net/l2tp/l2tp_core.c

   1 /*
   2  * L2TP core.
   3  *
   4  * Copyright (c) 2008,2009,2010 Katalix Systems Ltd
   5  *
   6  * This file contains some code of the original L2TPv2 pppol2tp
   7  * driver, which has the following copyright:
   8  *
   9  * Authors:     Martijn van Oosterhout <kleptog@svana.org>
  10  *              James Chapman (jchapman@katalix.com)
  11  * Contributors:
  12  *              Michal Ostrowski <mostrows@speakeasy.net>
  13  *              Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
  14  *              David S. Miller (davem@redhat.com)
  15  *
  16  * This program is free software; you can redistribute it and/or modify
  17  * it under the terms of the GNU General Public License version 2 as
  18  * published by the Free Software Foundation.
  19  */
  20
  21 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  22
  23 #include <linux/module.h>
  24 #include <linux/string.h>
  25 #include <linux/list.h>
  26 #include <linux/rculist.h>
  27 #include <linux/uaccess.h>
  28
  29 #include <linux/kernel.h>
  30 #include <linux/spinlock.h>
  31 #include <linux/kthread.h>
  32 #include <linux/sched.h>
  33 #include <linux/slab.h>
  34 #include <linux/errno.h>
  35 #include <linux/jiffies.h>
  36
  37 #include <linux/netdevice.h>
  38 #include <linux/net.h>
  39 #include <linux/inetdevice.h>
  40 #include <linux/skbuff.h>
  41 #include <linux/init.h>
  42 #include <linux/in.h>
  43 #include <linux/ip.h>
  44 #include <linux/udp.h>
  45 #include <linux/l2tp.h>
  46 #include <linux/hash.h>
  47 #include <linux/sort.h>
  48 #include <linux/file.h>
  49 #include <linux/nsproxy.h>
  50 #include <net/net_namespace.h>
  51 #include <net/netns/generic.h>
  52 #include <net/dst.h>
  53 #include <net/ip.h>
  54 #include <net/udp.h>
  55 #include <net/udp_tunnel.h>
  56 #include <net/inet_common.h>
  57 #include <net/xfrm.h>
  58 #include <net/protocol.h>
  59 #include <net/inet6_connection_sock.h>
  60 #include <net/inet_ecn.h>
  61 #include <net/ip6_route.h>
  62 #include <net/ip6_checksum.h>
  63
  64 #include <asm/byteorder.h>
  65 #include <linux/atomic.h>
  66
  67 #include "l2tp_core.h"
  68
  69 #define L2TP_DRV_VERSION        "V2.0"
  70
  71 /* L2TP header constants */
  72 #define L2TP_HDRFLAG_T     0x8000
  73 #define L2TP_HDRFLAG_L     0x4000
  74 #define L2TP_HDRFLAG_S     0x0800
  75 #define L2TP_HDRFLAG_O     0x0200
  76 #define L2TP_HDRFLAG_P     0x0100
  77
  78 #define L2TP_HDR_VER_MASK  0x000F
  79 #define L2TP_HDR_VER_2     0x0002
  80 #define L2TP_HDR_VER_3     0x0003
  81
  82 /* L2TPv3 default L2-specific sublayer */
  83 #define L2TP_SLFLAG_S      0x40000000
  84 #define L2TP_SL_SEQ_MASK   0x00ffffff
  85
  86 #define L2TP_HDR_SIZE_MAX               14
  87
  88 /* Default trace flags */
  89 #define L2TP_DEFAULT_DEBUG_FLAGS        0
  90
  91 /* Private data stored for received packets in the skb.
  92  */
  93 struct l2tp_skb_cb {
  94         u32                     ns;
  95         u16                     has_seq;
  96         u16                     length;
  97         unsigned long           expires;
  98 };
  99
 100 #define L2TP_SKB_CB(skb)        ((struct l2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])
 101
 102 static atomic_t l2tp_tunnel_count;
 103 static atomic_t l2tp_session_count;
 104 static struct workqueue_struct *l2tp_wq;
 105
 106 /* per-net private data for this module */
 107 static unsigned int l2tp_net_id;
 108 struct l2tp_net {
 109         struct list_head l2tp_tunnel_list;
 110         spinlock_t l2tp_tunnel_list_lock;
 111         struct hlist_head l2tp_session_hlist[L2TP_HASH_SIZE_2];
 112         spinlock_t l2tp_session_hlist_lock;
 113 };
 114
 115 #if IS_ENABLED(CONFIG_IPV6)
 116 static bool l2tp_sk_is_v6(struct sock *sk)
 117 {
 118         return sk->sk_family == PF_INET6 &&
 119                !ipv6_addr_v4mapped(&sk->sk_v6_daddr);
 120 }
 121 #endif
 122
 123 static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk)
 124 {
 125         return sk->sk_user_data;
 126 }
 127
 128 static inline struct l2tp_net *l2tp_pernet(const struct net *net)
 129 {
 130         BUG_ON(!net);
 131
 132         return net_generic(net, l2tp_net_id);
 133 }
 134
 135 /* Session hash global list for L2TPv3.
 136  * The session_id SHOULD be random according to RFC3931, but several
 137  * L2TP implementations use incrementing session_ids.  So we do a real
 138  * hash on the session_id, rather than a simple bitmask.
 139  */
 140 static inline struct hlist_head *
 141 l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
 142 {
 143         return &pn->l2tp_session_hlist[hash_32(session_id, L2TP_HASH_BITS_2)];
 144
 145 }
 146
 147 /* Lookup the tunnel socket, possibly involving the fs code if the socket is
 148  * owned by userspace.  A struct sock returned from this function must be
 149  * released using l2tp_tunnel_sock_put once you're done with it.
 150  */
 151 static struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel)
 152 {
 153         int err = 0;
 154         struct socket *sock = NULL;
 155         struct sock *sk = NULL;
 156
 157         if (!tunnel)
 158                 goto out;
 159
 160         if (tunnel->fd >= 0) {
 161                 /* Socket is owned by userspace, who might be in the process
 162                  * of closing it.  Look the socket up using the fd to ensure
 163                  * consistency.
 164                  */
 165                 sock = sockfd_lookup(tunnel->fd, &err);
 166                 if (sock)
 167                         sk = sock->sk;
 168         } else {
 169                 /* Socket is owned by kernelspace */
 170                 sk = tunnel->sock;
 171                 sock_hold(sk);
 172         }
 173
 174 out:
 175         return sk;
 176 }
 177
 178 /* Drop a reference to a tunnel socket obtained via. l2tp_tunnel_sock_put */
 179 static void l2tp_tunnel_sock_put(struct sock *sk)
 180 {
 181         struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
 182         if (tunnel) {
 183                 if (tunnel->fd >= 0) {
 184                         /* Socket is owned by userspace */
 185                         sockfd_put(sk->sk_socket);
 186                 }
 187                 sock_put(sk);
 188         }
 189         sock_put(sk);
 190 }
 191
 192 /* Session hash list.
 193  * The session_id SHOULD be random according to RFC2661, but several
 194  * L2TP implementations (Cisco and Microsoft) use incrementing
 195  * session_ids.  So we do a real hash on the session_id, rather than a
 196  * simple bitmask.
 197  */
 198 static inline struct hlist_head *
 199 l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id)
 200 {
 201         return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)];
 202 }
 203
 204 /* Lookup a tunnel. A new reference is held on the returned tunnel. */
 205 struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id)
 206 {
 207         const struct l2tp_net *pn = l2tp_pernet(net);
 208         struct l2tp_tunnel *tunnel;
 209
 210         rcu_read_lock_bh();
 211         list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
 212                 if (tunnel->tunnel_id == tunnel_id) {
 213                         l2tp_tunnel_inc_refcount(tunnel);
 214                         rcu_read_unlock_bh();
 215
 216                         return tunnel;
 217                 }
 218         }
 219         rcu_read_unlock_bh();
 220
 221         return NULL;
 222 }
 223 EXPORT_SYMBOL_GPL(l2tp_tunnel_get);
 224
 225 /* Lookup a session. A new reference is held on the returned session.
 226  * Optionally calls session->ref() too if do_ref is true.
 227  */
 228 struct l2tp_session *l2tp_session_get(const struct net *net,
 229                                       struct l2tp_tunnel *tunnel,
 230                                       u32 session_id, bool do_ref)
 231 {
 232         struct hlist_head *session_list;
 233         struct l2tp_session *session;
 234
 235         if (!tunnel) {
 236                 struct l2tp_net *pn = l2tp_pernet(net);
 237
 238                 session_list = l2tp_session_id_hash_2(pn, session_id);
 239
 240                 rcu_read_lock_bh();
 241                 hlist_for_each_entry_rcu(session, session_list, global_hlist) {
 242                         if (session->session_id == session_id) {
 243                                 l2tp_session_inc_refcount(session);
 244                                 if (do_ref && session->ref)
 245                                         session->ref(session);
 246                                 rcu_read_unlock_bh();
 247
 248                                 return session;
 249                         }
 250                 }
 251                 rcu_read_unlock_bh();
 252
 253                 return NULL;
 254         }
 255
 256         session_list = l2tp_session_id_hash(tunnel, session_id);
 257         read_lock_bh(&tunnel->hlist_lock);
 258         hlist_for_each_entry(session, session_list, hlist) {
 259                 if (session->session_id == session_id) {
 260                         l2tp_session_inc_refcount(session);
 261                         if (do_ref && session->ref)
 262                                 session->ref(session);
 263                         read_unlock_bh(&tunnel->hlist_lock);
 264
 265                         return session;
 266                 }
 267         }
 268         read_unlock_bh(&tunnel->hlist_lock);
 269
 270         return NULL;
 271 }
 272 EXPORT_SYMBOL_GPL(l2tp_session_get);
 273
 274 struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth,
 275                                           bool do_ref)
 276 {
 277         int hash;
 278         struct l2tp_session *session;
 279         int count = 0;
 280
 281         read_lock_bh(&tunnel->hlist_lock);
 282         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
 283                 hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {
 284                         if (++count > nth) {
 285                                 l2tp_session_inc_refcount(session);
 286                                 if (do_ref && session->ref)
 287                                         session->ref(session);
 288                                 read_unlock_bh(&tunnel->hlist_lock);
 289                                 return session;
 290                         }
 291                 }
 292         }
 293
 294         read_unlock_bh(&tunnel->hlist_lock);
 295
 296         return NULL;
 297 }
 298 EXPORT_SYMBOL_GPL(l2tp_session_get_nth);
 299
 300 /* Lookup a session by interface name.
 301  * This is very inefficient but is only used by management interfaces.
 302  */
 303 struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
 304                                                 const char *ifname,
 305                                                 bool do_ref)
 306 {
 307         struct l2tp_net *pn = l2tp_pernet(net);
 308         int hash;
 309         struct l2tp_session *session;
 310
 311         rcu_read_lock_bh();
 312         for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) {
 313                 hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {
 314                         if (!strcmp(session->ifname, ifname)) {
 315                                 l2tp_session_inc_refcount(session);
 316                                 if (do_ref && session->ref)
 317                                         session->ref(session);
 318                                 rcu_read_unlock_bh();
 319
 320                                 return session;
 321                         }
 322                 }
 323         }
 324
 325         rcu_read_unlock_bh();
 326
 327         return NULL;
 328 }
 329 EXPORT_SYMBOL_GPL(l2tp_session_get_by_ifname);
 330
 331 int l2tp_session_register(struct l2tp_session *session,
 332                           struct l2tp_tunnel *tunnel)
 333 {
 334         struct l2tp_session *session_walk;
 335         struct hlist_head *g_head;
 336         struct hlist_head *head;
 337         struct l2tp_net *pn;
 338         int err;
 339
 340         head = l2tp_session_id_hash(tunnel, session->session_id);
 341
 342         write_lock_bh(&tunnel->hlist_lock);
 343         if (!tunnel->acpt_newsess) {
 344                 err = -ENODEV;
 345                 goto err_tlock;
 346         }
 347
 348         hlist_for_each_entry(session_walk, head, hlist)
 349                 if (session_walk->session_id == session->session_id) {
 350                         err = -EEXIST;
 351                         goto err_tlock;
 352                 }
 353
 354         if (tunnel->version == L2TP_HDR_VER_3) {
 355                 pn = l2tp_pernet(tunnel->l2tp_net);
 356                 g_head = l2tp_session_id_hash_2(l2tp_pernet(tunnel->l2tp_net),
 357                                                 session->session_id);
 358
 359                 spin_lock_bh(&pn->l2tp_session_hlist_lock);
 360
 361                 /* IP encap expects session IDs to be globally unique, while
 362                  * UDP encap doesn't.
 363                  */
 364                 hlist_for_each_entry(session_walk, g_head, global_hlist)
 365                         if (session_walk->session_id == session->session_id &&
 366                             (session_walk->tunnel->encap == L2TP_ENCAPTYPE_IP ||
 367                              tunnel->encap == L2TP_ENCAPTYPE_IP)) {
 368                                 err = -EEXIST;
 369                                 goto err_tlock_pnlock;
 370                         }
 371
 372                 l2tp_tunnel_inc_refcount(tunnel);
 373                 sock_hold(tunnel->sock);
 374                 hlist_add_head_rcu(&session->global_hlist, g_head);
 375
 376                 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
 377         } else {
 378                 l2tp_tunnel_inc_refcount(tunnel);
 379                 sock_hold(tunnel->sock);
 380         }
 381
 382         hlist_add_head(&session->hlist, head);
 383         write_unlock_bh(&tunnel->hlist_lock);
 384
 385         /* Ignore management session in session count value */
 386         if (session->session_id != 0)
 387                 atomic_inc(&l2tp_session_count);
 388
 389         return 0;
 390
 391 err_tlock_pnlock:
 392         spin_unlock_bh(&pn->l2tp_session_hlist_lock);
 393 err_tlock:
 394         write_unlock_bh(&tunnel->hlist_lock);
 395
 396         return err;
 397 }
 398 EXPORT_SYMBOL_GPL(l2tp_session_register);
 399
 400 /* Lookup a tunnel by id
 401  */
 402 struct l2tp_tunnel *l2tp_tunnel_find(const struct net *net, u32 tunnel_id)
 403 {
 404         struct l2tp_tunnel *tunnel;
 405         struct l2tp_net *pn = l2tp_pernet(net);
 406
 407         rcu_read_lock_bh();
 408         list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
 409                 if (tunnel->tunnel_id == tunnel_id) {
 410                         rcu_read_unlock_bh();
 411                         return tunnel;
 412                 }
 413         }
 414         rcu_read_unlock_bh();
 415
 416         return NULL;
 417 }
 418 EXPORT_SYMBOL_GPL(l2tp_tunnel_find);
 419
 420 struct l2tp_tunnel *l2tp_tunnel_find_nth(const struct net *net, int nth)
 421 {
 422         struct l2tp_net *pn = l2tp_pernet(net);
 423         struct l2tp_tunnel *tunnel;
 424         int count = 0;
 425
 426         rcu_read_lock_bh();
 427         list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
 428                 if (++count > nth) {
 429                         rcu_read_unlock_bh();
 430                         return tunnel;
 431                 }
 432         }
 433
 434         rcu_read_unlock_bh();
 435
 436         return NULL;
 437 }
 438 EXPORT_SYMBOL_GPL(l2tp_tunnel_find_nth);
 439
 440 /*****************************************************************************
 441  * Receive data handling
 442  *****************************************************************************/
 443
 444 /* Queue a skb in order. We come here only if the skb has an L2TP sequence
 445  * number.
 446  */
 447 static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)
 448 {
 449         struct sk_buff *skbp;
 450         struct sk_buff *tmp;
 451         u32 ns = L2TP_SKB_CB(skb)->ns;
 452
 453         spin_lock_bh(&session->reorder_q.lock);
 454         skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
 455                 if (L2TP_SKB_CB(skbp)->ns > ns) {
 456                         __skb_queue_before(&session->reorder_q, skbp, skb);
 457                         l2tp_dbg(session, L2TP_MSG_SEQ,
 458                                  "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
 459                                  session->name, ns, L2TP_SKB_CB(skbp)->ns,
 460                                  skb_queue_len(&session->reorder_q));
 461                         atomic_long_inc(&session->stats.rx_oos_packets);
 462                         goto out;
 463                 }
 464         }
 465
 466         __skb_queue_tail(&session->reorder_q, skb);
 467
 468 out:
 469         spin_unlock_bh(&session->reorder_q.lock);
 470 }
 471
 472 /* Dequeue a single skb.
 473  */
 474 static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)
 475 {
 476         struct l2tp_tunnel *tunnel = session->tunnel;
 477         int length = L2TP_SKB_CB(skb)->length;
 478
 479         /* We're about to requeue the skb, so return resources
 480          * to its current owner (a socket receive buffer).
 481          */
 482         skb_orphan(skb);
 483
 484         atomic_long_inc(&tunnel->stats.rx_packets);
 485         atomic_long_add(length, &tunnel->stats.rx_bytes);
 486         atomic_long_inc(&session->stats.rx_packets);
 487         atomic_long_add(length, &session->stats.rx_bytes);
 488
 489         if (L2TP_SKB_CB(skb)->has_seq) {
 490                 /* Bump our Nr */
 491                 session->nr++;
 492                 session->nr &= session->nr_max;
 493
 494                 l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated nr to %hu\n",
 495                          session->name, session->nr);
 496         }
 497
 498         /* call private receive handler */
 499         if (session->recv_skb != NULL)
 500                 (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);
 501         else
 502                 kfree_skb(skb);
 503
 504         if (session->deref)
 505                 (*session->deref)(session);
 506 }
 507
 508 /* Dequeue skbs from the session's reorder_q, subject to packet order.
 509  * Skbs that have been in the queue for too long are simply discarded.
 510  */
 511 static void l2tp_recv_dequeue(struct l2tp_session *session)
 512 {
 513         struct sk_buff *skb;
 514         struct sk_buff *tmp;
 515
 516         /* If the pkt at the head of the queue has the nr that we
 517          * expect to send up next, dequeue it and any other
 518          * in-sequence packets behind it.
 519          */
 520 start:
 521         spin_lock_bh(&session->reorder_q.lock);
 522         skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
 523                 if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) {
 524                         atomic_long_inc(&session->stats.rx_seq_discards);
 525                         atomic_long_inc(&session->stats.rx_errors);
 526                         l2tp_dbg(session, L2TP_MSG_SEQ,
 527                                  "%s: oos pkt %u len %d discarded (too old), waiting for %u, reorder_q_len=%d\n",
 528                                  session->name, L2TP_SKB_CB(skb)->ns,
 529                                  L2TP_SKB_CB(skb)->length, session->nr,
 530                                  skb_queue_len(&session->reorder_q));
 531                         session->reorder_skip = 1;
 532                         __skb_unlink(skb, &session->reorder_q);
 533                         kfree_skb(skb);
 534                         if (session->deref)
 535                                 (*session->deref)(session);
 536                         continue;
 537                 }
 538
 539                 if (L2TP_SKB_CB(skb)->has_seq) {
 540                         if (session->reorder_skip) {
 541                                 l2tp_dbg(session, L2TP_MSG_SEQ,
 542                                          "%s: advancing nr to next pkt: %u -> %u",
 543                                          session->name, session->nr,
 544                                          L2TP_SKB_CB(skb)->ns);
 545                                 session->reorder_skip = 0;
 546                                 session->nr = L2TP_SKB_CB(skb)->ns;
 547                         }
 548                         if (L2TP_SKB_CB(skb)->ns != session->nr) {
 549                                 l2tp_dbg(session, L2TP_MSG_SEQ,
 550                                          "%s: holding oos pkt %u len %d, waiting for %u, reorder_q_len=%d\n",
 551                                          session->name, L2TP_SKB_CB(skb)->ns,
 552                                          L2TP_SKB_CB(skb)->length, session->nr,
 553                                          skb_queue_len(&session->reorder_q));
 554                                 goto out;
 555                         }
 556                 }
 557                 __skb_unlink(skb, &session->reorder_q);
 558
 559                 /* Process the skb. We release the queue lock while we
 560                  * do so to let other contexts process the queue.
 561                  */
 562                 spin_unlock_bh(&session->reorder_q.lock);
 563                 l2tp_recv_dequeue_skb(session, skb);
 564                 goto start;
 565         }
 566
 567 out:
 568         spin_unlock_bh(&session->reorder_q.lock);
 569 }
 570
 571 static int l2tp_seq_check_rx_window(struct l2tp_session *session, u32 nr)
 572 {
 573         u32 nws;
 574
 575         if (nr >= session->nr)
 576                 nws = nr - session->nr;
 577         else
 578                 nws = (session->nr_max + 1) - (session->nr - nr);
 579
 580         return nws < session->nr_window_size;
 581 }
 582
 583 /* If packet has sequence numbers, queue it if acceptable. Returns 0 if
 584  * acceptable, else non-zero.
 585  */
 586 static int l2tp_recv_data_seq(struct l2tp_session *session, struct sk_buff *skb)
 587 {
 588         if (!l2tp_seq_check_rx_window(session, L2TP_SKB_CB(skb)->ns)) {
 589                 /* Packet sequence number is outside allowed window.
 590                  * Discard it.
 591                  */
 592                 l2tp_dbg(session, L2TP_MSG_SEQ,
 593                          "%s: pkt %u len %d discarded, outside window, nr=%u\n",
 594                          session->name, L2TP_SKB_CB(skb)->ns,
 595                          L2TP_SKB_CB(skb)->length, session->nr);
 596                 goto discard;
 597         }
 598
 599         if (session->reorder_timeout != 0) {
 600                 /* Packet reordering enabled. Add skb to session's
 601                  * reorder queue, in order of ns.
 602                  */
 603                 l2tp_recv_queue_skb(session, skb);
 604                 goto out;
 605         }
 606
 607         /* Packet reordering disabled. Discard out-of-sequence packets, while
 608          * tracking the number if in-sequence packets after the first OOS packet
 609          * is seen. After nr_oos_count_max in-sequence packets, reset the
 610          * sequence number to re-enable packet reception.
 611          */
 612         if (L2TP_SKB_CB(skb)->ns == session->nr) {
 613                 skb_queue_tail(&session->reorder_q, skb);
 614         } else {
 615                 u32 nr_oos = L2TP_SKB_CB(skb)->ns;
 616                 u32 nr_next = (session->nr_oos + 1) & session->nr_max;
 617
 618                 if (nr_oos == nr_next)
 619                         session->nr_oos_count++;
 620                 else
 621                         session->nr_oos_count = 0;
 622
 623                 session->nr_oos = nr_oos;
 624                 if (session->nr_oos_count > session->nr_oos_count_max) {
 625                         session->reorder_skip = 1;
 626                         l2tp_dbg(session, L2TP_MSG_SEQ,
 627                                  "%s: %d oos packets received. Resetting sequence numbers\n",
 628                                  session->name, session->nr_oos_count);
 629                 }
 630                 if (!session->reorder_skip) {
 631                         atomic_long_inc(&session->stats.rx_seq_discards);
 632                         l2tp_dbg(session, L2TP_MSG_SEQ,
 633                                  "%s: oos pkt %u len %d discarded, waiting for %u, reorder_q_len=%d\n",
 634                                  session->name, L2TP_SKB_CB(skb)->ns,
 635                                  L2TP_SKB_CB(skb)->length, session->nr,
 636                                  skb_queue_len(&session->reorder_q));
 637                         goto discard;
 638                 }
 639                 skb_queue_tail(&session->reorder_q, skb);
 640         }
 641
 642 out:
 643         return 0;
 644
 645 discard:
 646         return 1;
 647 }
 648
 649 /* Do receive processing of L2TP data frames. We handle both L2TPv2
 650  * and L2TPv3 data frames here.
 651  *
 652  * L2TPv2 Data Message Header
 653  *
 654  *  0                   1                   2                   3
 655  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 656  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 657  * |T|L|x|x|S|x|O|P|x|x|x|x|  Ver  |          Length (opt)         |
 658  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 659  * |           Tunnel ID           |           Session ID          |
 660  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 661  * |             Ns (opt)          |             Nr (opt)          |
 662  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 663  * |      Offset Size (opt)        |    Offset pad... (opt)
 664  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 665  *
 666  * Data frames are marked by T=0. All other fields are the same as
 667  * those in L2TP control frames.
 668  *
 669  * L2TPv3 Data Message Header
 670  *
 671  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 672  * |                      L2TP Session Header                      |
 673  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 674  * |                      L2-Specific Sublayer                     |
 675  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 676  * |                        Tunnel Payload                      ...
 677  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 678  *
 679  * L2TPv3 Session Header Over IP
 680  *
 681  *  0                   1                   2                   3
 682  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 683  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 684  * |                           Session ID                          |
 685  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 686  * |               Cookie (optional, maximum 64 bits)...
 687  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 688  *                                                                 |
 689  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 690  *
 691  * L2TPv3 L2-Specific Sublayer Format
 692  *
 693  *  0                   1                   2                   3
 694  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 695  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 696  * |x|S|x|x|x|x|x|x|              Sequence Number                  |
 697  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 698  *
 699  * Cookie value, sublayer format and offset (pad) are negotiated with
 700  * the peer when the session is set up. Unlike L2TPv2, we do not need
 701  * to parse the packet header to determine if optional fields are
 702  * present.
 703  *
 704  * Caller must already have parsed the frame and determined that it is
 705  * a data (not control) frame before coming here. Fields up to the
 706  * session-id have already been parsed and ptr points to the data
 707  * after the session-id.
 708  *
 709  * session->ref() must have been called prior to l2tp_recv_common().
 710  * session->deref() will be called automatically after skb is processed.
 711  */
 712 void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
 713                       unsigned char *ptr, unsigned char *optr, u16 hdrflags,
 714                       int length, int (*payload_hook)(struct sk_buff *skb))
 715 {
 716         struct l2tp_tunnel *tunnel = session->tunnel;
 717         int offset;
 718         u32 ns, nr;
 719
 720         /* Parse and check optional cookie */
 721         if (session->peer_cookie_len > 0) {
 722                 if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
 723                         l2tp_info(tunnel, L2TP_MSG_DATA,
 724                                   "%s: cookie mismatch (%u/%u). Discarding.\n",
 725                                   tunnel->name, tunnel->tunnel_id,
 726                                   session->session_id);
 727                         atomic_long_inc(&session->stats.rx_cookie_discards);
 728                         goto discard;
 729                 }
 730                 ptr += session->peer_cookie_len;
 731         }
 732
 733         /* Handle the optional sequence numbers. Sequence numbers are
 734          * in different places for L2TPv2 and L2TPv3.
 735          *
 736          * If we are the LAC, enable/disable sequence numbers under
 737          * the control of the LNS.  If no sequence numbers present but
 738          * we were expecting them, discard frame.
 739          */
 740         ns = nr = 0;
 741         L2TP_SKB_CB(skb)->has_seq = 0;
 742         if (tunnel->version == L2TP_HDR_VER_2) {
 743                 if (hdrflags & L2TP_HDRFLAG_S) {
 744                         ns = ntohs(*(__be16 *) ptr);
 745                         ptr += 2;
 746                         nr = ntohs(*(__be16 *) ptr);
 747                         ptr += 2;
 748
 749                         /* Store L2TP info in the skb */
 750                         L2TP_SKB_CB(skb)->ns = ns;
 751                         L2TP_SKB_CB(skb)->has_seq = 1;
 752
 753                         l2tp_dbg(session, L2TP_MSG_SEQ,
 754                                  "%s: recv data ns=%u, nr=%u, session nr=%u\n",
 755                                  session->name, ns, nr, session->nr);
 756                 }
 757         } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
 758                 u32 l2h = ntohl(*(__be32 *) ptr);
 759
 760                 if (l2h & 0x40000000) {
 761                         ns = l2h & 0x00ffffff;
 762
 763                         /* Store L2TP info in the skb */
 764                         L2TP_SKB_CB(skb)->ns = ns;
 765                         L2TP_SKB_CB(skb)->has_seq = 1;
 766
 767                         l2tp_dbg(session, L2TP_MSG_SEQ,
 768                                  "%s: recv data ns=%u, session nr=%u\n",
 769                                  session->name, ns, session->nr);
 770                 }
 771                 ptr += 4;
 772         }
 773
 774         if (L2TP_SKB_CB(skb)->has_seq) {
 775                 /* Received a packet with sequence numbers. If we're the LNS,
 776                  * check if we sre sending sequence numbers and if not,
 777                  * configure it so.
 778                  */
 779                 if ((!session->lns_mode) && (!session->send_seq)) {
 780                         l2tp_info(session, L2TP_MSG_SEQ,
 781                                   "%s: requested to enable seq numbers by LNS\n",
 782                                   session->name);
 783                         session->send_seq = -1;
 784                         l2tp_session_set_header_len(session, tunnel->version);
 785                 }
 786         } else {
 787                 /* No sequence numbers.
 788                  * If user has configured mandatory sequence numbers, discard.
 789                  */
 790                 if (session->recv_seq) {
 791                         l2tp_warn(session, L2TP_MSG_SEQ,
 792                                   "%s: recv data has no seq numbers when required. Discarding.\n",
 793                                   session->name);
 794                         atomic_long_inc(&session->stats.rx_seq_discards);
 795                         goto discard;
 796                 }
 797
 798                 /* If we're the LAC and we're sending sequence numbers, the
 799                  * LNS has requested that we no longer send sequence numbers.
 800                  * If we're the LNS and we're sending sequence numbers, the
 801                  * LAC is broken. Discard the frame.
 802                  */
 803                 if ((!session->lns_mode) && (session->send_seq)) {
 804                         l2tp_info(session, L2TP_MSG_SEQ,
 805                                   "%s: requested to disable seq numbers by LNS\n",
 806                                   session->name);
 807                         session->send_seq = 0;
 808                         l2tp_session_set_header_len(session, tunnel->version);
 809                 } else if (session->send_seq) {
 810                         l2tp_warn(session, L2TP_MSG_SEQ,
 811                                   "%s: recv data has no seq numbers when required. Discarding.\n",
 812                                   session->name);
 813                         atomic_long_inc(&session->stats.rx_seq_discards);
 814                         goto discard;
 815                 }
 816         }
 817
 818         /* Session data offset is defined only for L2TPv2 and is
 819          * indicated by an optional 16-bit value in the header.
 820          */
 821         if (tunnel->version == L2TP_HDR_VER_2) {
 822                 /* If offset bit set, skip it. */
 823                 if (hdrflags & L2TP_HDRFLAG_O) {
 824                         offset = ntohs(*(__be16 *)ptr);
 825                         ptr += 2 + offset;
 826                 }
 827         }
 828
 829         offset = ptr - optr;
 830         if (!pskb_may_pull(skb, offset))
 831                 goto discard;
 832
 833         __skb_pull(skb, offset);
 834
 835         /* If caller wants to process the payload before we queue the
 836          * packet, do so now.
 837          */
 838         if (payload_hook)
 839                 if ((*payload_hook)(skb))
 840                         goto discard;
 841
 842         /* Prepare skb for adding to the session's reorder_q.  Hold
 843          * packets for max reorder_timeout or 1 second if not
 844          * reordering.
 845          */
 846         L2TP_SKB_CB(skb)->length = length;
 847         L2TP_SKB_CB(skb)->expires = jiffies +
 848                 (session->reorder_timeout ? session->reorder_timeout : HZ);
 849
 850         /* Add packet to the session's receive queue. Reordering is done here, if
 851          * enabled. Saved L2TP protocol info is stored in skb->sb[].
 852          */
 853         if (L2TP_SKB_CB(skb)->has_seq) {
 854                 if (l2tp_recv_data_seq(session, skb))
 855                         goto discard;
 856         } else {
 857                 /* No sequence numbers. Add the skb to the tail of the
 858                  * reorder queue. This ensures that it will be
 859                  * delivered after all previous sequenced skbs.
 860                  */
 861                 skb_queue_tail(&session->reorder_q, skb);
 862         }
 863
 864         /* Try to dequeue as many skbs from reorder_q as we can. */
 865         l2tp_recv_dequeue(session);
 866
 867         return;
 868
 869 discard:
 870         atomic_long_inc(&session->stats.rx_errors);
 871         kfree_skb(skb);
 872
 873         if (session->deref)
 874                 (*session->deref)(session);
 875 }
 876 EXPORT_SYMBOL(l2tp_recv_common);
 877
 878 /* Drop skbs from the session's reorder_q
 879  */
 880 int l2tp_session_queue_purge(struct l2tp_session *session)
 881 {
 882         struct sk_buff *skb = NULL;
 883         BUG_ON(!session);
 884         BUG_ON(session->magic != L2TP_SESSION_MAGIC);
 885         while ((skb = skb_dequeue(&session->reorder_q))) {
 886                 atomic_long_inc(&session->stats.rx_errors);
 887                 kfree_skb(skb);
 888                 if (session->deref)
 889                         (*session->deref)(session);
 890         }
 891         return 0;
 892 }
 893 EXPORT_SYMBOL_GPL(l2tp_session_queue_purge);
 894
 895 /* Internal UDP receive frame. Do the real work of receiving an L2TP data frame
 896  * here. The skb is not on a list when we get here.
 897  * Returns 0 if the packet was a data packet and was successfully passed on.
 898  * Returns 1 if the packet was not a good data packet and could not be
 899  * forwarded.  All such packets are passed up to userspace to deal with.
 900  */
 901 static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
 902                               int (*payload_hook)(struct sk_buff *skb))
 903 {
 904         struct l2tp_session *session = NULL;
 905         unsigned char *ptr, *optr;
 906         u16 hdrflags;
 907         u32 tunnel_id, session_id;
 908         u16 version;
 909         int length;
 910
 911         /* UDP has verifed checksum */
 912
 913         /* UDP always verifies the packet length. */
 914         __skb_pull(skb, sizeof(struct udphdr));
 915
 916         /* Short packet? */
 917         if (!pskb_may_pull(skb, L2TP_HDR_SIZE_MAX)) {
 918                 l2tp_info(tunnel, L2TP_MSG_DATA,
 919                           "%s: recv short packet (len=%d)\n",
 920                           tunnel->name, skb->len);
 921                 goto error;
 922         }
 923
 924         /* Trace packet contents, if enabled */
 925         if (tunnel->debug & L2TP_MSG_DATA) {
 926                 length = min(32u, skb->len);
 927                 if (!pskb_may_pull(skb, length))
 928                         goto error;
 929
 930                 pr_debug("%s: recv\n", tunnel->name);
 931                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length);
 932         }
 933
 934         /* Point to L2TP header */
 935         optr = ptr = skb->data;
 936
 937         /* Get L2TP header flags */
 938         hdrflags = ntohs(*(__be16 *) ptr);
 939
 940         /* Check protocol version */
 941         version = hdrflags & L2TP_HDR_VER_MASK;
 942         if (version != tunnel->version) {
 943                 l2tp_info(tunnel, L2TP_MSG_DATA,
 944                           "%s: recv protocol version mismatch: got %d expected %d\n",
 945                           tunnel->name, version, tunnel->version);
 946                 goto error;
 947         }
 948
 949         /* Get length of L2TP packet */
 950         length = skb->len;
 951
 952         /* If type is control packet, it is handled by userspace. */
 953         if (hdrflags & L2TP_HDRFLAG_T) {
 954                 l2tp_dbg(tunnel, L2TP_MSG_DATA,
 955                          "%s: recv control packet, len=%d\n",
 956                          tunnel->name, length);
 957                 goto error;
 958         }
 959
 960         /* Skip flags */
 961         ptr += 2;
 962
 963         if (tunnel->version == L2TP_HDR_VER_2) {
 964                 /* If length is present, skip it */
 965                 if (hdrflags & L2TP_HDRFLAG_L)
 966                         ptr += 2;
 967
 968                 /* Extract tunnel and session ID */
 969                 tunnel_id = ntohs(*(__be16 *) ptr);
 970                 ptr += 2;
 971                 session_id = ntohs(*(__be16 *) ptr);
 972                 ptr += 2;
 973         } else {
 974                 ptr += 2;       /* skip reserved bits */
 975                 tunnel_id = tunnel->tunnel_id;
 976                 session_id = ntohl(*(__be32 *) ptr);
 977                 ptr += 4;
 978         }
 979
 980         /* Find the session context */
 981         session = l2tp_session_get(tunnel->l2tp_net, tunnel, session_id, true);
 982         if (!session || !session->recv_skb) {
 983                 if (session) {
 984                         if (session->deref)
 985                                 session->deref(session);
 986                         l2tp_session_dec_refcount(session);
 987                 }
 988
 989                 /* Not found? Pass to userspace to deal with */
 990                 l2tp_info(tunnel, L2TP_MSG_DATA,
 991                           "%s: no session found (%u/%u). Passing up.\n",
 992                           tunnel->name, tunnel_id, session_id);
 993                 goto error;
 994         }
 995
 996         if (tunnel->version == L2TP_HDR_VER_3 &&
 997             l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) {
 998                 l2tp_session_dec_refcount(session);
 999                 goto error;
1000         }
1001
1002         l2tp_recv_common(session, skb, ptr, optr, hdrflags, length, payload_hook);
1003         l2tp_session_dec_refcount(session);
1004
1005         return 0;
1006
1007 error:
1008         /* Put UDP header back */
1009         __skb_push(skb, sizeof(struct udphdr));
1010
1011         return 1;
1012 }
1013
1014 /* UDP encapsulation receive handler. See net/ipv4/udp.c.
1015  * Return codes:
1016  * 0 : success.
1017  * <0: error
1018  * >0: skb should be passed up to userspace as UDP.
1019  */
1020 int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
1021 {
1022         struct l2tp_tunnel *tunnel;
1023
1024         tunnel = l2tp_sock_to_tunnel(sk);
1025         if (tunnel == NULL)
1026                 goto pass_up;
1027
1028         l2tp_dbg(tunnel, L2TP_MSG_DATA, "%s: received %d bytes\n",
1029                  tunnel->name, skb->len);
1030
1031         if (l2tp_udp_recv_core(tunnel, skb, tunnel->recv_payload_hook))
1032                 goto pass_up_put;
1033
1034         sock_put(sk);
1035         return 0;
1036
1037 pass_up_put:
1038         sock_put(sk);
1039 pass_up:
1040         return 1;
1041 }
1042 EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv);
1043
1044 /************************************************************************
1045  * Transmit handling
1046  ***********************************************************************/
1047
1048 /* Build an L2TP header for the session into the buffer provided.
1049  */
1050 static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
1051 {
1052         struct l2tp_tunnel *tunnel = session->tunnel;
1053         __be16 *bufp = buf;
1054         __be16 *optr = buf;
1055         u16 flags = L2TP_HDR_VER_2;
1056         u32 tunnel_id = tunnel->peer_tunnel_id;
1057         u32 session_id = session->peer_session_id;
1058
1059         if (session->send_seq)
1060                 flags |= L2TP_HDRFLAG_S;
1061
1062         /* Setup L2TP header. */
1063         *bufp++ = htons(flags);
1064         *bufp++ = htons(tunnel_id);
1065         *bufp++ = htons(session_id);
1066         if (session->send_seq) {
1067                 *bufp++ = htons(session->ns);
1068                 *bufp++ = 0;
1069                 session->ns++;
1070                 session->ns &= 0xffff;
1071                 l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated ns to %u\n",
1072                          session->name, session->ns);
1073         }
1074
1075         return bufp - optr;
1076 }
1077
1078 static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
1079 {
1080         struct l2tp_tunnel *tunnel = session->tunnel;
1081         char *bufp = buf;
1082         char *optr = bufp;
1083
1084         /* Setup L2TP header. The header differs slightly for UDP and
1085          * IP encapsulations. For UDP, there is 4 bytes of flags.
1086          */
1087         if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
1088                 u16 flags = L2TP_HDR_VER_3;
1089                 *((__be16 *) bufp) = htons(flags);
1090                 bufp += 2;
1091                 *((__be16 *) bufp) = 0;
1092                 bufp += 2;
1093         }
1094
1095         *((__be32 *) bufp) = htonl(session->peer_session_id);
1096         bufp += 4;
1097         if (session->cookie_len) {
1098                 memcpy(bufp, &session->cookie[0], session->cookie_len);
1099                 bufp += session->cookie_len;
1100         }
1101         if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
1102                 u32 l2h = 0;
1103
1104                 if (session->send_seq) {
1105                         l2h = 0x40000000 | session->ns;
1106                         session->ns++;
1107                         session->ns &= 0xffffff;
1108                         l2tp_dbg(session, L2TP_MSG_SEQ,
1109                                  "%s: updated ns to %u\n",
1110                                  session->name, session->ns);
1111                 }
1112
1113                 *((__be32 *)bufp) = htonl(l2h);
1114                 bufp += 4;
1115         }
1116
1117         return bufp - optr;
1118 }
1119
1120 static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
1121                           struct flowi *fl, size_t data_len)
1122 {
1123         struct l2tp_tunnel *tunnel = session->tunnel;
1124         unsigned int len = skb->len;
1125         int error;
1126
1127         /* Debug */
1128         if (session->send_seq)
1129                 l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %Zd bytes, ns=%u\n",
1130                          session->name, data_len, session->ns - 1);
1131         else
1132                 l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %Zd bytes\n",
1133                          session->name, data_len);
1134
1135         if (session->debug & L2TP_MSG_DATA) {
1136                 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1137                 unsigned char *datap = skb->data + uhlen;
1138
1139                 pr_debug("%s: xmit\n", session->name);
1140                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1141                                      datap, min_t(size_t, 32, len - uhlen));
1142         }
1143
1144         /* Queue the packet to IP for output */
1145         skb->ignore_df = 1;
1146         skb_dst_drop(skb);
1147 #if IS_ENABLED(CONFIG_IPV6)
1148         if (l2tp_sk_is_v6(tunnel->sock))
1149                 error = inet6_csk_xmit(tunnel->sock, skb, NULL);
1150         else
1151 #endif
1152                 error = ip_queue_xmit(tunnel->sock, skb, fl);
1153
1154         /* Update stats */
1155         if (error >= 0) {
1156                 atomic_long_inc(&tunnel->stats.tx_packets);
1157                 atomic_long_add(len, &tunnel->stats.tx_bytes);
1158                 atomic_long_inc(&session->stats.tx_packets);
1159                 atomic_long_add(len, &session->stats.tx_bytes);
1160         } else {
1161                 atomic_long_inc(&tunnel->stats.tx_errors);
1162                 atomic_long_inc(&session->stats.tx_errors);
1163         }
1164
1165         return 0;
1166 }
1167
1168 /* If caller requires the skb to have a ppp header, the header must be
1169  * inserted in the skb data before calling this function.
1170  */
1171 int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len)
1172 {
1173         int data_len = skb->len;
1174         struct l2tp_tunnel *tunnel = session->tunnel;
1175         struct sock *sk = tunnel->sock;
1176         struct flowi *fl;
1177         struct udphdr *uh;
1178         struct inet_sock *inet;
1179         int headroom;
1180         int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1181         int udp_len;
1182         int ret = NET_XMIT_SUCCESS;
1183
1184         /* Check that there's enough headroom in the skb to insert IP,
1185          * UDP and L2TP headers. If not enough, expand it to
1186          * make room. Adjust truesize.
1187          */
1188         headroom = NET_SKB_PAD + sizeof(struct iphdr) +
1189                 uhlen + hdr_len;
1190         if (skb_cow_head(skb, headroom)) {
1191                 kfree_skb(skb);
1192                 return NET_XMIT_DROP;
1193         }
1194
1195         /* Setup L2TP header */
1196         session->build_header(session, __skb_push(skb, hdr_len));
1197
1198         /* Reset skb netfilter state */
1199         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
1200         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
1201                               IPSKB_REROUTED);
1202         nf_reset(skb);
1203
1204         bh_lock_sock(sk);
1205         if (sock_owned_by_user(sk)) {
1206                 kfree_skb(skb);
1207                 ret = NET_XMIT_DROP;
1208                 goto out_unlock;
1209         }
1210
1211         /* The user-space may change the connection status for the user-space
1212          * provided socket at run time: we must check it under the socket lock
1213          */
1214         if (tunnel->fd >= 0 && sk->sk_state != TCP_ESTABLISHED) {
1215                 kfree_skb(skb);
1216                 ret = NET_XMIT_DROP;
1217                 goto out_unlock;
1218         }
1219
1220         inet = inet_sk(sk);
1221         fl = &inet->cork.fl;
1222         switch (tunnel->encap) {
1223         case L2TP_ENCAPTYPE_UDP:
1224                 /* Setup UDP header */
1225                 __skb_push(skb, sizeof(*uh));
1226                 skb_reset_transport_header(skb);
1227                 uh = udp_hdr(skb);
1228                 uh->source = inet->inet_sport;
1229                 uh->dest = inet->inet_dport;
1230                 udp_len = uhlen + hdr_len + data_len;
1231                 uh->len = htons(udp_len);
1232
1233                 /* Calculate UDP checksum if configured to do so */
1234 #if IS_ENABLED(CONFIG_IPV6)
1235                 if (l2tp_sk_is_v6(sk))
1236                         udp6_set_csum(udp_get_no_check6_tx(sk),
1237                                       skb, &inet6_sk(sk)->saddr,
1238                                       &sk->sk_v6_daddr, udp_len);
1239                 else
1240 #endif
1241                 udp_set_csum(sk->sk_no_check_tx, skb, inet->inet_saddr,
1242                              inet->inet_daddr, udp_len);
1243                 break;
1244
1245         case L2TP_ENCAPTYPE_IP:
1246                 break;
1247         }
1248
1249         l2tp_xmit_core(session, skb, fl, data_len);
1250 out_unlock:
1251         bh_unlock_sock(sk);
1252
1253         return ret;
1254 }
1255 EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
1256
1257 /*****************************************************************************
1258  * Tinnel and session create/destroy.
1259  *****************************************************************************/
1260
1261 /* Tunnel socket destruct hook.
1262  * The tunnel context is deleted only when all session sockets have been
1263  * closed.
1264  */
1265 static void l2tp_tunnel_destruct(struct sock *sk)
1266 {
1267         struct l2tp_tunnel *tunnel = l2tp_tunnel(sk);
1268         struct l2tp_net *pn;
1269
1270         if (tunnel == NULL)
1271                 goto end;
1272
1273         l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing...\n", tunnel->name);
1274
1275
1276         /* Disable udp encapsulation */
1277         switch (tunnel->encap) {
1278         case L2TP_ENCAPTYPE_UDP:
1279                 /* No longer an encapsulation socket. See net/ipv4/udp.c */
1280                 (udp_sk(sk))->encap_type = 0;
1281                 (udp_sk(sk))->encap_rcv = NULL;
1282                 (udp_sk(sk))->encap_destroy = NULL;
1283                 break;
1284         case L2TP_ENCAPTYPE_IP:
1285                 break;
1286         }
1287
1288         /* Remove hooks into tunnel socket */
1289         sk->sk_destruct = tunnel->old_sk_destruct;
1290         sk->sk_user_data = NULL;
1291
1292         /* Remove the tunnel struct from the tunnel list */
1293         pn = l2tp_pernet(tunnel->l2tp_net);
1294         spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1295         list_del_rcu(&tunnel->list);
1296         spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
1297         atomic_dec(&l2tp_tunnel_count);
1298
1299         l2tp_tunnel_closeall(tunnel);
1300
1301         tunnel->sock = NULL;
1302         l2tp_tunnel_dec_refcount(tunnel);
1303
1304         /* Call the original destructor */
1305         if (sk->sk_destruct)
1306                 (*sk->sk_destruct)(sk);
1307 end:
1308         return;
1309 }
1310
1311 /* When the tunnel is closed, all the attached sessions need to go too.
1312  */
1313 void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
1314 {
1315         int hash;
1316         struct hlist_node *walk;
1317         struct hlist_node *tmp;
1318         struct l2tp_session *session;
1319
1320         BUG_ON(tunnel == NULL);
1321
1322         l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing all sessions...\n",
1323                   tunnel->name);
1324
1325         write_lock_bh(&tunnel->hlist_lock);
1326         tunnel->acpt_newsess = false;
1327         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
1328 again:
1329                 hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
1330                         session = hlist_entry(walk, struct l2tp_session, hlist);
1331
1332                         l2tp_info(session, L2TP_MSG_CONTROL,
1333                                   "%s: closing session\n", session->name);
1334
1335                         hlist_del_init(&session->hlist);
1336
1337                         if (test_and_set_bit(0, &session->dead))
1338                                 goto again;
1339
1340                         if (session->ref != NULL)
1341                                 (*session->ref)(session);
1342
1343                         write_unlock_bh(&tunnel->hlist_lock);
1344
1345                         __l2tp_session_unhash(session);
1346                         l2tp_session_queue_purge(session);
1347
1348                         if (session->session_close != NULL)
1349                                 (*session->session_close)(session);
1350
1351                         if (session->deref != NULL)
1352                                 (*session->deref)(session);
1353
1354                         l2tp_session_dec_refcount(session);
1355
1356                         write_lock_bh(&tunnel->hlist_lock);
1357
1358                         /* Now restart from the beginning of this hash
1359                          * chain.  We always remove a session from the
1360                          * list so we are guaranteed to make forward
1361                          * progress.
1362                          */
1363                         goto again;
1364                 }
1365         }
1366         write_unlock_bh(&tunnel->hlist_lock);
1367 }
1368 EXPORT_SYMBOL_GPL(l2tp_tunnel_closeall);
1369
1370 /* Tunnel socket destroy hook for UDP encapsulation */
1371 static void l2tp_udp_encap_destroy(struct sock *sk)
1372 {
1373         struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
1374         if (tunnel) {
1375                 l2tp_tunnel_closeall(tunnel);
1376                 sock_put(sk);
1377         }
1378 }
1379
1380 /* Workqueue tunnel deletion function */
1381 static void l2tp_tunnel_del_work(struct work_struct *work)
1382 {
1383         struct l2tp_tunnel *tunnel = NULL;
1384         struct socket *sock = NULL;
1385         struct sock *sk = NULL;
1386
1387         tunnel = container_of(work, struct l2tp_tunnel, del_work);
1388
1389         l2tp_tunnel_closeall(tunnel);
1390
1391         sk = l2tp_tunnel_sock_lookup(tunnel);
1392         if (!sk)
1393                 goto out;
1394
1395         sock = sk->sk_socket;
1396
1397         /* If the tunnel socket was created by userspace, then go through the
1398          * inet layer to shut the socket down, and let userspace close it.
1399          * Otherwise, if we created the socket directly within the kernel, use
1400          * the sk API to release it here.
1401          * In either case the tunnel resources are freed in the socket
1402          * destructor when the tunnel socket goes away.
1403          */
1404         if (tunnel->fd >= 0) {
1405                 if (sock)
1406                         inet_shutdown(sock, 2);
1407         } else {
1408                 if (sock) {
1409                         kernel_sock_shutdown(sock, SHUT_RDWR);
1410                         sock_release(sock);
1411                 }
1412         }
1413
1414         l2tp_tunnel_sock_put(sk);
1415 out:
1416         l2tp_tunnel_dec_refcount(tunnel);
1417 }
1418
1419 /* Create a socket for the tunnel, if one isn't set up by
1420  * userspace. This is used for static tunnels where there is no
1421  * managing L2TP daemon.
1422  *
1423  * Since we don't want these sockets to keep a namespace alive by
1424  * themselves, we drop the socket's namespace refcount after creation.
1425  * These sockets are freed when the namespace exits using the pernet
1426  * exit hook.
1427  */
1428 static int l2tp_tunnel_sock_create(struct net *net,
1429                                 u32 tunnel_id,
1430                                 u32 peer_tunnel_id,
1431                                 struct l2tp_tunnel_cfg *cfg,
1432                                 struct socket **sockp)
1433 {
1434         int err = -EINVAL;
1435         struct socket *sock = NULL;
1436         struct udp_port_cfg udp_conf;
1437
1438         switch (cfg->encap) {
1439         case L2TP_ENCAPTYPE_UDP:
1440                 memset(&udp_conf, 0, sizeof(udp_conf));
1441
1442 #if IS_ENABLED(CONFIG_IPV6)
1443                 if (cfg->local_ip6 && cfg->peer_ip6) {
1444                         udp_conf.family = AF_INET6;
1445                         memcpy(&udp_conf.local_ip6, cfg->local_ip6,
1446                                sizeof(udp_conf.local_ip6));
1447                         memcpy(&udp_conf.peer_ip6, cfg->peer_ip6,
1448                                sizeof(udp_conf.peer_ip6));
1449                         udp_conf.use_udp6_tx_checksums =
1450                           ! cfg->udp6_zero_tx_checksums;
1451                         udp_conf.use_udp6_rx_checksums =
1452                           ! cfg->udp6_zero_rx_checksums;
1453                 } else
1454 #endif
1455                 {
1456                         udp_conf.family = AF_INET;
1457                         udp_conf.local_ip = cfg->local_ip;
1458                         udp_conf.peer_ip = cfg->peer_ip;
1459                         udp_conf.use_udp_checksums = cfg->use_udp_checksums;
1460                 }
1461
1462                 udp_conf.local_udp_port = htons(cfg->local_udp_port);
1463                 udp_conf.peer_udp_port = htons(cfg->peer_udp_port);
1464
1465                 err = udp_sock_create(net, &udp_conf, &sock);
1466                 if (err < 0)
1467                         goto out;
1468
1469                 break;
1470
1471         case L2TP_ENCAPTYPE_IP:
1472 #if IS_ENABLED(CONFIG_IPV6)
1473                 if (cfg->local_ip6 && cfg->peer_ip6) {
1474                         struct sockaddr_l2tpip6 ip6_addr = {0};
1475
1476                         err = sock_create_kern(net, AF_INET6, SOCK_DGRAM,
1477                                           IPPROTO_L2TP, &sock);
1478                         if (err < 0)
1479                                 goto out;
1480
1481                         ip6_addr.l2tp_family = AF_INET6;
1482                         memcpy(&ip6_addr.l2tp_addr, cfg->local_ip6,
1483                                sizeof(ip6_addr.l2tp_addr));
1484                         ip6_addr.l2tp_conn_id = tunnel_id;
1485                         err = kernel_bind(sock, (struct sockaddr *) &ip6_addr,
1486                                           sizeof(ip6_addr));
1487                         if (err < 0)
1488                                 goto out;
1489
1490                         ip6_addr.l2tp_family = AF_INET6;
1491                         memcpy(&ip6_addr.l2tp_addr, cfg->peer_ip6,
1492                                sizeof(ip6_addr.l2tp_addr));
1493                         ip6_addr.l2tp_conn_id = peer_tunnel_id;
1494                         err = kernel_connect(sock,
1495                                              (struct sockaddr *) &ip6_addr,
1496                                              sizeof(ip6_addr), 0);
1497                         if (err < 0)
1498                                 goto out;
1499                 } else
1500 #endif
1501                 {
1502                         struct sockaddr_l2tpip ip_addr = {0};
1503
1504                         err = sock_create_kern(net, AF_INET, SOCK_DGRAM,
1505                                           IPPROTO_L2TP, &sock);
1506                         if (err < 0)
1507                                 goto out;
1508
1509                         ip_addr.l2tp_family = AF_INET;
1510                         ip_addr.l2tp_addr = cfg->local_ip;
1511                         ip_addr.l2tp_conn_id = tunnel_id;
1512                         err = kernel_bind(sock, (struct sockaddr *) &ip_addr,
1513                                           sizeof(ip_addr));
1514                         if (err < 0)
1515                                 goto out;
1516
1517                         ip_addr.l2tp_family = AF_INET;
1518                         ip_addr.l2tp_addr = cfg->peer_ip;
1519                         ip_addr.l2tp_conn_id = peer_tunnel_id;
1520                         err = kernel_connect(sock, (struct sockaddr *) &ip_addr,
1521                                              sizeof(ip_addr), 0);
1522                         if (err < 0)
1523                                 goto out;
1524                 }
1525                 break;
1526
1527         default:
1528                 goto out;
1529         }
1530
1531 out:
1532         *sockp = sock;
1533         if ((err < 0) && sock) {
1534                 kernel_sock_shutdown(sock, SHUT_RDWR);
1535                 sock_release(sock);
1536                 *sockp = NULL;
1537         }
1538
1539         return err;
1540 }
1541
1542 static struct lock_class_key l2tp_socket_class;
1543
1544 int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp)
1545 {
1546         struct l2tp_tunnel *tunnel = NULL;
1547         int err;
1548         struct socket *sock = NULL;
1549         struct sock *sk = NULL;
1550         struct l2tp_net *pn;
1551         enum l2tp_encap_type encap = L2TP_ENCAPTYPE_UDP;
1552
1553         /* Get the tunnel socket from the fd, which was opened by
1554          * the userspace L2TP daemon. If not specified, create a
1555          * kernel socket.
1556          */
1557         if (fd < 0) {
1558                 err = l2tp_tunnel_sock_create(net, tunnel_id, peer_tunnel_id,
1559                                 cfg, &sock);
1560                 if (err < 0)
1561                         goto err;
1562         } else {
1563                 sock = sockfd_lookup(fd, &err);
1564                 if (!sock) {
1565                         pr_err("tunl %u: sockfd_lookup(fd=%d) returned %d\n",
1566                                tunnel_id, fd, err);
1567                         err = -EBADF;
1568                         goto err;
1569                 }
1570
1571                 /* Reject namespace mismatches */
1572                 if (!net_eq(sock_net(sock->sk), net)) {
1573                         pr_err("tunl %u: netns mismatch\n", tunnel_id);
1574                         err = -EINVAL;
1575                         goto err;
1576                 }
1577         }
1578
1579         sk = sock->sk;
1580
1581         if (cfg != NULL)
1582                 encap = cfg->encap;
1583
1584         /* Quick sanity checks */
1585         err = -EPROTONOSUPPORT;
1586         if (sk->sk_type != SOCK_DGRAM) {
1587                 pr_debug("tunl %hu: fd %d wrong socket type\n",
1588                          tunnel_id, fd);
1589                 goto err;
1590         }
1591         if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)
1592                 goto err;
1593         switch (encap) {
1594         case L2TP_ENCAPTYPE_UDP:
1595                 if (sk->sk_protocol != IPPROTO_UDP) {
1596                         pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
1597                                tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
1598                         goto err;
1599                 }
1600                 break;
1601         case L2TP_ENCAPTYPE_IP:
1602                 if (sk->sk_protocol != IPPROTO_L2TP) {
1603                         pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
1604                                tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP);
1605                         goto err;
1606                 }
1607                 break;
1608         }
1609
1610         /* Check if this socket has already been prepped */
1611         tunnel = l2tp_tunnel(sk);
1612         if (tunnel != NULL) {
1613                 /* This socket has already been prepped */
1614                 err = -EBUSY;
1615                 goto err;
1616         }
1617
1618         tunnel = kzalloc(sizeof(struct l2tp_tunnel), GFP_KERNEL);
1619         if (tunnel == NULL) {
1620                 err = -ENOMEM;
1621                 goto err;
1622         }
1623
1624         tunnel->version = version;
1625         tunnel->tunnel_id = tunnel_id;
1626         tunnel->peer_tunnel_id = peer_tunnel_id;
1627         tunnel->debug = L2TP_DEFAULT_DEBUG_FLAGS;
1628
1629         tunnel->magic = L2TP_TUNNEL_MAGIC;
1630         sprintf(&tunnel->name[0], "tunl %u", tunnel_id);
1631         rwlock_init(&tunnel->hlist_lock);
1632         tunnel->acpt_newsess = true;
1633
1634         /* The net we belong to */
1635         tunnel->l2tp_net = net;
1636         pn = l2tp_pernet(net);
1637
1638         if (cfg != NULL)
1639                 tunnel->debug = cfg->debug;
1640
1641         /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
1642         tunnel->encap = encap;
1643         if (encap == L2TP_ENCAPTYPE_UDP) {
1644                 struct udp_tunnel_sock_cfg udp_cfg = { };
1645
1646                 udp_cfg.sk_user_data = tunnel;
1647                 udp_cfg.encap_type = UDP_ENCAP_L2TPINUDP;
1648                 udp_cfg.encap_rcv = l2tp_udp_encap_recv;
1649                 udp_cfg.encap_destroy = l2tp_udp_encap_destroy;
1650
1651                 setup_udp_tunnel_sock(net, sock, &udp_cfg);
1652         } else {
1653                 sk->sk_user_data = tunnel;
1654         }
1655
1656         /* Hook on the tunnel socket destructor so that we can cleanup
1657          * if the tunnel socket goes away.
1658          */
1659         tunnel->old_sk_destruct = sk->sk_destruct;
1660         sk->sk_destruct = &l2tp_tunnel_destruct;
1661         tunnel->sock = sk;
1662         tunnel->fd = fd;
1663         lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock");
1664
1665         sk->sk_allocation = GFP_ATOMIC;
1666
1667         /* Init delete workqueue struct */
1668         INIT_WORK(&tunnel->del_work, l2tp_tunnel_del_work);
1669
1670         /* Add tunnel to our list */
1671         INIT_LIST_HEAD(&tunnel->list);
1672         atomic_inc(&l2tp_tunnel_count);
1673
1674         /* Bump the reference count. The tunnel context is deleted
1675          * only when this drops to zero. Must be done before list insertion
1676          */
1677         l2tp_tunnel_inc_refcount(tunnel);
1678         spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1679         list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
1680         spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
1681
1682         err = 0;
1683 err:
1684         if (tunnelp)
1685                 *tunnelp = tunnel;
1686
1687         /* If tunnel's socket was created by the kernel, it doesn't
1688          *  have a file.
1689          */
1690         if (sock && sock->file)
1691                 sockfd_put(sock);
1692
1693         return err;
1694 }
1695 EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
1696
1697 /* This function is used by the netlink TUNNEL_DELETE command.
1698  */
1699 void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
1700 {
1701         if (!test_and_set_bit(0, &tunnel->dead)) {
1702                 l2tp_tunnel_inc_refcount(tunnel);
1703                 queue_work(l2tp_wq, &tunnel->del_work);
1704         }
1705 }
1706 EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
1707
1708 /* Really kill the session.
1709  */
1710 void l2tp_session_free(struct l2tp_session *session)
1711 {
1712         struct l2tp_tunnel *tunnel = session->tunnel;
1713
1714         BUG_ON(atomic_read(&session->ref_count) != 0);
1715
1716         if (tunnel) {
1717                 BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
1718                 if (session->session_id != 0)
1719                         atomic_dec(&l2tp_session_count);
1720                 sock_put(tunnel->sock);
1721                 session->tunnel = NULL;
1722                 l2tp_tunnel_dec_refcount(tunnel);
1723         }
1724
1725         kfree(session);
1726 }
1727 EXPORT_SYMBOL_GPL(l2tp_session_free);
1728
1729 /* Remove an l2tp session from l2tp_core's hash lists.
1730  * Provides a tidyup interface for pseudowire code which can't just route all
1731  * shutdown via. l2tp_session_delete and a pseudowire-specific session_close
1732  * callback.
1733  */
1734 void __l2tp_session_unhash(struct l2tp_session *session)
1735 {
1736         struct l2tp_tunnel *tunnel = session->tunnel;
1737
1738         /* Remove the session from core hashes */
1739         if (tunnel) {
1740                 /* Remove from the per-tunnel hash */
1741                 write_lock_bh(&tunnel->hlist_lock);
1742                 hlist_del_init(&session->hlist);
1743                 write_unlock_bh(&tunnel->hlist_lock);
1744
1745                 /* For L2TPv3 we have a per-net hash: remove from there, too */
1746                 if (tunnel->version != L2TP_HDR_VER_2) {
1747                         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1748                         spin_lock_bh(&pn->l2tp_session_hlist_lock);
1749                         hlist_del_init_rcu(&session->global_hlist);
1750                         spin_unlock_bh(&pn->l2tp_session_hlist_lock);
1751                         synchronize_rcu();
1752                 }
1753         }
1754 }
1755 EXPORT_SYMBOL_GPL(__l2tp_session_unhash);
1756
1757 /* This function is used by the netlink SESSION_DELETE command and by
1758    pseudowire modules.
1759  */
1760 int l2tp_session_delete(struct l2tp_session *session)
1761 {
1762         if (test_and_set_bit(0, &session->dead))
1763                 return 0;
1764
1765         if (session->ref)
1766                 (*session->ref)(session);
1767         __l2tp_session_unhash(session);
1768         l2tp_session_queue_purge(session);
1769         if (session->session_close != NULL)
1770                 (*session->session_close)(session);
1771         if (session->deref)
1772                 (*session->deref)(session);
1773         l2tp_session_dec_refcount(session);
1774         return 0;
1775 }
1776 EXPORT_SYMBOL_GPL(l2tp_session_delete);
1777
1778 /* We come here whenever a session's send_seq, cookie_len or
1779  * l2specific_type parameters are set.
1780  */
1781 void l2tp_session_set_header_len(struct l2tp_session *session, int version)
1782 {
1783         if (version == L2TP_HDR_VER_2) {
1784                 session->hdr_len = 6;
1785                 if (session->send_seq)
1786                         session->hdr_len += 4;
1787         } else {
1788                 session->hdr_len = 4 + session->cookie_len;
1789                 session->hdr_len += l2tp_get_l2specific_len(session);
1790                 if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)
1791                         session->hdr_len += 4;
1792         }
1793
1794 }
1795 EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
1796
1797 struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
1798 {
1799         struct l2tp_session *session;
1800
1801         session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL);
1802         if (session != NULL) {
1803                 session->magic = L2TP_SESSION_MAGIC;
1804                 session->tunnel = tunnel;
1805
1806                 session->session_id = session_id;
1807                 session->peer_session_id = peer_session_id;
1808                 session->nr = 0;
1809                 if (tunnel->version == L2TP_HDR_VER_2)
1810                         session->nr_max = 0xffff;
1811                 else
1812                         session->nr_max = 0xffffff;
1813                 session->nr_window_size = session->nr_max / 2;
1814                 session->nr_oos_count_max = 4;
1815
1816                 /* Use NR of first received packet */
1817                 session->reorder_skip = 1;
1818
1819                 sprintf(&session->name[0], "sess %u/%u",
1820                         tunnel->tunnel_id, session->session_id);
1821
1822                 skb_queue_head_init(&session->reorder_q);
1823
1824                 INIT_HLIST_NODE(&session->hlist);
1825                 INIT_HLIST_NODE(&session->global_hlist);
1826
1827                 /* Inherit debug options from tunnel */
1828                 session->debug = tunnel->debug;
1829
1830                 if (cfg) {
1831                         session->pwtype = cfg->pw_type;
1832                         session->debug = cfg->debug;
1833                         session->mtu = cfg->mtu;
1834                         session->mru = cfg->mru;
1835                         session->send_seq = cfg->send_seq;
1836                         session->recv_seq = cfg->recv_seq;
1837                         session->lns_mode = cfg->lns_mode;
1838                         session->reorder_timeout = cfg->reorder_timeout;
1839                         session->l2specific_type = cfg->l2specific_type;
1840                         session->l2specific_len = cfg->l2specific_len;
1841                         session->cookie_len = cfg->cookie_len;
1842                         memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);
1843                         session->peer_cookie_len = cfg->peer_cookie_len;
1844                         memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);
1845                 }
1846
1847                 if (tunnel->version == L2TP_HDR_VER_2)
1848                         session->build_header = l2tp_build_l2tpv2_header;
1849                 else
1850                         session->build_header = l2tp_build_l2tpv3_header;
1851
1852                 l2tp_session_set_header_len(session, tunnel->version);
1853
1854                 l2tp_session_inc_refcount(session);
1855
1856                 return session;
1857         }
1858
1859         return ERR_PTR(-ENOMEM);
1860 }
1861 EXPORT_SYMBOL_GPL(l2tp_session_create);
1862
1863 /*****************************************************************************
1864  * Init and cleanup
1865  *****************************************************************************/
1866
1867 static __net_init int l2tp_init_net(struct net *net)
1868 {
1869         struct l2tp_net *pn = net_generic(net, l2tp_net_id);
1870         int hash;
1871
1872         INIT_LIST_HEAD(&pn->l2tp_tunnel_list);
1873         spin_lock_init(&pn->l2tp_tunnel_list_lock);
1874
1875         for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
1876                 INIT_HLIST_HEAD(&pn->l2tp_session_hlist[hash]);
1877
1878         spin_lock_init(&pn->l2tp_session_hlist_lock);
1879
1880         return 0;
1881 }
1882
1883 static __net_exit void l2tp_exit_net(struct net *net)
1884 {
1885         struct l2tp_net *pn = l2tp_pernet(net);
1886         struct l2tp_tunnel *tunnel = NULL;
1887
1888         rcu_read_lock_bh();
1889         list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
1890                 l2tp_tunnel_delete(tunnel);
1891         }
1892         rcu_read_unlock_bh();
1893
1894         if (l2tp_wq)
1895                 flush_workqueue(l2tp_wq);
1896         rcu_barrier();
1897 }
1898
1899 static struct pernet_operations l2tp_net_ops = {
1900         .init = l2tp_init_net,
1901         .exit = l2tp_exit_net,
1902         .id   = &l2tp_net_id,
1903         .size = sizeof(struct l2tp_net),
1904 };
1905
1906 static int __init l2tp_init(void)
1907 {
1908         int rc = 0;
1909
1910         rc = register_pernet_device(&l2tp_net_ops);
1911         if (rc)
1912                 goto out;
1913
1914         l2tp_wq = alloc_workqueue("l2tp", WQ_UNBOUND, 0);
1915         if (!l2tp_wq) {
1916                 pr_err("alloc_workqueue failed\n");
1917                 unregister_pernet_device(&l2tp_net_ops);
1918                 rc = -ENOMEM;
1919                 goto out;
1920         }
1921
1922         pr_info("L2TP core driver, %s\n", L2TP_DRV_VERSION);
1923
1924 out:
1925         return rc;
1926 }
1927
1928 static void __exit l2tp_exit(void)
1929 {
1930         unregister_pernet_device(&l2tp_net_ops);
1931         if (l2tp_wq) {
1932                 destroy_workqueue(l2tp_wq);
1933                 l2tp_wq = NULL;
1934         }
1935 }
1936
1937 module_init(l2tp_init);
1938 module_exit(l2tp_exit);
1939
1940 MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
1941 MODULE_DESCRIPTION("L2TP core");
1942 MODULE_LICENSE("GPL");
1943 MODULE_VERSION(L2TP_DRV_VERSION);
1944