1	// SPDX-License-Identifier: GPL-2.0-or-later
2	/*****************************************************************************
3	* Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets
4	*
5	* PPPoX --- Generic PPP encapsulation socket family
6	* PPPoL2TP --- PPP over L2TP (RFC 2661)
7	*
8	* Version: 2.0.0
9	*
10	* Authors: James Chapman (jchapman@katalix.com)
11	*
12	* Based on original work by Martijn van Oosterhout <kleptog@svana.org>
13	*
14	* License:
15	*/
16
17	/* This driver handles only L2TP data frames; control frames are handled by a
18	* userspace application.
19	*
20	* To send data in an L2TP session, userspace opens a PPPoL2TP socket and
21	* attaches it to a bound UDP socket with local tunnel_id / session_id and
22	* peer tunnel_id / session_id set. Data can then be sent or received using
23	* regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket
24	* can be read or modified using ioctl() or [gs]etsockopt() calls.
25	*
26	* When a PPPoL2TP socket is connected with local and peer session_id values
27	* zero, the socket is treated as a special tunnel management socket.
28	*
29	* Here's example userspace code to create a socket for sending/receiving data
30	* over an L2TP session:-
31	*
32	* struct sockaddr_pppol2tp sax;
33	* int fd;
34	* int session_fd;
35	*
36	* fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
37	*
38	* sax.sa_family = AF_PPPOX;
39	* sax.sa_protocol = PX_PROTO_OL2TP;
40	* sax.pppol2tp.fd = tunnel_fd; // bound UDP socket
41	* sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr;
42	* sax.pppol2tp.addr.sin_port = addr->sin_port;
43	* sax.pppol2tp.addr.sin_family = AF_INET;
44	* sax.pppol2tp.s_tunnel = tunnel_id;
45	* sax.pppol2tp.s_session = session_id;
46	* sax.pppol2tp.d_tunnel = peer_tunnel_id;
47	* sax.pppol2tp.d_session = peer_session_id;
48	*
49	* session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax));
50	*
51	* A pppd plugin that allows PPP traffic to be carried over L2TP using
52	* this driver is available from the OpenL2TP project at
53	* http://openl2tp.sourceforge.net.
54	*/
55
56	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
57
58	#include <linux/module.h>
59	#include <linux/string.h>
60	#include <linux/list.h>
61	#include <linux/uaccess.h>
62
63	#include <linux/kernel.h>
64	#include <linux/spinlock.h>
65	#include <linux/kthread.h>
66	#include <linux/sched.h>
67	#include <linux/slab.h>
68	#include <linux/errno.h>
69	#include <linux/jiffies.h>
70
71	#include <linux/netdevice.h>
72	#include <linux/net.h>
73	#include <linux/inetdevice.h>
74	#include <linux/skbuff.h>
75	#include <linux/init.h>
76	#include <linux/ip.h>
77	#include <linux/udp.h>
78	#include <linux/if_pppox.h>
79	#include <linux/if_pppol2tp.h>
80	#include <net/sock.h>
81	#include <linux/ppp_channel.h>
82	#include <linux/ppp_defs.h>
83	#include <linux/ppp-ioctl.h>
84	#include <linux/file.h>
85	#include <linux/hash.h>
86	#include <linux/sort.h>
87	#include <linux/proc_fs.h>
88	#include <linux/l2tp.h>
89	#include <linux/nsproxy.h>
90	#include <net/net_namespace.h>
91	#include <net/netns/generic.h>
92	#include <net/ip.h>
93	#include <net/udp.h>
94	#include <net/inet_common.h>
95
96	#include <asm/byteorder.h>
97	#include <linux/atomic.h>
98
99	#include "l2tp_core.h"
100
101	#define PPPOL2TP_DRV_VERSION "V2.0"
102
103	/* Space for UDP, L2TP and PPP headers */
104	#define PPPOL2TP_HEADER_OVERHEAD 40
105
106	/* Number of bytes to build transmit L2TP headers.
107	* Unfortunately the size is different depending on whether sequence numbers
108	* are enabled.
109	*/
110	#define PPPOL2TP_L2TP_HDR_SIZE_SEQ 10
111	#define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ 6
112
113	/* Private data of each session. This data lives at the end of struct
114	* l2tp_session, referenced via session->priv[].
115	*/
116	struct pppol2tp_session {
117	int owner; /* pid that opened the socket */
118
119	struct mutex sk_lock; /* Protects .sk */
120	struct sock __rcu *sk; /* Pointer to the session PPPoX socket */
121	struct sock *__sk; /* Copy of .sk, for cleanup */
122	struct rcu_head rcu; /* For asynchronous release */
123	};
124
125	static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);
126
127	static const struct ppp_channel_ops pppol2tp_chan_ops = {
128	.start_xmit = pppol2tp_xmit,
129	};
130
131	static const struct proto_ops pppol2tp_ops;
132
133	/* Retrieves the pppol2tp socket associated to a session.
134	* A reference is held on the returned socket, so this function must be paired
135	* with sock_put().
136	*/
137	static struct sock *pppol2tp_session_get_sock(struct l2tp_session *session)
138	{
139	struct pppol2tp_session *ps = l2tp_session_priv(session);
140	struct sock *sk;
141
142	rcu_read_lock();
143	sk = rcu_dereference(ps->sk);
144	if (sk)
145	sock_hold(sk);
146	rcu_read_unlock();
147
148	return sk;
149	}
150
151	/* Helpers to obtain tunnel/session contexts from sockets.
152	*/
153	static inline struct l2tp_session *pppol2tp_sock_to_session(struct sock *sk)
154	{
155	struct l2tp_session *session;
156
157	if (!sk)
158	return NULL;
159
160	sock_hold(sk);
161	session = (struct l2tp_session *)(sk->sk_user_data);
162	if (!session) {
163	sock_put(sk);
164	goto out;
165	}
166	if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) {
167	session = NULL;
168	sock_put(sk);
169	goto out;
170	}
171
172	out:
173	return session;
174	}
175
176	/*****************************************************************************
177	* Receive data handling
178	*****************************************************************************/
179
180	/* Receive message. This is the recvmsg for the PPPoL2TP socket.
181	*/
182	static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg,
183	size_t len, int flags)
184	{
185	int err;
186	struct sk_buff *skb;
187	struct sock *sk = sock->sk;
188
189	err = -EIO;
190	if (sk->sk_state & PPPOX_BOUND)
191	goto end;
192
193	err = 0;
194	skb = skb_recv_datagram(sk, flags, err: &err);
195	if (!skb)
196	goto end;
197
198	if (len > skb->len)
199	len = skb->len;
200	else if (len < skb->len)
201	msg->msg_flags |= MSG_TRUNC;
202
203	err = skb_copy_datagram_msg(from: skb, offset: 0, msg, size: len);
204	if (likely(err == 0))
205	err = len;
206
207	kfree_skb(skb);
208	end:
209	return err;
210	}
211
212	static void pppol2tp_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len)
213	{
214	struct pppol2tp_session *ps = l2tp_session_priv(session);
215	struct sock *sk = NULL;
216
217	/* If the socket is bound, send it in to PPP's input queue. Otherwise
218	* queue it on the session socket.
219	*/
220	rcu_read_lock();
221	sk = rcu_dereference(ps->sk);
222	if (!sk)
223	goto no_sock;
224
225	/* If the first two bytes are 0xFF03, consider that it is the PPP's
226	* Address and Control fields and skip them. The L2TP module has always
227	* worked this way, although, in theory, the use of these fields should
228	* be negotiated and handled at the PPP layer. These fields are
229	* constant: 0xFF is the All-Stations Address and 0x03 the Unnumbered
230	* Information command with Poll/Final bit set to zero (RFC 1662).
231	*/
232	if (pskb_may_pull(skb, len: 2) && skb->data[0] == PPP_ALLSTATIONS &&
233	skb->data[1] == PPP_UI)
234	skb_pull(skb, len: 2);
235
236	if (sk->sk_state & PPPOX_BOUND) {
237	struct pppox_sock *po;
238
239	po = pppox_sk(sk);
240	ppp_input(&po->chan, skb);
241	} else {
242	if (sock_queue_rcv_skb(sk, skb) < 0) {
243	atomic_long_inc(v: &session->stats.rx_errors);
244	kfree_skb(skb);
245	}
246	}
247	rcu_read_unlock();
248
249	return;
250
251	no_sock:
252	rcu_read_unlock();
253	pr_warn_ratelimited("%s: no socket in recv\n", session->name);
254	kfree_skb(skb);
255	}
256
257	/************************************************************************
258	* Transmit handling
259	***********************************************************************/
260
261	/* This is the sendmsg for the PPPoL2TP pppol2tp_session socket. We come here
262	* when a user application does a sendmsg() on the session socket. L2TP and
263	* PPP headers must be inserted into the user's data.
264	*/
265	static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
266	size_t total_len)
267	{
268	struct sock *sk = sock->sk;
269	struct sk_buff *skb;
270	int error;
271	struct l2tp_session *session;
272	struct l2tp_tunnel *tunnel;
273	int uhlen;
274
275	error = -ENOTCONN;
276	if (sock_flag(sk, flag: SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
277	goto error;
278
279	/* Get session and tunnel contexts */
280	error = -EBADF;
281	session = pppol2tp_sock_to_session(sk);
282	if (!session)
283	goto error;
284
285	tunnel = session->tunnel;
286
287	uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
288
289	/* Allocate a socket buffer */
290	error = -ENOMEM;
291	skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) +
292	uhlen + session->hdr_len +
293	2 + total_len, /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
294	force: 0, GFP_KERNEL);
295	if (!skb)
296	goto error_put_sess;
297
298	/* Reserve space for headers. */
299	skb_reserve(skb, NET_SKB_PAD);
300	skb_reset_network_header(skb);
301	skb_reserve(skb, len: sizeof(struct iphdr));
302	skb_reset_transport_header(skb);
303	skb_reserve(skb, len: uhlen);
304
305	/* Add PPP header */
306	skb->data[0] = PPP_ALLSTATIONS;
307	skb->data[1] = PPP_UI;
308	skb_put(skb, len: 2);
309
310	/* Copy user data into skb */
311	error = memcpy_from_msg(data: skb_put(skb, len: total_len), msg: m, len: total_len);
312	if (error < 0) {
313	kfree_skb(skb);
314	goto error_put_sess;
315	}
316
317	local_bh_disable();
318	l2tp_xmit_skb(session, skb);
319	local_bh_enable();
320
321	sock_put(sk);
322
323	return total_len;
324
325	error_put_sess:
326	sock_put(sk);
327	error:
328	return error;
329	}
330
331	/* Transmit function called by generic PPP driver. Sends PPP frame
332	* over PPPoL2TP socket.
333	*
334	* This is almost the same as pppol2tp_sendmsg(), but rather than
335	* being called with a msghdr from userspace, it is called with a skb
336	* from the kernel.
337	*
338	* The supplied skb from ppp doesn't have enough headroom for the
339	* insertion of L2TP, UDP and IP headers so we need to allocate more
340	* headroom in the skb. This will create a cloned skb. But we must be
341	* careful in the error case because the caller will expect to free
342	* the skb it supplied, not our cloned skb. So we take care to always
343	* leave the original skb unfreed if we return an error.
344	*/
345	static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
346	{
347	struct sock *sk = (struct sock *)chan->private;
348	struct l2tp_session *session;
349	struct l2tp_tunnel *tunnel;
350	int uhlen, headroom;
351
352	if (sock_flag(sk, flag: SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
353	goto abort;
354
355	/* Get session and tunnel contexts from the socket */
356	session = pppol2tp_sock_to_session(sk);
357	if (!session)
358	goto abort;
359
360	tunnel = session->tunnel;
361
362	uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
363	headroom = NET_SKB_PAD +
364	sizeof(struct iphdr) + /* IP header */
365	uhlen + /* UDP header (if L2TP_ENCAPTYPE_UDP) */
366	session->hdr_len + /* L2TP header */
367	2; /* 2 bytes for PPP_ALLSTATIONS & PPP_UI */
368	if (skb_cow_head(skb, headroom))
369	goto abort_put_sess;
370
371	/* Setup PPP header */
372	__skb_push(skb, len: 2);
373	skb->data[0] = PPP_ALLSTATIONS;
374	skb->data[1] = PPP_UI;
375
376	local_bh_disable();
377	l2tp_xmit_skb(session, skb);
378	local_bh_enable();
379
380	sock_put(sk);
381
382	return 1;
383
384	abort_put_sess:
385	sock_put(sk);
386	abort:
387	/* Free the original skb */
388	kfree_skb(skb);
389	return 1;
390	}
391
392	/*****************************************************************************
393	* Session (and tunnel control) socket create/destroy.
394	*****************************************************************************/
395
396	static void pppol2tp_put_sk(struct rcu_head *head)
397	{
398	struct pppol2tp_session *ps;
399
400	ps = container_of(head, typeof(*ps), rcu);
401	sock_put(sk: ps->__sk);
402	}
403
404	/* Really kill the session socket. (Called from sock_put() if
405	* refcnt == 0.)
406	*/
407	static void pppol2tp_session_destruct(struct sock *sk)
408	{
409	struct l2tp_session *session = sk->sk_user_data;
410
411	skb_queue_purge(list: &sk->sk_receive_queue);
412	skb_queue_purge(list: &sk->sk_write_queue);
413
414	if (session) {
415	sk->sk_user_data = NULL;
416	if (WARN_ON(session->magic != L2TP_SESSION_MAGIC))
417	return;
418	l2tp_session_dec_refcount(session);
419	}
420	}
421
422	/* Called when the PPPoX socket (session) is closed.
423	*/
424	static int pppol2tp_release(struct socket *sock)
425	{
426	struct sock *sk = sock->sk;
427	struct l2tp_session *session;
428	int error;
429
430	if (!sk)
431	return 0;
432
433	error = -EBADF;
434	lock_sock(sk);
435	if (sock_flag(sk, flag: SOCK_DEAD) != 0)
436	goto error;
437
438	pppox_unbind_sock(sk);
439
440	/* Signal the death of the socket. */
441	sk->sk_state = PPPOX_DEAD;
442	sock_orphan(sk);
443	sock->sk = NULL;
444
445	session = pppol2tp_sock_to_session(sk);
446	if (session) {
447	struct pppol2tp_session *ps;
448
449	l2tp_session_delete(session);
450
451	ps = l2tp_session_priv(session);
452	mutex_lock(&ps->sk_lock);
453	ps->__sk = rcu_dereference_protected(ps->sk,
454	lockdep_is_held(&ps->sk_lock));
455	RCU_INIT_POINTER(ps->sk, NULL);
456	mutex_unlock(lock: &ps->sk_lock);
457	call_rcu(head: &ps->rcu, func: pppol2tp_put_sk);
458
459	/* Rely on the sock_put() call at the end of the function for
460	* dropping the reference held by pppol2tp_sock_to_session().
461	* The last reference will be dropped by pppol2tp_put_sk().
462	*/
463	}
464
465	release_sock(sk);
466
467	/* This will delete the session context via
468	* pppol2tp_session_destruct() if the socket's refcnt drops to
469	* zero.
470	*/
471	sock_put(sk);
472
473	return 0;
474
475	error:
476	release_sock(sk);
477	return error;
478	}
479
480	static struct proto pppol2tp_sk_proto = {
481	.name = "PPPOL2TP",
482	.owner = THIS_MODULE,
483	.obj_size = sizeof(struct pppox_sock),
484	};
485
486	static int pppol2tp_backlog_recv(struct sock *sk, struct sk_buff *skb)
487	{
488	int rc;
489
490	rc = l2tp_udp_encap_recv(sk, skb);
491	if (rc)
492	kfree_skb(skb);
493
494	return NET_RX_SUCCESS;
495	}
496
497	/* socket() handler. Initialize a new struct sock.
498	*/
499	static int pppol2tp_create(struct net *net, struct socket *sock, int kern)
500	{
501	int error = -ENOMEM;
502	struct sock *sk;
503
504	sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, prot: &pppol2tp_sk_proto, kern);
505	if (!sk)
506	goto out;
507
508	sock_init_data(sock, sk);
509
510	sock->state = SS_UNCONNECTED;
511	sock->ops = &pppol2tp_ops;
512
513	sk->sk_backlog_rcv = pppol2tp_backlog_recv;
514	sk->sk_protocol = PX_PROTO_OL2TP;
515	sk->sk_family = PF_PPPOX;
516	sk->sk_state = PPPOX_NONE;
517	sk->sk_type = SOCK_STREAM;
518	sk->sk_destruct = pppol2tp_session_destruct;
519
520	error = 0;
521
522	out:
523	return error;
524	}
525
526	static void pppol2tp_show(struct seq_file *m, void *arg)
527	{
528	struct l2tp_session *session = arg;
529	struct sock *sk;
530
531	sk = pppol2tp_session_get_sock(session);
532	if (sk) {
533	struct pppox_sock *po = pppox_sk(sk);
534
535	seq_printf(m, fmt: " interface %s\n", ppp_dev_name(&po->chan));
536	sock_put(sk);
537	}
538	}
539
540	static void pppol2tp_session_init(struct l2tp_session *session)
541	{
542	struct pppol2tp_session *ps;
543
544	session->recv_skb = pppol2tp_recv;
545	if (IS_ENABLED(CONFIG_L2TP_DEBUGFS))
546	session->show = pppol2tp_show;
547
548	ps = l2tp_session_priv(session);
549	mutex_init(&ps->sk_lock);
550	ps->owner = current->pid;
551	}
552
553	struct l2tp_connect_info {
554	u8 version;
555	int fd;
556	u32 tunnel_id;
557	u32 peer_tunnel_id;
558	u32 session_id;
559	u32 peer_session_id;
560	};
561
562	static int pppol2tp_sockaddr_get_info(const void *sa, int sa_len,
563	struct l2tp_connect_info *info)
564	{
565	switch (sa_len) {
566	case sizeof(struct sockaddr_pppol2tp):
567	{
568	const struct sockaddr_pppol2tp *sa_v2in4 = sa;
569
570	if (sa_v2in4->sa_protocol != PX_PROTO_OL2TP)
571	return -EINVAL;
572
573	info->version = 2;
574	info->fd = sa_v2in4->pppol2tp.fd;
575	info->tunnel_id = sa_v2in4->pppol2tp.s_tunnel;
576	info->peer_tunnel_id = sa_v2in4->pppol2tp.d_tunnel;
577	info->session_id = sa_v2in4->pppol2tp.s_session;
578	info->peer_session_id = sa_v2in4->pppol2tp.d_session;
579
580	break;
581	}
582	case sizeof(struct sockaddr_pppol2tpv3):
583	{
584	const struct sockaddr_pppol2tpv3 *sa_v3in4 = sa;
585
586	if (sa_v3in4->sa_protocol != PX_PROTO_OL2TP)
587	return -EINVAL;
588
589	info->version = 3;
590	info->fd = sa_v3in4->pppol2tp.fd;
591	info->tunnel_id = sa_v3in4->pppol2tp.s_tunnel;
592	info->peer_tunnel_id = sa_v3in4->pppol2tp.d_tunnel;
593	info->session_id = sa_v3in4->pppol2tp.s_session;
594	info->peer_session_id = sa_v3in4->pppol2tp.d_session;
595
596	break;
597	}
598	case sizeof(struct sockaddr_pppol2tpin6):
599	{
600	const struct sockaddr_pppol2tpin6 *sa_v2in6 = sa;
601
602	if (sa_v2in6->sa_protocol != PX_PROTO_OL2TP)
603	return -EINVAL;
604
605	info->version = 2;
606	info->fd = sa_v2in6->pppol2tp.fd;
607	info->tunnel_id = sa_v2in6->pppol2tp.s_tunnel;
608	info->peer_tunnel_id = sa_v2in6->pppol2tp.d_tunnel;
609	info->session_id = sa_v2in6->pppol2tp.s_session;
610	info->peer_session_id = sa_v2in6->pppol2tp.d_session;
611
612	break;
613	}
614	case sizeof(struct sockaddr_pppol2tpv3in6):
615	{
616	const struct sockaddr_pppol2tpv3in6 *sa_v3in6 = sa;
617
618	if (sa_v3in6->sa_protocol != PX_PROTO_OL2TP)
619	return -EINVAL;
620
621	info->version = 3;
622	info->fd = sa_v3in6->pppol2tp.fd;
623	info->tunnel_id = sa_v3in6->pppol2tp.s_tunnel;
624	info->peer_tunnel_id = sa_v3in6->pppol2tp.d_tunnel;
625	info->session_id = sa_v3in6->pppol2tp.s_session;
626	info->peer_session_id = sa_v3in6->pppol2tp.d_session;
627
628	break;
629	}
630	default:
631	return -EINVAL;
632	}
633
634	return 0;
635	}
636
637	/* Rough estimation of the maximum payload size a tunnel can transmit without
638	* fragmenting at the lower IP layer. Assumes L2TPv2 with sequence
639	* numbers and no IP option. Not quite accurate, but the result is mostly
640	* unused anyway.
641	*/
642	static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel)
643	{
644	int mtu;
645
646	mtu = l2tp_tunnel_dst_mtu(tunnel);
647	if (mtu <= PPPOL2TP_HEADER_OVERHEAD)
648	return 1500 - PPPOL2TP_HEADER_OVERHEAD;
649
650	return mtu - PPPOL2TP_HEADER_OVERHEAD;
651	}
652
653	static struct l2tp_tunnel *pppol2tp_tunnel_get(struct net *net,
654	const struct l2tp_connect_info *info,
655	bool *new_tunnel)
656	{
657	struct l2tp_tunnel *tunnel;
658	int error;
659
660	*new_tunnel = false;
661
662	tunnel = l2tp_tunnel_get(net, tunnel_id: info->tunnel_id);
663
664	/* Special case: create tunnel context if session_id and
665	* peer_session_id is 0. Otherwise look up tunnel using supplied
666	* tunnel id.
667	*/
668	if (!info->session_id && !info->peer_session_id) {
669	if (!tunnel) {
670	struct l2tp_tunnel_cfg tcfg = {
671	.encap = L2TP_ENCAPTYPE_UDP,
672	};
673
674	/* Prevent l2tp_tunnel_register() from trying to set up
675	* a kernel socket.
676	*/
677	if (info->fd < 0)
678	return ERR_PTR(error: -EBADF);
679
680	error = l2tp_tunnel_create(fd: info->fd,
681	version: info->version,
682	tunnel_id: info->tunnel_id,
683	peer_tunnel_id: info->peer_tunnel_id, cfg: &tcfg,
684	tunnelp: &tunnel);
685	if (error < 0)
686	return ERR_PTR(error);
687
688	l2tp_tunnel_inc_refcount(tunnel);
689	error = l2tp_tunnel_register(tunnel, net, cfg: &tcfg);
690	if (error < 0) {
691	kfree(objp: tunnel);
692	return ERR_PTR(error);
693	}
694
695	*new_tunnel = true;
696	}
697	} else {
698	/* Error if we can't find the tunnel */
699	if (!tunnel)
700	return ERR_PTR(error: -ENOENT);
701
702	/* Error if socket is not prepped */
703	if (!tunnel->sock) {
704	l2tp_tunnel_dec_refcount(tunnel);
705	return ERR_PTR(error: -ENOENT);
706	}
707	}
708
709	return tunnel;
710	}
711
712	/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
713	*/
714	static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
715	int sockaddr_len, int flags)
716	{
717	struct sock *sk = sock->sk;
718	struct pppox_sock *po = pppox_sk(sk);
719	struct l2tp_session *session = NULL;
720	struct l2tp_connect_info info;
721	struct l2tp_tunnel *tunnel;
722	struct pppol2tp_session *ps;
723	struct l2tp_session_cfg cfg = { 0, };
724	bool drop_refcnt = false;
725	bool new_session = false;
726	bool new_tunnel = false;
727	int error;
728
729	error = pppol2tp_sockaddr_get_info(sa: uservaddr, sa_len: sockaddr_len, info: &info);
730	if (error < 0)
731	return error;
732
733	/* Don't bind if tunnel_id is 0 */
734	if (!info.tunnel_id)
735	return -EINVAL;
736
737	tunnel = pppol2tp_tunnel_get(net: sock_net(sk), info: &info, new_tunnel: &new_tunnel);
738	if (IS_ERR(ptr: tunnel))
739	return PTR_ERR(ptr: tunnel);
740
741	lock_sock(sk);
742
743	/* Check for already bound sockets */
744	error = -EBUSY;
745	if (sk->sk_state & PPPOX_CONNECTED)
746	goto end;
747
748	/* We don't supporting rebinding anyway */
749	error = -EALREADY;
750	if (sk->sk_user_data)
751	goto end; /* socket is already attached */
752
753	if (tunnel->peer_tunnel_id == 0)
754	tunnel->peer_tunnel_id = info.peer_tunnel_id;
755
756	session = l2tp_tunnel_get_session(tunnel, session_id: info.session_id);
757	if (session) {
758	drop_refcnt = true;
759
760	if (session->pwtype != L2TP_PWTYPE_PPP) {
761	error = -EPROTOTYPE;
762	goto end;
763	}
764
765	ps = l2tp_session_priv(session);
766
767	/* Using a pre-existing session is fine as long as it hasn't
768	* been connected yet.
769	*/
770	mutex_lock(&ps->sk_lock);
771	if (rcu_dereference_protected(ps->sk,
772	lockdep_is_held(&ps->sk_lock)) ||
773	ps->__sk) {
774	mutex_unlock(lock: &ps->sk_lock);
775	error = -EEXIST;
776	goto end;
777	}
778	} else {
779	cfg.pw_type = L2TP_PWTYPE_PPP;
780
781	session = l2tp_session_create(priv_size: sizeof(struct pppol2tp_session),
782	tunnel, session_id: info.session_id,
783	peer_session_id: info.peer_session_id, cfg: &cfg);
784	if (IS_ERR(ptr: session)) {
785	error = PTR_ERR(ptr: session);
786	goto end;
787	}
788
789	pppol2tp_session_init(session);
790	ps = l2tp_session_priv(session);
791	l2tp_session_inc_refcount(session);
792
793	mutex_lock(&ps->sk_lock);
794	error = l2tp_session_register(session, tunnel);
795	if (error < 0) {
796	mutex_unlock(lock: &ps->sk_lock);
797	kfree(objp: session);
798	goto end;
799	}
800	drop_refcnt = true;
801	new_session = true;
802	}
803
804	/* Special case: if source & dest session_id == 0x0000, this
805	* socket is being created to manage the tunnel. Just set up
806	* the internal context for use by ioctl() and sockopt()
807	* handlers.
808	*/
809	if (session->session_id == 0 && session->peer_session_id == 0) {
810	error = 0;
811	goto out_no_ppp;
812	}
813
814	/* The only header we need to worry about is the L2TP
815	* header. This size is different depending on whether
816	* sequence numbers are enabled for the data channel.
817	*/
818	po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
819
820	po->chan.private = sk;
821	po->chan.ops = &pppol2tp_chan_ops;
822	po->chan.mtu = pppol2tp_tunnel_mtu(tunnel);
823
824	error = ppp_register_net_channel(sock_net(sk), &po->chan);
825	if (error) {
826	mutex_unlock(lock: &ps->sk_lock);
827	goto end;
828	}
829
830	out_no_ppp:
831	/* This is how we get the session context from the socket. */
832	sk->sk_user_data = session;
833	rcu_assign_pointer(ps->sk, sk);
834	mutex_unlock(lock: &ps->sk_lock);
835
836	/* Keep the reference we've grabbed on the session: sk doesn't expect
837	* the session to disappear. pppol2tp_session_destruct() is responsible
838	* for dropping it.
839	*/
840	drop_refcnt = false;
841
842	sk->sk_state = PPPOX_CONNECTED;
843
844	end:
845	if (error) {
846	if (new_session)
847	l2tp_session_delete(session);
848	if (new_tunnel)
849	l2tp_tunnel_delete(tunnel);
850	}
851	if (drop_refcnt)
852	l2tp_session_dec_refcount(session);
853	l2tp_tunnel_dec_refcount(tunnel);
854	release_sock(sk);
855
856	return error;
857	}
858
859	#ifdef CONFIG_L2TP_V3
860
861	/* Called when creating sessions via the netlink interface. */
862	static int pppol2tp_session_create(struct net *net, struct l2tp_tunnel *tunnel,
863	u32 session_id, u32 peer_session_id,
864	struct l2tp_session_cfg *cfg)
865	{
866	int error;
867	struct l2tp_session *session;
868
869	/* Error if tunnel socket is not prepped */
870	if (!tunnel->sock) {
871	error = -ENOENT;
872	goto err;
873	}
874
875	/* Allocate and initialize a new session context. */
876	session = l2tp_session_create(priv_size: sizeof(struct pppol2tp_session),
877	tunnel, session_id,
878	peer_session_id, cfg);
879	if (IS_ERR(ptr: session)) {
880	error = PTR_ERR(ptr: session);
881	goto err;
882	}
883
884	pppol2tp_session_init(session);
885
886	error = l2tp_session_register(session, tunnel);
887	if (error < 0)
888	goto err_sess;
889
890	return 0;
891
892	err_sess:
893	kfree(objp: session);
894	err:
895	return error;
896	}
897
898	#endif /* CONFIG_L2TP_V3 */
899
900	/* getname() support.
901	*/
902	static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
903	int peer)
904	{
905	int len = 0;
906	int error = 0;
907	struct l2tp_session *session;
908	struct l2tp_tunnel *tunnel;
909	struct sock *sk = sock->sk;
910	struct inet_sock *inet;
911	struct pppol2tp_session *pls;
912
913	error = -ENOTCONN;
914	if (!sk)
915	goto end;
916	if (!(sk->sk_state & PPPOX_CONNECTED))
917	goto end;
918
919	error = -EBADF;
920	session = pppol2tp_sock_to_session(sk);
921	if (!session)
922	goto end;
923
924	pls = l2tp_session_priv(session);
925	tunnel = session->tunnel;
926
927	inet = inet_sk(tunnel->sock);
928	if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET) {
929	struct sockaddr_pppol2tp sp;
930
931	len = sizeof(sp);
932	memset(&sp, 0, len);
933	sp.sa_family = AF_PPPOX;
934	sp.sa_protocol = PX_PROTO_OL2TP;
935	sp.pppol2tp.fd = tunnel->fd;
936	sp.pppol2tp.pid = pls->owner;
937	sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
938	sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
939	sp.pppol2tp.s_session = session->session_id;
940	sp.pppol2tp.d_session = session->peer_session_id;
941	sp.pppol2tp.addr.sin_family = AF_INET;
942	sp.pppol2tp.addr.sin_port = inet->inet_dport;
943	sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
944	memcpy(uaddr, &sp, len);
945	#if IS_ENABLED(CONFIG_IPV6)
946	} else if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET6) {
947	struct sockaddr_pppol2tpin6 sp;
948
949	len = sizeof(sp);
950	memset(&sp, 0, len);
951	sp.sa_family = AF_PPPOX;
952	sp.sa_protocol = PX_PROTO_OL2TP;
953	sp.pppol2tp.fd = tunnel->fd;
954	sp.pppol2tp.pid = pls->owner;
955	sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
956	sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
957	sp.pppol2tp.s_session = session->session_id;
958	sp.pppol2tp.d_session = session->peer_session_id;
959	sp.pppol2tp.addr.sin6_family = AF_INET6;
960	sp.pppol2tp.addr.sin6_port = inet->inet_dport;
961	memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
962	sizeof(tunnel->sock->sk_v6_daddr));
963	memcpy(uaddr, &sp, len);
964	} else if (tunnel->version == 3 && tunnel->sock->sk_family == AF_INET6) {
965	struct sockaddr_pppol2tpv3in6 sp;
966
967	len = sizeof(sp);
968	memset(&sp, 0, len);
969	sp.sa_family = AF_PPPOX;
970	sp.sa_protocol = PX_PROTO_OL2TP;
971	sp.pppol2tp.fd = tunnel->fd;
972	sp.pppol2tp.pid = pls->owner;
973	sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
974	sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
975	sp.pppol2tp.s_session = session->session_id;
976	sp.pppol2tp.d_session = session->peer_session_id;
977	sp.pppol2tp.addr.sin6_family = AF_INET6;
978	sp.pppol2tp.addr.sin6_port = inet->inet_dport;
979	memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
980	sizeof(tunnel->sock->sk_v6_daddr));
981	memcpy(uaddr, &sp, len);
982	#endif
983	} else if (tunnel->version == 3) {
984	struct sockaddr_pppol2tpv3 sp;
985
986	len = sizeof(sp);
987	memset(&sp, 0, len);
988	sp.sa_family = AF_PPPOX;
989	sp.sa_protocol = PX_PROTO_OL2TP;
990	sp.pppol2tp.fd = tunnel->fd;
991	sp.pppol2tp.pid = pls->owner;
992	sp.pppol2tp.s_tunnel = tunnel->tunnel_id;
993	sp.pppol2tp.d_tunnel = tunnel->peer_tunnel_id;
994	sp.pppol2tp.s_session = session->session_id;
995	sp.pppol2tp.d_session = session->peer_session_id;
996	sp.pppol2tp.addr.sin_family = AF_INET;
997	sp.pppol2tp.addr.sin_port = inet->inet_dport;
998	sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
999	memcpy(uaddr, &sp, len);
1000	}
1001
1002	error = len;
1003
1004	sock_put(sk);
1005	end:
1006	return error;
1007	}
1008
1009	/****************************************************************************
1010	* ioctl() handlers.
1011	*
1012	* The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
1013	* sockets. However, in order to control kernel tunnel features, we allow
1014	* userspace to create a special "tunnel" PPPoX socket which is used for
1015	* control only. Tunnel PPPoX sockets have session_id == 0 and simply allow
1016	* the user application to issue L2TP setsockopt(), getsockopt() and ioctl()
1017	* calls.
1018	****************************************************************************/
1019
1020	static void pppol2tp_copy_stats(struct pppol2tp_ioc_stats *dest,
1021	const struct l2tp_stats *stats)
1022	{
1023	memset(dest, 0, sizeof(*dest));
1024
1025	dest->tx_packets = atomic_long_read(v: &stats->tx_packets);
1026	dest->tx_bytes = atomic_long_read(v: &stats->tx_bytes);
1027	dest->tx_errors = atomic_long_read(v: &stats->tx_errors);
1028	dest->rx_packets = atomic_long_read(v: &stats->rx_packets);
1029	dest->rx_bytes = atomic_long_read(v: &stats->rx_bytes);
1030	dest->rx_seq_discards = atomic_long_read(v: &stats->rx_seq_discards);
1031	dest->rx_oos_packets = atomic_long_read(v: &stats->rx_oos_packets);
1032	dest->rx_errors = atomic_long_read(v: &stats->rx_errors);
1033	}
1034
1035	static int pppol2tp_tunnel_copy_stats(struct pppol2tp_ioc_stats *stats,
1036	struct l2tp_tunnel *tunnel)
1037	{
1038	struct l2tp_session *session;
1039
1040	if (!stats->session_id) {
1041	pppol2tp_copy_stats(dest: stats, stats: &tunnel->stats);
1042	return 0;
1043	}
1044
1045	/* If session_id is set, search the corresponding session in the
1046	* context of this tunnel and record the session's statistics.
1047	*/
1048	session = l2tp_tunnel_get_session(tunnel, session_id: stats->session_id);
1049	if (!session)
1050	return -EBADR;
1051
1052	if (session->pwtype != L2TP_PWTYPE_PPP) {
1053	l2tp_session_dec_refcount(session);
1054	return -EBADR;
1055	}
1056
1057	pppol2tp_copy_stats(dest: stats, stats: &session->stats);
1058	l2tp_session_dec_refcount(session);
1059
1060	return 0;
1061	}
1062
1063	static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
1064	unsigned long arg)
1065	{
1066	struct pppol2tp_ioc_stats stats;
1067	struct l2tp_session *session;
1068
1069	switch (cmd) {
1070	case PPPIOCGMRU:
1071	case PPPIOCGFLAGS:
1072	session = sock->sk->sk_user_data;
1073	if (!session)
1074	return -ENOTCONN;
1075
1076	if (WARN_ON(session->magic != L2TP_SESSION_MAGIC))
1077	return -EBADF;
1078
1079	/* Not defined for tunnels */
1080	if (!session->session_id && !session->peer_session_id)
1081	return -ENOSYS;
1082
1083	if (put_user(0, (int __user *)arg))
1084	return -EFAULT;
1085	break;
1086
1087	case PPPIOCSMRU:
1088	case PPPIOCSFLAGS:
1089	session = sock->sk->sk_user_data;
1090	if (!session)
1091	return -ENOTCONN;
1092
1093	if (WARN_ON(session->magic != L2TP_SESSION_MAGIC))
1094	return -EBADF;
1095
1096	/* Not defined for tunnels */
1097	if (!session->session_id && !session->peer_session_id)
1098	return -ENOSYS;
1099
1100	if (!access_ok((int __user *)arg, sizeof(int)))
1101	return -EFAULT;
1102	break;
1103
1104	case PPPIOCGL2TPSTATS:
1105	session = sock->sk->sk_user_data;
1106	if (!session)
1107	return -ENOTCONN;
1108
1109	if (WARN_ON(session->magic != L2TP_SESSION_MAGIC))
1110	return -EBADF;
1111
1112	/* Session 0 represents the parent tunnel */
1113	if (!session->session_id && !session->peer_session_id) {
1114	u32 session_id;
1115	int err;
1116
1117	if (copy_from_user(to: &stats, from: (void __user *)arg,
1118	n: sizeof(stats)))
1119	return -EFAULT;
1120
1121	session_id = stats.session_id;
1122	err = pppol2tp_tunnel_copy_stats(stats: &stats,
1123	tunnel: session->tunnel);
1124	if (err < 0)
1125	return err;
1126
1127	stats.session_id = session_id;
1128	} else {
1129	pppol2tp_copy_stats(dest: &stats, stats: &session->stats);
1130	stats.session_id = session->session_id;
1131	}
1132	stats.tunnel_id = session->tunnel->tunnel_id;
1133	stats.using_ipsec = l2tp_tunnel_uses_xfrm(tunnel: session->tunnel);
1134
1135	if (copy_to_user(to: (void __user *)arg, from: &stats, n: sizeof(stats)))
1136	return -EFAULT;
1137	break;
1138
1139	default:
1140	return -ENOIOCTLCMD;
1141	}
1142
1143	return 0;
1144	}
1145
1146	/*****************************************************************************
1147	* setsockopt() / getsockopt() support.
1148	*
1149	* The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
1150	* sockets. In order to control kernel tunnel features, we allow userspace to
1151	* create a special "tunnel" PPPoX socket which is used for control only.
1152	* Tunnel PPPoX sockets have session_id == 0 and simply allow the user
1153	* application to issue L2TP setsockopt(), getsockopt() and ioctl() calls.
1154	*****************************************************************************/
1155
1156	/* Tunnel setsockopt() helper.
1157	*/
1158	static int pppol2tp_tunnel_setsockopt(struct sock *sk,
1159	struct l2tp_tunnel *tunnel,
1160	int optname, int val)
1161	{
1162	int err = 0;
1163
1164	switch (optname) {
1165	case PPPOL2TP_SO_DEBUG:
1166	/* Tunnel debug flags option is deprecated */
1167	break;
1168
1169	default:
1170	err = -ENOPROTOOPT;
1171	break;
1172	}
1173
1174	return err;
1175	}
1176
1177	/* Session setsockopt helper.
1178	*/
1179	static int pppol2tp_session_setsockopt(struct sock *sk,
1180	struct l2tp_session *session,
1181	int optname, int val)
1182	{
1183	int err = 0;
1184
1185	switch (optname) {
1186	case PPPOL2TP_SO_RECVSEQ:
1187	if (val != 0 && val != 1) {
1188	err = -EINVAL;
1189	break;
1190	}
1191	session->recv_seq = !!val;
1192	break;
1193
1194	case PPPOL2TP_SO_SENDSEQ:
1195	if (val != 0 && val != 1) {
1196	err = -EINVAL;
1197	break;
1198	}
1199	session->send_seq = !!val;
1200	{
1201	struct pppox_sock *po = pppox_sk(sk);
1202
1203	po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
1204	PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
1205	}
1206	l2tp_session_set_header_len(session, version: session->tunnel->version);
1207	break;
1208
1209	case PPPOL2TP_SO_LNSMODE:
1210	if (val != 0 && val != 1) {
1211	err = -EINVAL;
1212	break;
1213	}
1214	session->lns_mode = !!val;
1215	break;
1216
1217	case PPPOL2TP_SO_DEBUG:
1218	/* Session debug flags option is deprecated */
1219	break;
1220
1221	case PPPOL2TP_SO_REORDERTO:
1222	session->reorder_timeout = msecs_to_jiffies(m: val);
1223	break;
1224
1225	default:
1226	err = -ENOPROTOOPT;
1227	break;
1228	}
1229
1230	return err;
1231	}
1232
1233	/* Main setsockopt() entry point.
1234	* Does API checks, then calls either the tunnel or session setsockopt
1235	* handler, according to whether the PPPoL2TP socket is a for a regular
1236	* session or the special tunnel type.
1237	*/
1238	static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
1239	sockptr_t optval, unsigned int optlen)
1240	{
1241	struct sock *sk = sock->sk;
1242	struct l2tp_session *session;
1243	struct l2tp_tunnel *tunnel;
1244	int val;
1245	int err;
1246
1247	if (level != SOL_PPPOL2TP)
1248	return -EINVAL;
1249
1250	if (optlen < sizeof(int))
1251	return -EINVAL;
1252
1253	if (copy_from_sockptr(dst: &val, src: optval, size: sizeof(int)))
1254	return -EFAULT;
1255
1256	err = -ENOTCONN;
1257	if (!sk->sk_user_data)
1258	goto end;
1259
1260	/* Get session context from the socket */
1261	err = -EBADF;
1262	session = pppol2tp_sock_to_session(sk);
1263	if (!session)
1264	goto end;
1265
1266	/* Special case: if session_id == 0x0000, treat as operation on tunnel
1267	*/
1268	if (session->session_id == 0 && session->peer_session_id == 0) {
1269	tunnel = session->tunnel;
1270	err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
1271	} else {
1272	err = pppol2tp_session_setsockopt(sk, session, optname, val);
1273	}
1274
1275	sock_put(sk);
1276	end:
1277	return err;
1278	}
1279
1280	/* Tunnel getsockopt helper. Called with sock locked.
1281	*/
1282	static int pppol2tp_tunnel_getsockopt(struct sock *sk,
1283	struct l2tp_tunnel *tunnel,
1284	int optname, int *val)
1285	{
1286	int err = 0;
1287
1288	switch (optname) {
1289	case PPPOL2TP_SO_DEBUG:
1290	/* Tunnel debug flags option is deprecated */
1291	*val = 0;
1292	break;
1293
1294	default:
1295	err = -ENOPROTOOPT;
1296	break;
1297	}
1298
1299	return err;
1300	}
1301
1302	/* Session getsockopt helper. Called with sock locked.
1303	*/
1304	static int pppol2tp_session_getsockopt(struct sock *sk,
1305	struct l2tp_session *session,
1306	int optname, int *val)
1307	{
1308	int err = 0;
1309
1310	switch (optname) {
1311	case PPPOL2TP_SO_RECVSEQ:
1312	*val = session->recv_seq;
1313	break;
1314
1315	case PPPOL2TP_SO_SENDSEQ:
1316	*val = session->send_seq;
1317	break;
1318
1319	case PPPOL2TP_SO_LNSMODE:
1320	*val = session->lns_mode;
1321	break;
1322
1323	case PPPOL2TP_SO_DEBUG:
1324	/* Session debug flags option is deprecated */
1325	*val = 0;
1326	break;
1327
1328	case PPPOL2TP_SO_REORDERTO:
1329	*val = (int)jiffies_to_msecs(j: session->reorder_timeout);
1330	break;
1331
1332	default:
1333	err = -ENOPROTOOPT;
1334	}
1335
1336	return err;
1337	}
1338
1339	/* Main getsockopt() entry point.
1340	* Does API checks, then calls either the tunnel or session getsockopt
1341	* handler, according to whether the PPPoX socket is a for a regular session
1342	* or the special tunnel type.
1343	*/
1344	static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
1345	char __user *optval, int __user *optlen)
1346	{
1347	struct sock *sk = sock->sk;
1348	struct l2tp_session *session;
1349	struct l2tp_tunnel *tunnel;
1350	int val, len;
1351	int err;
1352
1353	if (level != SOL_PPPOL2TP)
1354	return -EINVAL;
1355
1356	if (get_user(len, optlen))
1357	return -EFAULT;
1358
1359	if (len < 0)
1360	return -EINVAL;
1361
1362	len = min_t(unsigned int, len, sizeof(int));
1363
1364	err = -ENOTCONN;
1365	if (!sk->sk_user_data)
1366	goto end;
1367
1368	/* Get the session context */
1369	err = -EBADF;
1370	session = pppol2tp_sock_to_session(sk);
1371	if (!session)
1372	goto end;
1373
1374	/* Special case: if session_id == 0x0000, treat as operation on tunnel */
1375	if (session->session_id == 0 && session->peer_session_id == 0) {
1376	tunnel = session->tunnel;
1377	err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, val: &val);
1378	if (err)
1379	goto end_put_sess;
1380	} else {
1381	err = pppol2tp_session_getsockopt(sk, session, optname, val: &val);
1382	if (err)
1383	goto end_put_sess;
1384	}
1385
1386	err = -EFAULT;
1387	if (put_user(len, optlen))
1388	goto end_put_sess;
1389
1390	if (copy_to_user(to: (void __user *)optval, from: &val, n: len))
1391	goto end_put_sess;
1392
1393	err = 0;
1394
1395	end_put_sess:
1396	sock_put(sk);
1397	end:
1398	return err;
1399	}
1400
1401	/*****************************************************************************
1402	* /proc filesystem for debug
1403	* Since the original pppol2tp driver provided /proc/net/pppol2tp for
1404	* L2TPv2, we dump only L2TPv2 tunnels and sessions here.
1405	*****************************************************************************/
1406
1407	static unsigned int pppol2tp_net_id;
1408
1409	#ifdef CONFIG_PROC_FS
1410
1411	struct pppol2tp_seq_data {
1412	struct seq_net_private p;
1413	int tunnel_idx; /* current tunnel */
1414	int session_idx; /* index of session within current tunnel */
1415	struct l2tp_tunnel *tunnel;
1416	struct l2tp_session *session; /* NULL means get next tunnel */
1417	};
1418
1419	static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
1420	{
1421	/* Drop reference taken during previous invocation */
1422	if (pd->tunnel)
1423	l2tp_tunnel_dec_refcount(tunnel: pd->tunnel);
1424
1425	for (;;) {
1426	pd->tunnel = l2tp_tunnel_get_nth(net, nth: pd->tunnel_idx);
1427	pd->tunnel_idx++;
1428
1429	/* Only accept L2TPv2 tunnels */
1430	if (!pd->tunnel || pd->tunnel->version == 2)
1431	return;
1432
1433	l2tp_tunnel_dec_refcount(tunnel: pd->tunnel);
1434	}
1435	}
1436
1437	static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
1438	{
1439	/* Drop reference taken during previous invocation */
1440	if (pd->session)
1441	l2tp_session_dec_refcount(session: pd->session);
1442
1443	pd->session = l2tp_session_get_nth(tunnel: pd->tunnel, nth: pd->session_idx);
1444	pd->session_idx++;
1445
1446	if (!pd->session) {
1447	pd->session_idx = 0;
1448	pppol2tp_next_tunnel(net, pd);
1449	}
1450	}
1451
1452	static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs)
1453	{
1454	struct pppol2tp_seq_data *pd = SEQ_START_TOKEN;
1455	loff_t pos = *offs;
1456	struct net *net;
1457
1458	if (!pos)
1459	goto out;
1460
1461	if (WARN_ON(!m->private)) {
1462	pd = NULL;
1463	goto out;
1464	}
1465
1466	pd = m->private;
1467	net = seq_file_net(seq: m);
1468
1469	if (!pd->tunnel)
1470	pppol2tp_next_tunnel(net, pd);
1471	else
1472	pppol2tp_next_session(net, pd);
1473
1474	/* NULL tunnel and session indicates end of list */
1475	if (!pd->tunnel && !pd->session)
1476	pd = NULL;
1477
1478	out:
1479	return pd;
1480	}
1481
1482	static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos)
1483	{
1484	(*pos)++;
1485	return NULL;
1486	}
1487
1488	static void pppol2tp_seq_stop(struct seq_file *p, void *v)
1489	{
1490	struct pppol2tp_seq_data *pd = v;
1491
1492	if (!pd || pd == SEQ_START_TOKEN)
1493	return;
1494
1495	/* Drop reference taken by last invocation of pppol2tp_next_session()
1496	* or pppol2tp_next_tunnel().
1497	*/
1498	if (pd->session) {
1499	l2tp_session_dec_refcount(session: pd->session);
1500	pd->session = NULL;
1501	}
1502	if (pd->tunnel) {
1503	l2tp_tunnel_dec_refcount(tunnel: pd->tunnel);
1504	pd->tunnel = NULL;
1505	}
1506	}
1507
1508	static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
1509	{
1510	struct l2tp_tunnel *tunnel = v;
1511
1512	seq_printf(m, fmt: "\nTUNNEL '%s', %c %d\n",
1513	tunnel->name,
1514	(tunnel == tunnel->sock->sk_user_data) ? 'Y' : 'N',
1515	refcount_read(r: &tunnel->ref_count) - 1);
1516	seq_printf(m, fmt: " %08x %ld/%ld/%ld %ld/%ld/%ld\n",
1517	0,
1518	atomic_long_read(v: &tunnel->stats.tx_packets),
1519	atomic_long_read(v: &tunnel->stats.tx_bytes),
1520	atomic_long_read(v: &tunnel->stats.tx_errors),
1521	atomic_long_read(v: &tunnel->stats.rx_packets),
1522	atomic_long_read(v: &tunnel->stats.rx_bytes),
1523	atomic_long_read(v: &tunnel->stats.rx_errors));
1524	}
1525
1526	static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
1527	{
1528	struct l2tp_session *session = v;
1529	struct l2tp_tunnel *tunnel = session->tunnel;
1530	unsigned char state;
1531	char user_data_ok;
1532	struct sock *sk;
1533	u32 ip = 0;
1534	u16 port = 0;
1535
1536	if (tunnel->sock) {
1537	struct inet_sock *inet = inet_sk(tunnel->sock);
1538
1539	ip = ntohl(inet->inet_saddr);
1540	port = ntohs(inet->inet_sport);
1541	}
1542
1543	sk = pppol2tp_session_get_sock(session);
1544	if (sk) {
1545	state = sk->sk_state;
1546	user_data_ok = (session == sk->sk_user_data) ? 'Y' : 'N';
1547	} else {
1548	state = 0;
1549	user_data_ok = 'N';
1550	}
1551
1552	seq_printf(m, fmt: " SESSION '%s' %08X/%d %04X/%04X -> %04X/%04X %d %c\n",
1553	session->name, ip, port,
1554	tunnel->tunnel_id,
1555	session->session_id,
1556	tunnel->peer_tunnel_id,
1557	session->peer_session_id,
1558	state, user_data_ok);
1559	seq_printf(m, fmt: " 0/0/%c/%c/%s %08x %u\n",
1560	session->recv_seq ? 'R' : '-',
1561	session->send_seq ? 'S' : '-',
1562	session->lns_mode ? "LNS" : "LAC",
1563	0,
1564	jiffies_to_msecs(j: session->reorder_timeout));
1565	seq_printf(m, fmt: " %u/%u %ld/%ld/%ld %ld/%ld/%ld\n",
1566	session->nr, session->ns,
1567	atomic_long_read(v: &session->stats.tx_packets),
1568	atomic_long_read(v: &session->stats.tx_bytes),
1569	atomic_long_read(v: &session->stats.tx_errors),
1570	atomic_long_read(v: &session->stats.rx_packets),
1571	atomic_long_read(v: &session->stats.rx_bytes),
1572	atomic_long_read(v: &session->stats.rx_errors));
1573
1574	if (sk) {
1575	struct pppox_sock *po = pppox_sk(sk);
1576
1577	seq_printf(m, fmt: " interface %s\n", ppp_dev_name(&po->chan));
1578	sock_put(sk);
1579	}
1580	}
1581
1582	static int pppol2tp_seq_show(struct seq_file *m, void *v)
1583	{
1584	struct pppol2tp_seq_data *pd = v;
1585
1586	/* display header on line 1 */
1587	if (v == SEQ_START_TOKEN) {
1588	seq_puts(m, s: "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n");
1589	seq_puts(m, s: "TUNNEL name, user-data-ok session-count\n");
1590	seq_puts(m, s: " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1591	seq_puts(m, s: " SESSION name, addr/port src-tid/sid dest-tid/sid state user-data-ok\n");
1592	seq_puts(m, s: " mtu/mru/rcvseq/sendseq/lns debug reorderto\n");
1593	seq_puts(m, s: " nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
1594	goto out;
1595	}
1596
1597	if (!pd->session)
1598	pppol2tp_seq_tunnel_show(m, v: pd->tunnel);
1599	else
1600	pppol2tp_seq_session_show(m, v: pd->session);
1601
1602	out:
1603	return 0;
1604	}
1605
1606	static const struct seq_operations pppol2tp_seq_ops = {
1607	.start = pppol2tp_seq_start,
1608	.next = pppol2tp_seq_next,
1609	.stop = pppol2tp_seq_stop,
1610	.show = pppol2tp_seq_show,
1611	};
1612	#endif /* CONFIG_PROC_FS */
1613
1614	/*****************************************************************************
1615	* Network namespace
1616	*****************************************************************************/
1617
1618	static __net_init int pppol2tp_init_net(struct net *net)
1619	{
1620	struct proc_dir_entry *pde;
1621	int err = 0;
1622
1623	pde = proc_create_net("pppol2tp", 0444, net->proc_net,
1624	&pppol2tp_seq_ops, sizeof(struct pppol2tp_seq_data));
1625	if (!pde) {
1626	err = -ENOMEM;
1627	goto out;
1628	}
1629
1630	out:
1631	return err;
1632	}
1633
1634	static __net_exit void pppol2tp_exit_net(struct net *net)
1635	{
1636	remove_proc_entry("pppol2tp", net->proc_net);
1637	}
1638
1639	static struct pernet_operations pppol2tp_net_ops = {
1640	.init = pppol2tp_init_net,
1641	.exit = pppol2tp_exit_net,
1642	.id = &pppol2tp_net_id,
1643	};
1644
1645	/*****************************************************************************
1646	* Init and cleanup
1647	*****************************************************************************/
1648
1649	static const struct proto_ops pppol2tp_ops = {
1650	.family = AF_PPPOX,
1651	.owner = THIS_MODULE,
1652	.release = pppol2tp_release,
1653	.bind = sock_no_bind,
1654	.connect = pppol2tp_connect,
1655	.socketpair = sock_no_socketpair,
1656	.accept = sock_no_accept,
1657	.getname = pppol2tp_getname,
1658	.poll = datagram_poll,
1659	.listen = sock_no_listen,
1660	.shutdown = sock_no_shutdown,
1661	.setsockopt = pppol2tp_setsockopt,
1662	.getsockopt = pppol2tp_getsockopt,
1663	.sendmsg = pppol2tp_sendmsg,
1664	.recvmsg = pppol2tp_recvmsg,
1665	.mmap = sock_no_mmap,
1666	.ioctl = pppox_ioctl,
1667	#ifdef CONFIG_COMPAT
1668	.compat_ioctl = pppox_compat_ioctl,
1669	#endif
1670	};
1671
1672	static const struct pppox_proto pppol2tp_proto = {
1673	.create = pppol2tp_create,
1674	.ioctl = pppol2tp_ioctl,
1675	.owner = THIS_MODULE,
1676	};
1677
1678	#ifdef CONFIG_L2TP_V3
1679
1680	static const struct l2tp_nl_cmd_ops pppol2tp_nl_cmd_ops = {
1681	.session_create = pppol2tp_session_create,
1682	.session_delete = l2tp_session_delete,
1683	};
1684
1685	#endif /* CONFIG_L2TP_V3 */
1686
1687	static int __init pppol2tp_init(void)
1688	{
1689	int err;
1690
1691	err = register_pernet_device(&pppol2tp_net_ops);
1692	if (err)
1693	goto out;
1694
1695	err = proto_register(prot: &pppol2tp_sk_proto, alloc_slab: 0);
1696	if (err)
1697	goto out_unregister_pppol2tp_pernet;
1698
1699	err = register_pppox_proto(PX_PROTO_OL2TP, pp: &pppol2tp_proto);
1700	if (err)
1701	goto out_unregister_pppol2tp_proto;
1702
1703	#ifdef CONFIG_L2TP_V3
1704	err = l2tp_nl_register_ops(pw_type: L2TP_PWTYPE_PPP, ops: &pppol2tp_nl_cmd_ops);
1705	if (err)
1706	goto out_unregister_pppox;
1707	#endif
1708
1709	pr_info("PPPoL2TP kernel driver, %s\n", PPPOL2TP_DRV_VERSION);
1710
1711	out:
1712	return err;
1713
1714	#ifdef CONFIG_L2TP_V3
1715	out_unregister_pppox:
1716	unregister_pppox_proto(PX_PROTO_OL2TP);
1717	#endif
1718	out_unregister_pppol2tp_proto:
1719	proto_unregister(prot: &pppol2tp_sk_proto);
1720	out_unregister_pppol2tp_pernet:
1721	unregister_pernet_device(&pppol2tp_net_ops);
1722	goto out;
1723	}
1724
1725	static void __exit pppol2tp_exit(void)
1726	{
1727	#ifdef CONFIG_L2TP_V3
1728	l2tp_nl_unregister_ops(pw_type: L2TP_PWTYPE_PPP);
1729	#endif
1730	unregister_pppox_proto(PX_PROTO_OL2TP);
1731	proto_unregister(prot: &pppol2tp_sk_proto);
1732	unregister_pernet_device(&pppol2tp_net_ops);
1733	}
1734
1735	module_init(pppol2tp_init);
1736	module_exit(pppol2tp_exit);
1737
1738	MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1739	MODULE_DESCRIPTION("PPP over L2TP over UDP");
1740	MODULE_LICENSE("GPL");
1741	MODULE_VERSION(PPPOL2TP_DRV_VERSION);
1742	MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP);
1743	MODULE_ALIAS_L2TP_PWTYPE(7);
1744