1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /** -*- linux-c -*- *********************************************************** 3 * Linux PPP over Ethernet (PPPoX/PPPoE) Sockets 4 * 5 * PPPoX --- Generic PPP encapsulation socket family 6 * PPPoE --- PPP over Ethernet (RFC 2516) 7 * 8 * Version: 0.7.0 9 * 10 * 070228 : Fix to allow multiple sessions with same remote MAC and same 11 * session id by including the local device ifindex in the 12 * tuple identifying a session. This also ensures packets can't 13 * be injected into a session from interfaces other than the one 14 * specified by userspace. Florian Zumbiehl <florz@florz.de> 15 * (Oh, BTW, this one is YYMMDD, in case you were wondering ...) 16 * 220102 : Fix module use count on failure in pppoe_create, pppox_sk -acme 17 * 030700 : Fixed connect logic to allow for disconnect. 18 * 270700 : Fixed potential SMP problems; we must protect against 19 * simultaneous invocation of ppp_input 20 * and ppp_unregister_channel. 21 * 040800 : Respect reference count mechanisms on net-devices. 22 * 200800 : fix kfree(skb) in pppoe_rcv (acme) 23 * Module reference count is decremented in the right spot now, 24 * guards against sock_put not actually freeing the sk 25 * in pppoe_release. 26 * 051000 : Initialization cleanup. 27 * 111100 : Fix recvmsg. 28 * 050101 : Fix PADT procesing. 29 * 140501 : Use pppoe_rcv_core to handle all backlog. (Alexey) 30 * 170701 : Do not lock_sock with rwlock held. (DaveM) 31 * Ignore discovery frames if user has socket 32 * locked. (DaveM) 33 * Ignore return value of dev_queue_xmit in __pppoe_xmit 34 * or else we may kfree an SKB twice. (DaveM) 35 * 190701 : When doing copies of skb's in __pppoe_xmit, always delete 36 * the original skb that was passed in on success, never on 37 * failure. Delete the copy of the skb on failure to avoid 38 * a memory leak. 39 * 081001 : Misc. cleanup (licence string, non-blocking, prevent 40 * reference of device on close). 41 * 121301 : New ppp channels interface; cannot unregister a channel 42 * from interrupts. Thus, we mark the socket as a ZOMBIE 43 * and do the unregistration later. 44 * 081002 : seq_file support for proc stuff -acme 45 * 111602 : Merge all 2.4 fixes into 2.5/2.6 tree. Label 2.5/2.6 46 * as version 0.7. Spacing cleanup. 47 * Author: Michal Ostrowski <mostrows@speakeasy.net> 48 * Contributors: 49 * Arnaldo Carvalho de Melo <acme@conectiva.com.br> 50 * David S. Miller (davem@redhat.com) 51 * 52 * License: 53 */ 54 55 #include <linux/string.h> 56 #include <linux/module.h> 57 #include <linux/kernel.h> 58 #include <linux/slab.h> 59 #include <linux/errno.h> 60 #include <linux/netdevice.h> 61 #include <linux/net.h> 62 #include <linux/inetdevice.h> 63 #include <linux/etherdevice.h> 64 #include <linux/skbuff.h> 65 #include <linux/init.h> 66 #include <linux/if_ether.h> 67 #include <linux/if_pppox.h> 68 #include <linux/ppp_channel.h> 69 #include <linux/ppp_defs.h> 70 #include <linux/ppp-ioctl.h> 71 #include <linux/notifier.h> 72 #include <linux/file.h> 73 #include <linux/proc_fs.h> 74 #include <linux/seq_file.h> 75 76 #include <linux/nsproxy.h> 77 #include <net/net_namespace.h> 78 #include <net/netns/generic.h> 79 #include <net/sock.h> 80 81 #include <linux/uaccess.h> 82 83 #define PPPOE_HASH_BITS 4 84 #define PPPOE_HASH_SIZE (1 << PPPOE_HASH_BITS) 85 #define PPPOE_HASH_MASK (PPPOE_HASH_SIZE - 1) 86 87 static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb); 88 89 static const struct proto_ops pppoe_ops; 90 static const struct ppp_channel_ops pppoe_chan_ops; 91 92 /* per-net private data for this module */ 93 static unsigned int pppoe_net_id __read_mostly; 94 struct pppoe_net { 95 /* 96 * we could use _single_ hash table for all 97 * nets by injecting net id into the hash but 98 * it would increase hash chains and add 99 * a few additional math comparations messy 100 * as well, moreover in case of SMP less locking 101 * controversy here 102 */ 103 struct pppox_sock *hash_table[PPPOE_HASH_SIZE]; 104 rwlock_t hash_lock; 105 }; 106 107 /* 108 * PPPoE could be in the following stages: 109 * 1) Discovery stage (to obtain remote MAC and Session ID) 110 * 2) Session stage (MAC and SID are known) 111 * 112 * Ethernet frames have a special tag for this but 113 * we use simpler approach based on session id 114 */ 115 static inline bool stage_session(__be16 sid) 116 { 117 return sid != 0; 118 } 119 120 static inline struct pppoe_net *pppoe_pernet(struct net *net) 121 { 122 return net_generic(net, pppoe_net_id); 123 } 124 125 static inline int cmp_2_addr(struct pppoe_addr *a, struct pppoe_addr *b) 126 { 127 return a->sid == b->sid && ether_addr_equal(a->remote, b->remote); 128 } 129 130 static inline int cmp_addr(struct pppoe_addr *a, __be16 sid, char *addr) 131 { 132 return a->sid == sid && ether_addr_equal(a->remote, addr); 133 } 134 135 #if 8 % PPPOE_HASH_BITS 136 #error 8 must be a multiple of PPPOE_HASH_BITS 137 #endif 138 139 static int hash_item(__be16 sid, unsigned char *addr) 140 { 141 unsigned char hash = 0; 142 unsigned int i; 143 144 for (i = 0; i < ETH_ALEN; i++) 145 hash ^= addr[i]; 146 for (i = 0; i < sizeof(sid_t) * 8; i += 8) 147 hash ^= (__force __u32)sid >> i; 148 for (i = 8; (i >>= 1) >= PPPOE_HASH_BITS;) 149 hash ^= hash >> i; 150 151 return hash & PPPOE_HASH_MASK; 152 } 153 154 /********************************************************************** 155 * 156 * Set/get/delete/rehash items (internal versions) 157 * 158 **********************************************************************/ 159 static struct pppox_sock *__get_item(struct pppoe_net *pn, __be16 sid, 160 unsigned char *addr, int ifindex) 161 { 162 int hash = hash_item(sid, addr); 163 struct pppox_sock *ret; 164 165 ret = pn->hash_table[hash]; 166 while (ret) { 167 if (cmp_addr(&ret->pppoe_pa, sid, addr) && 168 ret->pppoe_ifindex == ifindex) 169 return ret; 170 171 ret = ret->next; 172 } 173 174 return NULL; 175 } 176 177 static int __set_item(struct pppoe_net *pn, struct pppox_sock *po) 178 { 179 int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); 180 struct pppox_sock *ret; 181 182 ret = pn->hash_table[hash]; 183 while (ret) { 184 if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa) && 185 ret->pppoe_ifindex == po->pppoe_ifindex) 186 return -EALREADY; 187 188 ret = ret->next; 189 } 190 191 po->next = pn->hash_table[hash]; 192 pn->hash_table[hash] = po; 193 194 return 0; 195 } 196 197 static void __delete_item(struct pppoe_net *pn, __be16 sid, 198 char *addr, int ifindex) 199 { 200 int hash = hash_item(sid, addr); 201 struct pppox_sock *ret, **src; 202 203 ret = pn->hash_table[hash]; 204 src = &pn->hash_table[hash]; 205 206 while (ret) { 207 if (cmp_addr(&ret->pppoe_pa, sid, addr) && 208 ret->pppoe_ifindex == ifindex) { 209 *src = ret->next; 210 break; 211 } 212 213 src = &ret->next; 214 ret = ret->next; 215 } 216 } 217 218 /********************************************************************** 219 * 220 * Set/get/delete/rehash items 221 * 222 **********************************************************************/ 223 static inline struct pppox_sock *get_item(struct pppoe_net *pn, __be16 sid, 224 unsigned char *addr, int ifindex) 225 { 226 struct pppox_sock *po; 227 228 read_lock_bh(&pn->hash_lock); 229 po = __get_item(pn, sid, addr, ifindex); 230 if (po) 231 sock_hold(sk_pppox(po)); 232 read_unlock_bh(&pn->hash_lock); 233 234 return po; 235 } 236 237 static inline struct pppox_sock *get_item_by_addr(struct net *net, 238 struct sockaddr_pppox *sp) 239 { 240 struct net_device *dev; 241 struct pppoe_net *pn; 242 struct pppox_sock *pppox_sock = NULL; 243 244 int ifindex; 245 246 rcu_read_lock(); 247 dev = dev_get_by_name_rcu(net, sp->sa_addr.pppoe.dev); 248 if (dev) { 249 ifindex = dev->ifindex; 250 pn = pppoe_pernet(net); 251 pppox_sock = get_item(pn, sp->sa_addr.pppoe.sid, 252 sp->sa_addr.pppoe.remote, ifindex); 253 } 254 rcu_read_unlock(); 255 return pppox_sock; 256 } 257 258 static inline void delete_item(struct pppoe_net *pn, __be16 sid, 259 char *addr, int ifindex) 260 { 261 write_lock_bh(&pn->hash_lock); 262 __delete_item(pn, sid, addr, ifindex); 263 write_unlock_bh(&pn->hash_lock); 264 } 265 266 /*************************************************************************** 267 * 268 * Handler for device events. 269 * Certain device events require that sockets be unconnected. 270 * 271 **************************************************************************/ 272 273 static void pppoe_flush_dev(struct net_device *dev) 274 { 275 struct pppoe_net *pn; 276 int i; 277 278 pn = pppoe_pernet(dev_net(dev)); 279 write_lock_bh(&pn->hash_lock); 280 for (i = 0; i < PPPOE_HASH_SIZE; i++) { 281 struct pppox_sock *po = pn->hash_table[i]; 282 struct sock *sk; 283 284 while (po) { 285 while (po && po->pppoe_dev != dev) { 286 po = po->next; 287 } 288 289 if (!po) 290 break; 291 292 sk = sk_pppox(po); 293 294 /* We always grab the socket lock, followed by the 295 * hash_lock, in that order. Since we should hold the 296 * sock lock while doing any unbinding, we need to 297 * release the lock we're holding. Hold a reference to 298 * the sock so it doesn't disappear as we're jumping 299 * between locks. 300 */ 301 302 sock_hold(sk); 303 write_unlock_bh(&pn->hash_lock); 304 lock_sock(sk); 305 306 if (po->pppoe_dev == dev && 307 sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) { 308 pppox_unbind_sock(sk); 309 sk->sk_state_change(sk); 310 po->pppoe_dev = NULL; 311 dev_put(dev); 312 } 313 314 release_sock(sk); 315 sock_put(sk); 316 317 /* Restart the process from the start of the current 318 * hash chain. We dropped locks so the world may have 319 * change from underneath us. 320 */ 321 322 BUG_ON(pppoe_pernet(dev_net(dev)) == NULL); 323 write_lock_bh(&pn->hash_lock); 324 po = pn->hash_table[i]; 325 } 326 } 327 write_unlock_bh(&pn->hash_lock); 328 } 329 330 static int pppoe_device_event(struct notifier_block *this, 331 unsigned long event, void *ptr) 332 { 333 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 334 335 /* Only look at sockets that are using this specific device. */ 336 switch (event) { 337 case NETDEV_CHANGEADDR: 338 case NETDEV_CHANGEMTU: 339 /* A change in mtu or address is a bad thing, requiring 340 * LCP re-negotiation. 341 */ 342 343 case NETDEV_GOING_DOWN: 344 case NETDEV_DOWN: 345 /* Find every socket on this device and kill it. */ 346 pppoe_flush_dev(dev); 347 break; 348 349 default: 350 break; 351 } 352 353 return NOTIFY_DONE; 354 } 355 356 static struct notifier_block pppoe_notifier = { 357 .notifier_call = pppoe_device_event, 358 }; 359 360 /************************************************************************ 361 * 362 * Do the real work of receiving a PPPoE Session frame. 363 * 364 ***********************************************************************/ 365 static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb) 366 { 367 struct pppox_sock *po = pppox_sk(sk); 368 struct pppox_sock *relay_po; 369 370 /* Backlog receive. Semantics of backlog rcv preclude any code from 371 * executing in lock_sock()/release_sock() bounds; meaning sk->sk_state 372 * can't change. 373 */ 374 375 if (skb->pkt_type == PACKET_OTHERHOST) 376 goto abort_kfree; 377 378 if (sk->sk_state & PPPOX_BOUND) { 379 ppp_input(&po->chan, skb); 380 } else if (sk->sk_state & PPPOX_RELAY) { 381 relay_po = get_item_by_addr(sock_net(sk), 382 &po->pppoe_relay); 383 if (relay_po == NULL) 384 goto abort_kfree; 385 386 if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0) 387 goto abort_put; 388 389 if (!__pppoe_xmit(sk_pppox(relay_po), skb)) 390 goto abort_put; 391 392 sock_put(sk_pppox(relay_po)); 393 } else { 394 if (sock_queue_rcv_skb(sk, skb)) 395 goto abort_kfree; 396 } 397 398 return NET_RX_SUCCESS; 399 400 abort_put: 401 sock_put(sk_pppox(relay_po)); 402 403 abort_kfree: 404 kfree_skb(skb); 405 return NET_RX_DROP; 406 } 407 408 /************************************************************************ 409 * 410 * Receive wrapper called in BH context. 411 * 412 ***********************************************************************/ 413 static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev, 414 struct packet_type *pt, struct net_device *orig_dev) 415 { 416 struct pppoe_hdr *ph; 417 struct pppox_sock *po; 418 struct pppoe_net *pn; 419 int len; 420 421 skb = skb_share_check(skb, GFP_ATOMIC); 422 if (!skb) 423 goto out; 424 425 if (skb_mac_header_len(skb) < ETH_HLEN) 426 goto drop; 427 428 if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) 429 goto drop; 430 431 ph = pppoe_hdr(skb); 432 len = ntohs(ph->length); 433 434 skb_pull_rcsum(skb, sizeof(*ph)); 435 if (skb->len < len) 436 goto drop; 437 438 if (pskb_trim_rcsum(skb, len)) 439 goto drop; 440 441 ph = pppoe_hdr(skb); 442 pn = pppoe_pernet(dev_net(dev)); 443 444 /* Note that get_item does a sock_hold(), so sk_pppox(po) 445 * is known to be safe. 446 */ 447 po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); 448 if (!po) 449 goto drop; 450 451 return sk_receive_skb(sk_pppox(po), skb, 0); 452 453 drop: 454 kfree_skb(skb); 455 out: 456 return NET_RX_DROP; 457 } 458 459 static void pppoe_unbind_sock_work(struct work_struct *work) 460 { 461 struct pppox_sock *po = container_of(work, struct pppox_sock, 462 proto.pppoe.padt_work); 463 struct sock *sk = sk_pppox(po); 464 465 lock_sock(sk); 466 if (po->pppoe_dev) { 467 dev_put(po->pppoe_dev); 468 po->pppoe_dev = NULL; 469 } 470 pppox_unbind_sock(sk); 471 release_sock(sk); 472 sock_put(sk); 473 } 474 475 /************************************************************************ 476 * 477 * Receive a PPPoE Discovery frame. 478 * This is solely for detection of PADT frames 479 * 480 ***********************************************************************/ 481 static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev, 482 struct packet_type *pt, struct net_device *orig_dev) 483 484 { 485 struct pppoe_hdr *ph; 486 struct pppox_sock *po; 487 struct pppoe_net *pn; 488 489 skb = skb_share_check(skb, GFP_ATOMIC); 490 if (!skb) 491 goto out; 492 493 if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) 494 goto abort; 495 496 ph = pppoe_hdr(skb); 497 if (ph->code != PADT_CODE) 498 goto abort; 499 500 pn = pppoe_pernet(dev_net(dev)); 501 po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); 502 if (po) 503 if (!schedule_work(&po->proto.pppoe.padt_work)) 504 sock_put(sk_pppox(po)); 505 506 abort: 507 kfree_skb(skb); 508 out: 509 return NET_RX_SUCCESS; /* Lies... :-) */ 510 } 511 512 static struct packet_type pppoes_ptype __read_mostly = { 513 .type = cpu_to_be16(ETH_P_PPP_SES), 514 .func = pppoe_rcv, 515 }; 516 517 static struct packet_type pppoed_ptype __read_mostly = { 518 .type = cpu_to_be16(ETH_P_PPP_DISC), 519 .func = pppoe_disc_rcv, 520 }; 521 522 static struct proto pppoe_sk_proto __read_mostly = { 523 .name = "PPPOE", 524 .owner = THIS_MODULE, 525 .obj_size = sizeof(struct pppox_sock), 526 }; 527 528 /*********************************************************************** 529 * 530 * Initialize a new struct sock. 531 * 532 **********************************************************************/ 533 static int pppoe_create(struct net *net, struct socket *sock, int kern) 534 { 535 struct sock *sk; 536 537 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppoe_sk_proto, kern); 538 if (!sk) 539 return -ENOMEM; 540 541 sock_init_data(sock, sk); 542 543 sock->state = SS_UNCONNECTED; 544 sock->ops = &pppoe_ops; 545 546 sk->sk_backlog_rcv = pppoe_rcv_core; 547 sk->sk_state = PPPOX_NONE; 548 sk->sk_type = SOCK_STREAM; 549 sk->sk_family = PF_PPPOX; 550 sk->sk_protocol = PX_PROTO_OE; 551 552 INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work, 553 pppoe_unbind_sock_work); 554 555 return 0; 556 } 557 558 static int pppoe_release(struct socket *sock) 559 { 560 struct sock *sk = sock->sk; 561 struct pppox_sock *po; 562 struct pppoe_net *pn; 563 struct net *net = NULL; 564 565 if (!sk) 566 return 0; 567 568 lock_sock(sk); 569 if (sock_flag(sk, SOCK_DEAD)) { 570 release_sock(sk); 571 return -EBADF; 572 } 573 574 po = pppox_sk(sk); 575 576 if (po->pppoe_dev) { 577 dev_put(po->pppoe_dev); 578 po->pppoe_dev = NULL; 579 } 580 581 pppox_unbind_sock(sk); 582 583 /* Signal the death of the socket. */ 584 sk->sk_state = PPPOX_DEAD; 585 586 net = sock_net(sk); 587 pn = pppoe_pernet(net); 588 589 /* 590 * protect "po" from concurrent updates 591 * on pppoe_flush_dev 592 */ 593 delete_item(pn, po->pppoe_pa.sid, po->pppoe_pa.remote, 594 po->pppoe_ifindex); 595 596 sock_orphan(sk); 597 sock->sk = NULL; 598 599 skb_queue_purge(&sk->sk_receive_queue); 600 release_sock(sk); 601 sock_put(sk); 602 603 return 0; 604 } 605 606 static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr, 607 int sockaddr_len, int flags) 608 { 609 struct sock *sk = sock->sk; 610 struct sockaddr_pppox *sp = (struct sockaddr_pppox *)uservaddr; 611 struct pppox_sock *po = pppox_sk(sk); 612 struct net_device *dev = NULL; 613 struct pppoe_net *pn; 614 struct net *net = NULL; 615 int error; 616 617 lock_sock(sk); 618 619 error = -EINVAL; 620 621 if (sockaddr_len != sizeof(struct sockaddr_pppox)) 622 goto end; 623 624 if (sp->sa_protocol != PX_PROTO_OE) 625 goto end; 626 627 /* Check for already bound sockets */ 628 error = -EBUSY; 629 if ((sk->sk_state & PPPOX_CONNECTED) && 630 stage_session(sp->sa_addr.pppoe.sid)) 631 goto end; 632 633 /* Check for already disconnected sockets, on attempts to disconnect */ 634 error = -EALREADY; 635 if ((sk->sk_state & PPPOX_DEAD) && 636 !stage_session(sp->sa_addr.pppoe.sid)) 637 goto end; 638 639 error = 0; 640 641 /* Delete the old binding */ 642 if (stage_session(po->pppoe_pa.sid)) { 643 pppox_unbind_sock(sk); 644 pn = pppoe_pernet(sock_net(sk)); 645 delete_item(pn, po->pppoe_pa.sid, 646 po->pppoe_pa.remote, po->pppoe_ifindex); 647 if (po->pppoe_dev) { 648 dev_put(po->pppoe_dev); 649 po->pppoe_dev = NULL; 650 } 651 652 po->pppoe_ifindex = 0; 653 memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa)); 654 memset(&po->pppoe_relay, 0, sizeof(po->pppoe_relay)); 655 memset(&po->chan, 0, sizeof(po->chan)); 656 po->next = NULL; 657 po->num = 0; 658 659 sk->sk_state = PPPOX_NONE; 660 } 661 662 /* Re-bind in session stage only */ 663 if (stage_session(sp->sa_addr.pppoe.sid)) { 664 error = -ENODEV; 665 net = sock_net(sk); 666 dev = dev_get_by_name(net, sp->sa_addr.pppoe.dev); 667 if (!dev) 668 goto err_put; 669 670 po->pppoe_dev = dev; 671 po->pppoe_ifindex = dev->ifindex; 672 pn = pppoe_pernet(net); 673 if (!(dev->flags & IFF_UP)) { 674 goto err_put; 675 } 676 677 memcpy(&po->pppoe_pa, 678 &sp->sa_addr.pppoe, 679 sizeof(struct pppoe_addr)); 680 681 write_lock_bh(&pn->hash_lock); 682 error = __set_item(pn, po); 683 write_unlock_bh(&pn->hash_lock); 684 if (error < 0) 685 goto err_put; 686 687 po->chan.hdrlen = (sizeof(struct pppoe_hdr) + 688 dev->hard_header_len); 689 690 po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2; 691 po->chan.private = sk; 692 po->chan.ops = &pppoe_chan_ops; 693 694 error = ppp_register_net_channel(dev_net(dev), &po->chan); 695 if (error) { 696 delete_item(pn, po->pppoe_pa.sid, 697 po->pppoe_pa.remote, po->pppoe_ifindex); 698 goto err_put; 699 } 700 701 sk->sk_state = PPPOX_CONNECTED; 702 } 703 704 po->num = sp->sa_addr.pppoe.sid; 705 706 end: 707 release_sock(sk); 708 return error; 709 err_put: 710 if (po->pppoe_dev) { 711 dev_put(po->pppoe_dev); 712 po->pppoe_dev = NULL; 713 } 714 goto end; 715 } 716 717 static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr, 718 int peer) 719 { 720 int len = sizeof(struct sockaddr_pppox); 721 struct sockaddr_pppox sp; 722 723 sp.sa_family = AF_PPPOX; 724 sp.sa_protocol = PX_PROTO_OE; 725 memcpy(&sp.sa_addr.pppoe, &pppox_sk(sock->sk)->pppoe_pa, 726 sizeof(struct pppoe_addr)); 727 728 memcpy(uaddr, &sp, len); 729 730 return len; 731 } 732 733 static int pppoe_ioctl(struct socket *sock, unsigned int cmd, 734 unsigned long arg) 735 { 736 struct sock *sk = sock->sk; 737 struct pppox_sock *po = pppox_sk(sk); 738 int val; 739 int err; 740 741 switch (cmd) { 742 case PPPIOCGMRU: 743 err = -ENXIO; 744 if (!(sk->sk_state & PPPOX_CONNECTED)) 745 break; 746 747 err = -EFAULT; 748 if (put_user(po->pppoe_dev->mtu - 749 sizeof(struct pppoe_hdr) - 750 PPP_HDRLEN, 751 (int __user *)arg)) 752 break; 753 err = 0; 754 break; 755 756 case PPPIOCSMRU: 757 err = -ENXIO; 758 if (!(sk->sk_state & PPPOX_CONNECTED)) 759 break; 760 761 err = -EFAULT; 762 if (get_user(val, (int __user *)arg)) 763 break; 764 765 if (val < (po->pppoe_dev->mtu 766 - sizeof(struct pppoe_hdr) 767 - PPP_HDRLEN)) 768 err = 0; 769 else 770 err = -EINVAL; 771 break; 772 773 case PPPIOCSFLAGS: 774 err = -EFAULT; 775 if (get_user(val, (int __user *)arg)) 776 break; 777 err = 0; 778 break; 779 780 case PPPOEIOCSFWD: 781 { 782 struct pppox_sock *relay_po; 783 784 err = -EBUSY; 785 if (sk->sk_state & (PPPOX_BOUND | PPPOX_DEAD)) 786 break; 787 788 err = -ENOTCONN; 789 if (!(sk->sk_state & PPPOX_CONNECTED)) 790 break; 791 792 /* PPPoE address from the user specifies an outbound 793 PPPoE address which frames are forwarded to */ 794 err = -EFAULT; 795 if (copy_from_user(&po->pppoe_relay, 796 (void __user *)arg, 797 sizeof(struct sockaddr_pppox))) 798 break; 799 800 err = -EINVAL; 801 if (po->pppoe_relay.sa_family != AF_PPPOX || 802 po->pppoe_relay.sa_protocol != PX_PROTO_OE) 803 break; 804 805 /* Check that the socket referenced by the address 806 actually exists. */ 807 relay_po = get_item_by_addr(sock_net(sk), &po->pppoe_relay); 808 if (!relay_po) 809 break; 810 811 sock_put(sk_pppox(relay_po)); 812 sk->sk_state |= PPPOX_RELAY; 813 err = 0; 814 break; 815 } 816 817 case PPPOEIOCDFWD: 818 err = -EALREADY; 819 if (!(sk->sk_state & PPPOX_RELAY)) 820 break; 821 822 sk->sk_state &= ~PPPOX_RELAY; 823 err = 0; 824 break; 825 826 default: 827 err = -ENOTTY; 828 } 829 830 return err; 831 } 832 833 static int pppoe_sendmsg(struct socket *sock, struct msghdr *m, 834 size_t total_len) 835 { 836 struct sk_buff *skb; 837 struct sock *sk = sock->sk; 838 struct pppox_sock *po = pppox_sk(sk); 839 int error; 840 struct pppoe_hdr hdr; 841 struct pppoe_hdr *ph; 842 struct net_device *dev; 843 char *start; 844 int hlen; 845 846 lock_sock(sk); 847 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) { 848 error = -ENOTCONN; 849 goto end; 850 } 851 852 hdr.ver = 1; 853 hdr.type = 1; 854 hdr.code = 0; 855 hdr.sid = po->num; 856 857 dev = po->pppoe_dev; 858 859 error = -EMSGSIZE; 860 if (total_len > (dev->mtu + dev->hard_header_len)) 861 goto end; 862 863 hlen = LL_RESERVED_SPACE(dev); 864 skb = sock_wmalloc(sk, hlen + sizeof(*ph) + total_len + 865 dev->needed_tailroom, 0, GFP_KERNEL); 866 if (!skb) { 867 error = -ENOMEM; 868 goto end; 869 } 870 871 /* Reserve space for headers. */ 872 skb_reserve(skb, hlen); 873 skb_reset_network_header(skb); 874 875 skb->dev = dev; 876 877 skb->priority = sk->sk_priority; 878 skb->protocol = cpu_to_be16(ETH_P_PPP_SES); 879 880 ph = skb_put(skb, total_len + sizeof(struct pppoe_hdr)); 881 start = (char *)&ph->tag[0]; 882 883 error = memcpy_from_msg(start, m, total_len); 884 if (error < 0) { 885 kfree_skb(skb); 886 goto end; 887 } 888 889 error = total_len; 890 dev_hard_header(skb, dev, ETH_P_PPP_SES, 891 po->pppoe_pa.remote, NULL, total_len); 892 893 memcpy(ph, &hdr, sizeof(struct pppoe_hdr)); 894 895 ph->length = htons(total_len); 896 897 dev_queue_xmit(skb); 898 899 end: 900 release_sock(sk); 901 return error; 902 } 903 904 /************************************************************************ 905 * 906 * xmit function for internal use. 907 * 908 ***********************************************************************/ 909 static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb) 910 { 911 struct pppox_sock *po = pppox_sk(sk); 912 struct net_device *dev = po->pppoe_dev; 913 struct pppoe_hdr *ph; 914 int data_len = skb->len; 915 916 /* The higher-level PPP code (ppp_unregister_channel()) ensures the PPP 917 * xmit operations conclude prior to an unregistration call. Thus 918 * sk->sk_state cannot change, so we don't need to do lock_sock(). 919 * But, we also can't do a lock_sock since that introduces a potential 920 * deadlock as we'd reverse the lock ordering used when calling 921 * ppp_unregister_channel(). 922 */ 923 924 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 925 goto abort; 926 927 if (!dev) 928 goto abort; 929 930 /* Copy the data if there is no space for the header or if it's 931 * read-only. 932 */ 933 if (skb_cow_head(skb, LL_RESERVED_SPACE(dev) + sizeof(*ph))) 934 goto abort; 935 936 __skb_push(skb, sizeof(*ph)); 937 skb_reset_network_header(skb); 938 939 ph = pppoe_hdr(skb); 940 ph->ver = 1; 941 ph->type = 1; 942 ph->code = 0; 943 ph->sid = po->num; 944 ph->length = htons(data_len); 945 946 skb->protocol = cpu_to_be16(ETH_P_PPP_SES); 947 skb->dev = dev; 948 949 dev_hard_header(skb, dev, ETH_P_PPP_SES, 950 po->pppoe_pa.remote, NULL, data_len); 951 952 dev_queue_xmit(skb); 953 return 1; 954 955 abort: 956 kfree_skb(skb); 957 return 1; 958 } 959 960 /************************************************************************ 961 * 962 * xmit function called by generic PPP driver 963 * sends PPP frame over PPPoE socket 964 * 965 ***********************************************************************/ 966 static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb) 967 { 968 struct sock *sk = (struct sock *)chan->private; 969 return __pppoe_xmit(sk, skb); 970 } 971 972 static const struct ppp_channel_ops pppoe_chan_ops = { 973 .start_xmit = pppoe_xmit, 974 }; 975 976 static int pppoe_recvmsg(struct socket *sock, struct msghdr *m, 977 size_t total_len, int flags) 978 { 979 struct sock *sk = sock->sk; 980 struct sk_buff *skb; 981 int error = 0; 982 983 if (sk->sk_state & PPPOX_BOUND) { 984 error = -EIO; 985 goto end; 986 } 987 988 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 989 flags & MSG_DONTWAIT, &error); 990 if (error < 0) 991 goto end; 992 993 if (skb) { 994 total_len = min_t(size_t, total_len, skb->len); 995 error = skb_copy_datagram_msg(skb, 0, m, total_len); 996 if (error == 0) { 997 consume_skb(skb); 998 return total_len; 999 } 1000 } 1001 1002 kfree_skb(skb); 1003 end: 1004 return error; 1005 } 1006 1007 #ifdef CONFIG_PROC_FS 1008 static int pppoe_seq_show(struct seq_file *seq, void *v) 1009 { 1010 struct pppox_sock *po; 1011 char *dev_name; 1012 1013 if (v == SEQ_START_TOKEN) { 1014 seq_puts(seq, "Id Address Device\n"); 1015 goto out; 1016 } 1017 1018 po = v; 1019 dev_name = po->pppoe_pa.dev; 1020 1021 seq_printf(seq, "%08X %pM %8s\n", 1022 po->pppoe_pa.sid, po->pppoe_pa.remote, dev_name); 1023 out: 1024 return 0; 1025 } 1026 1027 static inline struct pppox_sock *pppoe_get_idx(struct pppoe_net *pn, loff_t pos) 1028 { 1029 struct pppox_sock *po; 1030 int i; 1031 1032 for (i = 0; i < PPPOE_HASH_SIZE; i++) { 1033 po = pn->hash_table[i]; 1034 while (po) { 1035 if (!pos--) 1036 goto out; 1037 po = po->next; 1038 } 1039 } 1040 1041 out: 1042 return po; 1043 } 1044 1045 static void *pppoe_seq_start(struct seq_file *seq, loff_t *pos) 1046 __acquires(pn->hash_lock) 1047 { 1048 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 1049 loff_t l = *pos; 1050 1051 read_lock_bh(&pn->hash_lock); 1052 return l ? pppoe_get_idx(pn, --l) : SEQ_START_TOKEN; 1053 } 1054 1055 static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos) 1056 { 1057 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 1058 struct pppox_sock *po; 1059 1060 ++*pos; 1061 if (v == SEQ_START_TOKEN) { 1062 po = pppoe_get_idx(pn, 0); 1063 goto out; 1064 } 1065 po = v; 1066 if (po->next) 1067 po = po->next; 1068 else { 1069 int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); 1070 1071 po = NULL; 1072 while (++hash < PPPOE_HASH_SIZE) { 1073 po = pn->hash_table[hash]; 1074 if (po) 1075 break; 1076 } 1077 } 1078 1079 out: 1080 return po; 1081 } 1082 1083 static void pppoe_seq_stop(struct seq_file *seq, void *v) 1084 __releases(pn->hash_lock) 1085 { 1086 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 1087 read_unlock_bh(&pn->hash_lock); 1088 } 1089 1090 static const struct seq_operations pppoe_seq_ops = { 1091 .start = pppoe_seq_start, 1092 .next = pppoe_seq_next, 1093 .stop = pppoe_seq_stop, 1094 .show = pppoe_seq_show, 1095 }; 1096 #endif /* CONFIG_PROC_FS */ 1097 1098 static const struct proto_ops pppoe_ops = { 1099 .family = AF_PPPOX, 1100 .owner = THIS_MODULE, 1101 .release = pppoe_release, 1102 .bind = sock_no_bind, 1103 .connect = pppoe_connect, 1104 .socketpair = sock_no_socketpair, 1105 .accept = sock_no_accept, 1106 .getname = pppoe_getname, 1107 .poll = datagram_poll, 1108 .listen = sock_no_listen, 1109 .shutdown = sock_no_shutdown, 1110 .setsockopt = sock_no_setsockopt, 1111 .getsockopt = sock_no_getsockopt, 1112 .sendmsg = pppoe_sendmsg, 1113 .recvmsg = pppoe_recvmsg, 1114 .mmap = sock_no_mmap, 1115 .ioctl = pppox_ioctl, 1116 #ifdef CONFIG_COMPAT 1117 .compat_ioctl = pppox_compat_ioctl, 1118 #endif 1119 }; 1120 1121 static const struct pppox_proto pppoe_proto = { 1122 .create = pppoe_create, 1123 .ioctl = pppoe_ioctl, 1124 .owner = THIS_MODULE, 1125 }; 1126 1127 static __net_init int pppoe_init_net(struct net *net) 1128 { 1129 struct pppoe_net *pn = pppoe_pernet(net); 1130 struct proc_dir_entry *pde; 1131 1132 rwlock_init(&pn->hash_lock); 1133 1134 pde = proc_create_net("pppoe", 0444, net->proc_net, 1135 &pppoe_seq_ops, sizeof(struct seq_net_private)); 1136 #ifdef CONFIG_PROC_FS 1137 if (!pde) 1138 return -ENOMEM; 1139 #endif 1140 1141 return 0; 1142 } 1143 1144 static __net_exit void pppoe_exit_net(struct net *net) 1145 { 1146 remove_proc_entry("pppoe", net->proc_net); 1147 } 1148 1149 static struct pernet_operations pppoe_net_ops = { 1150 .init = pppoe_init_net, 1151 .exit = pppoe_exit_net, 1152 .id = &pppoe_net_id, 1153 .size = sizeof(struct pppoe_net), 1154 }; 1155 1156 static int __init pppoe_init(void) 1157 { 1158 int err; 1159 1160 err = register_pernet_device(&pppoe_net_ops); 1161 if (err) 1162 goto out; 1163 1164 err = proto_register(&pppoe_sk_proto, 0); 1165 if (err) 1166 goto out_unregister_net_ops; 1167 1168 err = register_pppox_proto(PX_PROTO_OE, &pppoe_proto); 1169 if (err) 1170 goto out_unregister_pppoe_proto; 1171 1172 dev_add_pack(&pppoes_ptype); 1173 dev_add_pack(&pppoed_ptype); 1174 register_netdevice_notifier(&pppoe_notifier); 1175 1176 return 0; 1177 1178 out_unregister_pppoe_proto: 1179 proto_unregister(&pppoe_sk_proto); 1180 out_unregister_net_ops: 1181 unregister_pernet_device(&pppoe_net_ops); 1182 out: 1183 return err; 1184 } 1185 1186 static void __exit pppoe_exit(void) 1187 { 1188 unregister_netdevice_notifier(&pppoe_notifier); 1189 dev_remove_pack(&pppoed_ptype); 1190 dev_remove_pack(&pppoes_ptype); 1191 unregister_pppox_proto(PX_PROTO_OE); 1192 proto_unregister(&pppoe_sk_proto); 1193 unregister_pernet_device(&pppoe_net_ops); 1194 } 1195 1196 module_init(pppoe_init); 1197 module_exit(pppoe_exit); 1198 1199 MODULE_AUTHOR("Michal Ostrowski <mostrows@speakeasy.net>"); 1200 MODULE_DESCRIPTION("PPP over Ethernet driver"); 1201 MODULE_LICENSE("GPL"); 1202 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OE); 1203