net/l2tp/l2tp_core.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /* L2TP core.
   3  *
   4  * Copyright (c) 2008,2009,2010 Katalix Systems Ltd
   5  *
   6  * This file contains some code of the original L2TPv2 pppol2tp
   7  * driver, which has the following copyright:
   8  *
   9  * Authors:     Martijn van Oosterhout <[email protected]>
  10  *              James Chapman ([email protected])
  11  * Contributors:
  12  *              Michal Ostrowski <[email protected]>
  13  *              Arnaldo Carvalho de Melo <[email protected]>
  14  *              David S. Miller ([email protected])
  15  */
  16
  17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  18
  19 #include <linux/module.h>
  20 #include <linux/string.h>
  21 #include <linux/list.h>
  22 #include <linux/rculist.h>
  23 #include <linux/uaccess.h>
  24
  25 #include <linux/kernel.h>
  26 #include <linux/spinlock.h>
  27 #include <linux/kthread.h>
  28 #include <linux/sched.h>
  29 #include <linux/slab.h>
  30 #include <linux/errno.h>
  31 #include <linux/jiffies.h>
  32
  33 #include <linux/netdevice.h>
  34 #include <linux/net.h>
  35 #include <linux/inetdevice.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/init.h>
  38 #include <linux/in.h>
  39 #include <linux/ip.h>
  40 #include <linux/udp.h>
  41 #include <linux/l2tp.h>
  42 #include <linux/sort.h>
  43 #include <linux/file.h>
  44 #include <linux/nsproxy.h>
  45 #include <net/net_namespace.h>
  46 #include <net/netns/generic.h>
  47 #include <net/dst.h>
  48 #include <net/ip.h>
  49 #include <net/udp.h>
  50 #include <net/udp_tunnel.h>
  51 #include <net/inet_common.h>
  52 #include <net/xfrm.h>
  53 #include <net/protocol.h>
  54 #include <net/inet6_connection_sock.h>
  55 #include <net/inet_ecn.h>
  56 #include <net/ip6_route.h>
  57 #include <net/ip6_checksum.h>
  58
  59 #include <asm/byteorder.h>
  60 #include <linux/atomic.h>
  61
  62 #include "l2tp_core.h"
  63
  64 #define CREATE_TRACE_POINTS
  65 #include "trace.h"
  66
  67 #define L2TP_DRV_VERSION        "V2.0"
  68
  69 /* L2TP header constants */
  70 #define L2TP_HDRFLAG_T     0x8000
  71 #define L2TP_HDRFLAG_L     0x4000
  72 #define L2TP_HDRFLAG_S     0x0800
  73 #define L2TP_HDRFLAG_O     0x0200
  74 #define L2TP_HDRFLAG_P     0x0100
  75
  76 #define L2TP_HDR_VER_MASK  0x000F
  77 #define L2TP_HDR_VER_2     0x0002
  78 #define L2TP_HDR_VER_3     0x0003
  79
  80 /* L2TPv3 default L2-specific sublayer */
  81 #define L2TP_SLFLAG_S      0x40000000
  82 #define L2TP_SL_SEQ_MASK   0x00ffffff
  83
  84 #define L2TP_HDR_SIZE_MAX               14
  85
  86 /* Default trace flags */
  87 #define L2TP_DEFAULT_DEBUG_FLAGS        0
  88
  89 #define L2TP_DEPTH_NESTING              2
  90 #if L2TP_DEPTH_NESTING == SINGLE_DEPTH_NESTING
  91 #error "L2TP requires its own lockdep subclass"
  92 #endif
  93
  94 /* Private data stored for received packets in the skb.
  95  */
  96 struct l2tp_skb_cb {
  97         u32                     ns;
  98         u16                     has_seq;
  99         u16                     length;
 100         unsigned long           expires;
 101 };
 102
 103 #define L2TP_SKB_CB(skb)        ((struct l2tp_skb_cb *)&(skb)->cb[sizeof(struct inet_skb_parm)])
 104
 105 static struct workqueue_struct *l2tp_wq;
 106
 107 /* per-net private data for this module */
 108 static unsigned int l2tp_net_id;
 109 struct l2tp_net {
 110         /* Lock for write access to l2tp_tunnel_idr */
 111         spinlock_t l2tp_tunnel_idr_lock;
 112         struct idr l2tp_tunnel_idr;
 113         /* Lock for write access to l2tp_v[23]_session_idr/htable */
 114         spinlock_t l2tp_session_idr_lock;
 115         struct idr l2tp_v2_session_idr;
 116         struct idr l2tp_v3_session_idr;
 117         struct hlist_head l2tp_v3_session_htable[16];
 118 };
 119
 120 static inline u32 l2tp_v2_session_key(u16 tunnel_id, u16 session_id)
 121 {
 122         return ((u32)tunnel_id) << 16 | session_id;
 123 }
 124
 125 static inline unsigned long l2tp_v3_session_hashkey(struct sock *sk, u32 session_id)
 126 {
 127         return ((unsigned long)sk) + session_id;
 128 }
 129
 130 #if IS_ENABLED(CONFIG_IPV6)
 131 static bool l2tp_sk_is_v6(struct sock *sk)
 132 {
 133         return sk->sk_family == PF_INET6 &&
 134                !ipv6_addr_v4mapped(&sk->sk_v6_daddr);
 135 }
 136 #endif
 137
 138 static inline struct l2tp_net *l2tp_pernet(const struct net *net)
 139 {
 140         return net_generic(net, l2tp_net_id);
 141 }
 142
 143 static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
 144 {
 145         trace_free_tunnel(tunnel);
 146         sock_put(tunnel->sock);
 147         /* the tunnel is freed in the socket destructor */
 148 }
 149
 150 static void l2tp_session_free(struct l2tp_session *session)
 151 {
 152         trace_free_session(session);
 153         if (session->tunnel)
 154                 l2tp_tunnel_dec_refcount(session->tunnel);
 155         kfree(session);
 156 }
 157
 158 struct l2tp_tunnel *l2tp_sk_to_tunnel(struct sock *sk)
 159 {
 160         struct l2tp_tunnel *tunnel = sk->sk_user_data;
 161
 162         if (tunnel)
 163                 if (WARN_ON(tunnel->magic != L2TP_TUNNEL_MAGIC))
 164                         return NULL;
 165
 166         return tunnel;
 167 }
 168 EXPORT_SYMBOL_GPL(l2tp_sk_to_tunnel);
 169
 170 void l2tp_tunnel_inc_refcount(struct l2tp_tunnel *tunnel)
 171 {
 172         refcount_inc(&tunnel->ref_count);
 173 }
 174 EXPORT_SYMBOL_GPL(l2tp_tunnel_inc_refcount);
 175
 176 void l2tp_tunnel_dec_refcount(struct l2tp_tunnel *tunnel)
 177 {
 178         if (refcount_dec_and_test(&tunnel->ref_count))
 179                 l2tp_tunnel_free(tunnel);
 180 }
 181 EXPORT_SYMBOL_GPL(l2tp_tunnel_dec_refcount);
 182
 183 void l2tp_session_inc_refcount(struct l2tp_session *session)
 184 {
 185         refcount_inc(&session->ref_count);
 186 }
 187 EXPORT_SYMBOL_GPL(l2tp_session_inc_refcount);
 188
 189 void l2tp_session_dec_refcount(struct l2tp_session *session)
 190 {
 191         if (refcount_dec_and_test(&session->ref_count))
 192                 l2tp_session_free(session);
 193 }
 194 EXPORT_SYMBOL_GPL(l2tp_session_dec_refcount);
 195
 196 /* Lookup a tunnel. A new reference is held on the returned tunnel. */
 197 struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id)
 198 {
 199         const struct l2tp_net *pn = l2tp_pernet(net);
 200         struct l2tp_tunnel *tunnel;
 201
 202         rcu_read_lock_bh();
 203         tunnel = idr_find(&pn->l2tp_tunnel_idr, tunnel_id);
 204         if (tunnel && refcount_inc_not_zero(&tunnel->ref_count)) {
 205                 rcu_read_unlock_bh();
 206                 return tunnel;
 207         }
 208         rcu_read_unlock_bh();
 209
 210         return NULL;
 211 }
 212 EXPORT_SYMBOL_GPL(l2tp_tunnel_get);
 213
 214 struct l2tp_tunnel *l2tp_tunnel_get_nth(const struct net *net, int nth)
 215 {
 216         struct l2tp_net *pn = l2tp_pernet(net);
 217         unsigned long tunnel_id, tmp;
 218         struct l2tp_tunnel *tunnel;
 219         int count = 0;
 220
 221         rcu_read_lock_bh();
 222         idr_for_each_entry_ul(&pn->l2tp_tunnel_idr, tunnel, tmp, tunnel_id) {
 223                 if (tunnel && ++count > nth &&
 224                     refcount_inc_not_zero(&tunnel->ref_count)) {
 225                         rcu_read_unlock_bh();
 226                         return tunnel;
 227                 }
 228         }
 229         rcu_read_unlock_bh();
 230
 231         return NULL;
 232 }
 233 EXPORT_SYMBOL_GPL(l2tp_tunnel_get_nth);
 234
 235 struct l2tp_session *l2tp_v3_session_get(const struct net *net, struct sock *sk, u32 session_id)
 236 {
 237         const struct l2tp_net *pn = l2tp_pernet(net);
 238         struct l2tp_session *session;
 239
 240         rcu_read_lock_bh();
 241         session = idr_find(&pn->l2tp_v3_session_idr, session_id);
 242         if (session && !hash_hashed(&session->hlist) &&
 243             refcount_inc_not_zero(&session->ref_count)) {
 244                 rcu_read_unlock_bh();
 245                 return session;
 246         }
 247
 248         /* If we get here and session is non-NULL, the session_id
 249          * collides with one in another tunnel. If sk is non-NULL,
 250          * find the session matching sk.
 251          */
 252         if (session && sk) {
 253                 unsigned long key = l2tp_v3_session_hashkey(sk, session->session_id);
 254
 255                 hash_for_each_possible_rcu(pn->l2tp_v3_session_htable, session,
 256                                            hlist, key) {
 257                         if (session->tunnel->sock == sk &&
 258                             refcount_inc_not_zero(&session->ref_count)) {
 259                                 rcu_read_unlock_bh();
 260                                 return session;
 261                         }
 262                 }
 263         }
 264         rcu_read_unlock_bh();
 265
 266         return NULL;
 267 }
 268 EXPORT_SYMBOL_GPL(l2tp_v3_session_get);
 269
 270 struct l2tp_session *l2tp_v2_session_get(const struct net *net, u16 tunnel_id, u16 session_id)
 271 {
 272         u32 session_key = l2tp_v2_session_key(tunnel_id, session_id);
 273         const struct l2tp_net *pn = l2tp_pernet(net);
 274         struct l2tp_session *session;
 275
 276         rcu_read_lock_bh();
 277         session = idr_find(&pn->l2tp_v2_session_idr, session_key);
 278         if (session && refcount_inc_not_zero(&session->ref_count)) {
 279                 rcu_read_unlock_bh();
 280                 return session;
 281         }
 282         rcu_read_unlock_bh();
 283
 284         return NULL;
 285 }
 286 EXPORT_SYMBOL_GPL(l2tp_v2_session_get);
 287
 288 struct l2tp_session *l2tp_session_get(const struct net *net, struct sock *sk, int pver,
 289                                       u32 tunnel_id, u32 session_id)
 290 {
 291         if (pver == L2TP_HDR_VER_2)
 292                 return l2tp_v2_session_get(net, tunnel_id, session_id);
 293         else
 294                 return l2tp_v3_session_get(net, sk, session_id);
 295 }
 296 EXPORT_SYMBOL_GPL(l2tp_session_get);
 297
 298 struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth)
 299 {
 300         struct l2tp_session *session;
 301         int count = 0;
 302
 303         rcu_read_lock_bh();
 304         list_for_each_entry_rcu(session, &tunnel->session_list, list) {
 305                 if (++count > nth) {
 306                         l2tp_session_inc_refcount(session);
 307                         rcu_read_unlock_bh();
 308                         return session;
 309                 }
 310         }
 311         rcu_read_unlock_bh();
 312
 313         return NULL;
 314 }
 315 EXPORT_SYMBOL_GPL(l2tp_session_get_nth);
 316
 317 /* Lookup a session by interface name.
 318  * This is very inefficient but is only used by management interfaces.
 319  */
 320 struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
 321                                                 const char *ifname)
 322 {
 323         struct l2tp_net *pn = l2tp_pernet(net);
 324         unsigned long tunnel_id, tmp;
 325         struct l2tp_session *session;
 326         struct l2tp_tunnel *tunnel;
 327
 328         rcu_read_lock_bh();
 329         idr_for_each_entry_ul(&pn->l2tp_tunnel_idr, tunnel, tmp, tunnel_id) {
 330                 if (tunnel) {
 331                         list_for_each_entry_rcu(session, &tunnel->session_list, list) {
 332                                 if (!strcmp(session->ifname, ifname)) {
 333                                         l2tp_session_inc_refcount(session);
 334                                         rcu_read_unlock_bh();
 335
 336                                         return session;
 337                                 }
 338                         }
 339                 }
 340         }
 341         rcu_read_unlock_bh();
 342
 343         return NULL;
 344 }
 345 EXPORT_SYMBOL_GPL(l2tp_session_get_by_ifname);
 346
 347 static void l2tp_session_coll_list_add(struct l2tp_session_coll_list *clist,
 348                                        struct l2tp_session *session)
 349 {
 350         l2tp_session_inc_refcount(session);
 351         WARN_ON_ONCE(session->coll_list);
 352         session->coll_list = clist;
 353         spin_lock(&clist->lock);
 354         list_add(&session->clist, &clist->list);
 355         spin_unlock(&clist->lock);
 356 }
 357
 358 static int l2tp_session_collision_add(struct l2tp_net *pn,
 359                                       struct l2tp_session *session1,
 360                                       struct l2tp_session *session2)
 361 {
 362         struct l2tp_session_coll_list *clist;
 363
 364         lockdep_assert_held(&pn->l2tp_session_idr_lock);
 365
 366         if (!session2)
 367                 return -EEXIST;
 368
 369         /* If existing session is in IP-encap tunnel, refuse new session */
 370         if (session2->tunnel->encap == L2TP_ENCAPTYPE_IP)
 371                 return -EEXIST;
 372
 373         clist = session2->coll_list;
 374         if (!clist) {
 375                 /* First collision. Allocate list to manage the collided sessions
 376                  * and add the existing session to the list.
 377                  */
 378                 clist = kmalloc(sizeof(*clist), GFP_ATOMIC);
 379                 if (!clist)
 380                         return -ENOMEM;
 381
 382                 spin_lock_init(&clist->lock);
 383                 INIT_LIST_HEAD(&clist->list);
 384                 refcount_set(&clist->ref_count, 1);
 385                 l2tp_session_coll_list_add(clist, session2);
 386         }
 387
 388         /* If existing session isn't already in the session hlist, add it. */
 389         if (!hash_hashed(&session2->hlist))
 390                 hash_add(pn->l2tp_v3_session_htable, &session2->hlist,
 391                          session2->hlist_key);
 392
 393         /* Add new session to the hlist and collision list */
 394         hash_add(pn->l2tp_v3_session_htable, &session1->hlist,
 395                  session1->hlist_key);
 396         refcount_inc(&clist->ref_count);
 397         l2tp_session_coll_list_add(clist, session1);
 398
 399         return 0;
 400 }
 401
 402 static void l2tp_session_collision_del(struct l2tp_net *pn,
 403                                        struct l2tp_session *session)
 404 {
 405         struct l2tp_session_coll_list *clist = session->coll_list;
 406         unsigned long session_key = session->session_id;
 407         struct l2tp_session *session2;
 408
 409         lockdep_assert_held(&pn->l2tp_session_idr_lock);
 410
 411         hash_del(&session->hlist);
 412
 413         if (clist) {
 414                 /* Remove session from its collision list. If there
 415                  * are other sessions with the same ID, replace this
 416                  * session's IDR entry with that session, otherwise
 417                  * remove the IDR entry. If this is the last session,
 418                  * the collision list data is freed.
 419                  */
 420                 spin_lock(&clist->lock);
 421                 list_del_init(&session->clist);
 422                 session2 = list_first_entry_or_null(&clist->list, struct l2tp_session, clist);
 423                 if (session2) {
 424                         void *old = idr_replace(&pn->l2tp_v3_session_idr, session2, session_key);
 425
 426                         WARN_ON_ONCE(IS_ERR_VALUE(old));
 427                 } else {
 428                         void *removed = idr_remove(&pn->l2tp_v3_session_idr, session_key);
 429
 430                         WARN_ON_ONCE(removed != session);
 431                 }
 432                 session->coll_list = NULL;
 433                 spin_unlock(&clist->lock);
 434                 if (refcount_dec_and_test(&clist->ref_count))
 435                         kfree(clist);
 436                 l2tp_session_dec_refcount(session);
 437         }
 438 }
 439
 440 int l2tp_session_register(struct l2tp_session *session,
 441                           struct l2tp_tunnel *tunnel)
 442 {
 443         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
 444         struct l2tp_session *other_session = NULL;
 445         u32 session_key;
 446         int err;
 447
 448         spin_lock_bh(&tunnel->list_lock);
 449         spin_lock_bh(&pn->l2tp_session_idr_lock);
 450
 451         if (!tunnel->acpt_newsess) {
 452                 err = -ENODEV;
 453                 goto out;
 454         }
 455
 456         if (tunnel->version == L2TP_HDR_VER_3) {
 457                 session_key = session->session_id;
 458                 err = idr_alloc_u32(&pn->l2tp_v3_session_idr, NULL,
 459                                     &session_key, session_key, GFP_ATOMIC);
 460                 /* IP encap expects session IDs to be globally unique, while
 461                  * UDP encap doesn't. This isn't per the RFC, which says that
 462                  * sessions are identified only by the session ID, but is to
 463                  * support existing userspace which depends on it.
 464                  */
 465                 if (err == -ENOSPC && tunnel->encap == L2TP_ENCAPTYPE_UDP) {
 466                         other_session = idr_find(&pn->l2tp_v3_session_idr,
 467                                                  session_key);
 468                         err = l2tp_session_collision_add(pn, session,
 469                                                          other_session);
 470                 }
 471         } else {
 472                 session_key = l2tp_v2_session_key(tunnel->tunnel_id,
 473                                                   session->session_id);
 474                 err = idr_alloc_u32(&pn->l2tp_v2_session_idr, NULL,
 475                                     &session_key, session_key, GFP_ATOMIC);
 476         }
 477
 478         if (err) {
 479                 if (err == -ENOSPC)
 480                         err = -EEXIST;
 481                 goto out;
 482         }
 483
 484         l2tp_tunnel_inc_refcount(tunnel);
 485         list_add(&session->list, &tunnel->session_list);
 486
 487         if (tunnel->version == L2TP_HDR_VER_3) {
 488                 if (!other_session)
 489                         idr_replace(&pn->l2tp_v3_session_idr, session, session_key);
 490         } else {
 491                 idr_replace(&pn->l2tp_v2_session_idr, session, session_key);
 492         }
 493
 494 out:
 495         spin_unlock_bh(&pn->l2tp_session_idr_lock);
 496         spin_unlock_bh(&tunnel->list_lock);
 497
 498         if (!err)
 499                 trace_register_session(session);
 500
 501         return err;
 502 }
 503 EXPORT_SYMBOL_GPL(l2tp_session_register);
 504
 505 /*****************************************************************************
 506  * Receive data handling
 507  *****************************************************************************/
 508
 509 /* Queue a skb in order. We come here only if the skb has an L2TP sequence
 510  * number.
 511  */
 512 static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)
 513 {
 514         struct sk_buff *skbp;
 515         struct sk_buff *tmp;
 516         u32 ns = L2TP_SKB_CB(skb)->ns;
 517
 518         spin_lock_bh(&session->reorder_q.lock);
 519         skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
 520                 if (L2TP_SKB_CB(skbp)->ns > ns) {
 521                         __skb_queue_before(&session->reorder_q, skbp, skb);
 522                         atomic_long_inc(&session->stats.rx_oos_packets);
 523                         goto out;
 524                 }
 525         }
 526
 527         __skb_queue_tail(&session->reorder_q, skb);
 528
 529 out:
 530         spin_unlock_bh(&session->reorder_q.lock);
 531 }
 532
 533 /* Dequeue a single skb.
 534  */
 535 static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)
 536 {
 537         struct l2tp_tunnel *tunnel = session->tunnel;
 538         int length = L2TP_SKB_CB(skb)->length;
 539
 540         /* We're about to requeue the skb, so return resources
 541          * to its current owner (a socket receive buffer).
 542          */
 543         skb_orphan(skb);
 544
 545         atomic_long_inc(&tunnel->stats.rx_packets);
 546         atomic_long_add(length, &tunnel->stats.rx_bytes);
 547         atomic_long_inc(&session->stats.rx_packets);
 548         atomic_long_add(length, &session->stats.rx_bytes);
 549
 550         if (L2TP_SKB_CB(skb)->has_seq) {
 551                 /* Bump our Nr */
 552                 session->nr++;
 553                 session->nr &= session->nr_max;
 554                 trace_session_seqnum_update(session);
 555         }
 556
 557         /* call private receive handler */
 558         if (session->recv_skb)
 559                 (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);
 560         else
 561                 kfree_skb(skb);
 562 }
 563
 564 /* Dequeue skbs from the session's reorder_q, subject to packet order.
 565  * Skbs that have been in the queue for too long are simply discarded.
 566  */
 567 static void l2tp_recv_dequeue(struct l2tp_session *session)
 568 {
 569         struct sk_buff *skb;
 570         struct sk_buff *tmp;
 571
 572         /* If the pkt at the head of the queue has the nr that we
 573          * expect to send up next, dequeue it and any other
 574          * in-sequence packets behind it.
 575          */
 576 start:
 577         spin_lock_bh(&session->reorder_q.lock);
 578         skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
 579                 struct l2tp_skb_cb *cb = L2TP_SKB_CB(skb);
 580
 581                 /* If the packet has been pending on the queue for too long, discard it */
 582                 if (time_after(jiffies, cb->expires)) {
 583                         atomic_long_inc(&session->stats.rx_seq_discards);
 584                         atomic_long_inc(&session->stats.rx_errors);
 585                         trace_session_pkt_expired(session, cb->ns);
 586                         session->reorder_skip = 1;
 587                         __skb_unlink(skb, &session->reorder_q);
 588                         kfree_skb(skb);
 589                         continue;
 590                 }
 591
 592                 if (cb->has_seq) {
 593                         if (session->reorder_skip) {
 594                                 session->reorder_skip = 0;
 595                                 session->nr = cb->ns;
 596                                 trace_session_seqnum_reset(session);
 597                         }
 598                         if (cb->ns != session->nr)
 599                                 goto out;
 600                 }
 601                 __skb_unlink(skb, &session->reorder_q);
 602
 603                 /* Process the skb. We release the queue lock while we
 604                  * do so to let other contexts process the queue.
 605                  */
 606                 spin_unlock_bh(&session->reorder_q.lock);
 607                 l2tp_recv_dequeue_skb(session, skb);
 608                 goto start;
 609         }
 610
 611 out:
 612         spin_unlock_bh(&session->reorder_q.lock);
 613 }
 614
 615 static int l2tp_seq_check_rx_window(struct l2tp_session *session, u32 nr)
 616 {
 617         u32 nws;
 618
 619         if (nr >= session->nr)
 620                 nws = nr - session->nr;
 621         else
 622                 nws = (session->nr_max + 1) - (session->nr - nr);
 623
 624         return nws < session->nr_window_size;
 625 }
 626
 627 /* If packet has sequence numbers, queue it if acceptable. Returns 0 if
 628  * acceptable, else non-zero.
 629  */
 630 static int l2tp_recv_data_seq(struct l2tp_session *session, struct sk_buff *skb)
 631 {
 632         struct l2tp_skb_cb *cb = L2TP_SKB_CB(skb);
 633
 634         if (!l2tp_seq_check_rx_window(session, cb->ns)) {
 635                 /* Packet sequence number is outside allowed window.
 636                  * Discard it.
 637                  */
 638                 trace_session_pkt_outside_rx_window(session, cb->ns);
 639                 goto discard;
 640         }
 641
 642         if (session->reorder_timeout != 0) {
 643                 /* Packet reordering enabled. Add skb to session's
 644                  * reorder queue, in order of ns.
 645                  */
 646                 l2tp_recv_queue_skb(session, skb);
 647                 goto out;
 648         }
 649
 650         /* Packet reordering disabled. Discard out-of-sequence packets, while
 651          * tracking the number if in-sequence packets after the first OOS packet
 652          * is seen. After nr_oos_count_max in-sequence packets, reset the
 653          * sequence number to re-enable packet reception.
 654          */
 655         if (cb->ns == session->nr) {
 656                 skb_queue_tail(&session->reorder_q, skb);
 657         } else {
 658                 u32 nr_oos = cb->ns;
 659                 u32 nr_next = (session->nr_oos + 1) & session->nr_max;
 660
 661                 if (nr_oos == nr_next)
 662                         session->nr_oos_count++;
 663                 else
 664                         session->nr_oos_count = 0;
 665
 666                 session->nr_oos = nr_oos;
 667                 if (session->nr_oos_count > session->nr_oos_count_max) {
 668                         session->reorder_skip = 1;
 669                 }
 670                 if (!session->reorder_skip) {
 671                         atomic_long_inc(&session->stats.rx_seq_discards);
 672                         trace_session_pkt_oos(session, cb->ns);
 673                         goto discard;
 674                 }
 675                 skb_queue_tail(&session->reorder_q, skb);
 676         }
 677
 678 out:
 679         return 0;
 680
 681 discard:
 682         return 1;
 683 }
 684
 685 /* Do receive processing of L2TP data frames. We handle both L2TPv2
 686  * and L2TPv3 data frames here.
 687  *
 688  * L2TPv2 Data Message Header
 689  *
 690  *  0                   1                   2                   3
 691  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 692  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 693  * |T|L|x|x|S|x|O|P|x|x|x|x|  Ver  |          Length (opt)         |
 694  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 695  * |           Tunnel ID           |           Session ID          |
 696  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 697  * |             Ns (opt)          |             Nr (opt)          |
 698  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 699  * |      Offset Size (opt)        |    Offset pad... (opt)
 700  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 701  *
 702  * Data frames are marked by T=0. All other fields are the same as
 703  * those in L2TP control frames.
 704  *
 705  * L2TPv3 Data Message Header
 706  *
 707  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 708  * |                      L2TP Session Header                      |
 709  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 710  * |                      L2-Specific Sublayer                     |
 711  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 712  * |                        Tunnel Payload                      ...
 713  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 714  *
 715  * L2TPv3 Session Header Over IP
 716  *
 717  *  0                   1                   2                   3
 718  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 719  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 720  * |                           Session ID                          |
 721  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 722  * |               Cookie (optional, maximum 64 bits)...
 723  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 724  *                                                                 |
 725  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 726  *
 727  * L2TPv3 L2-Specific Sublayer Format
 728  *
 729  *  0                   1                   2                   3
 730  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 731  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 732  * |x|S|x|x|x|x|x|x|              Sequence Number                  |
 733  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 734  *
 735  * Cookie value and sublayer format are negotiated with the peer when
 736  * the session is set up. Unlike L2TPv2, we do not need to parse the
 737  * packet header to determine if optional fields are present.
 738  *
 739  * Caller must already have parsed the frame and determined that it is
 740  * a data (not control) frame before coming here. Fields up to the
 741  * session-id have already been parsed and ptr points to the data
 742  * after the session-id.
 743  */
 744 void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
 745                       unsigned char *ptr, unsigned char *optr, u16 hdrflags,
 746                       int length)
 747 {
 748         struct l2tp_tunnel *tunnel = session->tunnel;
 749         int offset;
 750
 751         /* Parse and check optional cookie */
 752         if (session->peer_cookie_len > 0) {
 753                 if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
 754                         pr_debug_ratelimited("%s: cookie mismatch (%u/%u). Discarding.\n",
 755                                              tunnel->name, tunnel->tunnel_id,
 756                                              session->session_id);
 757                         atomic_long_inc(&session->stats.rx_cookie_discards);
 758                         goto discard;
 759                 }
 760                 ptr += session->peer_cookie_len;
 761         }
 762
 763         /* Handle the optional sequence numbers. Sequence numbers are
 764          * in different places for L2TPv2 and L2TPv3.
 765          *
 766          * If we are the LAC, enable/disable sequence numbers under
 767          * the control of the LNS.  If no sequence numbers present but
 768          * we were expecting them, discard frame.
 769          */
 770         L2TP_SKB_CB(skb)->has_seq = 0;
 771         if (tunnel->version == L2TP_HDR_VER_2) {
 772                 if (hdrflags & L2TP_HDRFLAG_S) {
 773                         /* Store L2TP info in the skb */
 774                         L2TP_SKB_CB(skb)->ns = ntohs(*(__be16 *)ptr);
 775                         L2TP_SKB_CB(skb)->has_seq = 1;
 776                         ptr += 2;
 777                         /* Skip past nr in the header */
 778                         ptr += 2;
 779
 780                 }
 781         } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
 782                 u32 l2h = ntohl(*(__be32 *)ptr);
 783
 784                 if (l2h & 0x40000000) {
 785                         /* Store L2TP info in the skb */
 786                         L2TP_SKB_CB(skb)->ns = l2h & 0x00ffffff;
 787                         L2TP_SKB_CB(skb)->has_seq = 1;
 788                 }
 789                 ptr += 4;
 790         }
 791
 792         if (L2TP_SKB_CB(skb)->has_seq) {
 793                 /* Received a packet with sequence numbers. If we're the LAC,
 794                  * check if we sre sending sequence numbers and if not,
 795                  * configure it so.
 796                  */
 797                 if (!session->lns_mode && !session->send_seq) {
 798                         trace_session_seqnum_lns_enable(session);
 799                         session->send_seq = 1;
 800                         l2tp_session_set_header_len(session, tunnel->version);
 801                 }
 802         } else {
 803                 /* No sequence numbers.
 804                  * If user has configured mandatory sequence numbers, discard.
 805                  */
 806                 if (session->recv_seq) {
 807                         pr_debug_ratelimited("%s: recv data has no seq numbers when required. Discarding.\n",
 808                                              session->name);
 809                         atomic_long_inc(&session->stats.rx_seq_discards);
 810                         goto discard;
 811                 }
 812
 813                 /* If we're the LAC and we're sending sequence numbers, the
 814                  * LNS has requested that we no longer send sequence numbers.
 815                  * If we're the LNS and we're sending sequence numbers, the
 816                  * LAC is broken. Discard the frame.
 817                  */
 818                 if (!session->lns_mode && session->send_seq) {
 819                         trace_session_seqnum_lns_disable(session);
 820                         session->send_seq = 0;
 821                         l2tp_session_set_header_len(session, tunnel->version);
 822                 } else if (session->send_seq) {
 823                         pr_debug_ratelimited("%s: recv data has no seq numbers when required. Discarding.\n",
 824                                              session->name);
 825                         atomic_long_inc(&session->stats.rx_seq_discards);
 826                         goto discard;
 827                 }
 828         }
 829
 830         /* Session data offset is defined only for L2TPv2 and is
 831          * indicated by an optional 16-bit value in the header.
 832          */
 833         if (tunnel->version == L2TP_HDR_VER_2) {
 834                 /* If offset bit set, skip it. */
 835                 if (hdrflags & L2TP_HDRFLAG_O) {
 836                         offset = ntohs(*(__be16 *)ptr);
 837                         ptr += 2 + offset;
 838                 }
 839         }
 840
 841         offset = ptr - optr;
 842         if (!pskb_may_pull(skb, offset))
 843                 goto discard;
 844
 845         __skb_pull(skb, offset);
 846
 847         /* Prepare skb for adding to the session's reorder_q.  Hold
 848          * packets for max reorder_timeout or 1 second if not
 849          * reordering.
 850          */
 851         L2TP_SKB_CB(skb)->length = length;
 852         L2TP_SKB_CB(skb)->expires = jiffies +
 853                 (session->reorder_timeout ? session->reorder_timeout : HZ);
 854
 855         /* Add packet to the session's receive queue. Reordering is done here, if
 856          * enabled. Saved L2TP protocol info is stored in skb->sb[].
 857          */
 858         if (L2TP_SKB_CB(skb)->has_seq) {
 859                 if (l2tp_recv_data_seq(session, skb))
 860                         goto discard;
 861         } else {
 862                 /* No sequence numbers. Add the skb to the tail of the
 863                  * reorder queue. This ensures that it will be
 864                  * delivered after all previous sequenced skbs.
 865                  */
 866                 skb_queue_tail(&session->reorder_q, skb);
 867         }
 868
 869         /* Try to dequeue as many skbs from reorder_q as we can. */
 870         l2tp_recv_dequeue(session);
 871
 872         return;
 873
 874 discard:
 875         atomic_long_inc(&session->stats.rx_errors);
 876         kfree_skb(skb);
 877 }
 878 EXPORT_SYMBOL_GPL(l2tp_recv_common);
 879
 880 /* Drop skbs from the session's reorder_q
 881  */
 882 static void l2tp_session_queue_purge(struct l2tp_session *session)
 883 {
 884         struct sk_buff *skb = NULL;
 885
 886         while ((skb = skb_dequeue(&session->reorder_q))) {
 887                 atomic_long_inc(&session->stats.rx_errors);
 888                 kfree_skb(skb);
 889         }
 890 }
 891
 892 /* UDP encapsulation receive handler. See net/ipv4/udp.c for details. */
 893 int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
 894 {
 895         struct l2tp_session *session = NULL;
 896         struct l2tp_tunnel *tunnel = NULL;
 897         struct net *net = sock_net(sk);
 898         unsigned char *ptr, *optr;
 899         u16 hdrflags;
 900         u16 version;
 901         int length;
 902
 903         /* UDP has verified checksum */
 904
 905         /* UDP always verifies the packet length. */
 906         __skb_pull(skb, sizeof(struct udphdr));
 907
 908         /* Short packet? */
 909         if (!pskb_may_pull(skb, L2TP_HDR_SIZE_MAX))
 910                 goto pass;
 911
 912         /* Point to L2TP header */
 913         optr = skb->data;
 914         ptr = skb->data;
 915
 916         /* Get L2TP header flags */
 917         hdrflags = ntohs(*(__be16 *)ptr);
 918
 919         /* Get protocol version */
 920         version = hdrflags & L2TP_HDR_VER_MASK;
 921
 922         /* Get length of L2TP packet */
 923         length = skb->len;
 924
 925         /* If type is control packet, it is handled by userspace. */
 926         if (hdrflags & L2TP_HDRFLAG_T)
 927                 goto pass;
 928
 929         /* Skip flags */
 930         ptr += 2;
 931
 932         if (version == L2TP_HDR_VER_2) {
 933                 u16 tunnel_id, session_id;
 934
 935                 /* If length is present, skip it */
 936                 if (hdrflags & L2TP_HDRFLAG_L)
 937                         ptr += 2;
 938
 939                 /* Extract tunnel and session ID */
 940                 tunnel_id = ntohs(*(__be16 *)ptr);
 941                 ptr += 2;
 942                 session_id = ntohs(*(__be16 *)ptr);
 943                 ptr += 2;
 944
 945                 session = l2tp_v2_session_get(net, tunnel_id, session_id);
 946         } else {
 947                 u32 session_id;
 948
 949                 ptr += 2;       /* skip reserved bits */
 950                 session_id = ntohl(*(__be32 *)ptr);
 951                 ptr += 4;
 952
 953                 session = l2tp_v3_session_get(net, sk, session_id);
 954         }
 955
 956         if (!session || !session->recv_skb) {
 957                 if (session)
 958                         l2tp_session_dec_refcount(session);
 959
 960                 /* Not found? Pass to userspace to deal with */
 961                 goto pass;
 962         }
 963
 964         tunnel = session->tunnel;
 965
 966         /* Check protocol version */
 967         if (version != tunnel->version)
 968                 goto invalid;
 969
 970         if (version == L2TP_HDR_VER_3 &&
 971             l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) {
 972                 l2tp_session_dec_refcount(session);
 973                 goto invalid;
 974         }
 975
 976         l2tp_recv_common(session, skb, ptr, optr, hdrflags, length);
 977         l2tp_session_dec_refcount(session);
 978
 979         return 0;
 980
 981 invalid:
 982         atomic_long_inc(&tunnel->stats.rx_invalid);
 983
 984 pass:
 985         /* Put UDP header back */
 986         __skb_push(skb, sizeof(struct udphdr));
 987
 988         return 1;
 989 }
 990 EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv);
 991
 992 /* UDP encapsulation receive error handler. See net/ipv4/udp.c for details. */
 993 static void l2tp_udp_encap_err_recv(struct sock *sk, struct sk_buff *skb, int err,
 994                                     __be16 port, u32 info, u8 *payload)
 995 {
 996         sk->sk_err = err;
 997         sk_error_report(sk);
 998
 999         if (ip_hdr(skb)->version == IPVERSION) {
1000                 if (inet_test_bit(RECVERR, sk))
1001                         return ip_icmp_error(sk, skb, err, port, info, payload);
1002 #if IS_ENABLED(CONFIG_IPV6)
1003         } else {
1004                 if (inet6_test_bit(RECVERR6, sk))
1005                         return ipv6_icmp_error(sk, skb, err, port, info, payload);
1006 #endif
1007         }
1008 }
1009
1010 /************************************************************************
1011  * Transmit handling
1012  ***********************************************************************/
1013
1014 /* Build an L2TP header for the session into the buffer provided.
1015  */
1016 static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
1017 {
1018         struct l2tp_tunnel *tunnel = session->tunnel;
1019         __be16 *bufp = buf;
1020         __be16 *optr = buf;
1021         u16 flags = L2TP_HDR_VER_2;
1022         u32 tunnel_id = tunnel->peer_tunnel_id;
1023         u32 session_id = session->peer_session_id;
1024
1025         if (session->send_seq)
1026                 flags |= L2TP_HDRFLAG_S;
1027
1028         /* Setup L2TP header. */
1029         *bufp++ = htons(flags);
1030         *bufp++ = htons(tunnel_id);
1031         *bufp++ = htons(session_id);
1032         if (session->send_seq) {
1033                 *bufp++ = htons(session->ns);
1034                 *bufp++ = 0;
1035                 session->ns++;
1036                 session->ns &= 0xffff;
1037                 trace_session_seqnum_update(session);
1038         }
1039
1040         return bufp - optr;
1041 }
1042
1043 static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
1044 {
1045         struct l2tp_tunnel *tunnel = session->tunnel;
1046         char *bufp = buf;
1047         char *optr = bufp;
1048
1049         /* Setup L2TP header. The header differs slightly for UDP and
1050          * IP encapsulations. For UDP, there is 4 bytes of flags.
1051          */
1052         if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
1053                 u16 flags = L2TP_HDR_VER_3;
1054                 *((__be16 *)bufp) = htons(flags);
1055                 bufp += 2;
1056                 *((__be16 *)bufp) = 0;
1057                 bufp += 2;
1058         }
1059
1060         *((__be32 *)bufp) = htonl(session->peer_session_id);
1061         bufp += 4;
1062         if (session->cookie_len) {
1063                 memcpy(bufp, &session->cookie[0], session->cookie_len);
1064                 bufp += session->cookie_len;
1065         }
1066         if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
1067                 u32 l2h = 0;
1068
1069                 if (session->send_seq) {
1070                         l2h = 0x40000000 | session->ns;
1071                         session->ns++;
1072                         session->ns &= 0xffffff;
1073                         trace_session_seqnum_update(session);
1074                 }
1075
1076                 *((__be32 *)bufp) = htonl(l2h);
1077                 bufp += 4;
1078         }
1079
1080         return bufp - optr;
1081 }
1082
1083 /* Queue the packet to IP for output: tunnel socket lock must be held */
1084 static int l2tp_xmit_queue(struct l2tp_tunnel *tunnel, struct sk_buff *skb, struct flowi *fl)
1085 {
1086         int err;
1087
1088         skb->ignore_df = 1;
1089         skb_dst_drop(skb);
1090 #if IS_ENABLED(CONFIG_IPV6)
1091         if (l2tp_sk_is_v6(tunnel->sock))
1092                 err = inet6_csk_xmit(tunnel->sock, skb, NULL);
1093         else
1094 #endif
1095                 err = ip_queue_xmit(tunnel->sock, skb, fl);
1096
1097         return err >= 0 ? NET_XMIT_SUCCESS : NET_XMIT_DROP;
1098 }
1099
1100 static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, unsigned int *len)
1101 {
1102         struct l2tp_tunnel *tunnel = session->tunnel;
1103         unsigned int data_len = skb->len;
1104         struct sock *sk = tunnel->sock;
1105         int headroom, uhlen, udp_len;
1106         int ret = NET_XMIT_SUCCESS;
1107         struct inet_sock *inet;
1108         struct udphdr *uh;
1109
1110         /* Check that there's enough headroom in the skb to insert IP,
1111          * UDP and L2TP headers. If not enough, expand it to
1112          * make room. Adjust truesize.
1113          */
1114         uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(*uh) : 0;
1115         headroom = NET_SKB_PAD + sizeof(struct iphdr) + uhlen + session->hdr_len;
1116         if (skb_cow_head(skb, headroom)) {
1117                 kfree_skb(skb);
1118                 return NET_XMIT_DROP;
1119         }
1120
1121         /* Setup L2TP header */
1122         if (tunnel->version == L2TP_HDR_VER_2)
1123                 l2tp_build_l2tpv2_header(session, __skb_push(skb, session->hdr_len));
1124         else
1125                 l2tp_build_l2tpv3_header(session, __skb_push(skb, session->hdr_len));
1126
1127         /* Reset skb netfilter state */
1128         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
1129         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED | IPSKB_REROUTED);
1130         nf_reset_ct(skb);
1131
1132         /* L2TP uses its own lockdep subclass to avoid lockdep splats caused by
1133          * nested socket calls on the same lockdep socket class. This can
1134          * happen when data from a user socket is routed over l2tp, which uses
1135          * another userspace socket.
1136          */
1137         spin_lock_nested(&sk->sk_lock.slock, L2TP_DEPTH_NESTING);
1138
1139         if (sock_owned_by_user(sk)) {
1140                 kfree_skb(skb);
1141                 ret = NET_XMIT_DROP;
1142                 goto out_unlock;
1143         }
1144
1145         /* The user-space may change the connection status for the user-space
1146          * provided socket at run time: we must check it under the socket lock
1147          */
1148         if (tunnel->fd >= 0 && sk->sk_state != TCP_ESTABLISHED) {
1149                 kfree_skb(skb);
1150                 ret = NET_XMIT_DROP;
1151                 goto out_unlock;
1152         }
1153
1154         /* Report transmitted length before we add encap header, which keeps
1155          * statistics consistent for both UDP and IP encap tx/rx paths.
1156          */
1157         *len = skb->len;
1158
1159         inet = inet_sk(sk);
1160         switch (tunnel->encap) {
1161         case L2TP_ENCAPTYPE_UDP:
1162                 /* Setup UDP header */
1163                 __skb_push(skb, sizeof(*uh));
1164                 skb_reset_transport_header(skb);
1165                 uh = udp_hdr(skb);
1166                 uh->source = inet->inet_sport;
1167                 uh->dest = inet->inet_dport;
1168                 udp_len = uhlen + session->hdr_len + data_len;
1169                 uh->len = htons(udp_len);
1170
1171                 /* Calculate UDP checksum if configured to do so */
1172 #if IS_ENABLED(CONFIG_IPV6)
1173                 if (l2tp_sk_is_v6(sk))
1174                         udp6_set_csum(udp_get_no_check6_tx(sk),
1175                                       skb, &inet6_sk(sk)->saddr,
1176                                       &sk->sk_v6_daddr, udp_len);
1177                 else
1178 #endif
1179                         udp_set_csum(sk->sk_no_check_tx, skb, inet->inet_saddr,
1180                                      inet->inet_daddr, udp_len);
1181                 break;
1182
1183         case L2TP_ENCAPTYPE_IP:
1184                 break;
1185         }
1186
1187         ret = l2tp_xmit_queue(tunnel, skb, &inet->cork.fl);
1188
1189 out_unlock:
1190         spin_unlock(&sk->sk_lock.slock);
1191
1192         return ret;
1193 }
1194
1195 /* If caller requires the skb to have a ppp header, the header must be
1196  * inserted in the skb data before calling this function.
1197  */
1198 int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb)
1199 {
1200         unsigned int len = 0;
1201         int ret;
1202
1203         ret = l2tp_xmit_core(session, skb, &len);
1204         if (ret == NET_XMIT_SUCCESS) {
1205                 atomic_long_inc(&session->tunnel->stats.tx_packets);
1206                 atomic_long_add(len, &session->tunnel->stats.tx_bytes);
1207                 atomic_long_inc(&session->stats.tx_packets);
1208                 atomic_long_add(len, &session->stats.tx_bytes);
1209         } else {
1210                 atomic_long_inc(&session->tunnel->stats.tx_errors);
1211                 atomic_long_inc(&session->stats.tx_errors);
1212         }
1213         return ret;
1214 }
1215 EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
1216
1217 /*****************************************************************************
1218  * Tinnel and session create/destroy.
1219  *****************************************************************************/
1220
1221 /* Tunnel socket destruct hook.
1222  * The tunnel context is deleted only when all session sockets have been
1223  * closed.
1224  */
1225 static void l2tp_tunnel_destruct(struct sock *sk)
1226 {
1227         struct l2tp_tunnel *tunnel = l2tp_sk_to_tunnel(sk);
1228
1229         if (!tunnel)
1230                 goto end;
1231
1232         /* Disable udp encapsulation */
1233         switch (tunnel->encap) {
1234         case L2TP_ENCAPTYPE_UDP:
1235                 /* No longer an encapsulation socket. See net/ipv4/udp.c */
1236                 WRITE_ONCE(udp_sk(sk)->encap_type, 0);
1237                 udp_sk(sk)->encap_rcv = NULL;
1238                 udp_sk(sk)->encap_destroy = NULL;
1239                 break;
1240         case L2TP_ENCAPTYPE_IP:
1241                 break;
1242         }
1243
1244         /* Remove hooks into tunnel socket */
1245         write_lock_bh(&sk->sk_callback_lock);
1246         sk->sk_destruct = tunnel->old_sk_destruct;
1247         sk->sk_user_data = NULL;
1248         write_unlock_bh(&sk->sk_callback_lock);
1249
1250         /* Call the original destructor */
1251         if (sk->sk_destruct)
1252                 (*sk->sk_destruct)(sk);
1253
1254         kfree_rcu(tunnel, rcu);
1255 end:
1256         return;
1257 }
1258
1259 /* Remove an l2tp session from l2tp_core's lists. */
1260 static void l2tp_session_unhash(struct l2tp_session *session)
1261 {
1262         struct l2tp_tunnel *tunnel = session->tunnel;
1263
1264         if (tunnel) {
1265                 struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1266                 struct l2tp_session *removed = session;
1267
1268                 spin_lock_bh(&tunnel->list_lock);
1269                 spin_lock_bh(&pn->l2tp_session_idr_lock);
1270
1271                 /* Remove from the per-tunnel list */
1272                 list_del_init(&session->list);
1273
1274                 /* Remove from per-net IDR */
1275                 if (tunnel->version == L2TP_HDR_VER_3) {
1276                         if (hash_hashed(&session->hlist))
1277                                 l2tp_session_collision_del(pn, session);
1278                         else
1279                                 removed = idr_remove(&pn->l2tp_v3_session_idr,
1280                                                      session->session_id);
1281                 } else {
1282                         u32 session_key = l2tp_v2_session_key(tunnel->tunnel_id,
1283                                                               session->session_id);
1284                         removed = idr_remove(&pn->l2tp_v2_session_idr,
1285                                              session_key);
1286                 }
1287                 WARN_ON_ONCE(removed && removed != session);
1288
1289                 spin_unlock_bh(&pn->l2tp_session_idr_lock);
1290                 spin_unlock_bh(&tunnel->list_lock);
1291
1292                 synchronize_rcu();
1293         }
1294 }
1295
1296 /* When the tunnel is closed, all the attached sessions need to go too.
1297  */
1298 static void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
1299 {
1300         struct l2tp_session *session;
1301
1302         spin_lock_bh(&tunnel->list_lock);
1303         tunnel->acpt_newsess = false;
1304         for (;;) {
1305                 session = list_first_entry_or_null(&tunnel->session_list,
1306                                                    struct l2tp_session, list);
1307                 if (!session)
1308                         break;
1309                 l2tp_session_inc_refcount(session);
1310                 list_del_init(&session->list);
1311                 spin_unlock_bh(&tunnel->list_lock);
1312                 l2tp_session_delete(session);
1313                 spin_lock_bh(&tunnel->list_lock);
1314                 l2tp_session_dec_refcount(session);
1315         }
1316         spin_unlock_bh(&tunnel->list_lock);
1317 }
1318
1319 /* Tunnel socket destroy hook for UDP encapsulation */
1320 static void l2tp_udp_encap_destroy(struct sock *sk)
1321 {
1322         struct l2tp_tunnel *tunnel = l2tp_sk_to_tunnel(sk);
1323
1324         if (tunnel)
1325                 l2tp_tunnel_delete(tunnel);
1326 }
1327
1328 static void l2tp_tunnel_remove(struct net *net, struct l2tp_tunnel *tunnel)
1329 {
1330         struct l2tp_net *pn = l2tp_pernet(net);
1331
1332         spin_lock_bh(&pn->l2tp_tunnel_idr_lock);
1333         idr_remove(&pn->l2tp_tunnel_idr, tunnel->tunnel_id);
1334         spin_unlock_bh(&pn->l2tp_tunnel_idr_lock);
1335 }
1336
1337 /* Workqueue tunnel deletion function */
1338 static void l2tp_tunnel_del_work(struct work_struct *work)
1339 {
1340         struct l2tp_tunnel *tunnel = container_of(work, struct l2tp_tunnel,
1341                                                   del_work);
1342         struct sock *sk = tunnel->sock;
1343         struct socket *sock = sk->sk_socket;
1344
1345         l2tp_tunnel_closeall(tunnel);
1346
1347         /* If the tunnel socket was created within the kernel, use
1348          * the sk API to release it here.
1349          */
1350         if (tunnel->fd < 0) {
1351                 if (sock) {
1352                         kernel_sock_shutdown(sock, SHUT_RDWR);
1353                         sock_release(sock);
1354                 }
1355         }
1356
1357         l2tp_tunnel_remove(tunnel->l2tp_net, tunnel);
1358         /* drop initial ref */
1359         l2tp_tunnel_dec_refcount(tunnel);
1360
1361         /* drop workqueue ref */
1362         l2tp_tunnel_dec_refcount(tunnel);
1363 }
1364
1365 /* Create a socket for the tunnel, if one isn't set up by
1366  * userspace. This is used for static tunnels where there is no
1367  * managing L2TP daemon.
1368  *
1369  * Since we don't want these sockets to keep a namespace alive by
1370  * themselves, we drop the socket's namespace refcount after creation.
1371  * These sockets are freed when the namespace exits using the pernet
1372  * exit hook.
1373  */
1374 static int l2tp_tunnel_sock_create(struct net *net,
1375                                    u32 tunnel_id,
1376                                    u32 peer_tunnel_id,
1377                                    struct l2tp_tunnel_cfg *cfg,
1378                                    struct socket **sockp)
1379 {
1380         int err = -EINVAL;
1381         struct socket *sock = NULL;
1382         struct udp_port_cfg udp_conf;
1383
1384         switch (cfg->encap) {
1385         case L2TP_ENCAPTYPE_UDP:
1386                 memset(&udp_conf, 0, sizeof(udp_conf));
1387
1388 #if IS_ENABLED(CONFIG_IPV6)
1389                 if (cfg->local_ip6 && cfg->peer_ip6) {
1390                         udp_conf.family = AF_INET6;
1391                         memcpy(&udp_conf.local_ip6, cfg->local_ip6,
1392                                sizeof(udp_conf.local_ip6));
1393                         memcpy(&udp_conf.peer_ip6, cfg->peer_ip6,
1394                                sizeof(udp_conf.peer_ip6));
1395                         udp_conf.use_udp6_tx_checksums =
1396                           !cfg->udp6_zero_tx_checksums;
1397                         udp_conf.use_udp6_rx_checksums =
1398                           !cfg->udp6_zero_rx_checksums;
1399                 } else
1400 #endif
1401                 {
1402                         udp_conf.family = AF_INET;
1403                         udp_conf.local_ip = cfg->local_ip;
1404                         udp_conf.peer_ip = cfg->peer_ip;
1405                         udp_conf.use_udp_checksums = cfg->use_udp_checksums;
1406                 }
1407
1408                 udp_conf.local_udp_port = htons(cfg->local_udp_port);
1409                 udp_conf.peer_udp_port = htons(cfg->peer_udp_port);
1410
1411                 err = udp_sock_create(net, &udp_conf, &sock);
1412                 if (err < 0)
1413                         goto out;
1414
1415                 break;
1416
1417         case L2TP_ENCAPTYPE_IP:
1418 #if IS_ENABLED(CONFIG_IPV6)
1419                 if (cfg->local_ip6 && cfg->peer_ip6) {
1420                         struct sockaddr_l2tpip6 ip6_addr = {0};
1421
1422                         err = sock_create_kern(net, AF_INET6, SOCK_DGRAM,
1423                                                IPPROTO_L2TP, &sock);
1424                         if (err < 0)
1425                                 goto out;
1426
1427                         ip6_addr.l2tp_family = AF_INET6;
1428                         memcpy(&ip6_addr.l2tp_addr, cfg->local_ip6,
1429                                sizeof(ip6_addr.l2tp_addr));
1430                         ip6_addr.l2tp_conn_id = tunnel_id;
1431                         err = kernel_bind(sock, (struct sockaddr *)&ip6_addr,
1432                                           sizeof(ip6_addr));
1433                         if (err < 0)
1434                                 goto out;
1435
1436                         ip6_addr.l2tp_family = AF_INET6;
1437                         memcpy(&ip6_addr.l2tp_addr, cfg->peer_ip6,
1438                                sizeof(ip6_addr.l2tp_addr));
1439                         ip6_addr.l2tp_conn_id = peer_tunnel_id;
1440                         err = kernel_connect(sock,
1441                                              (struct sockaddr *)&ip6_addr,
1442                                              sizeof(ip6_addr), 0);
1443                         if (err < 0)
1444                                 goto out;
1445                 } else
1446 #endif
1447                 {
1448                         struct sockaddr_l2tpip ip_addr = {0};
1449
1450                         err = sock_create_kern(net, AF_INET, SOCK_DGRAM,
1451                                                IPPROTO_L2TP, &sock);
1452                         if (err < 0)
1453                                 goto out;
1454
1455                         ip_addr.l2tp_family = AF_INET;
1456                         ip_addr.l2tp_addr = cfg->local_ip;
1457                         ip_addr.l2tp_conn_id = tunnel_id;
1458                         err = kernel_bind(sock, (struct sockaddr *)&ip_addr,
1459                                           sizeof(ip_addr));
1460                         if (err < 0)
1461                                 goto out;
1462
1463                         ip_addr.l2tp_family = AF_INET;
1464                         ip_addr.l2tp_addr = cfg->peer_ip;
1465                         ip_addr.l2tp_conn_id = peer_tunnel_id;
1466                         err = kernel_connect(sock, (struct sockaddr *)&ip_addr,
1467                                              sizeof(ip_addr), 0);
1468                         if (err < 0)
1469                                 goto out;
1470                 }
1471                 break;
1472
1473         default:
1474                 goto out;
1475         }
1476
1477 out:
1478         *sockp = sock;
1479         if (err < 0 && sock) {
1480                 kernel_sock_shutdown(sock, SHUT_RDWR);
1481                 sock_release(sock);
1482                 *sockp = NULL;
1483         }
1484
1485         return err;
1486 }
1487
1488 int l2tp_tunnel_create(int fd, int version, u32 tunnel_id, u32 peer_tunnel_id,
1489                        struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp)
1490 {
1491         struct l2tp_tunnel *tunnel = NULL;
1492         int err;
1493         enum l2tp_encap_type encap = L2TP_ENCAPTYPE_UDP;
1494
1495         if (cfg)
1496                 encap = cfg->encap;
1497
1498         tunnel = kzalloc(sizeof(*tunnel), GFP_KERNEL);
1499         if (!tunnel) {
1500                 err = -ENOMEM;
1501                 goto err;
1502         }
1503
1504         tunnel->version = version;
1505         tunnel->tunnel_id = tunnel_id;
1506         tunnel->peer_tunnel_id = peer_tunnel_id;
1507
1508         tunnel->magic = L2TP_TUNNEL_MAGIC;
1509         sprintf(&tunnel->name[0], "tunl %u", tunnel_id);
1510         spin_lock_init(&tunnel->list_lock);
1511         tunnel->acpt_newsess = true;
1512         INIT_LIST_HEAD(&tunnel->session_list);
1513
1514         tunnel->encap = encap;
1515
1516         refcount_set(&tunnel->ref_count, 1);
1517         tunnel->fd = fd;
1518
1519         /* Init delete workqueue struct */
1520         INIT_WORK(&tunnel->del_work, l2tp_tunnel_del_work);
1521
1522         err = 0;
1523 err:
1524         if (tunnelp)
1525                 *tunnelp = tunnel;
1526
1527         return err;
1528 }
1529 EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
1530
1531 static int l2tp_validate_socket(const struct sock *sk, const struct net *net,
1532                                 enum l2tp_encap_type encap)
1533 {
1534         if (!net_eq(sock_net(sk), net))
1535                 return -EINVAL;
1536
1537         if (sk->sk_type != SOCK_DGRAM)
1538                 return -EPROTONOSUPPORT;
1539
1540         if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)
1541                 return -EPROTONOSUPPORT;
1542
1543         if ((encap == L2TP_ENCAPTYPE_UDP && sk->sk_protocol != IPPROTO_UDP) ||
1544             (encap == L2TP_ENCAPTYPE_IP && sk->sk_protocol != IPPROTO_L2TP))
1545                 return -EPROTONOSUPPORT;
1546
1547         if (sk->sk_user_data)
1548                 return -EBUSY;
1549
1550         return 0;
1551 }
1552
1553 int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
1554                          struct l2tp_tunnel_cfg *cfg)
1555 {
1556         struct l2tp_net *pn = l2tp_pernet(net);
1557         u32 tunnel_id = tunnel->tunnel_id;
1558         struct socket *sock;
1559         struct sock *sk;
1560         int ret;
1561
1562         spin_lock_bh(&pn->l2tp_tunnel_idr_lock);
1563         ret = idr_alloc_u32(&pn->l2tp_tunnel_idr, NULL, &tunnel_id, tunnel_id,
1564                             GFP_ATOMIC);
1565         spin_unlock_bh(&pn->l2tp_tunnel_idr_lock);
1566         if (ret)
1567                 return ret == -ENOSPC ? -EEXIST : ret;
1568
1569         if (tunnel->fd < 0) {
1570                 ret = l2tp_tunnel_sock_create(net, tunnel->tunnel_id,
1571                                               tunnel->peer_tunnel_id, cfg,
1572                                               &sock);
1573                 if (ret < 0)
1574                         goto err;
1575         } else {
1576                 sock = sockfd_lookup(tunnel->fd, &ret);
1577                 if (!sock)
1578                         goto err;
1579         }
1580
1581         sk = sock->sk;
1582         lock_sock(sk);
1583         write_lock_bh(&sk->sk_callback_lock);
1584         ret = l2tp_validate_socket(sk, net, tunnel->encap);
1585         if (ret < 0)
1586                 goto err_inval_sock;
1587         rcu_assign_sk_user_data(sk, tunnel);
1588         write_unlock_bh(&sk->sk_callback_lock);
1589
1590         if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
1591                 struct udp_tunnel_sock_cfg udp_cfg = {
1592                         .sk_user_data = tunnel,
1593                         .encap_type = UDP_ENCAP_L2TPINUDP,
1594                         .encap_rcv = l2tp_udp_encap_recv,
1595                         .encap_err_rcv = l2tp_udp_encap_err_recv,
1596                         .encap_destroy = l2tp_udp_encap_destroy,
1597                 };
1598
1599                 setup_udp_tunnel_sock(net, sock, &udp_cfg);
1600         }
1601
1602         tunnel->old_sk_destruct = sk->sk_destruct;
1603         sk->sk_destruct = &l2tp_tunnel_destruct;
1604         sk->sk_allocation = GFP_ATOMIC;
1605         release_sock(sk);
1606
1607         sock_hold(sk);
1608         tunnel->sock = sk;
1609         tunnel->l2tp_net = net;
1610
1611         spin_lock_bh(&pn->l2tp_tunnel_idr_lock);
1612         idr_replace(&pn->l2tp_tunnel_idr, tunnel, tunnel->tunnel_id);
1613         spin_unlock_bh(&pn->l2tp_tunnel_idr_lock);
1614
1615         trace_register_tunnel(tunnel);
1616
1617         if (tunnel->fd >= 0)
1618                 sockfd_put(sock);
1619
1620         return 0;
1621
1622 err_inval_sock:
1623         write_unlock_bh(&sk->sk_callback_lock);
1624         release_sock(sk);
1625
1626         if (tunnel->fd < 0)
1627                 sock_release(sock);
1628         else
1629                 sockfd_put(sock);
1630 err:
1631         l2tp_tunnel_remove(net, tunnel);
1632         return ret;
1633 }
1634 EXPORT_SYMBOL_GPL(l2tp_tunnel_register);
1635
1636 /* This function is used by the netlink TUNNEL_DELETE command.
1637  */
1638 void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
1639 {
1640         if (!test_and_set_bit(0, &tunnel->dead)) {
1641                 trace_delete_tunnel(tunnel);
1642                 l2tp_tunnel_inc_refcount(tunnel);
1643                 queue_work(l2tp_wq, &tunnel->del_work);
1644         }
1645 }
1646 EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
1647
1648 void l2tp_session_delete(struct l2tp_session *session)
1649 {
1650         if (test_and_set_bit(0, &session->dead))
1651                 return;
1652
1653         trace_delete_session(session);
1654         l2tp_session_unhash(session);
1655         l2tp_session_queue_purge(session);
1656         if (session->session_close)
1657                 (*session->session_close)(session);
1658
1659         l2tp_session_dec_refcount(session);
1660 }
1661 EXPORT_SYMBOL_GPL(l2tp_session_delete);
1662
1663 /* We come here whenever a session's send_seq, cookie_len or
1664  * l2specific_type parameters are set.
1665  */
1666 void l2tp_session_set_header_len(struct l2tp_session *session, int version)
1667 {
1668         if (version == L2TP_HDR_VER_2) {
1669                 session->hdr_len = 6;
1670                 if (session->send_seq)
1671                         session->hdr_len += 4;
1672         } else {
1673                 session->hdr_len = 4 + session->cookie_len;
1674                 session->hdr_len += l2tp_get_l2specific_len(session);
1675                 if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)
1676                         session->hdr_len += 4;
1677         }
1678 }
1679 EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
1680
1681 struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id,
1682                                          u32 peer_session_id, struct l2tp_session_cfg *cfg)
1683 {
1684         struct l2tp_session *session;
1685
1686         session = kzalloc(sizeof(*session) + priv_size, GFP_KERNEL);
1687         if (session) {
1688                 session->magic = L2TP_SESSION_MAGIC;
1689                 session->tunnel = tunnel;
1690
1691                 session->session_id = session_id;
1692                 session->peer_session_id = peer_session_id;
1693                 session->nr = 0;
1694                 if (tunnel->version == L2TP_HDR_VER_2)
1695                         session->nr_max = 0xffff;
1696                 else
1697                         session->nr_max = 0xffffff;
1698                 session->nr_window_size = session->nr_max / 2;
1699                 session->nr_oos_count_max = 4;
1700
1701                 /* Use NR of first received packet */
1702                 session->reorder_skip = 1;
1703
1704                 sprintf(&session->name[0], "sess %u/%u",
1705                         tunnel->tunnel_id, session->session_id);
1706
1707                 skb_queue_head_init(&session->reorder_q);
1708
1709                 session->hlist_key = l2tp_v3_session_hashkey(tunnel->sock, session->session_id);
1710                 INIT_HLIST_NODE(&session->hlist);
1711                 INIT_LIST_HEAD(&session->clist);
1712                 INIT_LIST_HEAD(&session->list);
1713
1714                 if (cfg) {
1715                         session->pwtype = cfg->pw_type;
1716                         session->send_seq = cfg->send_seq;
1717                         session->recv_seq = cfg->recv_seq;
1718                         session->lns_mode = cfg->lns_mode;
1719                         session->reorder_timeout = cfg->reorder_timeout;
1720                         session->l2specific_type = cfg->l2specific_type;
1721                         session->cookie_len = cfg->cookie_len;
1722                         memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);
1723                         session->peer_cookie_len = cfg->peer_cookie_len;
1724                         memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);
1725                 }
1726
1727                 l2tp_session_set_header_len(session, tunnel->version);
1728
1729                 refcount_set(&session->ref_count, 1);
1730
1731                 return session;
1732         }
1733
1734         return ERR_PTR(-ENOMEM);
1735 }
1736 EXPORT_SYMBOL_GPL(l2tp_session_create);
1737
1738 /*****************************************************************************
1739  * Init and cleanup
1740  *****************************************************************************/
1741
1742 static __net_init int l2tp_init_net(struct net *net)
1743 {
1744         struct l2tp_net *pn = net_generic(net, l2tp_net_id);
1745
1746         idr_init(&pn->l2tp_tunnel_idr);
1747         spin_lock_init(&pn->l2tp_tunnel_idr_lock);
1748
1749         idr_init(&pn->l2tp_v2_session_idr);
1750         idr_init(&pn->l2tp_v3_session_idr);
1751         spin_lock_init(&pn->l2tp_session_idr_lock);
1752
1753         return 0;
1754 }
1755
1756 static __net_exit void l2tp_exit_net(struct net *net)
1757 {
1758         struct l2tp_net *pn = l2tp_pernet(net);
1759         struct l2tp_tunnel *tunnel = NULL;
1760         unsigned long tunnel_id, tmp;
1761
1762         rcu_read_lock_bh();
1763         idr_for_each_entry_ul(&pn->l2tp_tunnel_idr, tunnel, tmp, tunnel_id) {
1764                 if (tunnel)
1765                         l2tp_tunnel_delete(tunnel);
1766         }
1767         rcu_read_unlock_bh();
1768
1769         if (l2tp_wq)
1770                 flush_workqueue(l2tp_wq);
1771         rcu_barrier();
1772
1773         idr_destroy(&pn->l2tp_v2_session_idr);
1774         idr_destroy(&pn->l2tp_v3_session_idr);
1775         idr_destroy(&pn->l2tp_tunnel_idr);
1776 }
1777
1778 static struct pernet_operations l2tp_net_ops = {
1779         .init = l2tp_init_net,
1780         .exit = l2tp_exit_net,
1781         .id   = &l2tp_net_id,
1782         .size = sizeof(struct l2tp_net),
1783 };
1784
1785 static int __init l2tp_init(void)
1786 {
1787         int rc = 0;
1788
1789         rc = register_pernet_device(&l2tp_net_ops);
1790         if (rc)
1791                 goto out;
1792
1793         l2tp_wq = alloc_workqueue("l2tp", WQ_UNBOUND, 0);
1794         if (!l2tp_wq) {
1795                 pr_err("alloc_workqueue failed\n");
1796                 unregister_pernet_device(&l2tp_net_ops);
1797                 rc = -ENOMEM;
1798                 goto out;
1799         }
1800
1801         pr_info("L2TP core driver, %s\n", L2TP_DRV_VERSION);
1802
1803 out:
1804         return rc;
1805 }
1806
1807 static void __exit l2tp_exit(void)
1808 {
1809         unregister_pernet_device(&l2tp_net_ops);
1810         if (l2tp_wq) {
1811                 destroy_workqueue(l2tp_wq);
1812                 l2tp_wq = NULL;
1813         }
1814 }
1815
1816 module_init(l2tp_init);
1817 module_exit(l2tp_exit);
1818
1819 MODULE_AUTHOR("James Chapman <[email protected]>");
1820 MODULE_DESCRIPTION("L2TP core");
1821 MODULE_LICENSE("GPL");
1822 MODULE_VERSION(L2TP_DRV_VERSION);