1 /* 2 * INET An implementation of the TCP/IP protocol suite for the LINUX 3 * operating system. INET is implemented using the BSD Socket 4 * interface as the means of communication with the user level. 5 * 6 * PACKET - implements raw packet sockets. 7 * 8 * Version: $Id: af_packet.c,v 1.61 2002/02/08 03:57:19 davem Exp $ 9 * 10 * Authors: Ross Biro 11 * Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG> 12 * Alan Cox, <gw4pts@gw4pts.ampr.org> 13 * 14 * Fixes: 15 * Alan Cox : verify_area() now used correctly 16 * Alan Cox : new skbuff lists, look ma no backlogs! 17 * Alan Cox : tidied skbuff lists. 18 * Alan Cox : Now uses generic datagram routines I 19 * added. Also fixed the peek/read crash 20 * from all old Linux datagram code. 21 * Alan Cox : Uses the improved datagram code. 22 * Alan Cox : Added NULL's for socket options. 23 * Alan Cox : Re-commented the code. 24 * Alan Cox : Use new kernel side addressing 25 * Rob Janssen : Correct MTU usage. 26 * Dave Platt : Counter leaks caused by incorrect 27 * interrupt locking and some slightly 28 * dubious gcc output. Can you read 29 * compiler: it said _VOLATILE_ 30 * Richard Kooijman : Timestamp fixes. 31 * Alan Cox : New buffers. Use sk->mac.raw. 32 * Alan Cox : sendmsg/recvmsg support. 33 * Alan Cox : Protocol setting support 34 * Alexey Kuznetsov : Untied from IPv4 stack. 35 * Cyrus Durgin : Fixed kerneld for kmod. 36 * Michal Ostrowski : Module initialization cleanup. 37 * Ulises Alonso : Frame number limit removal and 38 * packet_set_ring memory leak. 39 * Eric Biederman : Allow for > 8 byte hardware addresses. 40 * The convention is that longer addresses 41 * will simply extend the hardware address 42 * byte arrays at the end of sockaddr_ll 43 * and packet_mreq. 44 * 45 * This program is free software; you can redistribute it and/or 46 * modify it under the terms of the GNU General Public License 47 * as published by the Free Software Foundation; either version 48 * 2 of the License, or (at your option) any later version. 49 * 50 */ 51 52 #include <linux/types.h> 53 #include <linux/mm.h> 54 #include <linux/capability.h> 55 #include <linux/fcntl.h> 56 #include <linux/socket.h> 57 #include <linux/in.h> 58 #include <linux/inet.h> 59 #include <linux/netdevice.h> 60 #include <linux/if_packet.h> 61 #include <linux/wireless.h> 62 #include <linux/kernel.h> 63 #include <linux/kmod.h> 64 #include <net/net_namespace.h> 65 #include <net/ip.h> 66 #include <net/protocol.h> 67 #include <linux/skbuff.h> 68 #include <net/sock.h> 69 #include <linux/errno.h> 70 #include <linux/timer.h> 71 #include <asm/system.h> 72 #include <asm/uaccess.h> 73 #include <asm/ioctls.h> 74 #include <asm/page.h> 75 #include <asm/cacheflush.h> 76 #include <asm/io.h> 77 #include <linux/proc_fs.h> 78 #include <linux/seq_file.h> 79 #include <linux/poll.h> 80 #include <linux/module.h> 81 #include <linux/init.h> 82 83 #ifdef CONFIG_INET 84 #include <net/inet_common.h> 85 #endif 86 87 /* 88 Assumptions: 89 - if device has no dev->hard_header routine, it adds and removes ll header 90 inside itself. In this case ll header is invisible outside of device, 91 but higher levels still should reserve dev->hard_header_len. 92 Some devices are enough clever to reallocate skb, when header 93 will not fit to reserved space (tunnel), another ones are silly 94 (PPP). 95 - packet socket receives packets with pulled ll header, 96 so that SOCK_RAW should push it back. 97 98 On receive: 99 ----------- 100 101 Incoming, dev->hard_header!=NULL 102 mac_header -> ll header 103 data -> data 104 105 Outgoing, dev->hard_header!=NULL 106 mac_header -> ll header 107 data -> ll header 108 109 Incoming, dev->hard_header==NULL 110 mac_header -> UNKNOWN position. It is very likely, that it points to ll 111 header. PPP makes it, that is wrong, because introduce 112 assymetry between rx and tx paths. 113 data -> data 114 115 Outgoing, dev->hard_header==NULL 116 mac_header -> data. ll header is still not built! 117 data -> data 118 119 Resume 120 If dev->hard_header==NULL we are unlikely to restore sensible ll header. 121 122 123 On transmit: 124 ------------ 125 126 dev->hard_header != NULL 127 mac_header -> ll header 128 data -> ll header 129 130 dev->hard_header == NULL (ll header is added by device, we cannot control it) 131 mac_header -> data 132 data -> data 133 134 We should set nh.raw on output to correct posistion, 135 packet classifier depends on it. 136 */ 137 138 /* List of all packet sockets. */ 139 static HLIST_HEAD(packet_sklist); 140 static DEFINE_RWLOCK(packet_sklist_lock); 141 142 static atomic_t packet_socks_nr; 143 144 145 /* Private packet socket structures. */ 146 147 struct packet_mclist 148 { 149 struct packet_mclist *next; 150 int ifindex; 151 int count; 152 unsigned short type; 153 unsigned short alen; 154 unsigned char addr[MAX_ADDR_LEN]; 155 }; 156 /* identical to struct packet_mreq except it has 157 * a longer address field. 158 */ 159 struct packet_mreq_max 160 { 161 int mr_ifindex; 162 unsigned short mr_type; 163 unsigned short mr_alen; 164 unsigned char mr_address[MAX_ADDR_LEN]; 165 }; 166 167 #ifdef CONFIG_PACKET_MMAP 168 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing); 169 #endif 170 171 static void packet_flush_mclist(struct sock *sk); 172 173 struct packet_sock { 174 /* struct sock has to be the first member of packet_sock */ 175 struct sock sk; 176 struct tpacket_stats stats; 177 #ifdef CONFIG_PACKET_MMAP 178 char * *pg_vec; 179 unsigned int head; 180 unsigned int frames_per_block; 181 unsigned int frame_size; 182 unsigned int frame_max; 183 int copy_thresh; 184 #endif 185 struct packet_type prot_hook; 186 spinlock_t bind_lock; 187 unsigned int running:1, /* prot_hook is attached*/ 188 auxdata:1, 189 origdev:1; 190 int ifindex; /* bound device */ 191 __be16 num; 192 struct packet_mclist *mclist; 193 #ifdef CONFIG_PACKET_MMAP 194 atomic_t mapped; 195 unsigned int pg_vec_order; 196 unsigned int pg_vec_pages; 197 unsigned int pg_vec_len; 198 #endif 199 }; 200 201 struct packet_skb_cb { 202 unsigned int origlen; 203 union { 204 struct sockaddr_pkt pkt; 205 struct sockaddr_ll ll; 206 } sa; 207 }; 208 209 #define PACKET_SKB_CB(__skb) ((struct packet_skb_cb *)((__skb)->cb)) 210 211 #ifdef CONFIG_PACKET_MMAP 212 213 static inline struct tpacket_hdr *packet_lookup_frame(struct packet_sock *po, unsigned int position) 214 { 215 unsigned int pg_vec_pos, frame_offset; 216 217 pg_vec_pos = position / po->frames_per_block; 218 frame_offset = position % po->frames_per_block; 219 220 return (struct tpacket_hdr *)(po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size)); 221 } 222 #endif 223 224 static inline struct packet_sock *pkt_sk(struct sock *sk) 225 { 226 return (struct packet_sock *)sk; 227 } 228 229 static void packet_sock_destruct(struct sock *sk) 230 { 231 BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc)); 232 BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc)); 233 234 if (!sock_flag(sk, SOCK_DEAD)) { 235 printk("Attempt to release alive packet socket: %p\n", sk); 236 return; 237 } 238 239 atomic_dec(&packet_socks_nr); 240 #ifdef PACKET_REFCNT_DEBUG 241 printk(KERN_DEBUG "PACKET socket %p is free, %d are alive\n", sk, atomic_read(&packet_socks_nr)); 242 #endif 243 } 244 245 246 static const struct proto_ops packet_ops; 247 248 static const struct proto_ops packet_ops_spkt; 249 250 static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev) 251 { 252 struct sock *sk; 253 struct sockaddr_pkt *spkt; 254 255 if (dev->nd_net != &init_net) 256 goto out; 257 258 /* 259 * When we registered the protocol we saved the socket in the data 260 * field for just this event. 261 */ 262 263 sk = pt->af_packet_priv; 264 265 /* 266 * Yank back the headers [hope the device set this 267 * right or kerboom...] 268 * 269 * Incoming packets have ll header pulled, 270 * push it back. 271 * 272 * For outgoing ones skb->data == skb_mac_header(skb) 273 * so that this procedure is noop. 274 */ 275 276 if (skb->pkt_type == PACKET_LOOPBACK) 277 goto out; 278 279 if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) 280 goto oom; 281 282 /* drop any routing info */ 283 dst_release(skb->dst); 284 skb->dst = NULL; 285 286 /* drop conntrack reference */ 287 nf_reset(skb); 288 289 spkt = &PACKET_SKB_CB(skb)->sa.pkt; 290 291 skb_push(skb, skb->data - skb_mac_header(skb)); 292 293 /* 294 * The SOCK_PACKET socket receives _all_ frames. 295 */ 296 297 spkt->spkt_family = dev->type; 298 strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device)); 299 spkt->spkt_protocol = skb->protocol; 300 301 /* 302 * Charge the memory to the socket. This is done specifically 303 * to prevent sockets using all the memory up. 304 */ 305 306 if (sock_queue_rcv_skb(sk,skb) == 0) 307 return 0; 308 309 out: 310 kfree_skb(skb); 311 oom: 312 return 0; 313 } 314 315 316 /* 317 * Output a raw packet to a device layer. This bypasses all the other 318 * protocol layers and you must therefore supply it with a complete frame 319 */ 320 321 static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock, 322 struct msghdr *msg, size_t len) 323 { 324 struct sock *sk = sock->sk; 325 struct sockaddr_pkt *saddr=(struct sockaddr_pkt *)msg->msg_name; 326 struct sk_buff *skb; 327 struct net_device *dev; 328 __be16 proto=0; 329 int err; 330 331 /* 332 * Get and verify the address. 333 */ 334 335 if (saddr) 336 { 337 if (msg->msg_namelen < sizeof(struct sockaddr)) 338 return(-EINVAL); 339 if (msg->msg_namelen==sizeof(struct sockaddr_pkt)) 340 proto=saddr->spkt_protocol; 341 } 342 else 343 return(-ENOTCONN); /* SOCK_PACKET must be sent giving an address */ 344 345 /* 346 * Find the device first to size check it 347 */ 348 349 saddr->spkt_device[13] = 0; 350 dev = dev_get_by_name(saddr->spkt_device); 351 err = -ENODEV; 352 if (dev == NULL) 353 goto out_unlock; 354 355 err = -ENETDOWN; 356 if (!(dev->flags & IFF_UP)) 357 goto out_unlock; 358 359 /* 360 * You may not queue a frame bigger than the mtu. This is the lowest level 361 * raw protocol and you must do your own fragmentation at this level. 362 */ 363 364 err = -EMSGSIZE; 365 if (len > dev->mtu + dev->hard_header_len) 366 goto out_unlock; 367 368 err = -ENOBUFS; 369 skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL); 370 371 /* 372 * If the write buffer is full, then tough. At this level the user gets to 373 * deal with the problem - do your own algorithmic backoffs. That's far 374 * more flexible. 375 */ 376 377 if (skb == NULL) 378 goto out_unlock; 379 380 /* 381 * Fill it in 382 */ 383 384 /* FIXME: Save some space for broken drivers that write a 385 * hard header at transmission time by themselves. PPP is the 386 * notable one here. This should really be fixed at the driver level. 387 */ 388 skb_reserve(skb, LL_RESERVED_SPACE(dev)); 389 skb_reset_network_header(skb); 390 391 /* Try to align data part correctly */ 392 if (dev->hard_header) { 393 skb->data -= dev->hard_header_len; 394 skb->tail -= dev->hard_header_len; 395 if (len < dev->hard_header_len) 396 skb_reset_network_header(skb); 397 } 398 399 /* Returns -EFAULT on error */ 400 err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len); 401 skb->protocol = proto; 402 skb->dev = dev; 403 skb->priority = sk->sk_priority; 404 if (err) 405 goto out_free; 406 407 /* 408 * Now send it 409 */ 410 411 dev_queue_xmit(skb); 412 dev_put(dev); 413 return(len); 414 415 out_free: 416 kfree_skb(skb); 417 out_unlock: 418 if (dev) 419 dev_put(dev); 420 return err; 421 } 422 423 static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk, 424 unsigned int res) 425 { 426 struct sk_filter *filter; 427 428 rcu_read_lock_bh(); 429 filter = rcu_dereference(sk->sk_filter); 430 if (filter != NULL) 431 res = sk_run_filter(skb, filter->insns, filter->len); 432 rcu_read_unlock_bh(); 433 434 return res; 435 } 436 437 /* 438 This function makes lazy skb cloning in hope that most of packets 439 are discarded by BPF. 440 441 Note tricky part: we DO mangle shared skb! skb->data, skb->len 442 and skb->cb are mangled. It works because (and until) packets 443 falling here are owned by current CPU. Output packets are cloned 444 by dev_queue_xmit_nit(), input packets are processed by net_bh 445 sequencially, so that if we return skb to original state on exit, 446 we will not harm anyone. 447 */ 448 449 static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev) 450 { 451 struct sock *sk; 452 struct sockaddr_ll *sll; 453 struct packet_sock *po; 454 u8 * skb_head = skb->data; 455 int skb_len = skb->len; 456 unsigned int snaplen, res; 457 458 if (dev->nd_net != &init_net) 459 goto drop; 460 461 if (skb->pkt_type == PACKET_LOOPBACK) 462 goto drop; 463 464 sk = pt->af_packet_priv; 465 po = pkt_sk(sk); 466 467 skb->dev = dev; 468 469 if (dev->hard_header) { 470 /* The device has an explicit notion of ll header, 471 exported to higher levels. 472 473 Otherwise, the device hides datails of it frame 474 structure, so that corresponding packet head 475 never delivered to user. 476 */ 477 if (sk->sk_type != SOCK_DGRAM) 478 skb_push(skb, skb->data - skb_mac_header(skb)); 479 else if (skb->pkt_type == PACKET_OUTGOING) { 480 /* Special case: outgoing packets have ll header at head */ 481 skb_pull(skb, skb_network_offset(skb)); 482 } 483 } 484 485 snaplen = skb->len; 486 487 res = run_filter(skb, sk, snaplen); 488 if (!res) 489 goto drop_n_restore; 490 if (snaplen > res) 491 snaplen = res; 492 493 if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >= 494 (unsigned)sk->sk_rcvbuf) 495 goto drop_n_acct; 496 497 if (skb_shared(skb)) { 498 struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC); 499 if (nskb == NULL) 500 goto drop_n_acct; 501 502 if (skb_head != skb->data) { 503 skb->data = skb_head; 504 skb->len = skb_len; 505 } 506 kfree_skb(skb); 507 skb = nskb; 508 } 509 510 BUILD_BUG_ON(sizeof(*PACKET_SKB_CB(skb)) + MAX_ADDR_LEN - 8 > 511 sizeof(skb->cb)); 512 513 sll = &PACKET_SKB_CB(skb)->sa.ll; 514 sll->sll_family = AF_PACKET; 515 sll->sll_hatype = dev->type; 516 sll->sll_protocol = skb->protocol; 517 sll->sll_pkttype = skb->pkt_type; 518 if (unlikely(po->origdev) && skb->pkt_type == PACKET_HOST) 519 sll->sll_ifindex = orig_dev->ifindex; 520 else 521 sll->sll_ifindex = dev->ifindex; 522 sll->sll_halen = 0; 523 524 if (dev->hard_header_parse) 525 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr); 526 527 PACKET_SKB_CB(skb)->origlen = skb->len; 528 529 if (pskb_trim(skb, snaplen)) 530 goto drop_n_acct; 531 532 skb_set_owner_r(skb, sk); 533 skb->dev = NULL; 534 dst_release(skb->dst); 535 skb->dst = NULL; 536 537 /* drop conntrack reference */ 538 nf_reset(skb); 539 540 spin_lock(&sk->sk_receive_queue.lock); 541 po->stats.tp_packets++; 542 __skb_queue_tail(&sk->sk_receive_queue, skb); 543 spin_unlock(&sk->sk_receive_queue.lock); 544 sk->sk_data_ready(sk, skb->len); 545 return 0; 546 547 drop_n_acct: 548 spin_lock(&sk->sk_receive_queue.lock); 549 po->stats.tp_drops++; 550 spin_unlock(&sk->sk_receive_queue.lock); 551 552 drop_n_restore: 553 if (skb_head != skb->data && skb_shared(skb)) { 554 skb->data = skb_head; 555 skb->len = skb_len; 556 } 557 drop: 558 kfree_skb(skb); 559 return 0; 560 } 561 562 #ifdef CONFIG_PACKET_MMAP 563 static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev) 564 { 565 struct sock *sk; 566 struct packet_sock *po; 567 struct sockaddr_ll *sll; 568 struct tpacket_hdr *h; 569 u8 * skb_head = skb->data; 570 int skb_len = skb->len; 571 unsigned int snaplen, res; 572 unsigned long status = TP_STATUS_LOSING|TP_STATUS_USER; 573 unsigned short macoff, netoff; 574 struct sk_buff *copy_skb = NULL; 575 struct timeval tv; 576 577 if (dev->nd_net != &init_net) 578 goto drop; 579 580 if (skb->pkt_type == PACKET_LOOPBACK) 581 goto drop; 582 583 sk = pt->af_packet_priv; 584 po = pkt_sk(sk); 585 586 if (dev->hard_header) { 587 if (sk->sk_type != SOCK_DGRAM) 588 skb_push(skb, skb->data - skb_mac_header(skb)); 589 else if (skb->pkt_type == PACKET_OUTGOING) { 590 /* Special case: outgoing packets have ll header at head */ 591 skb_pull(skb, skb_network_offset(skb)); 592 } 593 } 594 595 if (skb->ip_summed == CHECKSUM_PARTIAL) 596 status |= TP_STATUS_CSUMNOTREADY; 597 598 snaplen = skb->len; 599 600 res = run_filter(skb, sk, snaplen); 601 if (!res) 602 goto drop_n_restore; 603 if (snaplen > res) 604 snaplen = res; 605 606 if (sk->sk_type == SOCK_DGRAM) { 607 macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16; 608 } else { 609 unsigned maclen = skb_network_offset(skb); 610 netoff = TPACKET_ALIGN(TPACKET_HDRLEN + (maclen < 16 ? 16 : maclen)); 611 macoff = netoff - maclen; 612 } 613 614 if (macoff + snaplen > po->frame_size) { 615 if (po->copy_thresh && 616 atomic_read(&sk->sk_rmem_alloc) + skb->truesize < 617 (unsigned)sk->sk_rcvbuf) { 618 if (skb_shared(skb)) { 619 copy_skb = skb_clone(skb, GFP_ATOMIC); 620 } else { 621 copy_skb = skb_get(skb); 622 skb_head = skb->data; 623 } 624 if (copy_skb) 625 skb_set_owner_r(copy_skb, sk); 626 } 627 snaplen = po->frame_size - macoff; 628 if ((int)snaplen < 0) 629 snaplen = 0; 630 } 631 632 spin_lock(&sk->sk_receive_queue.lock); 633 h = packet_lookup_frame(po, po->head); 634 635 if (h->tp_status) 636 goto ring_is_full; 637 po->head = po->head != po->frame_max ? po->head+1 : 0; 638 po->stats.tp_packets++; 639 if (copy_skb) { 640 status |= TP_STATUS_COPY; 641 __skb_queue_tail(&sk->sk_receive_queue, copy_skb); 642 } 643 if (!po->stats.tp_drops) 644 status &= ~TP_STATUS_LOSING; 645 spin_unlock(&sk->sk_receive_queue.lock); 646 647 skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen); 648 649 h->tp_len = skb->len; 650 h->tp_snaplen = snaplen; 651 h->tp_mac = macoff; 652 h->tp_net = netoff; 653 if (skb->tstamp.tv64) 654 tv = ktime_to_timeval(skb->tstamp); 655 else 656 do_gettimeofday(&tv); 657 h->tp_sec = tv.tv_sec; 658 h->tp_usec = tv.tv_usec; 659 660 sll = (struct sockaddr_ll*)((u8*)h + TPACKET_ALIGN(sizeof(*h))); 661 sll->sll_halen = 0; 662 if (dev->hard_header_parse) 663 sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr); 664 sll->sll_family = AF_PACKET; 665 sll->sll_hatype = dev->type; 666 sll->sll_protocol = skb->protocol; 667 sll->sll_pkttype = skb->pkt_type; 668 if (unlikely(po->origdev) && skb->pkt_type == PACKET_HOST) 669 sll->sll_ifindex = orig_dev->ifindex; 670 else 671 sll->sll_ifindex = dev->ifindex; 672 673 h->tp_status = status; 674 smp_mb(); 675 676 { 677 struct page *p_start, *p_end; 678 u8 *h_end = (u8 *)h + macoff + snaplen - 1; 679 680 p_start = virt_to_page(h); 681 p_end = virt_to_page(h_end); 682 while (p_start <= p_end) { 683 flush_dcache_page(p_start); 684 p_start++; 685 } 686 } 687 688 sk->sk_data_ready(sk, 0); 689 690 drop_n_restore: 691 if (skb_head != skb->data && skb_shared(skb)) { 692 skb->data = skb_head; 693 skb->len = skb_len; 694 } 695 drop: 696 kfree_skb(skb); 697 return 0; 698 699 ring_is_full: 700 po->stats.tp_drops++; 701 spin_unlock(&sk->sk_receive_queue.lock); 702 703 sk->sk_data_ready(sk, 0); 704 if (copy_skb) 705 kfree_skb(copy_skb); 706 goto drop_n_restore; 707 } 708 709 #endif 710 711 712 static int packet_sendmsg(struct kiocb *iocb, struct socket *sock, 713 struct msghdr *msg, size_t len) 714 { 715 struct sock *sk = sock->sk; 716 struct sockaddr_ll *saddr=(struct sockaddr_ll *)msg->msg_name; 717 struct sk_buff *skb; 718 struct net_device *dev; 719 __be16 proto; 720 unsigned char *addr; 721 int ifindex, err, reserve = 0; 722 723 /* 724 * Get and verify the address. 725 */ 726 727 if (saddr == NULL) { 728 struct packet_sock *po = pkt_sk(sk); 729 730 ifindex = po->ifindex; 731 proto = po->num; 732 addr = NULL; 733 } else { 734 err = -EINVAL; 735 if (msg->msg_namelen < sizeof(struct sockaddr_ll)) 736 goto out; 737 if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr))) 738 goto out; 739 ifindex = saddr->sll_ifindex; 740 proto = saddr->sll_protocol; 741 addr = saddr->sll_addr; 742 } 743 744 745 dev = dev_get_by_index(ifindex); 746 err = -ENXIO; 747 if (dev == NULL) 748 goto out_unlock; 749 if (sock->type == SOCK_RAW) 750 reserve = dev->hard_header_len; 751 752 err = -ENETDOWN; 753 if (!(dev->flags & IFF_UP)) 754 goto out_unlock; 755 756 err = -EMSGSIZE; 757 if (len > dev->mtu+reserve) 758 goto out_unlock; 759 760 skb = sock_alloc_send_skb(sk, len + LL_RESERVED_SPACE(dev), 761 msg->msg_flags & MSG_DONTWAIT, &err); 762 if (skb==NULL) 763 goto out_unlock; 764 765 skb_reserve(skb, LL_RESERVED_SPACE(dev)); 766 skb_reset_network_header(skb); 767 768 if (dev->hard_header) { 769 int res; 770 err = -EINVAL; 771 res = dev->hard_header(skb, dev, ntohs(proto), addr, NULL, len); 772 if (sock->type != SOCK_DGRAM) { 773 skb_reset_tail_pointer(skb); 774 skb->len = 0; 775 } else if (res < 0) 776 goto out_free; 777 } 778 779 /* Returns -EFAULT on error */ 780 err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len); 781 if (err) 782 goto out_free; 783 784 skb->protocol = proto; 785 skb->dev = dev; 786 skb->priority = sk->sk_priority; 787 788 /* 789 * Now send it 790 */ 791 792 err = dev_queue_xmit(skb); 793 if (err > 0 && (err = net_xmit_errno(err)) != 0) 794 goto out_unlock; 795 796 dev_put(dev); 797 798 return(len); 799 800 out_free: 801 kfree_skb(skb); 802 out_unlock: 803 if (dev) 804 dev_put(dev); 805 out: 806 return err; 807 } 808 809 /* 810 * Close a PACKET socket. This is fairly simple. We immediately go 811 * to 'closed' state and remove our protocol entry in the device list. 812 */ 813 814 static int packet_release(struct socket *sock) 815 { 816 struct sock *sk = sock->sk; 817 struct packet_sock *po; 818 819 if (!sk) 820 return 0; 821 822 po = pkt_sk(sk); 823 824 write_lock_bh(&packet_sklist_lock); 825 sk_del_node_init(sk); 826 write_unlock_bh(&packet_sklist_lock); 827 828 /* 829 * Unhook packet receive handler. 830 */ 831 832 if (po->running) { 833 /* 834 * Remove the protocol hook 835 */ 836 dev_remove_pack(&po->prot_hook); 837 po->running = 0; 838 po->num = 0; 839 __sock_put(sk); 840 } 841 842 packet_flush_mclist(sk); 843 844 #ifdef CONFIG_PACKET_MMAP 845 if (po->pg_vec) { 846 struct tpacket_req req; 847 memset(&req, 0, sizeof(req)); 848 packet_set_ring(sk, &req, 1); 849 } 850 #endif 851 852 /* 853 * Now the socket is dead. No more input will appear. 854 */ 855 856 sock_orphan(sk); 857 sock->sk = NULL; 858 859 /* Purge queues */ 860 861 skb_queue_purge(&sk->sk_receive_queue); 862 863 sock_put(sk); 864 return 0; 865 } 866 867 /* 868 * Attach a packet hook. 869 */ 870 871 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protocol) 872 { 873 struct packet_sock *po = pkt_sk(sk); 874 /* 875 * Detach an existing hook if present. 876 */ 877 878 lock_sock(sk); 879 880 spin_lock(&po->bind_lock); 881 if (po->running) { 882 __sock_put(sk); 883 po->running = 0; 884 po->num = 0; 885 spin_unlock(&po->bind_lock); 886 dev_remove_pack(&po->prot_hook); 887 spin_lock(&po->bind_lock); 888 } 889 890 po->num = protocol; 891 po->prot_hook.type = protocol; 892 po->prot_hook.dev = dev; 893 894 po->ifindex = dev ? dev->ifindex : 0; 895 896 if (protocol == 0) 897 goto out_unlock; 898 899 if (dev) { 900 if (dev->flags&IFF_UP) { 901 dev_add_pack(&po->prot_hook); 902 sock_hold(sk); 903 po->running = 1; 904 } else { 905 sk->sk_err = ENETDOWN; 906 if (!sock_flag(sk, SOCK_DEAD)) 907 sk->sk_error_report(sk); 908 } 909 } else { 910 dev_add_pack(&po->prot_hook); 911 sock_hold(sk); 912 po->running = 1; 913 } 914 915 out_unlock: 916 spin_unlock(&po->bind_lock); 917 release_sock(sk); 918 return 0; 919 } 920 921 /* 922 * Bind a packet socket to a device 923 */ 924 925 static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len) 926 { 927 struct sock *sk=sock->sk; 928 char name[15]; 929 struct net_device *dev; 930 int err = -ENODEV; 931 932 /* 933 * Check legality 934 */ 935 936 if (addr_len != sizeof(struct sockaddr)) 937 return -EINVAL; 938 strlcpy(name,uaddr->sa_data,sizeof(name)); 939 940 dev = dev_get_by_name(name); 941 if (dev) { 942 err = packet_do_bind(sk, dev, pkt_sk(sk)->num); 943 dev_put(dev); 944 } 945 return err; 946 } 947 948 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) 949 { 950 struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr; 951 struct sock *sk=sock->sk; 952 struct net_device *dev = NULL; 953 int err; 954 955 956 /* 957 * Check legality 958 */ 959 960 if (addr_len < sizeof(struct sockaddr_ll)) 961 return -EINVAL; 962 if (sll->sll_family != AF_PACKET) 963 return -EINVAL; 964 965 if (sll->sll_ifindex) { 966 err = -ENODEV; 967 dev = dev_get_by_index(sll->sll_ifindex); 968 if (dev == NULL) 969 goto out; 970 } 971 err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num); 972 if (dev) 973 dev_put(dev); 974 975 out: 976 return err; 977 } 978 979 static struct proto packet_proto = { 980 .name = "PACKET", 981 .owner = THIS_MODULE, 982 .obj_size = sizeof(struct packet_sock), 983 }; 984 985 /* 986 * Create a packet of type SOCK_PACKET. 987 */ 988 989 static int packet_create(struct net *net, struct socket *sock, int protocol) 990 { 991 struct sock *sk; 992 struct packet_sock *po; 993 __be16 proto = (__force __be16)protocol; /* weird, but documented */ 994 int err; 995 996 if (net != &init_net) 997 return -EAFNOSUPPORT; 998 999 if (!capable(CAP_NET_RAW)) 1000 return -EPERM; 1001 if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW && 1002 sock->type != SOCK_PACKET) 1003 return -ESOCKTNOSUPPORT; 1004 1005 sock->state = SS_UNCONNECTED; 1006 1007 err = -ENOBUFS; 1008 sk = sk_alloc(net, PF_PACKET, GFP_KERNEL, &packet_proto, 1); 1009 if (sk == NULL) 1010 goto out; 1011 1012 sock->ops = &packet_ops; 1013 if (sock->type == SOCK_PACKET) 1014 sock->ops = &packet_ops_spkt; 1015 1016 sock_init_data(sock, sk); 1017 1018 po = pkt_sk(sk); 1019 sk->sk_family = PF_PACKET; 1020 po->num = proto; 1021 1022 sk->sk_destruct = packet_sock_destruct; 1023 atomic_inc(&packet_socks_nr); 1024 1025 /* 1026 * Attach a protocol block 1027 */ 1028 1029 spin_lock_init(&po->bind_lock); 1030 po->prot_hook.func = packet_rcv; 1031 1032 if (sock->type == SOCK_PACKET) 1033 po->prot_hook.func = packet_rcv_spkt; 1034 1035 po->prot_hook.af_packet_priv = sk; 1036 1037 if (proto) { 1038 po->prot_hook.type = proto; 1039 dev_add_pack(&po->prot_hook); 1040 sock_hold(sk); 1041 po->running = 1; 1042 } 1043 1044 write_lock_bh(&packet_sklist_lock); 1045 sk_add_node(sk, &packet_sklist); 1046 write_unlock_bh(&packet_sklist_lock); 1047 return(0); 1048 out: 1049 return err; 1050 } 1051 1052 /* 1053 * Pull a packet from our receive queue and hand it to the user. 1054 * If necessary we block. 1055 */ 1056 1057 static int packet_recvmsg(struct kiocb *iocb, struct socket *sock, 1058 struct msghdr *msg, size_t len, int flags) 1059 { 1060 struct sock *sk = sock->sk; 1061 struct sk_buff *skb; 1062 int copied, err; 1063 struct sockaddr_ll *sll; 1064 1065 err = -EINVAL; 1066 if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT)) 1067 goto out; 1068 1069 #if 0 1070 /* What error should we return now? EUNATTACH? */ 1071 if (pkt_sk(sk)->ifindex < 0) 1072 return -ENODEV; 1073 #endif 1074 1075 /* 1076 * Call the generic datagram receiver. This handles all sorts 1077 * of horrible races and re-entrancy so we can forget about it 1078 * in the protocol layers. 1079 * 1080 * Now it will return ENETDOWN, if device have just gone down, 1081 * but then it will block. 1082 */ 1083 1084 skb=skb_recv_datagram(sk,flags,flags&MSG_DONTWAIT,&err); 1085 1086 /* 1087 * An error occurred so return it. Because skb_recv_datagram() 1088 * handles the blocking we don't see and worry about blocking 1089 * retries. 1090 */ 1091 1092 if (skb == NULL) 1093 goto out; 1094 1095 /* 1096 * If the address length field is there to be filled in, we fill 1097 * it in now. 1098 */ 1099 1100 sll = &PACKET_SKB_CB(skb)->sa.ll; 1101 if (sock->type == SOCK_PACKET) 1102 msg->msg_namelen = sizeof(struct sockaddr_pkt); 1103 else 1104 msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr); 1105 1106 /* 1107 * You lose any data beyond the buffer you gave. If it worries a 1108 * user program they can ask the device for its MTU anyway. 1109 */ 1110 1111 copied = skb->len; 1112 if (copied > len) 1113 { 1114 copied=len; 1115 msg->msg_flags|=MSG_TRUNC; 1116 } 1117 1118 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied); 1119 if (err) 1120 goto out_free; 1121 1122 sock_recv_timestamp(msg, sk, skb); 1123 1124 if (msg->msg_name) 1125 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, 1126 msg->msg_namelen); 1127 1128 if (pkt_sk(sk)->auxdata) { 1129 struct tpacket_auxdata aux; 1130 1131 aux.tp_status = TP_STATUS_USER; 1132 if (skb->ip_summed == CHECKSUM_PARTIAL) 1133 aux.tp_status |= TP_STATUS_CSUMNOTREADY; 1134 aux.tp_len = PACKET_SKB_CB(skb)->origlen; 1135 aux.tp_snaplen = skb->len; 1136 aux.tp_mac = 0; 1137 aux.tp_net = skb_network_offset(skb); 1138 1139 put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux); 1140 } 1141 1142 /* 1143 * Free or return the buffer as appropriate. Again this 1144 * hides all the races and re-entrancy issues from us. 1145 */ 1146 err = (flags&MSG_TRUNC) ? skb->len : copied; 1147 1148 out_free: 1149 skb_free_datagram(sk, skb); 1150 out: 1151 return err; 1152 } 1153 1154 static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr, 1155 int *uaddr_len, int peer) 1156 { 1157 struct net_device *dev; 1158 struct sock *sk = sock->sk; 1159 1160 if (peer) 1161 return -EOPNOTSUPP; 1162 1163 uaddr->sa_family = AF_PACKET; 1164 dev = dev_get_by_index(pkt_sk(sk)->ifindex); 1165 if (dev) { 1166 strlcpy(uaddr->sa_data, dev->name, 15); 1167 dev_put(dev); 1168 } else 1169 memset(uaddr->sa_data, 0, 14); 1170 *uaddr_len = sizeof(*uaddr); 1171 1172 return 0; 1173 } 1174 1175 static int packet_getname(struct socket *sock, struct sockaddr *uaddr, 1176 int *uaddr_len, int peer) 1177 { 1178 struct net_device *dev; 1179 struct sock *sk = sock->sk; 1180 struct packet_sock *po = pkt_sk(sk); 1181 struct sockaddr_ll *sll = (struct sockaddr_ll*)uaddr; 1182 1183 if (peer) 1184 return -EOPNOTSUPP; 1185 1186 sll->sll_family = AF_PACKET; 1187 sll->sll_ifindex = po->ifindex; 1188 sll->sll_protocol = po->num; 1189 dev = dev_get_by_index(po->ifindex); 1190 if (dev) { 1191 sll->sll_hatype = dev->type; 1192 sll->sll_halen = dev->addr_len; 1193 memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len); 1194 dev_put(dev); 1195 } else { 1196 sll->sll_hatype = 0; /* Bad: we have no ARPHRD_UNSPEC */ 1197 sll->sll_halen = 0; 1198 } 1199 *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen; 1200 1201 return 0; 1202 } 1203 1204 static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int what) 1205 { 1206 switch (i->type) { 1207 case PACKET_MR_MULTICAST: 1208 if (what > 0) 1209 dev_mc_add(dev, i->addr, i->alen, 0); 1210 else 1211 dev_mc_delete(dev, i->addr, i->alen, 0); 1212 break; 1213 case PACKET_MR_PROMISC: 1214 dev_set_promiscuity(dev, what); 1215 break; 1216 case PACKET_MR_ALLMULTI: 1217 dev_set_allmulti(dev, what); 1218 break; 1219 default:; 1220 } 1221 } 1222 1223 static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what) 1224 { 1225 for ( ; i; i=i->next) { 1226 if (i->ifindex == dev->ifindex) 1227 packet_dev_mc(dev, i, what); 1228 } 1229 } 1230 1231 static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq) 1232 { 1233 struct packet_sock *po = pkt_sk(sk); 1234 struct packet_mclist *ml, *i; 1235 struct net_device *dev; 1236 int err; 1237 1238 rtnl_lock(); 1239 1240 err = -ENODEV; 1241 dev = __dev_get_by_index(mreq->mr_ifindex); 1242 if (!dev) 1243 goto done; 1244 1245 err = -EINVAL; 1246 if (mreq->mr_alen > dev->addr_len) 1247 goto done; 1248 1249 err = -ENOBUFS; 1250 i = kmalloc(sizeof(*i), GFP_KERNEL); 1251 if (i == NULL) 1252 goto done; 1253 1254 err = 0; 1255 for (ml = po->mclist; ml; ml = ml->next) { 1256 if (ml->ifindex == mreq->mr_ifindex && 1257 ml->type == mreq->mr_type && 1258 ml->alen == mreq->mr_alen && 1259 memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) { 1260 ml->count++; 1261 /* Free the new element ... */ 1262 kfree(i); 1263 goto done; 1264 } 1265 } 1266 1267 i->type = mreq->mr_type; 1268 i->ifindex = mreq->mr_ifindex; 1269 i->alen = mreq->mr_alen; 1270 memcpy(i->addr, mreq->mr_address, i->alen); 1271 i->count = 1; 1272 i->next = po->mclist; 1273 po->mclist = i; 1274 packet_dev_mc(dev, i, +1); 1275 1276 done: 1277 rtnl_unlock(); 1278 return err; 1279 } 1280 1281 static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq) 1282 { 1283 struct packet_mclist *ml, **mlp; 1284 1285 rtnl_lock(); 1286 1287 for (mlp = &pkt_sk(sk)->mclist; (ml = *mlp) != NULL; mlp = &ml->next) { 1288 if (ml->ifindex == mreq->mr_ifindex && 1289 ml->type == mreq->mr_type && 1290 ml->alen == mreq->mr_alen && 1291 memcmp(ml->addr, mreq->mr_address, ml->alen) == 0) { 1292 if (--ml->count == 0) { 1293 struct net_device *dev; 1294 *mlp = ml->next; 1295 dev = dev_get_by_index(ml->ifindex); 1296 if (dev) { 1297 packet_dev_mc(dev, ml, -1); 1298 dev_put(dev); 1299 } 1300 kfree(ml); 1301 } 1302 rtnl_unlock(); 1303 return 0; 1304 } 1305 } 1306 rtnl_unlock(); 1307 return -EADDRNOTAVAIL; 1308 } 1309 1310 static void packet_flush_mclist(struct sock *sk) 1311 { 1312 struct packet_sock *po = pkt_sk(sk); 1313 struct packet_mclist *ml; 1314 1315 if (!po->mclist) 1316 return; 1317 1318 rtnl_lock(); 1319 while ((ml = po->mclist) != NULL) { 1320 struct net_device *dev; 1321 1322 po->mclist = ml->next; 1323 if ((dev = dev_get_by_index(ml->ifindex)) != NULL) { 1324 packet_dev_mc(dev, ml, -1); 1325 dev_put(dev); 1326 } 1327 kfree(ml); 1328 } 1329 rtnl_unlock(); 1330 } 1331 1332 static int 1333 packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen) 1334 { 1335 struct sock *sk = sock->sk; 1336 struct packet_sock *po = pkt_sk(sk); 1337 int ret; 1338 1339 if (level != SOL_PACKET) 1340 return -ENOPROTOOPT; 1341 1342 switch(optname) { 1343 case PACKET_ADD_MEMBERSHIP: 1344 case PACKET_DROP_MEMBERSHIP: 1345 { 1346 struct packet_mreq_max mreq; 1347 int len = optlen; 1348 memset(&mreq, 0, sizeof(mreq)); 1349 if (len < sizeof(struct packet_mreq)) 1350 return -EINVAL; 1351 if (len > sizeof(mreq)) 1352 len = sizeof(mreq); 1353 if (copy_from_user(&mreq,optval,len)) 1354 return -EFAULT; 1355 if (len < (mreq.mr_alen + offsetof(struct packet_mreq, mr_address))) 1356 return -EINVAL; 1357 if (optname == PACKET_ADD_MEMBERSHIP) 1358 ret = packet_mc_add(sk, &mreq); 1359 else 1360 ret = packet_mc_drop(sk, &mreq); 1361 return ret; 1362 } 1363 1364 #ifdef CONFIG_PACKET_MMAP 1365 case PACKET_RX_RING: 1366 { 1367 struct tpacket_req req; 1368 1369 if (optlen<sizeof(req)) 1370 return -EINVAL; 1371 if (copy_from_user(&req,optval,sizeof(req))) 1372 return -EFAULT; 1373 return packet_set_ring(sk, &req, 0); 1374 } 1375 case PACKET_COPY_THRESH: 1376 { 1377 int val; 1378 1379 if (optlen!=sizeof(val)) 1380 return -EINVAL; 1381 if (copy_from_user(&val,optval,sizeof(val))) 1382 return -EFAULT; 1383 1384 pkt_sk(sk)->copy_thresh = val; 1385 return 0; 1386 } 1387 #endif 1388 case PACKET_AUXDATA: 1389 { 1390 int val; 1391 1392 if (optlen < sizeof(val)) 1393 return -EINVAL; 1394 if (copy_from_user(&val, optval, sizeof(val))) 1395 return -EFAULT; 1396 1397 po->auxdata = !!val; 1398 return 0; 1399 } 1400 case PACKET_ORIGDEV: 1401 { 1402 int val; 1403 1404 if (optlen < sizeof(val)) 1405 return -EINVAL; 1406 if (copy_from_user(&val, optval, sizeof(val))) 1407 return -EFAULT; 1408 1409 po->origdev = !!val; 1410 return 0; 1411 } 1412 default: 1413 return -ENOPROTOOPT; 1414 } 1415 } 1416 1417 static int packet_getsockopt(struct socket *sock, int level, int optname, 1418 char __user *optval, int __user *optlen) 1419 { 1420 int len; 1421 int val; 1422 struct sock *sk = sock->sk; 1423 struct packet_sock *po = pkt_sk(sk); 1424 void *data; 1425 struct tpacket_stats st; 1426 1427 if (level != SOL_PACKET) 1428 return -ENOPROTOOPT; 1429 1430 if (get_user(len, optlen)) 1431 return -EFAULT; 1432 1433 if (len < 0) 1434 return -EINVAL; 1435 1436 switch(optname) { 1437 case PACKET_STATISTICS: 1438 if (len > sizeof(struct tpacket_stats)) 1439 len = sizeof(struct tpacket_stats); 1440 spin_lock_bh(&sk->sk_receive_queue.lock); 1441 st = po->stats; 1442 memset(&po->stats, 0, sizeof(st)); 1443 spin_unlock_bh(&sk->sk_receive_queue.lock); 1444 st.tp_packets += st.tp_drops; 1445 1446 data = &st; 1447 break; 1448 case PACKET_AUXDATA: 1449 if (len > sizeof(int)) 1450 len = sizeof(int); 1451 val = po->auxdata; 1452 1453 data = &val; 1454 break; 1455 case PACKET_ORIGDEV: 1456 if (len > sizeof(int)) 1457 len = sizeof(int); 1458 val = po->origdev; 1459 1460 data = &val; 1461 break; 1462 default: 1463 return -ENOPROTOOPT; 1464 } 1465 1466 if (put_user(len, optlen)) 1467 return -EFAULT; 1468 if (copy_to_user(optval, data, len)) 1469 return -EFAULT; 1470 return 0; 1471 } 1472 1473 1474 static int packet_notifier(struct notifier_block *this, unsigned long msg, void *data) 1475 { 1476 struct sock *sk; 1477 struct hlist_node *node; 1478 struct net_device *dev = data; 1479 1480 read_lock(&packet_sklist_lock); 1481 sk_for_each(sk, node, &packet_sklist) { 1482 struct packet_sock *po = pkt_sk(sk); 1483 1484 switch (msg) { 1485 case NETDEV_UNREGISTER: 1486 if (po->mclist) 1487 packet_dev_mclist(dev, po->mclist, -1); 1488 /* fallthrough */ 1489 1490 case NETDEV_DOWN: 1491 if (dev->ifindex == po->ifindex) { 1492 spin_lock(&po->bind_lock); 1493 if (po->running) { 1494 __dev_remove_pack(&po->prot_hook); 1495 __sock_put(sk); 1496 po->running = 0; 1497 sk->sk_err = ENETDOWN; 1498 if (!sock_flag(sk, SOCK_DEAD)) 1499 sk->sk_error_report(sk); 1500 } 1501 if (msg == NETDEV_UNREGISTER) { 1502 po->ifindex = -1; 1503 po->prot_hook.dev = NULL; 1504 } 1505 spin_unlock(&po->bind_lock); 1506 } 1507 break; 1508 case NETDEV_UP: 1509 spin_lock(&po->bind_lock); 1510 if (dev->ifindex == po->ifindex && po->num && 1511 !po->running) { 1512 dev_add_pack(&po->prot_hook); 1513 sock_hold(sk); 1514 po->running = 1; 1515 } 1516 spin_unlock(&po->bind_lock); 1517 break; 1518 } 1519 } 1520 read_unlock(&packet_sklist_lock); 1521 return NOTIFY_DONE; 1522 } 1523 1524 1525 static int packet_ioctl(struct socket *sock, unsigned int cmd, 1526 unsigned long arg) 1527 { 1528 struct sock *sk = sock->sk; 1529 1530 switch(cmd) { 1531 case SIOCOUTQ: 1532 { 1533 int amount = atomic_read(&sk->sk_wmem_alloc); 1534 return put_user(amount, (int __user *)arg); 1535 } 1536 case SIOCINQ: 1537 { 1538 struct sk_buff *skb; 1539 int amount = 0; 1540 1541 spin_lock_bh(&sk->sk_receive_queue.lock); 1542 skb = skb_peek(&sk->sk_receive_queue); 1543 if (skb) 1544 amount = skb->len; 1545 spin_unlock_bh(&sk->sk_receive_queue.lock); 1546 return put_user(amount, (int __user *)arg); 1547 } 1548 case SIOCGSTAMP: 1549 return sock_get_timestamp(sk, (struct timeval __user *)arg); 1550 case SIOCGSTAMPNS: 1551 return sock_get_timestampns(sk, (struct timespec __user *)arg); 1552 1553 #ifdef CONFIG_INET 1554 case SIOCADDRT: 1555 case SIOCDELRT: 1556 case SIOCDARP: 1557 case SIOCGARP: 1558 case SIOCSARP: 1559 case SIOCGIFADDR: 1560 case SIOCSIFADDR: 1561 case SIOCGIFBRDADDR: 1562 case SIOCSIFBRDADDR: 1563 case SIOCGIFNETMASK: 1564 case SIOCSIFNETMASK: 1565 case SIOCGIFDSTADDR: 1566 case SIOCSIFDSTADDR: 1567 case SIOCSIFFLAGS: 1568 return inet_dgram_ops.ioctl(sock, cmd, arg); 1569 #endif 1570 1571 default: 1572 return -ENOIOCTLCMD; 1573 } 1574 return 0; 1575 } 1576 1577 #ifndef CONFIG_PACKET_MMAP 1578 #define packet_mmap sock_no_mmap 1579 #define packet_poll datagram_poll 1580 #else 1581 1582 static unsigned int packet_poll(struct file * file, struct socket *sock, 1583 poll_table *wait) 1584 { 1585 struct sock *sk = sock->sk; 1586 struct packet_sock *po = pkt_sk(sk); 1587 unsigned int mask = datagram_poll(file, sock, wait); 1588 1589 spin_lock_bh(&sk->sk_receive_queue.lock); 1590 if (po->pg_vec) { 1591 unsigned last = po->head ? po->head-1 : po->frame_max; 1592 struct tpacket_hdr *h; 1593 1594 h = packet_lookup_frame(po, last); 1595 1596 if (h->tp_status) 1597 mask |= POLLIN | POLLRDNORM; 1598 } 1599 spin_unlock_bh(&sk->sk_receive_queue.lock); 1600 return mask; 1601 } 1602 1603 1604 /* Dirty? Well, I still did not learn better way to account 1605 * for user mmaps. 1606 */ 1607 1608 static void packet_mm_open(struct vm_area_struct *vma) 1609 { 1610 struct file *file = vma->vm_file; 1611 struct socket * sock = file->private_data; 1612 struct sock *sk = sock->sk; 1613 1614 if (sk) 1615 atomic_inc(&pkt_sk(sk)->mapped); 1616 } 1617 1618 static void packet_mm_close(struct vm_area_struct *vma) 1619 { 1620 struct file *file = vma->vm_file; 1621 struct socket * sock = file->private_data; 1622 struct sock *sk = sock->sk; 1623 1624 if (sk) 1625 atomic_dec(&pkt_sk(sk)->mapped); 1626 } 1627 1628 static struct vm_operations_struct packet_mmap_ops = { 1629 .open = packet_mm_open, 1630 .close =packet_mm_close, 1631 }; 1632 1633 static inline struct page *pg_vec_endpage(char *one_pg_vec, unsigned int order) 1634 { 1635 return virt_to_page(one_pg_vec + (PAGE_SIZE << order) - 1); 1636 } 1637 1638 static void free_pg_vec(char **pg_vec, unsigned int order, unsigned int len) 1639 { 1640 int i; 1641 1642 for (i = 0; i < len; i++) { 1643 if (likely(pg_vec[i])) 1644 free_pages((unsigned long) pg_vec[i], order); 1645 } 1646 kfree(pg_vec); 1647 } 1648 1649 static inline char *alloc_one_pg_vec_page(unsigned long order) 1650 { 1651 return (char *) __get_free_pages(GFP_KERNEL | __GFP_COMP | __GFP_ZERO, 1652 order); 1653 } 1654 1655 static char **alloc_pg_vec(struct tpacket_req *req, int order) 1656 { 1657 unsigned int block_nr = req->tp_block_nr; 1658 char **pg_vec; 1659 int i; 1660 1661 pg_vec = kzalloc(block_nr * sizeof(char *), GFP_KERNEL); 1662 if (unlikely(!pg_vec)) 1663 goto out; 1664 1665 for (i = 0; i < block_nr; i++) { 1666 pg_vec[i] = alloc_one_pg_vec_page(order); 1667 if (unlikely(!pg_vec[i])) 1668 goto out_free_pgvec; 1669 } 1670 1671 out: 1672 return pg_vec; 1673 1674 out_free_pgvec: 1675 free_pg_vec(pg_vec, order, block_nr); 1676 pg_vec = NULL; 1677 goto out; 1678 } 1679 1680 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing) 1681 { 1682 char **pg_vec = NULL; 1683 struct packet_sock *po = pkt_sk(sk); 1684 int was_running, order = 0; 1685 __be16 num; 1686 int err = 0; 1687 1688 if (req->tp_block_nr) { 1689 int i, l; 1690 1691 /* Sanity tests and some calculations */ 1692 1693 if (unlikely(po->pg_vec)) 1694 return -EBUSY; 1695 1696 if (unlikely((int)req->tp_block_size <= 0)) 1697 return -EINVAL; 1698 if (unlikely(req->tp_block_size & (PAGE_SIZE - 1))) 1699 return -EINVAL; 1700 if (unlikely(req->tp_frame_size < TPACKET_HDRLEN)) 1701 return -EINVAL; 1702 if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1))) 1703 return -EINVAL; 1704 1705 po->frames_per_block = req->tp_block_size/req->tp_frame_size; 1706 if (unlikely(po->frames_per_block <= 0)) 1707 return -EINVAL; 1708 if (unlikely((po->frames_per_block * req->tp_block_nr) != 1709 req->tp_frame_nr)) 1710 return -EINVAL; 1711 1712 err = -ENOMEM; 1713 order = get_order(req->tp_block_size); 1714 pg_vec = alloc_pg_vec(req, order); 1715 if (unlikely(!pg_vec)) 1716 goto out; 1717 1718 l = 0; 1719 for (i = 0; i < req->tp_block_nr; i++) { 1720 char *ptr = pg_vec[i]; 1721 struct tpacket_hdr *header; 1722 int k; 1723 1724 for (k = 0; k < po->frames_per_block; k++) { 1725 header = (struct tpacket_hdr *) ptr; 1726 header->tp_status = TP_STATUS_KERNEL; 1727 ptr += req->tp_frame_size; 1728 } 1729 } 1730 /* Done */ 1731 } else { 1732 if (unlikely(req->tp_frame_nr)) 1733 return -EINVAL; 1734 } 1735 1736 lock_sock(sk); 1737 1738 /* Detach socket from network */ 1739 spin_lock(&po->bind_lock); 1740 was_running = po->running; 1741 num = po->num; 1742 if (was_running) { 1743 __dev_remove_pack(&po->prot_hook); 1744 po->num = 0; 1745 po->running = 0; 1746 __sock_put(sk); 1747 } 1748 spin_unlock(&po->bind_lock); 1749 1750 synchronize_net(); 1751 1752 err = -EBUSY; 1753 if (closing || atomic_read(&po->mapped) == 0) { 1754 err = 0; 1755 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; }) 1756 1757 spin_lock_bh(&sk->sk_receive_queue.lock); 1758 pg_vec = XC(po->pg_vec, pg_vec); 1759 po->frame_max = (req->tp_frame_nr - 1); 1760 po->head = 0; 1761 po->frame_size = req->tp_frame_size; 1762 spin_unlock_bh(&sk->sk_receive_queue.lock); 1763 1764 order = XC(po->pg_vec_order, order); 1765 req->tp_block_nr = XC(po->pg_vec_len, req->tp_block_nr); 1766 1767 po->pg_vec_pages = req->tp_block_size/PAGE_SIZE; 1768 po->prot_hook.func = po->pg_vec ? tpacket_rcv : packet_rcv; 1769 skb_queue_purge(&sk->sk_receive_queue); 1770 #undef XC 1771 if (atomic_read(&po->mapped)) 1772 printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped)); 1773 } 1774 1775 spin_lock(&po->bind_lock); 1776 if (was_running && !po->running) { 1777 sock_hold(sk); 1778 po->running = 1; 1779 po->num = num; 1780 dev_add_pack(&po->prot_hook); 1781 } 1782 spin_unlock(&po->bind_lock); 1783 1784 release_sock(sk); 1785 1786 if (pg_vec) 1787 free_pg_vec(pg_vec, order, req->tp_block_nr); 1788 out: 1789 return err; 1790 } 1791 1792 static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_struct *vma) 1793 { 1794 struct sock *sk = sock->sk; 1795 struct packet_sock *po = pkt_sk(sk); 1796 unsigned long size; 1797 unsigned long start; 1798 int err = -EINVAL; 1799 int i; 1800 1801 if (vma->vm_pgoff) 1802 return -EINVAL; 1803 1804 size = vma->vm_end - vma->vm_start; 1805 1806 lock_sock(sk); 1807 if (po->pg_vec == NULL) 1808 goto out; 1809 if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE) 1810 goto out; 1811 1812 start = vma->vm_start; 1813 for (i = 0; i < po->pg_vec_len; i++) { 1814 struct page *page = virt_to_page(po->pg_vec[i]); 1815 int pg_num; 1816 1817 for (pg_num = 0; pg_num < po->pg_vec_pages; pg_num++, page++) { 1818 err = vm_insert_page(vma, start, page); 1819 if (unlikely(err)) 1820 goto out; 1821 start += PAGE_SIZE; 1822 } 1823 } 1824 atomic_inc(&po->mapped); 1825 vma->vm_ops = &packet_mmap_ops; 1826 err = 0; 1827 1828 out: 1829 release_sock(sk); 1830 return err; 1831 } 1832 #endif 1833 1834 1835 static const struct proto_ops packet_ops_spkt = { 1836 .family = PF_PACKET, 1837 .owner = THIS_MODULE, 1838 .release = packet_release, 1839 .bind = packet_bind_spkt, 1840 .connect = sock_no_connect, 1841 .socketpair = sock_no_socketpair, 1842 .accept = sock_no_accept, 1843 .getname = packet_getname_spkt, 1844 .poll = datagram_poll, 1845 .ioctl = packet_ioctl, 1846 .listen = sock_no_listen, 1847 .shutdown = sock_no_shutdown, 1848 .setsockopt = sock_no_setsockopt, 1849 .getsockopt = sock_no_getsockopt, 1850 .sendmsg = packet_sendmsg_spkt, 1851 .recvmsg = packet_recvmsg, 1852 .mmap = sock_no_mmap, 1853 .sendpage = sock_no_sendpage, 1854 }; 1855 1856 static const struct proto_ops packet_ops = { 1857 .family = PF_PACKET, 1858 .owner = THIS_MODULE, 1859 .release = packet_release, 1860 .bind = packet_bind, 1861 .connect = sock_no_connect, 1862 .socketpair = sock_no_socketpair, 1863 .accept = sock_no_accept, 1864 .getname = packet_getname, 1865 .poll = packet_poll, 1866 .ioctl = packet_ioctl, 1867 .listen = sock_no_listen, 1868 .shutdown = sock_no_shutdown, 1869 .setsockopt = packet_setsockopt, 1870 .getsockopt = packet_getsockopt, 1871 .sendmsg = packet_sendmsg, 1872 .recvmsg = packet_recvmsg, 1873 .mmap = packet_mmap, 1874 .sendpage = sock_no_sendpage, 1875 }; 1876 1877 static struct net_proto_family packet_family_ops = { 1878 .family = PF_PACKET, 1879 .create = packet_create, 1880 .owner = THIS_MODULE, 1881 }; 1882 1883 static struct notifier_block packet_netdev_notifier = { 1884 .notifier_call =packet_notifier, 1885 }; 1886 1887 #ifdef CONFIG_PROC_FS 1888 static inline struct sock *packet_seq_idx(loff_t off) 1889 { 1890 struct sock *s; 1891 struct hlist_node *node; 1892 1893 sk_for_each(s, node, &packet_sklist) { 1894 if (!off--) 1895 return s; 1896 } 1897 return NULL; 1898 } 1899 1900 static void *packet_seq_start(struct seq_file *seq, loff_t *pos) 1901 { 1902 read_lock(&packet_sklist_lock); 1903 return *pos ? packet_seq_idx(*pos - 1) : SEQ_START_TOKEN; 1904 } 1905 1906 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos) 1907 { 1908 ++*pos; 1909 return (v == SEQ_START_TOKEN) 1910 ? sk_head(&packet_sklist) 1911 : sk_next((struct sock*)v) ; 1912 } 1913 1914 static void packet_seq_stop(struct seq_file *seq, void *v) 1915 { 1916 read_unlock(&packet_sklist_lock); 1917 } 1918 1919 static int packet_seq_show(struct seq_file *seq, void *v) 1920 { 1921 if (v == SEQ_START_TOKEN) 1922 seq_puts(seq, "sk RefCnt Type Proto Iface R Rmem User Inode\n"); 1923 else { 1924 struct sock *s = v; 1925 const struct packet_sock *po = pkt_sk(s); 1926 1927 seq_printf(seq, 1928 "%p %-6d %-4d %04x %-5d %1d %-6u %-6u %-6lu\n", 1929 s, 1930 atomic_read(&s->sk_refcnt), 1931 s->sk_type, 1932 ntohs(po->num), 1933 po->ifindex, 1934 po->running, 1935 atomic_read(&s->sk_rmem_alloc), 1936 sock_i_uid(s), 1937 sock_i_ino(s) ); 1938 } 1939 1940 return 0; 1941 } 1942 1943 static const struct seq_operations packet_seq_ops = { 1944 .start = packet_seq_start, 1945 .next = packet_seq_next, 1946 .stop = packet_seq_stop, 1947 .show = packet_seq_show, 1948 }; 1949 1950 static int packet_seq_open(struct inode *inode, struct file *file) 1951 { 1952 return seq_open(file, &packet_seq_ops); 1953 } 1954 1955 static const struct file_operations packet_seq_fops = { 1956 .owner = THIS_MODULE, 1957 .open = packet_seq_open, 1958 .read = seq_read, 1959 .llseek = seq_lseek, 1960 .release = seq_release, 1961 }; 1962 1963 #endif 1964 1965 static void __exit packet_exit(void) 1966 { 1967 proc_net_remove(&init_net, "packet"); 1968 unregister_netdevice_notifier(&packet_netdev_notifier); 1969 sock_unregister(PF_PACKET); 1970 proto_unregister(&packet_proto); 1971 } 1972 1973 static int __init packet_init(void) 1974 { 1975 int rc = proto_register(&packet_proto, 0); 1976 1977 if (rc != 0) 1978 goto out; 1979 1980 sock_register(&packet_family_ops); 1981 register_netdevice_notifier(&packet_netdev_notifier); 1982 proc_net_fops_create(&init_net, "packet", 0, &packet_seq_fops); 1983 out: 1984 return rc; 1985 } 1986 1987 module_init(packet_init); 1988 module_exit(packet_exit); 1989 MODULE_LICENSE("GPL"); 1990 MODULE_ALIAS_NETPROTO(PF_PACKET); 1991