1/** -*- linux-c -*- ***********************************************************
2 * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets
3 *
4 * PPPoX    --- Generic PPP encapsulation socket family
5 * PPPoL2TP --- PPP over L2TP (RFC 2661)
6 *
7 *
8 * Version:    0.13.0
9 *
10 * 251003 :	Copied from pppoe.c version 0.6.9.
11 *
12 * Author:	Martijn van Oosterhout <kleptog@svana.org>
13 * Contributors:
14 *		Michal Ostrowski <mostrows@speakeasy.net>
15 *		Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
16 *		David S. Miller (davem@redhat.com)
17 *		James Chapman (jchapman@katalix.com)
18 *
19 * License:
20 *		This program is free software; you can redistribute it and/or
21 *		modify it under the terms of the GNU General Public License
22 *		as published by the Free Software Foundation; either version
23 *		2 of the License, or (at your option) any later version.
24 *
25 */
26
27/* This driver handles only L2TP data frames; control frames are handled by a
28 * userspace application.
29 *
30 * To send data in an L2TP session, userspace opens a PPPoL2TP socket and
31 * attaches it to a bound UDP socket with local tunnel_id / session_id and
32 * peer tunnel_id / session_id set. Data can then be sent or received using
33 * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket
34 * can be read or modified using ioctl() or [gs]etsockopt() calls.
35 *
36 * When a PPPoL2TP socket is connected with local and peer session_id values
37 * zero, the socket is treated as a special tunnel management socket.
38 *
39 * Here's example userspace code to create a socket for sending/receiving data
40 * over an L2TP session:-
41 *
42 *	struct sockaddr_pppol2tp sax;
43 *	int fd;
44 *	int session_fd;
45 *
46 *	fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
47 *
48 *	sax.sa_family = AF_PPPOX;
49 *	sax.sa_protocol = PX_PROTO_OL2TP;
50 *	sax.pppol2tp.fd = tunnel_fd; // bound UDP socket
51 *	sax.pppol2tp.pid = 0; 	     // current pid owns UDP socket
52 *	sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr;
53 *	sax.pppol2tp.addr.sin_port = addr->sin_port;
54 *	sax.pppol2tp.addr.sin_family = AF_INET;
55 *	sax.pppol2tp.s_tunnel  = tunnel_id;
56 *	sax.pppol2tp.s_session = session_id;
57 *	sax.pppol2tp.d_tunnel  = peer_tunnel_id;
58 *	sax.pppol2tp.d_session = peer_session_id;
59 *
60 *	session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax));
61 *
62 */
63
64#include <linux/string.h>
65#include <linux/module.h>
66#include <linux/version.h>
67
68#include <linux/list.h>
69#include <asm/uaccess.h>
70
71#include <linux/kernel.h>
72#include <linux/sched.h>
73#include <linux/slab.h>
74#include <linux/errno.h>
75
76#include <linux/netdevice.h>
77#include <linux/net.h>
78#include <linux/inetdevice.h>
79#include <linux/skbuff.h>
80#include <linux/init.h>
81#include <linux/udp.h>
82#include <linux/if_pppox.h>
83#include <net/sock.h>
84#include <linux/ppp_channel.h>
85#include <linux/ppp_defs.h>
86#include <linux/if_ppp.h>
87#include <linux/if_pppvar.h>
88#include <linux/file.h>
89#include <linux/hash.h>
90#include <linux/proc_fs.h>
91#include <net/dst.h>
92#include <net/ip.h>
93#include <net/udp.h>
94
95#include <asm/byteorder.h>
96#include <asm/atomic.h>
97
98#define PPPOL2TP_DRV_VERSION	"V0.13 (oleg@cs.msu.su)"
99
100/* Developer debug code. */
101#if 0
102#define DEBUG			/* Define to compile in very verbose developer
103				 * debug */
104#define DEBUG_MOD_USE_COUNT	/* Define to debug module use count bugs */
105#endif
106
107/* Useful to debug module use_count problems */
108#ifdef DEBUG_MOD_USE_COUNT
109#undef MOD_INC_USE_COUNT
110#undef MOD_DEC_USE_COUNT
111static int mod_use_count = 0;
112#define MOD_INC_USE_COUNT do { \
113	mod_use_count++; \
114	printk(KERN_DEBUG "%s: INC_USE_COUNT, now %d\n", __FUNCTION__, mod_use_count); \
115} while (0)
116#define MOD_DEC_USE_COUNT do { \
117	mod_use_count--; \
118	printk(KERN_DEBUG "%s: DEC_USE_COUNT, now %d\n", __FUNCTION__, mod_use_count); \
119} while (0)
120#endif /* DEBUG_MOD_USE_COUNT */
121
122/* Timeouts are specified in milliseconds to/from userspace */
123#define JIFFIES_TO_MS(t) ((t) * 1000 / HZ)
124#define MS_TO_JIFFIES(j) ((j * HZ) / 1000)
125
126/* L2TP header constants */
127#define L2TP_HDRFLAG_T	   0x8000
128#define L2TP_HDRFLAG_L	   0x4000
129#define L2TP_HDRFLAG_S	   0x0800
130#define L2TP_HDRFLAG_O	   0x0200
131#define L2TP_HDRFLAG_P	   0x0100
132
133#define L2TP_HDR_VER_MASK  0x000F
134#define L2TP_HDR_VER	   0x0002
135
136/* Space for UDP, L2TP and PPP headers */
137#define PPPOL2TP_HEADER_OVERHEAD	40
138
139/* Just some random numbers */
140#define L2TP_TUNNEL_MAGIC   0x42114DDA
141#define L2TP_SESSION_MAGIC  0x0C04EB7D
142
143#define PPPOL2TP_HASH_BITS 4
144#define PPPOL2TP_HASH_SIZE (1 << PPPOL2TP_HASH_BITS)
145
146/* Default trace flags */
147#ifdef DEBUG
148#define PPPOL2TP_DEFAULT_DEBUG_FLAGS	-1
149#else
150#define PPPOL2TP_DEFAULT_DEBUG_FLAGS	0
151#endif
152
153/* For kernel compatability. This might not work for early 2.4 kernels */
154#ifndef dst_pmtu
155#define dst_pmtu(dst) dst->pmtu
156#endif
157
158/* Debug kernel message control.
159 * Verbose debug messages (L2TP_MSG_DEBUG flag) are optionally compiled in.
160 */
161#ifdef DEBUG
162#define DPRINTK(_mask, _fmt, args...)					\
163	do {								\
164		if ((_mask) & PPPOL2TP_MSG_DEBUG)			\
165			printk(KERN_DEBUG "PPPOL2TP %s: " _fmt,		\
166			       __FUNCTION__, ##args);			\
167	} while(0)
168#else
169#define DPRINTK(_mask, _fmt, args...) do { } while(0)
170#endif /* DEBUG */
171
172#define PRINTK(_mask, _type, _lvl, _fmt, args...)			\
173	do {								\
174		if ((_mask) & (_type))					\
175			printk(_lvl "PPPOL2TP: " _fmt, ##args);		\
176	} while(0)
177
178/* Extra driver debug. Should only be enabled by developers working on
179 * this driver.
180 */
181#ifdef DEBUG
182#define ENTER_FUNCTION	 printk(KERN_DEBUG "PPPOL2TP: --> %s\n", __FUNCTION__)
183#define EXIT_FUNCTION	 printk(KERN_DEBUG "PPPOL2TP: <-- %s\n", __FUNCTION__)
184#else
185#define ENTER_FUNCTION	 do { } while(0)
186#define EXIT_FUNCTION	 do { } while(0)
187#endif
188
189#define container_of(ptr, type, member) ({			\
190	const typeof( ((type *)0)->member ) *__mptr = (ptr);	\
191	(type *)( (char *)__mptr - offsetof(type,member) );})
192
193struct pppol2tp_tunnel;
194
195/* Describes a session. It is the user_data field in the PPPoL2TP
196 * socket. Contains information to determine incoming packets and transmit
197 * outgoing ones.
198 */
199struct pppol2tp_session
200{
201	int			magic;		/* should be
202						 * L2TP_SESSION_MAGIC */
203	int			owner;		/* pid that opened the socket */
204
205	struct sock		*sock;		/* Pointer to the session
206						 * PPPoX socket */
207	struct sock		*tunnel_sock;	/* Pointer to the tunnel UDP
208						 * socket */
209
210	struct pppol2tp_addr	tunnel_addr;	/* Description of tunnel */
211
212	struct pppol2tp_tunnel	*tunnel;	/* back pointer to tunnel
213						 * context */
214
215	char			name[20];	/* "sess xxxxx/yyyyy", where
216						 * x=tunnel_id, y=session_id */
217	int			mtu;
218	int			mru;
219	int			flags;		/* accessed by PPPIOCGFLAGS.
220						 * Unused. */
221	int			recv_seq:1;	/* expect receive packets with
222						 * sequence numbers? */
223	int			send_seq:1;	/* send packets with sequence
224						 * numbers? */
225	int			lns_mode:1;	/* behave as LNS? LAC enables
226						 * sequence numbers under
227						 * control of LNS. */
228	int			debug;		/* bitmask of debug message
229						 * categories */
230	int			reorder_timeout; /* configured reorder timeout
231						  * (in jiffies) */
232	u16			nr;		/* session NR state (receive) */
233	u16			ns;		/* session NR state (send) */
234	struct sk_buff_head	reorder_q;	/* receive reorder queue */
235	struct pppol2tp_ioc_stats stats;
236	struct hlist_node	hlist;		/* Hash list node */
237};
238
239/* The user_data field of the tunnel's UDP socket. It contains info to track
240 * all the associated sessions so incoming packets can be sorted out
241 */
242struct pppol2tp_tunnel
243{
244	int			magic;		/* Should be L2TP_TUNNEL_MAGIC */
245
246	struct proto		*old_proto;	/* original proto */
247	struct proto		l2tp_proto;	/* L2TP proto */
248	rwlock_t		hlist_lock;	/* protect session_hlist */
249	struct hlist_head	session_hlist[PPPOL2TP_HASH_SIZE];
250						/* hashed list of sessions,
251						 * hashed by id */
252	int			debug;		/* bitmask of debug message
253						 * categories */
254	char			name[12];	/* "tunl xxxxx" */
255	struct pppol2tp_ioc_stats stats;
256
257#ifndef UDP_ENCAP_L2TPINUDP
258	void (*old_data_ready)(struct sock *, int);
259#endif
260	void (*old_sk_destruct)(struct sock *);
261
262	struct sock		*sock;		/* Parent socket */
263	struct list_head	list;		/* Keep a list of all open
264						 * prepared sockets */
265
266	atomic_t		session_count;
267};
268
269#define udp_sk(x) (&sk->tp_pinfo.af_udp)
270
271/* Private data stored for received packets in the skb.
272 */
273struct pppol2tp_skb_cb {
274	u16			ns;
275	u16			nr;
276	int			has_seq;
277	int			length;
278	unsigned long		expires;
279};
280
281#define PPPOL2TP_SKB_CB(skb)	((struct pppol2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])
282
283/* Number of bytes to build transmit L2TP headers.
284 * Unfortunately the size is different depending on whether sequence numbers
285 * are enabled.
286 */
287#define PPPOL2TP_L2TP_HDR_SIZE_SEQ		10
288#define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ		6
289
290
291static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);
292
293static struct ppp_channel_ops pppol2tp_chan_ops = { pppol2tp_xmit , NULL };
294static struct proto_ops pppol2tp_ops;
295static LIST_HEAD(pppol2tp_tunnel_list);
296
297/* Macros to derive session/tunnel context pointers from a socket. */
298#define SOCK_2_SESSION(sock, session, err, errval, label, quiet) \
299	session = (struct pppol2tp_session *)((sock)->user_data);  \
300	if (!session || session->magic != L2TP_SESSION_MAGIC) {	       \
301		if (!quiet) \
302			printk(KERN_ERR "%s: %s:%d: BAD SESSION MAGIC " \
303			       "(" #sock "=%p) session=%p magic=%x\n", \
304			       __FUNCTION__, __FILE__, __LINE__, sock, \
305			       session, session ? session->magic : 0); \
306		err = errval; \
307		goto label; \
308	}
309
310#define SOCK_2_TUNNEL(sock, tunnel, err, errval, label, quiet) \
311	tunnel = (struct pppol2tp_tunnel *)((sock)->user_data);	 \
312	if (!tunnel || tunnel->magic != L2TP_TUNNEL_MAGIC) {	     \
313		if (!quiet) \
314			printk(KERN_ERR "%s: %s:%d: BAD TUNNEL MAGIC " \
315			       "(" #sock "=%p) tunnel=%p magic=%x\n", \
316			       __FUNCTION__, __FILE__, __LINE__, sock, \
317			       tunnel, tunnel ? tunnel->magic : 0); \
318		err = errval; \
319		goto label; \
320	}
321
322/* Session hash list.
323 * The session_id SHOULD be random according to RFC2661, but several
324 * L2TP implementations (Cisco and Microsoft) use incrementing
325 * session_ids.  So we do a real hash on the session_id, rather than a
326 * simple bitmask.
327 */
328static inline struct hlist_head *
329pppol2tp_session_id_hash(struct pppol2tp_tunnel *tunnel, u16 session_id)
330{
331	unsigned long hash_val = (unsigned long) session_id;
332	return &tunnel->session_hlist[hash_long(hash_val, PPPOL2TP_HASH_BITS)];
333}
334
335/* Lookup a session by id
336 */
337static struct pppol2tp_session *
338pppol2tp_session_find(struct pppol2tp_tunnel *tunnel, u16 session_id)
339{
340	struct hlist_head *session_list =
341		pppol2tp_session_id_hash(tunnel, session_id);
342	struct hlist_node *tmp;
343	struct hlist_node *walk;
344	struct pppol2tp_session *session;
345
346	hlist_for_each_safe(walk, tmp, session_list) {
347		session = hlist_entry(walk, struct pppol2tp_session, hlist);
348		if (session->tunnel_addr.s_session == session_id) {
349			return session;
350		}
351	}
352
353	return NULL;
354}
355
356/* Copied from socket.c
357 */
358static __inline__ void sockfd_put(struct socket *sock)
359{
360	fput(sock->file);
361}
362
363/*****************************************************************************
364 * Receive data handling
365 *****************************************************************************/
366
367/* Queue a skb in order. If the skb has no sequence number, queue it
368 * at the tail.
369 */
370static void pppol2tp_recv_queue_skb(struct pppol2tp_session *session, struct sk_buff *skb)
371{
372	struct sk_buff *next;
373	struct sk_buff *prev;
374	u16 ns = PPPOL2TP_SKB_CB(skb)->ns;
375
376	ENTER_FUNCTION;
377
378	spin_lock(&session->reorder_q.lock);
379
380	prev = (struct sk_buff *) &session->reorder_q;
381	next = prev->next;
382	while (next != prev) {
383		if (PPPOL2TP_SKB_CB(next)->ns > ns) {
384			__skb_insert(skb, next->prev, next, next->list);
385			PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
386			       "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
387			       session->name, ns, PPPOL2TP_SKB_CB(next)->ns,
388			       skb_queue_len(&session->reorder_q));
389			session->stats.rx_oos_packets++;
390			goto out;
391		}
392		next = next->next;
393	}
394
395	__skb_queue_tail(&session->reorder_q, skb);
396
397out:
398	spin_unlock(&session->reorder_q.lock);
399	EXIT_FUNCTION;
400}
401
402/* Dequeue a single skb, passing it either to ppp or to userspace.
403 */
404static void pppol2tp_recv_dequeue_skb(struct pppol2tp_session *session, struct sk_buff *skb)
405{
406	struct pppol2tp_tunnel *tunnel = session->tunnel;
407	int length = PPPOL2TP_SKB_CB(skb)->length;
408	struct sock *session_sock = NULL;
409
410	ENTER_FUNCTION;
411
412	/* We're about to requeue the skb, so unlink it and return resources
413	 * to its current owner (a socket receive buffer). Also release the
414	 * dst to force a route lookup on the inner IP packet since skb->dst
415	 * currently points to the dst of the UDP tunnel.
416	 */
417	skb_unlink(skb);
418	skb_orphan(skb);
419
420	tunnel->stats.rx_packets++;
421	tunnel->stats.rx_bytes += length;
422	session->stats.rx_packets++;
423	session->stats.rx_bytes += length;
424
425	if (PPPOL2TP_SKB_CB(skb)->has_seq) {
426		/* Bump our Nr */
427		session->nr++;
428		PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
429		       "%s: updated nr to %hu\n", session->name, session->nr);
430	}
431
432	/* If the socket is bound, send it in to PPP's input queue.  Otherwise
433	 * queue it on the session socket.
434	 */
435	session_sock = session->sock;
436	if (session_sock->state & PPPOX_BOUND) {
437		PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
438		       "%s: recv %d byte data frame, passing to ppp\n",
439		       session->name, length);
440
441		dst_release(skb->dst);
442		skb->dst = NULL;
443
444#ifdef CONFIG_NETFILTER
445		/* We need to forget conntrack info as we reuse the same skb. */
446		nf_conntrack_put(skb->nfct);
447		skb->nfct = NULL;
448#ifdef CONFIG_NETFILTER_DEBUG
449		skb->nf_debug = 0;
450#endif
451#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
452		/*skb->nf_bridge = NULL;*/
453#endif
454#endif /* CONFIG_NETFILTER */
455		ppp_input(&session_sock->protinfo.pppox->chan, skb);
456	} else {
457		PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_INFO,
458		       "%s: socket not bound\n", session->name);
459		/* Not bound. Queue it now */
460		if (sock_queue_rcv_skb(session_sock, skb) < 0) {
461			session->stats.rx_errors++;
462			kfree_skb(skb);
463			if (!session_sock->dead)
464				session_sock->data_ready(session_sock, 0);
465		}
466	}
467
468	DPRINTK(session->debug, "calling sock_put; refcnt=%d\n",
469		session->sock->refcnt.counter);
470	sock_put(session->sock);
471	EXIT_FUNCTION;
472}
473
474/* Dequeue skbs from the session's reorder_q, subject to packet order.
475 * Skbs that have been in the queue for too long are simply discarded.
476 */
477static void pppol2tp_recv_dequeue(struct pppol2tp_session *session)
478{
479	struct sk_buff *next;
480	struct sk_buff *prev;
481
482	ENTER_FUNCTION;
483
484	prev = (struct sk_buff *) &session->reorder_q;
485	spin_lock(&session->reorder_q.lock);
486	next = prev->next;
487
488	/* If the pkt at the head of the queue has the nr that we
489	 * expect to send up next, dequeue it and any other
490	 * in-sequence packets behind it.
491	 */
492	while (next != prev) {
493		struct sk_buff *skb = next;
494		next = next->next;
495		spin_unlock(&session->reorder_q.lock);
496
497		if (time_after(jiffies, PPPOL2TP_SKB_CB(skb)->expires)) {
498			session->stats.rx_seq_discards++;
499			session->stats.rx_errors++;
500			PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
501			       "%s: oos pkt %hu len %d discarded (too old), waiting for %hu, reorder_q_len=%d\n",
502			       session->name, PPPOL2TP_SKB_CB(skb)->ns,
503			       PPPOL2TP_SKB_CB(skb)->length, session->nr,
504			       skb_queue_len(&session->reorder_q));
505			skb_unlink(skb);
506			kfree_skb(skb);
507			goto again;
508		}
509
510		if (PPPOL2TP_SKB_CB(skb)->has_seq) {
511			if (PPPOL2TP_SKB_CB(skb)->ns != session->nr) {
512				PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
513					"%s: holding oos pkt %hu len %d, waiting for %hu, reorder_q_len=%d\n",
514					session->name, PPPOL2TP_SKB_CB(skb)->ns,
515					PPPOL2TP_SKB_CB(skb)->length, session->nr,
516					skb_queue_len(&session->reorder_q));
517				goto out;
518			}
519		}
520		pppol2tp_recv_dequeue_skb(session, skb);
521again:
522		spin_lock(&session->reorder_q.lock);
523	}
524
525	spin_unlock(&session->reorder_q.lock);
526out:
527	EXIT_FUNCTION;
528}
529
530/* Internal receive frame. Do the real work of receiving an L2TP data frame
531 * here.
532 * Returns 0 if the packet was a data packet and was successfully passed on.
533 * Returns 1 if the packet was not a good data packet and could not be
534 * forwarded.  All such packets are passed up to userspace to deal with.
535 */
536static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
537{
538	struct pppol2tp_session *session = NULL;
539	int error = 0;
540	struct pppol2tp_tunnel *tunnel;
541	unsigned char *ptr;
542	u16 hdrflags;
543	u16 tunnel_id, session_id;
544	int length, i;
545
546	ENTER_FUNCTION;
547
548	SOCK_2_TUNNEL(sock, tunnel, error, 1, end, 0);
549
550	/* Short packet? */
551	if (skb->len < sizeof(struct udphdr)) {
552		PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_INFO,
553		       "%s: recv short packet (len=%d)\n", tunnel->name, skb->len);
554		goto end;
555	}
556
557	/* Get length of L2TP packet */
558	length = ntohs(skb->h.uh->len) - sizeof(struct udphdr);
559
560	/* Point to L2TP header */
561	ptr = skb->data + sizeof(struct udphdr);
562
563	/* Trace packet contents, if enabled */
564	if (tunnel->debug & PPPOL2TP_MSG_DATA) {
565		printk(KERN_DEBUG "%s: recv: ", tunnel->name);
566
567		for (i = 0; i < 16 && i < length; i++)
568			printk(" %02X", ptr[i]);
569		printk("\n");
570	}
571
572	/* Too short? */
573	if (length < 12) {
574		PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_INFO,
575		       "%s: recv short L2TP packet (len=%d)\n", tunnel->name, length);
576		goto end;
577	}
578
579	/* Get L2TP header flags */
580	hdrflags = ntohs(*(u16*)ptr);
581
582	/* If type is control packet, it is handled by userspace. */
583	if (hdrflags & L2TP_HDRFLAG_T) {
584		PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
585		       "%s: recv control packet, len=%d\n", tunnel->name, length);
586		goto end;
587	}
588
589	/* Skip flags */
590	ptr += 2;
591
592	/* If length is present, skip it */
593	if (hdrflags & L2TP_HDRFLAG_L)
594		ptr += 2;
595
596	/* Extract tunnel and session ID */
597	tunnel_id = ntohs(*(u16 *) ptr);
598	ptr += 2;
599	session_id = ntohs(*(u16 *) ptr);
600	ptr += 2;
601
602	/* Find the session context */
603	session = pppol2tp_session_find(tunnel, session_id);
604	if (!session) {
605		/* Not found? Pass to userspace to deal with */
606		PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_INFO,
607		       "%s: no socket found (%hu/%hu). Passing up.\n",
608		       tunnel->name, tunnel_id, session_id);
609		goto end;
610	}
611	sock_hold(session->sock);
612
613	DPRINTK(session->debug, "%s: socket rcvbuf alloc=%d\n",
614		session->name, atomic_read(&sock->rmem_alloc));
615
616	/* The ref count on the socket was increased by the above call since
617	 * we now hold a pointer to the session. Take care to do sock_put()
618	 * when exiting this function from now on...
619	 */
620
621	/* Handle the optional sequence numbers.  If we are the LAC,
622	 * enable/disable sequence numbers under the control of the LNS.  If
623	 * no sequence numbers present but we were expecting them, discard
624	 * frame.
625	 */
626	if (hdrflags & L2TP_HDRFLAG_S) {
627		u16 ns, nr;
628		ns = ntohs(*(u16 *) ptr);
629		ptr += 2;
630		nr = ntohs(*(u16 *) ptr);
631		ptr += 2;
632
633		/* Received a packet with sequence numbers. If we're the LNS,
634		 * check if we sre sending sequence numbers and if not,
635		 * configure it so.
636		 */
637		if ((!session->lns_mode) && (!session->send_seq)) {
638			PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_INFO,
639			       "%s: requested to enable seq numbers by LNS\n",
640			       session->name);
641			session->send_seq = -1;
642		}
643
644		/* Store L2TP info in the skb */
645		PPPOL2TP_SKB_CB(skb)->ns = ns;
646		PPPOL2TP_SKB_CB(skb)->nr = nr;
647		PPPOL2TP_SKB_CB(skb)->has_seq = 1;
648
649		PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
650		       "%s: recv data ns=%hu, nr=%hu, session nr=%hu\n",
651		       session->name, ns, nr, session->nr);
652	} else {
653		/* No sequence numbers.
654		 * If user has configured mandatory sequence numbers, discard.
655		 */
656		if (session->recv_seq) {
657			PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_WARNING,
658			       "%s: recv data has no seq numbers when required. "
659			       "Discarding\n", session->name);
660			session->stats.rx_seq_discards++;
661			session->stats.rx_errors++;
662			goto discard;
663		}
664
665		/* If we're the LAC and we're sending sequence numbers, the
666		 * LNS has requested that we no longer send sequence numbers.
667		 * If we're the LNS and we're sending sequence numbers, the
668		 * LAC is broken. Discard the frame.
669		 */
670		if ((!session->lns_mode) && (session->send_seq)) {
671			PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_INFO,
672			       "%s: requested to disable seq numbers by LNS\n",
673			       session->name);
674			session->send_seq = 0;
675		} else if (session->send_seq) {
676			PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_WARNING,
677			       "%s: recv data has no seq numbers when required. "
678			       "Discarding\n", session->name);
679			session->stats.rx_seq_discards++;
680			session->stats.rx_errors++;
681			goto discard;
682		}
683
684		/* Store L2TP info in the skb */
685		PPPOL2TP_SKB_CB(skb)->has_seq = 0;
686	}
687
688	/* If offset bit set, skip it. */
689	if (hdrflags & L2TP_HDRFLAG_O)
690		ptr += 2 + ntohs(*(u16 *) ptr);
691
692	skb_pull(skb, ptr - skb->data);
693
694	/* Skip PPP header, if present.	 In testing, Microsoft L2TP clients
695	 * don't send the PPP header (PPP header compression enabled), but
696	 * other clients can include the header. So we cope with both cases
697	 * here. The PPP header is always FF03 when using L2TP.
698	 *
699	 * Note that skb->data[] isn't dereferenced from a u16 ptr here since
700	 * the field may be unaligned.
701	 */
702	if ((skb->data[0] == 0xff) && (skb->data[1] == 0x03))
703		skb_pull(skb, 2);
704
705	/* Prepare skb for adding to the session's reorder_q.  Hold
706	 * packets for max reorder_timeout or 1 second if not
707	 * reordering.
708	 */
709	PPPOL2TP_SKB_CB(skb)->length = length;
710	PPPOL2TP_SKB_CB(skb)->expires = jiffies +
711		(session->reorder_timeout ? session->reorder_timeout : HZ);
712
713	/* Add packet to the session's receive queue. Reordering is done here, if
714	 * enabled. Saved L2TP protocol info is stored in skb->sb[].
715	 */
716	if (PPPOL2TP_SKB_CB(skb)->has_seq) {
717		if (session->reorder_timeout != 0) {
718			/* Packet reordering enabled. Add skb to session's
719			 * reorder queue, in order of ns.
720			 */
721			pppol2tp_recv_queue_skb(session, skb);
722		} else {
723			/* Packet reordering disabled. Discard out-of-sequence
724			 * packets
725			 */
726			if (PPPOL2TP_SKB_CB(skb)->ns != session->nr) {
727				session->stats.rx_seq_discards++;
728				session->stats.rx_errors++;
729				PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
730				       "%s: oos pkt %hu len %d discarded, waiting for %hu, reorder_q_len=%d\n",
731				       session->name, PPPOL2TP_SKB_CB(skb)->ns,
732				       PPPOL2TP_SKB_CB(skb)->length, session->nr,
733				       skb_queue_len(&session->reorder_q));
734				goto discard;
735			}
736			skb_queue_tail(&session->reorder_q, skb);
737		}
738	} else {
739		/* No sequence numbers. Add the skb to the tail of the
740		 * reorder queue. This ensures that it will be
741		 * delivered after all previous sequenced skbs.
742		 */
743		skb_queue_tail(&session->reorder_q, skb);
744	}
745
746	/* Try to dequeue as many skbs from reorder_q as we can. */
747	pppol2tp_recv_dequeue(session);
748
749	EXIT_FUNCTION;
750	return 0;
751
752discard:
753	DPRINTK(session->debug, "discarding skb, len=%d\n", skb->len);
754	skb_unlink(skb);
755	kfree_skb(skb);
756	DPRINTK(session->debug, "calling sock_put; refcnt=%d\n",
757		session->sock->refcnt.counter);
758	sock_put(session->sock);
759	EXIT_FUNCTION;
760	return 0;
761
762end:
763	EXIT_FUNCTION;
764	return 1;
765}
766
767#ifndef UDP_ENCAP_L2TPINUDP
768/* The data_ready hook on the UDP socket. Scan the incoming packet list for
769 * packets to process. Only control or bad data packets are delivered to
770 * userspace.
771 */
772static void pppol2tp_data_ready(struct sock *sk, int len)
773{
774	int err;
775	struct pppol2tp_tunnel *tunnel;
776	struct sk_buff *skb;
777
778	ENTER_FUNCTION;
779	SOCK_2_TUNNEL(sk, tunnel, err, -EBADF, end, 0);
780
781	PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
782	       "%s: received %d bytes\n", tunnel->name, len);
783
784	skb = skb_dequeue(&sk->receive_queue);
785	if (pppol2tp_recv_core(sk, skb)) {
786		DPRINTK(tunnel->debug, "%s: packet passing to userspace\n",
787		       tunnel->name);
788		skb_queue_head(&sk->receive_queue, skb);
789		tunnel->old_data_ready(sk, len);
790	} else {
791		DPRINTK(tunnel->debug, "%s: data packet received\n",
792			tunnel->name);
793	}
794end:
795	EXIT_FUNCTION;
796	return;
797}
798#else
799/* UDP encapsulation receive handler. See net/ipv4/udp.c.
800 * Return codes:
801 * 0 : success.
802 * <0: error
803 * >0: skb should be passed up to userspace as UDP.
804 */
805static int pppol2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
806{
807	int err;
808	struct pppol2tp_tunnel *tunnel;
809
810	ENTER_FUNCTION;
811	SOCK_2_TUNNEL(sk, tunnel, err, -EBADF, pass_up, 0);
812
813	PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
814	       "%s: received %d bytes\n", tunnel->name, skb->len);
815
816	if (pppol2tp_recv_core(sk, skb))
817		goto pass_up;
818
819	EXIT_FUNCTION;
820	return 0;
821
822pass_up:
823	EXIT_FUNCTION;
824	return 1;
825}
826#endif
827
828/* Receive message. This is the recvmsg for the PPPoL2TP socket.
829 */
830static int pppol2tp_recvmsg(struct socket *sock, struct msghdr *msg, int len,
831			    int flags, struct scm_cookie *scm)
832{
833	int err = 0;
834	struct sk_buff *skb = NULL;
835	struct sock *sk = sock->sk;
836
837	ENTER_FUNCTION;
838
839	err = -EIO;
840	if (sock->state & PPPOX_BOUND)
841		goto error;
842
843	msg->msg_namelen = 0;
844
845	skb=skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
846			      flags & MSG_DONTWAIT, &err);
847	if (skb) {
848		err = memcpy_toiovec(msg->msg_iov, (unsigned char *) skb->data,
849				     skb->len);
850		if (err < 0)
851			goto do_skb_free;
852		err = skb->len;
853	}
854do_skb_free:
855	if (skb)
856		kfree_skb(skb);
857error:
858	EXIT_FUNCTION;
859	return err;
860}
861
862/************************************************************************
863 * Transmit handling
864 ***********************************************************************/
865
866/* Internal UDP socket transmission
867 */
868static int pppol2tp_udp_sock_send(struct pppol2tp_session *session,
869				  struct pppol2tp_tunnel *tunnel,
870				  struct msghdr *msg, int total_len)
871{
872	mm_segment_t fs;
873	int error;
874
875	ENTER_FUNCTION;
876
877	DPRINTK(session->debug, "%s: udp_sendmsg call...\n", session->name);
878#ifdef DEBUG
879	/* Catch bad socket parameter errors */
880	if (msg->msg_name) {
881		struct sockaddr_in * usin = (struct sockaddr_in*)msg->msg_name;
882		if (msg->msg_namelen < sizeof(*usin)) {
883			printk(KERN_ERR "msg->msg_namelen wrong, %d\n", msg->msg_namelen);
884			return -EINVAL;
885		}
886		if (usin->sin_family != AF_INET) {
887			if (usin->sin_family != AF_UNSPEC) {
888				printk(KERN_ERR "addr family wrong: %d\n", usin->sin_family);
889				return -EINVAL;
890			}
891		}
892		if ((usin->sin_addr.s_addr == 0) || (usin->sin_port == 0)) {
893			printk(KERN_ERR "udp addr=%x/%hu\n", usin->sin_addr.s_addr, usin->sin_port);
894			return -EINVAL;
895		}
896	}
897#endif /* DEBUG */
898
899	/* Set to userspace data segment while we do a sendmsg() call.	We're
900	 * actually calling a userspace API from the kernel here...
901	 */
902	fs = get_fs();
903	set_fs(get_ds());
904
905	/* The actual sendmsg() call... */
906	error = tunnel->old_proto->sendmsg(session->tunnel_sock, msg, total_len);
907	if (error >= 0) {
908		tunnel->stats.tx_packets++;
909		tunnel->stats.tx_bytes += error;
910		session->stats.tx_packets++;
911		session->stats.tx_bytes += error;
912	} else {
913		tunnel->stats.tx_errors++;
914		session->stats.tx_errors++;
915	}
916
917	/* Back to kernel space */
918	set_fs(fs);
919
920	DPRINTK(session->debug, "%s: %s: returning result %d\n", __FUNCTION__,
921		session->name, error);
922	kfree(msg->msg_iov);
923	kfree(msg);
924
925	EXIT_FUNCTION;
926	return error;
927}
928
929/* Build an L2TP header for the session into the buffer provided.
930 */
931static int pppol2tp_build_l2tp_header(struct pppol2tp_session *session,
932				      void *buf)
933{
934	u16 *bufp = buf;
935	u16 flags = L2TP_HDR_VER;
936
937	if (session->send_seq) {
938		flags |= L2TP_HDRFLAG_S;
939	}
940
941	/* Setup L2TP header.
942	 * FIXME: Can this ever be unaligned? Is direct dereferencing of
943	 * 16-bit header fields safe here for all architectures?
944	 */
945	*bufp++ = htons(flags);
946	*bufp++ = htons(session->tunnel_addr.d_tunnel);
947	*bufp++ = htons(session->tunnel_addr.d_session);
948	if (session->send_seq) {
949		*bufp++ = htons(session->ns);
950		*bufp++ = 0;
951		session->ns++;
952		PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
953		       "%s: updated ns to %hu\n", session->name, session->ns);
954	}
955	/* This is the PPP header really */
956	*bufp = htons(0xff03);
957
958	return ((void *) bufp) - buf;
959}
960
961/* This is the sendmsg for the PPPoL2TP pppol2tp_session socket.  We come here
962 * when a user application does a sendmsg() on the session socket. L2TP and
963 * PPP headers must be inserted into the user's data.
964 */
965static int pppol2tp_sendmsg(struct socket *sock, struct msghdr *m,
966			    int total_len, struct scm_cookie *scm)
967{
968	static unsigned char ppph[2] = { 0xff, 0x03 };
969	struct sock *sk = sock->sk;
970	int error = 0;
971	u8 hdr[PPPOL2TP_L2TP_HDR_SIZE_SEQ];
972	int hdr_len;
973	struct msghdr *msg;
974	struct pppol2tp_session *session;
975	struct pppol2tp_tunnel *tunnel;
976
977	ENTER_FUNCTION;
978
979	if (sk->dead || !(sk->state & PPPOX_CONNECTED)) {
980		error = -ENOTCONN;
981		goto end;
982	}
983
984	/* Get session and tunnel contexts */
985	SOCK_2_SESSION(sk, session, error, -EBADF, end, 0);
986	SOCK_2_TUNNEL(session->tunnel_sock, tunnel, error, -EBADF, end, 0);
987
988	/* Setup L2TP header */
989	hdr_len = pppol2tp_build_l2tp_header(session, &hdr);
990
991	if (session->send_seq)
992		PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
993		       "%s: send %d bytes, ns=%hu\n", session->name,
994		       total_len, session->ns - 1);
995	else
996		PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
997		       "%s: send %d bytes\n", session->name, total_len);
998
999	if (session->debug & PPPOL2TP_MSG_DATA) {
1000		int i, j, count;
1001
1002		printk(KERN_DEBUG "%s: xmit:", session->name);
1003		count = 0;
1004		for (i = 0; i < m->msg_iovlen; i++) {
1005			for (j = 0; j < m->msg_iov[i].iov_len; j++) {
1006				printk(" %02X", ((unsigned char *) m->msg_iov[i].iov_base)[j]);
1007				count++;
1008				if (count == 15) {
1009					printk(" ...");
1010					break;
1011				}
1012			}
1013		}
1014		printk("\n");
1015	}
1016
1017	/* Unfortunately, there is no direct way for us to pass an skb to the
1018	 * UDP layer, we have to pretend to be sending ordinary data and use
1019	 * sendmsg.
1020	 *
1021	 * We add the L2TP and PPP headers here. To do so, we create a new
1022	 * struct msghdr and insert the headers as the first iovecs.
1023	 */
1024	msg = kmalloc(sizeof(struct msghdr), GFP_ATOMIC);
1025	if (msg == NULL) {
1026		error = -ENOBUFS;
1027		tunnel->stats.tx_errors++;
1028		session->stats.tx_errors++;
1029		goto end;
1030	}
1031
1032	msg->msg_iov = kmalloc((m->msg_iovlen + 2) * sizeof(struct iovec),
1033			       GFP_ATOMIC);
1034	if (msg->msg_iov == NULL) {
1035		error = -ENOBUFS;
1036		tunnel->stats.tx_errors++;
1037		session->stats.tx_errors++;
1038		kfree(msg);
1039		goto end;
1040	}
1041
1042	msg->msg_iov[0].iov_base = &hdr;
1043	msg->msg_iov[0].iov_len	 = hdr_len;
1044	msg->msg_iov[1].iov_base = &ppph;
1045	msg->msg_iov[1].iov_len	 = sizeof(ppph);
1046	memcpy(&msg->msg_iov[2], &m->msg_iov[0],
1047	       m->msg_iovlen * sizeof(struct iovec));
1048	msg->msg_iovlen = m->msg_iovlen + 2;
1049
1050	/* If the user calls sendto() that's just too bad */
1051	msg->msg_name	 = &session->tunnel_addr.addr;
1052	msg->msg_namelen = sizeof(session->tunnel_addr.addr);
1053
1054	msg->msg_control    = m->msg_control;
1055	msg->msg_controllen = m->msg_controllen;
1056	msg->msg_flags	    = m->msg_flags;
1057
1058	/* Do the real work. This always frees msg, regardless of whether
1059	 * there was an error
1060	 */
1061	error = pppol2tp_udp_sock_send(session, tunnel, msg,
1062				       total_len + hdr_len + sizeof(ppph));
1063
1064end:
1065	EXIT_FUNCTION;
1066	return error;
1067}
1068
1069
1070/* Transmit function called by generic PPP driver.  Sends PPP frame over
1071 * PPPoL2TP socket.
1072 *
1073 * This is almost the same as pppol2tp_sendmsg(), but rather than being called
1074 * with a msghdr from userspace, it is called with a skb from the kernel.
1075 */
1076static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
1077{
1078	static unsigned char ppph[2] = { 0xff, 0x03 };
1079 	struct sock *sk = (struct sock *) chan->private;
1080	int error = 0;
1081	u8 hdr[PPPOL2TP_L2TP_HDR_SIZE_SEQ];
1082	int hdr_len;
1083	struct msghdr *msg;
1084	struct pppol2tp_session *session;
1085	struct pppol2tp_tunnel *tunnel;
1086
1087	ENTER_FUNCTION;
1088
1089	if (sk->dead || !(sk->state & PPPOX_CONNECTED)) {
1090		DPRINTK(-1, "dead=%d state=%x\n", sk->dead, sk->state);
1091		error = -ENOTCONN;
1092		goto end;
1093	}
1094
1095	/* Get session and tunnel contexts from the socket */
1096	SOCK_2_SESSION(sk, session, error, -EBADF, end, 0);
1097	SOCK_2_TUNNEL(session->tunnel_sock, tunnel, error, -EBADF, end, 0);
1098
1099	/* Setup L2TP header */
1100	hdr_len = pppol2tp_build_l2tp_header(session, &hdr);
1101
1102	if (session->send_seq)
1103		PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
1104		       "%s: send %d bytes, ns=%hu\n",
1105		       session->name, skb->len, session->ns - 1);
1106	else
1107		PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
1108		       "%s: send %d bytes\n", session->name, skb->len);
1109
1110	if (session->debug & PPPOL2TP_MSG_DATA) {
1111		int i;
1112
1113		printk(KERN_DEBUG "%s: xmit:", session->name);
1114		for (i = 0; i < skb->len; i++) {
1115			printk(" %02X", skb->data[i]);
1116			if (i == 15) {
1117				printk(" ...");
1118				break;
1119			}
1120		}
1121		printk("\n");
1122	}
1123
1124	/* Unfortunatly there doesn't appear to be a way for us to pass an skb
1125	 * to the UDP layer, we have to pretend to be sending ordinary data
1126	 * and use sendmsg
1127	 */
1128	msg = kmalloc(sizeof(struct msghdr), GFP_ATOMIC);
1129	if (msg == NULL) {
1130		error = -ENOBUFS;
1131		tunnel->stats.tx_errors++;
1132		session->stats.tx_errors++;
1133		goto end;
1134	}
1135
1136	msg->msg_iov = kmalloc(2 * sizeof(struct iovec), GFP_ATOMIC);
1137	if (msg->msg_iov == NULL) {
1138		error = -ENOBUFS;
1139		tunnel->stats.tx_errors++;
1140		session->stats.tx_errors++;
1141		kfree(msg);
1142		goto end;
1143	}
1144	msg->msg_iov[0].iov_base = &hdr;
1145	msg->msg_iov[0].iov_len	 = hdr_len;
1146	/* FIXME: do we need to handle skb fragments here? */
1147        msg->msg_iov[1].iov_base = &ppph;
1148        msg->msg_iov[1].iov_len  = sizeof(ppph);
1149	msg->msg_iov[2].iov_base = skb->data;
1150	msg->msg_iov[2].iov_len	 = skb->len;
1151	msg->msg_iovlen = 3;
1152
1153	/* If the user calls sendto() that's just too bad */
1154	msg->msg_name	 = &session->tunnel_addr.addr;
1155	msg->msg_namelen = sizeof(session->tunnel_addr.addr);
1156
1157	msg->msg_control    = NULL;
1158	msg->msg_controllen = 0;
1159	msg->msg_flags	    = MSG_DONTWAIT;	/* Need this to prevent blocking */
1160
1161	/* Do the real work. This always frees msg, regardless of whether
1162	 * there was an error
1163	 */
1164	error = pppol2tp_udp_sock_send(session, tunnel, msg,
1165				       skb->len + hdr_len + sizeof(ppph));
1166
1167	kfree_skb(skb);
1168
1169end:
1170	EXIT_FUNCTION;
1171	return error;
1172}
1173
1174/*****************************************************************************
1175 * Session (and tunnel control) socket create/destroy.
1176 *****************************************************************************/
1177
1178/* When the tunnel UDP socket is closed, all the attached sockets need to go
1179 * too. This handles that.
1180 */
1181static void pppol2tp_tunnel_closeall(struct pppol2tp_tunnel *tunnel)
1182{
1183	int hash;
1184	struct hlist_node *walk;
1185	struct hlist_node *tmp;
1186	struct pppol2tp_session *session;
1187	struct sock *sk;
1188
1189	ENTER_FUNCTION;
1190
1191	if (tunnel == NULL)
1192		BUG();
1193
1194	PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
1195	       "%s: closing all sessions...\n", tunnel->name);
1196
1197	for (hash = 0; hash < PPPOL2TP_HASH_SIZE; hash++) {
1198		hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
1199			session = hlist_entry(walk, struct pppol2tp_session, hlist);
1200
1201			sk = session->sock;
1202
1203			PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
1204			       "%s: closing session\n", session->name);
1205
1206			write_lock_bh(&tunnel->hlist_lock);
1207			hlist_del_init(&session->hlist);
1208			write_unlock_bh(&tunnel->hlist_lock);
1209
1210			sock_hold(sk);
1211
1212			lock_sock(sk);
1213
1214			if (sk->state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
1215				pppox_unbind_sock(sk);
1216				sk->state = PPPOX_DEAD;
1217				sk->state_change(sk);
1218			}
1219
1220			/* Purge any queued data */
1221			skb_queue_purge(&sk->receive_queue);
1222			skb_queue_purge(&sk->write_queue);
1223
1224			release_sock(sk);
1225
1226			DPRINTK(session->debug, "calling sock_put; refcnt=%d\n",
1227				sk->refcnt.counter);
1228			sock_put(sk);
1229		}
1230	}
1231
1232	EXIT_FUNCTION;
1233}
1234
1235/* Really kill the tunnel.
1236 * Come here only when all sessions have been cleared from the tunnel.
1237 */
1238static void pppol2tp_tunnel_free(struct pppol2tp_tunnel *tunnel)
1239{
1240	struct sock *sk = tunnel->sock;
1241
1242	ENTER_FUNCTION;
1243
1244	/* Remove from socket list */
1245	list_del_init(&tunnel->list);
1246
1247	sk->prot = tunnel->old_proto;
1248#ifndef UDP_ENCAP_L2TPINUDP
1249       	sk->data_ready = tunnel->old_data_ready;
1250#else
1251	(udp_sk(sk))->encap_type = 0;
1252	(udp_sk(sk))->encap_rcv = NULL;
1253#endif
1254	sk->destruct = tunnel->old_sk_destruct;
1255	sk->user_data = NULL;
1256
1257	DPRINTK(tunnel->debug, "%s: MOD_DEC_USE_COUNT\n", tunnel->name);
1258	kfree(tunnel);
1259	MOD_DEC_USE_COUNT;
1260
1261	EXIT_FUNCTION;
1262}
1263
1264/* Tunnel UDP socket destruct hook.
1265 * The tunnel context is deleted only when all session sockets have been
1266 * closed.
1267 */
1268static void pppol2tp_tunnel_destruct(struct sock *sk)
1269{
1270	struct pppol2tp_tunnel *tunnel;
1271	int error = 0;
1272	ENTER_FUNCTION;
1273
1274	SOCK_2_TUNNEL(sk, tunnel, error, -EBADF, end, 0);
1275
1276	PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
1277	       "%s: closing...\n", tunnel->name);
1278
1279	pppol2tp_tunnel_closeall(tunnel);
1280
1281end:
1282	EXIT_FUNCTION;
1283	return;
1284}
1285
1286/* Really kill the socket. (Called from sock_put if refcnt == 0.)
1287 */
1288static void pppol2tp_session_destruct(struct sock *sk)
1289{
1290	struct pppol2tp_session *session = NULL;
1291	int error = 0;
1292
1293	ENTER_FUNCTION;
1294
1295	if (sk->user_data != NULL) {
1296		struct pppol2tp_tunnel *tunnel;
1297
1298		SOCK_2_SESSION(sk, session, error, -EBADF, out, 0);
1299		skb_queue_purge(&session->reorder_q);
1300
1301		/* Don't use SOCK_2_TUNNEL() here to get the tunnel context
1302		 * because the tunnel socket might have already been closed
1303		 * (its sk->user_data will be NULL) so use the session's
1304		 * private tunnel ptr instead.
1305		 */
1306		tunnel = session->tunnel;
1307		if (tunnel != NULL) {
1308			if (tunnel->magic != L2TP_TUNNEL_MAGIC) {
1309				printk(KERN_ERR "%s: %s:%d: BAD TUNNEL MAGIC "
1310				       "( tunnel=%p magic=%x )\n",
1311				       __FUNCTION__, __FILE__, __LINE__,
1312				       tunnel, tunnel->magic);
1313				goto out;
1314			}
1315		}
1316
1317		/* Delete tunnel context if this was the last session on the
1318		 * tunnel.  This was allocated when the first session was
1319		 * created on the tunnel. See
1320		 * pppol2tp_prepare_tunnel_socket().
1321		 */
1322		DPRINTK(tunnel->debug, "%s: session_count=%d\n",
1323			tunnel->name, atomic_read(&tunnel->session_count));
1324		if (atomic_dec_and_test(&tunnel->session_count)) {
1325			pppol2tp_tunnel_free(tunnel);
1326		}
1327	}
1328
1329	if (session != NULL)
1330		DPRINTK(session->debug, "%s: MOD_DEC_USE_COUNT\n", session->name);
1331
1332	if (sk->protinfo.pppox)
1333		kfree(sk->protinfo.pppox);
1334
1335	if (session != NULL)
1336		kfree(session);
1337	MOD_DEC_USE_COUNT;
1338
1339out:
1340	EXIT_FUNCTION;
1341}
1342
1343/* Called when the PPPoX socket (session) is closed.
1344 */
1345static int pppol2tp_release(struct socket *sock)
1346{
1347	struct sock *sk = sock->sk;
1348	struct pppol2tp_session *session = NULL;
1349	struct pppol2tp_tunnel *tunnel;
1350	int error = 0;
1351	ENTER_FUNCTION;
1352
1353	if (!sk)
1354		return 0;
1355
1356	if (sk->dead != 0)
1357		return -EBADF;
1358
1359	if (sk->user_data) {	    /* Was this socket actually connected? */
1360		SOCK_2_SESSION(sk, session, error, -EBADF, end, 0);
1361
1362		/* Don't use SOCK_2_TUNNEL() here to get the tunnel context
1363		 * because the tunnel socket might have already been closed
1364		 * (its sk->user_data will be NULL) so use the session's
1365		 * private tunnel ptr instead.
1366		 */
1367		tunnel = session->tunnel;
1368		if (tunnel != NULL) {
1369			if (tunnel->magic == L2TP_TUNNEL_MAGIC) {
1370				/* Delete the session socket from the hash */
1371				write_lock_bh(&tunnel->hlist_lock);
1372				hlist_del_init(&session->hlist);
1373				write_unlock_bh(&tunnel->hlist_lock);
1374			} else {
1375				printk(KERN_ERR "%s: %s:%d: BAD TUNNEL MAGIC "
1376				       "( tunnel=%p magic=%x )\n",
1377				       __FUNCTION__, __FILE__, __LINE__,
1378				       tunnel, tunnel->magic);
1379				goto end;
1380			}
1381		}
1382	}
1383
1384	lock_sock(sk);
1385
1386	if (sk->state & (PPPOX_CONNECTED | PPPOX_BOUND))
1387		pppox_unbind_sock(sk);
1388
1389	/* Signal the death of the socket. */
1390	sk->state = PPPOX_DEAD;
1391	sock_orphan(sk);
1392	sock->sk = NULL;
1393
1394	/* Purge any queued data */
1395	skb_queue_purge(&sk->receive_queue);
1396	skb_queue_purge(&sk->write_queue);
1397
1398	release_sock(sk);
1399
1400	if (session != NULL)
1401		DPRINTK(session->debug, "calling sock_put; refcnt=%d\n",
1402			session->sock->refcnt.counter);
1403	sock_put(sk);
1404
1405end:
1406	EXIT_FUNCTION;
1407	return error;
1408}
1409
1410/* Copied from fget() in fs/file_table.c.
1411 * Allows caller to specify the pid that owns the fd.
1412 */
1413static struct file *pppol2tp_fget(pid_t pid, unsigned int fd)
1414{
1415	struct file *file;
1416	struct files_struct *files = current->files;
1417
1418	if (pid != 0) {
1419		struct task_struct *tsk = find_task_by_pid(pid);
1420		if (tsk == NULL)
1421			return NULL;
1422		files = tsk->files;
1423	}
1424
1425	spin_lock(&files->file_lock);
1426	file = fcheck_files(files, fd);
1427	if (file)
1428		get_file(file);
1429	spin_unlock(&files->file_lock);
1430	return file;
1431}
1432
1433/* Copied from net/socket.c */
1434extern __inline__ struct socket *socki_lookup(struct inode *inode)
1435{
1436	return &inode->u.socket_i;
1437}
1438
1439/* Copied from sockfd_lookup() in net/socket.c.
1440 * Allows caller to specify the pid that owns the fd.
1441 */
1442static struct socket *pppol2tp_sockfd_lookup(pid_t pid, int fd, int *err)
1443{
1444	struct file *file;
1445	struct inode *inode;
1446	struct socket *sock;
1447
1448	if (!(file = pppol2tp_fget(pid, fd))) {
1449		*err = -EBADF;
1450		return NULL;
1451	}
1452
1453	inode = file->f_dentry->d_inode;
1454	if (!inode->i_sock || !(sock = socki_lookup(inode))) {
1455		*err = -ENOTSOCK;
1456		fput(file);
1457		return NULL;
1458	}
1459
1460	if (sock->file != file) {
1461		printk(KERN_ERR "socki_lookup: socket file changed!\n");
1462		sock->file = file;
1463	}
1464	return sock;
1465}
1466
1467/* Internal function to prepare a tunnel (UDP) socket to have PPPoX sockets
1468 * attached to it
1469 */
1470static struct sock *pppol2tp_prepare_tunnel_socket(pid_t pid, int fd,
1471						   u16 tunnel_id, int *error)
1472{
1473	int err;
1474	struct socket *sock = NULL;
1475	struct sock *sk;
1476	struct pppol2tp_tunnel *tunnel;
1477	struct sock *ret = NULL;
1478
1479	ENTER_FUNCTION;
1480
1481	/* Get the socket from the fd */
1482	err = -EBADF;
1483	sock = pppol2tp_sockfd_lookup(pid, fd, &err);
1484	if (!sock) {
1485		PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_ERR,
1486		       "tunl %hu: sockfd_lookup(fd=%d) returned %d\n",
1487		       tunnel_id, fd, err);
1488		goto err;
1489	}
1490
1491	/* Quick sanity checks */
1492	err = -ESOCKTNOSUPPORT;
1493	if (sock->type != SOCK_DGRAM) {
1494		PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_ERR,
1495		       "tunl %hu: fd %d wrong type, got %d, expected %d\n",
1496		       tunnel_id, fd, sock->type, SOCK_DGRAM);
1497		goto err;
1498	}
1499	err = -EAFNOSUPPORT;
1500	if (sock->ops->family!=AF_INET) {
1501		PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_ERR,
1502		       "tunl %hu: fd %d wrong family, got %d, expected %d\n",
1503		       tunnel_id, fd, sock->ops->family, AF_INET);
1504		goto err;
1505	}
1506
1507	err = -ENOTCONN;
1508	sk = sock->sk;
1509
1510	/* Check if this socket has already been prepped */
1511	tunnel = (struct pppol2tp_tunnel *)sk->user_data;
1512	if (tunnel != NULL) {
1513		/* User-data field already set */
1514		err = -EBUSY;
1515		if (tunnel->magic != L2TP_TUNNEL_MAGIC) {
1516			printk(KERN_ERR "%s: %s:%d: BAD TUNNEL MAGIC "
1517			       "( tunnel=%p magic=%x )\n",
1518			       __FUNCTION__, __FILE__, __LINE__,
1519			       tunnel, tunnel->magic);
1520			goto err;
1521		}
1522
1523		/* This socket has already been prepped */
1524		ret = tunnel->sock;
1525		goto out;
1526	}
1527
1528	/* This socket is available and needs prepping. Create a new tunnel
1529	 * context and init it.
1530	 */
1531	sk->user_data = tunnel = kmalloc(sizeof(struct pppol2tp_tunnel), GFP_KERNEL);
1532	if (sk->user_data == NULL) {
1533		err = -ENOMEM;
1534		goto err;
1535	}
1536
1537	memset(tunnel, 0, sizeof(struct pppol2tp_tunnel));
1538
1539	tunnel->magic = L2TP_TUNNEL_MAGIC;
1540	sprintf(&tunnel->name[0], "tunl %hu", tunnel_id);
1541
1542	tunnel->stats.tunnel_id = tunnel_id;
1543
1544	tunnel->debug = PPPOL2TP_DEFAULT_DEBUG_FLAGS;
1545
1546	DPRINTK(tunnel->debug, "tunl %hu: allocated tunnel=%p, sk=%p, sock=%p\n",
1547		tunnel_id, tunnel, sk, sock);
1548
1549	/* Setup the new protocol stuff */
1550	tunnel->old_proto  = sk->prot;
1551	tunnel->l2tp_proto = *sk->prot;
1552
1553	sk->prot = &tunnel->l2tp_proto;
1554
1555#ifndef UDP_ENCAP_L2TPINUDP
1556	tunnel->old_data_ready = sk->data_ready;
1557	sk->data_ready	       = &pppol2tp_data_ready;
1558#else
1559	/* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
1560	(udp_sk(sk))->encap_type = UDP_ENCAP_L2TPINUDP;
1561	(udp_sk(sk))->encap_rcv = &pppol2tp_udp_encap_recv;
1562#endif
1563
1564	tunnel->old_sk_destruct = sk->destruct;
1565	sk->destruct		= &pppol2tp_tunnel_destruct;
1566
1567	tunnel->sock   = sk;
1568	sk->allocation = GFP_ATOMIC;
1569
1570	rwlock_init(&tunnel->hlist_lock);
1571
1572	/* Add tunnel to our list */
1573	INIT_LIST_HEAD(&tunnel->list);
1574	list_add(&tunnel->list, &pppol2tp_tunnel_list);
1575
1576	ret = tunnel->sock;
1577
1578	MOD_INC_USE_COUNT;
1579	DPRINTK(-1, "tunl %hu: MOD_INC_USE_COUNT\n", tunnel_id);
1580
1581	*error = 0;
1582out:
1583	if (sock)
1584		sockfd_put(sock);
1585	EXIT_FUNCTION;
1586
1587	return ret;
1588
1589err:
1590	*error = err;
1591	goto out;
1592}
1593
1594/* socket() handler. Initialize a new struct sock.
1595 */
1596static int pppol2tp_create(struct socket *sock)
1597{
1598	int error = 0;
1599	struct sock *sk;
1600
1601	ENTER_FUNCTION;
1602	DPRINTK(-1, "sock=%p\n", sock);
1603
1604	sk = sk_alloc(PF_PPPOX, GFP_KERNEL, 1);
1605	if (!sk)
1606		return -ENOMEM;
1607
1608	MOD_INC_USE_COUNT;
1609	DPRINTK(-1, "MOD_INC_USE_COUNT\n");
1610
1611	sock_init_data(sock, sk);
1612
1613	sock->state  = SS_UNCONNECTED;
1614	sock->ops    = &pppol2tp_ops;
1615
1616	sk->protocol = PX_PROTO_OL2TP;
1617	sk->family   = PF_PPPOX;
1618
1619	sk->next     = NULL;
1620	sk->pprev    = NULL;
1621	sk->state    = PPPOX_NONE;
1622	sk->type     = SOCK_STREAM;
1623	sk->destruct = pppol2tp_session_destruct;
1624	sk->backlog_rcv = pppol2tp_recv_core;
1625
1626	sk->protinfo.pppox = kmalloc(sizeof(struct pppox_opt), GFP_KERNEL);
1627	if (!sk->protinfo.pppox) {
1628		error = -ENOMEM;
1629		goto free_sk;
1630	}
1631
1632	memset((void *) sk->protinfo.pppox, 0, sizeof(struct pppox_opt));
1633	sk->protinfo.pppox->sk = sk;
1634
1635	sock->sk = sk;
1636
1637	EXIT_FUNCTION;
1638	return 0;
1639
1640free_sk:
1641	sk_free(sk);
1642	EXIT_FUNCTION;
1643	return error;
1644}
1645
1646/* connect() handler..	Attach a PPPoX socket to a tunnel UDP socket
1647 */
1648int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
1649		     int sockaddr_len, int flags)
1650{
1651	struct sock *sk = sock->sk;
1652	struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr;
1653	struct pppox_opt *po = sk->protinfo.pppox;
1654	struct sock *tunnel_sock = NULL;
1655	struct pppol2tp_session *session = NULL;
1656	struct pppol2tp_tunnel *tunnel;
1657	struct dst_entry *dst;
1658	int error = 0;
1659
1660	ENTER_FUNCTION;
1661
1662	DPRINTK(-1, "sock=%p, uservaddr=%p, sockaddr_len=%d, flags=%d, addr=%x/%hu\n",
1663		sock, uservaddr, sockaddr_len, flags,
1664		ntohl(sp->pppol2tp.addr.sin_addr.s_addr), ntohs(sp->pppol2tp.addr.sin_port));
1665	lock_sock(sk);
1666
1667	error = -EINVAL;
1668	if (sp->sa_protocol != PX_PROTO_OL2TP)
1669		goto end;
1670
1671	/* Check for already bound sockets */
1672	error = -EBUSY;
1673	if (sk->state & PPPOX_CONNECTED)
1674		goto end;
1675
1676	/* We don't supporting rebinding anyway */
1677	if (sk->user_data)
1678		goto end; /* socket is already attached */
1679
1680	/* Don't bind if s_tunnel is 0 */
1681	error = -EINVAL;
1682	if (sp->pppol2tp.s_tunnel == 0)
1683		goto end;
1684
1685	/* Look up the tunnel socket and configure it if necessary */
1686	tunnel_sock = pppol2tp_prepare_tunnel_socket(sp->pppol2tp.pid,
1687						     sp->pppol2tp.fd,
1688						     sp->pppol2tp.s_tunnel,
1689						     &error);
1690	if (tunnel_sock == NULL)
1691		goto end;
1692	tunnel = tunnel_sock->user_data;
1693
1694	/* Allocate and initialize a new session context.
1695	 */
1696	session = kmalloc(sizeof(struct pppol2tp_session), GFP_KERNEL);
1697	if (session == NULL) {
1698		error = -ENOMEM;
1699		goto end;
1700	}
1701
1702	memset(session, 0, sizeof(struct pppol2tp_session));
1703
1704	skb_queue_head_init(&session->reorder_q);
1705
1706	session->magic	     = L2TP_SESSION_MAGIC;
1707	session->owner	     = current->pid;
1708	session->sock	     = sk;
1709	session->tunnel	     = tunnel;
1710	session->tunnel_sock = tunnel_sock;
1711	session->tunnel_addr = sp->pppol2tp;
1712	sprintf(&session->name[0], "sess %hu/%hu",
1713		session->tunnel_addr.s_tunnel,
1714		session->tunnel_addr.s_session);
1715
1716	session->stats.tunnel_id  = session->tunnel_addr.s_tunnel;
1717	session->stats.session_id = session->tunnel_addr.s_session;
1718
1719	INIT_HLIST_NODE(&session->hlist);
1720
1721	session->debug = PPPOL2TP_DEFAULT_DEBUG_FLAGS;
1722
1723	/* Default MTU must allow space for UDP/L2TP/PPP
1724	 * headers. Leave some slack.
1725	 */
1726	session->mtu = session->mru = 1500 - PPPOL2TP_HEADER_OVERHEAD;
1727
1728	/* If PMTU discovery was enabled, use the MTU that was discovered */
1729	dst = sk_dst_get(sk);
1730	if (dst != NULL) {
1731		u32 pmtu = dst_pmtu(dst);
1732		if (pmtu != 0) {
1733			session->mtu = session->mru = pmtu -
1734				PPPOL2TP_HEADER_OVERHEAD;
1735			DPRINTK(session->debug,
1736				"%s: MTU set by Path MTU discovery: mtu=%d\n",
1737				session->name, session->mtu);
1738		}
1739		dst_release(dst);
1740	}
1741
1742	/* Special case: if source & dest session_id == 0x0000, this socket is
1743	 * being created to manage the tunnel. Don't add the session to the
1744	 * session hash list, just set up the internal context for use by
1745	 * ioctl() and sockopt() handlers.
1746	 */
1747	if ((session->tunnel_addr.s_session == 0) &&
1748	    (session->tunnel_addr.d_session == 0)) {
1749		error = 0;
1750		DPRINTK(session->debug,
1751			"tunl %hu: socket created for tunnel mgmt ops\n",
1752			session->tunnel_addr.s_tunnel);
1753		sk->user_data = session;
1754		goto out_no_ppp;
1755	}
1756
1757	DPRINTK(session->debug, "%s: allocated session=%p, sock=%p, owner=%d\n",
1758		session->name, session, sk, session->owner);
1759
1760	/* Add session to the tunnel's hash list */
1761	SOCK_2_TUNNEL(tunnel_sock, tunnel, error, -EBADF, end, 0);
1762	write_lock_bh(&tunnel->hlist_lock);
1763	hlist_add_head(&session->hlist,
1764		       pppol2tp_session_id_hash(tunnel,
1765						session->tunnel_addr.s_session));
1766	write_unlock_bh(&tunnel->hlist_lock);
1767
1768	/* This is how we get the session context from the socket. */
1769	sk->user_data = session;
1770
1771	/* We don't store any more options in the pppox_opt, everything is in
1772	 * user_data (struct pppol2tp_session)
1773	 */
1774	po->sk = sk;
1775
1776	/* Right now, because we don't have a way to push the incoming skb's
1777	 * straight through the UDP layer, the only header we need to worry
1778	 * about is the L2TP header. This size is different depending on
1779	 * whether sequence numbers are enabled for the data channel.
1780	 */
1781	po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
1782
1783	po->chan.private = sk;
1784	po->chan.ops	 = &pppol2tp_chan_ops;
1785	po->chan.mtu	 = session->mtu;
1786
1787	error = ppp_register_channel(&po->chan);
1788	if (error)
1789		goto end;
1790
1791out_no_ppp:
1792	atomic_inc(&tunnel->session_count);
1793	sk->state = PPPOX_CONNECTED;
1794	PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
1795	       "%s: created\n", session->name);
1796
1797end:
1798	release_sock(sk);
1799
1800	if (error != 0)
1801		PRINTK(session ? session->debug : -1, PPPOL2TP_MSG_CONTROL,
1802		       KERN_WARNING, "%s: connect failed: %d\n", session->name,
1803		       error);
1804
1805	EXIT_FUNCTION;
1806
1807	return error;
1808}
1809
1810/* getname() support.
1811 */
1812static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
1813			    int *usockaddr_len, int peer)
1814{
1815	int len = sizeof(struct sockaddr_pppol2tp);
1816	struct sockaddr_pppol2tp sp;
1817	int error = 0;
1818	struct pppol2tp_session *session;
1819
1820	ENTER_FUNCTION;
1821
1822	error = -ENOTCONN;
1823	if (sock->sk->state != PPPOX_CONNECTED)
1824		goto end;
1825
1826	SOCK_2_SESSION(sock->sk, session, error, -EBADF, end, 0);
1827
1828	sp.sa_family	= AF_PPPOX;
1829	sp.sa_protocol	= PX_PROTO_OL2TP;
1830	memcpy(&sp.pppol2tp, &session->tunnel_addr,
1831	       sizeof(struct pppol2tp_addr));
1832
1833	memcpy(uaddr, &sp, len);
1834
1835	*usockaddr_len = len;
1836
1837	error = 0;
1838end:
1839	EXIT_FUNCTION;
1840	return error;
1841}
1842
1843/****************************************************************************
1844 * ioctl() handlers.
1845 *
1846 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
1847 * sockets. However, in order to control kernel tunnel features, we allow
1848 * userspace to create a special "tunnel" PPPoX socket which is used for
1849 * control only.  Tunnel PPPoX sockets have session_id == 0 and simply allow
1850 * the user application to issue L2TP setsockopt(), getsockopt() and ioctl()
1851 * calls.
1852 ****************************************************************************/
1853
1854/* Session ioctl helper.
1855 */
1856static int pppol2tp_session_ioctl(struct pppol2tp_session *session,
1857				  unsigned int cmd, unsigned long arg)
1858{
1859	struct ifreq ifr;
1860	int err = 0;
1861	struct sock *sk = session->sock;
1862	int val = (int) arg;
1863
1864	sock_hold(sk);
1865
1866	PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_DEBUG,
1867	       "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n",
1868	       session->name, cmd, arg);
1869
1870	switch (cmd) {
1871	case SIOCGIFMTU:
1872		err = -ENXIO;
1873		if (!(sk->state & PPPOX_CONNECTED))
1874			break;
1875
1876		err = -EFAULT;
1877		if (copy_from_user(&ifr, (void *) arg, sizeof(struct ifreq)))
1878			break;
1879		ifr.ifr_mtu = session->mtu;
1880		if (copy_to_user((void *) arg, &ifr, sizeof(struct ifreq)))
1881			break;
1882
1883		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
1884		       "%s: get mtu=%d\n", session->name, session->mtu);
1885		err = 0;
1886		break;
1887
1888	case SIOCSIFMTU:
1889		err = -ENXIO;
1890		if (!(sk->state & PPPOX_CONNECTED))
1891			break;
1892
1893		err = -EFAULT;
1894		if (copy_from_user(&ifr, (void *) arg, sizeof(struct ifreq)))
1895			break;
1896
1897		session->mtu = ifr.ifr_mtu;
1898;
1899		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
1900		       "%s: set mtu=%d\n", session->name, session->mtu);
1901		err = 0;
1902		break;
1903
1904	case PPPIOCGMRU:
1905		err = -ENXIO;
1906		if (!(sk->state & PPPOX_CONNECTED))
1907			break;
1908
1909		err = -EFAULT;
1910		if (put_user(session->mru, (int *) arg))
1911			break;
1912
1913		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
1914		       "%s: get mru=%d\n", session->name, session->mru);
1915		err = 0;
1916		break;
1917
1918	case PPPIOCSMRU:
1919		err = -ENXIO;
1920		if (!(sk->state & PPPOX_CONNECTED))
1921			break;
1922
1923		err = -EFAULT;
1924		if (get_user(val,(int *) arg))
1925			break;
1926
1927		session->mru = val;
1928		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
1929		       "%s: set mru=%d\n", session->name, session->mru);
1930		err = 0;
1931		break;
1932
1933	case PPPIOCGFLAGS:
1934		err = -EFAULT;
1935		if (put_user(session->flags, (int *) arg))
1936			break;
1937
1938		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
1939		       "%s: get flags=%d\n", session->name, session->flags);
1940		err = 0;
1941		break;
1942
1943	case PPPIOCSFLAGS:
1944		err = -EFAULT;
1945		if (get_user(val, (int *) arg))
1946			break;
1947		session->flags = val;
1948		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
1949		       "%s: set flags=%d\n", session->name, session->flags);
1950		err = 0;
1951		break;
1952
1953	case PPPIOCGL2TPSTATS:
1954		err = -ENXIO;
1955
1956		if (!(sk->state & PPPOX_CONNECTED))
1957			break;
1958
1959		if (copy_to_user((void *) arg, &session->stats,
1960				 sizeof(session->stats)))
1961			break;
1962		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
1963		       "%s: get L2TP stats\n", session->name);
1964		err = 0;
1965		break;
1966
1967	default:
1968		err = -ENOSYS;
1969		break;
1970	}
1971
1972	sock_put(sk);
1973
1974	return err;
1975}
1976
1977/* Tunnel ioctl helper.
1978 *
1979 * Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data
1980 * specifies a session_id, the session ioctl handler is called. This allows an
1981 * application to retrieve session stats via a tunnel socket.
1982 */
1983static int pppol2tp_tunnel_ioctl(struct pppol2tp_tunnel *tunnel,
1984				 unsigned int cmd, unsigned long arg)
1985{
1986	int err = 0;
1987	struct sock *sk = tunnel->sock;
1988	struct pppol2tp_ioc_stats stats_req;
1989
1990	sock_hold(sk);
1991
1992	PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_DEBUG,
1993	       "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n", tunnel->name,
1994	       cmd, arg);
1995
1996	switch (cmd) {
1997	case PPPIOCGL2TPSTATS:
1998		err = -ENXIO;
1999
2000		if (!(sk->state & PPPOX_CONNECTED))
2001			break;
2002
2003		if (copy_from_user(&stats_req, (void *) arg,
2004				   sizeof(stats_req))) {
2005			err = -EFAULT;
2006			break;
2007		}
2008		if (stats_req.session_id != 0) {
2009			/* resend to session ioctl handler */
2010			struct pppol2tp_session *session =
2011				pppol2tp_session_find(tunnel, stats_req.session_id);
2012			if (session != NULL)
2013				err = pppol2tp_session_ioctl(session, cmd, arg);
2014			else
2015				err = -EBADR;
2016			break;
2017		}
2018		if (copy_to_user((void *) arg, &tunnel->stats,
2019				 sizeof(tunnel->stats))) {
2020			err = -EFAULT;
2021			break;
2022		}
2023		PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
2024		       "%s: get L2TP stats\n", tunnel->name);
2025		err = 0;
2026		break;
2027
2028	default:
2029		err = -ENOSYS;
2030		break;
2031	}
2032
2033	sock_put(sk);
2034
2035	return err;
2036}
2037
2038/* Main ioctl() handler.
2039 * Dispatch to tunnel or session helpers depending on the socket.
2040 */
2041static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
2042			    unsigned long arg)
2043{
2044	struct sock *sk = sock->sk;
2045	struct pppol2tp_session *session;
2046	struct pppol2tp_tunnel *tunnel;
2047	int err = 0;
2048
2049	ENTER_FUNCTION;
2050
2051	if (!sk)
2052		return 0;
2053
2054	if (sk->dead != 0)
2055		return -EBADF;
2056
2057	if ((sk->user_data == NULL) ||
2058	    (!(sk->state & (PPPOX_CONNECTED | PPPOX_BOUND)))) {
2059		err = -ENOTCONN;
2060		DPRINTK(-1, "ioctl: socket %p not connected.\n", sk);
2061		goto end;
2062	}
2063
2064	SOCK_2_SESSION(sk, session, err, -EBADF, end, 0);
2065	SOCK_2_TUNNEL(session->tunnel_sock, tunnel, err, -EBADF, end, 1);
2066
2067	/* Special case: if session's session_id is zero, treat ioctl as a
2068	 * tunnel ioctl
2069	 */
2070	if ((session->tunnel_addr.s_session == 0) &&
2071	    (session->tunnel_addr.d_session == 0)) {
2072		err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg);
2073		goto end;
2074	}
2075
2076	err = pppol2tp_session_ioctl(session, cmd, arg);
2077
2078end:
2079	EXIT_FUNCTION;
2080	return err;
2081}
2082
2083/*****************************************************************************
2084 * setsockopt() / getsockopt() support.
2085 *
2086 * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
2087 * sockets. In order to control kernel tunnel features, we allow userspace to
2088 * create a special "tunnel" PPPoX socket which is used for control only.
2089 * Tunnel PPPoX sockets have session_id == 0 and simply allow the user
2090 * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls.
2091 *****************************************************************************/
2092
2093/* Tunnel setsockopt() helper.
2094 */
2095static int pppol2tp_tunnel_setsockopt(struct sock *sk,
2096				      struct pppol2tp_tunnel *tunnel,
2097				      int optname, int val)
2098{
2099	int err = 0;
2100
2101	switch (optname) {
2102	case PPPOL2TP_SO_DEBUG:
2103		tunnel->debug = val;
2104		PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
2105		       "%s: set debug=%x\n", tunnel->name, tunnel->debug);
2106		break;
2107
2108	default:
2109		err = -ENOPROTOOPT;
2110		break;
2111	}
2112
2113	return err;
2114}
2115
2116/* Session setsockopt helper.
2117 */
2118static int pppol2tp_session_setsockopt(struct sock *sk,
2119				       struct pppol2tp_session *session,
2120				       int optname, int val)
2121{
2122	int err = 0;
2123
2124	switch (optname) {
2125	case PPPOL2TP_SO_RECVSEQ:
2126		if ((val != 0) && (val != 1)) {
2127			err = -EINVAL;
2128			break;
2129		}
2130		session->recv_seq = val ? -1 : 0;
2131		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
2132		       "%s: set recv_seq=%d\n", session->name,
2133		       session->recv_seq);
2134		break;
2135
2136	case PPPOL2TP_SO_SENDSEQ:
2137		if ((val != 0) && (val != 1)) {
2138			err = -EINVAL;
2139			break;
2140		}
2141		session->send_seq = val ? -1 : 0;
2142		{
2143			/* FIXME: is it safe to change the ppp channel's
2144			 * hdrlen on the fly?
2145			 */
2146			struct sock *sk	     = session->sock;
2147			struct pppox_opt *po = sk->protinfo.pppox;
2148			po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
2149				PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
2150		}
2151		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
2152		       "%s: set send_seq=%d\n", session->name, session->send_seq);
2153		break;
2154
2155	case PPPOL2TP_SO_LNSMODE:
2156		if ((val != 0) && (val != 1)) {
2157			err = -EINVAL;
2158			break;
2159		}
2160		session->lns_mode = val ? -1 : 0;
2161		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
2162		       "%s: set lns_mode=%d\n", session->name,
2163		       session->lns_mode);
2164		break;
2165
2166	case PPPOL2TP_SO_DEBUG:
2167		session->debug = val;
2168		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
2169		       "%s: set debug=%x\n", session->name, session->debug);
2170		break;
2171
2172	case PPPOL2TP_SO_REORDERTO:
2173		session->reorder_timeout = MS_TO_JIFFIES(val);
2174		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
2175		       "%s: set reorder_timeout=%d\n", session->name,
2176		       session->reorder_timeout);
2177		break;
2178
2179	default:
2180		err = -ENOPROTOOPT;
2181		break;
2182	}
2183
2184	return err;
2185}
2186
2187/* Main setsockopt() entry point.
2188 * Does API checks, then calls either the tunnel or session setsockopt
2189 * handler, according to whether the PPPoL2TP socket is a for a regular
2190 * session or the special tunnel type.
2191 */
2192static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
2193			       char *optval, int optlen)
2194{
2195	struct sock *sk = sock->sk;
2196	struct pppol2tp_session *session = sk->user_data;
2197	struct pppol2tp_tunnel *tunnel;
2198	int val;
2199	int err = 0;
2200
2201	if (level != SOL_PPPOL2TP)
2202		return udp_prot.setsockopt(sk, level, optname, optval, optlen);
2203
2204	if (optlen<sizeof(int))
2205		return -EINVAL;
2206
2207	if (get_user(val, (int *)optval))
2208		return -EFAULT;
2209
2210	if (sk->user_data == NULL) {
2211		err = -ENOTCONN;
2212		DPRINTK(-1, "setsockopt: socket %p not connected.\n", sk);
2213		goto end;
2214	}
2215
2216	SOCK_2_SESSION(sk, session, err, -EBADF, end, 0);
2217	SOCK_2_TUNNEL(session->tunnel_sock, tunnel, err, -EBADF, end, 1);
2218
2219	lock_sock(sk);
2220
2221	/* Special case: if session_id == 0x0000, treat as operation on tunnel
2222	 */
2223	if ((session->tunnel_addr.s_session == 0) &&
2224	    (session->tunnel_addr.d_session == 0))
2225		err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
2226	else
2227		err = pppol2tp_session_setsockopt(sk, session, optname, val);
2228
2229	release_sock(sk);
2230end:
2231	return err;
2232}
2233
2234/* Tunnel getsockopt helper.
2235 */
2236static int pppol2tp_tunnel_getsockopt(struct sock *sk,
2237				      struct pppol2tp_tunnel *tunnel,
2238				      int optname, int *val)
2239{
2240	int err = 0;
2241
2242	switch (optname) {
2243	case PPPOL2TP_SO_DEBUG:
2244		*val = tunnel->debug;
2245		PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
2246		       "%s: get debug=%x\n", tunnel->name, tunnel->debug);
2247		break;
2248
2249	default:
2250		err = -ENOPROTOOPT;
2251		break;
2252	}
2253
2254	return err;
2255}
2256
2257/* Session getsockopt helper.
2258 */
2259static int pppol2tp_session_getsockopt(struct sock *sk,
2260				       struct pppol2tp_session *session,
2261				       int optname, int *val)
2262{
2263	int err = 0;
2264
2265	switch (optname) {
2266	case PPPOL2TP_SO_RECVSEQ:
2267		*val = session->recv_seq;
2268		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
2269		       "%s: get recv_seq=%d\n", session->name, *val);
2270		break;
2271
2272	case PPPOL2TP_SO_SENDSEQ:
2273		*val = session->send_seq;
2274		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
2275		       "%s: get send_seq=%d\n", session->name, *val);
2276		break;
2277
2278	case PPPOL2TP_SO_LNSMODE:
2279		*val = session->lns_mode;
2280		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
2281		       "%s: get lns_mode=%d\n", session->name, *val);
2282		break;
2283
2284	case PPPOL2TP_SO_DEBUG:
2285		*val = session->debug;
2286		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
2287		       "%s: get debug=%d\n", session->name, *val);
2288		break;
2289
2290	case PPPOL2TP_SO_REORDERTO:
2291		*val = JIFFIES_TO_MS(session->reorder_timeout);
2292		PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
2293		       "%s: get reorder_timeout=%d\n", session->name, *val);
2294		break;
2295
2296	default:
2297		err = -ENOPROTOOPT;
2298	}
2299
2300	return err;
2301}
2302
2303/* Main getsockopt() entry point.
2304 * Does API checks, then calls either the tunnel or session getsockopt
2305 * handler, according to whether the PPPoX socket is a for a regular session
2306 * or the special tunnel type.
2307 */
2308static int pppol2tp_getsockopt(struct socket *sock, int level,
2309			       int optname, char *optval, int *optlen)
2310{
2311	struct sock *sk = sock->sk;
2312	struct pppol2tp_session *session = sk->user_data;
2313	struct pppol2tp_tunnel *tunnel;
2314	int val, len;
2315	int err = 0;
2316
2317	if (level != SOL_PPPOL2TP)
2318		return udp_prot.getsockopt(sk, level, optname, optval, optlen);
2319
2320	if (get_user(len,optlen))
2321		return -EFAULT;
2322
2323	len = min_t(unsigned int, len, sizeof(int));
2324
2325	if (len < 0)
2326		return -EINVAL;
2327
2328	if (sk->user_data == NULL) {
2329		err = -ENOTCONN;
2330		DPRINTK(-1, "getsockopt: socket %p not connected.\n", sk);
2331		goto end;
2332	}
2333
2334	/* Get the session and tunnel contexts */
2335	SOCK_2_SESSION(sk, session, err, -EBADF, end, 0);
2336	SOCK_2_TUNNEL(session->tunnel_sock, tunnel, err, -EBADF, end, 1);
2337
2338	/* Special case: if session_id == 0x0000, treat as operation on tunnel */
2339	if ((session->tunnel_addr.s_session == 0) &&
2340	    (session->tunnel_addr.d_session == 0))
2341		err = pppol2tp_tunnel_getsockopt(sk,tunnel, optname, &val);
2342	else
2343		err = pppol2tp_session_getsockopt(sk,session, optname, &val);
2344
2345	if (put_user(len, optlen))
2346		return -EFAULT;
2347
2348	if (copy_to_user(optval, &val, len))
2349		return -EFAULT;
2350
2351end:
2352	return err;
2353}
2354
2355/*****************************************************************************
2356 * /proc filesystem for debug
2357 *****************************************************************************/
2358
2359#ifdef CONFIG_PROC_FS
2360
2361#include <linux/seq_file.h>
2362
2363static int pppol2tp_proc_open(struct inode *inode, struct file *file);
2364static void *pppol2tp_proc_start(struct seq_file *m, loff_t *_pos);
2365static void *pppol2tp_proc_next(struct seq_file *p, void *v, loff_t *pos);
2366static void pppol2tp_proc_stop(struct seq_file *p, void *v);
2367static int pppol2tp_proc_show(struct seq_file *m, void *v);
2368
2369static struct proc_dir_entry *pppol2tp_proc;
2370
2371static struct seq_operations pppol2tp_proc_ops = {
2372	.start		= pppol2tp_proc_start,
2373	.next		= pppol2tp_proc_next,
2374	.stop		= pppol2tp_proc_stop,
2375	.show		= pppol2tp_proc_show,
2376};
2377
2378static struct file_operations pppol2tp_proc_fops = {
2379	.open		= pppol2tp_proc_open,
2380	.read		= seq_read,
2381	.llseek		= seq_lseek,
2382	.release	= seq_release,
2383};
2384
2385
2386#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,4,26))
2387static inline struct proc_dir_entry *PDE(const struct inode *inode)
2388{
2389	return (struct proc_dir_entry *)inode->u.generic_ip;
2390}
2391#endif
2392
2393static int pppol2tp_proc_open(struct inode *inode, struct file *file)
2394{
2395	struct seq_file *m;
2396	int ret = 0;
2397
2398	ENTER_FUNCTION;
2399	ret = seq_open(file, &pppol2tp_proc_ops);
2400	if (ret < 0)
2401		goto out;
2402
2403	m	   = file->private_data;
2404	m->private = PDE(inode)->data;
2405
2406out:
2407	EXIT_FUNCTION;
2408	return ret;
2409}
2410
2411static void *pppol2tp_proc_start(struct seq_file *m, loff_t *_pos)
2412{
2413	struct pppol2tp_tunnel *tunnel = NULL;
2414	loff_t pos = *_pos;
2415	struct list_head *walk;
2416	struct list_head *tmp;
2417
2418	ENTER_FUNCTION;
2419
2420	/* allow for the header line */
2421	if (!pos) {
2422		tunnel = (void *)1;
2423		goto out;
2424	}
2425	pos--;
2426
2427	/* find the n'th element in the list */
2428	list_for_each_safe(walk, tmp, &pppol2tp_tunnel_list) {
2429		tunnel = list_entry(walk, struct pppol2tp_tunnel, list);
2430		if (!pos--) {
2431			sock_hold(tunnel->sock);
2432			goto out;
2433		}
2434	}
2435	tunnel = NULL;
2436
2437out:
2438	EXIT_FUNCTION;
2439
2440	return tunnel;
2441}
2442
2443static void *pppol2tp_proc_next(struct seq_file *p, void *v, loff_t *pos)
2444{
2445	struct pppol2tp_tunnel *tunnel = v;
2446	struct list_head *tmp;
2447	struct list_head *list;
2448
2449	ENTER_FUNCTION;
2450
2451	(*pos)++;
2452
2453	if (v == (void *)1)
2454		list = &pppol2tp_tunnel_list;
2455	else
2456		list = &tunnel->list;
2457
2458	tmp = list->next;
2459	if (tmp == &pppol2tp_tunnel_list)
2460		tunnel = NULL;
2461	else
2462		tunnel = list_entry(tmp, struct pppol2tp_tunnel, list);
2463
2464	EXIT_FUNCTION;
2465
2466	return tunnel;
2467}
2468
2469static void pppol2tp_proc_stop(struct seq_file *p, void *v)
2470{
2471	struct pppol2tp_tunnel *tunnel = v;
2472
2473	ENTER_FUNCTION;
2474
2475	if (tunnel != NULL)
2476		sock_put(tunnel->sock);
2477
2478	EXIT_FUNCTION;
2479}
2480
2481static int pppol2tp_proc_show(struct seq_file *m, void *v)
2482{
2483	struct pppol2tp_tunnel *tunnel = v;
2484	struct pppol2tp_session *session;
2485	struct hlist_node *walk;
2486	struct hlist_node *tmp;
2487	int i;
2488
2489	ENTER_FUNCTION;
2490
2491	/* display header on line 1 */
2492	if (v == (void *)1) {
2493		seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n");
2494		seq_puts(m, "TUNNEL name, user-data-ok "
2495			 "session-count magic-ok\n");
2496		seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
2497		seq_puts(m, "  SESSION name, addr/port src-tid/sid "
2498			 "dest-tid/sid state user-data-ok magic-ok\n");
2499		seq_puts(m, "   mtu/mru/rcvseq/sendseq/lns debug reorderto\n");
2500		seq_puts(m, "   nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
2501		goto out;
2502	}
2503
2504	seq_printf(m, "TUNNEL '%s', %c %d MAGIC %s\n",
2505		   tunnel->name,
2506		   (tunnel == tunnel->sock->user_data) ? 'Y':'N',
2507		   atomic_read(&tunnel->session_count),
2508		   (tunnel->magic == L2TP_TUNNEL_MAGIC) ? "OK" : "BAD");
2509	seq_printf(m, " %08x %llu/%llu/%llu %llu/%llu/%llu\n",
2510		   tunnel->debug,
2511		   tunnel->stats.tx_packets, tunnel->stats.tx_bytes,
2512		   tunnel->stats.tx_errors,
2513		   tunnel->stats.rx_packets, tunnel->stats.rx_bytes,
2514		   tunnel->stats.rx_errors);
2515
2516	if (tunnel->magic != L2TP_TUNNEL_MAGIC) {
2517		seq_puts(m, "*** Aborting ***\n");
2518		goto out;
2519	}
2520
2521	for (i = 0; i < PPPOL2TP_HASH_SIZE; i++) {
2522		hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[i]) {
2523			session = hlist_entry(walk, struct pppol2tp_session, hlist);
2524			seq_printf(m, "  SESSION '%s' %08X/%d %04X/%04X -> "
2525				   "%04X/%04X %d %c MAGIC %s\n",
2526				   session->name,
2527				   htonl(session->tunnel_addr.addr.sin_addr.s_addr),
2528				   htons(session->tunnel_addr.addr.sin_port),
2529				   session->tunnel_addr.s_tunnel,
2530				   session->tunnel_addr.s_session,
2531				   session->tunnel_addr.d_tunnel,
2532				   session->tunnel_addr.d_session,
2533				   session->sock->state,
2534				   (session == session->sock->user_data) ?
2535				   'Y' : 'N',
2536				   (session->magic == L2TP_SESSION_MAGIC) ?
2537				   "OK" : "BAD");
2538
2539			seq_printf(m, "   %d/%d/%c/%c/%s %08x %d\n",
2540				   session->mtu, session->mru,
2541				   session->recv_seq ? 'R' : '-',
2542				   session->send_seq ? 'S' : '-',
2543				   session->lns_mode ? "LNS" : "LAC",
2544				   session->debug,
2545				   JIFFIES_TO_MS(session->reorder_timeout));
2546			seq_printf(m, "   %hu/%hu %llu/%llu/%llu %llu/%llu/%llu\n",
2547				   session->nr, session->ns,
2548				   session->stats.tx_packets,
2549				   session->stats.tx_bytes,
2550				   session->stats.tx_errors,
2551				   session->stats.rx_packets,
2552				   session->stats.rx_bytes,
2553				   session->stats.rx_errors);
2554
2555			if (session->magic != L2TP_SESSION_MAGIC) {
2556				seq_puts(m, "*** Aborting ***\n");
2557				goto out;
2558			}
2559		}
2560	}
2561out:
2562	seq_puts(m, "\n");
2563
2564	EXIT_FUNCTION;
2565
2566	return 0;
2567}
2568
2569#endif /* CONFIG_PROC_FS */
2570
2571/*****************************************************************************
2572 * Init and cleanup
2573 *****************************************************************************/
2574
2575static struct proto_ops pppol2tp_ops = {
2576	.family		= AF_PPPOX,
2577	.release	= pppol2tp_release,
2578	.bind		= sock_no_bind,
2579	.connect	= pppol2tp_connect,
2580	.socketpair	= sock_no_socketpair,
2581	.accept		= sock_no_accept,
2582	.getname	= pppol2tp_getname,
2583	.poll		= datagram_poll,
2584	.listen		= sock_no_listen,
2585	.shutdown	= sock_no_shutdown,
2586	.setsockopt	= pppol2tp_setsockopt,
2587	.getsockopt	= pppol2tp_getsockopt,
2588	.sendmsg	= pppol2tp_sendmsg,
2589	.recvmsg	= pppol2tp_recvmsg,
2590	.mmap		= sock_no_mmap
2591};
2592
2593struct pppox_proto pppol2tp_proto = {
2594	.create		= pppol2tp_create,
2595	.ioctl		= pppol2tp_ioctl
2596};
2597
2598int __init pppol2tp_init(void)
2599{
2600	int err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto);
2601
2602	if (err == 0) {
2603#ifdef CONFIG_PROC_FS
2604		pppol2tp_proc = create_proc_entry("pppol2tp", 0, proc_net);
2605		if (!pppol2tp_proc) {
2606			return -ENOMEM;
2607		}
2608		pppol2tp_proc->owner	 = THIS_MODULE;
2609		pppol2tp_proc->proc_fops = &pppol2tp_proc_fops;
2610#endif /* CONFIG_PROC_FS */
2611		printk(KERN_INFO "PPPoL2TP kernel driver, %s\n",
2612		       PPPOL2TP_DRV_VERSION);
2613	}
2614
2615	return err;
2616}
2617
2618void __exit pppol2tp_exit(void)
2619{
2620	unregister_pppox_proto(PX_PROTO_OL2TP);
2621#ifdef CONFIG_PROC_FS
2622	remove_proc_entry("pppol2tp", proc_net);
2623#endif
2624#ifdef DEBUG_MOD_USE_COUNT
2625	printk(KERN_DEBUG "%s: module use_count is %d\n", __FUNCTION__, mod_use_count);
2626#endif
2627}
2628
2629module_init(pppol2tp_init);
2630module_exit(pppol2tp_exit);
2631
2632MODULE_AUTHOR("Martijn van Oosterhout <kleptog@svana.org>");
2633MODULE_DESCRIPTION("PPP over L2TP over UDP, " PPPOL2TP_DRV_VERSION);
2634MODULE_LICENSE("GPL");
2635