net/l2tp/l2tp_core.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /* L2TP core.
   3  *
   4  * Copyright (c) 2008,2009,2010 Katalix Systems Ltd
   5  *
   6  * This file contains some code of the original L2TPv2 pppol2tp
   7  * driver, which has the following copyright:
   8  *
   9  * Authors:     Martijn van Oosterhout <[email protected]>
  10  *              James Chapman ([email protected])
  11  * Contributors:
  12  *              Michal Ostrowski <[email protected]>
  13  *              Arnaldo Carvalho de Melo <[email protected]>
  14  *              David S. Miller ([email protected])
  15  */
  16
  17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  18
  19 #include <linux/module.h>
  20 #include <linux/string.h>
  21 #include <linux/list.h>
  22 #include <linux/rculist.h>
  23 #include <linux/uaccess.h>
  24
  25 #include <linux/kernel.h>
  26 #include <linux/spinlock.h>
  27 #include <linux/kthread.h>
  28 #include <linux/sched.h>
  29 #include <linux/slab.h>
  30 #include <linux/errno.h>
  31 #include <linux/jiffies.h>
  32
  33 #include <linux/netdevice.h>
  34 #include <linux/net.h>
  35 #include <linux/inetdevice.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/init.h>
  38 #include <linux/in.h>
  39 #include <linux/ip.h>
  40 #include <linux/udp.h>
  41 #include <linux/l2tp.h>
  42 #include <linux/hash.h>
  43 #include <linux/sort.h>
  44 #include <linux/file.h>
  45 #include <linux/nsproxy.h>
  46 #include <net/net_namespace.h>
  47 #include <net/netns/generic.h>
  48 #include <net/dst.h>
  49 #include <net/ip.h>
  50 #include <net/udp.h>
  51 #include <net/udp_tunnel.h>
  52 #include <net/inet_common.h>
  53 #include <net/xfrm.h>
  54 #include <net/protocol.h>
  55 #include <net/inet6_connection_sock.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/ip6_route.h>
  58 #include <net/ip6_checksum.h>
  59
  60 #include <asm/byteorder.h>
  61 #include <linux/atomic.h>
  62
  63 #include "l2tp_core.h"
  64
  65 #define L2TP_DRV_VERSION        "V2.0"
  66
  67 /* L2TP header constants */
  68 #define L2TP_HDRFLAG_T     0x8000
  69 #define L2TP_HDRFLAG_L     0x4000
  70 #define L2TP_HDRFLAG_S     0x0800
  71 #define L2TP_HDRFLAG_O     0x0200
  72 #define L2TP_HDRFLAG_P     0x0100
  73
  74 #define L2TP_HDR_VER_MASK  0x000F
  75 #define L2TP_HDR_VER_2     0x0002
  76 #define L2TP_HDR_VER_3     0x0003
  77
  78 /* L2TPv3 default L2-specific sublayer */
  79 #define L2TP_SLFLAG_S      0x40000000
  80 #define L2TP_SL_SEQ_MASK   0x00ffffff
  81
  82 #define L2TP_HDR_SIZE_MAX               14
  83
  84 /* Default trace flags */
  85 #define L2TP_DEFAULT_DEBUG_FLAGS        0
  86
  87 /* Private data stored for received packets in the skb.
  88  */
  89 struct l2tp_skb_cb {
  90         u32                     ns;
  91         u16                     has_seq;
  92         u16                     length;
  93         unsigned long           expires;
  94 };
  95
  96 #define L2TP_SKB_CB(skb)        ((struct l2tp_skb_cb *)&(skb)->cb[sizeof(struct inet_skb_parm)])
  97
  98 static struct workqueue_struct *l2tp_wq;
  99
 100 /* per-net private data for this module */
 101 static unsigned int l2tp_net_id;
 102 struct l2tp_net {
 103         struct list_head l2tp_tunnel_list;
 104         /* Lock for write access to l2tp_tunnel_list */
 105         spinlock_t l2tp_tunnel_list_lock;
 106         struct hlist_head l2tp_session_hlist[L2TP_HASH_SIZE_2];
 107         /* Lock for write access to l2tp_session_hlist */
 108         spinlock_t l2tp_session_hlist_lock;
 109 };
 110
 111 #if IS_ENABLED(CONFIG_IPV6)
 112 static bool l2tp_sk_is_v6(struct sock *sk)
 113 {
 114         return sk->sk_family == PF_INET6 &&
 115                !ipv6_addr_v4mapped(&sk->sk_v6_daddr);
 116 }
 117 #endif
 118
 119 static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk)
 120 {
 121         return sk->sk_user_data;
 122 }
 123
 124 static inline struct l2tp_net *l2tp_pernet(const struct net *net)
 125 {
 126         return net_generic(net, l2tp_net_id);
 127 }
 128
 129 /* Session hash global list for L2TPv3.
 130  * The session_id SHOULD be random according to RFC3931, but several
 131  * L2TP implementations use incrementing session_ids.  So we do a real
 132  * hash on the session_id, rather than a simple bitmask.
 133  */
 134 static inline struct hlist_head *
 135 l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
 136 {
 137         return &pn->l2tp_session_hlist[hash_32(session_id, L2TP_HASH_BITS_2)];
 138 }
 139
 140 /* Session hash list.
 141  * The session_id SHOULD be random according to RFC2661, but several
 142  * L2TP implementations (Cisco and Microsoft) use incrementing
 143  * session_ids.  So we do a real hash on the session_id, rather than a
 144  * simple bitmask.
 145  */
 146 static inline struct hlist_head *
 147 l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id)
 148 {
 149         return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)];
 150 }
 151
 152 static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
 153 {
 154         sock_put(tunnel->sock);
 155         /* the tunnel is freed in the socket destructor */
 156 }
 157
 158 static void l2tp_session_free(struct l2tp_session *session)
 159 {
 160         struct l2tp_tunnel *tunnel = session->tunnel;
 161
 162         if (tunnel) {
 163                 if (WARN_ON(tunnel->magic != L2TP_TUNNEL_MAGIC))
 164                         goto out;
 165                 l2tp_tunnel_dec_refcount(tunnel);
 166         }
 167
 168 out:
 169         kfree(session);
 170 }
 171
 172 void l2tp_tunnel_inc_refcount(struct l2tp_tunnel *tunnel)
 173 {
 174         refcount_inc(&tunnel->ref_count);
 175 }
 176 EXPORT_SYMBOL_GPL(l2tp_tunnel_inc_refcount);
 177
 178 void l2tp_tunnel_dec_refcount(struct l2tp_tunnel *tunnel)
 179 {
 180         if (refcount_dec_and_test(&tunnel->ref_count))
 181                 l2tp_tunnel_free(tunnel);
 182 }
 183 EXPORT_SYMBOL_GPL(l2tp_tunnel_dec_refcount);
 184
 185 void l2tp_session_inc_refcount(struct l2tp_session *session)
 186 {
 187         refcount_inc(&session->ref_count);
 188 }
 189 EXPORT_SYMBOL_GPL(l2tp_session_inc_refcount);
 190
 191 void l2tp_session_dec_refcount(struct l2tp_session *session)
 192 {
 193         if (refcount_dec_and_test(&session->ref_count))
 194                 l2tp_session_free(session);
 195 }
 196 EXPORT_SYMBOL_GPL(l2tp_session_dec_refcount);
 197
 198 /* Lookup a tunnel. A new reference is held on the returned tunnel. */
 199 struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id)
 200 {
 201         const struct l2tp_net *pn = l2tp_pernet(net);
 202         struct l2tp_tunnel *tunnel;
 203
 204         rcu_read_lock_bh();
 205         list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
 206                 if (tunnel->tunnel_id == tunnel_id &&
 207                     refcount_inc_not_zero(&tunnel->ref_count)) {
 208                         rcu_read_unlock_bh();
 209
 210                         return tunnel;
 211                 }
 212         }
 213         rcu_read_unlock_bh();
 214
 215         return NULL;
 216 }
 217 EXPORT_SYMBOL_GPL(l2tp_tunnel_get);
 218
 219 struct l2tp_tunnel *l2tp_tunnel_get_nth(const struct net *net, int nth)
 220 {
 221         const struct l2tp_net *pn = l2tp_pernet(net);
 222         struct l2tp_tunnel *tunnel;
 223         int count = 0;
 224
 225         rcu_read_lock_bh();
 226         list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
 227                 if (++count > nth &&
 228                     refcount_inc_not_zero(&tunnel->ref_count)) {
 229                         rcu_read_unlock_bh();
 230                         return tunnel;
 231                 }
 232         }
 233         rcu_read_unlock_bh();
 234
 235         return NULL;
 236 }
 237 EXPORT_SYMBOL_GPL(l2tp_tunnel_get_nth);
 238
 239 struct l2tp_session *l2tp_tunnel_get_session(struct l2tp_tunnel *tunnel,
 240                                              u32 session_id)
 241 {
 242         struct hlist_head *session_list;
 243         struct l2tp_session *session;
 244
 245         session_list = l2tp_session_id_hash(tunnel, session_id);
 246
 247         read_lock_bh(&tunnel->hlist_lock);
 248         hlist_for_each_entry(session, session_list, hlist)
 249                 if (session->session_id == session_id) {
 250                         l2tp_session_inc_refcount(session);
 251                         read_unlock_bh(&tunnel->hlist_lock);
 252
 253                         return session;
 254                 }
 255         read_unlock_bh(&tunnel->hlist_lock);
 256
 257         return NULL;
 258 }
 259 EXPORT_SYMBOL_GPL(l2tp_tunnel_get_session);
 260
 261 struct l2tp_session *l2tp_session_get(const struct net *net, u32 session_id)
 262 {
 263         struct hlist_head *session_list;
 264         struct l2tp_session *session;
 265
 266         session_list = l2tp_session_id_hash_2(l2tp_pernet(net), session_id);
 267
 268         rcu_read_lock_bh();
 269         hlist_for_each_entry_rcu(session, session_list, global_hlist)
 270                 if (session->session_id == session_id) {
 271                         l2tp_session_inc_refcount(session);
 272                         rcu_read_unlock_bh();
 273
 274                         return session;
 275                 }
 276         rcu_read_unlock_bh();
 277
 278         return NULL;
 279 }
 280 EXPORT_SYMBOL_GPL(l2tp_session_get);
 281
 282 struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth)
 283 {
 284         int hash;
 285         struct l2tp_session *session;
 286         int count = 0;
 287
 288         read_lock_bh(&tunnel->hlist_lock);
 289         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
 290                 hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {
 291                         if (++count > nth) {
 292                                 l2tp_session_inc_refcount(session);
 293                                 read_unlock_bh(&tunnel->hlist_lock);
 294                                 return session;
 295                         }
 296                 }
 297         }
 298
 299         read_unlock_bh(&tunnel->hlist_lock);
 300
 301         return NULL;
 302 }
 303 EXPORT_SYMBOL_GPL(l2tp_session_get_nth);
 304
 305 /* Lookup a session by interface name.
 306  * This is very inefficient but is only used by management interfaces.
 307  */
 308 struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
 309                                                 const char *ifname)
 310 {
 311         struct l2tp_net *pn = l2tp_pernet(net);
 312         int hash;
 313         struct l2tp_session *session;
 314
 315         rcu_read_lock_bh();
 316         for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) {
 317                 hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {
 318                         if (!strcmp(session->ifname, ifname)) {
 319                                 l2tp_session_inc_refcount(session);
 320                                 rcu_read_unlock_bh();
 321
 322                                 return session;
 323                         }
 324                 }
 325         }
 326
 327         rcu_read_unlock_bh();
 328
 329         return NULL;
 330 }
 331 EXPORT_SYMBOL_GPL(l2tp_session_get_by_ifname);
 332
 333 int l2tp_session_register(struct l2tp_session *session,
 334                           struct l2tp_tunnel *tunnel)
 335 {
 336         struct l2tp_session *session_walk;
 337         struct hlist_head *g_head;
 338         struct hlist_head *head;
 339         struct l2tp_net *pn;
 340         int err;
 341
 342         head = l2tp_session_id_hash(tunnel, session->session_id);
 343
 344         write_lock_bh(&tunnel->hlist_lock);
 345         if (!tunnel->acpt_newsess) {
 346                 err = -ENODEV;
 347                 goto err_tlock;
 348         }
 349
 350         hlist_for_each_entry(session_walk, head, hlist)
 351                 if (session_walk->session_id == session->session_id) {
 352                         err = -EEXIST;
 353                         goto err_tlock;
 354                 }
 355
 356         if (tunnel->version == L2TP_HDR_VER_3) {
 357                 pn = l2tp_pernet(tunnel->l2tp_net);
 358                 g_head = l2tp_session_id_hash_2(pn, session->session_id);
 359
 360                 spin_lock_bh(&pn->l2tp_session_hlist_lock);
 361
 362                 /* IP encap expects session IDs to be globally unique, while
 363                  * UDP encap doesn't.
 364                  */
 365                 hlist_for_each_entry(session_walk, g_head, global_hlist)
 366                         if (session_walk->session_id == session->session_id &&
 367                             (session_walk->tunnel->encap == L2TP_ENCAPTYPE_IP ||
 368                              tunnel->encap == L2TP_ENCAPTYPE_IP)) {
 369                                 err = -EEXIST;
 370                                 goto err_tlock_pnlock;
 371                         }
 372
 373                 l2tp_tunnel_inc_refcount(tunnel);
 374                 hlist_add_head_rcu(&session->global_hlist, g_head);
 375
 376                 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
 377         } else {
 378                 l2tp_tunnel_inc_refcount(tunnel);
 379         }
 380
 381         hlist_add_head(&session->hlist, head);
 382         write_unlock_bh(&tunnel->hlist_lock);
 383
 384         return 0;
 385
 386 err_tlock_pnlock:
 387         spin_unlock_bh(&pn->l2tp_session_hlist_lock);
 388 err_tlock:
 389         write_unlock_bh(&tunnel->hlist_lock);
 390
 391         return err;
 392 }
 393 EXPORT_SYMBOL_GPL(l2tp_session_register);
 394
 395 /*****************************************************************************
 396  * Receive data handling
 397  *****************************************************************************/
 398
 399 /* Queue a skb in order. We come here only if the skb has an L2TP sequence
 400  * number.
 401  */
 402 static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb)
 403 {
 404         struct sk_buff *skbp;
 405         struct sk_buff *tmp;
 406         u32 ns = L2TP_SKB_CB(skb)->ns;
 407
 408         spin_lock_bh(&session->reorder_q.lock);
 409         skb_queue_walk_safe(&session->reorder_q, skbp, tmp) {
 410                 if (L2TP_SKB_CB(skbp)->ns > ns) {
 411                         __skb_queue_before(&session->reorder_q, skbp, skb);
 412                         l2tp_dbg(session, L2TP_MSG_SEQ,
 413                                  "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
 414                                  session->name, ns, L2TP_SKB_CB(skbp)->ns,
 415                                  skb_queue_len(&session->reorder_q));
 416                         atomic_long_inc(&session->stats.rx_oos_packets);
 417                         goto out;
 418                 }
 419         }
 420
 421         __skb_queue_tail(&session->reorder_q, skb);
 422
 423 out:
 424         spin_unlock_bh(&session->reorder_q.lock);
 425 }
 426
 427 /* Dequeue a single skb.
 428  */
 429 static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb)
 430 {
 431         struct l2tp_tunnel *tunnel = session->tunnel;
 432         int length = L2TP_SKB_CB(skb)->length;
 433
 434         /* We're about to requeue the skb, so return resources
 435          * to its current owner (a socket receive buffer).
 436          */
 437         skb_orphan(skb);
 438
 439         atomic_long_inc(&tunnel->stats.rx_packets);
 440         atomic_long_add(length, &tunnel->stats.rx_bytes);
 441         atomic_long_inc(&session->stats.rx_packets);
 442         atomic_long_add(length, &session->stats.rx_bytes);
 443
 444         if (L2TP_SKB_CB(skb)->has_seq) {
 445                 /* Bump our Nr */
 446                 session->nr++;
 447                 session->nr &= session->nr_max;
 448
 449                 l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated nr to %hu\n",
 450                          session->name, session->nr);
 451         }
 452
 453         /* call private receive handler */
 454         if (session->recv_skb)
 455                 (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length);
 456         else
 457                 kfree_skb(skb);
 458 }
 459
 460 /* Dequeue skbs from the session's reorder_q, subject to packet order.
 461  * Skbs that have been in the queue for too long are simply discarded.
 462  */
 463 static void l2tp_recv_dequeue(struct l2tp_session *session)
 464 {
 465         struct sk_buff *skb;
 466         struct sk_buff *tmp;
 467
 468         /* If the pkt at the head of the queue has the nr that we
 469          * expect to send up next, dequeue it and any other
 470          * in-sequence packets behind it.
 471          */
 472 start:
 473         spin_lock_bh(&session->reorder_q.lock);
 474         skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
 475                 if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) {
 476                         atomic_long_inc(&session->stats.rx_seq_discards);
 477                         atomic_long_inc(&session->stats.rx_errors);
 478                         l2tp_dbg(session, L2TP_MSG_SEQ,
 479                                  "%s: oos pkt %u len %d discarded (too old), waiting for %u, reorder_q_len=%d\n",
 480                                  session->name, L2TP_SKB_CB(skb)->ns,
 481                                  L2TP_SKB_CB(skb)->length, session->nr,
 482                                  skb_queue_len(&session->reorder_q));
 483                         session->reorder_skip = 1;
 484                         __skb_unlink(skb, &session->reorder_q);
 485                         kfree_skb(skb);
 486                         continue;
 487                 }
 488
 489                 if (L2TP_SKB_CB(skb)->has_seq) {
 490                         if (session->reorder_skip) {
 491                                 l2tp_dbg(session, L2TP_MSG_SEQ,
 492                                          "%s: advancing nr to next pkt: %u -> %u",
 493                                          session->name, session->nr,
 494                                          L2TP_SKB_CB(skb)->ns);
 495                                 session->reorder_skip = 0;
 496                                 session->nr = L2TP_SKB_CB(skb)->ns;
 497                         }
 498                         if (L2TP_SKB_CB(skb)->ns != session->nr) {
 499                                 l2tp_dbg(session, L2TP_MSG_SEQ,
 500                                          "%s: holding oos pkt %u len %d, waiting for %u, reorder_q_len=%d\n",
 501                                          session->name, L2TP_SKB_CB(skb)->ns,
 502                                          L2TP_SKB_CB(skb)->length, session->nr,
 503                                          skb_queue_len(&session->reorder_q));
 504                                 goto out;
 505                         }
 506                 }
 507                 __skb_unlink(skb, &session->reorder_q);
 508
 509                 /* Process the skb. We release the queue lock while we
 510                  * do so to let other contexts process the queue.
 511                  */
 512                 spin_unlock_bh(&session->reorder_q.lock);
 513                 l2tp_recv_dequeue_skb(session, skb);
 514                 goto start;
 515         }
 516
 517 out:
 518         spin_unlock_bh(&session->reorder_q.lock);
 519 }
 520
 521 static int l2tp_seq_check_rx_window(struct l2tp_session *session, u32 nr)
 522 {
 523         u32 nws;
 524
 525         if (nr >= session->nr)
 526                 nws = nr - session->nr;
 527         else
 528                 nws = (session->nr_max + 1) - (session->nr - nr);
 529
 530         return nws < session->nr_window_size;
 531 }
 532
 533 /* If packet has sequence numbers, queue it if acceptable. Returns 0 if
 534  * acceptable, else non-zero.
 535  */
 536 static int l2tp_recv_data_seq(struct l2tp_session *session, struct sk_buff *skb)
 537 {
 538         if (!l2tp_seq_check_rx_window(session, L2TP_SKB_CB(skb)->ns)) {
 539                 /* Packet sequence number is outside allowed window.
 540                  * Discard it.
 541                  */
 542                 l2tp_dbg(session, L2TP_MSG_SEQ,
 543                          "%s: pkt %u len %d discarded, outside window, nr=%u\n",
 544                          session->name, L2TP_SKB_CB(skb)->ns,
 545                          L2TP_SKB_CB(skb)->length, session->nr);
 546                 goto discard;
 547         }
 548
 549         if (session->reorder_timeout != 0) {
 550                 /* Packet reordering enabled. Add skb to session's
 551                  * reorder queue, in order of ns.
 552                  */
 553                 l2tp_recv_queue_skb(session, skb);
 554                 goto out;
 555         }
 556
 557         /* Packet reordering disabled. Discard out-of-sequence packets, while
 558          * tracking the number if in-sequence packets after the first OOS packet
 559          * is seen. After nr_oos_count_max in-sequence packets, reset the
 560          * sequence number to re-enable packet reception.
 561          */
 562         if (L2TP_SKB_CB(skb)->ns == session->nr) {
 563                 skb_queue_tail(&session->reorder_q, skb);
 564         } else {
 565                 u32 nr_oos = L2TP_SKB_CB(skb)->ns;
 566                 u32 nr_next = (session->nr_oos + 1) & session->nr_max;
 567
 568                 if (nr_oos == nr_next)
 569                         session->nr_oos_count++;
 570                 else
 571                         session->nr_oos_count = 0;
 572
 573                 session->nr_oos = nr_oos;
 574                 if (session->nr_oos_count > session->nr_oos_count_max) {
 575                         session->reorder_skip = 1;
 576                         l2tp_dbg(session, L2TP_MSG_SEQ,
 577                                  "%s: %d oos packets received. Resetting sequence numbers\n",
 578                                  session->name, session->nr_oos_count);
 579                 }
 580                 if (!session->reorder_skip) {
 581                         atomic_long_inc(&session->stats.rx_seq_discards);
 582                         l2tp_dbg(session, L2TP_MSG_SEQ,
 583                                  "%s: oos pkt %u len %d discarded, waiting for %u, reorder_q_len=%d\n",
 584                                  session->name, L2TP_SKB_CB(skb)->ns,
 585                                  L2TP_SKB_CB(skb)->length, session->nr,
 586                                  skb_queue_len(&session->reorder_q));
 587                         goto discard;
 588                 }
 589                 skb_queue_tail(&session->reorder_q, skb);
 590         }
 591
 592 out:
 593         return 0;
 594
 595 discard:
 596         return 1;
 597 }
 598
 599 /* Do receive processing of L2TP data frames. We handle both L2TPv2
 600  * and L2TPv3 data frames here.
 601  *
 602  * L2TPv2 Data Message Header
 603  *
 604  *  0                   1                   2                   3
 605  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 606  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 607  * |T|L|x|x|S|x|O|P|x|x|x|x|  Ver  |          Length (opt)         |
 608  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 609  * |           Tunnel ID           |           Session ID          |
 610  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 611  * |             Ns (opt)          |             Nr (opt)          |
 612  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 613  * |      Offset Size (opt)        |    Offset pad... (opt)
 614  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 615  *
 616  * Data frames are marked by T=0. All other fields are the same as
 617  * those in L2TP control frames.
 618  *
 619  * L2TPv3 Data Message Header
 620  *
 621  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 622  * |                      L2TP Session Header                      |
 623  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 624  * |                      L2-Specific Sublayer                     |
 625  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 626  * |                        Tunnel Payload                      ...
 627  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 628  *
 629  * L2TPv3 Session Header Over IP
 630  *
 631  *  0                   1                   2                   3
 632  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 633  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 634  * |                           Session ID                          |
 635  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 636  * |               Cookie (optional, maximum 64 bits)...
 637  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 638  *                                                                 |
 639  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 640  *
 641  * L2TPv3 L2-Specific Sublayer Format
 642  *
 643  *  0                   1                   2                   3
 644  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 645  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 646  * |x|S|x|x|x|x|x|x|              Sequence Number                  |
 647  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 648  *
 649  * Cookie value and sublayer format are negotiated with the peer when
 650  * the session is set up. Unlike L2TPv2, we do not need to parse the
 651  * packet header to determine if optional fields are present.
 652  *
 653  * Caller must already have parsed the frame and determined that it is
 654  * a data (not control) frame before coming here. Fields up to the
 655  * session-id have already been parsed and ptr points to the data
 656  * after the session-id.
 657  */
 658 void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
 659                       unsigned char *ptr, unsigned char *optr, u16 hdrflags,
 660                       int length)
 661 {
 662         struct l2tp_tunnel *tunnel = session->tunnel;
 663         u32 ns = 0, nr = 0;
 664         int offset;
 665
 666         /* Parse and check optional cookie */
 667         if (session->peer_cookie_len > 0) {
 668                 if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
 669                         l2tp_info(tunnel, L2TP_MSG_DATA,
 670                                   "%s: cookie mismatch (%u/%u). Discarding.\n",
 671                                   tunnel->name, tunnel->tunnel_id,
 672                                   session->session_id);
 673                         atomic_long_inc(&session->stats.rx_cookie_discards);
 674                         goto discard;
 675                 }
 676                 ptr += session->peer_cookie_len;
 677         }
 678
 679         /* Handle the optional sequence numbers. Sequence numbers are
 680          * in different places for L2TPv2 and L2TPv3.
 681          *
 682          * If we are the LAC, enable/disable sequence numbers under
 683          * the control of the LNS.  If no sequence numbers present but
 684          * we were expecting them, discard frame.
 685          */
 686         L2TP_SKB_CB(skb)->has_seq = 0;
 687         if (tunnel->version == L2TP_HDR_VER_2) {
 688                 if (hdrflags & L2TP_HDRFLAG_S) {
 689                         ns = ntohs(*(__be16 *)ptr);
 690                         ptr += 2;
 691                         nr = ntohs(*(__be16 *)ptr);
 692                         ptr += 2;
 693
 694                         /* Store L2TP info in the skb */
 695                         L2TP_SKB_CB(skb)->ns = ns;
 696                         L2TP_SKB_CB(skb)->has_seq = 1;
 697
 698                         l2tp_dbg(session, L2TP_MSG_SEQ,
 699                                  "%s: recv data ns=%u, nr=%u, session nr=%u\n",
 700                                  session->name, ns, nr, session->nr);
 701                 }
 702         } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
 703                 u32 l2h = ntohl(*(__be32 *)ptr);
 704
 705                 if (l2h & 0x40000000) {
 706                         ns = l2h & 0x00ffffff;
 707
 708                         /* Store L2TP info in the skb */
 709                         L2TP_SKB_CB(skb)->ns = ns;
 710                         L2TP_SKB_CB(skb)->has_seq = 1;
 711
 712                         l2tp_dbg(session, L2TP_MSG_SEQ,
 713                                  "%s: recv data ns=%u, session nr=%u\n",
 714                                  session->name, ns, session->nr);
 715                 }
 716                 ptr += 4;
 717         }
 718
 719         if (L2TP_SKB_CB(skb)->has_seq) {
 720                 /* Received a packet with sequence numbers. If we're the LAC,
 721                  * check if we sre sending sequence numbers and if not,
 722                  * configure it so.
 723                  */
 724                 if (!session->lns_mode && !session->send_seq) {
 725                         l2tp_info(session, L2TP_MSG_SEQ,
 726                                   "%s: requested to enable seq numbers by LNS\n",
 727                                   session->name);
 728                         session->send_seq = 1;
 729                         l2tp_session_set_header_len(session, tunnel->version);
 730                 }
 731         } else {
 732                 /* No sequence numbers.
 733                  * If user has configured mandatory sequence numbers, discard.
 734                  */
 735                 if (session->recv_seq) {
 736                         l2tp_warn(session, L2TP_MSG_SEQ,
 737                                   "%s: recv data has no seq numbers when required. Discarding.\n",
 738                                   session->name);
 739                         atomic_long_inc(&session->stats.rx_seq_discards);
 740                         goto discard;
 741                 }
 742
 743                 /* If we're the LAC and we're sending sequence numbers, the
 744                  * LNS has requested that we no longer send sequence numbers.
 745                  * If we're the LNS and we're sending sequence numbers, the
 746                  * LAC is broken. Discard the frame.
 747                  */
 748                 if (!session->lns_mode && session->send_seq) {
 749                         l2tp_info(session, L2TP_MSG_SEQ,
 750                                   "%s: requested to disable seq numbers by LNS\n",
 751                                   session->name);
 752                         session->send_seq = 0;
 753                         l2tp_session_set_header_len(session, tunnel->version);
 754                 } else if (session->send_seq) {
 755                         l2tp_warn(session, L2TP_MSG_SEQ,
 756                                   "%s: recv data has no seq numbers when required. Discarding.\n",
 757                                   session->name);
 758                         atomic_long_inc(&session->stats.rx_seq_discards);
 759                         goto discard;
 760                 }
 761         }
 762
 763         /* Session data offset is defined only for L2TPv2 and is
 764          * indicated by an optional 16-bit value in the header.
 765          */
 766         if (tunnel->version == L2TP_HDR_VER_2) {
 767                 /* If offset bit set, skip it. */
 768                 if (hdrflags & L2TP_HDRFLAG_O) {
 769                         offset = ntohs(*(__be16 *)ptr);
 770                         ptr += 2 + offset;
 771                 }
 772         }
 773
 774         offset = ptr - optr;
 775         if (!pskb_may_pull(skb, offset))
 776                 goto discard;
 777
 778         __skb_pull(skb, offset);
 779
 780         /* Prepare skb for adding to the session's reorder_q.  Hold
 781          * packets for max reorder_timeout or 1 second if not
 782          * reordering.
 783          */
 784         L2TP_SKB_CB(skb)->length = length;
 785         L2TP_SKB_CB(skb)->expires = jiffies +
 786                 (session->reorder_timeout ? session->reorder_timeout : HZ);
 787
 788         /* Add packet to the session's receive queue. Reordering is done here, if
 789          * enabled. Saved L2TP protocol info is stored in skb->sb[].
 790          */
 791         if (L2TP_SKB_CB(skb)->has_seq) {
 792                 if (l2tp_recv_data_seq(session, skb))
 793                         goto discard;
 794         } else {
 795                 /* No sequence numbers. Add the skb to the tail of the
 796                  * reorder queue. This ensures that it will be
 797                  * delivered after all previous sequenced skbs.
 798                  */
 799                 skb_queue_tail(&session->reorder_q, skb);
 800         }
 801
 802         /* Try to dequeue as many skbs from reorder_q as we can. */
 803         l2tp_recv_dequeue(session);
 804
 805         return;
 806
 807 discard:
 808         atomic_long_inc(&session->stats.rx_errors);
 809         kfree_skb(skb);
 810 }
 811 EXPORT_SYMBOL_GPL(l2tp_recv_common);
 812
 813 /* Drop skbs from the session's reorder_q
 814  */
 815 static void l2tp_session_queue_purge(struct l2tp_session *session)
 816 {
 817         struct sk_buff *skb = NULL;
 818
 819         if (WARN_ON(session->magic != L2TP_SESSION_MAGIC))
 820                 return;
 821
 822         while ((skb = skb_dequeue(&session->reorder_q))) {
 823                 atomic_long_inc(&session->stats.rx_errors);
 824                 kfree_skb(skb);
 825         }
 826 }
 827
 828 /* Internal UDP receive frame. Do the real work of receiving an L2TP data frame
 829  * here. The skb is not on a list when we get here.
 830  * Returns 0 if the packet was a data packet and was successfully passed on.
 831  * Returns 1 if the packet was not a good data packet and could not be
 832  * forwarded.  All such packets are passed up to userspace to deal with.
 833  */
 834 static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb)
 835 {
 836         struct l2tp_session *session = NULL;
 837         unsigned char *ptr, *optr;
 838         u16 hdrflags;
 839         u32 tunnel_id, session_id;
 840         u16 version;
 841         int length;
 842
 843         /* UDP has verifed checksum */
 844
 845         /* UDP always verifies the packet length. */
 846         __skb_pull(skb, sizeof(struct udphdr));
 847
 848         /* Short packet? */
 849         if (!pskb_may_pull(skb, L2TP_HDR_SIZE_MAX)) {
 850                 l2tp_info(tunnel, L2TP_MSG_DATA,
 851                           "%s: recv short packet (len=%d)\n",
 852                           tunnel->name, skb->len);
 853                 goto error;
 854         }
 855
 856         /* Trace packet contents, if enabled */
 857         if (tunnel->debug & L2TP_MSG_DATA) {
 858                 length = min(32u, skb->len);
 859                 if (!pskb_may_pull(skb, length))
 860                         goto error;
 861
 862                 pr_debug("%s: recv\n", tunnel->name);
 863                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length);
 864         }
 865
 866         /* Point to L2TP header */
 867         optr = skb->data;
 868         ptr = skb->data;
 869
 870         /* Get L2TP header flags */
 871         hdrflags = ntohs(*(__be16 *)ptr);
 872
 873         /* Check protocol version */
 874         version = hdrflags & L2TP_HDR_VER_MASK;
 875         if (version != tunnel->version) {
 876                 l2tp_info(tunnel, L2TP_MSG_DATA,
 877                           "%s: recv protocol version mismatch: got %d expected %d\n",
 878                           tunnel->name, version, tunnel->version);
 879                 goto error;
 880         }
 881
 882         /* Get length of L2TP packet */
 883         length = skb->len;
 884
 885         /* If type is control packet, it is handled by userspace. */
 886         if (hdrflags & L2TP_HDRFLAG_T) {
 887                 l2tp_dbg(tunnel, L2TP_MSG_DATA,
 888                          "%s: recv control packet, len=%d\n",
 889                          tunnel->name, length);
 890                 goto error;
 891         }
 892
 893         /* Skip flags */
 894         ptr += 2;
 895
 896         if (tunnel->version == L2TP_HDR_VER_2) {
 897                 /* If length is present, skip it */
 898                 if (hdrflags & L2TP_HDRFLAG_L)
 899                         ptr += 2;
 900
 901                 /* Extract tunnel and session ID */
 902                 tunnel_id = ntohs(*(__be16 *)ptr);
 903                 ptr += 2;
 904                 session_id = ntohs(*(__be16 *)ptr);
 905                 ptr += 2;
 906         } else {
 907                 ptr += 2;       /* skip reserved bits */
 908                 tunnel_id = tunnel->tunnel_id;
 909                 session_id = ntohl(*(__be32 *)ptr);
 910                 ptr += 4;
 911         }
 912
 913         /* Find the session context */
 914         session = l2tp_tunnel_get_session(tunnel, session_id);
 915         if (!session || !session->recv_skb) {
 916                 if (session)
 917                         l2tp_session_dec_refcount(session);
 918
 919                 /* Not found? Pass to userspace to deal with */
 920                 l2tp_info(tunnel, L2TP_MSG_DATA,
 921                           "%s: no session found (%u/%u). Passing up.\n",
 922                           tunnel->name, tunnel_id, session_id);
 923                 goto error;
 924         }
 925
 926         if (tunnel->version == L2TP_HDR_VER_3 &&
 927             l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr))
 928                 goto error;
 929
 930         l2tp_recv_common(session, skb, ptr, optr, hdrflags, length);
 931         l2tp_session_dec_refcount(session);
 932
 933         return 0;
 934
 935 error:
 936         /* Put UDP header back */
 937         __skb_push(skb, sizeof(struct udphdr));
 938
 939         return 1;
 940 }
 941
 942 /* UDP encapsulation receive handler. See net/ipv4/udp.c.
 943  * Return codes:
 944  * 0 : success.
 945  * <0: error
 946  * >0: skb should be passed up to userspace as UDP.
 947  */
 948 int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
 949 {
 950         struct l2tp_tunnel *tunnel;
 951
 952         tunnel = rcu_dereference_sk_user_data(sk);
 953         if (!tunnel)
 954                 goto pass_up;
 955
 956         l2tp_dbg(tunnel, L2TP_MSG_DATA, "%s: received %d bytes\n",
 957                  tunnel->name, skb->len);
 958
 959         if (l2tp_udp_recv_core(tunnel, skb))
 960                 goto pass_up;
 961
 962         return 0;
 963
 964 pass_up:
 965         return 1;
 966 }
 967 EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv);
 968
 969 /************************************************************************
 970  * Transmit handling
 971  ***********************************************************************/
 972
 973 /* Build an L2TP header for the session into the buffer provided.
 974  */
 975 static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf)
 976 {
 977         struct l2tp_tunnel *tunnel = session->tunnel;
 978         __be16 *bufp = buf;
 979         __be16 *optr = buf;
 980         u16 flags = L2TP_HDR_VER_2;
 981         u32 tunnel_id = tunnel->peer_tunnel_id;
 982         u32 session_id = session->peer_session_id;
 983
 984         if (session->send_seq)
 985                 flags |= L2TP_HDRFLAG_S;
 986
 987         /* Setup L2TP header. */
 988         *bufp++ = htons(flags);
 989         *bufp++ = htons(tunnel_id);
 990         *bufp++ = htons(session_id);
 991         if (session->send_seq) {
 992                 *bufp++ = htons(session->ns);
 993                 *bufp++ = 0;
 994                 session->ns++;
 995                 session->ns &= 0xffff;
 996                 l2tp_dbg(session, L2TP_MSG_SEQ, "%s: updated ns to %u\n",
 997                          session->name, session->ns);
 998         }
 999
1000         return bufp - optr;
1001 }
1002
1003 static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf)
1004 {
1005         struct l2tp_tunnel *tunnel = session->tunnel;
1006         char *bufp = buf;
1007         char *optr = bufp;
1008
1009         /* Setup L2TP header. The header differs slightly for UDP and
1010          * IP encapsulations. For UDP, there is 4 bytes of flags.
1011          */
1012         if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
1013                 u16 flags = L2TP_HDR_VER_3;
1014                 *((__be16 *)bufp) = htons(flags);
1015                 bufp += 2;
1016                 *((__be16 *)bufp) = 0;
1017                 bufp += 2;
1018         }
1019
1020         *((__be32 *)bufp) = htonl(session->peer_session_id);
1021         bufp += 4;
1022         if (session->cookie_len) {
1023                 memcpy(bufp, &session->cookie[0], session->cookie_len);
1024                 bufp += session->cookie_len;
1025         }
1026         if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) {
1027                 u32 l2h = 0;
1028
1029                 if (session->send_seq) {
1030                         l2h = 0x40000000 | session->ns;
1031                         session->ns++;
1032                         session->ns &= 0xffffff;
1033                         l2tp_dbg(session, L2TP_MSG_SEQ,
1034                                  "%s: updated ns to %u\n",
1035                                  session->name, session->ns);
1036                 }
1037
1038                 *((__be32 *)bufp) = htonl(l2h);
1039                 bufp += 4;
1040         }
1041
1042         return bufp - optr;
1043 }
1044
1045 static void l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
1046                            struct flowi *fl, size_t data_len)
1047 {
1048         struct l2tp_tunnel *tunnel = session->tunnel;
1049         unsigned int len = skb->len;
1050         int error;
1051
1052         /* Debug */
1053         if (session->send_seq)
1054                 l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %zd bytes, ns=%u\n",
1055                          session->name, data_len, session->ns - 1);
1056         else
1057                 l2tp_dbg(session, L2TP_MSG_DATA, "%s: send %zd bytes\n",
1058                          session->name, data_len);
1059
1060         if (session->debug & L2TP_MSG_DATA) {
1061                 int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1062                 unsigned char *datap = skb->data + uhlen;
1063
1064                 pr_debug("%s: xmit\n", session->name);
1065                 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET,
1066                                      datap, min_t(size_t, 32, len - uhlen));
1067         }
1068
1069         /* Queue the packet to IP for output */
1070         skb->ignore_df = 1;
1071         skb_dst_drop(skb);
1072 #if IS_ENABLED(CONFIG_IPV6)
1073         if (l2tp_sk_is_v6(tunnel->sock))
1074                 error = inet6_csk_xmit(tunnel->sock, skb, NULL);
1075         else
1076 #endif
1077                 error = ip_queue_xmit(tunnel->sock, skb, fl);
1078
1079         /* Update stats */
1080         if (error >= 0) {
1081                 atomic_long_inc(&tunnel->stats.tx_packets);
1082                 atomic_long_add(len, &tunnel->stats.tx_bytes);
1083                 atomic_long_inc(&session->stats.tx_packets);
1084                 atomic_long_add(len, &session->stats.tx_bytes);
1085         } else {
1086                 atomic_long_inc(&tunnel->stats.tx_errors);
1087                 atomic_long_inc(&session->stats.tx_errors);
1088         }
1089 }
1090
1091 /* If caller requires the skb to have a ppp header, the header must be
1092  * inserted in the skb data before calling this function.
1093  */
1094 int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len)
1095 {
1096         int data_len = skb->len;
1097         struct l2tp_tunnel *tunnel = session->tunnel;
1098         struct sock *sk = tunnel->sock;
1099         struct flowi *fl;
1100         struct udphdr *uh;
1101         struct inet_sock *inet;
1102         int headroom;
1103         int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0;
1104         int udp_len;
1105         int ret = NET_XMIT_SUCCESS;
1106
1107         /* Check that there's enough headroom in the skb to insert IP,
1108          * UDP and L2TP headers. If not enough, expand it to
1109          * make room. Adjust truesize.
1110          */
1111         headroom = NET_SKB_PAD + sizeof(struct iphdr) +
1112                 uhlen + hdr_len;
1113         if (skb_cow_head(skb, headroom)) {
1114                 kfree_skb(skb);
1115                 return NET_XMIT_DROP;
1116         }
1117
1118         /* Setup L2TP header */
1119         if (tunnel->version == L2TP_HDR_VER_2)
1120                 l2tp_build_l2tpv2_header(session, __skb_push(skb, hdr_len));
1121         else
1122                 l2tp_build_l2tpv3_header(session, __skb_push(skb, hdr_len));
1123
1124         /* Reset skb netfilter state */
1125         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
1126         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
1127                               IPSKB_REROUTED);
1128         nf_reset_ct(skb);
1129
1130         bh_lock_sock(sk);
1131         if (sock_owned_by_user(sk)) {
1132                 kfree_skb(skb);
1133                 ret = NET_XMIT_DROP;
1134                 goto out_unlock;
1135         }
1136
1137         /* The user-space may change the connection status for the user-space
1138          * provided socket at run time: we must check it under the socket lock
1139          */
1140         if (tunnel->fd >= 0 && sk->sk_state != TCP_ESTABLISHED) {
1141                 kfree_skb(skb);
1142                 ret = NET_XMIT_DROP;
1143                 goto out_unlock;
1144         }
1145
1146         inet = inet_sk(sk);
1147         fl = &inet->cork.fl;
1148         switch (tunnel->encap) {
1149         case L2TP_ENCAPTYPE_UDP:
1150                 /* Setup UDP header */
1151                 __skb_push(skb, sizeof(*uh));
1152                 skb_reset_transport_header(skb);
1153                 uh = udp_hdr(skb);
1154                 uh->source = inet->inet_sport;
1155                 uh->dest = inet->inet_dport;
1156                 udp_len = uhlen + hdr_len + data_len;
1157                 uh->len = htons(udp_len);
1158
1159                 /* Calculate UDP checksum if configured to do so */
1160 #if IS_ENABLED(CONFIG_IPV6)
1161                 if (l2tp_sk_is_v6(sk))
1162                         udp6_set_csum(udp_get_no_check6_tx(sk),
1163                                       skb, &inet6_sk(sk)->saddr,
1164                                       &sk->sk_v6_daddr, udp_len);
1165                 else
1166 #endif
1167                         udp_set_csum(sk->sk_no_check_tx, skb, inet->inet_saddr,
1168                                      inet->inet_daddr, udp_len);
1169                 break;
1170
1171         case L2TP_ENCAPTYPE_IP:
1172                 break;
1173         }
1174
1175         l2tp_xmit_core(session, skb, fl, data_len);
1176 out_unlock:
1177         bh_unlock_sock(sk);
1178
1179         return ret;
1180 }
1181 EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
1182
1183 /*****************************************************************************
1184  * Tinnel and session create/destroy.
1185  *****************************************************************************/
1186
1187 /* Tunnel socket destruct hook.
1188  * The tunnel context is deleted only when all session sockets have been
1189  * closed.
1190  */
1191 static void l2tp_tunnel_destruct(struct sock *sk)
1192 {
1193         struct l2tp_tunnel *tunnel = l2tp_tunnel(sk);
1194
1195         if (!tunnel)
1196                 goto end;
1197
1198         l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing...\n", tunnel->name);
1199
1200         /* Disable udp encapsulation */
1201         switch (tunnel->encap) {
1202         case L2TP_ENCAPTYPE_UDP:
1203                 /* No longer an encapsulation socket. See net/ipv4/udp.c */
1204                 (udp_sk(sk))->encap_type = 0;
1205                 (udp_sk(sk))->encap_rcv = NULL;
1206                 (udp_sk(sk))->encap_destroy = NULL;
1207                 break;
1208         case L2TP_ENCAPTYPE_IP:
1209                 break;
1210         }
1211
1212         /* Remove hooks into tunnel socket */
1213         sk->sk_destruct = tunnel->old_sk_destruct;
1214         sk->sk_user_data = NULL;
1215
1216         /* Call the original destructor */
1217         if (sk->sk_destruct)
1218                 (*sk->sk_destruct)(sk);
1219
1220         kfree_rcu(tunnel, rcu);
1221 end:
1222         return;
1223 }
1224
1225 /* Remove an l2tp session from l2tp_core's hash lists. */
1226 static void l2tp_session_unhash(struct l2tp_session *session)
1227 {
1228         struct l2tp_tunnel *tunnel = session->tunnel;
1229
1230         /* Remove the session from core hashes */
1231         if (tunnel) {
1232                 /* Remove from the per-tunnel hash */
1233                 write_lock_bh(&tunnel->hlist_lock);
1234                 hlist_del_init(&session->hlist);
1235                 write_unlock_bh(&tunnel->hlist_lock);
1236
1237                 /* For L2TPv3 we have a per-net hash: remove from there, too */
1238                 if (tunnel->version != L2TP_HDR_VER_2) {
1239                         struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
1240
1241                         spin_lock_bh(&pn->l2tp_session_hlist_lock);
1242                         hlist_del_init_rcu(&session->global_hlist);
1243                         spin_unlock_bh(&pn->l2tp_session_hlist_lock);
1244                         synchronize_rcu();
1245                 }
1246         }
1247 }
1248
1249 /* When the tunnel is closed, all the attached sessions need to go too.
1250  */
1251 static void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel)
1252 {
1253         int hash;
1254         struct hlist_node *walk;
1255         struct hlist_node *tmp;
1256         struct l2tp_session *session;
1257
1258         l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing all sessions...\n",
1259                   tunnel->name);
1260
1261         write_lock_bh(&tunnel->hlist_lock);
1262         tunnel->acpt_newsess = false;
1263         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
1264 again:
1265                 hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
1266                         session = hlist_entry(walk, struct l2tp_session, hlist);
1267
1268                         l2tp_info(session, L2TP_MSG_CONTROL,
1269                                   "%s: closing session\n", session->name);
1270
1271                         hlist_del_init(&session->hlist);
1272
1273                         if (test_and_set_bit(0, &session->dead))
1274                                 goto again;
1275
1276                         write_unlock_bh(&tunnel->hlist_lock);
1277
1278                         l2tp_session_unhash(session);
1279                         l2tp_session_queue_purge(session);
1280
1281                         if (session->session_close)
1282                                 (*session->session_close)(session);
1283
1284                         l2tp_session_dec_refcount(session);
1285
1286                         write_lock_bh(&tunnel->hlist_lock);
1287
1288                         /* Now restart from the beginning of this hash
1289                          * chain.  We always remove a session from the
1290                          * list so we are guaranteed to make forward
1291                          * progress.
1292                          */
1293                         goto again;
1294                 }
1295         }
1296         write_unlock_bh(&tunnel->hlist_lock);
1297 }
1298
1299 /* Tunnel socket destroy hook for UDP encapsulation */
1300 static void l2tp_udp_encap_destroy(struct sock *sk)
1301 {
1302         struct l2tp_tunnel *tunnel = l2tp_tunnel(sk);
1303
1304         if (tunnel)
1305                 l2tp_tunnel_delete(tunnel);
1306 }
1307
1308 /* Workqueue tunnel deletion function */
1309 static void l2tp_tunnel_del_work(struct work_struct *work)
1310 {
1311         struct l2tp_tunnel *tunnel = container_of(work, struct l2tp_tunnel,
1312                                                   del_work);
1313         struct sock *sk = tunnel->sock;
1314         struct socket *sock = sk->sk_socket;
1315         struct l2tp_net *pn;
1316
1317         l2tp_tunnel_closeall(tunnel);
1318
1319         /* If the tunnel socket was created within the kernel, use
1320          * the sk API to release it here.
1321          */
1322         if (tunnel->fd < 0) {
1323                 if (sock) {
1324                         kernel_sock_shutdown(sock, SHUT_RDWR);
1325                         sock_release(sock);
1326                 }
1327         }
1328
1329         /* Remove the tunnel struct from the tunnel list */
1330         pn = l2tp_pernet(tunnel->l2tp_net);
1331         spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1332         list_del_rcu(&tunnel->list);
1333         spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
1334
1335         /* drop initial ref */
1336         l2tp_tunnel_dec_refcount(tunnel);
1337
1338         /* drop workqueue ref */
1339         l2tp_tunnel_dec_refcount(tunnel);
1340 }
1341
1342 /* Create a socket for the tunnel, if one isn't set up by
1343  * userspace. This is used for static tunnels where there is no
1344  * managing L2TP daemon.
1345  *
1346  * Since we don't want these sockets to keep a namespace alive by
1347  * themselves, we drop the socket's namespace refcount after creation.
1348  * These sockets are freed when the namespace exits using the pernet
1349  * exit hook.
1350  */
1351 static int l2tp_tunnel_sock_create(struct net *net,
1352                                    u32 tunnel_id,
1353                                    u32 peer_tunnel_id,
1354                                    struct l2tp_tunnel_cfg *cfg,
1355                                    struct socket **sockp)
1356 {
1357         int err = -EINVAL;
1358         struct socket *sock = NULL;
1359         struct udp_port_cfg udp_conf;
1360
1361         switch (cfg->encap) {
1362         case L2TP_ENCAPTYPE_UDP:
1363                 memset(&udp_conf, 0, sizeof(udp_conf));
1364
1365 #if IS_ENABLED(CONFIG_IPV6)
1366                 if (cfg->local_ip6 && cfg->peer_ip6) {
1367                         udp_conf.family = AF_INET6;
1368                         memcpy(&udp_conf.local_ip6, cfg->local_ip6,
1369                                sizeof(udp_conf.local_ip6));
1370                         memcpy(&udp_conf.peer_ip6, cfg->peer_ip6,
1371                                sizeof(udp_conf.peer_ip6));
1372                         udp_conf.use_udp6_tx_checksums =
1373                           !cfg->udp6_zero_tx_checksums;
1374                         udp_conf.use_udp6_rx_checksums =
1375                           !cfg->udp6_zero_rx_checksums;
1376                 } else
1377 #endif
1378                 {
1379                         udp_conf.family = AF_INET;
1380                         udp_conf.local_ip = cfg->local_ip;
1381                         udp_conf.peer_ip = cfg->peer_ip;
1382                         udp_conf.use_udp_checksums = cfg->use_udp_checksums;
1383                 }
1384
1385                 udp_conf.local_udp_port = htons(cfg->local_udp_port);
1386                 udp_conf.peer_udp_port = htons(cfg->peer_udp_port);
1387
1388                 err = udp_sock_create(net, &udp_conf, &sock);
1389                 if (err < 0)
1390                         goto out;
1391
1392                 break;
1393
1394         case L2TP_ENCAPTYPE_IP:
1395 #if IS_ENABLED(CONFIG_IPV6)
1396                 if (cfg->local_ip6 && cfg->peer_ip6) {
1397                         struct sockaddr_l2tpip6 ip6_addr = {0};
1398
1399                         err = sock_create_kern(net, AF_INET6, SOCK_DGRAM,
1400                                                IPPROTO_L2TP, &sock);
1401                         if (err < 0)
1402                                 goto out;
1403
1404                         ip6_addr.l2tp_family = AF_INET6;
1405                         memcpy(&ip6_addr.l2tp_addr, cfg->local_ip6,
1406                                sizeof(ip6_addr.l2tp_addr));
1407                         ip6_addr.l2tp_conn_id = tunnel_id;
1408                         err = kernel_bind(sock, (struct sockaddr *)&ip6_addr,
1409                                           sizeof(ip6_addr));
1410                         if (err < 0)
1411                                 goto out;
1412
1413                         ip6_addr.l2tp_family = AF_INET6;
1414                         memcpy(&ip6_addr.l2tp_addr, cfg->peer_ip6,
1415                                sizeof(ip6_addr.l2tp_addr));
1416                         ip6_addr.l2tp_conn_id = peer_tunnel_id;
1417                         err = kernel_connect(sock,
1418                                              (struct sockaddr *)&ip6_addr,
1419                                              sizeof(ip6_addr), 0);
1420                         if (err < 0)
1421                                 goto out;
1422                 } else
1423 #endif
1424                 {
1425                         struct sockaddr_l2tpip ip_addr = {0};
1426
1427                         err = sock_create_kern(net, AF_INET, SOCK_DGRAM,
1428                                                IPPROTO_L2TP, &sock);
1429                         if (err < 0)
1430                                 goto out;
1431
1432                         ip_addr.l2tp_family = AF_INET;
1433                         ip_addr.l2tp_addr = cfg->local_ip;
1434                         ip_addr.l2tp_conn_id = tunnel_id;
1435                         err = kernel_bind(sock, (struct sockaddr *)&ip_addr,
1436                                           sizeof(ip_addr));
1437                         if (err < 0)
1438                                 goto out;
1439
1440                         ip_addr.l2tp_family = AF_INET;
1441                         ip_addr.l2tp_addr = cfg->peer_ip;
1442                         ip_addr.l2tp_conn_id = peer_tunnel_id;
1443                         err = kernel_connect(sock, (struct sockaddr *)&ip_addr,
1444                                              sizeof(ip_addr), 0);
1445                         if (err < 0)
1446                                 goto out;
1447                 }
1448                 break;
1449
1450         default:
1451                 goto out;
1452         }
1453
1454 out:
1455         *sockp = sock;
1456         if (err < 0 && sock) {
1457                 kernel_sock_shutdown(sock, SHUT_RDWR);
1458                 sock_release(sock);
1459                 *sockp = NULL;
1460         }
1461
1462         return err;
1463 }
1464
1465 static struct lock_class_key l2tp_socket_class;
1466
1467 int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id,
1468                        struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp)
1469 {
1470         struct l2tp_tunnel *tunnel = NULL;
1471         int err;
1472         enum l2tp_encap_type encap = L2TP_ENCAPTYPE_UDP;
1473
1474         if (cfg)
1475                 encap = cfg->encap;
1476
1477         tunnel = kzalloc(sizeof(*tunnel), GFP_KERNEL);
1478         if (!tunnel) {
1479                 err = -ENOMEM;
1480                 goto err;
1481         }
1482
1483         tunnel->version = version;
1484         tunnel->tunnel_id = tunnel_id;
1485         tunnel->peer_tunnel_id = peer_tunnel_id;
1486         tunnel->debug = L2TP_DEFAULT_DEBUG_FLAGS;
1487
1488         tunnel->magic = L2TP_TUNNEL_MAGIC;
1489         sprintf(&tunnel->name[0], "tunl %u", tunnel_id);
1490         rwlock_init(&tunnel->hlist_lock);
1491         tunnel->acpt_newsess = true;
1492
1493         if (cfg)
1494                 tunnel->debug = cfg->debug;
1495
1496         tunnel->encap = encap;
1497
1498         refcount_set(&tunnel->ref_count, 1);
1499         tunnel->fd = fd;
1500
1501         /* Init delete workqueue struct */
1502         INIT_WORK(&tunnel->del_work, l2tp_tunnel_del_work);
1503
1504         INIT_LIST_HEAD(&tunnel->list);
1505
1506         err = 0;
1507 err:
1508         if (tunnelp)
1509                 *tunnelp = tunnel;
1510
1511         return err;
1512 }
1513 EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
1514
1515 static int l2tp_validate_socket(const struct sock *sk, const struct net *net,
1516                                 enum l2tp_encap_type encap)
1517 {
1518         if (!net_eq(sock_net(sk), net))
1519                 return -EINVAL;
1520
1521         if (sk->sk_type != SOCK_DGRAM)
1522                 return -EPROTONOSUPPORT;
1523
1524         if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)
1525                 return -EPROTONOSUPPORT;
1526
1527         if ((encap == L2TP_ENCAPTYPE_UDP && sk->sk_protocol != IPPROTO_UDP) ||
1528             (encap == L2TP_ENCAPTYPE_IP && sk->sk_protocol != IPPROTO_L2TP))
1529                 return -EPROTONOSUPPORT;
1530
1531         if (sk->sk_user_data)
1532                 return -EBUSY;
1533
1534         return 0;
1535 }
1536
1537 int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
1538                          struct l2tp_tunnel_cfg *cfg)
1539 {
1540         struct l2tp_tunnel *tunnel_walk;
1541         struct l2tp_net *pn;
1542         struct socket *sock;
1543         struct sock *sk;
1544         int ret;
1545
1546         if (tunnel->fd < 0) {
1547                 ret = l2tp_tunnel_sock_create(net, tunnel->tunnel_id,
1548                                               tunnel->peer_tunnel_id, cfg,
1549                                               &sock);
1550                 if (ret < 0)
1551                         goto err;
1552         } else {
1553                 sock = sockfd_lookup(tunnel->fd, &ret);
1554                 if (!sock)
1555                         goto err;
1556
1557                 ret = l2tp_validate_socket(sock->sk, net, tunnel->encap);
1558                 if (ret < 0)
1559                         goto err_sock;
1560         }
1561
1562         tunnel->l2tp_net = net;
1563         pn = l2tp_pernet(net);
1564
1565         spin_lock_bh(&pn->l2tp_tunnel_list_lock);
1566         list_for_each_entry(tunnel_walk, &pn->l2tp_tunnel_list, list) {
1567                 if (tunnel_walk->tunnel_id == tunnel->tunnel_id) {
1568                         spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
1569
1570                         ret = -EEXIST;
1571                         goto err_sock;
1572                 }
1573         }
1574         list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
1575         spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
1576
1577         sk = sock->sk;
1578         sock_hold(sk);
1579         tunnel->sock = sk;
1580
1581         if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
1582                 struct udp_tunnel_sock_cfg udp_cfg = {
1583                         .sk_user_data = tunnel,
1584                         .encap_type = UDP_ENCAP_L2TPINUDP,
1585                         .encap_rcv = l2tp_udp_encap_recv,
1586                         .encap_destroy = l2tp_udp_encap_destroy,
1587                 };
1588
1589                 setup_udp_tunnel_sock(net, sock, &udp_cfg);
1590         } else {
1591                 sk->sk_user_data = tunnel;
1592         }
1593
1594         tunnel->old_sk_destruct = sk->sk_destruct;
1595         sk->sk_destruct = &l2tp_tunnel_destruct;
1596         lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class,
1597                                    "l2tp_sock");
1598         sk->sk_allocation = GFP_ATOMIC;
1599
1600         if (tunnel->fd >= 0)
1601                 sockfd_put(sock);
1602
1603         return 0;
1604
1605 err_sock:
1606         if (tunnel->fd < 0)
1607                 sock_release(sock);
1608         else
1609                 sockfd_put(sock);
1610 err:
1611         return ret;
1612 }
1613 EXPORT_SYMBOL_GPL(l2tp_tunnel_register);
1614
1615 /* This function is used by the netlink TUNNEL_DELETE command.
1616  */
1617 void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
1618 {
1619         if (!test_and_set_bit(0, &tunnel->dead)) {
1620                 l2tp_tunnel_inc_refcount(tunnel);
1621                 queue_work(l2tp_wq, &tunnel->del_work);
1622         }
1623 }
1624 EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
1625
1626 void l2tp_session_delete(struct l2tp_session *session)
1627 {
1628         if (test_and_set_bit(0, &session->dead))
1629                 return;
1630
1631         l2tp_session_unhash(session);
1632         l2tp_session_queue_purge(session);
1633         if (session->session_close)
1634                 (*session->session_close)(session);
1635
1636         l2tp_session_dec_refcount(session);
1637 }
1638 EXPORT_SYMBOL_GPL(l2tp_session_delete);
1639
1640 /* We come here whenever a session's send_seq, cookie_len or
1641  * l2specific_type parameters are set.
1642  */
1643 void l2tp_session_set_header_len(struct l2tp_session *session, int version)
1644 {
1645         if (version == L2TP_HDR_VER_2) {
1646                 session->hdr_len = 6;
1647                 if (session->send_seq)
1648                         session->hdr_len += 4;
1649         } else {
1650                 session->hdr_len = 4 + session->cookie_len;
1651                 session->hdr_len += l2tp_get_l2specific_len(session);
1652                 if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP)
1653                         session->hdr_len += 4;
1654         }
1655 }
1656 EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
1657
1658 struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id,
1659                                          u32 peer_session_id, struct l2tp_session_cfg *cfg)
1660 {
1661         struct l2tp_session *session;
1662
1663         session = kzalloc(sizeof(*session) + priv_size, GFP_KERNEL);
1664         if (session) {
1665                 session->magic = L2TP_SESSION_MAGIC;
1666                 session->tunnel = tunnel;
1667
1668                 session->session_id = session_id;
1669                 session->peer_session_id = peer_session_id;
1670                 session->nr = 0;
1671                 if (tunnel->version == L2TP_HDR_VER_2)
1672                         session->nr_max = 0xffff;
1673                 else
1674                         session->nr_max = 0xffffff;
1675                 session->nr_window_size = session->nr_max / 2;
1676                 session->nr_oos_count_max = 4;
1677
1678                 /* Use NR of first received packet */
1679                 session->reorder_skip = 1;
1680
1681                 sprintf(&session->name[0], "sess %u/%u",
1682                         tunnel->tunnel_id, session->session_id);
1683
1684                 skb_queue_head_init(&session->reorder_q);
1685
1686                 INIT_HLIST_NODE(&session->hlist);
1687                 INIT_HLIST_NODE(&session->global_hlist);
1688
1689                 /* Inherit debug options from tunnel */
1690                 session->debug = tunnel->debug;
1691
1692                 if (cfg) {
1693                         session->pwtype = cfg->pw_type;
1694                         session->debug = cfg->debug;
1695                         session->send_seq = cfg->send_seq;
1696                         session->recv_seq = cfg->recv_seq;
1697                         session->lns_mode = cfg->lns_mode;
1698                         session->reorder_timeout = cfg->reorder_timeout;
1699                         session->l2specific_type = cfg->l2specific_type;
1700                         session->cookie_len = cfg->cookie_len;
1701                         memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len);
1702                         session->peer_cookie_len = cfg->peer_cookie_len;
1703                         memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len);
1704                 }
1705
1706                 l2tp_session_set_header_len(session, tunnel->version);
1707
1708                 refcount_set(&session->ref_count, 1);
1709
1710                 return session;
1711         }
1712
1713         return ERR_PTR(-ENOMEM);
1714 }
1715 EXPORT_SYMBOL_GPL(l2tp_session_create);
1716
1717 /*****************************************************************************
1718  * Init and cleanup
1719  *****************************************************************************/
1720
1721 static __net_init int l2tp_init_net(struct net *net)
1722 {
1723         struct l2tp_net *pn = net_generic(net, l2tp_net_id);
1724         int hash;
1725
1726         INIT_LIST_HEAD(&pn->l2tp_tunnel_list);
1727         spin_lock_init(&pn->l2tp_tunnel_list_lock);
1728
1729         for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
1730                 INIT_HLIST_HEAD(&pn->l2tp_session_hlist[hash]);
1731
1732         spin_lock_init(&pn->l2tp_session_hlist_lock);
1733
1734         return 0;
1735 }
1736
1737 static __net_exit void l2tp_exit_net(struct net *net)
1738 {
1739         struct l2tp_net *pn = l2tp_pernet(net);
1740         struct l2tp_tunnel *tunnel = NULL;
1741         int hash;
1742
1743         rcu_read_lock_bh();
1744         list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
1745                 l2tp_tunnel_delete(tunnel);
1746         }
1747         rcu_read_unlock_bh();
1748
1749         if (l2tp_wq)
1750                 flush_workqueue(l2tp_wq);
1751         rcu_barrier();
1752
1753         for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
1754                 WARN_ON_ONCE(!hlist_empty(&pn->l2tp_session_hlist[hash]));
1755 }
1756
1757 static struct pernet_operations l2tp_net_ops = {
1758         .init = l2tp_init_net,
1759         .exit = l2tp_exit_net,
1760         .id   = &l2tp_net_id,
1761         .size = sizeof(struct l2tp_net),
1762 };
1763
1764 static int __init l2tp_init(void)
1765 {
1766         int rc = 0;
1767
1768         rc = register_pernet_device(&l2tp_net_ops);
1769         if (rc)
1770                 goto out;
1771
1772         l2tp_wq = alloc_workqueue("l2tp", WQ_UNBOUND, 0);
1773         if (!l2tp_wq) {
1774                 pr_err("alloc_workqueue failed\n");
1775                 unregister_pernet_device(&l2tp_net_ops);
1776                 rc = -ENOMEM;
1777                 goto out;
1778         }
1779
1780         pr_info("L2TP core driver, %s\n", L2TP_DRV_VERSION);
1781
1782 out:
1783         return rc;
1784 }
1785
1786 static void __exit l2tp_exit(void)
1787 {
1788         unregister_pernet_device(&l2tp_net_ops);
1789         if (l2tp_wq) {
1790                 destroy_workqueue(l2tp_wq);
1791                 l2tp_wq = NULL;
1792         }
1793 }
1794
1795 module_init(l2tp_init);
1796 module_exit(l2tp_exit);
1797
1798 MODULE_AUTHOR("James Chapman <[email protected]>");
1799 MODULE_DESCRIPTION("L2TP core");
1800 MODULE_LICENSE("GPL");
1801 MODULE_VERSION(L2TP_DRV_VERSION);