%s: xmit:", session->name);
 		for (i = 0; i < data_len; i++) {
 			printk(" %02X", *datap++);
 			if (i == 31) {
 				printk(" ...");
 				break;
 			}
 		}
 		printk("\n");
 	}
 	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
 	IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
 			      IPSKB_REROUTED);
 	nf_reset(skb);
 	/* Get routing info from the tunnel socket */
 	skb_dst_drop(skb);
 	skb_dst_set(skb, dst_clone(__sk_dst_get(sk_tun)));
 	pppol2tp_skb_set_owner_w(skb, sk_tun);
 	/* Calculate UDP checksum if configured to do so */
 	if (sk_tun->sk_no_check == UDP_CSUM_NOXMIT)
 		skb->ip_summed = CHECKSUM_NONE;
 	else if (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM)) {
 		skb->ip_summed = CHECKSUM_COMPLETE;
 		csum = skb_checksum(skb, 0, udp_len, 0);
 		uh->check = csum_tcpudp_magic(inet->inet_saddr,
 					      inet->inet_daddr,
 					      udp_len, IPPROTO_UDP, csum);
 		if (uh->check == 0)
 			uh->check = CSUM_MANGLED_0;
 	} else {
 		skb->ip_summed = CHECKSUM_PARTIAL;
 		skb->csum_start = skb_transport_header(skb) - skb->head;
 		skb->csum_offset = offsetof(struct udphdr, check);
 		uh->check = ~csum_tcpudp_magic(inet->inet_saddr,
 					       inet->inet_daddr,
 					       udp_len, IPPROTO_UDP, 0);
 	}
 	/* Queue the packet to IP for output */
 	len = skb->len;
 	rc = ip_queue_xmit(skb, 1);
 	/* Update stats */
 	if (rc >= 0) {
 		tunnel->stats.tx_packets++;
 		tunnel->stats.tx_bytes += len;
 		session->stats.tx_packets++;
 		session->stats.tx_bytes += len;
 	} else {
 		tunnel->stats.tx_errors++;
 		session->stats.tx_errors++;
 	}
 	sock_put(sk_tun);
 	sock_put(sk);
 	return 1;
 abort_put_sess_tun:
 	sock_put(sk_tun);
 abort_put_sess:
 	sock_put(sk);
 abort:
 	/* Free the original skb */
 	kfree_skb(skb);
 	return 1;
 }
 /*****************************************************************************
  * Session (and tunnel control) socket create/destroy.
  *****************************************************************************/
 /* When the tunnel UDP socket is closed, all the attached sockets need to go
  * too.
  */
 static void pppol2tp_tunnel_closeall(struct pppol2tp_tunnel *tunnel)
 {
 	int hash;
 	struct hlist_node *walk;
 	struct hlist_node *tmp;
 	struct pppol2tp_session *session;
 	struct sock *sk;
 	BUG_ON(tunnel == NULL);
 	PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 	       "%s: closing all sessions...\n", tunnel->name);
 	write_lock_bh(&tunnel->hlist_lock);
 	for (hash = 0; hash < PPPOL2TP_HASH_SIZE; hash++) {
 again:
 		hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
 			struct sk_buff *skb;
 			session = hlist_entry(walk, struct pppol2tp_session, hlist);
 			sk = session->sock;
 			PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 			       "%s: closing session\n", session->name);
 			hlist_del_init(&session->hlist);
 			/* Since we should hold the sock lock while
 			 * doing any unbinding, we need to release the
 			 * lock we're holding before taking that lock.
 			 * Hold a reference to the sock so it doesn't
 			 * disappear as we're jumping between locks.
 			 */
 			sock_hold(sk);
 			write_unlock_bh(&tunnel->hlist_lock);
 			lock_sock(sk);
 			if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
 				pppox_unbind_sock(sk);
 				sk->sk_state = PPPOX_DEAD;
 				sk->sk_state_change(sk);
 			}
 			/* Purge any queued data */
 			skb_queue_purge(&sk->sk_receive_queue);
 			skb_queue_purge(&sk->sk_write_queue);
 			while ((skb = skb_dequeue(&session->reorder_q))) {
 				kfree_skb(skb);
 				sock_put(sk);
 			}
 			release_sock(sk);
 			sock_put(sk);
 			/* Now restart from the beginning of this hash
 			 * chain.  We always remove a session from the
 			 * list so we are guaranteed to make forward
 			 * progress.
 			 */
 			write_lock_bh(&tunnel->hlist_lock);
 			goto again;
 		}
 	}
 	write_unlock_bh(&tunnel->hlist_lock);
 }
 /* Really kill the tunnel.
  * Come here only when all sessions have been cleared from the tunnel.
  */
 static void pppol2tp_tunnel_free(struct pppol2tp_tunnel *tunnel)
 {
 	struct pppol2tp_net *pn = pppol2tp_pernet(tunnel->pppol2tp_net);
 	/* Remove from socket list */
 	write_lock_bh(&pn->pppol2tp_tunnel_list_lock);
 	list_del_init(&tunnel->list);
 	write_unlock_bh(&pn->pppol2tp_tunnel_list_lock);
 	atomic_dec(&pppol2tp_tunnel_count);
 	kfree(tunnel);
 }
 /* Tunnel UDP socket destruct hook.
  * The tunnel context is deleted only when all session sockets have been
  * closed.
  */
 static void pppol2tp_tunnel_destruct(struct sock *sk)
 {
 	struct pppol2tp_tunnel *tunnel;
 	tunnel = sk->sk_user_data;
 	if (tunnel == NULL)
 		goto end;
 	PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 	       "%s: closing...\n", tunnel->name);
 	/* Close all sessions */
 	pppol2tp_tunnel_closeall(tunnel);
 	/* No longer an encapsulation socket. See net/ipv4/udp.c */
 	(udp_sk(sk))->encap_type = 0;
 	(udp_sk(sk))->encap_rcv = NULL;
 	/* Remove hooks into tunnel socket */
 	tunnel->sock = NULL;
 	sk->sk_destruct = tunnel->old_sk_destruct;
 	sk->sk_user_data = NULL;
 	/* Call original (UDP) socket descructor */
 	if (sk->sk_destruct != NULL)
 		(*sk->sk_destruct)(sk);
 	pppol2tp_tunnel_dec_refcount(tunnel);
 end:
 	return;
 }
 /* Really kill the session socket. (Called from sock_put() if
  * refcnt == 0.)
  */
 static void pppol2tp_session_destruct(struct sock *sk)
 {
 	struct pppol2tp_session *session = NULL;
 	if (sk->sk_user_data != NULL) {
 		struct pppol2tp_tunnel *tunnel;
 		session = sk->sk_user_data;
 		if (session == NULL)
 			goto out;
 		BUG_ON(session->magic != L2TP_SESSION_MAGIC);
 		/* Don't use pppol2tp_sock_to_tunnel() here to
 		 * get the tunnel context because the tunnel
 		 * socket might have already been closed (its
 		 * sk->sk_user_data will be NULL) so use the
 		 * session's private tunnel ptr instead.
 		 */
 		tunnel = session->tunnel;
 		if (tunnel != NULL) {
 			BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
 			/* If session_id is zero, this is a null
 			 * session context, which was created for a
 			 * socket that is being used only to manage
 			 * tunnels.
 			 */
 			if (session->tunnel_addr.s_session != 0) {
 				/* Delete the session socket from the
 				 * hash
 				 */
 				write_lock_bh(&tunnel->hlist_lock);
 				hlist_del_init(&session->hlist);
 				write_unlock_bh(&tunnel->hlist_lock);
 				atomic_dec(&pppol2tp_session_count);
 			}
 			/* This will delete the tunnel context if this
 			 * is the last session on the tunnel.
 			 */
 			session->tunnel = NULL;
 			session->tunnel_sock = NULL;
 			pppol2tp_tunnel_dec_refcount(tunnel);
 		}
 	}
 	kfree(session);
 out:
 	return;
 }
 /* Called when the PPPoX socket (session) is closed.
  */
 static int pppol2tp_release(struct socket *sock)
 {
 	struct sock *sk = sock->sk;
 	struct pppol2tp_session *session;
 	int error;
 	if (!sk)
 		return 0;
 	error = -EBADF;
 	lock_sock(sk);
 	if (sock_flag(sk, SOCK_DEAD) != 0)
 		goto error;
 	pppox_unbind_sock(sk);
 	/* Signal the death of the socket. */
 	sk->sk_state = PPPOX_DEAD;
 	sock_orphan(sk);
 	sock->sk = NULL;
 	session = pppol2tp_sock_to_session(sk);
 	/* Purge any queued data */
 	skb_queue_purge(&sk->sk_receive_queue);
 	skb_queue_purge(&sk->sk_write_queue);
 	if (session != NULL) {
 		struct sk_buff *skb;
 		while ((skb = skb_dequeue(&session->reorder_q))) {
 			kfree_skb(skb);
 			sock_put(sk);
 		}
 		sock_put(sk);
 	}
 	release_sock(sk);
 	/* This will delete the session context via
 	 * pppol2tp_session_destruct() if the socket's refcnt drops to
 	 * zero.
 	 */
 	sock_put(sk);
 	return 0;
 error:
 	release_sock(sk);
 	return error;
 }
 /* Internal function to prepare a tunnel (UDP) socket to have PPPoX
  * sockets attached to it.
  */
 static struct sock *pppol2tp_prepare_tunnel_socket(struct net *net,
 					int fd, u16 tunnel_id, int *error)
 {
 	int err;
 	struct socket *sock = NULL;
 	struct sock *sk;
 	struct pppol2tp_tunnel *tunnel;
 	struct pppol2tp_net *pn;
 	struct sock *ret = NULL;
 	/* Get the tunnel UDP socket from the fd, which was opened by
 	 * the userspace L2TP daemon.
 	 */
 	err = -EBADF;
 	sock = sockfd_lookup(fd, &err);
 	if (!sock) {
 		PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_ERR,
 		       "tunl %hu: sockfd_lookup(fd=%d) returned %d\n",
 		       tunnel_id, fd, err);
 		goto err;
 	}
 	sk = sock->sk;
 	/* Quick sanity checks */
 	err = -EPROTONOSUPPORT;
 	if (sk->sk_protocol != IPPROTO_UDP) {
 		PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_ERR,
 		       "tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
 		       tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
 		goto err;
 	}
 	err = -EAFNOSUPPORT;
 	if (sock->ops->family != AF_INET) {
 		PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_ERR,
 		       "tunl %hu: fd %d wrong family, got %d, expected %d\n",
 		       tunnel_id, fd, sock->ops->family, AF_INET);
 		goto err;
 	}
 	err = -ENOTCONN;
 	/* Check if this socket has already been prepped */
 	tunnel = (struct pppol2tp_tunnel *)sk->sk_user_data;
 	if (tunnel != NULL) {
 		/* User-data field already set */
 		err = -EBUSY;
 		BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
 		/* This socket has already been prepped */
 		ret = tunnel->sock;
 		goto out;
 	}
 	/* This socket is available and needs prepping. Create a new tunnel
 	 * context and init it.
 	 */
 	sk->sk_user_data = tunnel = kzalloc(sizeof(struct pppol2tp_tunnel), GFP_KERNEL);
 	if (sk->sk_user_data == NULL) {
 		err = -ENOMEM;
 		goto err;
 	}
 	tunnel->magic = L2TP_TUNNEL_MAGIC;
 	sprintf(&tunnel->name[0], "tunl %hu", tunnel_id);
 	tunnel->stats.tunnel_id = tunnel_id;
 	tunnel->debug = PPPOL2TP_DEFAULT_DEBUG_FLAGS;
 	/* Hook on the tunnel socket destructor so that we can cleanup
 	 * if the tunnel socket goes away.
 	 */
 	tunnel->old_sk_destruct = sk->sk_destruct;
 	sk->sk_destruct = pppol2tp_tunnel_destruct;
 	tunnel->sock = sk;
 	sk->sk_allocation = GFP_ATOMIC;
 	/* Misc init */
 	rwlock_init(&tunnel->hlist_lock);
 	/* The net we belong to */
 	tunnel->pppol2tp_net = net;
 	pn = pppol2tp_pernet(net);
 	/* Add tunnel to our list */
 	INIT_LIST_HEAD(&tunnel->list);
 	write_lock_bh(&pn->pppol2tp_tunnel_list_lock);
 	list_add(&tunnel->list, &pn->pppol2tp_tunnel_list);
 	write_unlock_bh(&pn->pppol2tp_tunnel_list_lock);
 	atomic_inc(&pppol2tp_tunnel_count);
 	/* Bump the reference count. The tunnel context is deleted
 	 * only when this drops to zero.
 	 */
 	pppol2tp_tunnel_inc_refcount(tunnel);
 	/* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
 	(udp_sk(sk))->encap_type = UDP_ENCAP_L2TPINUDP;
 	(udp_sk(sk))->encap_rcv = pppol2tp_udp_encap_recv;
 	ret = tunnel->sock;
 	*error = 0;
 out:
 	if (sock)
 		sockfd_put(sock);
 	return ret;
 err:
 	*error = err;
 	goto out;
 }
 static struct proto pppol2tp_sk_proto = {
 	.name	  = "PPPOL2TP",
 	.owner	  = THIS_MODULE,
 	.obj_size = sizeof(struct pppox_sock),
 };
 /* socket() handler. Initialize a new struct sock.
  */
 static int pppol2tp_create(struct net *net, struct socket *sock)
 {
 	int error = -ENOMEM;
 	struct sock *sk;
 	sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto);
 	if (!sk)
 		goto out;
 	sock_init_data(sock, sk);
 	sock->state  = SS_UNCONNECTED;
 	sock->ops    = &pppol2tp_ops;
 	sk->sk_backlog_rcv = pppol2tp_recv_core;
 	sk->sk_protocol	   = PX_PROTO_OL2TP;
 	sk->sk_family	   = PF_PPPOX;
 	sk->sk_state	   = PPPOX_NONE;
 	sk->sk_type	   = SOCK_STREAM;
 	sk->sk_destruct	   = pppol2tp_session_destruct;
 	error = 0;
 out:
 	return error;
 }
 /* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
  */
 static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
 			    int sockaddr_len, int flags)
 {
 	struct sock *sk = sock->sk;
 	struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr;
 	struct pppox_sock *po = pppox_sk(sk);
 	struct sock *tunnel_sock = NULL;
 	struct pppol2tp_session *session = NULL;
 	struct pppol2tp_tunnel *tunnel;
 	struct dst_entry *dst;
 	int error = 0;
 	lock_sock(sk);
 	error = -EINVAL;
 	if (sp->sa_protocol != PX_PROTO_OL2TP)
 		goto end;
 	/* Check for already bound sockets */
 	error = -EBUSY;
 	if (sk->sk_state & PPPOX_CONNECTED)
 		goto end;
 	/* We don't supporting rebinding anyway */
 	error = -EALREADY;
 	if (sk->sk_user_data)
 		goto end; /* socket is already attached */
 	/* Don't bind if s_tunnel is 0 */
 	error = -EINVAL;
 	if (sp->pppol2tp.s_tunnel == 0)
 		goto end;
 	/* Special case: prepare tunnel socket if s_session and
 	 * d_session is 0. Otherwise look up tunnel using supplied
 	 * tunnel id.
 	 */
 	if ((sp->pppol2tp.s_session == 0) && (sp->pppol2tp.d_session == 0)) {
 		tunnel_sock = pppol2tp_prepare_tunnel_socket(sock_net(sk),
 							     sp->pppol2tp.fd,
 							     sp->pppol2tp.s_tunnel,
 							     &error);
 		if (tunnel_sock == NULL)
 			goto end;
 		tunnel = tunnel_sock->sk_user_data;
 	} else {
 		tunnel = pppol2tp_tunnel_find(sock_net(sk), sp->pppol2tp.s_tunnel);
 		/* Error if we can't find the tunnel */
 		error = -ENOENT;
 		if (tunnel == NULL)
 			goto end;
 		tunnel_sock = tunnel->sock;
 	}
 	/* Check that this session doesn't already exist */
 	error = -EEXIST;
 	session = pppol2tp_session_find(tunnel, sp->pppol2tp.s_session);
 	if (session != NULL)
 		goto end;
 	/* Allocate and initialize a new session context. */
 	session = kzalloc(sizeof(struct pppol2tp_session), GFP_KERNEL);
 	if (session == NULL) {
 		error = -ENOMEM;
 		goto end;
 	}
 	skb_queue_head_init(&session->reorder_q);
 	session->magic	     = L2TP_SESSION_MAGIC;
 	session->owner	     = current->pid;
 	session->sock	     = sk;
 	session->tunnel	     = tunnel;
 	session->tunnel_sock = tunnel_sock;
 	session->tunnel_addr = sp->pppol2tp;
 	sprintf(&session->name[0], "sess %hu/%hu",
 		session->tunnel_addr.s_tunnel,
 		session->tunnel_addr.s_session);
 	session->stats.tunnel_id  = session->tunnel_addr.s_tunnel;
 	session->stats.session_id = session->tunnel_addr.s_session;
 	INIT_HLIST_NODE(&session->hlist);
 	/* Inherit debug options from tunnel */
 	session->debug = tunnel->debug;
 	/* Default MTU must allow space for UDP/L2TP/PPP
 	 * headers.
 	 */
 	session->mtu = session->mru = 1500 - PPPOL2TP_HEADER_OVERHEAD;
 	/* If PMTU discovery was enabled, use the MTU that was discovered */
 	dst = sk_dst_get(sk);
 	if (dst != NULL) {
 		u32 pmtu = dst_mtu(__sk_dst_get(sk));
 		if (pmtu != 0)
 			session->mtu = session->mru = pmtu -
 				PPPOL2TP_HEADER_OVERHEAD;
 		dst_release(dst);
 	}
 	/* Special case: if source & dest session_id == 0x0000, this socket is
 	 * being created to manage the tunnel. Don't add the session to the
 	 * session hash list, just set up the internal context for use by
 	 * ioctl() and sockopt() handlers.
 	 */
 	if ((session->tunnel_addr.s_session == 0) &&
 	    (session->tunnel_addr.d_session == 0)) {
 		error = 0;
 		sk->sk_user_data = session;
 		goto out_no_ppp;
 	}
 	/* Get tunnel context from the tunnel socket */
 	tunnel = pppol2tp_sock_to_tunnel(tunnel_sock);
 	if (tunnel == NULL) {
 		error = -EBADF;
 		goto end;
 	}
 	/* Right now, because we don't have a way to push the incoming skb's
 	 * straight through the UDP layer, the only header we need to worry
 	 * about is the L2TP header. This size is different depending on
 	 * whether sequence numbers are enabled for the data channel.
 	 */
 	po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
 	po->chan.private = sk;
 	po->chan.ops	 = &pppol2tp_chan_ops;
 	po->chan.mtu	 = session->mtu;
 	error = ppp_register_net_channel(sock_net(sk), &po->chan);
 	if (error)
 		goto end_put_tun;
 	/* This is how we get the session context from the socket. */
 	sk->sk_user_data = session;
 	/* Add session to the tunnel's hash list */
 	write_lock_bh(&tunnel->hlist_lock);
 	hlist_add_head(&session->hlist,
 		       pppol2tp_session_id_hash(tunnel,
 						session->tunnel_addr.s_session));
 	write_unlock_bh(&tunnel->hlist_lock);
 	atomic_inc(&pppol2tp_session_count);
 out_no_ppp:
 	pppol2tp_tunnel_inc_refcount(tunnel);
 	sk->sk_state = PPPOX_CONNECTED;
 	PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 	       "%s: created\n", session->name);
 end_put_tun:
 	sock_put(tunnel_sock);
 end:
 	release_sock(sk);
 	if (error != 0) {
 		if (session)
 			PRINTK(session->debug,
 				PPPOL2TP_MSG_CONTROL, KERN_WARNING,
 				"%s: connect failed: %d\n",
 				session->name, error);
 		else
 			PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_WARNING,
 				"connect failed: %d\n", error);
 	}
 	return error;
 }
 /* getname() support.
  */
 static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
 			    int *usockaddr_len, int peer)
 {
 	int len = sizeof(struct sockaddr_pppol2tp);
 	struct sockaddr_pppol2tp sp;
 	int error = 0;
 	struct pppol2tp_session *session;
 	error = -ENOTCONN;
 	if (sock->sk->sk_state != PPPOX_CONNECTED)
 		goto end;
 	session = pppol2tp_sock_to_session(sock->sk);
 	if (session == NULL) {
 		error = -EBADF;
 		goto end;
 	}
 	sp.sa_family	= AF_PPPOX;
 	sp.sa_protocol	= PX_PROTO_OL2TP;
 	memcpy(&sp.pppol2tp, &session->tunnel_addr,
 	       sizeof(struct pppol2tp_addr));
 	memcpy(uaddr, &sp, len);
 	*usockaddr_len = len;
 	error = 0;
 	sock_put(sock->sk);
 end:
 	return error;
 }
 /****************************************************************************
  * ioctl() handlers.
  *
  * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
  * sockets. However, in order to control kernel tunnel features, we allow
  * userspace to create a special "tunnel" PPPoX socket which is used for
  * control only.  Tunnel PPPoX sockets have session_id == 0 and simply allow
  * the user application to issue L2TP setsockopt(), getsockopt() and ioctl()
  * calls.
  ****************************************************************************/
 /* Session ioctl helper.
  */
 static int pppol2tp_session_ioctl(struct pppol2tp_session *session,
 				  unsigned int cmd, unsigned long arg)
 {
 	struct ifreq ifr;
 	int err = 0;
 	struct sock *sk = session->sock;
 	int val = (int) arg;
 	PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_DEBUG,
 	       "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n",
 	       session->name, cmd, arg);
 	sock_hold(sk);
 	switch (cmd) {
 	case SIOCGIFMTU:
 		err = -ENXIO;
 		if (!(sk->sk_state & PPPOX_CONNECTED))
 			break;
 		err = -EFAULT;
 		if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq)))
 			break;
 		ifr.ifr_mtu = session->mtu;
 		if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq)))
 			break;
 		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: get mtu=%d\n", session->name, session->mtu);
 		err = 0;
 		break;
 	case SIOCSIFMTU:
 		err = -ENXIO;
 		if (!(sk->sk_state & PPPOX_CONNECTED))
 			break;
 		err = -EFAULT;
 		if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq)))
 			break;
 		session->mtu = ifr.ifr_mtu;
 		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: set mtu=%d\n", session->name, session->mtu);
 		err = 0;
 		break;
 	case PPPIOCGMRU:
 		err = -ENXIO;
 		if (!(sk->sk_state & PPPOX_CONNECTED))
 			break;
 		err = -EFAULT;
 		if (put_user(session->mru, (int __user *) arg))
 			break;
 		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: get mru=%d\n", session->name, session->mru);
 		err = 0;
 		break;
 	case PPPIOCSMRU:
 		err = -ENXIO;
 		if (!(sk->sk_state & PPPOX_CONNECTED))
 			break;
 		err = -EFAULT;
 		if (get_user(val,(int __user *) arg))
 			break;
 		session->mru = val;
 		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: set mru=%d\n", session->name, session->mru);
 		err = 0;
 		break;
 	case PPPIOCGFLAGS:
 		err = -EFAULT;
 		if (put_user(session->flags, (int __user *) arg))
 			break;
 		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: get flags=%d\n", session->name, session->flags);
 		err = 0;
 		break;
 	case PPPIOCSFLAGS:
 		err = -EFAULT;
 		if (get_user(val, (int __user *) arg))
 			break;
 		session->flags = val;
 		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: set flags=%d\n", session->name, session->flags);
 		err = 0;
 		break;
 	case PPPIOCGL2TPSTATS:
 		err = -ENXIO;
 		if (!(sk->sk_state & PPPOX_CONNECTED))
 			break;
 		if (copy_to_user((void __user *) arg, &session->stats,
 				 sizeof(session->stats)))
 			break;
 		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: get L2TP stats\n", session->name);
 		err = 0;
 		break;
 	default:
 		err = -ENOSYS;
 		break;
 	}
 	sock_put(sk);
 	return err;
 }
 /* Tunnel ioctl helper.
  *
  * Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data
  * specifies a session_id, the session ioctl handler is called. This allows an
  * application to retrieve session stats via a tunnel socket.
  */
 static int pppol2tp_tunnel_ioctl(struct pppol2tp_tunnel *tunnel,
 				 unsigned int cmd, unsigned long arg)
 {
 	int err = 0;
 	struct sock *sk = tunnel->sock;
 	struct pppol2tp_ioc_stats stats_req;
 	PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_DEBUG,
 	       "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n", tunnel->name,
 	       cmd, arg);
 	sock_hold(sk);
 	switch (cmd) {
 	case PPPIOCGL2TPSTATS:
 		err = -ENXIO;
 		if (!(sk->sk_state & PPPOX_CONNECTED))
 			break;
 		if (copy_from_user(&stats_req, (void __user *) arg,
 				   sizeof(stats_req))) {
 			err = -EFAULT;
 			break;
 		}
 		if (stats_req.session_id != 0) {
 			/* resend to session ioctl handler */
 			struct pppol2tp_session *session =
 				pppol2tp_session_find(tunnel, stats_req.session_id);
 			if (session != NULL)
 				err = pppol2tp_session_ioctl(session, cmd, arg);
 			else
 				err = -EBADR;
 			break;
 		}
 #ifdef CONFIG_XFRM
 		tunnel->stats.using_ipsec = (sk->sk_policy[0] || sk->sk_policy[1]) ? 1 : 0;
 #endif
 		if (copy_to_user((void __user *) arg, &tunnel->stats,
 				 sizeof(tunnel->stats))) {
 			err = -EFAULT;
 			break;
 		}
 		PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: get L2TP stats\n", tunnel->name);
 		err = 0;
 		break;
 	default:
 		err = -ENOSYS;
 		break;
 	}
 	sock_put(sk);
 	return err;
 }
 /* Main ioctl() handler.
  * Dispatch to tunnel or session helpers depending on the socket.
  */
 static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
 			  unsigned long arg)
 {
 	struct sock *sk = sock->sk;
 	struct pppol2tp_session *session;
 	struct pppol2tp_tunnel *tunnel;
 	int err;
 	if (!sk)
 		return 0;
 	err = -EBADF;
 	if (sock_flag(sk, SOCK_DEAD) != 0)
 		goto end;
 	err = -ENOTCONN;
 	if ((sk->sk_user_data == NULL) ||
 	    (!(sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND))))
 		goto end;
 	/* Get session context from the socket */
 	err = -EBADF;
 	session = pppol2tp_sock_to_session(sk);
 	if (session == NULL)
 		goto end;
 	/* Special case: if session's session_id is zero, treat ioctl as a
 	 * tunnel ioctl
 	 */
 	if ((session->tunnel_addr.s_session == 0) &&
 	    (session->tunnel_addr.d_session == 0)) {
 		err = -EBADF;
 		tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
 		if (tunnel == NULL)
 			goto end_put_sess;
 		err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg);
 		sock_put(session->tunnel_sock);
 		goto end_put_sess;
 	}
 	err = pppol2tp_session_ioctl(session, cmd, arg);
 end_put_sess:
 	sock_put(sk);
 end:
 	return err;
 }
 /*****************************************************************************
  * setsockopt() / getsockopt() support.
  *
  * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
  * sockets. In order to control kernel tunnel features, we allow userspace to
  * create a special "tunnel" PPPoX socket which is used for control only.
  * Tunnel PPPoX sockets have session_id == 0 and simply allow the user
  * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls.
  *****************************************************************************/
 /* Tunnel setsockopt() helper.
  */
 static int pppol2tp_tunnel_setsockopt(struct sock *sk,
 				      struct pppol2tp_tunnel *tunnel,
 				      int optname, int val)
 {
 	int err = 0;
 	switch (optname) {
 	case PPPOL2TP_SO_DEBUG:
 		tunnel->debug = val;
 		PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: set debug=%x\n", tunnel->name, tunnel->debug);
 		break;
 	default:
 		err = -ENOPROTOOPT;
 		break;
 	}
 	return err;
 }
 /* Session setsockopt helper.
  */
 static int pppol2tp_session_setsockopt(struct sock *sk,
 				       struct pppol2tp_session *session,
 				       int optname, int val)
 {
 	int err = 0;
 	switch (optname) {
 	case PPPOL2TP_SO_RECVSEQ:
 		if ((val != 0) && (val != 1)) {
 			err = -EINVAL;
 			break;
 		}
 		session->recv_seq = val ? -1 : 0;
 		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: set recv_seq=%d\n", session->name,
 		       session->recv_seq);
 		break;
 	case PPPOL2TP_SO_SENDSEQ:
 		if ((val != 0) && (val != 1)) {
 			err = -EINVAL;
 			break;
 		}
 		session->send_seq = val ? -1 : 0;
 		{
 			struct sock *ssk      = session->sock;
 			struct pppox_sock *po = pppox_sk(ssk);
 			po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
 				PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
 		}
 		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: set send_seq=%d\n", session->name, session->send_seq);
 		break;
 	case PPPOL2TP_SO_LNSMODE:
 		if ((val != 0) && (val != 1)) {
 			err = -EINVAL;
 			break;
 		}
 		session->lns_mode = val ? -1 : 0;
 		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: set lns_mode=%d\n", session->name,
 		       session->lns_mode);
 		break;
 	case PPPOL2TP_SO_DEBUG:
 		session->debug = val;
 		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: set debug=%x\n", session->name, session->debug);
 		break;
 	case PPPOL2TP_SO_REORDERTO:
 		session->reorder_timeout = msecs_to_jiffies(val);
 		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: set reorder_timeout=%d\n", session->name,
 		       session->reorder_timeout);
 		break;
 	default:
 		err = -ENOPROTOOPT;
 		break;
 	}
 	return err;
 }
 /* Main setsockopt() entry point.
  * Does API checks, then calls either the tunnel or session setsockopt
  * handler, according to whether the PPPoL2TP socket is a for a regular
  * session or the special tunnel type.
  */
 static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
 			       char __user *optval, unsigned int optlen)
 {
 	struct sock *sk = sock->sk;
 	struct pppol2tp_session *session = sk->sk_user_data;
 	struct pppol2tp_tunnel *tunnel;
 	int val;
 	int err;
 	if (level != SOL_PPPOL2TP)
 		return udp_prot.setsockopt(sk, level, optname, optval, optlen);
 	if (optlen < sizeof(int))
 		return -EINVAL;
 	if (get_user(val, (int __user *)optval))
 		return -EFAULT;
 	err = -ENOTCONN;
 	if (sk->sk_user_data == NULL)
 		goto end;
 	/* Get session context from the socket */
 	err = -EBADF;
 	session = pppol2tp_sock_to_session(sk);
 	if (session == NULL)
 		goto end;
 	/* Special case: if session_id == 0x0000, treat as operation on tunnel
 	 */
 	if ((session->tunnel_addr.s_session == 0) &&
 	    (session->tunnel_addr.d_session == 0)) {
 		err = -EBADF;
 		tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
 		if (tunnel == NULL)
 			goto end_put_sess;
 		err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
 		sock_put(session->tunnel_sock);
 	} else
 		err = pppol2tp_session_setsockopt(sk, session, optname, val);
 	err = 0;
 end_put_sess:
 	sock_put(sk);
 end:
 	return err;
 }
 /* Tunnel getsockopt helper. Called with sock locked.
  */
 static int pppol2tp_tunnel_getsockopt(struct sock *sk,
 				      struct pppol2tp_tunnel *tunnel,
 				      int optname, int *val)
 {
 	int err = 0;
 	switch (optname) {
 	case PPPOL2TP_SO_DEBUG:
 		*val = tunnel->debug;
 		PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: get debug=%x\n", tunnel->name, tunnel->debug);
 		break;
 	default:
 		err = -ENOPROTOOPT;
 		break;
 	}
 	return err;
 }
 /* Session getsockopt helper. Called with sock locked.
  */
 static int pppol2tp_session_getsockopt(struct sock *sk,
 				       struct pppol2tp_session *session,
 				       int optname, int *val)
 {
 	int err = 0;
 	switch (optname) {
 	case PPPOL2TP_SO_RECVSEQ:
 		*val = session->recv_seq;
 		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: get recv_seq=%d\n", session->name, *val);
 		break;
 	case PPPOL2TP_SO_SENDSEQ:
 		*val = session->send_seq;
 		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: get send_seq=%d\n", session->name, *val);
 		break;
 	case PPPOL2TP_SO_LNSMODE:
 		*val = session->lns_mode;
 		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: get lns_mode=%d\n", session->name, *val);
 		break;
 	case PPPOL2TP_SO_DEBUG:
 		*val = session->debug;
 		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: get debug=%d\n", session->name, *val);
 		break;
 	case PPPOL2TP_SO_REORDERTO:
 		*val = (int) jiffies_to_msecs(session->reorder_timeout);
 		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
 		       "%s: get reorder_timeout=%d\n", session->name, *val);
 		break;
 	default:
 		err = -ENOPROTOOPT;
 	}
 	return err;
 }
 /* Main getsockopt() entry point.
  * Does API checks, then calls either the tunnel or session getsockopt
  * handler, according to whether the PPPoX socket is a for a regular session
  * or the special tunnel type.
  */
 static int pppol2tp_getsockopt(struct socket *sock, int level,
 			       int optname, char __user *optval, int __user *optlen)
 {
 	struct sock *sk = sock->sk;
 	struct pppol2tp_session *session = sk->sk_user_data;
 	struct pppol2tp_tunnel *tunnel;
 	int val, len;
 	int err;
 	if (level != SOL_PPPOL2TP)
 		return udp_prot.getsockopt(sk, level, optname, optval, optlen);
 	if (get_user(len, (int __user *) optlen))
 		return -EFAULT;
 	len = min_t(unsigned int, len, sizeof(int));
 	if (len < 0)
 		return -EINVAL;
 	err = -ENOTCONN;
 	if (sk->sk_user_data == NULL)
 		goto end;
 	/* Get the session context */
 	err = -EBADF;
 	session = pppol2tp_sock_to_session(sk);
 	if (session == NULL)
 		goto end;
 	/* Special case: if session_id == 0x0000, treat as operation on tunnel */
 	if ((session->tunnel_addr.s_session == 0) &&
 	    (session->tunnel_addr.d_session == 0)) {
 		err = -EBADF;
 		tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
 		if (tunnel == NULL)
 			goto end_put_sess;
 		err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
 		sock_put(session->tunnel_sock);
 	} else
 		err = pppol2tp_session_getsockopt(sk, session, optname, &val);
 	err = -EFAULT;
 	if (put_user(len, (int __user *) optlen))
 		goto end_put_sess;
 	if (copy_to_user((void __user *) optval, &val, len))
 		goto end_put_sess;
 	err = 0;
 end_put_sess:
 	sock_put(sk);
 end:
 	return err;
 }
 /*****************************************************************************
  * /proc filesystem for debug
  *****************************************************************************/
 #ifdef CONFIG_PROC_FS
 #include <linux/seq_file.h>
 struct pppol2tp_seq_data {
 	struct seq_net_private p;
 	struct pppol2tp_tunnel *tunnel;		/* current tunnel */
 	struct pppol2tp_session *session;	/* NULL means get first session in tunnel */
 };
 static struct pppol2tp_session *next_session(struct pppol2tp_tunnel *tunnel, struct pppol2tp_session *curr)
 {
 	struct pppol2tp_session *session = NULL;
 	struct hlist_node *walk;
 	int found = 0;
 	int next = 0;
 	int i;
 	read_lock_bh(&tunnel->hlist_lock);
 	for (i = 0; i < PPPOL2TP_HASH_SIZE; i++) {
 		hlist_for_each_entry(session, walk, &tunnel->session_hlist[i], hlist) {
 			if (curr == NULL) {
 				found = 1;
 				goto out;
 			}
 			if (session == curr) {
 				next = 1;
 				continue;
 			}
 			if (next) {
 				found = 1;
 				goto out;
 			}
 		}
 	}
 out:
 	read_unlock_bh(&tunnel->hlist_lock);
 	if (!found)
 		session = NULL;
 	return session;
 }
 static struct pppol2tp_tunnel *next_tunnel(struct pppol2tp_net *pn,
 					   struct pppol2tp_tunnel *curr)
 {
 	struct pppol2tp_tunnel *tunnel = NULL;
 	read_lock_bh(&pn->pppol2tp_tunnel_list_lock);
 	if (list_is_last(&curr->list, &pn->pppol2tp_tunnel_list)) {
 		goto out;
 	}
 	tunnel = list_entry(curr->list.next, struct pppol2tp_tunnel, list);
 out:
 	read_unlock_bh(&pn->pppol2tp_tunnel_list_lock);
 	return tunnel;
 }
 static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs)
 {
 	struct pppol2tp_seq_data *pd = SEQ_START_TOKEN;
 	struct pppol2tp_net *pn;
 	loff_t pos = *offs;
 	if (!pos)
 		goto out;
 	BUG_ON(m->private == NULL);
 	pd = m->private;
 	pn = pppol2tp_pernet(seq_file_net(m));
 	if (pd->tunnel == NULL) {
 		if (!list_empty(&pn->pppol2tp_tunnel_list))
 			pd->tunnel = list_entry(pn->pppol2tp_tunnel_list.next, struct pppol2tp_tunnel, list);
 	} else {
 		pd->session = next_session(pd->tunnel, pd->session);
 		if (pd->session == NULL) {
 			pd->tunnel = next_tunnel(pn, pd->tunnel);
 		}
 	}
 	/* NULL tunnel and session indicates end of list */
 	if ((pd->tunnel == NULL) && (pd->session == NULL))
 		pd = NULL;
 out:
 	return pd;
 }
 static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos)
 {
 	(*pos)++;
 	return NULL;
 }
 static void pppol2tp_seq_stop(struct seq_file *p, void *v)
 {
 	/* nothing to do */
 }
 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
 {
 	struct pppol2tp_tunnel *tunnel = v;
 	seq_printf(m, "\nTUNNEL '%s', %c %d\n",
 		   tunnel->name,
 		   (tunnel == tunnel->sock->sk_user_data) ? 'Y':'N',
 		   atomic_read(&tunnel->ref_count) - 1);
 	seq_printf(m, " %08x %llu/%llu/%llu %llu/%llu/%llu\n",
 		   tunnel->debug,
 		   (unsigned long long)tunnel->stats.tx_packets,
 		   (unsigned long long)tunnel->stats.tx_bytes,
 		   (unsigned long long)tunnel->stats.tx_errors,
 		   (unsigned long long)tunnel->stats.rx_packets,
 		   (unsigned long long)tunnel->stats.rx_bytes,
 		   (unsigned long long)tunnel->stats.rx_errors);
 }
 static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
 {
 	struct pppol2tp_session *session = v;
 	seq_printf(m, "  SESSION '%s' %08X/%d %04X/%04X -> "
 		   "%04X/%04X %d %c\n",
 		   session->name,
 		   ntohl(session->tunnel_addr.addr.sin_addr.s_addr),
 		   ntohs(session->tunnel_addr.addr.sin_port),
 		   session->tunnel_addr.s_tunnel,
 		   session->tunnel_addr.s_session,
 		   session->tunnel_addr.d_tunnel,
 		   session->tunnel_addr.d_session,
 		   session->sock->sk_state,
 		   (session == session->sock->sk_user_data) ?
 		   'Y' : 'N');
 	seq_printf(m, "   %d/%d/%c/%c/%s %08x %u\n",
 		   session->mtu, session->mru,
 		   session->recv_seq ? 'R' : '-',
 		   session->send_seq ? 'S' : '-',
 		   session->lns_mode ? "LNS" : "LAC",
 		   session->debug,
 		   jiffies_to_msecs(session->reorder_timeout));
 	seq_printf(m, "   %hu/%hu %llu/%llu/%llu %llu/%llu/%llu\n",
 		   session->nr, session->ns,
 		   (unsigned long long)session->stats.tx_packets,
 		   (unsigned long long)session->stats.tx_bytes,
 		   (unsigned long long)session->stats.tx_errors,
 		   (unsigned long long)session->stats.rx_packets,
 		   (unsigned long long)session->stats.rx_bytes,
 		   (unsigned long long)session->stats.rx_errors);
 }
 static int pppol2tp_seq_show(struct seq_file *m, void *v)
 {
 	struct pppol2tp_seq_data *pd = v;
 	/* display header on line 1 */
 	if (v == SEQ_START_TOKEN) {
 		seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n");
 		seq_puts(m, "TUNNEL name, user-data-ok session-count\n");
 		seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
 		seq_puts(m, "  SESSION name, addr/port src-tid/sid "
 			 "dest-tid/sid state user-data-ok\n");
 		seq_puts(m, "   mtu/mru/rcvseq/sendseq/lns debug reorderto\n");
 		seq_puts(m, "   nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
 		goto out;
 	}
 	/* Show the tunnel or session context.
 	 */
 	if (pd->session == NULL)
 		pppol2tp_seq_tunnel_show(m, pd->tunnel);
 	else
 		pppol2tp_seq_session_show(m, pd->session);
 out:
 	return 0;
 }
 static const struct seq_operations pppol2tp_seq_ops = {
 	.start		= pppol2tp_seq_start,
 	.next		= pppol2tp_seq_next,
 	.stop		= pppol2tp_seq_stop,
 	.show		= pppol2tp_seq_show,
 };
 /* Called when our /proc file is opened. We allocate data for use when
  * iterating our tunnel / session contexts and store it in the private
  * data of the seq_file.
  */
 static int pppol2tp_proc_open(struct inode *inode, struct file *file)
 {
 	return seq_open_net(inode, file, &pppol2tp_seq_ops,
 			    sizeof(struct pppol2tp_seq_data));
 }
 static const struct file_operations pppol2tp_proc_fops = {
 	.owner		= THIS_MODULE,
 	.open		= pppol2tp_proc_open,
 	.read		= seq_read,
 	.llseek		= seq_lseek,
 	.release	= seq_release_net,
 };
 #endif /* CONFIG_PROC_FS */
 /*****************************************************************************
  * Init and cleanup
  *****************************************************************************/
 static const struct proto_ops pppol2tp_ops = {
 	.family		= AF_PPPOX,
 	.owner		= THIS_MODULE,
 	.release	= pppol2tp_release,
 	.bind		= sock_no_bind,
 	.connect	= pppol2tp_connect,
 	.socketpair	= sock_no_socketpair,
 	.accept		= sock_no_accept,
 	.getname	= pppol2tp_getname,
 	.poll		= datagram_poll,
 	.listen		= sock_no_listen,
 	.shutdown	= sock_no_shutdown,
 	.setsockopt	= pppol2tp_setsockopt,
 	.getsockopt	= pppol2tp_getsockopt,
 	.sendmsg	= pppol2tp_sendmsg,
 	.recvmsg	= pppol2tp_recvmsg,
 	.mmap		= sock_no_mmap,
 	.ioctl		= pppox_ioctl,
 };
 static struct pppox_proto pppol2tp_proto = {
 	.create		= pppol2tp_create,
 	.ioctl		= pppol2tp_ioctl
 };
 static __net_init int pppol2tp_init_net(struct net *net)
 {
-	struct pppol2tp_net *pn;
+	struct pppol2tp_net *pn = pppol2tp_pernet(net);
 	struct proc_dir_entry *pde;
-	int err;
-	pn = kzalloc(sizeof(*pn), GFP_KERNEL);
-	if (!pn)
-		return -ENOMEM;
 	INIT_LIST_HEAD(&pn->pppol2tp_tunnel_list);
 	rwlock_init(&pn->pppol2tp_tunnel_list_lock);
-	err = net_assign_generic(net, pppol2tp_net_id, pn);
-	if (err)
-		goto out;
 	pde = proc_net_fops_create(net, "pppol2tp", S_IRUGO, &pppol2tp_proc_fops);
 #ifdef CONFIG_PROC_FS
-	if (!pde) {
+	if (!pde)
-		err = -ENOMEM;
+		return -ENOMEM;
-		goto out;
-	}
 #endif
 	return 0;
-out:
-	kfree(pn);
-	return err;
 }
 static __net_exit void pppol2tp_exit_net(struct net *net)
 {
-	struct pppoe_net *pn;
 	proc_net_remove(net, "pppol2tp");
-	pn = net_generic(net, pppol2tp_net_id);
-	/*
-	 * if someone has cached our net then
-	 * further net_generic call will return NULL
-	 */
-	net_assign_generic(net, pppol2tp_net_id, NULL);
-	kfree(pn);
 }
 static struct pernet_operations pppol2tp_net_ops = {
 	.init = pppol2tp_init_net,
 	.exit = pppol2tp_exit_net,
+	.id   = &pppol2tp_net_id,
+	.size = sizeof(struct pppol2tp_net),
 };
 static int __init pppol2tp_init(void)
 {
 	int err;
 	err = proto_register(&pppol2tp_sk_proto, 0);
 	if (err)
 		goto out;
 	err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto);
 	if (err)
 		goto out_unregister_pppol2tp_proto;
-	err = register_pernet_gen_device(&pppol2tp_net_id, &pppol2tp_net_ops);
+	err = register_pernet_device(&pppol2tp_net_ops);
 	if (err)
 		goto out_unregister_pppox_proto;
 	printk(KERN_INFO "PPPoL2TP kernel driver, %s\n",
 	       PPPOL2TP_DRV_VERSION);
 out:
 	return err;
 out_unregister_pppox_proto:
 	unregister_pppox_proto(PX_PROTO_OL2TP);
 out_unregister_pppol2tp_proto:
 	proto_unregister(&pppol2tp_sk_proto);
 	goto out;
 }
 static void __exit pppol2tp_exit(void)
 {
 	unregister_pppox_proto(PX_PROTO_OL2TP);
-	unregister_pernet_gen_device(pppol2tp_net_id, &pppol2tp_net_ops);
+	unregister_pernet_device(&pppol2tp_net_ops);
 	proto_unregister(&pppol2tp_sk_proto);
 }
 module_init(pppol2tp_init);
 module_exit(pppol2tp_exit);
 MODULE_AUTHOR("Martijn van Oosterhout <kleptog@svana.org>, "
 	      "James Chapman <jchapman@katalix.com>");
 MODULE_DESCRIPTION("PPP over L2TP over UDP");
 MODULE_LICENSE("GPL");