l2tp: fix reorder timeout recovery
[linux-3.10.git] / net / l2tp / l2tp_core.c
1 /*
2  * L2TP core.
3  *
4  * Copyright (c) 2008,2009,2010 Katalix Systems Ltd
5  *
6  * This file contains some code of the original L2TPv2 pppol2tp
7  * driver, which has the following copyright:
8  *
9  * Authors:     Martijn van Oosterhout <kleptog@svana.org>
10  *              James Chapman (jchapman@katalix.com)
11  * Contributors:
12  *              Michal Ostrowski <mostrows@speakeasy.net>
13  *              Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
14  *              David S. Miller (davem@redhat.com)
15  *
16  * This program is free software; you can redistribute it and/or modify
17  * it under the terms of the GNU General Public License version 2 as
18  * published by the Free Software Foundation.
19  */
20
21 #include <linux/module.h>
22 #include <linux/string.h>
23 #include <linux/list.h>
24 #include <linux/rculist.h>
25 #include <linux/uaccess.h>
26
27 #include <linux/kernel.h>
28 #include <linux/spinlock.h>
29 #include <linux/kthread.h>
30 #include <linux/sched.h>
31 #include <linux/slab.h>
32 #include <linux/errno.h>
33 #include <linux/jiffies.h>
34
35 #include <linux/netdevice.h>
36 #include <linux/net.h>
37 #include <linux/inetdevice.h>
38 #include <linux/skbuff.h>
39 #include <linux/init.h>
40 #include <linux/in.h>
41 #include <linux/ip.h>
42 #include <linux/udp.h>
43 #include <linux/l2tp.h>
44 #include <linux/hash.h>
45 #include <linux/sort.h>
46 #include <linux/file.h>
47 #include <linux/nsproxy.h>
48 #include <net/net_namespace.h>
49 #include <net/netns/generic.h>
50 #include <net/dst.h>
51 #include <net/ip.h>
52 #include <net/udp.h>
53 #include <net/inet_common.h>
54 #include <net/xfrm.h>
55 #include <net/protocol.h>
56 #include <net/inet6_connection_sock.h>
57 #include <net/inet_ecn.h>
58 #include <net/ip6_route.h>
59 #include <net/ip6_checksum.h>
60
61 #include <asm/byteorder.h>
62 #include <linux/atomic.h>
63
64 #include "l2tp_core.h"
65
66 #define L2TP_DRV_VERSION        "V2.0"
67
68 /* L2TP header constants */
69 #define L2TP_HDRFLAG_T     0x8000
70 #define L2TP_HDRFLAG_L     0x4000
71 #define L2TP_HDRFLAG_S     0x0800
72 #define L2TP_HDRFLAG_O     0x0200
73 #define L2TP_HDRFLAG_P     0x0100
74
75 #define L2TP_HDR_VER_MASK  0x000F
76 #define L2TP_HDR_VER_2     0x0002
77 #define L2TP_HDR_VER_3     0x0003
78
79 /* L2TPv3 default L2-specific sublayer */
80 #define L2TP_SLFLAG_S      0x40000000
81 #define L2TP_SL_SEQ_MASK   0x00ffffff
82
83 #define L2TP_HDR_SIZE_SEQ               10
84 #define L2TP_HDR_SIZE_NOSEQ             6
85
86 /* Default trace flags */
87 #define L2TP_DEFAULT_DEBUG_FLAGS        0
88
89 #define PRINTK(_mask, _type, _lvl, _fmt, args...)                       \
90         do {                                                            \
91                 if ((_mask) & (_type))                                  \
92                         printk(_lvl "L2TP: " _fmt, ##args);             \
93         } while (0)
94
95 /* Private data stored for received packets in the skb.
96  */
97 struct l2tp_skb_cb {
98         u32                     ns;
99         u16                     has_seq;
100         u16                     length;
101         unsigned long           expires;
102 };
103
104 #define L2TP_SKB_CB(skb)        ((struct l2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])
105
106 static atomic_t l2tp_tunnel_count;
107 static atomic_t l2tp_session_count;
108
109 /* per-net private data for this module */
110 static unsigned int l2tp_net_id;
111 struct l2tp_net {
112         struct list_head l2tp_tunnel_list;
113         spinlock_t l2tp_tunnel_list_lock;
114         struct hlist_head l2tp_session_hlist[L2TP_HASH_SIZE_2];
115         spinlock_t l2tp_session_hlist_lock;
116 };
117
118 static void l2tp_session_set_header_len(struct l2tp_session *session, int version);
119 static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
120 static void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel);
121
122 static inline struct l2tp_net *l2tp_pernet(struct net *net)
123 {
124         BUG_ON(!net);
125
126         return net_generic(net, l2tp_net_id);
127 }
128
129
130 /* Tunnel reference counts. Incremented per session that is added to
131  * the tunnel.
132  */
133 static inline void l2tp_tunnel_inc_refcount_1(struct l2tp_tunnel *tunnel)
134 {
135         atomic_inc(&tunnel->ref_count);
136 }
137
138 static inline void l2tp_tunnel_dec_refcount_1(struct l2tp_tunnel *tunnel)
139 {
140         if (atomic_dec_and_test(&tunnel->ref_count))
141                 l2tp_tunnel_free(tunnel);
142 }
143 #ifdef L2TP_REFCNT_DEBUG
144 #define l2tp_tunnel_inc_refcount(_t) do { \
145                 printk(KERN_DEBUG "l2tp_tunnel_inc_refcount: %s:%d %s: cnt=%d\n", __func__, __LINE__, (_t)->name, atomic_read(&_t->ref_count)); \
146                 l2tp_tunnel_inc_refcount_1(_t);                         \
147         } while (0)
148 #define l2tp_tunnel_dec_refcount(_t) do { \
149                 printk(KERN_DEBUG "l2tp_tunnel_dec_refcount: %s:%d %s: cnt=%d\n", __func__, __LINE__, (_t)->name, atomic_read(&_t->ref_count)); \
150                 l2tp_tunnel_dec_refcount_1(_t);                         \
151         } while (0)
152 #else
153 #define l2tp_tunnel_inc_refcount(t) l2tp_tunnel_inc_refcount_1(t)
154 #define l2tp_tunnel_dec_refcount(t) l2tp_tunnel_dec_refcount_1(t)
155 #endif
156
157 /* Session hash global list for L2TPv3.
158  * The session_id SHOULD be random according to RFC3931, but several
159  * L2TP implementations use incrementing session_ids.  So we do a real
160  * hash on the session_id, rather than a simple bitmask.
161  */
162 static inline struct hlist_head *
163 l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
164 {
165         return &pn->l2tp_session_hlist[hash_32(session_id, L2TP_HASH_BITS_2)];
166
167 }
168
169 /* Lookup a session by id in the global session list
170  */
171 static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
172 {
173         struct l2tp_net *pn = l2tp_pernet(net);
174         struct hlist_head *session_list =
175                 l2tp_session_id_hash_2(pn, session_id);
176         struct l2tp_session *session;
177         struct hlist_node *walk;
178
179         rcu_read_lock_bh();
180         hlist_for_each_entry_rcu(session, walk, session_list, global_hlist) {
181                 if (session->session_id == session_id) {
182                         rcu_read_unlock_bh();
183                         return session;
184                 }
185         }
186         rcu_read_unlock_bh();
187
188         return NULL;
189 }
190
191 /* Session hash list.
192  * The session_id SHOULD be random according to RFC2661, but several
193  * L2TP implementations (Cisco and Microsoft) use incrementing
194  * session_ids.  So we do a real hash on the session_id, rather than a
195  * simple bitmask.
196  */
197 static inline struct hlist_head *
198 l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id)
199 {
200         return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)];
201 }
202
203 /* Lookup a session by id
204  */
205 struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id)
206 {
207         struct hlist_head *session_list;
208         struct l2tp_session *session;
209         struct hlist_node *walk;
210
211         /* In L2TPv3, session_ids are unique over all tunnels and we
212          * sometimes need to look them up before we know the
213          * tunnel.
214          */
215         if (tunnel == NULL)
216                 return l2tp_session_find_2(net, session_id);
217
218         session_list = l2tp_session_id_hash(tunnel, session_id);
219         read_lock_bh(&tunnel->hlist_lock);
220         hlist_for_each_entry(session, walk, session_list, hlist) {
221                 if (session->session_id == session_id) {
222                         read_unlock_bh(&tunnel->hlist_lock);
223                         return session;
224                 }
225         }
226         read_unlock_bh(&tunnel->hlist_lock);
227
228         return NULL;
229 }
230 EXPORT_SYMBOL_GPL(l2tp_session_find);
231
232 struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
233 {
234         int hash;
235         struct hlist_node *walk;
236         struct l2tp_session *session;
237         int count = 0;
238
239         read_lock_bh(&tunnel->hlist_lock);
240         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
241                 hlist_for_each_entry(session, walk, &tunnel->session_hlist[hash], hlist) {
242                         if (++count > nth) {
243                                 read_unlock_bh(&tunnel->hlist_lock);
244                                 return session;
245                         }
246                 }
247         }
248
249         read_unlock_bh(&tunnel->hlist_lock);
250
251         return NULL;
252 }
253 EXPORT_SYMBOL_GPL(l2tp_session_find_nth);
254
255 /* Lookup a session by interface name.
256  * This is very inefficient but is only used by management interfaces.
257  */
258 struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname)
259 {
260         struct l2tp_net *pn = l2tp_pernet(net);
261         int hash;
262         struct hlist_node *walk;
263         struct l2tp_session *session;
264
265         rcu_read_lock_bh();
266         for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) {
267                 hlist_for_each_entry_rcu(session, walk, &pn->l2tp_session_hlist[hash], global_hlist) {
268                         if (!strcmp(session->ifname, ifname)) {
269                                 rcu_read_unlock_bh();
270                                 return session;
271                         }
272                 }
273         }
274
275         rcu_read_unlock_bh();
276
277         return NULL;
278 }
279 EXPORT_SYMBOL_GPL(l2tp_session_find_by_ifname);
280
281 /* Lookup a tunnel by id
282  */
283 struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id)
284 {
285         struct l2tp_tunnel *tunnel;
286         struct l2tp_net *pn = l2tp_pernet(net);
287
288         rcu_read_lock_bh();
289         list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
290                 if (tunnel->tunnel_id == tunnel_id) {
291                         rcu_read_unlock_bh();
292                         return tunnel;
293                 }
294         }
295         rcu_read_unlock_bh();
296
297         return NULL;
298 }
299 EXPORT_SYMBOL_GPL(l2tp_tunnel_find);
300
301 struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth)
302 {
303         struct l2tp_net *pn = l2tp_pernet(net);
304         struct l2tp_tunnel *tunnel;
305         int count = 0;
306
307         rcu_read_lock_bh();
308         list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
309                 if (++count > nth) {
310                         rcu_read_unlock_bh();
311                         return tunnel;
312                 }
313         }
314
315         rcu_read_unlock_bh();
316
317         return NULL;
318 }
319 EXPORT_SYMBOL_GPL(l2tp_tunnel_find_nth);
320
321 /*****************************************************************************
322  * Receive data handling
323  *****************************************************************************/
324
325 /* Queue a skb in order. We come here only if the skb has an L2TP sequence
326  * number.
327  */
328 static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)
329 {
330         struct sk_buff *skbp;
331         struct sk_buff *tmp;
332         u32 ns = L2TP_SKB_CB(skb)->ns;
333         struct l2tp_stats *sstats;
334
335         spin_lock_bh(&session->reorder_q.lock);
336         sstats = &session->stats;
337         skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
338                 if (L2TP_SKB_CB(skbp)->ns > ns) {
339                         __skb_queue_before(&session->reorder_q, skbp, skb);
340                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
341                                "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
342                                session->name, ns, L2TP_SKB_CB(skbp)->ns,
343                                skb_queue_len(&session->reorder_q));
344                         u64_stats_update_begin(&sstats->syncp);
345                         sstats->rx_oos_packets++;
346                         u64_stats_update_end(&sstats->syncp);
347                         goto out;
348                 }
349         }
350
351         __skb_queue_tail(&session->reorder_q, skb);
352
353 out:
354         spin_unlock_bh(&session->reorder_q.lock);
355 }
356
357 /* Dequeue a single skb.
358  */
359 static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)
360 {
361         struct l2tp_tunnel *tunnel = session->tunnel;
362         int length = L2TP_SKB_CB(skb)->length;
363         struct l2tp_stats *tstats, *sstats;
364
365         /* We're about to requeue the skb, so return resources
366          * to its current owner (a socket receive buffer).
367          */
368         skb_orphan(skb);
369
370         tstats = &tunnel->stats;
371         u64_stats_update_begin(&tstats->syncp);
372         sstats = &session->stats;
373         u64_stats_update_begin(&sstats->syncp);
374         tstats->rx_packets++;
375         tstats->rx_bytes += length;
376         sstats->rx_packets++;
377         sstats->rx_bytes += length;
378         u64_stats_update_end(&tstats->syncp);
379         u64_stats_update_end(&sstats->syncp);
380
381         if (L2TP_SKB_CB(skb)->has_seq) {
382                 /* Bump our Nr */
383                 session->nr++;
384                 if (tunnel->version == L2TP_HDR_VER_2)
385                         session->nr &= 0xffff;
386                 else
387                         session->nr &= 0xffffff;
388
389                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
390                        "%s: updated nr to %hu\n", session->name, session->nr);
391         }
392
393         /* call private receive handler */
394         if (session->recv_skb != NULL)
395                 (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);
396         else
397                 kfree_skb(skb);
398
399         if (session->deref)
400                 (*session->deref)(session);
401 }
402
403 /* Dequeue skbs from the session's reorder_q, subject to packet order.
404  * Skbs that have been in the queue for too long are simply discarded.
405  */
406 static void l2tp_recv_dequeue(struct l2tp_session *session)
407 {
408         struct sk_buff *skb;
409         struct sk_buff *tmp;
410         struct l2tp_stats *sstats;
411
412         /* If the pkt at the head of the queue has the nr that we
413          * expect to send up next, dequeue it and any other
414          * in-sequence packets behind it.
415          */
416 start:
417         spin_lock_bh(&session->reorder_q.lock);
418         sstats = &session->stats;
419         skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
420                 if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) {
421                         u64_stats_update_begin(&sstats->syncp);
422                         sstats->rx_seq_discards++;
423                         sstats->rx_errors++;
424                         u64_stats_update_end(&sstats->syncp);
425                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
426                                "%s: oos pkt %u len %d discarded (too old), "
427                                "waiting for %u, reorder_q_len=%d\n",
428                                session->name, L2TP_SKB_CB(skb)->ns,
429                                L2TP_SKB_CB(skb)->length, session->nr,
430                                skb_queue_len(&session->reorder_q));
431                         session->reorder_skip = 1;
432                         __skb_unlink(skb, &session->reorder_q);
433                         kfree_skb(skb);
434                         if (session->deref)
435                                 (*session->deref)(session);
436                         continue;
437                 }
438
439                 if (L2TP_SKB_CB(skb)->has_seq) {
440                         if (session->reorder_skip) {
441                                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
442                                        "%s: advancing nr to next pkt: %u -> %u",
443                                        session->name, session->nr,
444                                        L2TP_SKB_CB(skb)->ns);
445                                 session->reorder_skip = 0;
446                                 session->nr = L2TP_SKB_CB(skb)->ns;
447                         }
448                         if (L2TP_SKB_CB(skb)->ns != session->nr) {
449                                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
450                                        "%s: holding oos pkt %u len %d, "
451                                        "waiting for %u, reorder_q_len=%d\n",
452                                        session->name, L2TP_SKB_CB(skb)->ns,
453                                        L2TP_SKB_CB(skb)->length, session->nr,
454                                        skb_queue_len(&session->reorder_q));
455                                 goto out;
456                         }
457                 }
458                 __skb_unlink(skb, &session->reorder_q);
459
460                 /* Process the skb. We release the queue lock while we
461                  * do so to let other contexts process the queue.
462                  */
463                 spin_unlock_bh(&session->reorder_q.lock);
464                 l2tp_recv_dequeue_skb(session, skb);
465                 goto start;
466         }
467
468 out:
469         spin_unlock_bh(&session->reorder_q.lock);
470 }
471
472 static inline int l2tp_verify_udp_checksum(struct sock *sk,
473                                            struct sk_buff *skb)
474 {
475         struct udphdr *uh = udp_hdr(skb);
476         u16 ulen = ntohs(uh->len);
477         __wsum psum;
478
479         if (sk->sk_no_check || skb_csum_unnecessary(skb))
480                 return 0;
481
482 #if IS_ENABLED(CONFIG_IPV6)
483         if (sk->sk_family == PF_INET6) {
484                 if (!uh->check) {
485                         LIMIT_NETDEBUG(KERN_INFO "L2TP: IPv6: checksum is 0\n");
486                         return 1;
487                 }
488                 if ((skb->ip_summed == CHECKSUM_COMPLETE) &&
489                     !csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
490                                      &ipv6_hdr(skb)->daddr, ulen,
491                                      IPPROTO_UDP, skb->csum)) {
492                         skb->ip_summed = CHECKSUM_UNNECESSARY;
493                         return 0;
494                 }
495                 skb->csum = ~csum_unfold(csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
496                                                          &ipv6_hdr(skb)->daddr,
497                                                          skb->len, IPPROTO_UDP,
498                                                          0));
499         } else
500 #endif
501         {
502                 struct inet_sock *inet;
503                 if (!uh->check)
504                         return 0;
505                 inet = inet_sk(sk);
506                 psum = csum_tcpudp_nofold(inet->inet_saddr, inet->inet_daddr,
507                                           ulen, IPPROTO_UDP, 0);
508
509                 if ((skb->ip_summed == CHECKSUM_COMPLETE) &&
510                     !csum_fold(csum_add(psum, skb->csum)))
511                         return 0;
512                 skb->csum = psum;
513         }
514
515         return __skb_checksum_complete(skb);
516 }
517
518 /* Do receive processing of L2TP data frames. We handle both L2TPv2
519  * and L2TPv3 data frames here.
520  *
521  * L2TPv2 Data Message Header
522  *
523  *  0                   1                   2                   3
524  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
525  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
526  * |T|L|x|x|S|x|O|P|x|x|x|x|  Ver  |          Length (opt)         |
527  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
528  * |           Tunnel ID           |           Session ID          |
529  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
530  * |             Ns (opt)          |             Nr (opt)          |
531  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
532  * |      Offset Size (opt)        |    Offset pad... (opt)
533  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
534  *
535  * Data frames are marked by T=0. All other fields are the same as
536  * those in L2TP control frames.
537  *
538  * L2TPv3 Data Message Header
539  *
540  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
541  * |                      L2TP Session Header                      |
542  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
543  * |                      L2-Specific Sublayer                     |
544  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
545  * |                        Tunnel Payload                      ...
546  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
547  *
548  * L2TPv3 Session Header Over IP
549  *
550  *  0                   1                   2                   3
551  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
552  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
553  * |                           Session ID                          |
554  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
555  * |               Cookie (optional, maximum 64 bits)...
556  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
557  *                                                                 |
558  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
559  *
560  * L2TPv3 L2-Specific Sublayer Format
561  *
562  *  0                   1                   2                   3
563  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
564  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
565  * |x|S|x|x|x|x|x|x|              Sequence Number                  |
566  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
567  *
568  * Cookie value, sublayer format and offset (pad) are negotiated with
569  * the peer when the session is set up. Unlike L2TPv2, we do not need
570  * to parse the packet header to determine if optional fields are
571  * present.
572  *
573  * Caller must already have parsed the frame and determined that it is
574  * a data (not control) frame before coming here. Fields up to the
575  * session-id have already been parsed and ptr points to the data
576  * after the session-id.
577  */
578 void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
579                       unsigned char *ptr, unsigned char *optr, u16 hdrflags,
580                       int length, int (*payload_hook)(struct sk_buff *skb))
581 {
582         struct l2tp_tunnel *tunnel = session->tunnel;
583         int offset;
584         u32 ns, nr;
585         struct l2tp_stats *sstats = &session->stats;
586
587         /* The ref count is increased since we now hold a pointer to
588          * the session. Take care to decrement the refcnt when exiting
589          * this function from now on...
590          */
591         l2tp_session_inc_refcount(session);
592         if (session->ref)
593                 (*session->ref)(session);
594
595         /* Parse and check optional cookie */
596         if (session->peer_cookie_len > 0) {
597                 if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
598                         PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
599                                "%s: cookie mismatch (%u/%u). Discarding.\n",
600                                tunnel->name, tunnel->tunnel_id, session->session_id);
601                         u64_stats_update_begin(&sstats->syncp);
602                         sstats->rx_cookie_discards++;
603                         u64_stats_update_end(&sstats->syncp);
604                         goto discard;
605                 }
606                 ptr += session->peer_cookie_len;
607         }
608
609         /* Handle the optional sequence numbers. Sequence numbers are
610          * in different places for L2TPv2 and L2TPv3.
611          *
612          * If we are the LAC, enable/disable sequence numbers under
613          * the control of the LNS.  If no sequence numbers present but
614          * we were expecting them, discard frame.
615          */
616         ns = nr = 0;
617         L2TP_SKB_CB(skb)->has_seq = 0;
618         if (tunnel->version == L2TP_HDR_VER_2) {
619                 if (hdrflags & L2TP_HDRFLAG_S) {
620                         ns = ntohs(*(__be16 *) ptr);
621                         ptr += 2;
622                         nr = ntohs(*(__be16 *) ptr);
623                         ptr += 2;
624
625                         /* Store L2TP info in the skb */
626                         L2TP_SKB_CB(skb)->ns = ns;
627                         L2TP_SKB_CB(skb)->has_seq = 1;
628
629                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
630                                "%s: recv data ns=%u, nr=%u, session nr=%u\n",
631                                session->name, ns, nr, session->nr);
632                 }
633         } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
634                 u32 l2h = ntohl(*(__be32 *) ptr);
635
636                 if (l2h & 0x40000000) {
637                         ns = l2h & 0x00ffffff;
638
639                         /* Store L2TP info in the skb */
640                         L2TP_SKB_CB(skb)->ns = ns;
641                         L2TP_SKB_CB(skb)->has_seq = 1;
642
643                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
644                                "%s: recv data ns=%u, session nr=%u\n",
645                                session->name, ns, session->nr);
646                 }
647         }
648
649         /* Advance past L2-specific header, if present */
650         ptr += session->l2specific_len;
651
652         if (L2TP_SKB_CB(skb)->has_seq) {
653                 /* Received a packet with sequence numbers. If we're the LNS,
654                  * check if we sre sending sequence numbers and if not,
655                  * configure it so.
656                  */
657                 if ((!session->lns_mode) && (!session->send_seq)) {
658                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_INFO,
659                                "%s: requested to enable seq numbers by LNS\n",
660                                session->name);
661                         session->send_seq = -1;
662                         l2tp_session_set_header_len(session, tunnel->version);
663                 }
664         } else {
665                 /* No sequence numbers.
666                  * If user has configured mandatory sequence numbers, discard.
667                  */
668                 if (session->recv_seq) {
669                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_WARNING,
670                                "%s: recv data has no seq numbers when required. "
671                                "Discarding\n", session->name);
672                         u64_stats_update_begin(&sstats->syncp);
673                         sstats->rx_seq_discards++;
674                         u64_stats_update_end(&sstats->syncp);
675                         goto discard;
676                 }
677
678                 /* If we're the LAC and we're sending sequence numbers, the
679                  * LNS has requested that we no longer send sequence numbers.
680                  * If we're the LNS and we're sending sequence numbers, the
681                  * LAC is broken. Discard the frame.
682                  */
683                 if ((!session->lns_mode) && (session->send_seq)) {
684                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_INFO,
685                                "%s: requested to disable seq numbers by LNS\n",
686                                session->name);
687                         session->send_seq = 0;
688                         l2tp_session_set_header_len(session, tunnel->version);
689                 } else if (session->send_seq) {
690                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_WARNING,
691                                "%s: recv data has no seq numbers when required. "
692                                "Discarding\n", session->name);
693                         u64_stats_update_begin(&sstats->syncp);
694                         sstats->rx_seq_discards++;
695                         u64_stats_update_end(&sstats->syncp);
696                         goto discard;
697                 }
698         }
699
700         /* Session data offset is handled differently for L2TPv2 and
701          * L2TPv3. For L2TPv2, there is an optional 16-bit value in
702          * the header. For L2TPv3, the offset is negotiated using AVPs
703          * in the session setup control protocol.
704          */
705         if (tunnel->version == L2TP_HDR_VER_2) {
706                 /* If offset bit set, skip it. */
707                 if (hdrflags & L2TP_HDRFLAG_O) {
708                         offset = ntohs(*(__be16 *)ptr);
709                         ptr += 2 + offset;
710                 }
711         } else
712                 ptr += session->offset;
713
714         offset = ptr - optr;
715         if (!pskb_may_pull(skb, offset))
716                 goto discard;
717
718         __skb_pull(skb, offset);
719
720         /* If caller wants to process the payload before we queue the
721          * packet, do so now.
722          */
723         if (payload_hook)
724                 if ((*payload_hook)(skb))
725                         goto discard;
726
727         /* Prepare skb for adding to the session's reorder_q.  Hold
728          * packets for max reorder_timeout or 1 second if not
729          * reordering.
730          */
731         L2TP_SKB_CB(skb)->length = length;
732         L2TP_SKB_CB(skb)->expires = jiffies +
733                 (session->reorder_timeout ? session->reorder_timeout : HZ);
734
735         /* Add packet to the session's receive queue. Reordering is done here, if
736          * enabled. Saved L2TP protocol info is stored in skb->sb[].
737          */
738         if (L2TP_SKB_CB(skb)->has_seq) {
739                 if (session->reorder_timeout != 0) {
740                         /* Packet reordering enabled. Add skb to session's
741                          * reorder queue, in order of ns.
742                          */
743                         l2tp_recv_queue_skb(session, skb);
744                 } else {
745                         /* Packet reordering disabled. Discard out-of-sequence
746                          * packets
747                          */
748                         if (L2TP_SKB_CB(skb)->ns != session->nr) {
749                                 u64_stats_update_begin(&sstats->syncp);
750                                 sstats->rx_seq_discards++;
751                                 u64_stats_update_end(&sstats->syncp);
752                                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
753                                        "%s: oos pkt %u len %d discarded, "
754                                        "waiting for %u, reorder_q_len=%d\n",
755                                        session->name, L2TP_SKB_CB(skb)->ns,
756                                        L2TP_SKB_CB(skb)->length, session->nr,
757                                        skb_queue_len(&session->reorder_q));
758                                 goto discard;
759                         }
760                         skb_queue_tail(&session->reorder_q, skb);
761                 }
762         } else {
763                 /* No sequence numbers. Add the skb to the tail of the
764                  * reorder queue. This ensures that it will be
765                  * delivered after all previous sequenced skbs.
766                  */
767                 skb_queue_tail(&session->reorder_q, skb);
768         }
769
770         /* Try to dequeue as many skbs from reorder_q as we can. */
771         l2tp_recv_dequeue(session);
772
773         l2tp_session_dec_refcount(session);
774
775         return;
776
777 discard:
778         u64_stats_update_begin(&sstats->syncp);
779         sstats->rx_errors++;
780         u64_stats_update_end(&sstats->syncp);
781         kfree_skb(skb);
782
783         if (session->deref)
784                 (*session->deref)(session);
785
786         l2tp_session_dec_refcount(session);
787 }
788 EXPORT_SYMBOL(l2tp_recv_common);
789
790 /* Internal UDP receive frame. Do the real work of receiving an L2TP data frame
791  * here. The skb is not on a list when we get here.
792  * Returns 0 if the packet was a data packet and was successfully passed on.
793  * Returns 1 if the packet was not a good data packet and could not be
794  * forwarded.  All such packets are passed up to userspace to deal with.
795  */
796 static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
797                               int (*payload_hook)(struct sk_buff *skb))
798 {
799         struct l2tp_session *session = NULL;
800         unsigned char *ptr, *optr;
801         u16 hdrflags;
802         u32 tunnel_id, session_id;
803         int offset;
804         u16 version;
805         int length;
806         struct l2tp_stats *tstats;
807
808         if (tunnel->sock && l2tp_verify_udp_checksum(tunnel->sock, skb))
809                 goto discard_bad_csum;
810
811         /* UDP always verifies the packet length. */
812         __skb_pull(skb, sizeof(struct udphdr));
813
814         /* Short packet? */
815         if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) {
816                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
817                        "%s: recv short packet (len=%d)\n", tunnel->name, skb->len);
818                 goto error;
819         }
820
821         /* Trace packet contents, if enabled */
822         if (tunnel->debug & L2TP_MSG_DATA) {
823                 length = min(32u, skb->len);
824                 if (!pskb_may_pull(skb, length))
825                         goto error;
826
827                 printk(KERN_DEBUG "%s: recv: ", tunnel->name);
828
829                 offset = 0;
830                 do {
831                         printk(" %02X", skb->data[offset]);
832                 } while (++offset < length);
833
834                 printk("\n");
835         }
836
837         /* Point to L2TP header */
838         optr = ptr = skb->data;
839
840         /* Get L2TP header flags */
841         hdrflags = ntohs(*(__be16 *) ptr);
842
843         /* Check protocol version */
844         version = hdrflags & L2TP_HDR_VER_MASK;
845         if (version != tunnel->version) {
846                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
847                        "%s: recv protocol version mismatch: got %d expected %d\n",
848                        tunnel->name, version, tunnel->version);
849                 goto error;
850         }
851
852         /* Get length of L2TP packet */
853         length = skb->len;
854
855         /* If type is control packet, it is handled by userspace. */
856         if (hdrflags & L2TP_HDRFLAG_T) {
857                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_DEBUG,
858                        "%s: recv control packet, len=%d\n", tunnel->name, length);
859                 goto error;
860         }
861
862         /* Skip flags */
863         ptr += 2;
864
865         if (tunnel->version == L2TP_HDR_VER_2) {
866                 /* If length is present, skip it */
867                 if (hdrflags & L2TP_HDRFLAG_L)
868                         ptr += 2;
869
870                 /* Extract tunnel and session ID */
871                 tunnel_id = ntohs(*(__be16 *) ptr);
872                 ptr += 2;
873                 session_id = ntohs(*(__be16 *) ptr);
874                 ptr += 2;
875         } else {
876                 ptr += 2;       /* skip reserved bits */
877                 tunnel_id = tunnel->tunnel_id;
878                 session_id = ntohl(*(__be32 *) ptr);
879                 ptr += 4;
880         }
881
882         /* Find the session context */
883         session = l2tp_session_find(tunnel->l2tp_net, tunnel, session_id);
884         if (!session || !session->recv_skb) {
885                 /* Not found? Pass to userspace to deal with */
886                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
887                        "%s: no session found (%u/%u). Passing up.\n",
888                        tunnel->name, tunnel_id, session_id);
889                 goto error;
890         }
891
892         l2tp_recv_common(session, skb, ptr, optr, hdrflags, length, payload_hook);
893
894         return 0;
895
896 discard_bad_csum:
897         LIMIT_NETDEBUG("%s: UDP: bad checksum\n", tunnel->name);
898         UDP_INC_STATS_USER(tunnel->l2tp_net, UDP_MIB_INERRORS, 0);
899         tstats = &tunnel->stats;
900         u64_stats_update_begin(&tstats->syncp);
901         tstats->rx_errors++;
902         u64_stats_update_end(&tstats->syncp);
903         kfree_skb(skb);
904
905         return 0;
906
907 error:
908         /* Put UDP header back */
909         __skb_push(skb, sizeof(struct udphdr));
910
911         return 1;
912 }
913
914 /* UDP encapsulation receive handler. See net/ipv4/udp.c.
915  * Return codes:
916  * 0 : success.
917  * <0: error
918  * >0: skb should be passed up to userspace as UDP.
919  */
920 int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
921 {
922         struct l2tp_tunnel *tunnel;
923
924         tunnel = l2tp_sock_to_tunnel(sk);
925         if (tunnel == NULL)
926                 goto pass_up;
927
928         PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_DEBUG,
929                "%s: received %d bytes\n", tunnel->name, skb->len);
930
931         if (l2tp_udp_recv_core(tunnel, skb, tunnel->recv_payload_hook))
932                 goto pass_up_put;
933
934         sock_put(sk);
935         return 0;
936
937 pass_up_put:
938         sock_put(sk);
939 pass_up:
940         return 1;
941 }
942 EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv);
943
944 /************************************************************************
945  * Transmit handling
946  ***********************************************************************/
947
948 /* Build an L2TP header for the session into the buffer provided.
949  */
950 static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
951 {
952         struct l2tp_tunnel *tunnel = session->tunnel;
953         __be16 *bufp = buf;
954         __be16 *optr = buf;
955         u16 flags = L2TP_HDR_VER_2;
956         u32 tunnel_id = tunnel->peer_tunnel_id;
957         u32 session_id = session->peer_session_id;
958
959         if (session->send_seq)
960                 flags |= L2TP_HDRFLAG_S;
961
962         /* Setup L2TP header. */
963         *bufp++ = htons(flags);
964         *bufp++ = htons(tunnel_id);
965         *bufp++ = htons(session_id);
966         if (session->send_seq) {
967                 *bufp++ = htons(session->ns);
968                 *bufp++ = 0;
969                 session->ns++;
970                 session->ns &= 0xffff;
971                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
972                        "%s: updated ns to %u\n", session->name, session->ns);
973         }
974
975         return bufp - optr;
976 }
977
978 static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
979 {
980         struct l2tp_tunnel *tunnel = session->tunnel;
981         char *bufp = buf;
982         char *optr = bufp;
983
984         /* Setup L2TP header. The header differs slightly for UDP and
985          * IP encapsulations. For UDP, there is 4 bytes of flags.
986          */
987         if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
988                 u16 flags = L2TP_HDR_VER_3;
989                 *((__be16 *) bufp) = htons(flags);
990                 bufp += 2;
991                 *((__be16 *) bufp) = 0;
992                 bufp += 2;
993         }
994
995         *((__be32 *) bufp) = htonl(session->peer_session_id);
996         bufp += 4;
997         if (session->cookie_len) {
998                 memcpy(bufp, &session->cookie[0], session->cookie_len);
999                 bufp += session->cookie_len;
1000         }
1001         if (session->l2specific_len) {
1002                 if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
1003                         u32 l2h = 0;
1004                         if (session->send_seq) {
1005                                 l2h = 0x40000000 | session->ns;
1006                                 session->ns++;
1007                                 session->ns &= 0xffffff;
1008                                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
1009                                        "%s: updated ns to %u\n", session->name, session->ns);
1010                         }
1011
1012                         *((__be32 *) bufp) = htonl(l2h);
1013                 }
1014                 bufp += session->l2specific_len;
1015         }
1016         if (session->offset)
1017                 bufp += session->offset;
1018
1019         return bufp - optr;
1020 }
1021
1022 static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
1023                           struct flowi *fl, size_t data_len)
1024 {
1025         struct l2tp_tunnel *tunnel = session->tunnel;
1026         unsigned int len = skb->len;
1027         int error;
1028         struct l2tp_stats *tstats, *sstats;
1029
1030         /* Debug */
1031         if (session->send_seq)
1032                 PRINTK(session->debug, L2TP_MSG_DATA, KERN_DEBUG,
1033                        "%s: send %Zd bytes, ns=%u\n", session->name,
1034                        data_len, session->ns - 1);
1035         else
1036                 PRINTK(session->debug, L2TP_MSG_DATA, KERN_DEBUG,
1037                        "%s: send %Zd bytes\n", session->name, data_len);
1038
1039         if (session->debug & L2TP_MSG_DATA) {
1040                 int i;
1041                 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1042                 unsigned char *datap = skb->data + uhlen;
1043
1044                 printk(KERN_DEBUG "%s: xmit:", session->name);
1045                 for (i = 0; i < (len - uhlen); i++) {
1046                         printk(" %02X", *datap++);
1047                         if (i == 31) {
1048                                 printk(" ...");
1049                                 break;
1050                         }
1051                 }
1052                 printk("\n");
1053         }
1054
1055         /* Queue the packet to IP for output */
1056         skb->local_df = 1;
1057 #if IS_ENABLED(CONFIG_IPV6)
1058         if (skb->sk->sk_family == PF_INET6)
1059                 error = inet6_csk_xmit(skb, NULL);
1060         else
1061 #endif
1062                 error = ip_queue_xmit(skb, fl);
1063
1064         /* Update stats */
1065         tstats = &tunnel->stats;
1066         u64_stats_update_begin(&tstats->syncp);
1067         sstats = &session->stats;
1068         u64_stats_update_begin(&sstats->syncp);
1069         if (error >= 0) {
1070                 tstats->tx_packets++;
1071                 tstats->tx_bytes += len;
1072                 sstats->tx_packets++;
1073                 sstats->tx_bytes += len;
1074         } else {
1075                 tstats->tx_errors++;
1076                 sstats->tx_errors++;
1077         }
1078         u64_stats_update_end(&tstats->syncp);
1079         u64_stats_update_end(&sstats->syncp);
1080
1081         return 0;
1082 }
1083
1084 /* Automatically called when the skb is freed.
1085  */
1086 static void l2tp_sock_wfree(struct sk_buff *skb)
1087 {
1088         sock_put(skb->sk);
1089 }
1090
1091 /* For data skbs that we transmit, we associate with the tunnel socket
1092  * but don't do accounting.
1093  */
1094 static inline void l2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
1095 {
1096         sock_hold(sk);
1097         skb->sk = sk;
1098         skb->destructor = l2tp_sock_wfree;
1099 }
1100
1101 #if IS_ENABLED(CONFIG_IPV6)
1102 static void l2tp_xmit_ipv6_csum(struct sock *sk, struct sk_buff *skb,
1103                                 int udp_len)
1104 {
1105         struct ipv6_pinfo *np = inet6_sk(sk);
1106         struct udphdr *uh = udp_hdr(skb);
1107
1108         if (!skb_dst(skb) || !skb_dst(skb)->dev ||
1109             !(skb_dst(skb)->dev->features & NETIF_F_IPV6_CSUM)) {
1110                 __wsum csum = skb_checksum(skb, 0, udp_len, 0);
1111                 skb->ip_summed = CHECKSUM_UNNECESSARY;
1112                 uh->check = csum_ipv6_magic(&np->saddr, &np->daddr, udp_len,
1113                                             IPPROTO_UDP, csum);
1114                 if (uh->check == 0)
1115                         uh->check = CSUM_MANGLED_0;
1116         } else {
1117                 skb->ip_summed = CHECKSUM_PARTIAL;
1118                 skb->csum_start = skb_transport_header(skb) - skb->head;
1119                 skb->csum_offset = offsetof(struct udphdr, check);
1120                 uh->check = ~csum_ipv6_magic(&np->saddr, &np->daddr,
1121                                              udp_len, IPPROTO_UDP, 0);
1122         }
1123 }
1124 #endif
1125
1126 /* If caller requires the skb to have a ppp header, the header must be
1127  * inserted in the skb data before calling this function.
1128  */
1129 int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len)
1130 {
1131         int data_len = skb->len;
1132         struct l2tp_tunnel *tunnel = session->tunnel;
1133         struct sock *sk = tunnel->sock;
1134         struct flowi *fl;
1135         struct udphdr *uh;
1136         struct inet_sock *inet;
1137         __wsum csum;
1138         int old_headroom;
1139         int new_headroom;
1140         int headroom;
1141         int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1142         int udp_len;
1143
1144         /* Check that there's enough headroom in the skb to insert IP,
1145          * UDP and L2TP headers. If not enough, expand it to
1146          * make room. Adjust truesize.
1147          */
1148         headroom = NET_SKB_PAD + sizeof(struct iphdr) +
1149                 uhlen + hdr_len;
1150         old_headroom = skb_headroom(skb);
1151         if (skb_cow_head(skb, headroom)) {
1152                 dev_kfree_skb(skb);
1153                 goto abort;
1154         }
1155
1156         new_headroom = skb_headroom(skb);
1157         skb_orphan(skb);
1158         skb->truesize += new_headroom - old_headroom;
1159
1160         /* Setup L2TP header */
1161         session->build_header(session, __skb_push(skb, hdr_len));
1162
1163         /* Reset skb netfilter state */
1164         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
1165         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
1166                               IPSKB_REROUTED);
1167         nf_reset(skb);
1168
1169         bh_lock_sock(sk);
1170         if (sock_owned_by_user(sk)) {
1171                 dev_kfree_skb(skb);
1172                 goto out_unlock;
1173         }
1174
1175         /* Get routing info from the tunnel socket */
1176         skb_dst_drop(skb);
1177         skb_dst_set(skb, dst_clone(__sk_dst_check(sk, 0)));
1178
1179         inet = inet_sk(sk);
1180         fl = &inet->cork.fl;
1181         switch (tunnel->encap) {
1182         case L2TP_ENCAPTYPE_UDP:
1183                 /* Setup UDP header */
1184                 __skb_push(skb, sizeof(*uh));
1185                 skb_reset_transport_header(skb);
1186                 uh = udp_hdr(skb);
1187                 uh->source = inet->inet_sport;
1188                 uh->dest = inet->inet_dport;
1189                 udp_len = uhlen + hdr_len + data_len;
1190                 uh->len = htons(udp_len);
1191                 uh->check = 0;
1192
1193                 /* Calculate UDP checksum if configured to do so */
1194 #if IS_ENABLED(CONFIG_IPV6)
1195                 if (sk->sk_family == PF_INET6)
1196                         l2tp_xmit_ipv6_csum(sk, skb, udp_len);
1197                 else
1198 #endif
1199                 if (sk->sk_no_check == UDP_CSUM_NOXMIT)
1200                         skb->ip_summed = CHECKSUM_NONE;
1201                 else if ((skb_dst(skb) && skb_dst(skb)->dev) &&
1202                          (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM))) {
1203                         skb->ip_summed = CHECKSUM_COMPLETE;
1204                         csum = skb_checksum(skb, 0, udp_len, 0);
1205                         uh->check = csum_tcpudp_magic(inet->inet_saddr,
1206                                                       inet->inet_daddr,
1207                                                       udp_len, IPPROTO_UDP, csum);
1208                         if (uh->check == 0)
1209                                 uh->check = CSUM_MANGLED_0;
1210                 } else {
1211                         skb->ip_summed = CHECKSUM_PARTIAL;
1212                         skb->csum_start = skb_transport_header(skb) - skb->head;
1213                         skb->csum_offset = offsetof(struct udphdr, check);
1214                         uh->check = ~csum_tcpudp_magic(inet->inet_saddr,
1215                                                        inet->inet_daddr,
1216                                                        udp_len, IPPROTO_UDP, 0);
1217                 }
1218                 break;
1219
1220         case L2TP_ENCAPTYPE_IP:
1221                 break;
1222         }
1223
1224         l2tp_skb_set_owner_w(skb, sk);
1225
1226         l2tp_xmit_core(session, skb, fl, data_len);
1227 out_unlock:
1228         bh_unlock_sock(sk);
1229
1230 abort:
1231         return 0;
1232 }
1233 EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
1234
1235 /*****************************************************************************
1236  * Tinnel and session create/destroy.
1237  *****************************************************************************/
1238
1239 /* Tunnel socket destruct hook.
1240  * The tunnel context is deleted only when all session sockets have been
1241  * closed.
1242  */
1243 static void l2tp_tunnel_destruct(struct sock *sk)
1244 {
1245         struct l2tp_tunnel *tunnel;
1246
1247         tunnel = sk->sk_user_data;
1248         if (tunnel == NULL)
1249                 goto end;
1250
1251         PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
1252                "%s: closing...\n", tunnel->name);
1253
1254         /* Close all sessions */
1255         l2tp_tunnel_closeall(tunnel);
1256
1257         switch (tunnel->encap) {
1258         case L2TP_ENCAPTYPE_UDP:
1259                 /* No longer an encapsulation socket. See net/ipv4/udp.c */
1260                 (udp_sk(sk))->encap_type = 0;
1261                 (udp_sk(sk))->encap_rcv = NULL;
1262                 break;
1263         case L2TP_ENCAPTYPE_IP:
1264                 break;
1265         }
1266
1267         /* Remove hooks into tunnel socket */
1268         tunnel->sock = NULL;
1269         sk->sk_destruct = tunnel->old_sk_destruct;
1270         sk->sk_user_data = NULL;
1271
1272         /* Call the original destructor */
1273         if (sk->sk_destruct)
1274                 (*sk->sk_destruct)(sk);
1275
1276         /* We're finished with the socket */
1277         l2tp_tunnel_dec_refcount(tunnel);
1278
1279 end:
1280         return;
1281 }
1282
1283 /* When the tunnel is closed, all the attached sessions need to go too.
1284  */
1285 static void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
1286 {
1287         int hash;
1288         struct hlist_node *walk;
1289         struct hlist_node *tmp;
1290         struct l2tp_session *session;
1291
1292         BUG_ON(tunnel == NULL);
1293
1294         PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
1295                "%s: closing all sessions...\n", tunnel->name);
1296
1297         write_lock_bh(&tunnel->hlist_lock);
1298         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
1299 again:
1300                 hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
1301                         session = hlist_entry(walk, struct l2tp_session, hlist);
1302
1303                         PRINTK(session->debug, L2TP_MSG_CONTROL, KERN_INFO,
1304                                "%s: closing session\n", session->name);
1305
1306                         hlist_del_init(&session->hlist);
1307
1308                         /* Since we should hold the sock lock while
1309                          * doing any unbinding, we need to release the
1310                          * lock we're holding before taking that lock.
1311                          * Hold a reference to the sock so it doesn't
1312                          * disappear as we're jumping between locks.
1313                          */
1314                         if (session->ref != NULL)
1315                                 (*session->ref)(session);
1316
1317                         write_unlock_bh(&tunnel->hlist_lock);
1318
1319                         if (tunnel->version != L2TP_HDR_VER_2) {
1320                                 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1321
1322                                 spin_lock_bh(&pn->l2tp_session_hlist_lock);
1323                                 hlist_del_init_rcu(&session->global_hlist);
1324                                 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
1325                                 synchronize_rcu();
1326                         }
1327
1328                         if (session->session_close != NULL)
1329                                 (*session->session_close)(session);
1330
1331                         if (session->deref != NULL)
1332                                 (*session->deref)(session);
1333
1334                         write_lock_bh(&tunnel->hlist_lock);
1335
1336                         /* Now restart from the beginning of this hash
1337                          * chain.  We always remove a session from the
1338                          * list so we are guaranteed to make forward
1339                          * progress.
1340                          */
1341                         goto again;
1342                 }
1343         }
1344         write_unlock_bh(&tunnel->hlist_lock);
1345 }
1346
1347 /* Really kill the tunnel.
1348  * Come here only when all sessions have been cleared from the tunnel.
1349  */
1350 static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
1351 {
1352         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1353
1354         BUG_ON(atomic_read(&tunnel->ref_count) != 0);
1355         BUG_ON(tunnel->sock != NULL);
1356
1357         PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
1358                "%s: free...\n", tunnel->name);
1359
1360         /* Remove from tunnel list */
1361         spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1362         list_del_rcu(&tunnel->list);
1363         spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
1364         synchronize_rcu();
1365
1366         atomic_dec(&l2tp_tunnel_count);
1367         kfree(tunnel);
1368 }
1369
1370 /* Create a socket for the tunnel, if one isn't set up by
1371  * userspace. This is used for static tunnels where there is no
1372  * managing L2TP daemon.
1373  */
1374 static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct socket **sockp)
1375 {
1376         int err = -EINVAL;
1377         struct sockaddr_in udp_addr;
1378 #if IS_ENABLED(CONFIG_IPV6)
1379         struct sockaddr_in6 udp6_addr;
1380         struct sockaddr_l2tpip6 ip6_addr;
1381 #endif
1382         struct sockaddr_l2tpip ip_addr;
1383         struct socket *sock = NULL;
1384
1385         switch (cfg->encap) {
1386         case L2TP_ENCAPTYPE_UDP:
1387 #if IS_ENABLED(CONFIG_IPV6)
1388                 if (cfg->local_ip6 && cfg->peer_ip6) {
1389                         err = sock_create(AF_INET6, SOCK_DGRAM, 0, sockp);
1390                         if (err < 0)
1391                                 goto out;
1392
1393                         sock = *sockp;
1394
1395                         memset(&udp6_addr, 0, sizeof(udp6_addr));
1396                         udp6_addr.sin6_family = AF_INET6;
1397                         memcpy(&udp6_addr.sin6_addr, cfg->local_ip6,
1398                                sizeof(udp6_addr.sin6_addr));
1399                         udp6_addr.sin6_port = htons(cfg->local_udp_port);
1400                         err = kernel_bind(sock, (struct sockaddr *) &udp6_addr,
1401                                           sizeof(udp6_addr));
1402                         if (err < 0)
1403                                 goto out;
1404
1405                         udp6_addr.sin6_family = AF_INET6;
1406                         memcpy(&udp6_addr.sin6_addr, cfg->peer_ip6,
1407                                sizeof(udp6_addr.sin6_addr));
1408                         udp6_addr.sin6_port = htons(cfg->peer_udp_port);
1409                         err = kernel_connect(sock,
1410                                              (struct sockaddr *) &udp6_addr,
1411                                              sizeof(udp6_addr), 0);
1412                         if (err < 0)
1413                                 goto out;
1414                 } else
1415 #endif
1416                 {
1417                         err = sock_create(AF_INET, SOCK_DGRAM, 0, sockp);
1418                         if (err < 0)
1419                                 goto out;
1420
1421                         sock = *sockp;
1422
1423                         memset(&udp_addr, 0, sizeof(udp_addr));
1424                         udp_addr.sin_family = AF_INET;
1425                         udp_addr.sin_addr = cfg->local_ip;
1426                         udp_addr.sin_port = htons(cfg->local_udp_port);
1427                         err = kernel_bind(sock, (struct sockaddr *) &udp_addr,
1428                                           sizeof(udp_addr));
1429                         if (err < 0)
1430                                 goto out;
1431
1432                         udp_addr.sin_family = AF_INET;
1433                         udp_addr.sin_addr = cfg->peer_ip;
1434                         udp_addr.sin_port = htons(cfg->peer_udp_port);
1435                         err = kernel_connect(sock,
1436                                              (struct sockaddr *) &udp_addr,
1437                                              sizeof(udp_addr), 0);
1438                         if (err < 0)
1439                                 goto out;
1440                 }
1441
1442                 if (!cfg->use_udp_checksums)
1443                         sock->sk->sk_no_check = UDP_CSUM_NOXMIT;
1444
1445                 break;
1446
1447         case L2TP_ENCAPTYPE_IP:
1448 #if IS_ENABLED(CONFIG_IPV6)
1449                 if (cfg->local_ip6 && cfg->peer_ip6) {
1450                         err = sock_create(AF_INET6, SOCK_DGRAM, IPPROTO_L2TP,
1451                                           sockp);
1452                         if (err < 0)
1453                                 goto out;
1454
1455                         sock = *sockp;
1456
1457                         memset(&ip6_addr, 0, sizeof(ip6_addr));
1458                         ip6_addr.l2tp_family = AF_INET6;
1459                         memcpy(&ip6_addr.l2tp_addr, cfg->local_ip6,
1460                                sizeof(ip6_addr.l2tp_addr));
1461                         ip6_addr.l2tp_conn_id = tunnel_id;
1462                         err = kernel_bind(sock, (struct sockaddr *) &ip6_addr,
1463                                           sizeof(ip6_addr));
1464                         if (err < 0)
1465                                 goto out;
1466
1467                         ip6_addr.l2tp_family = AF_INET6;
1468                         memcpy(&ip6_addr.l2tp_addr, cfg->peer_ip6,
1469                                sizeof(ip6_addr.l2tp_addr));
1470                         ip6_addr.l2tp_conn_id = peer_tunnel_id;
1471                         err = kernel_connect(sock,
1472                                              (struct sockaddr *) &ip6_addr,
1473                                              sizeof(ip6_addr), 0);
1474                         if (err < 0)
1475                                 goto out;
1476                 } else
1477 #endif
1478                 {
1479                         err = sock_create(AF_INET, SOCK_DGRAM, IPPROTO_L2TP,
1480                                           sockp);
1481                         if (err < 0)
1482                                 goto out;
1483
1484                         sock = *sockp;
1485
1486                         memset(&ip_addr, 0, sizeof(ip_addr));
1487                         ip_addr.l2tp_family = AF_INET;
1488                         ip_addr.l2tp_addr = cfg->local_ip;
1489                         ip_addr.l2tp_conn_id = tunnel_id;
1490                         err = kernel_bind(sock, (struct sockaddr *) &ip_addr,
1491                                           sizeof(ip_addr));
1492                         if (err < 0)
1493                                 goto out;
1494
1495                         ip_addr.l2tp_family = AF_INET;
1496                         ip_addr.l2tp_addr = cfg->peer_ip;
1497                         ip_addr.l2tp_conn_id = peer_tunnel_id;
1498                         err = kernel_connect(sock, (struct sockaddr *) &ip_addr,
1499                                              sizeof(ip_addr), 0);
1500                         if (err < 0)
1501                                 goto out;
1502                 }
1503                 break;
1504
1505         default:
1506                 goto out;
1507         }
1508
1509 out:
1510         if ((err < 0) && sock) {
1511                 sock_release(sock);
1512                 *sockp = NULL;
1513         }
1514
1515         return err;
1516 }
1517
1518 int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp)
1519 {
1520         struct l2tp_tunnel *tunnel = NULL;
1521         int err;
1522         struct socket *sock = NULL;
1523         struct sock *sk = NULL;
1524         struct l2tp_net *pn;
1525         enum l2tp_encap_type encap = L2TP_ENCAPTYPE_UDP;
1526
1527         /* Get the tunnel socket from the fd, which was opened by
1528          * the userspace L2TP daemon. If not specified, create a
1529          * kernel socket.
1530          */
1531         if (fd < 0) {
1532                 err = l2tp_tunnel_sock_create(tunnel_id, peer_tunnel_id, cfg, &sock);
1533                 if (err < 0)
1534                         goto err;
1535         } else {
1536                 err = -EBADF;
1537                 sock = sockfd_lookup(fd, &err);
1538                 if (!sock) {
1539                         printk(KERN_ERR "tunl %hu: sockfd_lookup(fd=%d) returned %d\n",
1540                                tunnel_id, fd, err);
1541                         goto err;
1542                 }
1543         }
1544
1545         sk = sock->sk;
1546
1547         if (cfg != NULL)
1548                 encap = cfg->encap;
1549
1550         /* Quick sanity checks */
1551         switch (encap) {
1552         case L2TP_ENCAPTYPE_UDP:
1553                 err = -EPROTONOSUPPORT;
1554                 if (sk->sk_protocol != IPPROTO_UDP) {
1555                         printk(KERN_ERR "tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
1556                                tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
1557                         goto err;
1558                 }
1559                 break;
1560         case L2TP_ENCAPTYPE_IP:
1561                 err = -EPROTONOSUPPORT;
1562                 if (sk->sk_protocol != IPPROTO_L2TP) {
1563                         printk(KERN_ERR "tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
1564                                tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP);
1565                         goto err;
1566                 }
1567                 break;
1568         }
1569
1570         /* Check if this socket has already been prepped */
1571         tunnel = (struct l2tp_tunnel *)sk->sk_user_data;
1572         if (tunnel != NULL) {
1573                 /* This socket has already been prepped */
1574                 err = -EBUSY;
1575                 goto err;
1576         }
1577
1578         tunnel = kzalloc(sizeof(struct l2tp_tunnel), GFP_KERNEL);
1579         if (tunnel == NULL) {
1580                 err = -ENOMEM;
1581                 goto err;
1582         }
1583
1584         tunnel->version = version;
1585         tunnel->tunnel_id = tunnel_id;
1586         tunnel->peer_tunnel_id = peer_tunnel_id;
1587         tunnel->debug = L2TP_DEFAULT_DEBUG_FLAGS;
1588
1589         tunnel->magic = L2TP_TUNNEL_MAGIC;
1590         sprintf(&tunnel->name[0], "tunl %u", tunnel_id);
1591         rwlock_init(&tunnel->hlist_lock);
1592
1593         /* The net we belong to */
1594         tunnel->l2tp_net = net;
1595         pn = l2tp_pernet(net);
1596
1597         if (cfg != NULL)
1598                 tunnel->debug = cfg->debug;
1599
1600         /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
1601         tunnel->encap = encap;
1602         if (encap == L2TP_ENCAPTYPE_UDP) {
1603                 /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
1604                 udp_sk(sk)->encap_type = UDP_ENCAP_L2TPINUDP;
1605                 udp_sk(sk)->encap_rcv = l2tp_udp_encap_recv;
1606 #if IS_ENABLED(CONFIG_IPV6)
1607                 if (sk->sk_family == PF_INET6)
1608                         udpv6_encap_enable();
1609                 else
1610 #endif
1611                 udp_encap_enable();
1612         }
1613
1614         sk->sk_user_data = tunnel;
1615
1616         /* Hook on the tunnel socket destructor so that we can cleanup
1617          * if the tunnel socket goes away.
1618          */
1619         tunnel->old_sk_destruct = sk->sk_destruct;
1620         sk->sk_destruct = &l2tp_tunnel_destruct;
1621         tunnel->sock = sk;
1622         sk->sk_allocation = GFP_ATOMIC;
1623
1624         /* Add tunnel to our list */
1625         INIT_LIST_HEAD(&tunnel->list);
1626         atomic_inc(&l2tp_tunnel_count);
1627
1628         /* Bump the reference count. The tunnel context is deleted
1629          * only when this drops to zero. Must be done before list insertion
1630          */
1631         l2tp_tunnel_inc_refcount(tunnel);
1632         spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1633         list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
1634         spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
1635
1636         err = 0;
1637 err:
1638         if (tunnelp)
1639                 *tunnelp = tunnel;
1640
1641         /* If tunnel's socket was created by the kernel, it doesn't
1642          *  have a file.
1643          */
1644         if (sock && sock->file)
1645                 sockfd_put(sock);
1646
1647         return err;
1648 }
1649 EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
1650
1651 /* This function is used by the netlink TUNNEL_DELETE command.
1652  */
1653 int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
1654 {
1655         int err = 0;
1656         struct socket *sock = tunnel->sock ? tunnel->sock->sk_socket : NULL;
1657
1658         /* Force the tunnel socket to close. This will eventually
1659          * cause the tunnel to be deleted via the normal socket close
1660          * mechanisms when userspace closes the tunnel socket.
1661          */
1662         if (sock != NULL) {
1663                 err = inet_shutdown(sock, 2);
1664
1665                 /* If the tunnel's socket was created by the kernel,
1666                  * close the socket here since the socket was not
1667                  * created by userspace.
1668                  */
1669                 if (sock->file == NULL)
1670                         err = inet_release(sock);
1671         }
1672
1673         return err;
1674 }
1675 EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
1676
1677 /* Really kill the session.
1678  */
1679 void l2tp_session_free(struct l2tp_session *session)
1680 {
1681         struct l2tp_tunnel *tunnel;
1682
1683         BUG_ON(atomic_read(&session->ref_count) != 0);
1684
1685         tunnel = session->tunnel;
1686         if (tunnel != NULL) {
1687                 BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
1688
1689                 /* Delete the session from the hash */
1690                 write_lock_bh(&tunnel->hlist_lock);
1691                 hlist_del_init(&session->hlist);
1692                 write_unlock_bh(&tunnel->hlist_lock);
1693
1694                 /* Unlink from the global hash if not L2TPv2 */
1695                 if (tunnel->version != L2TP_HDR_VER_2) {
1696                         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1697
1698                         spin_lock_bh(&pn->l2tp_session_hlist_lock);
1699                         hlist_del_init_rcu(&session->global_hlist);
1700                         spin_unlock_bh(&pn->l2tp_session_hlist_lock);
1701                         synchronize_rcu();
1702                 }
1703
1704                 if (session->session_id != 0)
1705                         atomic_dec(&l2tp_session_count);
1706
1707                 sock_put(tunnel->sock);
1708
1709                 /* This will delete the tunnel context if this
1710                  * is the last session on the tunnel.
1711                  */
1712                 session->tunnel = NULL;
1713                 l2tp_tunnel_dec_refcount(tunnel);
1714         }
1715
1716         kfree(session);
1717
1718         return;
1719 }
1720 EXPORT_SYMBOL_GPL(l2tp_session_free);
1721
1722 /* This function is used by the netlink SESSION_DELETE command and by
1723    pseudowire modules.
1724  */
1725 int l2tp_session_delete(struct l2tp_session *session)
1726 {
1727         if (session->session_close != NULL)
1728                 (*session->session_close)(session);
1729
1730         l2tp_session_dec_refcount(session);
1731
1732         return 0;
1733 }
1734 EXPORT_SYMBOL_GPL(l2tp_session_delete);
1735
1736
1737 /* We come here whenever a session's send_seq, cookie_len or
1738  * l2specific_len parameters are set.
1739  */
1740 static void l2tp_session_set_header_len(struct l2tp_session *session, int version)
1741 {
1742         if (version == L2TP_HDR_VER_2) {
1743                 session->hdr_len = 6;
1744                 if (session->send_seq)
1745                         session->hdr_len += 4;
1746         } else {
1747                 session->hdr_len = 4 + session->cookie_len + session->l2specific_len + session->offset;
1748                 if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)
1749                         session->hdr_len += 4;
1750         }
1751
1752 }
1753
1754 struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
1755 {
1756         struct l2tp_session *session;
1757
1758         session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL);
1759         if (session != NULL) {
1760                 session->magic = L2TP_SESSION_MAGIC;
1761                 session->tunnel = tunnel;
1762
1763                 session->session_id = session_id;
1764                 session->peer_session_id = peer_session_id;
1765                 session->nr = 1;
1766
1767                 sprintf(&session->name[0], "sess %u/%u",
1768                         tunnel->tunnel_id, session->session_id);
1769
1770                 skb_queue_head_init(&session->reorder_q);
1771
1772                 INIT_HLIST_NODE(&session->hlist);
1773                 INIT_HLIST_NODE(&session->global_hlist);
1774
1775                 /* Inherit debug options from tunnel */
1776                 session->debug = tunnel->debug;
1777
1778                 if (cfg) {
1779                         session->pwtype = cfg->pw_type;
1780                         session->debug = cfg->debug;
1781                         session->mtu = cfg->mtu;
1782                         session->mru = cfg->mru;
1783                         session->send_seq = cfg->send_seq;
1784                         session->recv_seq = cfg->recv_seq;
1785                         session->lns_mode = cfg->lns_mode;
1786                         session->reorder_timeout = cfg->reorder_timeout;
1787                         session->offset = cfg->offset;
1788                         session->l2specific_type = cfg->l2specific_type;
1789                         session->l2specific_len = cfg->l2specific_len;
1790                         session->cookie_len = cfg->cookie_len;
1791                         memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);
1792                         session->peer_cookie_len = cfg->peer_cookie_len;
1793                         memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);
1794                 }
1795
1796                 if (tunnel->version == L2TP_HDR_VER_2)
1797                         session->build_header = l2tp_build_l2tpv2_header;
1798                 else
1799                         session->build_header = l2tp_build_l2tpv3_header;
1800
1801                 l2tp_session_set_header_len(session, tunnel->version);
1802
1803                 /* Bump the reference count. The session context is deleted
1804                  * only when this drops to zero.
1805                  */
1806                 l2tp_session_inc_refcount(session);
1807                 l2tp_tunnel_inc_refcount(tunnel);
1808
1809                 /* Ensure tunnel socket isn't deleted */
1810                 sock_hold(tunnel->sock);
1811
1812                 /* Add session to the tunnel's hash list */
1813                 write_lock_bh(&tunnel->hlist_lock);
1814                 hlist_add_head(&session->hlist,
1815                                l2tp_session_id_hash(tunnel, session_id));
1816                 write_unlock_bh(&tunnel->hlist_lock);
1817
1818                 /* And to the global session list if L2TPv3 */
1819                 if (tunnel->version != L2TP_HDR_VER_2) {
1820                         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1821
1822                         spin_lock_bh(&pn->l2tp_session_hlist_lock);
1823                         hlist_add_head_rcu(&session->global_hlist,
1824                                            l2tp_session_id_hash_2(pn, session_id));
1825                         spin_unlock_bh(&pn->l2tp_session_hlist_lock);
1826                 }
1827
1828                 /* Ignore management session in session count value */
1829                 if (session->session_id != 0)
1830                         atomic_inc(&l2tp_session_count);
1831         }
1832
1833         return session;
1834 }
1835 EXPORT_SYMBOL_GPL(l2tp_session_create);
1836
1837 /*****************************************************************************
1838  * Init and cleanup
1839  *****************************************************************************/
1840
1841 static __net_init int l2tp_init_net(struct net *net)
1842 {
1843         struct l2tp_net *pn = net_generic(net, l2tp_net_id);
1844         int hash;
1845
1846         INIT_LIST_HEAD(&pn->l2tp_tunnel_list);
1847         spin_lock_init(&pn->l2tp_tunnel_list_lock);
1848
1849         for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
1850                 INIT_HLIST_HEAD(&pn->l2tp_session_hlist[hash]);
1851
1852         spin_lock_init(&pn->l2tp_session_hlist_lock);
1853
1854         return 0;
1855 }
1856
1857 static struct pernet_operations l2tp_net_ops = {
1858         .init = l2tp_init_net,
1859         .id   = &l2tp_net_id,
1860         .size = sizeof(struct l2tp_net),
1861 };
1862
1863 static int __init l2tp_init(void)
1864 {
1865         int rc = 0;
1866
1867         rc = register_pernet_device(&l2tp_net_ops);
1868         if (rc)
1869                 goto out;
1870
1871         printk(KERN_INFO "L2TP core driver, %s\n", L2TP_DRV_VERSION);
1872
1873 out:
1874         return rc;
1875 }
1876
1877 static void __exit l2tp_exit(void)
1878 {
1879         unregister_pernet_device(&l2tp_net_ops);
1880 }
1881
1882 module_init(l2tp_init);
1883 module_exit(l2tp_exit);
1884
1885 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1886 MODULE_DESCRIPTION("L2TP core");
1887 MODULE_LICENSE("GPL");
1888 MODULE_VERSION(L2TP_DRV_VERSION);
1889