]>
Commit | Line | Data |
---|---|---|
1 | /** -*- linux-c -*- *********************************************************** | |
2 | * Linux PPP over Ethernet (PPPoX/PPPoE) Sockets | |
3 | * | |
4 | * PPPoX --- Generic PPP encapsulation socket family | |
5 | * PPPoE --- PPP over Ethernet (RFC 2516) | |
6 | * | |
7 | * | |
8 | * Version: 0.7.0 | |
9 | * | |
10 | * 070228 : Fix to allow multiple sessions with same remote MAC and same | |
11 | * session id by including the local device ifindex in the | |
12 | * tuple identifying a session. This also ensures packets can't | |
13 | * be injected into a session from interfaces other than the one | |
14 | * specified by userspace. Florian Zumbiehl <florz@florz.de> | |
15 | * (Oh, BTW, this one is YYMMDD, in case you were wondering ...) | |
16 | * 220102 : Fix module use count on failure in pppoe_create, pppox_sk -acme | |
17 | * 030700 : Fixed connect logic to allow for disconnect. | |
18 | * 270700 : Fixed potential SMP problems; we must protect against | |
19 | * simultaneous invocation of ppp_input | |
20 | * and ppp_unregister_channel. | |
21 | * 040800 : Respect reference count mechanisms on net-devices. | |
22 | * 200800 : fix kfree(skb) in pppoe_rcv (acme) | |
23 | * Module reference count is decremented in the right spot now, | |
24 | * guards against sock_put not actually freeing the sk | |
25 | * in pppoe_release. | |
26 | * 051000 : Initialization cleanup. | |
27 | * 111100 : Fix recvmsg. | |
28 | * 050101 : Fix PADT procesing. | |
29 | * 140501 : Use pppoe_rcv_core to handle all backlog. (Alexey) | |
30 | * 170701 : Do not lock_sock with rwlock held. (DaveM) | |
31 | * Ignore discovery frames if user has socket | |
32 | * locked. (DaveM) | |
33 | * Ignore return value of dev_queue_xmit in __pppoe_xmit | |
34 | * or else we may kfree an SKB twice. (DaveM) | |
35 | * 190701 : When doing copies of skb's in __pppoe_xmit, always delete | |
36 | * the original skb that was passed in on success, never on | |
37 | * failure. Delete the copy of the skb on failure to avoid | |
38 | * a memory leak. | |
39 | * 081001 : Misc. cleanup (licence string, non-blocking, prevent | |
40 | * reference of device on close). | |
41 | * 121301 : New ppp channels interface; cannot unregister a channel | |
42 | * from interrupts. Thus, we mark the socket as a ZOMBIE | |
43 | * and do the unregistration later. | |
44 | * 081002 : seq_file support for proc stuff -acme | |
45 | * 111602 : Merge all 2.4 fixes into 2.5/2.6 tree. Label 2.5/2.6 | |
46 | * as version 0.7. Spacing cleanup. | |
47 | * Author: Michal Ostrowski <mostrows@speakeasy.net> | |
48 | * Contributors: | |
49 | * Arnaldo Carvalho de Melo <acme@conectiva.com.br> | |
50 | * David S. Miller (davem@redhat.com) | |
51 | * | |
52 | * License: | |
53 | * This program is free software; you can redistribute it and/or | |
54 | * modify it under the terms of the GNU General Public License | |
55 | * as published by the Free Software Foundation; either version | |
56 | * 2 of the License, or (at your option) any later version. | |
57 | * | |
58 | */ | |
59 | ||
60 | #include <linux/string.h> | |
61 | #include <linux/module.h> | |
62 | #include <linux/kernel.h> | |
63 | #include <linux/slab.h> | |
64 | #include <linux/errno.h> | |
65 | #include <linux/netdevice.h> | |
66 | #include <linux/net.h> | |
67 | #include <linux/inetdevice.h> | |
68 | #include <linux/etherdevice.h> | |
69 | #include <linux/skbuff.h> | |
70 | #include <linux/init.h> | |
71 | #include <linux/if_ether.h> | |
72 | #include <linux/if_pppox.h> | |
73 | #include <linux/ppp_channel.h> | |
74 | #include <linux/ppp_defs.h> | |
75 | #include <linux/ppp-ioctl.h> | |
76 | #include <linux/notifier.h> | |
77 | #include <linux/file.h> | |
78 | #include <linux/proc_fs.h> | |
79 | #include <linux/seq_file.h> | |
80 | ||
81 | #include <linux/nsproxy.h> | |
82 | #include <net/net_namespace.h> | |
83 | #include <net/netns/generic.h> | |
84 | #include <net/sock.h> | |
85 | ||
86 | #include <linux/uaccess.h> | |
87 | ||
88 | #define PPPOE_HASH_BITS 4 | |
89 | #define PPPOE_HASH_SIZE (1 << PPPOE_HASH_BITS) | |
90 | #define PPPOE_HASH_MASK (PPPOE_HASH_SIZE - 1) | |
91 | ||
92 | static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb); | |
93 | ||
94 | static const struct proto_ops pppoe_ops; | |
95 | static const struct ppp_channel_ops pppoe_chan_ops; | |
96 | ||
97 | /* per-net private data for this module */ | |
98 | static unsigned int pppoe_net_id __read_mostly; | |
99 | struct pppoe_net { | |
100 | /* | |
101 | * we could use _single_ hash table for all | |
102 | * nets by injecting net id into the hash but | |
103 | * it would increase hash chains and add | |
104 | * a few additional math comparations messy | |
105 | * as well, moreover in case of SMP less locking | |
106 | * controversy here | |
107 | */ | |
108 | struct pppox_sock *hash_table[PPPOE_HASH_SIZE]; | |
109 | rwlock_t hash_lock; | |
110 | }; | |
111 | ||
112 | /* | |
113 | * PPPoE could be in the following stages: | |
114 | * 1) Discovery stage (to obtain remote MAC and Session ID) | |
115 | * 2) Session stage (MAC and SID are known) | |
116 | * | |
117 | * Ethernet frames have a special tag for this but | |
118 | * we use simpler approach based on session id | |
119 | */ | |
120 | static inline bool stage_session(__be16 sid) | |
121 | { | |
122 | return sid != 0; | |
123 | } | |
124 | ||
125 | static inline struct pppoe_net *pppoe_pernet(struct net *net) | |
126 | { | |
127 | BUG_ON(!net); | |
128 | ||
129 | return net_generic(net, pppoe_net_id); | |
130 | } | |
131 | ||
132 | static inline int cmp_2_addr(struct pppoe_addr *a, struct pppoe_addr *b) | |
133 | { | |
134 | return a->sid == b->sid && ether_addr_equal(a->remote, b->remote); | |
135 | } | |
136 | ||
137 | static inline int cmp_addr(struct pppoe_addr *a, __be16 sid, char *addr) | |
138 | { | |
139 | return a->sid == sid && ether_addr_equal(a->remote, addr); | |
140 | } | |
141 | ||
142 | #if 8 % PPPOE_HASH_BITS | |
143 | #error 8 must be a multiple of PPPOE_HASH_BITS | |
144 | #endif | |
145 | ||
146 | static int hash_item(__be16 sid, unsigned char *addr) | |
147 | { | |
148 | unsigned char hash = 0; | |
149 | unsigned int i; | |
150 | ||
151 | for (i = 0; i < ETH_ALEN; i++) | |
152 | hash ^= addr[i]; | |
153 | for (i = 0; i < sizeof(sid_t) * 8; i += 8) | |
154 | hash ^= (__force __u32)sid >> i; | |
155 | for (i = 8; (i >>= 1) >= PPPOE_HASH_BITS;) | |
156 | hash ^= hash >> i; | |
157 | ||
158 | return hash & PPPOE_HASH_MASK; | |
159 | } | |
160 | ||
161 | /********************************************************************** | |
162 | * | |
163 | * Set/get/delete/rehash items (internal versions) | |
164 | * | |
165 | **********************************************************************/ | |
166 | static struct pppox_sock *__get_item(struct pppoe_net *pn, __be16 sid, | |
167 | unsigned char *addr, int ifindex) | |
168 | { | |
169 | int hash = hash_item(sid, addr); | |
170 | struct pppox_sock *ret; | |
171 | ||
172 | ret = pn->hash_table[hash]; | |
173 | while (ret) { | |
174 | if (cmp_addr(&ret->pppoe_pa, sid, addr) && | |
175 | ret->pppoe_ifindex == ifindex) | |
176 | return ret; | |
177 | ||
178 | ret = ret->next; | |
179 | } | |
180 | ||
181 | return NULL; | |
182 | } | |
183 | ||
184 | static int __set_item(struct pppoe_net *pn, struct pppox_sock *po) | |
185 | { | |
186 | int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); | |
187 | struct pppox_sock *ret; | |
188 | ||
189 | ret = pn->hash_table[hash]; | |
190 | while (ret) { | |
191 | if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa) && | |
192 | ret->pppoe_ifindex == po->pppoe_ifindex) | |
193 | return -EALREADY; | |
194 | ||
195 | ret = ret->next; | |
196 | } | |
197 | ||
198 | po->next = pn->hash_table[hash]; | |
199 | pn->hash_table[hash] = po; | |
200 | ||
201 | return 0; | |
202 | } | |
203 | ||
204 | static void __delete_item(struct pppoe_net *pn, __be16 sid, | |
205 | char *addr, int ifindex) | |
206 | { | |
207 | int hash = hash_item(sid, addr); | |
208 | struct pppox_sock *ret, **src; | |
209 | ||
210 | ret = pn->hash_table[hash]; | |
211 | src = &pn->hash_table[hash]; | |
212 | ||
213 | while (ret) { | |
214 | if (cmp_addr(&ret->pppoe_pa, sid, addr) && | |
215 | ret->pppoe_ifindex == ifindex) { | |
216 | *src = ret->next; | |
217 | break; | |
218 | } | |
219 | ||
220 | src = &ret->next; | |
221 | ret = ret->next; | |
222 | } | |
223 | } | |
224 | ||
225 | /********************************************************************** | |
226 | * | |
227 | * Set/get/delete/rehash items | |
228 | * | |
229 | **********************************************************************/ | |
230 | static inline struct pppox_sock *get_item(struct pppoe_net *pn, __be16 sid, | |
231 | unsigned char *addr, int ifindex) | |
232 | { | |
233 | struct pppox_sock *po; | |
234 | ||
235 | read_lock_bh(&pn->hash_lock); | |
236 | po = __get_item(pn, sid, addr, ifindex); | |
237 | if (po) | |
238 | sock_hold(sk_pppox(po)); | |
239 | read_unlock_bh(&pn->hash_lock); | |
240 | ||
241 | return po; | |
242 | } | |
243 | ||
244 | static inline struct pppox_sock *get_item_by_addr(struct net *net, | |
245 | struct sockaddr_pppox *sp) | |
246 | { | |
247 | struct net_device *dev; | |
248 | struct pppoe_net *pn; | |
249 | struct pppox_sock *pppox_sock = NULL; | |
250 | ||
251 | int ifindex; | |
252 | ||
253 | rcu_read_lock(); | |
254 | dev = dev_get_by_name_rcu(net, sp->sa_addr.pppoe.dev); | |
255 | if (dev) { | |
256 | ifindex = dev->ifindex; | |
257 | pn = pppoe_pernet(net); | |
258 | pppox_sock = get_item(pn, sp->sa_addr.pppoe.sid, | |
259 | sp->sa_addr.pppoe.remote, ifindex); | |
260 | } | |
261 | rcu_read_unlock(); | |
262 | return pppox_sock; | |
263 | } | |
264 | ||
265 | static inline void delete_item(struct pppoe_net *pn, __be16 sid, | |
266 | char *addr, int ifindex) | |
267 | { | |
268 | write_lock_bh(&pn->hash_lock); | |
269 | __delete_item(pn, sid, addr, ifindex); | |
270 | write_unlock_bh(&pn->hash_lock); | |
271 | } | |
272 | ||
273 | /*************************************************************************** | |
274 | * | |
275 | * Handler for device events. | |
276 | * Certain device events require that sockets be unconnected. | |
277 | * | |
278 | **************************************************************************/ | |
279 | ||
280 | static void pppoe_flush_dev(struct net_device *dev) | |
281 | { | |
282 | struct pppoe_net *pn; | |
283 | int i; | |
284 | ||
285 | pn = pppoe_pernet(dev_net(dev)); | |
286 | write_lock_bh(&pn->hash_lock); | |
287 | for (i = 0; i < PPPOE_HASH_SIZE; i++) { | |
288 | struct pppox_sock *po = pn->hash_table[i]; | |
289 | struct sock *sk; | |
290 | ||
291 | while (po) { | |
292 | while (po && po->pppoe_dev != dev) { | |
293 | po = po->next; | |
294 | } | |
295 | ||
296 | if (!po) | |
297 | break; | |
298 | ||
299 | sk = sk_pppox(po); | |
300 | ||
301 | /* We always grab the socket lock, followed by the | |
302 | * hash_lock, in that order. Since we should hold the | |
303 | * sock lock while doing any unbinding, we need to | |
304 | * release the lock we're holding. Hold a reference to | |
305 | * the sock so it doesn't disappear as we're jumping | |
306 | * between locks. | |
307 | */ | |
308 | ||
309 | sock_hold(sk); | |
310 | write_unlock_bh(&pn->hash_lock); | |
311 | lock_sock(sk); | |
312 | ||
313 | if (po->pppoe_dev == dev && | |
314 | sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) { | |
315 | pppox_unbind_sock(sk); | |
316 | sk->sk_state_change(sk); | |
317 | po->pppoe_dev = NULL; | |
318 | dev_put(dev); | |
319 | } | |
320 | ||
321 | release_sock(sk); | |
322 | sock_put(sk); | |
323 | ||
324 | /* Restart the process from the start of the current | |
325 | * hash chain. We dropped locks so the world may have | |
326 | * change from underneath us. | |
327 | */ | |
328 | ||
329 | BUG_ON(pppoe_pernet(dev_net(dev)) == NULL); | |
330 | write_lock_bh(&pn->hash_lock); | |
331 | po = pn->hash_table[i]; | |
332 | } | |
333 | } | |
334 | write_unlock_bh(&pn->hash_lock); | |
335 | } | |
336 | ||
337 | static int pppoe_device_event(struct notifier_block *this, | |
338 | unsigned long event, void *ptr) | |
339 | { | |
340 | struct net_device *dev = netdev_notifier_info_to_dev(ptr); | |
341 | ||
342 | /* Only look at sockets that are using this specific device. */ | |
343 | switch (event) { | |
344 | case NETDEV_CHANGEADDR: | |
345 | case NETDEV_CHANGEMTU: | |
346 | /* A change in mtu or address is a bad thing, requiring | |
347 | * LCP re-negotiation. | |
348 | */ | |
349 | ||
350 | case NETDEV_GOING_DOWN: | |
351 | case NETDEV_DOWN: | |
352 | /* Find every socket on this device and kill it. */ | |
353 | pppoe_flush_dev(dev); | |
354 | break; | |
355 | ||
356 | default: | |
357 | break; | |
358 | } | |
359 | ||
360 | return NOTIFY_DONE; | |
361 | } | |
362 | ||
363 | static struct notifier_block pppoe_notifier = { | |
364 | .notifier_call = pppoe_device_event, | |
365 | }; | |
366 | ||
367 | /************************************************************************ | |
368 | * | |
369 | * Do the real work of receiving a PPPoE Session frame. | |
370 | * | |
371 | ***********************************************************************/ | |
372 | static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb) | |
373 | { | |
374 | struct pppox_sock *po = pppox_sk(sk); | |
375 | struct pppox_sock *relay_po; | |
376 | ||
377 | /* Backlog receive. Semantics of backlog rcv preclude any code from | |
378 | * executing in lock_sock()/release_sock() bounds; meaning sk->sk_state | |
379 | * can't change. | |
380 | */ | |
381 | ||
382 | if (skb->pkt_type == PACKET_OTHERHOST) | |
383 | goto abort_kfree; | |
384 | ||
385 | if (sk->sk_state & PPPOX_BOUND) { | |
386 | ppp_input(&po->chan, skb); | |
387 | } else if (sk->sk_state & PPPOX_RELAY) { | |
388 | relay_po = get_item_by_addr(sock_net(sk), | |
389 | &po->pppoe_relay); | |
390 | if (relay_po == NULL) | |
391 | goto abort_kfree; | |
392 | ||
393 | if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0) | |
394 | goto abort_put; | |
395 | ||
396 | if (!__pppoe_xmit(sk_pppox(relay_po), skb)) | |
397 | goto abort_put; | |
398 | ||
399 | sock_put(sk_pppox(relay_po)); | |
400 | } else { | |
401 | if (sock_queue_rcv_skb(sk, skb)) | |
402 | goto abort_kfree; | |
403 | } | |
404 | ||
405 | return NET_RX_SUCCESS; | |
406 | ||
407 | abort_put: | |
408 | sock_put(sk_pppox(relay_po)); | |
409 | ||
410 | abort_kfree: | |
411 | kfree_skb(skb); | |
412 | return NET_RX_DROP; | |
413 | } | |
414 | ||
415 | /************************************************************************ | |
416 | * | |
417 | * Receive wrapper called in BH context. | |
418 | * | |
419 | ***********************************************************************/ | |
420 | static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev, | |
421 | struct packet_type *pt, struct net_device *orig_dev) | |
422 | { | |
423 | struct pppoe_hdr *ph; | |
424 | struct pppox_sock *po; | |
425 | struct pppoe_net *pn; | |
426 | int len; | |
427 | ||
428 | skb = skb_share_check(skb, GFP_ATOMIC); | |
429 | if (!skb) | |
430 | goto out; | |
431 | ||
432 | if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) | |
433 | goto drop; | |
434 | ||
435 | ph = pppoe_hdr(skb); | |
436 | len = ntohs(ph->length); | |
437 | ||
438 | skb_pull_rcsum(skb, sizeof(*ph)); | |
439 | if (skb->len < len) | |
440 | goto drop; | |
441 | ||
442 | if (pskb_trim_rcsum(skb, len)) | |
443 | goto drop; | |
444 | ||
445 | pn = pppoe_pernet(dev_net(dev)); | |
446 | ||
447 | /* Note that get_item does a sock_hold(), so sk_pppox(po) | |
448 | * is known to be safe. | |
449 | */ | |
450 | po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); | |
451 | if (!po) | |
452 | goto drop; | |
453 | ||
454 | return sk_receive_skb(sk_pppox(po), skb, 0); | |
455 | ||
456 | drop: | |
457 | kfree_skb(skb); | |
458 | out: | |
459 | return NET_RX_DROP; | |
460 | } | |
461 | ||
462 | static void pppoe_unbind_sock_work(struct work_struct *work) | |
463 | { | |
464 | struct pppox_sock *po = container_of(work, struct pppox_sock, | |
465 | proto.pppoe.padt_work); | |
466 | struct sock *sk = sk_pppox(po); | |
467 | ||
468 | lock_sock(sk); | |
469 | if (po->pppoe_dev) { | |
470 | dev_put(po->pppoe_dev); | |
471 | po->pppoe_dev = NULL; | |
472 | } | |
473 | pppox_unbind_sock(sk); | |
474 | release_sock(sk); | |
475 | sock_put(sk); | |
476 | } | |
477 | ||
478 | /************************************************************************ | |
479 | * | |
480 | * Receive a PPPoE Discovery frame. | |
481 | * This is solely for detection of PADT frames | |
482 | * | |
483 | ***********************************************************************/ | |
484 | static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev, | |
485 | struct packet_type *pt, struct net_device *orig_dev) | |
486 | ||
487 | { | |
488 | struct pppoe_hdr *ph; | |
489 | struct pppox_sock *po; | |
490 | struct pppoe_net *pn; | |
491 | ||
492 | skb = skb_share_check(skb, GFP_ATOMIC); | |
493 | if (!skb) | |
494 | goto out; | |
495 | ||
496 | if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) | |
497 | goto abort; | |
498 | ||
499 | ph = pppoe_hdr(skb); | |
500 | if (ph->code != PADT_CODE) | |
501 | goto abort; | |
502 | ||
503 | pn = pppoe_pernet(dev_net(dev)); | |
504 | po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); | |
505 | if (po) | |
506 | if (!schedule_work(&po->proto.pppoe.padt_work)) | |
507 | sock_put(sk_pppox(po)); | |
508 | ||
509 | abort: | |
510 | kfree_skb(skb); | |
511 | out: | |
512 | return NET_RX_SUCCESS; /* Lies... :-) */ | |
513 | } | |
514 | ||
515 | static struct packet_type pppoes_ptype __read_mostly = { | |
516 | .type = cpu_to_be16(ETH_P_PPP_SES), | |
517 | .func = pppoe_rcv, | |
518 | }; | |
519 | ||
520 | static struct packet_type pppoed_ptype __read_mostly = { | |
521 | .type = cpu_to_be16(ETH_P_PPP_DISC), | |
522 | .func = pppoe_disc_rcv, | |
523 | }; | |
524 | ||
525 | static struct proto pppoe_sk_proto __read_mostly = { | |
526 | .name = "PPPOE", | |
527 | .owner = THIS_MODULE, | |
528 | .obj_size = sizeof(struct pppox_sock), | |
529 | }; | |
530 | ||
531 | /*********************************************************************** | |
532 | * | |
533 | * Initialize a new struct sock. | |
534 | * | |
535 | **********************************************************************/ | |
536 | static int pppoe_create(struct net *net, struct socket *sock, int kern) | |
537 | { | |
538 | struct sock *sk; | |
539 | ||
540 | sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppoe_sk_proto, kern); | |
541 | if (!sk) | |
542 | return -ENOMEM; | |
543 | ||
544 | sock_init_data(sock, sk); | |
545 | ||
546 | sock->state = SS_UNCONNECTED; | |
547 | sock->ops = &pppoe_ops; | |
548 | ||
549 | sk->sk_backlog_rcv = pppoe_rcv_core; | |
550 | sk->sk_state = PPPOX_NONE; | |
551 | sk->sk_type = SOCK_STREAM; | |
552 | sk->sk_family = PF_PPPOX; | |
553 | sk->sk_protocol = PX_PROTO_OE; | |
554 | ||
555 | INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work, | |
556 | pppoe_unbind_sock_work); | |
557 | ||
558 | return 0; | |
559 | } | |
560 | ||
561 | static int pppoe_release(struct socket *sock) | |
562 | { | |
563 | struct sock *sk = sock->sk; | |
564 | struct pppox_sock *po; | |
565 | struct pppoe_net *pn; | |
566 | struct net *net = NULL; | |
567 | ||
568 | if (!sk) | |
569 | return 0; | |
570 | ||
571 | lock_sock(sk); | |
572 | if (sock_flag(sk, SOCK_DEAD)) { | |
573 | release_sock(sk); | |
574 | return -EBADF; | |
575 | } | |
576 | ||
577 | po = pppox_sk(sk); | |
578 | ||
579 | if (po->pppoe_dev) { | |
580 | dev_put(po->pppoe_dev); | |
581 | po->pppoe_dev = NULL; | |
582 | } | |
583 | ||
584 | pppox_unbind_sock(sk); | |
585 | ||
586 | /* Signal the death of the socket. */ | |
587 | sk->sk_state = PPPOX_DEAD; | |
588 | ||
589 | net = sock_net(sk); | |
590 | pn = pppoe_pernet(net); | |
591 | ||
592 | /* | |
593 | * protect "po" from concurrent updates | |
594 | * on pppoe_flush_dev | |
595 | */ | |
596 | delete_item(pn, po->pppoe_pa.sid, po->pppoe_pa.remote, | |
597 | po->pppoe_ifindex); | |
598 | ||
599 | sock_orphan(sk); | |
600 | sock->sk = NULL; | |
601 | ||
602 | skb_queue_purge(&sk->sk_receive_queue); | |
603 | release_sock(sk); | |
604 | sock_put(sk); | |
605 | ||
606 | return 0; | |
607 | } | |
608 | ||
609 | static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr, | |
610 | int sockaddr_len, int flags) | |
611 | { | |
612 | struct sock *sk = sock->sk; | |
613 | struct sockaddr_pppox *sp = (struct sockaddr_pppox *)uservaddr; | |
614 | struct pppox_sock *po = pppox_sk(sk); | |
615 | struct net_device *dev = NULL; | |
616 | struct pppoe_net *pn; | |
617 | struct net *net = NULL; | |
618 | int error; | |
619 | ||
620 | lock_sock(sk); | |
621 | ||
622 | error = -EINVAL; | |
623 | if (sp->sa_protocol != PX_PROTO_OE) | |
624 | goto end; | |
625 | ||
626 | /* Check for already bound sockets */ | |
627 | error = -EBUSY; | |
628 | if ((sk->sk_state & PPPOX_CONNECTED) && | |
629 | stage_session(sp->sa_addr.pppoe.sid)) | |
630 | goto end; | |
631 | ||
632 | /* Check for already disconnected sockets, on attempts to disconnect */ | |
633 | error = -EALREADY; | |
634 | if ((sk->sk_state & PPPOX_DEAD) && | |
635 | !stage_session(sp->sa_addr.pppoe.sid)) | |
636 | goto end; | |
637 | ||
638 | error = 0; | |
639 | ||
640 | /* Delete the old binding */ | |
641 | if (stage_session(po->pppoe_pa.sid)) { | |
642 | pppox_unbind_sock(sk); | |
643 | pn = pppoe_pernet(sock_net(sk)); | |
644 | delete_item(pn, po->pppoe_pa.sid, | |
645 | po->pppoe_pa.remote, po->pppoe_ifindex); | |
646 | if (po->pppoe_dev) { | |
647 | dev_put(po->pppoe_dev); | |
648 | po->pppoe_dev = NULL; | |
649 | } | |
650 | ||
651 | po->pppoe_ifindex = 0; | |
652 | memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa)); | |
653 | memset(&po->pppoe_relay, 0, sizeof(po->pppoe_relay)); | |
654 | memset(&po->chan, 0, sizeof(po->chan)); | |
655 | po->next = NULL; | |
656 | po->num = 0; | |
657 | ||
658 | sk->sk_state = PPPOX_NONE; | |
659 | } | |
660 | ||
661 | /* Re-bind in session stage only */ | |
662 | if (stage_session(sp->sa_addr.pppoe.sid)) { | |
663 | error = -ENODEV; | |
664 | net = sock_net(sk); | |
665 | dev = dev_get_by_name(net, sp->sa_addr.pppoe.dev); | |
666 | if (!dev) | |
667 | goto err_put; | |
668 | ||
669 | po->pppoe_dev = dev; | |
670 | po->pppoe_ifindex = dev->ifindex; | |
671 | pn = pppoe_pernet(net); | |
672 | if (!(dev->flags & IFF_UP)) { | |
673 | goto err_put; | |
674 | } | |
675 | ||
676 | memcpy(&po->pppoe_pa, | |
677 | &sp->sa_addr.pppoe, | |
678 | sizeof(struct pppoe_addr)); | |
679 | ||
680 | write_lock_bh(&pn->hash_lock); | |
681 | error = __set_item(pn, po); | |
682 | write_unlock_bh(&pn->hash_lock); | |
683 | if (error < 0) | |
684 | goto err_put; | |
685 | ||
686 | po->chan.hdrlen = (sizeof(struct pppoe_hdr) + | |
687 | dev->hard_header_len); | |
688 | ||
689 | po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2; | |
690 | po->chan.private = sk; | |
691 | po->chan.ops = &pppoe_chan_ops; | |
692 | ||
693 | error = ppp_register_net_channel(dev_net(dev), &po->chan); | |
694 | if (error) { | |
695 | delete_item(pn, po->pppoe_pa.sid, | |
696 | po->pppoe_pa.remote, po->pppoe_ifindex); | |
697 | goto err_put; | |
698 | } | |
699 | ||
700 | sk->sk_state = PPPOX_CONNECTED; | |
701 | } | |
702 | ||
703 | po->num = sp->sa_addr.pppoe.sid; | |
704 | ||
705 | end: | |
706 | release_sock(sk); | |
707 | return error; | |
708 | err_put: | |
709 | if (po->pppoe_dev) { | |
710 | dev_put(po->pppoe_dev); | |
711 | po->pppoe_dev = NULL; | |
712 | } | |
713 | goto end; | |
714 | } | |
715 | ||
716 | static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr, | |
717 | int *usockaddr_len, int peer) | |
718 | { | |
719 | int len = sizeof(struct sockaddr_pppox); | |
720 | struct sockaddr_pppox sp; | |
721 | ||
722 | sp.sa_family = AF_PPPOX; | |
723 | sp.sa_protocol = PX_PROTO_OE; | |
724 | memcpy(&sp.sa_addr.pppoe, &pppox_sk(sock->sk)->pppoe_pa, | |
725 | sizeof(struct pppoe_addr)); | |
726 | ||
727 | memcpy(uaddr, &sp, len); | |
728 | ||
729 | *usockaddr_len = len; | |
730 | ||
731 | return 0; | |
732 | } | |
733 | ||
734 | static int pppoe_ioctl(struct socket *sock, unsigned int cmd, | |
735 | unsigned long arg) | |
736 | { | |
737 | struct sock *sk = sock->sk; | |
738 | struct pppox_sock *po = pppox_sk(sk); | |
739 | int val; | |
740 | int err; | |
741 | ||
742 | switch (cmd) { | |
743 | case PPPIOCGMRU: | |
744 | err = -ENXIO; | |
745 | if (!(sk->sk_state & PPPOX_CONNECTED)) | |
746 | break; | |
747 | ||
748 | err = -EFAULT; | |
749 | if (put_user(po->pppoe_dev->mtu - | |
750 | sizeof(struct pppoe_hdr) - | |
751 | PPP_HDRLEN, | |
752 | (int __user *)arg)) | |
753 | break; | |
754 | err = 0; | |
755 | break; | |
756 | ||
757 | case PPPIOCSMRU: | |
758 | err = -ENXIO; | |
759 | if (!(sk->sk_state & PPPOX_CONNECTED)) | |
760 | break; | |
761 | ||
762 | err = -EFAULT; | |
763 | if (get_user(val, (int __user *)arg)) | |
764 | break; | |
765 | ||
766 | if (val < (po->pppoe_dev->mtu | |
767 | - sizeof(struct pppoe_hdr) | |
768 | - PPP_HDRLEN)) | |
769 | err = 0; | |
770 | else | |
771 | err = -EINVAL; | |
772 | break; | |
773 | ||
774 | case PPPIOCSFLAGS: | |
775 | err = -EFAULT; | |
776 | if (get_user(val, (int __user *)arg)) | |
777 | break; | |
778 | err = 0; | |
779 | break; | |
780 | ||
781 | case PPPOEIOCSFWD: | |
782 | { | |
783 | struct pppox_sock *relay_po; | |
784 | ||
785 | err = -EBUSY; | |
786 | if (sk->sk_state & (PPPOX_BOUND | PPPOX_DEAD)) | |
787 | break; | |
788 | ||
789 | err = -ENOTCONN; | |
790 | if (!(sk->sk_state & PPPOX_CONNECTED)) | |
791 | break; | |
792 | ||
793 | /* PPPoE address from the user specifies an outbound | |
794 | PPPoE address which frames are forwarded to */ | |
795 | err = -EFAULT; | |
796 | if (copy_from_user(&po->pppoe_relay, | |
797 | (void __user *)arg, | |
798 | sizeof(struct sockaddr_pppox))) | |
799 | break; | |
800 | ||
801 | err = -EINVAL; | |
802 | if (po->pppoe_relay.sa_family != AF_PPPOX || | |
803 | po->pppoe_relay.sa_protocol != PX_PROTO_OE) | |
804 | break; | |
805 | ||
806 | /* Check that the socket referenced by the address | |
807 | actually exists. */ | |
808 | relay_po = get_item_by_addr(sock_net(sk), &po->pppoe_relay); | |
809 | if (!relay_po) | |
810 | break; | |
811 | ||
812 | sock_put(sk_pppox(relay_po)); | |
813 | sk->sk_state |= PPPOX_RELAY; | |
814 | err = 0; | |
815 | break; | |
816 | } | |
817 | ||
818 | case PPPOEIOCDFWD: | |
819 | err = -EALREADY; | |
820 | if (!(sk->sk_state & PPPOX_RELAY)) | |
821 | break; | |
822 | ||
823 | sk->sk_state &= ~PPPOX_RELAY; | |
824 | err = 0; | |
825 | break; | |
826 | ||
827 | default: | |
828 | err = -ENOTTY; | |
829 | } | |
830 | ||
831 | return err; | |
832 | } | |
833 | ||
834 | static int pppoe_sendmsg(struct socket *sock, struct msghdr *m, | |
835 | size_t total_len) | |
836 | { | |
837 | struct sk_buff *skb; | |
838 | struct sock *sk = sock->sk; | |
839 | struct pppox_sock *po = pppox_sk(sk); | |
840 | int error; | |
841 | struct pppoe_hdr hdr; | |
842 | struct pppoe_hdr *ph; | |
843 | struct net_device *dev; | |
844 | char *start; | |
845 | ||
846 | lock_sock(sk); | |
847 | if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) { | |
848 | error = -ENOTCONN; | |
849 | goto end; | |
850 | } | |
851 | ||
852 | hdr.ver = 1; | |
853 | hdr.type = 1; | |
854 | hdr.code = 0; | |
855 | hdr.sid = po->num; | |
856 | ||
857 | dev = po->pppoe_dev; | |
858 | ||
859 | error = -EMSGSIZE; | |
860 | if (total_len > (dev->mtu + dev->hard_header_len)) | |
861 | goto end; | |
862 | ||
863 | ||
864 | skb = sock_wmalloc(sk, total_len + dev->hard_header_len + 32, | |
865 | 0, GFP_KERNEL); | |
866 | if (!skb) { | |
867 | error = -ENOMEM; | |
868 | goto end; | |
869 | } | |
870 | ||
871 | /* Reserve space for headers. */ | |
872 | skb_reserve(skb, dev->hard_header_len); | |
873 | skb_reset_network_header(skb); | |
874 | ||
875 | skb->dev = dev; | |
876 | ||
877 | skb->priority = sk->sk_priority; | |
878 | skb->protocol = cpu_to_be16(ETH_P_PPP_SES); | |
879 | ||
880 | ph = skb_put(skb, total_len + sizeof(struct pppoe_hdr)); | |
881 | start = (char *)&ph->tag[0]; | |
882 | ||
883 | error = memcpy_from_msg(start, m, total_len); | |
884 | if (error < 0) { | |
885 | kfree_skb(skb); | |
886 | goto end; | |
887 | } | |
888 | ||
889 | error = total_len; | |
890 | dev_hard_header(skb, dev, ETH_P_PPP_SES, | |
891 | po->pppoe_pa.remote, NULL, total_len); | |
892 | ||
893 | memcpy(ph, &hdr, sizeof(struct pppoe_hdr)); | |
894 | ||
895 | ph->length = htons(total_len); | |
896 | ||
897 | dev_queue_xmit(skb); | |
898 | ||
899 | end: | |
900 | release_sock(sk); | |
901 | return error; | |
902 | } | |
903 | ||
904 | /************************************************************************ | |
905 | * | |
906 | * xmit function for internal use. | |
907 | * | |
908 | ***********************************************************************/ | |
909 | static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb) | |
910 | { | |
911 | struct pppox_sock *po = pppox_sk(sk); | |
912 | struct net_device *dev = po->pppoe_dev; | |
913 | struct pppoe_hdr *ph; | |
914 | int data_len = skb->len; | |
915 | ||
916 | /* The higher-level PPP code (ppp_unregister_channel()) ensures the PPP | |
917 | * xmit operations conclude prior to an unregistration call. Thus | |
918 | * sk->sk_state cannot change, so we don't need to do lock_sock(). | |
919 | * But, we also can't do a lock_sock since that introduces a potential | |
920 | * deadlock as we'd reverse the lock ordering used when calling | |
921 | * ppp_unregister_channel(). | |
922 | */ | |
923 | ||
924 | if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) | |
925 | goto abort; | |
926 | ||
927 | if (!dev) | |
928 | goto abort; | |
929 | ||
930 | /* Copy the data if there is no space for the header or if it's | |
931 | * read-only. | |
932 | */ | |
933 | if (skb_cow_head(skb, sizeof(*ph) + dev->hard_header_len)) | |
934 | goto abort; | |
935 | ||
936 | __skb_push(skb, sizeof(*ph)); | |
937 | skb_reset_network_header(skb); | |
938 | ||
939 | ph = pppoe_hdr(skb); | |
940 | ph->ver = 1; | |
941 | ph->type = 1; | |
942 | ph->code = 0; | |
943 | ph->sid = po->num; | |
944 | ph->length = htons(data_len); | |
945 | ||
946 | skb->protocol = cpu_to_be16(ETH_P_PPP_SES); | |
947 | skb->dev = dev; | |
948 | ||
949 | dev_hard_header(skb, dev, ETH_P_PPP_SES, | |
950 | po->pppoe_pa.remote, NULL, data_len); | |
951 | ||
952 | dev_queue_xmit(skb); | |
953 | return 1; | |
954 | ||
955 | abort: | |
956 | kfree_skb(skb); | |
957 | return 1; | |
958 | } | |
959 | ||
960 | /************************************************************************ | |
961 | * | |
962 | * xmit function called by generic PPP driver | |
963 | * sends PPP frame over PPPoE socket | |
964 | * | |
965 | ***********************************************************************/ | |
966 | static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb) | |
967 | { | |
968 | struct sock *sk = (struct sock *)chan->private; | |
969 | return __pppoe_xmit(sk, skb); | |
970 | } | |
971 | ||
972 | static const struct ppp_channel_ops pppoe_chan_ops = { | |
973 | .start_xmit = pppoe_xmit, | |
974 | }; | |
975 | ||
976 | static int pppoe_recvmsg(struct socket *sock, struct msghdr *m, | |
977 | size_t total_len, int flags) | |
978 | { | |
979 | struct sock *sk = sock->sk; | |
980 | struct sk_buff *skb; | |
981 | int error = 0; | |
982 | ||
983 | if (sk->sk_state & PPPOX_BOUND) { | |
984 | error = -EIO; | |
985 | goto end; | |
986 | } | |
987 | ||
988 | skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, | |
989 | flags & MSG_DONTWAIT, &error); | |
990 | if (error < 0) | |
991 | goto end; | |
992 | ||
993 | if (skb) { | |
994 | total_len = min_t(size_t, total_len, skb->len); | |
995 | error = skb_copy_datagram_msg(skb, 0, m, total_len); | |
996 | if (error == 0) { | |
997 | consume_skb(skb); | |
998 | return total_len; | |
999 | } | |
1000 | } | |
1001 | ||
1002 | kfree_skb(skb); | |
1003 | end: | |
1004 | return error; | |
1005 | } | |
1006 | ||
1007 | #ifdef CONFIG_PROC_FS | |
1008 | static int pppoe_seq_show(struct seq_file *seq, void *v) | |
1009 | { | |
1010 | struct pppox_sock *po; | |
1011 | char *dev_name; | |
1012 | ||
1013 | if (v == SEQ_START_TOKEN) { | |
1014 | seq_puts(seq, "Id Address Device\n"); | |
1015 | goto out; | |
1016 | } | |
1017 | ||
1018 | po = v; | |
1019 | dev_name = po->pppoe_pa.dev; | |
1020 | ||
1021 | seq_printf(seq, "%08X %pM %8s\n", | |
1022 | po->pppoe_pa.sid, po->pppoe_pa.remote, dev_name); | |
1023 | out: | |
1024 | return 0; | |
1025 | } | |
1026 | ||
1027 | static inline struct pppox_sock *pppoe_get_idx(struct pppoe_net *pn, loff_t pos) | |
1028 | { | |
1029 | struct pppox_sock *po; | |
1030 | int i; | |
1031 | ||
1032 | for (i = 0; i < PPPOE_HASH_SIZE; i++) { | |
1033 | po = pn->hash_table[i]; | |
1034 | while (po) { | |
1035 | if (!pos--) | |
1036 | goto out; | |
1037 | po = po->next; | |
1038 | } | |
1039 | } | |
1040 | ||
1041 | out: | |
1042 | return po; | |
1043 | } | |
1044 | ||
1045 | static void *pppoe_seq_start(struct seq_file *seq, loff_t *pos) | |
1046 | __acquires(pn->hash_lock) | |
1047 | { | |
1048 | struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); | |
1049 | loff_t l = *pos; | |
1050 | ||
1051 | read_lock_bh(&pn->hash_lock); | |
1052 | return l ? pppoe_get_idx(pn, --l) : SEQ_START_TOKEN; | |
1053 | } | |
1054 | ||
1055 | static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos) | |
1056 | { | |
1057 | struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); | |
1058 | struct pppox_sock *po; | |
1059 | ||
1060 | ++*pos; | |
1061 | if (v == SEQ_START_TOKEN) { | |
1062 | po = pppoe_get_idx(pn, 0); | |
1063 | goto out; | |
1064 | } | |
1065 | po = v; | |
1066 | if (po->next) | |
1067 | po = po->next; | |
1068 | else { | |
1069 | int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); | |
1070 | ||
1071 | po = NULL; | |
1072 | while (++hash < PPPOE_HASH_SIZE) { | |
1073 | po = pn->hash_table[hash]; | |
1074 | if (po) | |
1075 | break; | |
1076 | } | |
1077 | } | |
1078 | ||
1079 | out: | |
1080 | return po; | |
1081 | } | |
1082 | ||
1083 | static void pppoe_seq_stop(struct seq_file *seq, void *v) | |
1084 | __releases(pn->hash_lock) | |
1085 | { | |
1086 | struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); | |
1087 | read_unlock_bh(&pn->hash_lock); | |
1088 | } | |
1089 | ||
1090 | static const struct seq_operations pppoe_seq_ops = { | |
1091 | .start = pppoe_seq_start, | |
1092 | .next = pppoe_seq_next, | |
1093 | .stop = pppoe_seq_stop, | |
1094 | .show = pppoe_seq_show, | |
1095 | }; | |
1096 | ||
1097 | static int pppoe_seq_open(struct inode *inode, struct file *file) | |
1098 | { | |
1099 | return seq_open_net(inode, file, &pppoe_seq_ops, | |
1100 | sizeof(struct seq_net_private)); | |
1101 | } | |
1102 | ||
1103 | static const struct file_operations pppoe_seq_fops = { | |
1104 | .owner = THIS_MODULE, | |
1105 | .open = pppoe_seq_open, | |
1106 | .read = seq_read, | |
1107 | .llseek = seq_lseek, | |
1108 | .release = seq_release_net, | |
1109 | }; | |
1110 | ||
1111 | #endif /* CONFIG_PROC_FS */ | |
1112 | ||
1113 | static const struct proto_ops pppoe_ops = { | |
1114 | .family = AF_PPPOX, | |
1115 | .owner = THIS_MODULE, | |
1116 | .release = pppoe_release, | |
1117 | .bind = sock_no_bind, | |
1118 | .connect = pppoe_connect, | |
1119 | .socketpair = sock_no_socketpair, | |
1120 | .accept = sock_no_accept, | |
1121 | .getname = pppoe_getname, | |
1122 | .poll = datagram_poll, | |
1123 | .listen = sock_no_listen, | |
1124 | .shutdown = sock_no_shutdown, | |
1125 | .setsockopt = sock_no_setsockopt, | |
1126 | .getsockopt = sock_no_getsockopt, | |
1127 | .sendmsg = pppoe_sendmsg, | |
1128 | .recvmsg = pppoe_recvmsg, | |
1129 | .mmap = sock_no_mmap, | |
1130 | .ioctl = pppox_ioctl, | |
1131 | }; | |
1132 | ||
1133 | static const struct pppox_proto pppoe_proto = { | |
1134 | .create = pppoe_create, | |
1135 | .ioctl = pppoe_ioctl, | |
1136 | .owner = THIS_MODULE, | |
1137 | }; | |
1138 | ||
1139 | static __net_init int pppoe_init_net(struct net *net) | |
1140 | { | |
1141 | struct pppoe_net *pn = pppoe_pernet(net); | |
1142 | struct proc_dir_entry *pde; | |
1143 | ||
1144 | rwlock_init(&pn->hash_lock); | |
1145 | ||
1146 | pde = proc_create("pppoe", S_IRUGO, net->proc_net, &pppoe_seq_fops); | |
1147 | #ifdef CONFIG_PROC_FS | |
1148 | if (!pde) | |
1149 | return -ENOMEM; | |
1150 | #endif | |
1151 | ||
1152 | return 0; | |
1153 | } | |
1154 | ||
1155 | static __net_exit void pppoe_exit_net(struct net *net) | |
1156 | { | |
1157 | remove_proc_entry("pppoe", net->proc_net); | |
1158 | } | |
1159 | ||
1160 | static struct pernet_operations pppoe_net_ops = { | |
1161 | .init = pppoe_init_net, | |
1162 | .exit = pppoe_exit_net, | |
1163 | .id = &pppoe_net_id, | |
1164 | .size = sizeof(struct pppoe_net), | |
1165 | }; | |
1166 | ||
1167 | static int __init pppoe_init(void) | |
1168 | { | |
1169 | int err; | |
1170 | ||
1171 | err = register_pernet_device(&pppoe_net_ops); | |
1172 | if (err) | |
1173 | goto out; | |
1174 | ||
1175 | err = proto_register(&pppoe_sk_proto, 0); | |
1176 | if (err) | |
1177 | goto out_unregister_net_ops; | |
1178 | ||
1179 | err = register_pppox_proto(PX_PROTO_OE, &pppoe_proto); | |
1180 | if (err) | |
1181 | goto out_unregister_pppoe_proto; | |
1182 | ||
1183 | dev_add_pack(&pppoes_ptype); | |
1184 | dev_add_pack(&pppoed_ptype); | |
1185 | register_netdevice_notifier(&pppoe_notifier); | |
1186 | ||
1187 | return 0; | |
1188 | ||
1189 | out_unregister_pppoe_proto: | |
1190 | proto_unregister(&pppoe_sk_proto); | |
1191 | out_unregister_net_ops: | |
1192 | unregister_pernet_device(&pppoe_net_ops); | |
1193 | out: | |
1194 | return err; | |
1195 | } | |
1196 | ||
1197 | static void __exit pppoe_exit(void) | |
1198 | { | |
1199 | unregister_netdevice_notifier(&pppoe_notifier); | |
1200 | dev_remove_pack(&pppoed_ptype); | |
1201 | dev_remove_pack(&pppoes_ptype); | |
1202 | unregister_pppox_proto(PX_PROTO_OE); | |
1203 | proto_unregister(&pppoe_sk_proto); | |
1204 | unregister_pernet_device(&pppoe_net_ops); | |
1205 | } | |
1206 | ||
1207 | module_init(pppoe_init); | |
1208 | module_exit(pppoe_exit); | |
1209 | ||
1210 | MODULE_AUTHOR("Michal Ostrowski <mostrows@speakeasy.net>"); | |
1211 | MODULE_DESCRIPTION("PPP over Ethernet driver"); | |
1212 | MODULE_LICENSE("GPL"); | |
1213 | MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OE); |