Root/
1 | /* |
2 | * L2TP core. |
3 | * |
4 | * Copyright (c) 2008,2009,2010 Katalix Systems Ltd |
5 | * |
6 | * This file contains some code of the original L2TPv2 pppol2tp |
7 | * driver, which has the following copyright: |
8 | * |
9 | * Authors: Martijn van Oosterhout <kleptog@svana.org> |
10 | * James Chapman (jchapman@katalix.com) |
11 | * Contributors: |
12 | * Michal Ostrowski <mostrows@speakeasy.net> |
13 | * Arnaldo Carvalho de Melo <acme@xconectiva.com.br> |
14 | * David S. Miller (davem@redhat.com) |
15 | * |
16 | * This program is free software; you can redistribute it and/or modify |
17 | * it under the terms of the GNU General Public License version 2 as |
18 | * published by the Free Software Foundation. |
19 | */ |
20 | |
21 | #include <linux/module.h> |
22 | #include <linux/string.h> |
23 | #include <linux/list.h> |
24 | #include <linux/rculist.h> |
25 | #include <linux/uaccess.h> |
26 | |
27 | #include <linux/kernel.h> |
28 | #include <linux/spinlock.h> |
29 | #include <linux/kthread.h> |
30 | #include <linux/sched.h> |
31 | #include <linux/slab.h> |
32 | #include <linux/errno.h> |
33 | #include <linux/jiffies.h> |
34 | |
35 | #include <linux/netdevice.h> |
36 | #include <linux/net.h> |
37 | #include <linux/inetdevice.h> |
38 | #include <linux/skbuff.h> |
39 | #include <linux/init.h> |
40 | #include <linux/in.h> |
41 | #include <linux/ip.h> |
42 | #include <linux/udp.h> |
43 | #include <linux/l2tp.h> |
44 | #include <linux/hash.h> |
45 | #include <linux/sort.h> |
46 | #include <linux/file.h> |
47 | #include <linux/nsproxy.h> |
48 | #include <net/net_namespace.h> |
49 | #include <net/netns/generic.h> |
50 | #include <net/dst.h> |
51 | #include <net/ip.h> |
52 | #include <net/udp.h> |
53 | #include <net/inet_common.h> |
54 | #include <net/xfrm.h> |
55 | #include <net/protocol.h> |
56 | |
57 | #include <asm/byteorder.h> |
58 | #include <asm/atomic.h> |
59 | |
60 | #include "l2tp_core.h" |
61 | |
62 | #define L2TP_DRV_VERSION "V2.0" |
63 | |
64 | /* L2TP header constants */ |
65 | #define L2TP_HDRFLAG_T 0x8000 |
66 | #define L2TP_HDRFLAG_L 0x4000 |
67 | #define L2TP_HDRFLAG_S 0x0800 |
68 | #define L2TP_HDRFLAG_O 0x0200 |
69 | #define L2TP_HDRFLAG_P 0x0100 |
70 | |
71 | #define L2TP_HDR_VER_MASK 0x000F |
72 | #define L2TP_HDR_VER_2 0x0002 |
73 | #define L2TP_HDR_VER_3 0x0003 |
74 | |
75 | /* L2TPv3 default L2-specific sublayer */ |
76 | #define L2TP_SLFLAG_S 0x40000000 |
77 | #define L2TP_SL_SEQ_MASK 0x00ffffff |
78 | |
79 | #define L2TP_HDR_SIZE_SEQ 10 |
80 | #define L2TP_HDR_SIZE_NOSEQ 6 |
81 | |
82 | /* Default trace flags */ |
83 | #define L2TP_DEFAULT_DEBUG_FLAGS 0 |
84 | |
85 | #define PRINTK(_mask, _type, _lvl, _fmt, args...) \ |
86 | do { \ |
87 | if ((_mask) & (_type)) \ |
88 | printk(_lvl "L2TP: " _fmt, ##args); \ |
89 | } while (0) |
90 | |
91 | /* Private data stored for received packets in the skb. |
92 | */ |
93 | struct l2tp_skb_cb { |
94 | u32 ns; |
95 | u16 has_seq; |
96 | u16 length; |
97 | unsigned long expires; |
98 | }; |
99 | |
100 | #define L2TP_SKB_CB(skb) ((struct l2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)]) |
101 | |
102 | static atomic_t l2tp_tunnel_count; |
103 | static atomic_t l2tp_session_count; |
104 | |
105 | /* per-net private data for this module */ |
106 | static unsigned int l2tp_net_id; |
107 | struct l2tp_net { |
108 | struct list_head l2tp_tunnel_list; |
109 | spinlock_t l2tp_tunnel_list_lock; |
110 | struct hlist_head l2tp_session_hlist[L2TP_HASH_SIZE_2]; |
111 | spinlock_t l2tp_session_hlist_lock; |
112 | }; |
113 | |
114 | static inline struct l2tp_net *l2tp_pernet(struct net *net) |
115 | { |
116 | BUG_ON(!net); |
117 | |
118 | return net_generic(net, l2tp_net_id); |
119 | } |
120 | |
121 | /* Session hash global list for L2TPv3. |
122 | * The session_id SHOULD be random according to RFC3931, but several |
123 | * L2TP implementations use incrementing session_ids. So we do a real |
124 | * hash on the session_id, rather than a simple bitmask. |
125 | */ |
126 | static inline struct hlist_head * |
127 | l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id) |
128 | { |
129 | return &pn->l2tp_session_hlist[hash_32(session_id, L2TP_HASH_BITS_2)]; |
130 | |
131 | } |
132 | |
133 | /* Lookup a session by id in the global session list |
134 | */ |
135 | static struct l2tp_session *l2tp_session_find_2(struct net *net, u32 session_id) |
136 | { |
137 | struct l2tp_net *pn = l2tp_pernet(net); |
138 | struct hlist_head *session_list = |
139 | l2tp_session_id_hash_2(pn, session_id); |
140 | struct l2tp_session *session; |
141 | struct hlist_node *walk; |
142 | |
143 | rcu_read_lock_bh(); |
144 | hlist_for_each_entry_rcu(session, walk, session_list, global_hlist) { |
145 | if (session->session_id == session_id) { |
146 | rcu_read_unlock_bh(); |
147 | return session; |
148 | } |
149 | } |
150 | rcu_read_unlock_bh(); |
151 | |
152 | return NULL; |
153 | } |
154 | |
155 | /* Session hash list. |
156 | * The session_id SHOULD be random according to RFC2661, but several |
157 | * L2TP implementations (Cisco and Microsoft) use incrementing |
158 | * session_ids. So we do a real hash on the session_id, rather than a |
159 | * simple bitmask. |
160 | */ |
161 | static inline struct hlist_head * |
162 | l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id) |
163 | { |
164 | return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)]; |
165 | } |
166 | |
167 | /* Lookup a session by id |
168 | */ |
169 | struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id) |
170 | { |
171 | struct hlist_head *session_list; |
172 | struct l2tp_session *session; |
173 | struct hlist_node *walk; |
174 | |
175 | /* In L2TPv3, session_ids are unique over all tunnels and we |
176 | * sometimes need to look them up before we know the |
177 | * tunnel. |
178 | */ |
179 | if (tunnel == NULL) |
180 | return l2tp_session_find_2(net, session_id); |
181 | |
182 | session_list = l2tp_session_id_hash(tunnel, session_id); |
183 | read_lock_bh(&tunnel->hlist_lock); |
184 | hlist_for_each_entry(session, walk, session_list, hlist) { |
185 | if (session->session_id == session_id) { |
186 | read_unlock_bh(&tunnel->hlist_lock); |
187 | return session; |
188 | } |
189 | } |
190 | read_unlock_bh(&tunnel->hlist_lock); |
191 | |
192 | return NULL; |
193 | } |
194 | EXPORT_SYMBOL_GPL(l2tp_session_find); |
195 | |
196 | struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth) |
197 | { |
198 | int hash; |
199 | struct hlist_node *walk; |
200 | struct l2tp_session *session; |
201 | int count = 0; |
202 | |
203 | read_lock_bh(&tunnel->hlist_lock); |
204 | for (hash = 0; hash < L2TP_HASH_SIZE; hash++) { |
205 | hlist_for_each_entry(session, walk, &tunnel->session_hlist[hash], hlist) { |
206 | if (++count > nth) { |
207 | read_unlock_bh(&tunnel->hlist_lock); |
208 | return session; |
209 | } |
210 | } |
211 | } |
212 | |
213 | read_unlock_bh(&tunnel->hlist_lock); |
214 | |
215 | return NULL; |
216 | } |
217 | EXPORT_SYMBOL_GPL(l2tp_session_find_nth); |
218 | |
219 | /* Lookup a session by interface name. |
220 | * This is very inefficient but is only used by management interfaces. |
221 | */ |
222 | struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname) |
223 | { |
224 | struct l2tp_net *pn = l2tp_pernet(net); |
225 | int hash; |
226 | struct hlist_node *walk; |
227 | struct l2tp_session *session; |
228 | |
229 | rcu_read_lock_bh(); |
230 | for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) { |
231 | hlist_for_each_entry_rcu(session, walk, &pn->l2tp_session_hlist[hash], global_hlist) { |
232 | if (!strcmp(session->ifname, ifname)) { |
233 | rcu_read_unlock_bh(); |
234 | return session; |
235 | } |
236 | } |
237 | } |
238 | |
239 | rcu_read_unlock_bh(); |
240 | |
241 | return NULL; |
242 | } |
243 | EXPORT_SYMBOL_GPL(l2tp_session_find_by_ifname); |
244 | |
245 | /* Lookup a tunnel by id |
246 | */ |
247 | struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id) |
248 | { |
249 | struct l2tp_tunnel *tunnel; |
250 | struct l2tp_net *pn = l2tp_pernet(net); |
251 | |
252 | rcu_read_lock_bh(); |
253 | list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) { |
254 | if (tunnel->tunnel_id == tunnel_id) { |
255 | rcu_read_unlock_bh(); |
256 | return tunnel; |
257 | } |
258 | } |
259 | rcu_read_unlock_bh(); |
260 | |
261 | return NULL; |
262 | } |
263 | EXPORT_SYMBOL_GPL(l2tp_tunnel_find); |
264 | |
265 | struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth) |
266 | { |
267 | struct l2tp_net *pn = l2tp_pernet(net); |
268 | struct l2tp_tunnel *tunnel; |
269 | int count = 0; |
270 | |
271 | rcu_read_lock_bh(); |
272 | list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) { |
273 | if (++count > nth) { |
274 | rcu_read_unlock_bh(); |
275 | return tunnel; |
276 | } |
277 | } |
278 | |
279 | rcu_read_unlock_bh(); |
280 | |
281 | return NULL; |
282 | } |
283 | EXPORT_SYMBOL_GPL(l2tp_tunnel_find_nth); |
284 | |
285 | /***************************************************************************** |
286 | * Receive data handling |
287 | *****************************************************************************/ |
288 | |
289 | /* Queue a skb in order. We come here only if the skb has an L2TP sequence |
290 | * number. |
291 | */ |
292 | static void l2tp_recv_queue_skb(struct l2tp_session *session, struct sk_buff *skb) |
293 | { |
294 | struct sk_buff *skbp; |
295 | struct sk_buff *tmp; |
296 | u32 ns = L2TP_SKB_CB(skb)->ns; |
297 | |
298 | spin_lock_bh(&session->reorder_q.lock); |
299 | skb_queue_walk_safe(&session->reorder_q, skbp, tmp) { |
300 | if (L2TP_SKB_CB(skbp)->ns > ns) { |
301 | __skb_queue_before(&session->reorder_q, skbp, skb); |
302 | PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG, |
303 | "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n", |
304 | session->name, ns, L2TP_SKB_CB(skbp)->ns, |
305 | skb_queue_len(&session->reorder_q)); |
306 | session->stats.rx_oos_packets++; |
307 | goto out; |
308 | } |
309 | } |
310 | |
311 | __skb_queue_tail(&session->reorder_q, skb); |
312 | |
313 | out: |
314 | spin_unlock_bh(&session->reorder_q.lock); |
315 | } |
316 | |
317 | /* Dequeue a single skb. |
318 | */ |
319 | static void l2tp_recv_dequeue_skb(struct l2tp_session *session, struct sk_buff *skb) |
320 | { |
321 | struct l2tp_tunnel *tunnel = session->tunnel; |
322 | int length = L2TP_SKB_CB(skb)->length; |
323 | |
324 | /* We're about to requeue the skb, so return resources |
325 | * to its current owner (a socket receive buffer). |
326 | */ |
327 | skb_orphan(skb); |
328 | |
329 | tunnel->stats.rx_packets++; |
330 | tunnel->stats.rx_bytes += length; |
331 | session->stats.rx_packets++; |
332 | session->stats.rx_bytes += length; |
333 | |
334 | if (L2TP_SKB_CB(skb)->has_seq) { |
335 | /* Bump our Nr */ |
336 | session->nr++; |
337 | if (tunnel->version == L2TP_HDR_VER_2) |
338 | session->nr &= 0xffff; |
339 | else |
340 | session->nr &= 0xffffff; |
341 | |
342 | PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG, |
343 | "%s: updated nr to %hu\n", session->name, session->nr); |
344 | } |
345 | |
346 | /* call private receive handler */ |
347 | if (session->recv_skb != NULL) |
348 | (*session->recv_skb)(session, skb, L2TP_SKB_CB(skb)->length); |
349 | else |
350 | kfree_skb(skb); |
351 | |
352 | if (session->deref) |
353 | (*session->deref)(session); |
354 | } |
355 | |
356 | /* Dequeue skbs from the session's reorder_q, subject to packet order. |
357 | * Skbs that have been in the queue for too long are simply discarded. |
358 | */ |
359 | static void l2tp_recv_dequeue(struct l2tp_session *session) |
360 | { |
361 | struct sk_buff *skb; |
362 | struct sk_buff *tmp; |
363 | |
364 | /* If the pkt at the head of the queue has the nr that we |
365 | * expect to send up next, dequeue it and any other |
366 | * in-sequence packets behind it. |
367 | */ |
368 | spin_lock_bh(&session->reorder_q.lock); |
369 | skb_queue_walk_safe(&session->reorder_q, skb, tmp) { |
370 | if (time_after(jiffies, L2TP_SKB_CB(skb)->expires)) { |
371 | session->stats.rx_seq_discards++; |
372 | session->stats.rx_errors++; |
373 | PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG, |
374 | "%s: oos pkt %u len %d discarded (too old), " |
375 | "waiting for %u, reorder_q_len=%d\n", |
376 | session->name, L2TP_SKB_CB(skb)->ns, |
377 | L2TP_SKB_CB(skb)->length, session->nr, |
378 | skb_queue_len(&session->reorder_q)); |
379 | __skb_unlink(skb, &session->reorder_q); |
380 | kfree_skb(skb); |
381 | if (session->deref) |
382 | (*session->deref)(session); |
383 | continue; |
384 | } |
385 | |
386 | if (L2TP_SKB_CB(skb)->has_seq) { |
387 | if (L2TP_SKB_CB(skb)->ns != session->nr) { |
388 | PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG, |
389 | "%s: holding oos pkt %u len %d, " |
390 | "waiting for %u, reorder_q_len=%d\n", |
391 | session->name, L2TP_SKB_CB(skb)->ns, |
392 | L2TP_SKB_CB(skb)->length, session->nr, |
393 | skb_queue_len(&session->reorder_q)); |
394 | goto out; |
395 | } |
396 | } |
397 | __skb_unlink(skb, &session->reorder_q); |
398 | |
399 | /* Process the skb. We release the queue lock while we |
400 | * do so to let other contexts process the queue. |
401 | */ |
402 | spin_unlock_bh(&session->reorder_q.lock); |
403 | l2tp_recv_dequeue_skb(session, skb); |
404 | spin_lock_bh(&session->reorder_q.lock); |
405 | } |
406 | |
407 | out: |
408 | spin_unlock_bh(&session->reorder_q.lock); |
409 | } |
410 | |
411 | static inline int l2tp_verify_udp_checksum(struct sock *sk, |
412 | struct sk_buff *skb) |
413 | { |
414 | struct udphdr *uh = udp_hdr(skb); |
415 | u16 ulen = ntohs(uh->len); |
416 | struct inet_sock *inet; |
417 | __wsum psum; |
418 | |
419 | if (sk->sk_no_check || skb_csum_unnecessary(skb) || !uh->check) |
420 | return 0; |
421 | |
422 | inet = inet_sk(sk); |
423 | psum = csum_tcpudp_nofold(inet->inet_saddr, inet->inet_daddr, ulen, |
424 | IPPROTO_UDP, 0); |
425 | |
426 | if ((skb->ip_summed == CHECKSUM_COMPLETE) && |
427 | !csum_fold(csum_add(psum, skb->csum))) |
428 | return 0; |
429 | |
430 | skb->csum = psum; |
431 | |
432 | return __skb_checksum_complete(skb); |
433 | } |
434 | |
435 | /* Do receive processing of L2TP data frames. We handle both L2TPv2 |
436 | * and L2TPv3 data frames here. |
437 | * |
438 | * L2TPv2 Data Message Header |
439 | * |
440 | * 0 1 2 3 |
441 | * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
442 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
443 | * |T|L|x|x|S|x|O|P|x|x|x|x| Ver | Length (opt) | |
444 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
445 | * | Tunnel ID | Session ID | |
446 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
447 | * | Ns (opt) | Nr (opt) | |
448 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
449 | * | Offset Size (opt) | Offset pad... (opt) |
450 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
451 | * |
452 | * Data frames are marked by T=0. All other fields are the same as |
453 | * those in L2TP control frames. |
454 | * |
455 | * L2TPv3 Data Message Header |
456 | * |
457 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
458 | * | L2TP Session Header | |
459 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
460 | * | L2-Specific Sublayer | |
461 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
462 | * | Tunnel Payload ... |
463 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
464 | * |
465 | * L2TPv3 Session Header Over IP |
466 | * |
467 | * 0 1 2 3 |
468 | * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
469 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
470 | * | Session ID | |
471 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
472 | * | Cookie (optional, maximum 64 bits)... |
473 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
474 | * | |
475 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
476 | * |
477 | * L2TPv3 L2-Specific Sublayer Format |
478 | * |
479 | * 0 1 2 3 |
480 | * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
481 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
482 | * |x|S|x|x|x|x|x|x| Sequence Number | |
483 | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
484 | * |
485 | * Cookie value, sublayer format and offset (pad) are negotiated with |
486 | * the peer when the session is set up. Unlike L2TPv2, we do not need |
487 | * to parse the packet header to determine if optional fields are |
488 | * present. |
489 | * |
490 | * Caller must already have parsed the frame and determined that it is |
491 | * a data (not control) frame before coming here. Fields up to the |
492 | * session-id have already been parsed and ptr points to the data |
493 | * after the session-id. |
494 | */ |
495 | void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb, |
496 | unsigned char *ptr, unsigned char *optr, u16 hdrflags, |
497 | int length, int (*payload_hook)(struct sk_buff *skb)) |
498 | { |
499 | struct l2tp_tunnel *tunnel = session->tunnel; |
500 | int offset; |
501 | u32 ns, nr; |
502 | |
503 | /* The ref count is increased since we now hold a pointer to |
504 | * the session. Take care to decrement the refcnt when exiting |
505 | * this function from now on... |
506 | */ |
507 | l2tp_session_inc_refcount(session); |
508 | if (session->ref) |
509 | (*session->ref)(session); |
510 | |
511 | /* Parse and check optional cookie */ |
512 | if (session->peer_cookie_len > 0) { |
513 | if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) { |
514 | PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO, |
515 | "%s: cookie mismatch (%u/%u). Discarding.\n", |
516 | tunnel->name, tunnel->tunnel_id, session->session_id); |
517 | session->stats.rx_cookie_discards++; |
518 | goto discard; |
519 | } |
520 | ptr += session->peer_cookie_len; |
521 | } |
522 | |
523 | /* Handle the optional sequence numbers. Sequence numbers are |
524 | * in different places for L2TPv2 and L2TPv3. |
525 | * |
526 | * If we are the LAC, enable/disable sequence numbers under |
527 | * the control of the LNS. If no sequence numbers present but |
528 | * we were expecting them, discard frame. |
529 | */ |
530 | ns = nr = 0; |
531 | L2TP_SKB_CB(skb)->has_seq = 0; |
532 | if (tunnel->version == L2TP_HDR_VER_2) { |
533 | if (hdrflags & L2TP_HDRFLAG_S) { |
534 | ns = ntohs(*(__be16 *) ptr); |
535 | ptr += 2; |
536 | nr = ntohs(*(__be16 *) ptr); |
537 | ptr += 2; |
538 | |
539 | /* Store L2TP info in the skb */ |
540 | L2TP_SKB_CB(skb)->ns = ns; |
541 | L2TP_SKB_CB(skb)->has_seq = 1; |
542 | |
543 | PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG, |
544 | "%s: recv data ns=%u, nr=%u, session nr=%u\n", |
545 | session->name, ns, nr, session->nr); |
546 | } |
547 | } else if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) { |
548 | u32 l2h = ntohl(*(__be32 *) ptr); |
549 | |
550 | if (l2h & 0x40000000) { |
551 | ns = l2h & 0x00ffffff; |
552 | |
553 | /* Store L2TP info in the skb */ |
554 | L2TP_SKB_CB(skb)->ns = ns; |
555 | L2TP_SKB_CB(skb)->has_seq = 1; |
556 | |
557 | PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG, |
558 | "%s: recv data ns=%u, session nr=%u\n", |
559 | session->name, ns, session->nr); |
560 | } |
561 | } |
562 | |
563 | /* Advance past L2-specific header, if present */ |
564 | ptr += session->l2specific_len; |
565 | |
566 | if (L2TP_SKB_CB(skb)->has_seq) { |
567 | /* Received a packet with sequence numbers. If we're the LNS, |
568 | * check if we sre sending sequence numbers and if not, |
569 | * configure it so. |
570 | */ |
571 | if ((!session->lns_mode) && (!session->send_seq)) { |
572 | PRINTK(session->debug, L2TP_MSG_SEQ, KERN_INFO, |
573 | "%s: requested to enable seq numbers by LNS\n", |
574 | session->name); |
575 | session->send_seq = -1; |
576 | l2tp_session_set_header_len(session, tunnel->version); |
577 | } |
578 | } else { |
579 | /* No sequence numbers. |
580 | * If user has configured mandatory sequence numbers, discard. |
581 | */ |
582 | if (session->recv_seq) { |
583 | PRINTK(session->debug, L2TP_MSG_SEQ, KERN_WARNING, |
584 | "%s: recv data has no seq numbers when required. " |
585 | "Discarding\n", session->name); |
586 | session->stats.rx_seq_discards++; |
587 | goto discard; |
588 | } |
589 | |
590 | /* If we're the LAC and we're sending sequence numbers, the |
591 | * LNS has requested that we no longer send sequence numbers. |
592 | * If we're the LNS and we're sending sequence numbers, the |
593 | * LAC is broken. Discard the frame. |
594 | */ |
595 | if ((!session->lns_mode) && (session->send_seq)) { |
596 | PRINTK(session->debug, L2TP_MSG_SEQ, KERN_INFO, |
597 | "%s: requested to disable seq numbers by LNS\n", |
598 | session->name); |
599 | session->send_seq = 0; |
600 | l2tp_session_set_header_len(session, tunnel->version); |
601 | } else if (session->send_seq) { |
602 | PRINTK(session->debug, L2TP_MSG_SEQ, KERN_WARNING, |
603 | "%s: recv data has no seq numbers when required. " |
604 | "Discarding\n", session->name); |
605 | session->stats.rx_seq_discards++; |
606 | goto discard; |
607 | } |
608 | } |
609 | |
610 | /* Session data offset is handled differently for L2TPv2 and |
611 | * L2TPv3. For L2TPv2, there is an optional 16-bit value in |
612 | * the header. For L2TPv3, the offset is negotiated using AVPs |
613 | * in the session setup control protocol. |
614 | */ |
615 | if (tunnel->version == L2TP_HDR_VER_2) { |
616 | /* If offset bit set, skip it. */ |
617 | if (hdrflags & L2TP_HDRFLAG_O) { |
618 | offset = ntohs(*(__be16 *)ptr); |
619 | ptr += 2 + offset; |
620 | } |
621 | } else |
622 | ptr += session->offset; |
623 | |
624 | offset = ptr - optr; |
625 | if (!pskb_may_pull(skb, offset)) |
626 | goto discard; |
627 | |
628 | __skb_pull(skb, offset); |
629 | |
630 | /* If caller wants to process the payload before we queue the |
631 | * packet, do so now. |
632 | */ |
633 | if (payload_hook) |
634 | if ((*payload_hook)(skb)) |
635 | goto discard; |
636 | |
637 | /* Prepare skb for adding to the session's reorder_q. Hold |
638 | * packets for max reorder_timeout or 1 second if not |
639 | * reordering. |
640 | */ |
641 | L2TP_SKB_CB(skb)->length = length; |
642 | L2TP_SKB_CB(skb)->expires = jiffies + |
643 | (session->reorder_timeout ? session->reorder_timeout : HZ); |
644 | |
645 | /* Add packet to the session's receive queue. Reordering is done here, if |
646 | * enabled. Saved L2TP protocol info is stored in skb->sb[]. |
647 | */ |
648 | if (L2TP_SKB_CB(skb)->has_seq) { |
649 | if (session->reorder_timeout != 0) { |
650 | /* Packet reordering enabled. Add skb to session's |
651 | * reorder queue, in order of ns. |
652 | */ |
653 | l2tp_recv_queue_skb(session, skb); |
654 | } else { |
655 | /* Packet reordering disabled. Discard out-of-sequence |
656 | * packets |
657 | */ |
658 | if (L2TP_SKB_CB(skb)->ns != session->nr) { |
659 | session->stats.rx_seq_discards++; |
660 | PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG, |
661 | "%s: oos pkt %u len %d discarded, " |
662 | "waiting for %u, reorder_q_len=%d\n", |
663 | session->name, L2TP_SKB_CB(skb)->ns, |
664 | L2TP_SKB_CB(skb)->length, session->nr, |
665 | skb_queue_len(&session->reorder_q)); |
666 | goto discard; |
667 | } |
668 | skb_queue_tail(&session->reorder_q, skb); |
669 | } |
670 | } else { |
671 | /* No sequence numbers. Add the skb to the tail of the |
672 | * reorder queue. This ensures that it will be |
673 | * delivered after all previous sequenced skbs. |
674 | */ |
675 | skb_queue_tail(&session->reorder_q, skb); |
676 | } |
677 | |
678 | /* Try to dequeue as many skbs from reorder_q as we can. */ |
679 | l2tp_recv_dequeue(session); |
680 | |
681 | l2tp_session_dec_refcount(session); |
682 | |
683 | return; |
684 | |
685 | discard: |
686 | session->stats.rx_errors++; |
687 | kfree_skb(skb); |
688 | |
689 | if (session->deref) |
690 | (*session->deref)(session); |
691 | |
692 | l2tp_session_dec_refcount(session); |
693 | } |
694 | EXPORT_SYMBOL(l2tp_recv_common); |
695 | |
696 | /* Internal UDP receive frame. Do the real work of receiving an L2TP data frame |
697 | * here. The skb is not on a list when we get here. |
698 | * Returns 0 if the packet was a data packet and was successfully passed on. |
699 | * Returns 1 if the packet was not a good data packet and could not be |
700 | * forwarded. All such packets are passed up to userspace to deal with. |
701 | */ |
702 | int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb, |
703 | int (*payload_hook)(struct sk_buff *skb)) |
704 | { |
705 | struct l2tp_session *session = NULL; |
706 | unsigned char *ptr, *optr; |
707 | u16 hdrflags; |
708 | u32 tunnel_id, session_id; |
709 | int offset; |
710 | u16 version; |
711 | int length; |
712 | |
713 | if (tunnel->sock && l2tp_verify_udp_checksum(tunnel->sock, skb)) |
714 | goto discard_bad_csum; |
715 | |
716 | /* UDP always verifies the packet length. */ |
717 | __skb_pull(skb, sizeof(struct udphdr)); |
718 | |
719 | /* Short packet? */ |
720 | if (!pskb_may_pull(skb, L2TP_HDR_SIZE_SEQ)) { |
721 | PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO, |
722 | "%s: recv short packet (len=%d)\n", tunnel->name, skb->len); |
723 | goto error; |
724 | } |
725 | |
726 | /* Point to L2TP header */ |
727 | optr = ptr = skb->data; |
728 | |
729 | /* Trace packet contents, if enabled */ |
730 | if (tunnel->debug & L2TP_MSG_DATA) { |
731 | length = min(32u, skb->len); |
732 | if (!pskb_may_pull(skb, length)) |
733 | goto error; |
734 | |
735 | printk(KERN_DEBUG "%s: recv: ", tunnel->name); |
736 | |
737 | offset = 0; |
738 | do { |
739 | printk(" %02X", ptr[offset]); |
740 | } while (++offset < length); |
741 | |
742 | printk("\n"); |
743 | } |
744 | |
745 | /* Get L2TP header flags */ |
746 | hdrflags = ntohs(*(__be16 *) ptr); |
747 | |
748 | /* Check protocol version */ |
749 | version = hdrflags & L2TP_HDR_VER_MASK; |
750 | if (version != tunnel->version) { |
751 | PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO, |
752 | "%s: recv protocol version mismatch: got %d expected %d\n", |
753 | tunnel->name, version, tunnel->version); |
754 | goto error; |
755 | } |
756 | |
757 | /* Get length of L2TP packet */ |
758 | length = skb->len; |
759 | |
760 | /* If type is control packet, it is handled by userspace. */ |
761 | if (hdrflags & L2TP_HDRFLAG_T) { |
762 | PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_DEBUG, |
763 | "%s: recv control packet, len=%d\n", tunnel->name, length); |
764 | goto error; |
765 | } |
766 | |
767 | /* Skip flags */ |
768 | ptr += 2; |
769 | |
770 | if (tunnel->version == L2TP_HDR_VER_2) { |
771 | /* If length is present, skip it */ |
772 | if (hdrflags & L2TP_HDRFLAG_L) |
773 | ptr += 2; |
774 | |
775 | /* Extract tunnel and session ID */ |
776 | tunnel_id = ntohs(*(__be16 *) ptr); |
777 | ptr += 2; |
778 | session_id = ntohs(*(__be16 *) ptr); |
779 | ptr += 2; |
780 | } else { |
781 | ptr += 2; /* skip reserved bits */ |
782 | tunnel_id = tunnel->tunnel_id; |
783 | session_id = ntohl(*(__be32 *) ptr); |
784 | ptr += 4; |
785 | } |
786 | |
787 | /* Find the session context */ |
788 | session = l2tp_session_find(tunnel->l2tp_net, tunnel, session_id); |
789 | if (!session || !session->recv_skb) { |
790 | /* Not found? Pass to userspace to deal with */ |
791 | PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_INFO, |
792 | "%s: no session found (%u/%u). Passing up.\n", |
793 | tunnel->name, tunnel_id, session_id); |
794 | goto error; |
795 | } |
796 | |
797 | l2tp_recv_common(session, skb, ptr, optr, hdrflags, length, payload_hook); |
798 | |
799 | return 0; |
800 | |
801 | discard_bad_csum: |
802 | LIMIT_NETDEBUG("%s: UDP: bad checksum\n", tunnel->name); |
803 | UDP_INC_STATS_USER(tunnel->l2tp_net, UDP_MIB_INERRORS, 0); |
804 | tunnel->stats.rx_errors++; |
805 | kfree_skb(skb); |
806 | |
807 | return 0; |
808 | |
809 | error: |
810 | /* Put UDP header back */ |
811 | __skb_push(skb, sizeof(struct udphdr)); |
812 | |
813 | return 1; |
814 | } |
815 | EXPORT_SYMBOL_GPL(l2tp_udp_recv_core); |
816 | |
817 | /* UDP encapsulation receive handler. See net/ipv4/udp.c. |
818 | * Return codes: |
819 | * 0 : success. |
820 | * <0: error |
821 | * >0: skb should be passed up to userspace as UDP. |
822 | */ |
823 | int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb) |
824 | { |
825 | struct l2tp_tunnel *tunnel; |
826 | |
827 | tunnel = l2tp_sock_to_tunnel(sk); |
828 | if (tunnel == NULL) |
829 | goto pass_up; |
830 | |
831 | PRINTK(tunnel->debug, L2TP_MSG_DATA, KERN_DEBUG, |
832 | "%s: received %d bytes\n", tunnel->name, skb->len); |
833 | |
834 | if (l2tp_udp_recv_core(tunnel, skb, tunnel->recv_payload_hook)) |
835 | goto pass_up_put; |
836 | |
837 | sock_put(sk); |
838 | return 0; |
839 | |
840 | pass_up_put: |
841 | sock_put(sk); |
842 | pass_up: |
843 | return 1; |
844 | } |
845 | EXPORT_SYMBOL_GPL(l2tp_udp_encap_recv); |
846 | |
847 | /************************************************************************ |
848 | * Transmit handling |
849 | ***********************************************************************/ |
850 | |
851 | /* Build an L2TP header for the session into the buffer provided. |
852 | */ |
853 | static int l2tp_build_l2tpv2_header(struct l2tp_session *session, void *buf) |
854 | { |
855 | struct l2tp_tunnel *tunnel = session->tunnel; |
856 | __be16 *bufp = buf; |
857 | __be16 *optr = buf; |
858 | u16 flags = L2TP_HDR_VER_2; |
859 | u32 tunnel_id = tunnel->peer_tunnel_id; |
860 | u32 session_id = session->peer_session_id; |
861 | |
862 | if (session->send_seq) |
863 | flags |= L2TP_HDRFLAG_S; |
864 | |
865 | /* Setup L2TP header. */ |
866 | *bufp++ = htons(flags); |
867 | *bufp++ = htons(tunnel_id); |
868 | *bufp++ = htons(session_id); |
869 | if (session->send_seq) { |
870 | *bufp++ = htons(session->ns); |
871 | *bufp++ = 0; |
872 | session->ns++; |
873 | session->ns &= 0xffff; |
874 | PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG, |
875 | "%s: updated ns to %u\n", session->name, session->ns); |
876 | } |
877 | |
878 | return bufp - optr; |
879 | } |
880 | |
881 | static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf) |
882 | { |
883 | struct l2tp_tunnel *tunnel = session->tunnel; |
884 | char *bufp = buf; |
885 | char *optr = bufp; |
886 | |
887 | /* Setup L2TP header. The header differs slightly for UDP and |
888 | * IP encapsulations. For UDP, there is 4 bytes of flags. |
889 | */ |
890 | if (tunnel->encap == L2TP_ENCAPTYPE_UDP) { |
891 | u16 flags = L2TP_HDR_VER_3; |
892 | *((__be16 *) bufp) = htons(flags); |
893 | bufp += 2; |
894 | *((__be16 *) bufp) = 0; |
895 | bufp += 2; |
896 | } |
897 | |
898 | *((__be32 *) bufp) = htonl(session->peer_session_id); |
899 | bufp += 4; |
900 | if (session->cookie_len) { |
901 | memcpy(bufp, &session->cookie[0], session->cookie_len); |
902 | bufp += session->cookie_len; |
903 | } |
904 | if (session->l2specific_len) { |
905 | if (session->l2specific_type == L2TP_L2SPECTYPE_DEFAULT) { |
906 | u32 l2h = 0; |
907 | if (session->send_seq) { |
908 | l2h = 0x40000000 | session->ns; |
909 | session->ns++; |
910 | session->ns &= 0xffffff; |
911 | PRINTK(session->debug, L2TP_MSG_SEQ, KERN_DEBUG, |
912 | "%s: updated ns to %u\n", session->name, session->ns); |
913 | } |
914 | |
915 | *((__be32 *) bufp) = htonl(l2h); |
916 | } |
917 | bufp += session->l2specific_len; |
918 | } |
919 | if (session->offset) |
920 | bufp += session->offset; |
921 | |
922 | return bufp - optr; |
923 | } |
924 | |
925 | int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, size_t data_len) |
926 | { |
927 | struct l2tp_tunnel *tunnel = session->tunnel; |
928 | unsigned int len = skb->len; |
929 | int error; |
930 | |
931 | /* Debug */ |
932 | if (session->send_seq) |
933 | PRINTK(session->debug, L2TP_MSG_DATA, KERN_DEBUG, |
934 | "%s: send %Zd bytes, ns=%u\n", session->name, |
935 | data_len, session->ns - 1); |
936 | else |
937 | PRINTK(session->debug, L2TP_MSG_DATA, KERN_DEBUG, |
938 | "%s: send %Zd bytes\n", session->name, data_len); |
939 | |
940 | if (session->debug & L2TP_MSG_DATA) { |
941 | int i; |
942 | int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; |
943 | unsigned char *datap = skb->data + uhlen; |
944 | |
945 | printk(KERN_DEBUG "%s: xmit:", session->name); |
946 | for (i = 0; i < (len - uhlen); i++) { |
947 | printk(" %02X", *datap++); |
948 | if (i == 31) { |
949 | printk(" ..."); |
950 | break; |
951 | } |
952 | } |
953 | printk("\n"); |
954 | } |
955 | |
956 | /* Queue the packet to IP for output */ |
957 | skb->local_df = 1; |
958 | error = ip_queue_xmit(skb); |
959 | |
960 | /* Update stats */ |
961 | if (error >= 0) { |
962 | tunnel->stats.tx_packets++; |
963 | tunnel->stats.tx_bytes += len; |
964 | session->stats.tx_packets++; |
965 | session->stats.tx_bytes += len; |
966 | } else { |
967 | tunnel->stats.tx_errors++; |
968 | session->stats.tx_errors++; |
969 | } |
970 | |
971 | return 0; |
972 | } |
973 | EXPORT_SYMBOL_GPL(l2tp_xmit_core); |
974 | |
975 | /* Automatically called when the skb is freed. |
976 | */ |
977 | static void l2tp_sock_wfree(struct sk_buff *skb) |
978 | { |
979 | sock_put(skb->sk); |
980 | } |
981 | |
982 | /* For data skbs that we transmit, we associate with the tunnel socket |
983 | * but don't do accounting. |
984 | */ |
985 | static inline void l2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk) |
986 | { |
987 | sock_hold(sk); |
988 | skb->sk = sk; |
989 | skb->destructor = l2tp_sock_wfree; |
990 | } |
991 | |
992 | /* If caller requires the skb to have a ppp header, the header must be |
993 | * inserted in the skb data before calling this function. |
994 | */ |
995 | int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len) |
996 | { |
997 | int data_len = skb->len; |
998 | struct l2tp_tunnel *tunnel = session->tunnel; |
999 | struct sock *sk = tunnel->sock; |
1000 | struct udphdr *uh; |
1001 | struct inet_sock *inet; |
1002 | __wsum csum; |
1003 | int old_headroom; |
1004 | int new_headroom; |
1005 | int headroom; |
1006 | int uhlen = (tunnel->encap == L2TP_ENCAPTYPE_UDP) ? sizeof(struct udphdr) : 0; |
1007 | int udp_len; |
1008 | |
1009 | /* Check that there's enough headroom in the skb to insert IP, |
1010 | * UDP and L2TP headers. If not enough, expand it to |
1011 | * make room. Adjust truesize. |
1012 | */ |
1013 | headroom = NET_SKB_PAD + sizeof(struct iphdr) + |
1014 | uhlen + hdr_len; |
1015 | old_headroom = skb_headroom(skb); |
1016 | if (skb_cow_head(skb, headroom)) |
1017 | goto abort; |
1018 | |
1019 | new_headroom = skb_headroom(skb); |
1020 | skb_orphan(skb); |
1021 | skb->truesize += new_headroom - old_headroom; |
1022 | |
1023 | /* Setup L2TP header */ |
1024 | session->build_header(session, __skb_push(skb, hdr_len)); |
1025 | |
1026 | /* Reset skb netfilter state */ |
1027 | memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt)); |
1028 | IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED | |
1029 | IPSKB_REROUTED); |
1030 | nf_reset(skb); |
1031 | |
1032 | /* Get routing info from the tunnel socket */ |
1033 | skb_dst_drop(skb); |
1034 | skb_dst_set(skb, dst_clone(__sk_dst_get(sk))); |
1035 | |
1036 | switch (tunnel->encap) { |
1037 | case L2TP_ENCAPTYPE_UDP: |
1038 | /* Setup UDP header */ |
1039 | inet = inet_sk(sk); |
1040 | __skb_push(skb, sizeof(*uh)); |
1041 | skb_reset_transport_header(skb); |
1042 | uh = udp_hdr(skb); |
1043 | uh->source = inet->inet_sport; |
1044 | uh->dest = inet->inet_dport; |
1045 | udp_len = uhlen + hdr_len + data_len; |
1046 | uh->len = htons(udp_len); |
1047 | uh->check = 0; |
1048 | |
1049 | /* Calculate UDP checksum if configured to do so */ |
1050 | if (sk->sk_no_check == UDP_CSUM_NOXMIT) |
1051 | skb->ip_summed = CHECKSUM_NONE; |
1052 | else if ((skb_dst(skb) && skb_dst(skb)->dev) && |
1053 | (!(skb_dst(skb)->dev->features & NETIF_F_V4_CSUM))) { |
1054 | skb->ip_summed = CHECKSUM_COMPLETE; |
1055 | csum = skb_checksum(skb, 0, udp_len, 0); |
1056 | uh->check = csum_tcpudp_magic(inet->inet_saddr, |
1057 | inet->inet_daddr, |
1058 | udp_len, IPPROTO_UDP, csum); |
1059 | if (uh->check == 0) |
1060 | uh->check = CSUM_MANGLED_0; |
1061 | } else { |
1062 | skb->ip_summed = CHECKSUM_PARTIAL; |
1063 | skb->csum_start = skb_transport_header(skb) - skb->head; |
1064 | skb->csum_offset = offsetof(struct udphdr, check); |
1065 | uh->check = ~csum_tcpudp_magic(inet->inet_saddr, |
1066 | inet->inet_daddr, |
1067 | udp_len, IPPROTO_UDP, 0); |
1068 | } |
1069 | break; |
1070 | |
1071 | case L2TP_ENCAPTYPE_IP: |
1072 | break; |
1073 | } |
1074 | |
1075 | l2tp_skb_set_owner_w(skb, sk); |
1076 | |
1077 | l2tp_xmit_core(session, skb, data_len); |
1078 | |
1079 | abort: |
1080 | return 0; |
1081 | } |
1082 | EXPORT_SYMBOL_GPL(l2tp_xmit_skb); |
1083 | |
1084 | /***************************************************************************** |
1085 | * Tinnel and session create/destroy. |
1086 | *****************************************************************************/ |
1087 | |
1088 | /* Tunnel socket destruct hook. |
1089 | * The tunnel context is deleted only when all session sockets have been |
1090 | * closed. |
1091 | */ |
1092 | void l2tp_tunnel_destruct(struct sock *sk) |
1093 | { |
1094 | struct l2tp_tunnel *tunnel; |
1095 | |
1096 | tunnel = sk->sk_user_data; |
1097 | if (tunnel == NULL) |
1098 | goto end; |
1099 | |
1100 | PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO, |
1101 | "%s: closing...\n", tunnel->name); |
1102 | |
1103 | /* Close all sessions */ |
1104 | l2tp_tunnel_closeall(tunnel); |
1105 | |
1106 | switch (tunnel->encap) { |
1107 | case L2TP_ENCAPTYPE_UDP: |
1108 | /* No longer an encapsulation socket. See net/ipv4/udp.c */ |
1109 | (udp_sk(sk))->encap_type = 0; |
1110 | (udp_sk(sk))->encap_rcv = NULL; |
1111 | break; |
1112 | case L2TP_ENCAPTYPE_IP: |
1113 | break; |
1114 | } |
1115 | |
1116 | /* Remove hooks into tunnel socket */ |
1117 | tunnel->sock = NULL; |
1118 | sk->sk_destruct = tunnel->old_sk_destruct; |
1119 | sk->sk_user_data = NULL; |
1120 | |
1121 | /* Call the original destructor */ |
1122 | if (sk->sk_destruct) |
1123 | (*sk->sk_destruct)(sk); |
1124 | |
1125 | /* We're finished with the socket */ |
1126 | l2tp_tunnel_dec_refcount(tunnel); |
1127 | |
1128 | end: |
1129 | return; |
1130 | } |
1131 | EXPORT_SYMBOL(l2tp_tunnel_destruct); |
1132 | |
1133 | /* When the tunnel is closed, all the attached sessions need to go too. |
1134 | */ |
1135 | void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel) |
1136 | { |
1137 | int hash; |
1138 | struct hlist_node *walk; |
1139 | struct hlist_node *tmp; |
1140 | struct l2tp_session *session; |
1141 | |
1142 | BUG_ON(tunnel == NULL); |
1143 | |
1144 | PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO, |
1145 | "%s: closing all sessions...\n", tunnel->name); |
1146 | |
1147 | write_lock_bh(&tunnel->hlist_lock); |
1148 | for (hash = 0; hash < L2TP_HASH_SIZE; hash++) { |
1149 | again: |
1150 | hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) { |
1151 | session = hlist_entry(walk, struct l2tp_session, hlist); |
1152 | |
1153 | PRINTK(session->debug, L2TP_MSG_CONTROL, KERN_INFO, |
1154 | "%s: closing session\n", session->name); |
1155 | |
1156 | hlist_del_init(&session->hlist); |
1157 | |
1158 | /* Since we should hold the sock lock while |
1159 | * doing any unbinding, we need to release the |
1160 | * lock we're holding before taking that lock. |
1161 | * Hold a reference to the sock so it doesn't |
1162 | * disappear as we're jumping between locks. |
1163 | */ |
1164 | if (session->ref != NULL) |
1165 | (*session->ref)(session); |
1166 | |
1167 | write_unlock_bh(&tunnel->hlist_lock); |
1168 | |
1169 | if (tunnel->version != L2TP_HDR_VER_2) { |
1170 | struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net); |
1171 | |
1172 | spin_lock_bh(&pn->l2tp_session_hlist_lock); |
1173 | hlist_del_init_rcu(&session->global_hlist); |
1174 | spin_unlock_bh(&pn->l2tp_session_hlist_lock); |
1175 | synchronize_rcu(); |
1176 | } |
1177 | |
1178 | if (session->session_close != NULL) |
1179 | (*session->session_close)(session); |
1180 | |
1181 | if (session->deref != NULL) |
1182 | (*session->deref)(session); |
1183 | |
1184 | write_lock_bh(&tunnel->hlist_lock); |
1185 | |
1186 | /* Now restart from the beginning of this hash |
1187 | * chain. We always remove a session from the |
1188 | * list so we are guaranteed to make forward |
1189 | * progress. |
1190 | */ |
1191 | goto again; |
1192 | } |
1193 | } |
1194 | write_unlock_bh(&tunnel->hlist_lock); |
1195 | } |
1196 | EXPORT_SYMBOL_GPL(l2tp_tunnel_closeall); |
1197 | |
1198 | /* Really kill the tunnel. |
1199 | * Come here only when all sessions have been cleared from the tunnel. |
1200 | */ |
1201 | void l2tp_tunnel_free(struct l2tp_tunnel *tunnel) |
1202 | { |
1203 | struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net); |
1204 | |
1205 | BUG_ON(atomic_read(&tunnel->ref_count) != 0); |
1206 | BUG_ON(tunnel->sock != NULL); |
1207 | |
1208 | PRINTK(tunnel->debug, L2TP_MSG_CONTROL, KERN_INFO, |
1209 | "%s: free...\n", tunnel->name); |
1210 | |
1211 | /* Remove from tunnel list */ |
1212 | spin_lock_bh(&pn->l2tp_tunnel_list_lock); |
1213 | list_del_rcu(&tunnel->list); |
1214 | spin_unlock_bh(&pn->l2tp_tunnel_list_lock); |
1215 | synchronize_rcu(); |
1216 | |
1217 | atomic_dec(&l2tp_tunnel_count); |
1218 | kfree(tunnel); |
1219 | } |
1220 | EXPORT_SYMBOL_GPL(l2tp_tunnel_free); |
1221 | |
1222 | /* Create a socket for the tunnel, if one isn't set up by |
1223 | * userspace. This is used for static tunnels where there is no |
1224 | * managing L2TP daemon. |
1225 | */ |
1226 | static int l2tp_tunnel_sock_create(u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct socket **sockp) |
1227 | { |
1228 | int err = -EINVAL; |
1229 | struct sockaddr_in udp_addr; |
1230 | struct sockaddr_l2tpip ip_addr; |
1231 | struct socket *sock = NULL; |
1232 | |
1233 | switch (cfg->encap) { |
1234 | case L2TP_ENCAPTYPE_UDP: |
1235 | err = sock_create(AF_INET, SOCK_DGRAM, 0, sockp); |
1236 | if (err < 0) |
1237 | goto out; |
1238 | |
1239 | sock = *sockp; |
1240 | |
1241 | memset(&udp_addr, 0, sizeof(udp_addr)); |
1242 | udp_addr.sin_family = AF_INET; |
1243 | udp_addr.sin_addr = cfg->local_ip; |
1244 | udp_addr.sin_port = htons(cfg->local_udp_port); |
1245 | err = kernel_bind(sock, (struct sockaddr *) &udp_addr, sizeof(udp_addr)); |
1246 | if (err < 0) |
1247 | goto out; |
1248 | |
1249 | udp_addr.sin_family = AF_INET; |
1250 | udp_addr.sin_addr = cfg->peer_ip; |
1251 | udp_addr.sin_port = htons(cfg->peer_udp_port); |
1252 | err = kernel_connect(sock, (struct sockaddr *) &udp_addr, sizeof(udp_addr), 0); |
1253 | if (err < 0) |
1254 | goto out; |
1255 | |
1256 | if (!cfg->use_udp_checksums) |
1257 | sock->sk->sk_no_check = UDP_CSUM_NOXMIT; |
1258 | |
1259 | break; |
1260 | |
1261 | case L2TP_ENCAPTYPE_IP: |
1262 | err = sock_create(AF_INET, SOCK_DGRAM, IPPROTO_L2TP, sockp); |
1263 | if (err < 0) |
1264 | goto out; |
1265 | |
1266 | sock = *sockp; |
1267 | |
1268 | memset(&ip_addr, 0, sizeof(ip_addr)); |
1269 | ip_addr.l2tp_family = AF_INET; |
1270 | ip_addr.l2tp_addr = cfg->local_ip; |
1271 | ip_addr.l2tp_conn_id = tunnel_id; |
1272 | err = kernel_bind(sock, (struct sockaddr *) &ip_addr, sizeof(ip_addr)); |
1273 | if (err < 0) |
1274 | goto out; |
1275 | |
1276 | ip_addr.l2tp_family = AF_INET; |
1277 | ip_addr.l2tp_addr = cfg->peer_ip; |
1278 | ip_addr.l2tp_conn_id = peer_tunnel_id; |
1279 | err = kernel_connect(sock, (struct sockaddr *) &ip_addr, sizeof(ip_addr), 0); |
1280 | if (err < 0) |
1281 | goto out; |
1282 | |
1283 | break; |
1284 | |
1285 | default: |
1286 | goto out; |
1287 | } |
1288 | |
1289 | out: |
1290 | if ((err < 0) && sock) { |
1291 | sock_release(sock); |
1292 | *sockp = NULL; |
1293 | } |
1294 | |
1295 | return err; |
1296 | } |
1297 | |
1298 | int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp) |
1299 | { |
1300 | struct l2tp_tunnel *tunnel = NULL; |
1301 | int err; |
1302 | struct socket *sock = NULL; |
1303 | struct sock *sk = NULL; |
1304 | struct l2tp_net *pn; |
1305 | enum l2tp_encap_type encap = L2TP_ENCAPTYPE_UDP; |
1306 | |
1307 | /* Get the tunnel socket from the fd, which was opened by |
1308 | * the userspace L2TP daemon. If not specified, create a |
1309 | * kernel socket. |
1310 | */ |
1311 | if (fd < 0) { |
1312 | err = l2tp_tunnel_sock_create(tunnel_id, peer_tunnel_id, cfg, &sock); |
1313 | if (err < 0) |
1314 | goto err; |
1315 | } else { |
1316 | err = -EBADF; |
1317 | sock = sockfd_lookup(fd, &err); |
1318 | if (!sock) { |
1319 | printk(KERN_ERR "tunl %hu: sockfd_lookup(fd=%d) returned %d\n", |
1320 | tunnel_id, fd, err); |
1321 | goto err; |
1322 | } |
1323 | } |
1324 | |
1325 | sk = sock->sk; |
1326 | |
1327 | if (cfg != NULL) |
1328 | encap = cfg->encap; |
1329 | |
1330 | /* Quick sanity checks */ |
1331 | switch (encap) { |
1332 | case L2TP_ENCAPTYPE_UDP: |
1333 | err = -EPROTONOSUPPORT; |
1334 | if (sk->sk_protocol != IPPROTO_UDP) { |
1335 | printk(KERN_ERR "tunl %hu: fd %d wrong protocol, got %d, expected %d\n", |
1336 | tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP); |
1337 | goto err; |
1338 | } |
1339 | break; |
1340 | case L2TP_ENCAPTYPE_IP: |
1341 | err = -EPROTONOSUPPORT; |
1342 | if (sk->sk_protocol != IPPROTO_L2TP) { |
1343 | printk(KERN_ERR "tunl %hu: fd %d wrong protocol, got %d, expected %d\n", |
1344 | tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP); |
1345 | goto err; |
1346 | } |
1347 | break; |
1348 | } |
1349 | |
1350 | /* Check if this socket has already been prepped */ |
1351 | tunnel = (struct l2tp_tunnel *)sk->sk_user_data; |
1352 | if (tunnel != NULL) { |
1353 | /* This socket has already been prepped */ |
1354 | err = -EBUSY; |
1355 | goto err; |
1356 | } |
1357 | |
1358 | tunnel = kzalloc(sizeof(struct l2tp_tunnel), GFP_KERNEL); |
1359 | if (tunnel == NULL) { |
1360 | err = -ENOMEM; |
1361 | goto err; |
1362 | } |
1363 | |
1364 | tunnel->version = version; |
1365 | tunnel->tunnel_id = tunnel_id; |
1366 | tunnel->peer_tunnel_id = peer_tunnel_id; |
1367 | tunnel->debug = L2TP_DEFAULT_DEBUG_FLAGS; |
1368 | |
1369 | tunnel->magic = L2TP_TUNNEL_MAGIC; |
1370 | sprintf(&tunnel->name[0], "tunl %u", tunnel_id); |
1371 | rwlock_init(&tunnel->hlist_lock); |
1372 | |
1373 | /* The net we belong to */ |
1374 | tunnel->l2tp_net = net; |
1375 | pn = l2tp_pernet(net); |
1376 | |
1377 | if (cfg != NULL) |
1378 | tunnel->debug = cfg->debug; |
1379 | |
1380 | /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */ |
1381 | tunnel->encap = encap; |
1382 | if (encap == L2TP_ENCAPTYPE_UDP) { |
1383 | /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */ |
1384 | udp_sk(sk)->encap_type = UDP_ENCAP_L2TPINUDP; |
1385 | udp_sk(sk)->encap_rcv = l2tp_udp_encap_recv; |
1386 | } |
1387 | |
1388 | sk->sk_user_data = tunnel; |
1389 | |
1390 | /* Hook on the tunnel socket destructor so that we can cleanup |
1391 | * if the tunnel socket goes away. |
1392 | */ |
1393 | tunnel->old_sk_destruct = sk->sk_destruct; |
1394 | sk->sk_destruct = &l2tp_tunnel_destruct; |
1395 | tunnel->sock = sk; |
1396 | sk->sk_allocation = GFP_ATOMIC; |
1397 | |
1398 | /* Add tunnel to our list */ |
1399 | INIT_LIST_HEAD(&tunnel->list); |
1400 | spin_lock_bh(&pn->l2tp_tunnel_list_lock); |
1401 | list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list); |
1402 | spin_unlock_bh(&pn->l2tp_tunnel_list_lock); |
1403 | synchronize_rcu(); |
1404 | atomic_inc(&l2tp_tunnel_count); |
1405 | |
1406 | /* Bump the reference count. The tunnel context is deleted |
1407 | * only when this drops to zero. |
1408 | */ |
1409 | l2tp_tunnel_inc_refcount(tunnel); |
1410 | |
1411 | err = 0; |
1412 | err: |
1413 | if (tunnelp) |
1414 | *tunnelp = tunnel; |
1415 | |
1416 | /* If tunnel's socket was created by the kernel, it doesn't |
1417 | * have a file. |
1418 | */ |
1419 | if (sock && sock->file) |
1420 | sockfd_put(sock); |
1421 | |
1422 | return err; |
1423 | } |
1424 | EXPORT_SYMBOL_GPL(l2tp_tunnel_create); |
1425 | |
1426 | /* This function is used by the netlink TUNNEL_DELETE command. |
1427 | */ |
1428 | int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) |
1429 | { |
1430 | int err = 0; |
1431 | struct socket *sock = tunnel->sock ? tunnel->sock->sk_socket : NULL; |
1432 | |
1433 | /* Force the tunnel socket to close. This will eventually |
1434 | * cause the tunnel to be deleted via the normal socket close |
1435 | * mechanisms when userspace closes the tunnel socket. |
1436 | */ |
1437 | if (sock != NULL) { |
1438 | err = inet_shutdown(sock, 2); |
1439 | |
1440 | /* If the tunnel's socket was created by the kernel, |
1441 | * close the socket here since the socket was not |
1442 | * created by userspace. |
1443 | */ |
1444 | if (sock->file == NULL) |
1445 | err = inet_release(sock); |
1446 | } |
1447 | |
1448 | return err; |
1449 | } |
1450 | EXPORT_SYMBOL_GPL(l2tp_tunnel_delete); |
1451 | |
1452 | /* Really kill the session. |
1453 | */ |
1454 | void l2tp_session_free(struct l2tp_session *session) |
1455 | { |
1456 | struct l2tp_tunnel *tunnel; |
1457 | |
1458 | BUG_ON(atomic_read(&session->ref_count) != 0); |
1459 | |
1460 | tunnel = session->tunnel; |
1461 | if (tunnel != NULL) { |
1462 | BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC); |
1463 | |
1464 | /* Delete the session from the hash */ |
1465 | write_lock_bh(&tunnel->hlist_lock); |
1466 | hlist_del_init(&session->hlist); |
1467 | write_unlock_bh(&tunnel->hlist_lock); |
1468 | |
1469 | /* Unlink from the global hash if not L2TPv2 */ |
1470 | if (tunnel->version != L2TP_HDR_VER_2) { |
1471 | struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net); |
1472 | |
1473 | spin_lock_bh(&pn->l2tp_session_hlist_lock); |
1474 | hlist_del_init_rcu(&session->global_hlist); |
1475 | spin_unlock_bh(&pn->l2tp_session_hlist_lock); |
1476 | synchronize_rcu(); |
1477 | } |
1478 | |
1479 | if (session->session_id != 0) |
1480 | atomic_dec(&l2tp_session_count); |
1481 | |
1482 | sock_put(tunnel->sock); |
1483 | |
1484 | /* This will delete the tunnel context if this |
1485 | * is the last session on the tunnel. |
1486 | */ |
1487 | session->tunnel = NULL; |
1488 | l2tp_tunnel_dec_refcount(tunnel); |
1489 | } |
1490 | |
1491 | kfree(session); |
1492 | |
1493 | return; |
1494 | } |
1495 | EXPORT_SYMBOL_GPL(l2tp_session_free); |
1496 | |
1497 | /* This function is used by the netlink SESSION_DELETE command and by |
1498 | pseudowire modules. |
1499 | */ |
1500 | int l2tp_session_delete(struct l2tp_session *session) |
1501 | { |
1502 | if (session->session_close != NULL) |
1503 | (*session->session_close)(session); |
1504 | |
1505 | l2tp_session_dec_refcount(session); |
1506 | |
1507 | return 0; |
1508 | } |
1509 | EXPORT_SYMBOL_GPL(l2tp_session_delete); |
1510 | |
1511 | |
1512 | /* We come here whenever a session's send_seq, cookie_len or |
1513 | * l2specific_len parameters are set. |
1514 | */ |
1515 | void l2tp_session_set_header_len(struct l2tp_session *session, int version) |
1516 | { |
1517 | if (version == L2TP_HDR_VER_2) { |
1518 | session->hdr_len = 6; |
1519 | if (session->send_seq) |
1520 | session->hdr_len += 4; |
1521 | } else { |
1522 | session->hdr_len = 4 + session->cookie_len + session->l2specific_len + session->offset; |
1523 | if (session->tunnel->encap == L2TP_ENCAPTYPE_UDP) |
1524 | session->hdr_len += 4; |
1525 | } |
1526 | |
1527 | } |
1528 | EXPORT_SYMBOL_GPL(l2tp_session_set_header_len); |
1529 | |
1530 | struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg) |
1531 | { |
1532 | struct l2tp_session *session; |
1533 | |
1534 | session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL); |
1535 | if (session != NULL) { |
1536 | session->magic = L2TP_SESSION_MAGIC; |
1537 | session->tunnel = tunnel; |
1538 | |
1539 | session->session_id = session_id; |
1540 | session->peer_session_id = peer_session_id; |
1541 | session->nr = 1; |
1542 | |
1543 | sprintf(&session->name[0], "sess %u/%u", |
1544 | tunnel->tunnel_id, session->session_id); |
1545 | |
1546 | skb_queue_head_init(&session->reorder_q); |
1547 | |
1548 | INIT_HLIST_NODE(&session->hlist); |
1549 | INIT_HLIST_NODE(&session->global_hlist); |
1550 | |
1551 | /* Inherit debug options from tunnel */ |
1552 | session->debug = tunnel->debug; |
1553 | |
1554 | if (cfg) { |
1555 | session->pwtype = cfg->pw_type; |
1556 | session->debug = cfg->debug; |
1557 | session->mtu = cfg->mtu; |
1558 | session->mru = cfg->mru; |
1559 | session->send_seq = cfg->send_seq; |
1560 | session->recv_seq = cfg->recv_seq; |
1561 | session->lns_mode = cfg->lns_mode; |
1562 | session->reorder_timeout = cfg->reorder_timeout; |
1563 | session->offset = cfg->offset; |
1564 | session->l2specific_type = cfg->l2specific_type; |
1565 | session->l2specific_len = cfg->l2specific_len; |
1566 | session->cookie_len = cfg->cookie_len; |
1567 | memcpy(&session->cookie[0], &cfg->cookie[0], cfg->cookie_len); |
1568 | session->peer_cookie_len = cfg->peer_cookie_len; |
1569 | memcpy(&session->peer_cookie[0], &cfg->peer_cookie[0], cfg->peer_cookie_len); |
1570 | } |
1571 | |
1572 | if (tunnel->version == L2TP_HDR_VER_2) |
1573 | session->build_header = l2tp_build_l2tpv2_header; |
1574 | else |
1575 | session->build_header = l2tp_build_l2tpv3_header; |
1576 | |
1577 | l2tp_session_set_header_len(session, tunnel->version); |
1578 | |
1579 | /* Bump the reference count. The session context is deleted |
1580 | * only when this drops to zero. |
1581 | */ |
1582 | l2tp_session_inc_refcount(session); |
1583 | l2tp_tunnel_inc_refcount(tunnel); |
1584 | |
1585 | /* Ensure tunnel socket isn't deleted */ |
1586 | sock_hold(tunnel->sock); |
1587 | |
1588 | /* Add session to the tunnel's hash list */ |
1589 | write_lock_bh(&tunnel->hlist_lock); |
1590 | hlist_add_head(&session->hlist, |
1591 | l2tp_session_id_hash(tunnel, session_id)); |
1592 | write_unlock_bh(&tunnel->hlist_lock); |
1593 | |
1594 | /* And to the global session list if L2TPv3 */ |
1595 | if (tunnel->version != L2TP_HDR_VER_2) { |
1596 | struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net); |
1597 | |
1598 | spin_lock_bh(&pn->l2tp_session_hlist_lock); |
1599 | hlist_add_head_rcu(&session->global_hlist, |
1600 | l2tp_session_id_hash_2(pn, session_id)); |
1601 | spin_unlock_bh(&pn->l2tp_session_hlist_lock); |
1602 | synchronize_rcu(); |
1603 | } |
1604 | |
1605 | /* Ignore management session in session count value */ |
1606 | if (session->session_id != 0) |
1607 | atomic_inc(&l2tp_session_count); |
1608 | } |
1609 | |
1610 | return session; |
1611 | } |
1612 | EXPORT_SYMBOL_GPL(l2tp_session_create); |
1613 | |
1614 | /***************************************************************************** |
1615 | * Init and cleanup |
1616 | *****************************************************************************/ |
1617 | |
1618 | static __net_init int l2tp_init_net(struct net *net) |
1619 | { |
1620 | struct l2tp_net *pn = net_generic(net, l2tp_net_id); |
1621 | int hash; |
1622 | |
1623 | INIT_LIST_HEAD(&pn->l2tp_tunnel_list); |
1624 | spin_lock_init(&pn->l2tp_tunnel_list_lock); |
1625 | |
1626 | for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) |
1627 | INIT_HLIST_HEAD(&pn->l2tp_session_hlist[hash]); |
1628 | |
1629 | spin_lock_init(&pn->l2tp_session_hlist_lock); |
1630 | |
1631 | return 0; |
1632 | } |
1633 | |
1634 | static struct pernet_operations l2tp_net_ops = { |
1635 | .init = l2tp_init_net, |
1636 | .id = &l2tp_net_id, |
1637 | .size = sizeof(struct l2tp_net), |
1638 | }; |
1639 | |
1640 | static int __init l2tp_init(void) |
1641 | { |
1642 | int rc = 0; |
1643 | |
1644 | rc = register_pernet_device(&l2tp_net_ops); |
1645 | if (rc) |
1646 | goto out; |
1647 | |
1648 | printk(KERN_INFO "L2TP core driver, %s\n", L2TP_DRV_VERSION); |
1649 | |
1650 | out: |
1651 | return rc; |
1652 | } |
1653 | |
1654 | static void __exit l2tp_exit(void) |
1655 | { |
1656 | unregister_pernet_device(&l2tp_net_ops); |
1657 | } |
1658 | |
1659 | module_init(l2tp_init); |
1660 | module_exit(l2tp_exit); |
1661 | |
1662 | MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); |
1663 | MODULE_DESCRIPTION("L2TP core"); |
1664 | MODULE_LICENSE("GPL"); |
1665 | MODULE_VERSION(L2TP_DRV_VERSION); |
1666 | |
1667 |
Branches:
ben-wpan
ben-wpan-stefan
javiroman/ks7010
jz-2.6.34
jz-2.6.34-rc5
jz-2.6.34-rc6
jz-2.6.34-rc7
jz-2.6.35
jz-2.6.36
jz-2.6.37
jz-2.6.38
jz-2.6.39
jz-3.0
jz-3.1
jz-3.11
jz-3.12
jz-3.13
jz-3.15
jz-3.16
jz-3.18-dt
jz-3.2
jz-3.3
jz-3.4
jz-3.5
jz-3.6
jz-3.6-rc2-pwm
jz-3.9
jz-3.9-clk
jz-3.9-rc8
jz47xx
jz47xx-2.6.38
master
Tags:
od-2011-09-04
od-2011-09-18
v2.6.34-rc5
v2.6.34-rc6
v2.6.34-rc7
v3.9