l2tp: Add L2TPv3 protocol support
[linux-3.10.git] / net / l2tp / l2tp_core.c
1 /*
2  * L2TP core.
3  *
4  * Copyright (c) 2008,2009,2010 Katalix Systems Ltd
5  *
6  * This file contains some code of the original L2TPv2 pppol2tp
7  * driver, which has the following copyright:
8  *
9  * Authors:     Martijn van Oosterhout <kleptog@svana.org>
10  *              James Chapman (jchapman@katalix.com)
11  * Contributors:
12  *              Michal Ostrowski <mostrows@speakeasy.net>
13  *              Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
14  *              David S. Miller (davem@redhat.com)
15  *
16  * This program is free software; you can redistribute it and/or modify
17  * it under the terms of the GNU General Public License version 2 as
18  * published by the Free Software Foundation.
19  */
20
21 #include <linux/module.h>
22 #include <linux/string.h>
23 #include <linux/list.h>
24 #include <linux/uaccess.h>
25
26 #include <linux/kernel.h>
27 #include <linux/spinlock.h>
28 #include <linux/kthread.h>
29 #include <linux/sched.h>
30 #include <linux/slab.h>
31 #include <linux/errno.h>
32 #include <linux/jiffies.h>
33
34 #include <linux/netdevice.h>
35 #include <linux/net.h>
36 #include <linux/inetdevice.h>
37 #include <linux/skbuff.h>
38 #include <linux/init.h>
39 #include <linux/ip.h>
40 #include <linux/udp.h>
41 #include <linux/hash.h>
42 #include <linux/sort.h>
43 #include <linux/file.h>
44 #include <linux/nsproxy.h>
45 #include <net/net_namespace.h>
46 #include <net/netns/generic.h>
47 #include <net/dst.h>
48 #include <net/ip.h>
49 #include <net/udp.h>
50 #include <net/xfrm.h>
51
52 #include <asm/byteorder.h>
53 #include <asm/atomic.h>
54
55 #include "l2tp_core.h"
56
57 #define L2TP_DRV_VERSION        "V2.0"
58
59 /* L2TP header constants */
60 #define L2TP_HDRFLAG_T     0x8000
61 #define L2TP_HDRFLAG_L     0x4000
62 #define L2TP_HDRFLAG_S     0x0800
63 #define L2TP_HDRFLAG_O     0x0200
64 #define L2TP_HDRFLAG_P     0x0100
65
66 #define L2TP_HDR_VER_MASK  0x000F
67 #define L2TP_HDR_VER_2     0x0002
68 #define L2TP_HDR_VER_3     0x0003
69
70 /* L2TPv3 default L2-specific sublayer */
71 #define L2TP_SLFLAG_S      0x40000000
72 #define L2TP_SL_SEQ_MASK   0x00ffffff
73
74 #define L2TP_HDR_SIZE_SEQ               10
75 #define L2TP_HDR_SIZE_NOSEQ             6
76
77 /* Default trace flags */
78 #define L2TP_DEFAULT_DEBUG_FLAGS        0
79
80 #define PRINTK(_mask, _type, _lvl, _fmt, args...)                       \
81         do {                                                            \
82                 if ((_mask) & (_type))                                  \
83                         printk(_lvl "L2TP: " _fmt, ##args);             \
84         } while (0)
85
86 /* Private data stored for received packets in the skb.
87  */
88 struct l2tp_skb_cb {
89         u32                     ns;
90         u16                     has_seq;
91         u16                     length;
92         unsigned long           expires;
93 };
94
95 #define L2TP_SKB_CB(skb)        ((struct l2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])
96
97 static atomic_t l2tp_tunnel_count;
98 static atomic_t l2tp_session_count;
99
100 /* per-net private data for this module */
101 static unsigned int l2tp_net_id;
102 struct l2tp_net {
103         struct list_head l2tp_tunnel_list;
104         rwlock_t l2tp_tunnel_list_lock;
105         struct hlist_head l2tp_session_hlist[L2TP_HASH_SIZE_2];
106         rwlock_t l2tp_session_hlist_lock;
107 };
108
109 static inline struct l2tp_net *l2tp_pernet(struct net *net)
110 {
111         BUG_ON(!net);
112
113         return net_generic(net, l2tp_net_id);
114 }
115
116 /* Session hash global list for L2TPv3.
117  * The session_id SHOULD be random according to RFC3931, but several
118  * L2TP implementations use incrementing session_ids.  So we do a real
119  * hash on the session_id, rather than a simple bitmask.
120  */
121 static inline struct hlist_head *
122 l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
123 {
124         return &pn->l2tp_session_hlist[hash_32(session_id, L2TP_HASH_BITS_2)];
125
126 }
127
128 /* Lookup a session by id in the global session list
129  */
130 static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id)
131 {
132         struct l2tp_net *pn = l2tp_pernet(net);
133         struct hlist_head *session_list =
134                 l2tp_session_id_hash_2(pn, session_id);
135         struct l2tp_session *session;
136         struct hlist_node *walk;
137
138         read_lock_bh(&pn->l2tp_session_hlist_lock);
139         hlist_for_each_entry(session, walk, session_list, global_hlist) {
140                 if (session->session_id == session_id) {
141                         read_unlock_bh(&pn->l2tp_session_hlist_lock);
142                         return session;
143                 }
144         }
145         read_unlock_bh(&pn->l2tp_session_hlist_lock);
146
147         return NULL;
148 }
149
150 /* Session hash list.
151  * The session_id SHOULD be random according to RFC2661, but several
152  * L2TP implementations (Cisco and Microsoft) use incrementing
153  * session_ids.  So we do a real hash on the session_id, rather than a
154  * simple bitmask.
155  */
156 static inline struct hlist_head *
157 l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id)
158 {
159         return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)];
160 }
161
162 /* Lookup a session by id
163  */
164 struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id)
165 {
166         struct hlist_head *session_list;
167         struct l2tp_session *session;
168         struct hlist_node *walk;
169
170         /* In L2TPv3, session_ids are unique over all tunnels and we
171          * sometimes need to look them up before we know the
172          * tunnel.
173          */
174         if (tunnel == NULL)
175                 return l2tp_session_find_2(net, session_id);
176
177         session_list = l2tp_session_id_hash(tunnel, session_id);
178         read_lock_bh(&tunnel->hlist_lock);
179         hlist_for_each_entry(session, walk, session_list, hlist) {
180                 if (session->session_id == session_id) {
181                         read_unlock_bh(&tunnel->hlist_lock);
182                         return session;
183                 }
184         }
185         read_unlock_bh(&tunnel->hlist_lock);
186
187         return NULL;
188 }
189 EXPORT_SYMBOL_GPL(l2tp_session_find);
190
191 struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
192 {
193         int hash;
194         struct hlist_node *walk;
195         struct l2tp_session *session;
196         int count = 0;
197
198         read_lock_bh(&tunnel->hlist_lock);
199         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
200                 hlist_for_each_entry(session, walk, &tunnel->session_hlist[hash], hlist) {
201                         if (++count > nth) {
202                                 read_unlock_bh(&tunnel->hlist_lock);
203                                 return session;
204                         }
205                 }
206         }
207
208         read_unlock_bh(&tunnel->hlist_lock);
209
210         return NULL;
211 }
212 EXPORT_SYMBOL_GPL(l2tp_session_find_nth);
213
214 /* Lookup a tunnel by id
215  */
216 struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id)
217 {
218         struct l2tp_tunnel *tunnel;
219         struct l2tp_net *pn = l2tp_pernet(net);
220
221         read_lock_bh(&pn->l2tp_tunnel_list_lock);
222         list_for_each_entry(tunnel, &pn->l2tp_tunnel_list, list) {
223                 if (tunnel->tunnel_id == tunnel_id) {
224                         read_unlock_bh(&pn->l2tp_tunnel_list_lock);
225                         return tunnel;
226                 }
227         }
228         read_unlock_bh(&pn->l2tp_tunnel_list_lock);
229
230         return NULL;
231 }
232 EXPORT_SYMBOL_GPL(l2tp_tunnel_find);
233
234 struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth)
235 {
236         struct l2tp_net *pn = l2tp_pernet(net);
237         struct l2tp_tunnel *tunnel;
238         int count = 0;
239
240         read_lock_bh(&pn->l2tp_tunnel_list_lock);
241         list_for_each_entry(tunnel, &pn->l2tp_tunnel_list, list) {
242                 if (++count > nth) {
243                         read_unlock_bh(&pn->l2tp_tunnel_list_lock);
244                         return tunnel;
245                 }
246         }
247
248         read_unlock_bh(&pn->l2tp_tunnel_list_lock);
249
250         return NULL;
251 }
252 EXPORT_SYMBOL_GPL(l2tp_tunnel_find_nth);
253
254 /*****************************************************************************
255  * Receive data handling
256  *****************************************************************************/
257
258 /* Queue a skb in order. We come here only if the skb has an L2TP sequence
259  * number.
260  */
261 static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)
262 {
263         struct sk_buff *skbp;
264         struct sk_buff *tmp;
265         u32 ns = L2TP_SKB_CB(skb)->ns;
266
267         spin_lock_bh(&session->reorder_q.lock);
268         skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
269                 if (L2TP_SKB_CB(skbp)->ns > ns) {
270                         __skb_queue_before(&session->reorder_q, skbp, skb);
271                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
272                                "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
273                                session->name, ns, L2TP_SKB_CB(skbp)->ns,
274                                skb_queue_len(&session->reorder_q));
275                         session->stats.rx_oos_packets++;
276                         goto out;
277                 }
278         }
279
280         __skb_queue_tail(&session->reorder_q, skb);
281
282 out:
283         spin_unlock_bh(&session->reorder_q.lock);
284 }
285
286 /* Dequeue a single skb.
287  */
288 static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)
289 {
290         struct l2tp_tunnel *tunnel = session->tunnel;
291         int length = L2TP_SKB_CB(skb)->length;
292
293         /* We're about to requeue the skb, so return resources
294          * to its current owner (a socket receive buffer).
295          */
296         skb_orphan(skb);
297
298         tunnel->stats.rx_packets++;
299         tunnel->stats.rx_bytes += length;
300         session->stats.rx_packets++;
301         session->stats.rx_bytes += length;
302
303         if (L2TP_SKB_CB(skb)->has_seq) {
304                 /* Bump our Nr */
305                 session->nr++;
306                 if (tunnel->version == L2TP_HDR_VER_2)
307                         session->nr &= 0xffff;
308                 else
309                         session->nr &= 0xffffff;
310
311                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
312                        "%s: updated nr to %hu\n", session->name, session->nr);
313         }
314
315         /* call private receive handler */
316         if (session->recv_skb != NULL)
317                 (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);
318         else
319                 kfree_skb(skb);
320
321         if (session->deref)
322                 (*session->deref)(session);
323 }
324
325 /* Dequeue skbs from the session's reorder_q, subject to packet order.
326  * Skbs that have been in the queue for too long are simply discarded.
327  */
328 static void l2tp_recv_dequeue(struct l2tp_session *session)
329 {
330         struct sk_buff *skb;
331         struct sk_buff *tmp;
332
333         /* If the pkt at the head of the queue has the nr that we
334          * expect to send up next, dequeue it and any other
335          * in-sequence packets behind it.
336          */
337         spin_lock_bh(&session->reorder_q.lock);
338         skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
339                 if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) {
340                         session->stats.rx_seq_discards++;
341                         session->stats.rx_errors++;
342                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
343                                "%s: oos pkt %u len %d discarded (too old), "
344                                "waiting for %u, reorder_q_len=%d\n",
345                                session->name, L2TP_SKB_CB(skb)->ns,
346                                L2TP_SKB_CB(skb)->length, session->nr,
347                                skb_queue_len(&session->reorder_q));
348                         __skb_unlink(skb, &session->reorder_q);
349                         kfree_skb(skb);
350                         if (session->deref)
351                                 (*session->deref)(session);
352                         continue;
353                 }
354
355                 if (L2TP_SKB_CB(skb)->has_seq) {
356                         if (L2TP_SKB_CB(skb)->ns != session->nr) {
357                                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
358                                        "%s: holding oos pkt %u len %d, "
359                                        "waiting for %u, reorder_q_len=%d\n",
360                                        session->name, L2TP_SKB_CB(skb)->ns,
361                                        L2TP_SKB_CB(skb)->length, session->nr,
362                                        skb_queue_len(&session->reorder_q));
363                                 goto out;
364                         }
365                 }
366                 __skb_unlink(skb, &session->reorder_q);
367
368                 /* Process the skb. We release the queue lock while we
369                  * do so to let other contexts process the queue.
370                  */
371                 spin_unlock_bh(&session->reorder_q.lock);
372                 l2tp_recv_dequeue_skb(session, skb);
373                 spin_lock_bh(&session->reorder_q.lock);
374         }
375
376 out:
377         spin_unlock_bh(&session->reorder_q.lock);
378 }
379
380 static inline int l2tp_verify_udp_checksum(struct sock *sk,
381                                            struct sk_buff *skb)
382 {
383         struct udphdr *uh = udp_hdr(skb);
384         u16 ulen = ntohs(uh->len);
385         struct inet_sock *inet;
386         __wsum psum;
387
388         if (sk->sk_no_check || skb_csum_unnecessary(skb) || !uh->check)
389                 return 0;
390
391         inet = inet_sk(sk);
392         psum = csum_tcpudp_nofold(inet->inet_saddr, inet->inet_daddr, ulen,
393                                   IPPROTO_UDP, 0);
394
395         if ((skb->ip_summed == CHECKSUM_COMPLETE) &&
396             !csum_fold(csum_add(psum, skb->csum)))
397                 return 0;
398
399         skb->csum = psum;
400
401         return __skb_checksum_complete(skb);
402 }
403
404 /* Do receive processing of L2TP data frames. We handle both L2TPv2
405  * and L2TPv3 data frames here.
406  *
407  * L2TPv2 Data Message Header
408  *
409  *  0                   1                   2                   3
410  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
411  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
412  * |T|L|x|x|S|x|O|P|x|x|x|x|  Ver  |          Length (opt)         |
413  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
414  * |           Tunnel ID           |           Session ID          |
415  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
416  * |             Ns (opt)          |             Nr (opt)          |
417  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
418  * |      Offset Size (opt)        |    Offset pad... (opt)
419  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
420  *
421  * Data frames are marked by T=0. All other fields are the same as
422  * those in L2TP control frames.
423  *
424  * L2TPv3 Data Message Header
425  *
426  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
427  * |                      L2TP Session Header                      |
428  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
429  * |                      L2-Specific Sublayer                     |
430  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
431  * |                        Tunnel Payload                      ...
432  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
433  *
434  * L2TPv3 Session Header Over IP
435  *
436  *  0                   1                   2                   3
437  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
438  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
439  * |                           Session ID                          |
440  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
441  * |               Cookie (optional, maximum 64 bits)...
442  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
443  *                                                                 |
444  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
445  *
446  * L2TPv3 L2-Specific Sublayer Format
447  *
448  *  0                   1                   2                   3
449  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
450  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
451  * |x|S|x|x|x|x|x|x|              Sequence Number                  |
452  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
453  *
454  * Cookie value, sublayer format and offset (pad) are negotiated with
455  * the peer when the session is set up. Unlike L2TPv2, we do not need
456  * to parse the packet header to determine if optional fields are
457  * present.
458  *
459  * Caller must already have parsed the frame and determined that it is
460  * a data (not control) frame before coming here. Fields up to the
461  * session-id have already been parsed and ptr points to the data
462  * after the session-id.
463  */
464 void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
465                       unsigned char *ptr, unsigned char *optr, u16 hdrflags,
466                       int length, int (*payload_hook)(struct sk_buff *skb))
467 {
468         struct l2tp_tunnel *tunnel = session->tunnel;
469         int offset;
470         u32 ns, nr;
471
472         /* The ref count is increased since we now hold a pointer to
473          * the session. Take care to decrement the refcnt when exiting
474          * this function from now on...
475          */
476         l2tp_session_inc_refcount(session);
477         if (session->ref)
478                 (*session->ref)(session);
479
480         /* Parse and check optional cookie */
481         if (session->peer_cookie_len > 0) {
482                 if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
483                         PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
484                                "%s: cookie mismatch (%u/%u). Discarding.\n",
485                                tunnel->name, tunnel->tunnel_id, session->session_id);
486                         session->stats.rx_cookie_discards++;
487                         goto discard;
488                 }
489                 ptr += session->peer_cookie_len;
490         }
491
492         /* Handle the optional sequence numbers. Sequence numbers are
493          * in different places for L2TPv2 and L2TPv3.
494          *
495          * If we are the LAC, enable/disable sequence numbers under
496          * the control of the LNS.  If no sequence numbers present but
497          * we were expecting them, discard frame.
498          */
499         ns = nr = 0;
500         L2TP_SKB_CB(skb)->has_seq = 0;
501         if (tunnel->version == L2TP_HDR_VER_2) {
502                 if (hdrflags & L2TP_HDRFLAG_S) {
503                         ns = ntohs(*(__be16 *) ptr);
504                         ptr += 2;
505                         nr = ntohs(*(__be16 *) ptr);
506                         ptr += 2;
507
508                         /* Store L2TP info in the skb */
509                         L2TP_SKB_CB(skb)->ns = ns;
510                         L2TP_SKB_CB(skb)->has_seq = 1;
511
512                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
513                                "%s: recv data ns=%u, nr=%u, session nr=%u\n",
514                                session->name, ns, nr, session->nr);
515                 }
516         } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
517                 u32 l2h = ntohl(*(__be32 *) ptr);
518
519                 if (l2h & 0x40000000) {
520                         ns = l2h & 0x00ffffff;
521
522                         /* Store L2TP info in the skb */
523                         L2TP_SKB_CB(skb)->ns = ns;
524                         L2TP_SKB_CB(skb)->has_seq = 1;
525
526                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
527                                "%s: recv data ns=%u, session nr=%u\n",
528                                session->name, ns, session->nr);
529                 }
530         }
531
532         /* Advance past L2-specific header, if present */
533         ptr += session->l2specific_len;
534
535         if (L2TP_SKB_CB(skb)->has_seq) {
536                 /* Received a packet with sequence numbers. If we're the LNS,
537                  * check if we sre sending sequence numbers and if not,
538                  * configure it so.
539                  */
540                 if ((!session->lns_mode) && (!session->send_seq)) {
541                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_INFO,
542                                "%s: requested to enable seq numbers by LNS\n",
543                                session->name);
544                         session->send_seq = -1;
545                         l2tp_session_set_header_len(session, tunnel->version);
546                 }
547         } else {
548                 /* No sequence numbers.
549                  * If user has configured mandatory sequence numbers, discard.
550                  */
551                 if (session->recv_seq) {
552                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_WARNING,
553                                "%s: recv data has no seq numbers when required. "
554                                "Discarding\n", session->name);
555                         session->stats.rx_seq_discards++;
556                         goto discard;
557                 }
558
559                 /* If we're the LAC and we're sending sequence numbers, the
560                  * LNS has requested that we no longer send sequence numbers.
561                  * If we're the LNS and we're sending sequence numbers, the
562                  * LAC is broken. Discard the frame.
563                  */
564                 if ((!session->lns_mode) && (session->send_seq)) {
565                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_INFO,
566                                "%s: requested to disable seq numbers by LNS\n",
567                                session->name);
568                         session->send_seq = 0;
569                         l2tp_session_set_header_len(session, tunnel->version);
570                 } else if (session->send_seq) {
571                         PRINTK(session->debug, L2TP_MSG_SEQ, KERN_WARNING,
572                                "%s: recv data has no seq numbers when required. "
573                                "Discarding\n", session->name);
574                         session->stats.rx_seq_discards++;
575                         goto discard;
576                 }
577         }
578
579         /* Session data offset is handled differently for L2TPv2 and
580          * L2TPv3. For L2TPv2, there is an optional 16-bit value in
581          * the header. For L2TPv3, the offset is negotiated using AVPs
582          * in the session setup control protocol.
583          */
584         if (tunnel->version == L2TP_HDR_VER_2) {
585                 /* If offset bit set, skip it. */
586                 if (hdrflags & L2TP_HDRFLAG_O) {
587                         offset = ntohs(*(__be16 *)ptr);
588                         ptr += 2 + offset;
589                 }
590         } else
591                 ptr += session->offset;
592
593         offset = ptr - optr;
594         if (!pskb_may_pull(skb, offset))
595                 goto discard;
596
597         __skb_pull(skb, offset);
598
599         /* If caller wants to process the payload before we queue the
600          * packet, do so now.
601          */
602         if (payload_hook)
603                 if ((*payload_hook)(skb))
604                         goto discard;
605
606         /* Prepare skb for adding to the session's reorder_q.  Hold
607          * packets for max reorder_timeout or 1 second if not
608          * reordering.
609          */
610         L2TP_SKB_CB(skb)->length = length;
611         L2TP_SKB_CB(skb)->expires = jiffies +
612                 (session->reorder_timeout ? session->reorder_timeout : HZ);
613
614         /* Add packet to the session's receive queue. Reordering is done here, if
615          * enabled. Saved L2TP protocol info is stored in skb->sb[].
616          */
617         if (L2TP_SKB_CB(skb)->has_seq) {
618                 if (session->reorder_timeout != 0) {
619                         /* Packet reordering enabled. Add skb to session's
620                          * reorder queue, in order of ns.
621                          */
622                         l2tp_recv_queue_skb(session, skb);
623                 } else {
624                         /* Packet reordering disabled. Discard out-of-sequence
625                          * packets
626                          */
627                         if (L2TP_SKB_CB(skb)->ns != session->nr) {
628                                 session->stats.rx_seq_discards++;
629                                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
630                                        "%s: oos pkt %u len %d discarded, "
631                                        "waiting for %u, reorder_q_len=%d\n",
632                                        session->name, L2TP_SKB_CB(skb)->ns,
633                                        L2TP_SKB_CB(skb)->length, session->nr,
634                                        skb_queue_len(&session->reorder_q));
635                                 goto discard;
636                         }
637                         skb_queue_tail(&session->reorder_q, skb);
638                 }
639         } else {
640                 /* No sequence numbers. Add the skb to the tail of the
641                  * reorder queue. This ensures that it will be
642                  * delivered after all previous sequenced skbs.
643                  */
644                 skb_queue_tail(&session->reorder_q, skb);
645         }
646
647         /* Try to dequeue as many skbs from reorder_q as we can. */
648         l2tp_recv_dequeue(session);
649
650         l2tp_session_dec_refcount(session);
651
652         return;
653
654 discard:
655         session->stats.rx_errors++;
656         kfree_skb(skb);
657
658         if (session->deref)
659                 (*session->deref)(session);
660
661         l2tp_session_dec_refcount(session);
662 }
663 EXPORT_SYMBOL(l2tp_recv_common);
664
665 /* Internal UDP receive frame. Do the real work of receiving an L2TP data frame
666  * here. The skb is not on a list when we get here.
667  * Returns 0 if the packet was a data packet and was successfully passed on.
668  * Returns 1 if the packet was not a good data packet and could not be
669  * forwarded.  All such packets are passed up to userspace to deal with.
670  */
671 int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
672                        int (*payload_hook)(struct sk_buff *skb))
673 {
674         struct l2tp_session *session = NULL;
675         unsigned char *ptr, *optr;
676         u16 hdrflags;
677         u32 tunnel_id, session_id;
678         int offset;
679         u16 version;
680         int length;
681
682         if (tunnel->sock && l2tp_verify_udp_checksum(tunnel->sock, skb))
683                 goto discard_bad_csum;
684
685         /* UDP always verifies the packet length. */
686         __skb_pull(skb, sizeof(struct udphdr));
687
688         /* Short packet? */
689         if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) {
690                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
691                        "%s: recv short packet (len=%d)\n", tunnel->name, skb->len);
692                 goto error;
693         }
694
695         /* Point to L2TP header */
696         optr = ptr = skb->data;
697
698         /* Trace packet contents, if enabled */
699         if (tunnel->debug & L2TP_MSG_DATA) {
700                 length = min(32u, skb->len);
701                 if (!pskb_may_pull(skb, length))
702                         goto error;
703
704                 printk(KERN_DEBUG "%s: recv: ", tunnel->name);
705
706                 offset = 0;
707                 do {
708                         printk(" %02X", ptr[offset]);
709                 } while (++offset < length);
710
711                 printk("\n");
712         }
713
714         /* Get L2TP header flags */
715         hdrflags = ntohs(*(__be16 *) ptr);
716
717         /* Check protocol version */
718         version = hdrflags & L2TP_HDR_VER_MASK;
719         if (version != tunnel->version) {
720                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
721                        "%s: recv protocol version mismatch: got %d expected %d\n",
722                        tunnel->name, version, tunnel->version);
723                 goto error;
724         }
725
726         /* Get length of L2TP packet */
727         length = skb->len;
728
729         /* If type is control packet, it is handled by userspace. */
730         if (hdrflags & L2TP_HDRFLAG_T) {
731                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_DEBUG,
732                        "%s: recv control packet, len=%d\n", tunnel->name, length);
733                 goto error;
734         }
735
736         /* Skip flags */
737         ptr += 2;
738
739         if (tunnel->version == L2TP_HDR_VER_2) {
740                 /* If length is present, skip it */
741                 if (hdrflags & L2TP_HDRFLAG_L)
742                         ptr += 2;
743
744                 /* Extract tunnel and session ID */
745                 tunnel_id = ntohs(*(__be16 *) ptr);
746                 ptr += 2;
747                 session_id = ntohs(*(__be16 *) ptr);
748                 ptr += 2;
749         } else {
750                 ptr += 2;       /* skip reserved bits */
751                 tunnel_id = tunnel->tunnel_id;
752                 session_id = ntohl(*(__be32 *) ptr);
753                 ptr += 4;
754         }
755
756         /* Find the session context */
757         session = l2tp_session_find(tunnel->l2tp_net, tunnel, session_id);
758         if (!session) {
759                 /* Not found? Pass to userspace to deal with */
760                 PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO,
761                        "%s: no session found (%u/%u). Passing up.\n",
762                        tunnel->name, tunnel_id, session_id);
763                 goto error;
764         }
765
766         l2tp_recv_common(session, skb, ptr, optr, hdrflags, length, payload_hook);
767
768         return 0;
769
770 discard_bad_csum:
771         LIMIT_NETDEBUG("%s: UDP: bad checksum\n", tunnel->name);
772         UDP_INC_STATS_USER(tunnel->l2tp_net, UDP_MIB_INERRORS, 0);
773         tunnel->stats.rx_errors++;
774         kfree_skb(skb);
775
776         return 0;
777
778 error:
779         /* Put UDP header back */
780         __skb_push(skb, sizeof(struct udphdr));
781
782         return 1;
783 }
784 EXPORT_SYMBOL_GPL(l2tp_udp_recv_core);
785
786 /* UDP encapsulation receive handler. See net/ipv4/udp.c.
787  * Return codes:
788  * 0 : success.
789  * <0: error
790  * >0: skb should be passed up to userspace as UDP.
791  */
792 int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
793 {
794         struct l2tp_tunnel *tunnel;
795
796         tunnel = l2tp_sock_to_tunnel(sk);
797         if (tunnel == NULL)
798                 goto pass_up;
799
800         PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_DEBUG,
801                "%s: received %d bytes\n", tunnel->name, skb->len);
802
803         if (l2tp_udp_recv_core(tunnel, skb, tunnel->recv_payload_hook))
804                 goto pass_up_put;
805
806         sock_put(sk);
807         return 0;
808
809 pass_up_put:
810         sock_put(sk);
811 pass_up:
812         return 1;
813 }
814 EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv);
815
816 /************************************************************************
817  * Transmit handling
818  ***********************************************************************/
819
820 /* Build an L2TP header for the session into the buffer provided.
821  */
822 static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
823 {
824         struct l2tp_tunnel *tunnel = session->tunnel;
825         __be16 *bufp = buf;
826         __be16 *optr = buf;
827         u16 flags = L2TP_HDR_VER_2;
828         u32 tunnel_id = tunnel->peer_tunnel_id;
829         u32 session_id = session->peer_session_id;
830
831         if (session->send_seq)
832                 flags |= L2TP_HDRFLAG_S;
833
834         /* Setup L2TP header. */
835         *bufp++ = htons(flags);
836         *bufp++ = htons(tunnel_id);
837         *bufp++ = htons(session_id);
838         if (session->send_seq) {
839                 *bufp++ = htons(session->ns);
840                 *bufp++ = 0;
841                 session->ns++;
842                 session->ns &= 0xffff;
843                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
844                        "%s: updated ns to %u\n", session->name, session->ns);
845         }
846
847         return bufp - optr;
848 }
849
850 static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
851 {
852         char *bufp = buf;
853         char *optr = bufp;
854         u16 flags = L2TP_HDR_VER_3;
855
856         /* Setup L2TP header. */
857         *((__be16 *) bufp) = htons(flags);
858         bufp += 2;
859         *((__be16 *) bufp) = 0;
860         bufp += 2;
861         *((__be32 *) bufp) = htonl(session->peer_session_id);
862         bufp += 4;
863         if (session->cookie_len) {
864                 memcpy(bufp, &session->cookie[0], session->cookie_len);
865                 bufp += session->cookie_len;
866         }
867         if (session->l2specific_len) {
868                 if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
869                         u32 l2h = 0;
870                         if (session->send_seq) {
871                                 l2h = 0x40000000 | session->ns;
872                                 session->ns++;
873                                 session->ns &= 0xffffff;
874                                 PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG,
875                                        "%s: updated ns to %u\n", session->name, session->ns);
876                         }
877
878                         *((__be32 *) bufp) = htonl(l2h);
879                 }
880                 bufp += session->l2specific_len;
881         }
882         if (session->offset)
883                 bufp += session->offset;
884
885         return bufp - optr;
886 }
887
888 int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, size_t data_len)
889 {
890         struct l2tp_tunnel *tunnel = session->tunnel;
891         unsigned int len = skb->len;
892         int error;
893
894         /* Debug */
895         if (session->send_seq)
896                 PRINTK(session->debug, L2TP_MSG_DATA, KERN_DEBUG,
897                        "%s: send %Zd bytes, ns=%u\n", session->name,
898                        data_len, session->ns - 1);
899         else
900                 PRINTK(session->debug, L2TP_MSG_DATA, KERN_DEBUG,
901                        "%s: send %Zd bytes\n", session->name, data_len);
902
903         if (session->debug & L2TP_MSG_DATA) {
904                 int i;
905                 unsigned char *datap = skb->data + sizeof(struct udphdr);
906
907                 printk(KERN_DEBUG "%s: xmit:", session->name);
908                 for (i = 0; i < (len - sizeof(struct udphdr)); i++) {
909                         printk(" %02X", *datap++);
910                         if (i == 31) {
911                                 printk(" ...");
912                                 break;
913                         }
914                 }
915                 printk("\n");
916         }
917
918         /* Queue the packet to IP for output */
919         error = ip_queue_xmit(skb, 1);
920
921         /* Update stats */
922         if (error >= 0) {
923                 tunnel->stats.tx_packets++;
924                 tunnel->stats.tx_bytes += len;
925                 session->stats.tx_packets++;
926                 session->stats.tx_bytes += len;
927         } else {
928                 tunnel->stats.tx_errors++;
929                 session->stats.tx_errors++;
930         }
931
932         return 0;
933 }
934 EXPORT_SYMBOL_GPL(l2tp_xmit_core);
935
936 /* Automatically called when the skb is freed.
937  */
938 static void l2tp_sock_wfree(struct sk_buff *skb)
939 {
940         sock_put(skb->sk);
941 }
942
943 /* For data skbs that we transmit, we associate with the tunnel socket
944  * but don't do accounting.
945  */
946 static inline void l2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
947 {
948         sock_hold(sk);
949         skb->sk = sk;
950         skb->destructor = l2tp_sock_wfree;
951 }
952
953 /* If caller requires the skb to have a ppp header, the header must be
954  * inserted in the skb data before calling this function.
955  */
956 int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len)
957 {
958         int data_len = skb->len;
959         struct sock *sk = session->tunnel->sock;
960         struct udphdr *uh;
961         unsigned int udp_len;
962         struct inet_sock *inet;
963         __wsum csum;
964         int old_headroom;
965         int new_headroom;
966         int headroom;
967
968         /* Check that there's enough headroom in the skb to insert IP,
969          * UDP and L2TP headers. If not enough, expand it to
970          * make room. Adjust truesize.
971          */
972         headroom = NET_SKB_PAD + sizeof(struct iphdr) +
973                 sizeof(struct udphdr) + hdr_len;
974         old_headroom = skb_headroom(skb);
975         if (skb_cow_head(skb, headroom))
976                 goto abort;
977
978         new_headroom = skb_headroom(skb);
979         skb_orphan(skb);
980         skb->truesize += new_headroom - old_headroom;
981
982         /* Setup L2TP header */
983         session->build_header(session, __skb_push(skb, hdr_len));
984         udp_len = sizeof(struct udphdr) + hdr_len + data_len;
985
986         /* Setup UDP header */
987         inet = inet_sk(sk);
988         __skb_push(skb, sizeof(*uh));
989         skb_reset_transport_header(skb);
990         uh = udp_hdr(skb);
991         uh->source = inet->inet_sport;
992         uh->dest = inet->inet_dport;
993         uh->len = htons(udp_len);
994         uh->check = 0;
995
996         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
997         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
998                               IPSKB_REROUTED);
999         nf_reset(skb);
1000
1001         /* Get routing info from the tunnel socket */
1002         skb_dst_drop(skb);
1003         skb_dst_set(skb, dst_clone(__sk_dst_get(sk)));
1004         l2tp_skb_set_owner_w(skb, sk);
1005
1006         /* Calculate UDP checksum if configured to do so */
1007         if (sk->sk_no_check == UDP_CSUM_NOXMIT)
1008                 skb->ip_summed = CHECKSUM_NONE;
1009         else if ((skb_dst(skb) && skb_dst(skb)->dev) &&
1010                  (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM))) {
1011                 skb->ip_summed = CHECKSUM_COMPLETE;
1012                 csum = skb_checksum(skb, 0, udp_len, 0);
1013                 uh->check = csum_tcpudp_magic(inet->inet_saddr,
1014                                               inet->inet_daddr,
1015                                               udp_len, IPPROTO_UDP, csum);
1016                 if (uh->check == 0)
1017                         uh->check = CSUM_MANGLED_0;
1018         } else {
1019                 skb->ip_summed = CHECKSUM_PARTIAL;
1020                 skb->csum_start = skb_transport_header(skb) - skb->head;
1021                 skb->csum_offset = offsetof(struct udphdr, check);
1022                 uh->check = ~csum_tcpudp_magic(inet->inet_saddr,
1023                                                inet->inet_daddr,
1024                                                udp_len, IPPROTO_UDP, 0);
1025         }
1026
1027         l2tp_xmit_core(session, skb, data_len);
1028
1029 abort:
1030         return 0;
1031 }
1032 EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
1033
1034 /*****************************************************************************
1035  * Tinnel and session create/destroy.
1036  *****************************************************************************/
1037
1038 /* Tunnel socket destruct hook.
1039  * The tunnel context is deleted only when all session sockets have been
1040  * closed.
1041  */
1042 void l2tp_tunnel_destruct(struct sock *sk)
1043 {
1044         struct l2tp_tunnel *tunnel;
1045
1046         tunnel = sk->sk_user_data;
1047         if (tunnel == NULL)
1048                 goto end;
1049
1050         PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
1051                "%s: closing...\n", tunnel->name);
1052
1053         /* Close all sessions */
1054         l2tp_tunnel_closeall(tunnel);
1055
1056         /* No longer an encapsulation socket. See net/ipv4/udp.c */
1057         (udp_sk(sk))->encap_type = 0;
1058         (udp_sk(sk))->encap_rcv = NULL;
1059
1060         /* Remove hooks into tunnel socket */
1061         tunnel->sock = NULL;
1062         sk->sk_destruct = tunnel->old_sk_destruct;
1063         sk->sk_user_data = NULL;
1064
1065         /* Call the original destructor */
1066         if (sk->sk_destruct)
1067                 (*sk->sk_destruct)(sk);
1068
1069         /* We're finished with the socket */
1070         l2tp_tunnel_dec_refcount(tunnel);
1071
1072 end:
1073         return;
1074 }
1075 EXPORT_SYMBOL(l2tp_tunnel_destruct);
1076
1077 /* When the tunnel is closed, all the attached sessions need to go too.
1078  */
1079 void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
1080 {
1081         int hash;
1082         struct hlist_node *walk;
1083         struct hlist_node *tmp;
1084         struct l2tp_session *session;
1085
1086         BUG_ON(tunnel == NULL);
1087
1088         PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
1089                "%s: closing all sessions...\n", tunnel->name);
1090
1091         write_lock_bh(&tunnel->hlist_lock);
1092         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
1093 again:
1094                 hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
1095                         session = hlist_entry(walk, struct l2tp_session, hlist);
1096
1097                         PRINTK(session->debug, L2TP_MSG_CONTROL, KERN_INFO,
1098                                "%s: closing session\n", session->name);
1099
1100                         hlist_del_init(&session->hlist);
1101
1102                         /* Since we should hold the sock lock while
1103                          * doing any unbinding, we need to release the
1104                          * lock we're holding before taking that lock.
1105                          * Hold a reference to the sock so it doesn't
1106                          * disappear as we're jumping between locks.
1107                          */
1108                         if (session->ref != NULL)
1109                                 (*session->ref)(session);
1110
1111                         write_unlock_bh(&tunnel->hlist_lock);
1112
1113                         if (tunnel->version != L2TP_HDR_VER_2) {
1114                                 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1115
1116                                 write_lock_bh(&pn->l2tp_session_hlist_lock);
1117                                 hlist_del_init(&session->global_hlist);
1118                                 write_unlock_bh(&pn->l2tp_session_hlist_lock);
1119                         }
1120
1121                         if (session->session_close != NULL)
1122                                 (*session->session_close)(session);
1123
1124                         if (session->deref != NULL)
1125                                 (*session->deref)(session);
1126
1127                         write_lock_bh(&tunnel->hlist_lock);
1128
1129                         /* Now restart from the beginning of this hash
1130                          * chain.  We always remove a session from the
1131                          * list so we are guaranteed to make forward
1132                          * progress.
1133                          */
1134                         goto again;
1135                 }
1136         }
1137         write_unlock_bh(&tunnel->hlist_lock);
1138 }
1139 EXPORT_SYMBOL_GPL(l2tp_tunnel_closeall);
1140
1141 /* Really kill the tunnel.
1142  * Come here only when all sessions have been cleared from the tunnel.
1143  */
1144 void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
1145 {
1146         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1147
1148         BUG_ON(atomic_read(&tunnel->ref_count) != 0);
1149         BUG_ON(tunnel->sock != NULL);
1150
1151         PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO,
1152                "%s: free...\n", tunnel->name);
1153
1154         /* Remove from tunnel list */
1155         write_lock_bh(&pn->l2tp_tunnel_list_lock);
1156         list_del_init(&tunnel->list);
1157         write_unlock_bh(&pn->l2tp_tunnel_list_lock);
1158
1159         atomic_dec(&l2tp_tunnel_count);
1160         kfree(tunnel);
1161 }
1162 EXPORT_SYMBOL_GPL(l2tp_tunnel_free);
1163
1164 int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp)
1165 {
1166         struct l2tp_tunnel *tunnel = NULL;
1167         int err;
1168         struct socket *sock = NULL;
1169         struct sock *sk = NULL;
1170         struct l2tp_net *pn;
1171
1172         /* Get the tunnel socket from the fd, which was opened by
1173          * the userspace L2TP daemon.
1174          */
1175         err = -EBADF;
1176         sock = sockfd_lookup(fd, &err);
1177         if (!sock) {
1178                 printk(KERN_ERR "tunl %hu: sockfd_lookup(fd=%d) returned %d\n",
1179                        tunnel_id, fd, err);
1180                 goto err;
1181         }
1182
1183         sk = sock->sk;
1184
1185         /* Quick sanity checks */
1186         err = -EPROTONOSUPPORT;
1187         if (sk->sk_protocol != IPPROTO_UDP) {
1188                 printk(KERN_ERR "tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
1189                        tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
1190                 goto err;
1191         }
1192         err = -EAFNOSUPPORT;
1193         if (sock->ops->family != AF_INET) {
1194                 printk(KERN_ERR "tunl %hu: fd %d wrong family, got %d, expected %d\n",
1195                        tunnel_id, fd, sock->ops->family, AF_INET);
1196                 goto err;
1197         }
1198
1199         /* Check if this socket has already been prepped */
1200         tunnel = (struct l2tp_tunnel *)sk->sk_user_data;
1201         if (tunnel != NULL) {
1202                 /* This socket has already been prepped */
1203                 err = -EBUSY;
1204                 goto err;
1205         }
1206
1207         tunnel = kzalloc(sizeof(struct l2tp_tunnel), GFP_KERNEL);
1208         if (tunnel == NULL) {
1209                 err = -ENOMEM;
1210                 goto err;
1211         }
1212
1213         tunnel->version = version;
1214         tunnel->tunnel_id = tunnel_id;
1215         tunnel->peer_tunnel_id = peer_tunnel_id;
1216         tunnel->debug = L2TP_DEFAULT_DEBUG_FLAGS;
1217
1218         tunnel->magic = L2TP_TUNNEL_MAGIC;
1219         sprintf(&tunnel->name[0], "tunl %u", tunnel_id);
1220         rwlock_init(&tunnel->hlist_lock);
1221
1222         /* The net we belong to */
1223         tunnel->l2tp_net = net;
1224         pn = l2tp_pernet(net);
1225
1226         if (cfg)
1227                 tunnel->debug = cfg->debug;
1228
1229         /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
1230         udp_sk(sk)->encap_type = UDP_ENCAP_L2TPINUDP;
1231         udp_sk(sk)->encap_rcv = l2tp_udp_encap_recv;
1232
1233         sk->sk_user_data = tunnel;
1234
1235         /* Hook on the tunnel socket destructor so that we can cleanup
1236          * if the tunnel socket goes away.
1237          */
1238         tunnel->old_sk_destruct = sk->sk_destruct;
1239         sk->sk_destruct = &l2tp_tunnel_destruct;
1240         tunnel->sock = sk;
1241         sk->sk_allocation = GFP_ATOMIC;
1242
1243         /* Add tunnel to our list */
1244         INIT_LIST_HEAD(&tunnel->list);
1245         write_lock_bh(&pn->l2tp_tunnel_list_lock);
1246         list_add(&tunnel->list, &pn->l2tp_tunnel_list);
1247         write_unlock_bh(&pn->l2tp_tunnel_list_lock);
1248         atomic_inc(&l2tp_tunnel_count);
1249
1250         /* Bump the reference count. The tunnel context is deleted
1251          * only when this drops to zero.
1252          */
1253         l2tp_tunnel_inc_refcount(tunnel);
1254
1255         err = 0;
1256 err:
1257         if (tunnelp)
1258                 *tunnelp = tunnel;
1259
1260         if (sock)
1261                 sockfd_put(sock);
1262
1263         return err;
1264 }
1265 EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
1266
1267 /* Really kill the session.
1268  */
1269 void l2tp_session_free(struct l2tp_session *session)
1270 {
1271         struct l2tp_tunnel *tunnel;
1272
1273         BUG_ON(atomic_read(&session->ref_count) != 0);
1274
1275         tunnel = session->tunnel;
1276         if (tunnel != NULL) {
1277                 BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
1278
1279                 /* Delete the session from the hash */
1280                 write_lock_bh(&tunnel->hlist_lock);
1281                 hlist_del_init(&session->hlist);
1282                 write_unlock_bh(&tunnel->hlist_lock);
1283
1284                 /* Unlink from the global hash if not L2TPv2 */
1285                 if (tunnel->version != L2TP_HDR_VER_2) {
1286                         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1287
1288                         write_lock_bh(&pn->l2tp_session_hlist_lock);
1289                         hlist_del_init(&session->global_hlist);
1290                         write_unlock_bh(&pn->l2tp_session_hlist_lock);
1291                 }
1292
1293                 if (session->session_id != 0)
1294                         atomic_dec(&l2tp_session_count);
1295
1296                 sock_put(tunnel->sock);
1297
1298                 /* This will delete the tunnel context if this
1299                  * is the last session on the tunnel.
1300                  */
1301                 session->tunnel = NULL;
1302                 l2tp_tunnel_dec_refcount(tunnel);
1303         }
1304
1305         kfree(session);
1306
1307         return;
1308 }
1309 EXPORT_SYMBOL_GPL(l2tp_session_free);
1310
1311 /* We come here whenever a session's send_seq, cookie_len or
1312  * l2specific_len parameters are set.
1313  */
1314 void l2tp_session_set_header_len(struct l2tp_session *session, int version)
1315 {
1316         if (version == L2TP_HDR_VER_2) {
1317                 session->hdr_len = 6;
1318                 if (session->send_seq)
1319                         session->hdr_len += 4;
1320         } else {
1321                 session->hdr_len = 8 + session->cookie_len + session->l2specific_len + session->offset;
1322         }
1323
1324 }
1325 EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
1326
1327 struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
1328 {
1329         struct l2tp_session *session;
1330
1331         session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL);
1332         if (session != NULL) {
1333                 session->magic = L2TP_SESSION_MAGIC;
1334                 session->tunnel = tunnel;
1335
1336                 session->session_id = session_id;
1337                 session->peer_session_id = peer_session_id;
1338                 session->nr = 1;
1339
1340                 sprintf(&session->name[0], "sess %u/%u",
1341                         tunnel->tunnel_id, session->session_id);
1342
1343                 skb_queue_head_init(&session->reorder_q);
1344
1345                 INIT_HLIST_NODE(&session->hlist);
1346                 INIT_HLIST_NODE(&session->global_hlist);
1347
1348                 /* Inherit debug options from tunnel */
1349                 session->debug = tunnel->debug;
1350
1351                 if (cfg) {
1352                         session->pwtype = cfg->pw_type;
1353                         session->debug = cfg->debug;
1354                         session->mtu = cfg->mtu;
1355                         session->mru = cfg->mru;
1356                         session->send_seq = cfg->send_seq;
1357                         session->recv_seq = cfg->recv_seq;
1358                         session->lns_mode = cfg->lns_mode;
1359                         session->reorder_timeout = cfg->reorder_timeout;
1360                         session->offset = cfg->offset;
1361                         session->l2specific_type = cfg->l2specific_type;
1362                         session->l2specific_len = cfg->l2specific_len;
1363                         session->cookie_len = cfg->cookie_len;
1364                         memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);
1365                         session->peer_cookie_len = cfg->peer_cookie_len;
1366                         memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);
1367                 }
1368
1369                 if (tunnel->version == L2TP_HDR_VER_2)
1370                         session->build_header = l2tp_build_l2tpv2_header;
1371                 else
1372                         session->build_header = l2tp_build_l2tpv3_header;
1373
1374                 l2tp_session_set_header_len(session, tunnel->version);
1375
1376                 /* Bump the reference count. The session context is deleted
1377                  * only when this drops to zero.
1378                  */
1379                 l2tp_session_inc_refcount(session);
1380                 l2tp_tunnel_inc_refcount(tunnel);
1381
1382                 /* Ensure tunnel socket isn't deleted */
1383                 sock_hold(tunnel->sock);
1384
1385                 /* Add session to the tunnel's hash list */
1386                 write_lock_bh(&tunnel->hlist_lock);
1387                 hlist_add_head(&session->hlist,
1388                                l2tp_session_id_hash(tunnel, session_id));
1389                 write_unlock_bh(&tunnel->hlist_lock);
1390
1391                 /* And to the global session list if L2TPv3 */
1392                 if (tunnel->version != L2TP_HDR_VER_2) {
1393                         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1394
1395                         write_lock_bh(&pn->l2tp_session_hlist_lock);
1396                         hlist_add_head(&session->global_hlist,
1397                                        l2tp_session_id_hash_2(pn, session_id));
1398                         write_unlock_bh(&pn->l2tp_session_hlist_lock);
1399                 }
1400
1401                 /* Ignore management session in session count value */
1402                 if (session->session_id != 0)
1403                         atomic_inc(&l2tp_session_count);
1404         }
1405
1406         return session;
1407 }
1408 EXPORT_SYMBOL_GPL(l2tp_session_create);
1409
1410 /*****************************************************************************
1411  * Init and cleanup
1412  *****************************************************************************/
1413
1414 static __net_init int l2tp_init_net(struct net *net)
1415 {
1416         struct l2tp_net *pn;
1417         int err;
1418         int hash;
1419
1420         pn = kzalloc(sizeof(*pn), GFP_KERNEL);
1421         if (!pn)
1422                 return -ENOMEM;
1423
1424         INIT_LIST_HEAD(&pn->l2tp_tunnel_list);
1425         rwlock_init(&pn->l2tp_tunnel_list_lock);
1426
1427         for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
1428                 INIT_HLIST_HEAD(&pn->l2tp_session_hlist[hash]);
1429
1430         rwlock_init(&pn->l2tp_session_hlist_lock);
1431
1432         err = net_assign_generic(net, l2tp_net_id, pn);
1433         if (err)
1434                 goto out;
1435
1436         return 0;
1437
1438 out:
1439         kfree(pn);
1440         return err;
1441 }
1442
1443 static __net_exit void l2tp_exit_net(struct net *net)
1444 {
1445         struct l2tp_net *pn;
1446
1447         pn = net_generic(net, l2tp_net_id);
1448         /*
1449          * if someone has cached our net then
1450          * further net_generic call will return NULL
1451          */
1452         net_assign_generic(net, l2tp_net_id, NULL);
1453         kfree(pn);
1454 }
1455
1456 static struct pernet_operations l2tp_net_ops = {
1457         .init = l2tp_init_net,
1458         .exit = l2tp_exit_net,
1459         .id   = &l2tp_net_id,
1460         .size = sizeof(struct l2tp_net),
1461 };
1462
1463 static int __init l2tp_init(void)
1464 {
1465         int rc = 0;
1466
1467         rc = register_pernet_device(&l2tp_net_ops);
1468         if (rc)
1469                 goto out;
1470
1471         printk(KERN_INFO "L2TP core driver, %s\n", L2TP_DRV_VERSION);
1472
1473 out:
1474         return rc;
1475 }
1476
1477 static void __exit l2tp_exit(void)
1478 {
1479         unregister_pernet_device(&l2tp_net_ops);
1480 }
1481
1482 module_init(l2tp_init);
1483 module_exit(l2tp_exit);
1484
1485 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1486 MODULE_DESCRIPTION("L2TP core");
1487 MODULE_LICENSE("GPL");
1488 MODULE_VERSION(L2TP_DRV_VERSION);
1489