1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /** -*- linux-c -*- *********************************************************** 3 * Linux PPP over Ethernet (PPPoX/PPPoE) Sockets 4 * 5 * PPPoX --- Generic PPP encapsulation socket family 6 * PPPoE --- PPP over Ethernet (RFC 2516) 7 * 8 * Version: 0.7.0 9 * 10 * 070228 : Fix to allow multiple sessions with same remote MAC and same 11 * session id by including the local device ifindex in the 12 * tuple identifying a session. This also ensures packets can't 13 * be injected into a session from interfaces other than the one 14 * specified by userspace. Florian Zumbiehl <florz@florz.de> 15 * (Oh, BTW, this one is YYMMDD, in case you were wondering ...) 16 * 220102 : Fix module use count on failure in pppoe_create, pppox_sk -acme 17 * 030700 : Fixed connect logic to allow for disconnect. 18 * 270700 : Fixed potential SMP problems; we must protect against 19 * simultaneous invocation of ppp_input 20 * and ppp_unregister_channel. 21 * 040800 : Respect reference count mechanisms on net-devices. 22 * 200800 : fix kfree(skb) in pppoe_rcv (acme) 23 * Module reference count is decremented in the right spot now, 24 * guards against sock_put not actually freeing the sk 25 * in pppoe_release. 26 * 051000 : Initialization cleanup. 27 * 111100 : Fix recvmsg. 28 * 050101 : Fix PADT procesing. 29 * 140501 : Use pppoe_rcv_core to handle all backlog. (Alexey) 30 * 170701 : Do not lock_sock with rwlock held. (DaveM) 31 * Ignore discovery frames if user has socket 32 * locked. (DaveM) 33 * Ignore return value of dev_queue_xmit in __pppoe_xmit 34 * or else we may kfree an SKB twice. (DaveM) 35 * 190701 : When doing copies of skb's in __pppoe_xmit, always delete 36 * the original skb that was passed in on success, never on 37 * failure. Delete the copy of the skb on failure to avoid 38 * a memory leak. 39 * 081001 : Misc. cleanup (licence string, non-blocking, prevent 40 * reference of device on close). 41 * 121301 : New ppp channels interface; cannot unregister a channel 42 * from interrupts. Thus, we mark the socket as a ZOMBIE 43 * and do the unregistration later. 44 * 081002 : seq_file support for proc stuff -acme 45 * 111602 : Merge all 2.4 fixes into 2.5/2.6 tree. Label 2.5/2.6 46 * as version 0.7. Spacing cleanup. 47 * Author: Michal Ostrowski <mostrows@speakeasy.net> 48 * Contributors: 49 * Arnaldo Carvalho de Melo <acme@conectiva.com.br> 50 * David S. Miller (davem@redhat.com) 51 * 52 * License: 53 */ 54 55 #include <linux/string.h> 56 #include <linux/module.h> 57 #include <linux/kernel.h> 58 #include <linux/slab.h> 59 #include <linux/errno.h> 60 #include <linux/netdevice.h> 61 #include <linux/net.h> 62 #include <linux/inetdevice.h> 63 #include <linux/etherdevice.h> 64 #include <linux/skbuff.h> 65 #include <linux/init.h> 66 #include <linux/if_ether.h> 67 #include <linux/if_pppox.h> 68 #include <linux/ppp_channel.h> 69 #include <linux/ppp_defs.h> 70 #include <linux/ppp-ioctl.h> 71 #include <linux/notifier.h> 72 #include <linux/file.h> 73 #include <linux/proc_fs.h> 74 #include <linux/seq_file.h> 75 76 #include <linux/nsproxy.h> 77 #include <net/net_namespace.h> 78 #include <net/netns/generic.h> 79 #include <net/sock.h> 80 81 #include <linux/uaccess.h> 82 83 #define PPPOE_HASH_BITS 4 84 #define PPPOE_HASH_SIZE (1 << PPPOE_HASH_BITS) 85 #define PPPOE_HASH_MASK (PPPOE_HASH_SIZE - 1) 86 87 static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb); 88 89 static const struct proto_ops pppoe_ops; 90 static const struct ppp_channel_ops pppoe_chan_ops; 91 92 /* per-net private data for this module */ 93 static unsigned int pppoe_net_id __read_mostly; 94 struct pppoe_net { 95 /* 96 * we could use _single_ hash table for all 97 * nets by injecting net id into the hash but 98 * it would increase hash chains and add 99 * a few additional math comparations messy 100 * as well, moreover in case of SMP less locking 101 * controversy here 102 */ 103 struct pppox_sock *hash_table[PPPOE_HASH_SIZE]; 104 rwlock_t hash_lock; 105 }; 106 107 /* 108 * PPPoE could be in the following stages: 109 * 1) Discovery stage (to obtain remote MAC and Session ID) 110 * 2) Session stage (MAC and SID are known) 111 * 112 * Ethernet frames have a special tag for this but 113 * we use simpler approach based on session id 114 */ 115 static inline bool stage_session(__be16 sid) 116 { 117 return sid != 0; 118 } 119 120 static inline struct pppoe_net *pppoe_pernet(struct net *net) 121 { 122 BUG_ON(!net); 123 124 return net_generic(net, pppoe_net_id); 125 } 126 127 static inline int cmp_2_addr(struct pppoe_addr *a, struct pppoe_addr *b) 128 { 129 return a->sid == b->sid && ether_addr_equal(a->remote, b->remote); 130 } 131 132 static inline int cmp_addr(struct pppoe_addr *a, __be16 sid, char *addr) 133 { 134 return a->sid == sid && ether_addr_equal(a->remote, addr); 135 } 136 137 #if 8 % PPPOE_HASH_BITS 138 #error 8 must be a multiple of PPPOE_HASH_BITS 139 #endif 140 141 static int hash_item(__be16 sid, unsigned char *addr) 142 { 143 unsigned char hash = 0; 144 unsigned int i; 145 146 for (i = 0; i < ETH_ALEN; i++) 147 hash ^= addr[i]; 148 for (i = 0; i < sizeof(sid_t) * 8; i += 8) 149 hash ^= (__force __u32)sid >> i; 150 for (i = 8; (i >>= 1) >= PPPOE_HASH_BITS;) 151 hash ^= hash >> i; 152 153 return hash & PPPOE_HASH_MASK; 154 } 155 156 /********************************************************************** 157 * 158 * Set/get/delete/rehash items (internal versions) 159 * 160 **********************************************************************/ 161 static struct pppox_sock *__get_item(struct pppoe_net *pn, __be16 sid, 162 unsigned char *addr, int ifindex) 163 { 164 int hash = hash_item(sid, addr); 165 struct pppox_sock *ret; 166 167 ret = pn->hash_table[hash]; 168 while (ret) { 169 if (cmp_addr(&ret->pppoe_pa, sid, addr) && 170 ret->pppoe_ifindex == ifindex) 171 return ret; 172 173 ret = ret->next; 174 } 175 176 return NULL; 177 } 178 179 static int __set_item(struct pppoe_net *pn, struct pppox_sock *po) 180 { 181 int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); 182 struct pppox_sock *ret; 183 184 ret = pn->hash_table[hash]; 185 while (ret) { 186 if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa) && 187 ret->pppoe_ifindex == po->pppoe_ifindex) 188 return -EALREADY; 189 190 ret = ret->next; 191 } 192 193 po->next = pn->hash_table[hash]; 194 pn->hash_table[hash] = po; 195 196 return 0; 197 } 198 199 static void __delete_item(struct pppoe_net *pn, __be16 sid, 200 char *addr, int ifindex) 201 { 202 int hash = hash_item(sid, addr); 203 struct pppox_sock *ret, **src; 204 205 ret = pn->hash_table[hash]; 206 src = &pn->hash_table[hash]; 207 208 while (ret) { 209 if (cmp_addr(&ret->pppoe_pa, sid, addr) && 210 ret->pppoe_ifindex == ifindex) { 211 *src = ret->next; 212 break; 213 } 214 215 src = &ret->next; 216 ret = ret->next; 217 } 218 } 219 220 /********************************************************************** 221 * 222 * Set/get/delete/rehash items 223 * 224 **********************************************************************/ 225 static inline struct pppox_sock *get_item(struct pppoe_net *pn, __be16 sid, 226 unsigned char *addr, int ifindex) 227 { 228 struct pppox_sock *po; 229 230 read_lock_bh(&pn->hash_lock); 231 po = __get_item(pn, sid, addr, ifindex); 232 if (po) 233 sock_hold(sk_pppox(po)); 234 read_unlock_bh(&pn->hash_lock); 235 236 return po; 237 } 238 239 static inline struct pppox_sock *get_item_by_addr(struct net *net, 240 struct sockaddr_pppox *sp) 241 { 242 struct net_device *dev; 243 struct pppoe_net *pn; 244 struct pppox_sock *pppox_sock = NULL; 245 246 int ifindex; 247 248 rcu_read_lock(); 249 dev = dev_get_by_name_rcu(net, sp->sa_addr.pppoe.dev); 250 if (dev) { 251 ifindex = dev->ifindex; 252 pn = pppoe_pernet(net); 253 pppox_sock = get_item(pn, sp->sa_addr.pppoe.sid, 254 sp->sa_addr.pppoe.remote, ifindex); 255 } 256 rcu_read_unlock(); 257 return pppox_sock; 258 } 259 260 static inline void delete_item(struct pppoe_net *pn, __be16 sid, 261 char *addr, int ifindex) 262 { 263 write_lock_bh(&pn->hash_lock); 264 __delete_item(pn, sid, addr, ifindex); 265 write_unlock_bh(&pn->hash_lock); 266 } 267 268 /*************************************************************************** 269 * 270 * Handler for device events. 271 * Certain device events require that sockets be unconnected. 272 * 273 **************************************************************************/ 274 275 static void pppoe_flush_dev(struct net_device *dev) 276 { 277 struct pppoe_net *pn; 278 int i; 279 280 pn = pppoe_pernet(dev_net(dev)); 281 write_lock_bh(&pn->hash_lock); 282 for (i = 0; i < PPPOE_HASH_SIZE; i++) { 283 struct pppox_sock *po = pn->hash_table[i]; 284 struct sock *sk; 285 286 while (po) { 287 while (po && po->pppoe_dev != dev) { 288 po = po->next; 289 } 290 291 if (!po) 292 break; 293 294 sk = sk_pppox(po); 295 296 /* We always grab the socket lock, followed by the 297 * hash_lock, in that order. Since we should hold the 298 * sock lock while doing any unbinding, we need to 299 * release the lock we're holding. Hold a reference to 300 * the sock so it doesn't disappear as we're jumping 301 * between locks. 302 */ 303 304 sock_hold(sk); 305 write_unlock_bh(&pn->hash_lock); 306 lock_sock(sk); 307 308 if (po->pppoe_dev == dev && 309 sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) { 310 pppox_unbind_sock(sk); 311 sk->sk_state_change(sk); 312 po->pppoe_dev = NULL; 313 dev_put(dev); 314 } 315 316 release_sock(sk); 317 sock_put(sk); 318 319 /* Restart the process from the start of the current 320 * hash chain. We dropped locks so the world may have 321 * change from underneath us. 322 */ 323 324 BUG_ON(pppoe_pernet(dev_net(dev)) == NULL); 325 write_lock_bh(&pn->hash_lock); 326 po = pn->hash_table[i]; 327 } 328 } 329 write_unlock_bh(&pn->hash_lock); 330 } 331 332 static int pppoe_device_event(struct notifier_block *this, 333 unsigned long event, void *ptr) 334 { 335 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 336 337 /* Only look at sockets that are using this specific device. */ 338 switch (event) { 339 case NETDEV_CHANGEADDR: 340 case NETDEV_CHANGEMTU: 341 /* A change in mtu or address is a bad thing, requiring 342 * LCP re-negotiation. 343 */ 344 345 case NETDEV_GOING_DOWN: 346 case NETDEV_DOWN: 347 /* Find every socket on this device and kill it. */ 348 pppoe_flush_dev(dev); 349 break; 350 351 default: 352 break; 353 } 354 355 return NOTIFY_DONE; 356 } 357 358 static struct notifier_block pppoe_notifier = { 359 .notifier_call = pppoe_device_event, 360 }; 361 362 /************************************************************************ 363 * 364 * Do the real work of receiving a PPPoE Session frame. 365 * 366 ***********************************************************************/ 367 static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb) 368 { 369 struct pppox_sock *po = pppox_sk(sk); 370 struct pppox_sock *relay_po; 371 372 /* Backlog receive. Semantics of backlog rcv preclude any code from 373 * executing in lock_sock()/release_sock() bounds; meaning sk->sk_state 374 * can't change. 375 */ 376 377 if (skb->pkt_type == PACKET_OTHERHOST) 378 goto abort_kfree; 379 380 if (sk->sk_state & PPPOX_BOUND) { 381 ppp_input(&po->chan, skb); 382 } else if (sk->sk_state & PPPOX_RELAY) { 383 relay_po = get_item_by_addr(sock_net(sk), 384 &po->pppoe_relay); 385 if (relay_po == NULL) 386 goto abort_kfree; 387 388 if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0) 389 goto abort_put; 390 391 if (!__pppoe_xmit(sk_pppox(relay_po), skb)) 392 goto abort_put; 393 394 sock_put(sk_pppox(relay_po)); 395 } else { 396 if (sock_queue_rcv_skb(sk, skb)) 397 goto abort_kfree; 398 } 399 400 return NET_RX_SUCCESS; 401 402 abort_put: 403 sock_put(sk_pppox(relay_po)); 404 405 abort_kfree: 406 kfree_skb(skb); 407 return NET_RX_DROP; 408 } 409 410 /************************************************************************ 411 * 412 * Receive wrapper called in BH context. 413 * 414 ***********************************************************************/ 415 static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev, 416 struct packet_type *pt, struct net_device *orig_dev) 417 { 418 struct pppoe_hdr *ph; 419 struct pppox_sock *po; 420 struct pppoe_net *pn; 421 int len; 422 423 skb = skb_share_check(skb, GFP_ATOMIC); 424 if (!skb) 425 goto out; 426 427 if (skb_mac_header_len(skb) < ETH_HLEN) 428 goto drop; 429 430 if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) 431 goto drop; 432 433 ph = pppoe_hdr(skb); 434 len = ntohs(ph->length); 435 436 skb_pull_rcsum(skb, sizeof(*ph)); 437 if (skb->len < len) 438 goto drop; 439 440 if (pskb_trim_rcsum(skb, len)) 441 goto drop; 442 443 ph = pppoe_hdr(skb); 444 pn = pppoe_pernet(dev_net(dev)); 445 446 /* Note that get_item does a sock_hold(), so sk_pppox(po) 447 * is known to be safe. 448 */ 449 po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); 450 if (!po) 451 goto drop; 452 453 return sk_receive_skb(sk_pppox(po), skb, 0); 454 455 drop: 456 kfree_skb(skb); 457 out: 458 return NET_RX_DROP; 459 } 460 461 static void pppoe_unbind_sock_work(struct work_struct *work) 462 { 463 struct pppox_sock *po = container_of(work, struct pppox_sock, 464 proto.pppoe.padt_work); 465 struct sock *sk = sk_pppox(po); 466 467 lock_sock(sk); 468 if (po->pppoe_dev) { 469 dev_put(po->pppoe_dev); 470 po->pppoe_dev = NULL; 471 } 472 pppox_unbind_sock(sk); 473 release_sock(sk); 474 sock_put(sk); 475 } 476 477 /************************************************************************ 478 * 479 * Receive a PPPoE Discovery frame. 480 * This is solely for detection of PADT frames 481 * 482 ***********************************************************************/ 483 static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev, 484 struct packet_type *pt, struct net_device *orig_dev) 485 486 { 487 struct pppoe_hdr *ph; 488 struct pppox_sock *po; 489 struct pppoe_net *pn; 490 491 skb = skb_share_check(skb, GFP_ATOMIC); 492 if (!skb) 493 goto out; 494 495 if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) 496 goto abort; 497 498 ph = pppoe_hdr(skb); 499 if (ph->code != PADT_CODE) 500 goto abort; 501 502 pn = pppoe_pernet(dev_net(dev)); 503 po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); 504 if (po) 505 if (!schedule_work(&po->proto.pppoe.padt_work)) 506 sock_put(sk_pppox(po)); 507 508 abort: 509 kfree_skb(skb); 510 out: 511 return NET_RX_SUCCESS; /* Lies... :-) */ 512 } 513 514 static struct packet_type pppoes_ptype __read_mostly = { 515 .type = cpu_to_be16(ETH_P_PPP_SES), 516 .func = pppoe_rcv, 517 }; 518 519 static struct packet_type pppoed_ptype __read_mostly = { 520 .type = cpu_to_be16(ETH_P_PPP_DISC), 521 .func = pppoe_disc_rcv, 522 }; 523 524 static struct proto pppoe_sk_proto __read_mostly = { 525 .name = "PPPOE", 526 .owner = THIS_MODULE, 527 .obj_size = sizeof(struct pppox_sock), 528 }; 529 530 /*********************************************************************** 531 * 532 * Initialize a new struct sock. 533 * 534 **********************************************************************/ 535 static int pppoe_create(struct net *net, struct socket *sock, int kern) 536 { 537 struct sock *sk; 538 539 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppoe_sk_proto, kern); 540 if (!sk) 541 return -ENOMEM; 542 543 sock_init_data(sock, sk); 544 545 sock->state = SS_UNCONNECTED; 546 sock->ops = &pppoe_ops; 547 548 sk->sk_backlog_rcv = pppoe_rcv_core; 549 sk->sk_state = PPPOX_NONE; 550 sk->sk_type = SOCK_STREAM; 551 sk->sk_family = PF_PPPOX; 552 sk->sk_protocol = PX_PROTO_OE; 553 554 INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work, 555 pppoe_unbind_sock_work); 556 557 return 0; 558 } 559 560 static int pppoe_release(struct socket *sock) 561 { 562 struct sock *sk = sock->sk; 563 struct pppox_sock *po; 564 struct pppoe_net *pn; 565 struct net *net = NULL; 566 567 if (!sk) 568 return 0; 569 570 lock_sock(sk); 571 if (sock_flag(sk, SOCK_DEAD)) { 572 release_sock(sk); 573 return -EBADF; 574 } 575 576 po = pppox_sk(sk); 577 578 if (po->pppoe_dev) { 579 dev_put(po->pppoe_dev); 580 po->pppoe_dev = NULL; 581 } 582 583 pppox_unbind_sock(sk); 584 585 /* Signal the death of the socket. */ 586 sk->sk_state = PPPOX_DEAD; 587 588 net = sock_net(sk); 589 pn = pppoe_pernet(net); 590 591 /* 592 * protect "po" from concurrent updates 593 * on pppoe_flush_dev 594 */ 595 delete_item(pn, po->pppoe_pa.sid, po->pppoe_pa.remote, 596 po->pppoe_ifindex); 597 598 sock_orphan(sk); 599 sock->sk = NULL; 600 601 skb_queue_purge(&sk->sk_receive_queue); 602 release_sock(sk); 603 sock_put(sk); 604 605 return 0; 606 } 607 608 static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr, 609 int sockaddr_len, int flags) 610 { 611 struct sock *sk = sock->sk; 612 struct sockaddr_pppox *sp = (struct sockaddr_pppox *)uservaddr; 613 struct pppox_sock *po = pppox_sk(sk); 614 struct net_device *dev = NULL; 615 struct pppoe_net *pn; 616 struct net *net = NULL; 617 int error; 618 619 lock_sock(sk); 620 621 error = -EINVAL; 622 623 if (sockaddr_len != sizeof(struct sockaddr_pppox)) 624 goto end; 625 626 if (sp->sa_protocol != PX_PROTO_OE) 627 goto end; 628 629 /* Check for already bound sockets */ 630 error = -EBUSY; 631 if ((sk->sk_state & PPPOX_CONNECTED) && 632 stage_session(sp->sa_addr.pppoe.sid)) 633 goto end; 634 635 /* Check for already disconnected sockets, on attempts to disconnect */ 636 error = -EALREADY; 637 if ((sk->sk_state & PPPOX_DEAD) && 638 !stage_session(sp->sa_addr.pppoe.sid)) 639 goto end; 640 641 error = 0; 642 643 /* Delete the old binding */ 644 if (stage_session(po->pppoe_pa.sid)) { 645 pppox_unbind_sock(sk); 646 pn = pppoe_pernet(sock_net(sk)); 647 delete_item(pn, po->pppoe_pa.sid, 648 po->pppoe_pa.remote, po->pppoe_ifindex); 649 if (po->pppoe_dev) { 650 dev_put(po->pppoe_dev); 651 po->pppoe_dev = NULL; 652 } 653 654 po->pppoe_ifindex = 0; 655 memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa)); 656 memset(&po->pppoe_relay, 0, sizeof(po->pppoe_relay)); 657 memset(&po->chan, 0, sizeof(po->chan)); 658 po->next = NULL; 659 po->num = 0; 660 661 sk->sk_state = PPPOX_NONE; 662 } 663 664 /* Re-bind in session stage only */ 665 if (stage_session(sp->sa_addr.pppoe.sid)) { 666 error = -ENODEV; 667 net = sock_net(sk); 668 dev = dev_get_by_name(net, sp->sa_addr.pppoe.dev); 669 if (!dev) 670 goto err_put; 671 672 po->pppoe_dev = dev; 673 po->pppoe_ifindex = dev->ifindex; 674 pn = pppoe_pernet(net); 675 if (!(dev->flags & IFF_UP)) { 676 goto err_put; 677 } 678 679 memcpy(&po->pppoe_pa, 680 &sp->sa_addr.pppoe, 681 sizeof(struct pppoe_addr)); 682 683 write_lock_bh(&pn->hash_lock); 684 error = __set_item(pn, po); 685 write_unlock_bh(&pn->hash_lock); 686 if (error < 0) 687 goto err_put; 688 689 po->chan.hdrlen = (sizeof(struct pppoe_hdr) + 690 dev->hard_header_len); 691 692 po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2; 693 po->chan.private = sk; 694 po->chan.ops = &pppoe_chan_ops; 695 696 error = ppp_register_net_channel(dev_net(dev), &po->chan); 697 if (error) { 698 delete_item(pn, po->pppoe_pa.sid, 699 po->pppoe_pa.remote, po->pppoe_ifindex); 700 goto err_put; 701 } 702 703 sk->sk_state = PPPOX_CONNECTED; 704 } 705 706 po->num = sp->sa_addr.pppoe.sid; 707 708 end: 709 release_sock(sk); 710 return error; 711 err_put: 712 if (po->pppoe_dev) { 713 dev_put(po->pppoe_dev); 714 po->pppoe_dev = NULL; 715 } 716 goto end; 717 } 718 719 static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr, 720 int peer) 721 { 722 int len = sizeof(struct sockaddr_pppox); 723 struct sockaddr_pppox sp; 724 725 sp.sa_family = AF_PPPOX; 726 sp.sa_protocol = PX_PROTO_OE; 727 memcpy(&sp.sa_addr.pppoe, &pppox_sk(sock->sk)->pppoe_pa, 728 sizeof(struct pppoe_addr)); 729 730 memcpy(uaddr, &sp, len); 731 732 return len; 733 } 734 735 static int pppoe_ioctl(struct socket *sock, unsigned int cmd, 736 unsigned long arg) 737 { 738 struct sock *sk = sock->sk; 739 struct pppox_sock *po = pppox_sk(sk); 740 int val; 741 int err; 742 743 switch (cmd) { 744 case PPPIOCGMRU: 745 err = -ENXIO; 746 if (!(sk->sk_state & PPPOX_CONNECTED)) 747 break; 748 749 err = -EFAULT; 750 if (put_user(po->pppoe_dev->mtu - 751 sizeof(struct pppoe_hdr) - 752 PPP_HDRLEN, 753 (int __user *)arg)) 754 break; 755 err = 0; 756 break; 757 758 case PPPIOCSMRU: 759 err = -ENXIO; 760 if (!(sk->sk_state & PPPOX_CONNECTED)) 761 break; 762 763 err = -EFAULT; 764 if (get_user(val, (int __user *)arg)) 765 break; 766 767 if (val < (po->pppoe_dev->mtu 768 - sizeof(struct pppoe_hdr) 769 - PPP_HDRLEN)) 770 err = 0; 771 else 772 err = -EINVAL; 773 break; 774 775 case PPPIOCSFLAGS: 776 err = -EFAULT; 777 if (get_user(val, (int __user *)arg)) 778 break; 779 err = 0; 780 break; 781 782 case PPPOEIOCSFWD: 783 { 784 struct pppox_sock *relay_po; 785 786 err = -EBUSY; 787 if (sk->sk_state & (PPPOX_BOUND | PPPOX_DEAD)) 788 break; 789 790 err = -ENOTCONN; 791 if (!(sk->sk_state & PPPOX_CONNECTED)) 792 break; 793 794 /* PPPoE address from the user specifies an outbound 795 PPPoE address which frames are forwarded to */ 796 err = -EFAULT; 797 if (copy_from_user(&po->pppoe_relay, 798 (void __user *)arg, 799 sizeof(struct sockaddr_pppox))) 800 break; 801 802 err = -EINVAL; 803 if (po->pppoe_relay.sa_family != AF_PPPOX || 804 po->pppoe_relay.sa_protocol != PX_PROTO_OE) 805 break; 806 807 /* Check that the socket referenced by the address 808 actually exists. */ 809 relay_po = get_item_by_addr(sock_net(sk), &po->pppoe_relay); 810 if (!relay_po) 811 break; 812 813 sock_put(sk_pppox(relay_po)); 814 sk->sk_state |= PPPOX_RELAY; 815 err = 0; 816 break; 817 } 818 819 case PPPOEIOCDFWD: 820 err = -EALREADY; 821 if (!(sk->sk_state & PPPOX_RELAY)) 822 break; 823 824 sk->sk_state &= ~PPPOX_RELAY; 825 err = 0; 826 break; 827 828 default: 829 err = -ENOTTY; 830 } 831 832 return err; 833 } 834 835 static int pppoe_sendmsg(struct socket *sock, struct msghdr *m, 836 size_t total_len) 837 { 838 struct sk_buff *skb; 839 struct sock *sk = sock->sk; 840 struct pppox_sock *po = pppox_sk(sk); 841 int error; 842 struct pppoe_hdr hdr; 843 struct pppoe_hdr *ph; 844 struct net_device *dev; 845 char *start; 846 int hlen; 847 848 lock_sock(sk); 849 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) { 850 error = -ENOTCONN; 851 goto end; 852 } 853 854 hdr.ver = 1; 855 hdr.type = 1; 856 hdr.code = 0; 857 hdr.sid = po->num; 858 859 dev = po->pppoe_dev; 860 861 error = -EMSGSIZE; 862 if (total_len > (dev->mtu + dev->hard_header_len)) 863 goto end; 864 865 hlen = LL_RESERVED_SPACE(dev); 866 skb = sock_wmalloc(sk, hlen + sizeof(*ph) + total_len + 867 dev->needed_tailroom, 0, GFP_KERNEL); 868 if (!skb) { 869 error = -ENOMEM; 870 goto end; 871 } 872 873 /* Reserve space for headers. */ 874 skb_reserve(skb, hlen); 875 skb_reset_network_header(skb); 876 877 skb->dev = dev; 878 879 skb->priority = sk->sk_priority; 880 skb->protocol = cpu_to_be16(ETH_P_PPP_SES); 881 882 ph = skb_put(skb, total_len + sizeof(struct pppoe_hdr)); 883 start = (char *)&ph->tag[0]; 884 885 error = memcpy_from_msg(start, m, total_len); 886 if (error < 0) { 887 kfree_skb(skb); 888 goto end; 889 } 890 891 error = total_len; 892 dev_hard_header(skb, dev, ETH_P_PPP_SES, 893 po->pppoe_pa.remote, NULL, total_len); 894 895 memcpy(ph, &hdr, sizeof(struct pppoe_hdr)); 896 897 ph->length = htons(total_len); 898 899 dev_queue_xmit(skb); 900 901 end: 902 release_sock(sk); 903 return error; 904 } 905 906 /************************************************************************ 907 * 908 * xmit function for internal use. 909 * 910 ***********************************************************************/ 911 static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb) 912 { 913 struct pppox_sock *po = pppox_sk(sk); 914 struct net_device *dev = po->pppoe_dev; 915 struct pppoe_hdr *ph; 916 int data_len = skb->len; 917 918 /* The higher-level PPP code (ppp_unregister_channel()) ensures the PPP 919 * xmit operations conclude prior to an unregistration call. Thus 920 * sk->sk_state cannot change, so we don't need to do lock_sock(). 921 * But, we also can't do a lock_sock since that introduces a potential 922 * deadlock as we'd reverse the lock ordering used when calling 923 * ppp_unregister_channel(). 924 */ 925 926 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 927 goto abort; 928 929 if (!dev) 930 goto abort; 931 932 /* Copy the data if there is no space for the header or if it's 933 * read-only. 934 */ 935 if (skb_cow_head(skb, LL_RESERVED_SPACE(dev) + sizeof(*ph))) 936 goto abort; 937 938 __skb_push(skb, sizeof(*ph)); 939 skb_reset_network_header(skb); 940 941 ph = pppoe_hdr(skb); 942 ph->ver = 1; 943 ph->type = 1; 944 ph->code = 0; 945 ph->sid = po->num; 946 ph->length = htons(data_len); 947 948 skb->protocol = cpu_to_be16(ETH_P_PPP_SES); 949 skb->dev = dev; 950 951 dev_hard_header(skb, dev, ETH_P_PPP_SES, 952 po->pppoe_pa.remote, NULL, data_len); 953 954 dev_queue_xmit(skb); 955 return 1; 956 957 abort: 958 kfree_skb(skb); 959 return 1; 960 } 961 962 /************************************************************************ 963 * 964 * xmit function called by generic PPP driver 965 * sends PPP frame over PPPoE socket 966 * 967 ***********************************************************************/ 968 static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb) 969 { 970 struct sock *sk = (struct sock *)chan->private; 971 return __pppoe_xmit(sk, skb); 972 } 973 974 static const struct ppp_channel_ops pppoe_chan_ops = { 975 .start_xmit = pppoe_xmit, 976 }; 977 978 static int pppoe_recvmsg(struct socket *sock, struct msghdr *m, 979 size_t total_len, int flags) 980 { 981 struct sock *sk = sock->sk; 982 struct sk_buff *skb; 983 int error = 0; 984 985 if (sk->sk_state & PPPOX_BOUND) { 986 error = -EIO; 987 goto end; 988 } 989 990 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 991 flags & MSG_DONTWAIT, &error); 992 if (error < 0) 993 goto end; 994 995 if (skb) { 996 total_len = min_t(size_t, total_len, skb->len); 997 error = skb_copy_datagram_msg(skb, 0, m, total_len); 998 if (error == 0) { 999 consume_skb(skb); 1000 return total_len; 1001 } 1002 } 1003 1004 kfree_skb(skb); 1005 end: 1006 return error; 1007 } 1008 1009 #ifdef CONFIG_PROC_FS 1010 static int pppoe_seq_show(struct seq_file *seq, void *v) 1011 { 1012 struct pppox_sock *po; 1013 char *dev_name; 1014 1015 if (v == SEQ_START_TOKEN) { 1016 seq_puts(seq, "Id Address Device\n"); 1017 goto out; 1018 } 1019 1020 po = v; 1021 dev_name = po->pppoe_pa.dev; 1022 1023 seq_printf(seq, "%08X %pM %8s\n", 1024 po->pppoe_pa.sid, po->pppoe_pa.remote, dev_name); 1025 out: 1026 return 0; 1027 } 1028 1029 static inline struct pppox_sock *pppoe_get_idx(struct pppoe_net *pn, loff_t pos) 1030 { 1031 struct pppox_sock *po; 1032 int i; 1033 1034 for (i = 0; i < PPPOE_HASH_SIZE; i++) { 1035 po = pn->hash_table[i]; 1036 while (po) { 1037 if (!pos--) 1038 goto out; 1039 po = po->next; 1040 } 1041 } 1042 1043 out: 1044 return po; 1045 } 1046 1047 static void *pppoe_seq_start(struct seq_file *seq, loff_t *pos) 1048 __acquires(pn->hash_lock) 1049 { 1050 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 1051 loff_t l = *pos; 1052 1053 read_lock_bh(&pn->hash_lock); 1054 return l ? pppoe_get_idx(pn, --l) : SEQ_START_TOKEN; 1055 } 1056 1057 static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos) 1058 { 1059 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 1060 struct pppox_sock *po; 1061 1062 ++*pos; 1063 if (v == SEQ_START_TOKEN) { 1064 po = pppoe_get_idx(pn, 0); 1065 goto out; 1066 } 1067 po = v; 1068 if (po->next) 1069 po = po->next; 1070 else { 1071 int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); 1072 1073 po = NULL; 1074 while (++hash < PPPOE_HASH_SIZE) { 1075 po = pn->hash_table[hash]; 1076 if (po) 1077 break; 1078 } 1079 } 1080 1081 out: 1082 return po; 1083 } 1084 1085 static void pppoe_seq_stop(struct seq_file *seq, void *v) 1086 __releases(pn->hash_lock) 1087 { 1088 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 1089 read_unlock_bh(&pn->hash_lock); 1090 } 1091 1092 static const struct seq_operations pppoe_seq_ops = { 1093 .start = pppoe_seq_start, 1094 .next = pppoe_seq_next, 1095 .stop = pppoe_seq_stop, 1096 .show = pppoe_seq_show, 1097 }; 1098 #endif /* CONFIG_PROC_FS */ 1099 1100 static const struct proto_ops pppoe_ops = { 1101 .family = AF_PPPOX, 1102 .owner = THIS_MODULE, 1103 .release = pppoe_release, 1104 .bind = sock_no_bind, 1105 .connect = pppoe_connect, 1106 .socketpair = sock_no_socketpair, 1107 .accept = sock_no_accept, 1108 .getname = pppoe_getname, 1109 .poll = datagram_poll, 1110 .listen = sock_no_listen, 1111 .shutdown = sock_no_shutdown, 1112 .setsockopt = sock_no_setsockopt, 1113 .getsockopt = sock_no_getsockopt, 1114 .sendmsg = pppoe_sendmsg, 1115 .recvmsg = pppoe_recvmsg, 1116 .mmap = sock_no_mmap, 1117 .ioctl = pppox_ioctl, 1118 }; 1119 1120 static const struct pppox_proto pppoe_proto = { 1121 .create = pppoe_create, 1122 .ioctl = pppoe_ioctl, 1123 .owner = THIS_MODULE, 1124 }; 1125 1126 static __net_init int pppoe_init_net(struct net *net) 1127 { 1128 struct pppoe_net *pn = pppoe_pernet(net); 1129 struct proc_dir_entry *pde; 1130 1131 rwlock_init(&pn->hash_lock); 1132 1133 pde = proc_create_net("pppoe", 0444, net->proc_net, 1134 &pppoe_seq_ops, sizeof(struct seq_net_private)); 1135 #ifdef CONFIG_PROC_FS 1136 if (!pde) 1137 return -ENOMEM; 1138 #endif 1139 1140 return 0; 1141 } 1142 1143 static __net_exit void pppoe_exit_net(struct net *net) 1144 { 1145 remove_proc_entry("pppoe", net->proc_net); 1146 } 1147 1148 static struct pernet_operations pppoe_net_ops = { 1149 .init = pppoe_init_net, 1150 .exit = pppoe_exit_net, 1151 .id = &pppoe_net_id, 1152 .size = sizeof(struct pppoe_net), 1153 }; 1154 1155 static int __init pppoe_init(void) 1156 { 1157 int err; 1158 1159 err = register_pernet_device(&pppoe_net_ops); 1160 if (err) 1161 goto out; 1162 1163 err = proto_register(&pppoe_sk_proto, 0); 1164 if (err) 1165 goto out_unregister_net_ops; 1166 1167 err = register_pppox_proto(PX_PROTO_OE, &pppoe_proto); 1168 if (err) 1169 goto out_unregister_pppoe_proto; 1170 1171 dev_add_pack(&pppoes_ptype); 1172 dev_add_pack(&pppoed_ptype); 1173 register_netdevice_notifier(&pppoe_notifier); 1174 1175 return 0; 1176 1177 out_unregister_pppoe_proto: 1178 proto_unregister(&pppoe_sk_proto); 1179 out_unregister_net_ops: 1180 unregister_pernet_device(&pppoe_net_ops); 1181 out: 1182 return err; 1183 } 1184 1185 static void __exit pppoe_exit(void) 1186 { 1187 unregister_netdevice_notifier(&pppoe_notifier); 1188 dev_remove_pack(&pppoed_ptype); 1189 dev_remove_pack(&pppoes_ptype); 1190 unregister_pppox_proto(PX_PROTO_OE); 1191 proto_unregister(&pppoe_sk_proto); 1192 unregister_pernet_device(&pppoe_net_ops); 1193 } 1194 1195 module_init(pppoe_init); 1196 module_exit(pppoe_exit); 1197 1198 MODULE_AUTHOR("Michal Ostrowski <mostrows@speakeasy.net>"); 1199 MODULE_DESCRIPTION("PPP over Ethernet driver"); 1200 MODULE_LICENSE("GPL"); 1201 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OE); 1202