1 /** -*- linux-c -*- *********************************************************** 2 * Linux PPP over Ethernet (PPPoX/PPPoE) Sockets 3 * 4 * PPPoX --- Generic PPP encapsulation socket family 5 * PPPoE --- PPP over Ethernet (RFC 2516) 6 * 7 * 8 * Version: 0.7.0 9 * 10 * 070228 : Fix to allow multiple sessions with same remote MAC and same 11 * session id by including the local device ifindex in the 12 * tuple identifying a session. This also ensures packets can't 13 * be injected into a session from interfaces other than the one 14 * specified by userspace. Florian Zumbiehl <florz@florz.de> 15 * (Oh, BTW, this one is YYMMDD, in case you were wondering ...) 16 * 220102 : Fix module use count on failure in pppoe_create, pppox_sk -acme 17 * 030700 : Fixed connect logic to allow for disconnect. 18 * 270700 : Fixed potential SMP problems; we must protect against 19 * simultaneous invocation of ppp_input 20 * and ppp_unregister_channel. 21 * 040800 : Respect reference count mechanisms on net-devices. 22 * 200800 : fix kfree(skb) in pppoe_rcv (acme) 23 * Module reference count is decremented in the right spot now, 24 * guards against sock_put not actually freeing the sk 25 * in pppoe_release. 26 * 051000 : Initialization cleanup. 27 * 111100 : Fix recvmsg. 28 * 050101 : Fix PADT procesing. 29 * 140501 : Use pppoe_rcv_core to handle all backlog. (Alexey) 30 * 170701 : Do not lock_sock with rwlock held. (DaveM) 31 * Ignore discovery frames if user has socket 32 * locked. (DaveM) 33 * Ignore return value of dev_queue_xmit in __pppoe_xmit 34 * or else we may kfree an SKB twice. (DaveM) 35 * 190701 : When doing copies of skb's in __pppoe_xmit, always delete 36 * the original skb that was passed in on success, never on 37 * failure. Delete the copy of the skb on failure to avoid 38 * a memory leak. 39 * 081001 : Misc. cleanup (licence string, non-blocking, prevent 40 * reference of device on close). 41 * 121301 : New ppp channels interface; cannot unregister a channel 42 * from interrupts. Thus, we mark the socket as a ZOMBIE 43 * and do the unregistration later. 44 * 081002 : seq_file support for proc stuff -acme 45 * 111602 : Merge all 2.4 fixes into 2.5/2.6 tree. Label 2.5/2.6 46 * as version 0.7. Spacing cleanup. 47 * Author: Michal Ostrowski <mostrows@speakeasy.net> 48 * Contributors: 49 * Arnaldo Carvalho de Melo <acme@conectiva.com.br> 50 * David S. Miller (davem@redhat.com) 51 * 52 * License: 53 * This program is free software; you can redistribute it and/or 54 * modify it under the terms of the GNU General Public License 55 * as published by the Free Software Foundation; either version 56 * 2 of the License, or (at your option) any later version. 57 * 58 */ 59 60 #include <linux/string.h> 61 #include <linux/module.h> 62 #include <linux/kernel.h> 63 #include <linux/slab.h> 64 #include <linux/errno.h> 65 #include <linux/netdevice.h> 66 #include <linux/net.h> 67 #include <linux/inetdevice.h> 68 #include <linux/etherdevice.h> 69 #include <linux/skbuff.h> 70 #include <linux/init.h> 71 #include <linux/if_ether.h> 72 #include <linux/if_pppox.h> 73 #include <linux/ppp_channel.h> 74 #include <linux/ppp_defs.h> 75 #include <linux/ppp-ioctl.h> 76 #include <linux/notifier.h> 77 #include <linux/file.h> 78 #include <linux/proc_fs.h> 79 #include <linux/seq_file.h> 80 81 #include <linux/nsproxy.h> 82 #include <net/net_namespace.h> 83 #include <net/netns/generic.h> 84 #include <net/sock.h> 85 86 #include <asm/uaccess.h> 87 88 #define PPPOE_HASH_BITS 4 89 #define PPPOE_HASH_SIZE (1 << PPPOE_HASH_BITS) 90 #define PPPOE_HASH_MASK (PPPOE_HASH_SIZE - 1) 91 92 static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb); 93 94 static const struct proto_ops pppoe_ops; 95 static const struct ppp_channel_ops pppoe_chan_ops; 96 97 /* per-net private data for this module */ 98 static int pppoe_net_id __read_mostly; 99 struct pppoe_net { 100 /* 101 * we could use _single_ hash table for all 102 * nets by injecting net id into the hash but 103 * it would increase hash chains and add 104 * a few additional math comparations messy 105 * as well, moreover in case of SMP less locking 106 * controversy here 107 */ 108 struct pppox_sock *hash_table[PPPOE_HASH_SIZE]; 109 rwlock_t hash_lock; 110 }; 111 112 /* 113 * PPPoE could be in the following stages: 114 * 1) Discovery stage (to obtain remote MAC and Session ID) 115 * 2) Session stage (MAC and SID are known) 116 * 117 * Ethernet frames have a special tag for this but 118 * we use simpler approach based on session id 119 */ 120 static inline bool stage_session(__be16 sid) 121 { 122 return sid != 0; 123 } 124 125 static inline struct pppoe_net *pppoe_pernet(struct net *net) 126 { 127 BUG_ON(!net); 128 129 return net_generic(net, pppoe_net_id); 130 } 131 132 static inline int cmp_2_addr(struct pppoe_addr *a, struct pppoe_addr *b) 133 { 134 return a->sid == b->sid && ether_addr_equal(a->remote, b->remote); 135 } 136 137 static inline int cmp_addr(struct pppoe_addr *a, __be16 sid, char *addr) 138 { 139 return a->sid == sid && ether_addr_equal(a->remote, addr); 140 } 141 142 #if 8 % PPPOE_HASH_BITS 143 #error 8 must be a multiple of PPPOE_HASH_BITS 144 #endif 145 146 static int hash_item(__be16 sid, unsigned char *addr) 147 { 148 unsigned char hash = 0; 149 unsigned int i; 150 151 for (i = 0; i < ETH_ALEN; i++) 152 hash ^= addr[i]; 153 for (i = 0; i < sizeof(sid_t) * 8; i += 8) 154 hash ^= (__force __u32)sid >> i; 155 for (i = 8; (i >>= 1) >= PPPOE_HASH_BITS;) 156 hash ^= hash >> i; 157 158 return hash & PPPOE_HASH_MASK; 159 } 160 161 /********************************************************************** 162 * 163 * Set/get/delete/rehash items (internal versions) 164 * 165 **********************************************************************/ 166 static struct pppox_sock *__get_item(struct pppoe_net *pn, __be16 sid, 167 unsigned char *addr, int ifindex) 168 { 169 int hash = hash_item(sid, addr); 170 struct pppox_sock *ret; 171 172 ret = pn->hash_table[hash]; 173 while (ret) { 174 if (cmp_addr(&ret->pppoe_pa, sid, addr) && 175 ret->pppoe_ifindex == ifindex) 176 return ret; 177 178 ret = ret->next; 179 } 180 181 return NULL; 182 } 183 184 static int __set_item(struct pppoe_net *pn, struct pppox_sock *po) 185 { 186 int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); 187 struct pppox_sock *ret; 188 189 ret = pn->hash_table[hash]; 190 while (ret) { 191 if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa) && 192 ret->pppoe_ifindex == po->pppoe_ifindex) 193 return -EALREADY; 194 195 ret = ret->next; 196 } 197 198 po->next = pn->hash_table[hash]; 199 pn->hash_table[hash] = po; 200 201 return 0; 202 } 203 204 static void __delete_item(struct pppoe_net *pn, __be16 sid, 205 char *addr, int ifindex) 206 { 207 int hash = hash_item(sid, addr); 208 struct pppox_sock *ret, **src; 209 210 ret = pn->hash_table[hash]; 211 src = &pn->hash_table[hash]; 212 213 while (ret) { 214 if (cmp_addr(&ret->pppoe_pa, sid, addr) && 215 ret->pppoe_ifindex == ifindex) { 216 *src = ret->next; 217 break; 218 } 219 220 src = &ret->next; 221 ret = ret->next; 222 } 223 } 224 225 /********************************************************************** 226 * 227 * Set/get/delete/rehash items 228 * 229 **********************************************************************/ 230 static inline struct pppox_sock *get_item(struct pppoe_net *pn, __be16 sid, 231 unsigned char *addr, int ifindex) 232 { 233 struct pppox_sock *po; 234 235 read_lock_bh(&pn->hash_lock); 236 po = __get_item(pn, sid, addr, ifindex); 237 if (po) 238 sock_hold(sk_pppox(po)); 239 read_unlock_bh(&pn->hash_lock); 240 241 return po; 242 } 243 244 static inline struct pppox_sock *get_item_by_addr(struct net *net, 245 struct sockaddr_pppox *sp) 246 { 247 struct net_device *dev; 248 struct pppoe_net *pn; 249 struct pppox_sock *pppox_sock = NULL; 250 251 int ifindex; 252 253 rcu_read_lock(); 254 dev = dev_get_by_name_rcu(net, sp->sa_addr.pppoe.dev); 255 if (dev) { 256 ifindex = dev->ifindex; 257 pn = pppoe_pernet(net); 258 pppox_sock = get_item(pn, sp->sa_addr.pppoe.sid, 259 sp->sa_addr.pppoe.remote, ifindex); 260 } 261 rcu_read_unlock(); 262 return pppox_sock; 263 } 264 265 static inline void delete_item(struct pppoe_net *pn, __be16 sid, 266 char *addr, int ifindex) 267 { 268 write_lock_bh(&pn->hash_lock); 269 __delete_item(pn, sid, addr, ifindex); 270 write_unlock_bh(&pn->hash_lock); 271 } 272 273 /*************************************************************************** 274 * 275 * Handler for device events. 276 * Certain device events require that sockets be unconnected. 277 * 278 **************************************************************************/ 279 280 static void pppoe_flush_dev(struct net_device *dev) 281 { 282 struct pppoe_net *pn; 283 int i; 284 285 pn = pppoe_pernet(dev_net(dev)); 286 write_lock_bh(&pn->hash_lock); 287 for (i = 0; i < PPPOE_HASH_SIZE; i++) { 288 struct pppox_sock *po = pn->hash_table[i]; 289 struct sock *sk; 290 291 while (po) { 292 while (po && po->pppoe_dev != dev) { 293 po = po->next; 294 } 295 296 if (!po) 297 break; 298 299 sk = sk_pppox(po); 300 301 /* We always grab the socket lock, followed by the 302 * hash_lock, in that order. Since we should hold the 303 * sock lock while doing any unbinding, we need to 304 * release the lock we're holding. Hold a reference to 305 * the sock so it doesn't disappear as we're jumping 306 * between locks. 307 */ 308 309 sock_hold(sk); 310 write_unlock_bh(&pn->hash_lock); 311 lock_sock(sk); 312 313 if (po->pppoe_dev == dev && 314 sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) { 315 pppox_unbind_sock(sk); 316 sk->sk_state_change(sk); 317 po->pppoe_dev = NULL; 318 dev_put(dev); 319 } 320 321 release_sock(sk); 322 sock_put(sk); 323 324 /* Restart the process from the start of the current 325 * hash chain. We dropped locks so the world may have 326 * change from underneath us. 327 */ 328 329 BUG_ON(pppoe_pernet(dev_net(dev)) == NULL); 330 write_lock_bh(&pn->hash_lock); 331 po = pn->hash_table[i]; 332 } 333 } 334 write_unlock_bh(&pn->hash_lock); 335 } 336 337 static int pppoe_device_event(struct notifier_block *this, 338 unsigned long event, void *ptr) 339 { 340 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 341 342 /* Only look at sockets that are using this specific device. */ 343 switch (event) { 344 case NETDEV_CHANGEADDR: 345 case NETDEV_CHANGEMTU: 346 /* A change in mtu or address is a bad thing, requiring 347 * LCP re-negotiation. 348 */ 349 350 case NETDEV_GOING_DOWN: 351 case NETDEV_DOWN: 352 /* Find every socket on this device and kill it. */ 353 pppoe_flush_dev(dev); 354 break; 355 356 default: 357 break; 358 } 359 360 return NOTIFY_DONE; 361 } 362 363 static struct notifier_block pppoe_notifier = { 364 .notifier_call = pppoe_device_event, 365 }; 366 367 /************************************************************************ 368 * 369 * Do the real work of receiving a PPPoE Session frame. 370 * 371 ***********************************************************************/ 372 static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb) 373 { 374 struct pppox_sock *po = pppox_sk(sk); 375 struct pppox_sock *relay_po; 376 377 /* Backlog receive. Semantics of backlog rcv preclude any code from 378 * executing in lock_sock()/release_sock() bounds; meaning sk->sk_state 379 * can't change. 380 */ 381 382 if (skb->pkt_type == PACKET_OTHERHOST) 383 goto abort_kfree; 384 385 if (sk->sk_state & PPPOX_BOUND) { 386 ppp_input(&po->chan, skb); 387 } else if (sk->sk_state & PPPOX_RELAY) { 388 relay_po = get_item_by_addr(sock_net(sk), 389 &po->pppoe_relay); 390 if (relay_po == NULL) 391 goto abort_kfree; 392 393 if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0) 394 goto abort_put; 395 396 if (!__pppoe_xmit(sk_pppox(relay_po), skb)) 397 goto abort_put; 398 } else { 399 if (sock_queue_rcv_skb(sk, skb)) 400 goto abort_kfree; 401 } 402 403 return NET_RX_SUCCESS; 404 405 abort_put: 406 sock_put(sk_pppox(relay_po)); 407 408 abort_kfree: 409 kfree_skb(skb); 410 return NET_RX_DROP; 411 } 412 413 /************************************************************************ 414 * 415 * Receive wrapper called in BH context. 416 * 417 ***********************************************************************/ 418 static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev, 419 struct packet_type *pt, struct net_device *orig_dev) 420 { 421 struct pppoe_hdr *ph; 422 struct pppox_sock *po; 423 struct pppoe_net *pn; 424 int len; 425 426 skb = skb_share_check(skb, GFP_ATOMIC); 427 if (!skb) 428 goto out; 429 430 if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) 431 goto drop; 432 433 ph = pppoe_hdr(skb); 434 len = ntohs(ph->length); 435 436 skb_pull_rcsum(skb, sizeof(*ph)); 437 if (skb->len < len) 438 goto drop; 439 440 if (pskb_trim_rcsum(skb, len)) 441 goto drop; 442 443 pn = pppoe_pernet(dev_net(dev)); 444 445 /* Note that get_item does a sock_hold(), so sk_pppox(po) 446 * is known to be safe. 447 */ 448 po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); 449 if (!po) 450 goto drop; 451 452 return sk_receive_skb(sk_pppox(po), skb, 0); 453 454 drop: 455 kfree_skb(skb); 456 out: 457 return NET_RX_DROP; 458 } 459 460 static void pppoe_unbind_sock_work(struct work_struct *work) 461 { 462 struct pppox_sock *po = container_of(work, struct pppox_sock, 463 proto.pppoe.padt_work); 464 struct sock *sk = sk_pppox(po); 465 466 lock_sock(sk); 467 if (po->pppoe_dev) { 468 dev_put(po->pppoe_dev); 469 po->pppoe_dev = NULL; 470 } 471 pppox_unbind_sock(sk); 472 release_sock(sk); 473 sock_put(sk); 474 } 475 476 /************************************************************************ 477 * 478 * Receive a PPPoE Discovery frame. 479 * This is solely for detection of PADT frames 480 * 481 ***********************************************************************/ 482 static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev, 483 struct packet_type *pt, struct net_device *orig_dev) 484 485 { 486 struct pppoe_hdr *ph; 487 struct pppox_sock *po; 488 struct pppoe_net *pn; 489 490 skb = skb_share_check(skb, GFP_ATOMIC); 491 if (!skb) 492 goto out; 493 494 if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) 495 goto abort; 496 497 ph = pppoe_hdr(skb); 498 if (ph->code != PADT_CODE) 499 goto abort; 500 501 pn = pppoe_pernet(dev_net(dev)); 502 po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); 503 if (po) { 504 struct sock *sk = sk_pppox(po); 505 506 bh_lock_sock(sk); 507 508 /* If the user has locked the socket, just ignore 509 * the packet. With the way two rcv protocols hook into 510 * one socket family type, we cannot (easily) distinguish 511 * what kind of SKB it is during backlog rcv. 512 */ 513 if (sock_owned_by_user(sk) == 0) { 514 /* We're no longer connect at the PPPOE layer, 515 * and must wait for ppp channel to disconnect us. 516 */ 517 sk->sk_state = PPPOX_ZOMBIE; 518 } 519 520 bh_unlock_sock(sk); 521 if (!schedule_work(&po->proto.pppoe.padt_work)) 522 sock_put(sk); 523 } 524 525 abort: 526 kfree_skb(skb); 527 out: 528 return NET_RX_SUCCESS; /* Lies... :-) */ 529 } 530 531 static struct packet_type pppoes_ptype __read_mostly = { 532 .type = cpu_to_be16(ETH_P_PPP_SES), 533 .func = pppoe_rcv, 534 }; 535 536 static struct packet_type pppoed_ptype __read_mostly = { 537 .type = cpu_to_be16(ETH_P_PPP_DISC), 538 .func = pppoe_disc_rcv, 539 }; 540 541 static struct proto pppoe_sk_proto __read_mostly = { 542 .name = "PPPOE", 543 .owner = THIS_MODULE, 544 .obj_size = sizeof(struct pppox_sock), 545 }; 546 547 /*********************************************************************** 548 * 549 * Initialize a new struct sock. 550 * 551 **********************************************************************/ 552 static int pppoe_create(struct net *net, struct socket *sock, int kern) 553 { 554 struct sock *sk; 555 556 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppoe_sk_proto, kern); 557 if (!sk) 558 return -ENOMEM; 559 560 sock_init_data(sock, sk); 561 562 sock->state = SS_UNCONNECTED; 563 sock->ops = &pppoe_ops; 564 565 sk->sk_backlog_rcv = pppoe_rcv_core; 566 sk->sk_state = PPPOX_NONE; 567 sk->sk_type = SOCK_STREAM; 568 sk->sk_family = PF_PPPOX; 569 sk->sk_protocol = PX_PROTO_OE; 570 571 INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work, 572 pppoe_unbind_sock_work); 573 574 return 0; 575 } 576 577 static int pppoe_release(struct socket *sock) 578 { 579 struct sock *sk = sock->sk; 580 struct pppox_sock *po; 581 struct pppoe_net *pn; 582 struct net *net = NULL; 583 584 if (!sk) 585 return 0; 586 587 lock_sock(sk); 588 if (sock_flag(sk, SOCK_DEAD)) { 589 release_sock(sk); 590 return -EBADF; 591 } 592 593 po = pppox_sk(sk); 594 595 if (po->pppoe_dev) { 596 dev_put(po->pppoe_dev); 597 po->pppoe_dev = NULL; 598 } 599 600 pppox_unbind_sock(sk); 601 602 /* Signal the death of the socket. */ 603 sk->sk_state = PPPOX_DEAD; 604 605 net = sock_net(sk); 606 pn = pppoe_pernet(net); 607 608 /* 609 * protect "po" from concurrent updates 610 * on pppoe_flush_dev 611 */ 612 delete_item(pn, po->pppoe_pa.sid, po->pppoe_pa.remote, 613 po->pppoe_ifindex); 614 615 sock_orphan(sk); 616 sock->sk = NULL; 617 618 skb_queue_purge(&sk->sk_receive_queue); 619 release_sock(sk); 620 sock_put(sk); 621 622 return 0; 623 } 624 625 static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr, 626 int sockaddr_len, int flags) 627 { 628 struct sock *sk = sock->sk; 629 struct sockaddr_pppox *sp = (struct sockaddr_pppox *)uservaddr; 630 struct pppox_sock *po = pppox_sk(sk); 631 struct net_device *dev = NULL; 632 struct pppoe_net *pn; 633 struct net *net = NULL; 634 int error; 635 636 lock_sock(sk); 637 638 error = -EINVAL; 639 if (sp->sa_protocol != PX_PROTO_OE) 640 goto end; 641 642 /* Check for already bound sockets */ 643 error = -EBUSY; 644 if ((sk->sk_state & PPPOX_CONNECTED) && 645 stage_session(sp->sa_addr.pppoe.sid)) 646 goto end; 647 648 /* Check for already disconnected sockets, on attempts to disconnect */ 649 error = -EALREADY; 650 if ((sk->sk_state & PPPOX_DEAD) && 651 !stage_session(sp->sa_addr.pppoe.sid)) 652 goto end; 653 654 error = 0; 655 656 /* Delete the old binding */ 657 if (stage_session(po->pppoe_pa.sid)) { 658 pppox_unbind_sock(sk); 659 pn = pppoe_pernet(sock_net(sk)); 660 delete_item(pn, po->pppoe_pa.sid, 661 po->pppoe_pa.remote, po->pppoe_ifindex); 662 if (po->pppoe_dev) { 663 dev_put(po->pppoe_dev); 664 po->pppoe_dev = NULL; 665 } 666 667 po->pppoe_ifindex = 0; 668 memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa)); 669 memset(&po->pppoe_relay, 0, sizeof(po->pppoe_relay)); 670 memset(&po->chan, 0, sizeof(po->chan)); 671 po->next = NULL; 672 po->num = 0; 673 674 sk->sk_state = PPPOX_NONE; 675 } 676 677 /* Re-bind in session stage only */ 678 if (stage_session(sp->sa_addr.pppoe.sid)) { 679 error = -ENODEV; 680 net = sock_net(sk); 681 dev = dev_get_by_name(net, sp->sa_addr.pppoe.dev); 682 if (!dev) 683 goto err_put; 684 685 po->pppoe_dev = dev; 686 po->pppoe_ifindex = dev->ifindex; 687 pn = pppoe_pernet(net); 688 if (!(dev->flags & IFF_UP)) { 689 goto err_put; 690 } 691 692 memcpy(&po->pppoe_pa, 693 &sp->sa_addr.pppoe, 694 sizeof(struct pppoe_addr)); 695 696 write_lock_bh(&pn->hash_lock); 697 error = __set_item(pn, po); 698 write_unlock_bh(&pn->hash_lock); 699 if (error < 0) 700 goto err_put; 701 702 po->chan.hdrlen = (sizeof(struct pppoe_hdr) + 703 dev->hard_header_len); 704 705 po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2; 706 po->chan.private = sk; 707 po->chan.ops = &pppoe_chan_ops; 708 709 error = ppp_register_net_channel(dev_net(dev), &po->chan); 710 if (error) { 711 delete_item(pn, po->pppoe_pa.sid, 712 po->pppoe_pa.remote, po->pppoe_ifindex); 713 goto err_put; 714 } 715 716 sk->sk_state = PPPOX_CONNECTED; 717 } 718 719 po->num = sp->sa_addr.pppoe.sid; 720 721 end: 722 release_sock(sk); 723 return error; 724 err_put: 725 if (po->pppoe_dev) { 726 dev_put(po->pppoe_dev); 727 po->pppoe_dev = NULL; 728 } 729 goto end; 730 } 731 732 static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr, 733 int *usockaddr_len, int peer) 734 { 735 int len = sizeof(struct sockaddr_pppox); 736 struct sockaddr_pppox sp; 737 738 sp.sa_family = AF_PPPOX; 739 sp.sa_protocol = PX_PROTO_OE; 740 memcpy(&sp.sa_addr.pppoe, &pppox_sk(sock->sk)->pppoe_pa, 741 sizeof(struct pppoe_addr)); 742 743 memcpy(uaddr, &sp, len); 744 745 *usockaddr_len = len; 746 747 return 0; 748 } 749 750 static int pppoe_ioctl(struct socket *sock, unsigned int cmd, 751 unsigned long arg) 752 { 753 struct sock *sk = sock->sk; 754 struct pppox_sock *po = pppox_sk(sk); 755 int val; 756 int err; 757 758 switch (cmd) { 759 case PPPIOCGMRU: 760 err = -ENXIO; 761 if (!(sk->sk_state & PPPOX_CONNECTED)) 762 break; 763 764 err = -EFAULT; 765 if (put_user(po->pppoe_dev->mtu - 766 sizeof(struct pppoe_hdr) - 767 PPP_HDRLEN, 768 (int __user *)arg)) 769 break; 770 err = 0; 771 break; 772 773 case PPPIOCSMRU: 774 err = -ENXIO; 775 if (!(sk->sk_state & PPPOX_CONNECTED)) 776 break; 777 778 err = -EFAULT; 779 if (get_user(val, (int __user *)arg)) 780 break; 781 782 if (val < (po->pppoe_dev->mtu 783 - sizeof(struct pppoe_hdr) 784 - PPP_HDRLEN)) 785 err = 0; 786 else 787 err = -EINVAL; 788 break; 789 790 case PPPIOCSFLAGS: 791 err = -EFAULT; 792 if (get_user(val, (int __user *)arg)) 793 break; 794 err = 0; 795 break; 796 797 case PPPOEIOCSFWD: 798 { 799 struct pppox_sock *relay_po; 800 801 err = -EBUSY; 802 if (sk->sk_state & (PPPOX_BOUND | PPPOX_ZOMBIE | PPPOX_DEAD)) 803 break; 804 805 err = -ENOTCONN; 806 if (!(sk->sk_state & PPPOX_CONNECTED)) 807 break; 808 809 /* PPPoE address from the user specifies an outbound 810 PPPoE address which frames are forwarded to */ 811 err = -EFAULT; 812 if (copy_from_user(&po->pppoe_relay, 813 (void __user *)arg, 814 sizeof(struct sockaddr_pppox))) 815 break; 816 817 err = -EINVAL; 818 if (po->pppoe_relay.sa_family != AF_PPPOX || 819 po->pppoe_relay.sa_protocol != PX_PROTO_OE) 820 break; 821 822 /* Check that the socket referenced by the address 823 actually exists. */ 824 relay_po = get_item_by_addr(sock_net(sk), &po->pppoe_relay); 825 if (!relay_po) 826 break; 827 828 sock_put(sk_pppox(relay_po)); 829 sk->sk_state |= PPPOX_RELAY; 830 err = 0; 831 break; 832 } 833 834 case PPPOEIOCDFWD: 835 err = -EALREADY; 836 if (!(sk->sk_state & PPPOX_RELAY)) 837 break; 838 839 sk->sk_state &= ~PPPOX_RELAY; 840 err = 0; 841 break; 842 843 default: 844 err = -ENOTTY; 845 } 846 847 return err; 848 } 849 850 static int pppoe_sendmsg(struct socket *sock, struct msghdr *m, 851 size_t total_len) 852 { 853 struct sk_buff *skb; 854 struct sock *sk = sock->sk; 855 struct pppox_sock *po = pppox_sk(sk); 856 int error; 857 struct pppoe_hdr hdr; 858 struct pppoe_hdr *ph; 859 struct net_device *dev; 860 char *start; 861 862 lock_sock(sk); 863 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) { 864 error = -ENOTCONN; 865 goto end; 866 } 867 868 hdr.ver = 1; 869 hdr.type = 1; 870 hdr.code = 0; 871 hdr.sid = po->num; 872 873 dev = po->pppoe_dev; 874 875 error = -EMSGSIZE; 876 if (total_len > (dev->mtu + dev->hard_header_len)) 877 goto end; 878 879 880 skb = sock_wmalloc(sk, total_len + dev->hard_header_len + 32, 881 0, GFP_KERNEL); 882 if (!skb) { 883 error = -ENOMEM; 884 goto end; 885 } 886 887 /* Reserve space for headers. */ 888 skb_reserve(skb, dev->hard_header_len); 889 skb_reset_network_header(skb); 890 891 skb->dev = dev; 892 893 skb->priority = sk->sk_priority; 894 skb->protocol = cpu_to_be16(ETH_P_PPP_SES); 895 896 ph = (struct pppoe_hdr *)skb_put(skb, total_len + sizeof(struct pppoe_hdr)); 897 start = (char *)&ph->tag[0]; 898 899 error = memcpy_from_msg(start, m, total_len); 900 if (error < 0) { 901 kfree_skb(skb); 902 goto end; 903 } 904 905 error = total_len; 906 dev_hard_header(skb, dev, ETH_P_PPP_SES, 907 po->pppoe_pa.remote, NULL, total_len); 908 909 memcpy(ph, &hdr, sizeof(struct pppoe_hdr)); 910 911 ph->length = htons(total_len); 912 913 dev_queue_xmit(skb); 914 915 end: 916 release_sock(sk); 917 return error; 918 } 919 920 /************************************************************************ 921 * 922 * xmit function for internal use. 923 * 924 ***********************************************************************/ 925 static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb) 926 { 927 struct pppox_sock *po = pppox_sk(sk); 928 struct net_device *dev = po->pppoe_dev; 929 struct pppoe_hdr *ph; 930 int data_len = skb->len; 931 932 /* The higher-level PPP code (ppp_unregister_channel()) ensures the PPP 933 * xmit operations conclude prior to an unregistration call. Thus 934 * sk->sk_state cannot change, so we don't need to do lock_sock(). 935 * But, we also can't do a lock_sock since that introduces a potential 936 * deadlock as we'd reverse the lock ordering used when calling 937 * ppp_unregister_channel(). 938 */ 939 940 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 941 goto abort; 942 943 if (!dev) 944 goto abort; 945 946 /* Copy the data if there is no space for the header or if it's 947 * read-only. 948 */ 949 if (skb_cow_head(skb, sizeof(*ph) + dev->hard_header_len)) 950 goto abort; 951 952 __skb_push(skb, sizeof(*ph)); 953 skb_reset_network_header(skb); 954 955 ph = pppoe_hdr(skb); 956 ph->ver = 1; 957 ph->type = 1; 958 ph->code = 0; 959 ph->sid = po->num; 960 ph->length = htons(data_len); 961 962 skb->protocol = cpu_to_be16(ETH_P_PPP_SES); 963 skb->dev = dev; 964 965 dev_hard_header(skb, dev, ETH_P_PPP_SES, 966 po->pppoe_pa.remote, NULL, data_len); 967 968 dev_queue_xmit(skb); 969 return 1; 970 971 abort: 972 kfree_skb(skb); 973 return 1; 974 } 975 976 /************************************************************************ 977 * 978 * xmit function called by generic PPP driver 979 * sends PPP frame over PPPoE socket 980 * 981 ***********************************************************************/ 982 static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb) 983 { 984 struct sock *sk = (struct sock *)chan->private; 985 return __pppoe_xmit(sk, skb); 986 } 987 988 static const struct ppp_channel_ops pppoe_chan_ops = { 989 .start_xmit = pppoe_xmit, 990 }; 991 992 static int pppoe_recvmsg(struct socket *sock, struct msghdr *m, 993 size_t total_len, int flags) 994 { 995 struct sock *sk = sock->sk; 996 struct sk_buff *skb; 997 int error = 0; 998 999 if (sk->sk_state & PPPOX_BOUND) { 1000 error = -EIO; 1001 goto end; 1002 } 1003 1004 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 1005 flags & MSG_DONTWAIT, &error); 1006 if (error < 0) 1007 goto end; 1008 1009 if (skb) { 1010 total_len = min_t(size_t, total_len, skb->len); 1011 error = skb_copy_datagram_msg(skb, 0, m, total_len); 1012 if (error == 0) { 1013 consume_skb(skb); 1014 return total_len; 1015 } 1016 } 1017 1018 kfree_skb(skb); 1019 end: 1020 return error; 1021 } 1022 1023 #ifdef CONFIG_PROC_FS 1024 static int pppoe_seq_show(struct seq_file *seq, void *v) 1025 { 1026 struct pppox_sock *po; 1027 char *dev_name; 1028 1029 if (v == SEQ_START_TOKEN) { 1030 seq_puts(seq, "Id Address Device\n"); 1031 goto out; 1032 } 1033 1034 po = v; 1035 dev_name = po->pppoe_pa.dev; 1036 1037 seq_printf(seq, "%08X %pM %8s\n", 1038 po->pppoe_pa.sid, po->pppoe_pa.remote, dev_name); 1039 out: 1040 return 0; 1041 } 1042 1043 static inline struct pppox_sock *pppoe_get_idx(struct pppoe_net *pn, loff_t pos) 1044 { 1045 struct pppox_sock *po; 1046 int i; 1047 1048 for (i = 0; i < PPPOE_HASH_SIZE; i++) { 1049 po = pn->hash_table[i]; 1050 while (po) { 1051 if (!pos--) 1052 goto out; 1053 po = po->next; 1054 } 1055 } 1056 1057 out: 1058 return po; 1059 } 1060 1061 static void *pppoe_seq_start(struct seq_file *seq, loff_t *pos) 1062 __acquires(pn->hash_lock) 1063 { 1064 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 1065 loff_t l = *pos; 1066 1067 read_lock_bh(&pn->hash_lock); 1068 return l ? pppoe_get_idx(pn, --l) : SEQ_START_TOKEN; 1069 } 1070 1071 static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos) 1072 { 1073 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 1074 struct pppox_sock *po; 1075 1076 ++*pos; 1077 if (v == SEQ_START_TOKEN) { 1078 po = pppoe_get_idx(pn, 0); 1079 goto out; 1080 } 1081 po = v; 1082 if (po->next) 1083 po = po->next; 1084 else { 1085 int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); 1086 1087 po = NULL; 1088 while (++hash < PPPOE_HASH_SIZE) { 1089 po = pn->hash_table[hash]; 1090 if (po) 1091 break; 1092 } 1093 } 1094 1095 out: 1096 return po; 1097 } 1098 1099 static void pppoe_seq_stop(struct seq_file *seq, void *v) 1100 __releases(pn->hash_lock) 1101 { 1102 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 1103 read_unlock_bh(&pn->hash_lock); 1104 } 1105 1106 static const struct seq_operations pppoe_seq_ops = { 1107 .start = pppoe_seq_start, 1108 .next = pppoe_seq_next, 1109 .stop = pppoe_seq_stop, 1110 .show = pppoe_seq_show, 1111 }; 1112 1113 static int pppoe_seq_open(struct inode *inode, struct file *file) 1114 { 1115 return seq_open_net(inode, file, &pppoe_seq_ops, 1116 sizeof(struct seq_net_private)); 1117 } 1118 1119 static const struct file_operations pppoe_seq_fops = { 1120 .owner = THIS_MODULE, 1121 .open = pppoe_seq_open, 1122 .read = seq_read, 1123 .llseek = seq_lseek, 1124 .release = seq_release_net, 1125 }; 1126 1127 #endif /* CONFIG_PROC_FS */ 1128 1129 static const struct proto_ops pppoe_ops = { 1130 .family = AF_PPPOX, 1131 .owner = THIS_MODULE, 1132 .release = pppoe_release, 1133 .bind = sock_no_bind, 1134 .connect = pppoe_connect, 1135 .socketpair = sock_no_socketpair, 1136 .accept = sock_no_accept, 1137 .getname = pppoe_getname, 1138 .poll = datagram_poll, 1139 .listen = sock_no_listen, 1140 .shutdown = sock_no_shutdown, 1141 .setsockopt = sock_no_setsockopt, 1142 .getsockopt = sock_no_getsockopt, 1143 .sendmsg = pppoe_sendmsg, 1144 .recvmsg = pppoe_recvmsg, 1145 .mmap = sock_no_mmap, 1146 .ioctl = pppox_ioctl, 1147 }; 1148 1149 static const struct pppox_proto pppoe_proto = { 1150 .create = pppoe_create, 1151 .ioctl = pppoe_ioctl, 1152 .owner = THIS_MODULE, 1153 }; 1154 1155 static __net_init int pppoe_init_net(struct net *net) 1156 { 1157 struct pppoe_net *pn = pppoe_pernet(net); 1158 struct proc_dir_entry *pde; 1159 1160 rwlock_init(&pn->hash_lock); 1161 1162 pde = proc_create("pppoe", S_IRUGO, net->proc_net, &pppoe_seq_fops); 1163 #ifdef CONFIG_PROC_FS 1164 if (!pde) 1165 return -ENOMEM; 1166 #endif 1167 1168 return 0; 1169 } 1170 1171 static __net_exit void pppoe_exit_net(struct net *net) 1172 { 1173 remove_proc_entry("pppoe", net->proc_net); 1174 } 1175 1176 static struct pernet_operations pppoe_net_ops = { 1177 .init = pppoe_init_net, 1178 .exit = pppoe_exit_net, 1179 .id = &pppoe_net_id, 1180 .size = sizeof(struct pppoe_net), 1181 }; 1182 1183 static int __init pppoe_init(void) 1184 { 1185 int err; 1186 1187 err = register_pernet_device(&pppoe_net_ops); 1188 if (err) 1189 goto out; 1190 1191 err = proto_register(&pppoe_sk_proto, 0); 1192 if (err) 1193 goto out_unregister_net_ops; 1194 1195 err = register_pppox_proto(PX_PROTO_OE, &pppoe_proto); 1196 if (err) 1197 goto out_unregister_pppoe_proto; 1198 1199 dev_add_pack(&pppoes_ptype); 1200 dev_add_pack(&pppoed_ptype); 1201 register_netdevice_notifier(&pppoe_notifier); 1202 1203 return 0; 1204 1205 out_unregister_pppoe_proto: 1206 proto_unregister(&pppoe_sk_proto); 1207 out_unregister_net_ops: 1208 unregister_pernet_device(&pppoe_net_ops); 1209 out: 1210 return err; 1211 } 1212 1213 static void __exit pppoe_exit(void) 1214 { 1215 unregister_netdevice_notifier(&pppoe_notifier); 1216 dev_remove_pack(&pppoed_ptype); 1217 dev_remove_pack(&pppoes_ptype); 1218 unregister_pppox_proto(PX_PROTO_OE); 1219 proto_unregister(&pppoe_sk_proto); 1220 unregister_pernet_device(&pppoe_net_ops); 1221 } 1222 1223 module_init(pppoe_init); 1224 module_exit(pppoe_exit); 1225 1226 MODULE_AUTHOR("Michal Ostrowski <mostrows@speakeasy.net>"); 1227 MODULE_DESCRIPTION("PPP over Ethernet driver"); 1228 MODULE_LICENSE("GPL"); 1229 MODULE_ALIAS_NETPROTO(PF_PPPOX); 1230