xref: /openbmc/linux/net/x25/af_x25.c (revision 2b8232ce)
1 /*
2  *	X.25 Packet Layer release 002
3  *
4  *	This is ALPHA test software. This code may break your machine,
5  *	randomly fail to work with new releases, misbehave and/or generally
6  *	screw up. It might even work.
7  *
8  *	This code REQUIRES 2.1.15 or higher
9  *
10  *	This module:
11  *		This module is free software; you can redistribute it and/or
12  *		modify it under the terms of the GNU General Public License
13  *		as published by the Free Software Foundation; either version
14  *		2 of the License, or (at your option) any later version.
15  *
16  *	History
17  *	X.25 001	Jonathan Naylor	Started coding.
18  *	X.25 002	Jonathan Naylor	Centralised disconnect handling.
19  *					New timer architecture.
20  *	2000-03-11	Henner Eisen	MSG_EOR handling more POSIX compliant.
21  *	2000-03-22	Daniela Squassoni Allowed disabling/enabling of
22  *					  facilities negotiation and increased
23  *					  the throughput upper limit.
24  *	2000-08-27	Arnaldo C. Melo s/suser/capable/ + micro cleanups
25  *	2000-09-04	Henner Eisen	Set sock->state in x25_accept().
26  *					Fixed x25_output() related skb leakage.
27  *	2000-10-02	Henner Eisen	Made x25_kick() single threaded per socket.
28  *	2000-10-27	Henner Eisen    MSG_DONTWAIT for fragment allocation.
29  *	2000-11-14	Henner Eisen    Closing datalink from NETDEV_GOING_DOWN
30  *	2002-10-06	Arnaldo C. Melo Get rid of cli/sti, move proc stuff to
31  *					x25_proc.c, using seq_file
32  *	2005-04-02	Shaun Pereira	Selective sub address matching
33  *					with call user data
34  *	2005-04-15	Shaun Pereira	Fast select with no restriction on
35  *					response
36  */
37 
38 #include <linux/module.h>
39 #include <linux/capability.h>
40 #include <linux/errno.h>
41 #include <linux/kernel.h>
42 #include <linux/sched.h>
43 #include <linux/timer.h>
44 #include <linux/string.h>
45 #include <linux/net.h>
46 #include <linux/netdevice.h>
47 #include <linux/if_arp.h>
48 #include <linux/skbuff.h>
49 #include <net/sock.h>
50 #include <net/tcp_states.h>
51 #include <asm/uaccess.h>
52 #include <linux/fcntl.h>
53 #include <linux/termios.h>	/* For TIOCINQ/OUTQ */
54 #include <linux/notifier.h>
55 #include <linux/init.h>
56 #include <linux/compat.h>
57 
58 #include <net/x25.h>
59 #include <net/compat.h>
60 
61 int sysctl_x25_restart_request_timeout = X25_DEFAULT_T20;
62 int sysctl_x25_call_request_timeout    = X25_DEFAULT_T21;
63 int sysctl_x25_reset_request_timeout   = X25_DEFAULT_T22;
64 int sysctl_x25_clear_request_timeout   = X25_DEFAULT_T23;
65 int sysctl_x25_ack_holdback_timeout    = X25_DEFAULT_T2;
66 int sysctl_x25_forward                 = 0;
67 
68 HLIST_HEAD(x25_list);
69 DEFINE_RWLOCK(x25_list_lock);
70 
71 static const struct proto_ops x25_proto_ops;
72 
73 static struct x25_address null_x25_address = {"               "};
74 
75 #ifdef CONFIG_COMPAT
76 struct compat_x25_subscrip_struct {
77 	char device[200-sizeof(compat_ulong_t)];
78 	compat_ulong_t global_facil_mask;
79 	compat_uint_t extended;
80 };
81 #endif
82 
83 int x25_addr_ntoa(unsigned char *p, struct x25_address *called_addr,
84 		  struct x25_address *calling_addr)
85 {
86 	int called_len, calling_len;
87 	char *called, *calling;
88 	int i;
89 
90 	called_len  = (*p >> 0) & 0x0F;
91 	calling_len = (*p >> 4) & 0x0F;
92 
93 	called  = called_addr->x25_addr;
94 	calling = calling_addr->x25_addr;
95 	p++;
96 
97 	for (i = 0; i < (called_len + calling_len); i++) {
98 		if (i < called_len) {
99 			if (i % 2 != 0) {
100 				*called++ = ((*p >> 0) & 0x0F) + '0';
101 				p++;
102 			} else {
103 				*called++ = ((*p >> 4) & 0x0F) + '0';
104 			}
105 		} else {
106 			if (i % 2 != 0) {
107 				*calling++ = ((*p >> 0) & 0x0F) + '0';
108 				p++;
109 			} else {
110 				*calling++ = ((*p >> 4) & 0x0F) + '0';
111 			}
112 		}
113 	}
114 
115 	*called = *calling = '\0';
116 
117 	return 1 + (called_len + calling_len + 1) / 2;
118 }
119 
120 int x25_addr_aton(unsigned char *p, struct x25_address *called_addr,
121 		  struct x25_address *calling_addr)
122 {
123 	unsigned int called_len, calling_len;
124 	char *called, *calling;
125 	int i;
126 
127 	called  = called_addr->x25_addr;
128 	calling = calling_addr->x25_addr;
129 
130 	called_len  = strlen(called);
131 	calling_len = strlen(calling);
132 
133 	*p++ = (calling_len << 4) | (called_len << 0);
134 
135 	for (i = 0; i < (called_len + calling_len); i++) {
136 		if (i < called_len) {
137 			if (i % 2 != 0) {
138 				*p |= (*called++ - '0') << 0;
139 				p++;
140 			} else {
141 				*p = 0x00;
142 				*p |= (*called++ - '0') << 4;
143 			}
144 		} else {
145 			if (i % 2 != 0) {
146 				*p |= (*calling++ - '0') << 0;
147 				p++;
148 			} else {
149 				*p = 0x00;
150 				*p |= (*calling++ - '0') << 4;
151 			}
152 		}
153 	}
154 
155 	return 1 + (called_len + calling_len + 1) / 2;
156 }
157 
158 /*
159  *	Socket removal during an interrupt is now safe.
160  */
161 static void x25_remove_socket(struct sock *sk)
162 {
163 	write_lock_bh(&x25_list_lock);
164 	sk_del_node_init(sk);
165 	write_unlock_bh(&x25_list_lock);
166 }
167 
168 /*
169  *	Kill all bound sockets on a dropped device.
170  */
171 static void x25_kill_by_device(struct net_device *dev)
172 {
173 	struct sock *s;
174 	struct hlist_node *node;
175 
176 	write_lock_bh(&x25_list_lock);
177 
178 	sk_for_each(s, node, &x25_list)
179 		if (x25_sk(s)->neighbour && x25_sk(s)->neighbour->dev == dev)
180 			x25_disconnect(s, ENETUNREACH, 0, 0);
181 
182 	write_unlock_bh(&x25_list_lock);
183 }
184 
185 /*
186  *	Handle device status changes.
187  */
188 static int x25_device_event(struct notifier_block *this, unsigned long event,
189 			    void *ptr)
190 {
191 	struct net_device *dev = ptr;
192 	struct x25_neigh *nb;
193 
194 	if (dev->nd_net != &init_net)
195 		return NOTIFY_DONE;
196 
197 	if (dev->type == ARPHRD_X25
198 #if defined(CONFIG_LLC) || defined(CONFIG_LLC_MODULE)
199 	 || dev->type == ARPHRD_ETHER
200 #endif
201 	 ) {
202 		switch (event) {
203 			case NETDEV_UP:
204 				x25_link_device_up(dev);
205 				break;
206 			case NETDEV_GOING_DOWN:
207 				nb = x25_get_neigh(dev);
208 				if (nb) {
209 					x25_terminate_link(nb);
210 					x25_neigh_put(nb);
211 				}
212 				break;
213 			case NETDEV_DOWN:
214 				x25_kill_by_device(dev);
215 				x25_route_device_down(dev);
216 				x25_link_device_down(dev);
217 				break;
218 		}
219 	}
220 
221 	return NOTIFY_DONE;
222 }
223 
224 /*
225  *	Add a socket to the bound sockets list.
226  */
227 static void x25_insert_socket(struct sock *sk)
228 {
229 	write_lock_bh(&x25_list_lock);
230 	sk_add_node(sk, &x25_list);
231 	write_unlock_bh(&x25_list_lock);
232 }
233 
234 /*
235  *	Find a socket that wants to accept the Call Request we just
236  *	received. Check the full list for an address/cud match.
237  *	If no cuds match return the next_best thing, an address match.
238  *	Note: if a listening socket has cud set it must only get calls
239  *	with matching cud.
240  */
241 static struct sock *x25_find_listener(struct x25_address *addr,
242 					struct sk_buff *skb)
243 {
244 	struct sock *s;
245 	struct sock *next_best;
246 	struct hlist_node *node;
247 
248 	read_lock_bh(&x25_list_lock);
249 	next_best = NULL;
250 
251 	sk_for_each(s, node, &x25_list)
252 		if ((!strcmp(addr->x25_addr,
253 			x25_sk(s)->source_addr.x25_addr) ||
254 				!strcmp(addr->x25_addr,
255 					null_x25_address.x25_addr)) &&
256 					s->sk_state == TCP_LISTEN) {
257 			/*
258 			 * Found a listening socket, now check the incoming
259 			 * call user data vs this sockets call user data
260 			 */
261 			if(skb->len > 0 && x25_sk(s)->cudmatchlength > 0) {
262 				if((memcmp(x25_sk(s)->calluserdata.cuddata,
263 					skb->data,
264 					x25_sk(s)->cudmatchlength)) == 0) {
265 					sock_hold(s);
266 					goto found;
267 				 }
268 			} else
269 				next_best = s;
270 		}
271 	if (next_best) {
272 		s = next_best;
273 		sock_hold(s);
274 		goto found;
275 	}
276 	s = NULL;
277 found:
278 	read_unlock_bh(&x25_list_lock);
279 	return s;
280 }
281 
282 /*
283  *	Find a connected X.25 socket given my LCI and neighbour.
284  */
285 static struct sock *__x25_find_socket(unsigned int lci, struct x25_neigh *nb)
286 {
287 	struct sock *s;
288 	struct hlist_node *node;
289 
290 	sk_for_each(s, node, &x25_list)
291 		if (x25_sk(s)->lci == lci && x25_sk(s)->neighbour == nb) {
292 			sock_hold(s);
293 			goto found;
294 		}
295 	s = NULL;
296 found:
297 	return s;
298 }
299 
300 struct sock *x25_find_socket(unsigned int lci, struct x25_neigh *nb)
301 {
302 	struct sock *s;
303 
304 	read_lock_bh(&x25_list_lock);
305 	s = __x25_find_socket(lci, nb);
306 	read_unlock_bh(&x25_list_lock);
307 	return s;
308 }
309 
310 /*
311  *	Find a unique LCI for a given device.
312  */
313 static unsigned int x25_new_lci(struct x25_neigh *nb)
314 {
315 	unsigned int lci = 1;
316 	struct sock *sk;
317 
318 	read_lock_bh(&x25_list_lock);
319 
320 	while ((sk = __x25_find_socket(lci, nb)) != NULL) {
321 		sock_put(sk);
322 		if (++lci == 4096) {
323 			lci = 0;
324 			break;
325 		}
326 	}
327 
328 	read_unlock_bh(&x25_list_lock);
329 	return lci;
330 }
331 
332 /*
333  *	Deferred destroy.
334  */
335 void x25_destroy_socket(struct sock *);
336 
337 /*
338  *	handler for deferred kills.
339  */
340 static void x25_destroy_timer(unsigned long data)
341 {
342 	x25_destroy_socket((struct sock *)data);
343 }
344 
345 /*
346  *	This is called from user mode and the timers. Thus it protects itself
347  *	against interrupt users but doesn't worry about being called during
348  *	work. Once it is removed from the queue no interrupt or bottom half
349  *	will touch it and we are (fairly 8-) ) safe.
350  *	Not static as it's used by the timer
351  */
352 void x25_destroy_socket(struct sock *sk)
353 {
354 	struct sk_buff *skb;
355 
356 	sock_hold(sk);
357 	lock_sock(sk);
358 	x25_stop_heartbeat(sk);
359 	x25_stop_timer(sk);
360 
361 	x25_remove_socket(sk);
362 	x25_clear_queues(sk);		/* Flush the queues */
363 
364 	while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
365 		if (skb->sk != sk) {		/* A pending connection */
366 			/*
367 			 * Queue the unaccepted socket for death
368 			 */
369 			sock_set_flag(skb->sk, SOCK_DEAD);
370 			x25_start_heartbeat(skb->sk);
371 			x25_sk(skb->sk)->state = X25_STATE_0;
372 		}
373 
374 		kfree_skb(skb);
375 	}
376 
377 	if (atomic_read(&sk->sk_wmem_alloc) ||
378 	    atomic_read(&sk->sk_rmem_alloc)) {
379 		/* Defer: outstanding buffers */
380 		sk->sk_timer.expires  = jiffies + 10 * HZ;
381 		sk->sk_timer.function = x25_destroy_timer;
382 		sk->sk_timer.data = (unsigned long)sk;
383 		add_timer(&sk->sk_timer);
384 	} else {
385 		/* drop last reference so sock_put will free */
386 		__sock_put(sk);
387 	}
388 
389 	release_sock(sk);
390 	sock_put(sk);
391 }
392 
393 /*
394  *	Handling for system calls applied via the various interfaces to a
395  *	X.25 socket object.
396  */
397 
398 static int x25_setsockopt(struct socket *sock, int level, int optname,
399 			  char __user *optval, int optlen)
400 {
401 	int opt;
402 	struct sock *sk = sock->sk;
403 	int rc = -ENOPROTOOPT;
404 
405 	if (level != SOL_X25 || optname != X25_QBITINCL)
406 		goto out;
407 
408 	rc = -EINVAL;
409 	if (optlen < sizeof(int))
410 		goto out;
411 
412 	rc = -EFAULT;
413 	if (get_user(opt, (int __user *)optval))
414 		goto out;
415 
416 	x25_sk(sk)->qbitincl = !!opt;
417 	rc = 0;
418 out:
419 	return rc;
420 }
421 
422 static int x25_getsockopt(struct socket *sock, int level, int optname,
423 			  char __user *optval, int __user *optlen)
424 {
425 	struct sock *sk = sock->sk;
426 	int val, len, rc = -ENOPROTOOPT;
427 
428 	if (level != SOL_X25 || optname != X25_QBITINCL)
429 		goto out;
430 
431 	rc = -EFAULT;
432 	if (get_user(len, optlen))
433 		goto out;
434 
435 	len = min_t(unsigned int, len, sizeof(int));
436 
437 	rc = -EINVAL;
438 	if (len < 0)
439 		goto out;
440 
441 	rc = -EFAULT;
442 	if (put_user(len, optlen))
443 		goto out;
444 
445 	val = x25_sk(sk)->qbitincl;
446 	rc = copy_to_user(optval, &val, len) ? -EFAULT : 0;
447 out:
448 	return rc;
449 }
450 
451 static int x25_listen(struct socket *sock, int backlog)
452 {
453 	struct sock *sk = sock->sk;
454 	int rc = -EOPNOTSUPP;
455 
456 	if (sk->sk_state != TCP_LISTEN) {
457 		memset(&x25_sk(sk)->dest_addr, 0, X25_ADDR_LEN);
458 		sk->sk_max_ack_backlog = backlog;
459 		sk->sk_state           = TCP_LISTEN;
460 		rc = 0;
461 	}
462 
463 	return rc;
464 }
465 
466 static struct proto x25_proto = {
467 	.name	  = "X25",
468 	.owner	  = THIS_MODULE,
469 	.obj_size = sizeof(struct x25_sock),
470 };
471 
472 static struct sock *x25_alloc_socket(struct net *net)
473 {
474 	struct x25_sock *x25;
475 	struct sock *sk = sk_alloc(net, AF_X25, GFP_ATOMIC, &x25_proto, 1);
476 
477 	if (!sk)
478 		goto out;
479 
480 	sock_init_data(NULL, sk);
481 
482 	x25 = x25_sk(sk);
483 	skb_queue_head_init(&x25->ack_queue);
484 	skb_queue_head_init(&x25->fragment_queue);
485 	skb_queue_head_init(&x25->interrupt_in_queue);
486 	skb_queue_head_init(&x25->interrupt_out_queue);
487 out:
488 	return sk;
489 }
490 
491 static int x25_create(struct net *net, struct socket *sock, int protocol)
492 {
493 	struct sock *sk;
494 	struct x25_sock *x25;
495 	int rc = -ESOCKTNOSUPPORT;
496 
497 	if (net != &init_net)
498 		return -EAFNOSUPPORT;
499 
500 	if (sock->type != SOCK_SEQPACKET || protocol)
501 		goto out;
502 
503 	rc = -ENOMEM;
504 	if ((sk = x25_alloc_socket(net)) == NULL)
505 		goto out;
506 
507 	x25 = x25_sk(sk);
508 
509 	sock_init_data(sock, sk);
510 
511 	x25_init_timers(sk);
512 
513 	sock->ops    = &x25_proto_ops;
514 	sk->sk_protocol = protocol;
515 	sk->sk_backlog_rcv = x25_backlog_rcv;
516 
517 	x25->t21   = sysctl_x25_call_request_timeout;
518 	x25->t22   = sysctl_x25_reset_request_timeout;
519 	x25->t23   = sysctl_x25_clear_request_timeout;
520 	x25->t2    = sysctl_x25_ack_holdback_timeout;
521 	x25->state = X25_STATE_0;
522 	x25->cudmatchlength = 0;
523 	x25->accptapprv = X25_DENY_ACCPT_APPRV;		/* normally no cud  */
524 							/* on call accept   */
525 
526 	x25->facilities.winsize_in  = X25_DEFAULT_WINDOW_SIZE;
527 	x25->facilities.winsize_out = X25_DEFAULT_WINDOW_SIZE;
528 	x25->facilities.pacsize_in  = X25_DEFAULT_PACKET_SIZE;
529 	x25->facilities.pacsize_out = X25_DEFAULT_PACKET_SIZE;
530 	x25->facilities.throughput  = X25_DEFAULT_THROUGHPUT;
531 	x25->facilities.reverse     = X25_DEFAULT_REVERSE;
532 	x25->dte_facilities.calling_len = 0;
533 	x25->dte_facilities.called_len = 0;
534 	memset(x25->dte_facilities.called_ae, '\0',
535 			sizeof(x25->dte_facilities.called_ae));
536 	memset(x25->dte_facilities.calling_ae, '\0',
537 			sizeof(x25->dte_facilities.calling_ae));
538 
539 	rc = 0;
540 out:
541 	return rc;
542 }
543 
544 static struct sock *x25_make_new(struct sock *osk)
545 {
546 	struct sock *sk = NULL;
547 	struct x25_sock *x25, *ox25;
548 
549 	if (osk->sk_type != SOCK_SEQPACKET)
550 		goto out;
551 
552 	if ((sk = x25_alloc_socket(osk->sk_net)) == NULL)
553 		goto out;
554 
555 	x25 = x25_sk(sk);
556 
557 	sk->sk_type        = osk->sk_type;
558 	sk->sk_socket      = osk->sk_socket;
559 	sk->sk_priority    = osk->sk_priority;
560 	sk->sk_protocol    = osk->sk_protocol;
561 	sk->sk_rcvbuf      = osk->sk_rcvbuf;
562 	sk->sk_sndbuf      = osk->sk_sndbuf;
563 	sk->sk_state       = TCP_ESTABLISHED;
564 	sk->sk_sleep       = osk->sk_sleep;
565 	sk->sk_backlog_rcv = osk->sk_backlog_rcv;
566 	sock_copy_flags(sk, osk);
567 
568 	ox25 = x25_sk(osk);
569 	x25->t21        = ox25->t21;
570 	x25->t22        = ox25->t22;
571 	x25->t23        = ox25->t23;
572 	x25->t2         = ox25->t2;
573 	x25->facilities = ox25->facilities;
574 	x25->qbitincl   = ox25->qbitincl;
575 	x25->dte_facilities = ox25->dte_facilities;
576 	x25->cudmatchlength = ox25->cudmatchlength;
577 	x25->accptapprv = ox25->accptapprv;
578 
579 	x25_init_timers(sk);
580 out:
581 	return sk;
582 }
583 
584 static int x25_release(struct socket *sock)
585 {
586 	struct sock *sk = sock->sk;
587 	struct x25_sock *x25;
588 
589 	if (!sk)
590 		goto out;
591 
592 	x25 = x25_sk(sk);
593 
594 	switch (x25->state) {
595 
596 		case X25_STATE_0:
597 		case X25_STATE_2:
598 			x25_disconnect(sk, 0, 0, 0);
599 			x25_destroy_socket(sk);
600 			goto out;
601 
602 		case X25_STATE_1:
603 		case X25_STATE_3:
604 		case X25_STATE_4:
605 			x25_clear_queues(sk);
606 			x25_write_internal(sk, X25_CLEAR_REQUEST);
607 			x25_start_t23timer(sk);
608 			x25->state = X25_STATE_2;
609 			sk->sk_state	= TCP_CLOSE;
610 			sk->sk_shutdown	|= SEND_SHUTDOWN;
611 			sk->sk_state_change(sk);
612 			sock_set_flag(sk, SOCK_DEAD);
613 			sock_set_flag(sk, SOCK_DESTROY);
614 			break;
615 	}
616 
617 	sock->sk	= NULL;
618 	sk->sk_socket	= NULL;	/* Not used, but we should do this */
619 out:
620 	return 0;
621 }
622 
623 static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
624 {
625 	struct sock *sk = sock->sk;
626 	struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;
627 
628 	if (!sock_flag(sk, SOCK_ZAPPED) ||
629 	    addr_len != sizeof(struct sockaddr_x25) ||
630 	    addr->sx25_family != AF_X25)
631 		return -EINVAL;
632 
633 	x25_sk(sk)->source_addr = addr->sx25_addr;
634 	x25_insert_socket(sk);
635 	sock_reset_flag(sk, SOCK_ZAPPED);
636 	SOCK_DEBUG(sk, "x25_bind: socket is bound\n");
637 
638 	return 0;
639 }
640 
641 static int x25_wait_for_connection_establishment(struct sock *sk)
642 {
643 	DECLARE_WAITQUEUE(wait, current);
644 	int rc;
645 
646 	add_wait_queue_exclusive(sk->sk_sleep, &wait);
647 	for (;;) {
648 		__set_current_state(TASK_INTERRUPTIBLE);
649 		rc = -ERESTARTSYS;
650 		if (signal_pending(current))
651 			break;
652 		rc = sock_error(sk);
653 		if (rc) {
654 			sk->sk_socket->state = SS_UNCONNECTED;
655 			break;
656 		}
657 		rc = 0;
658 		if (sk->sk_state != TCP_ESTABLISHED) {
659 			release_sock(sk);
660 			schedule();
661 			lock_sock(sk);
662 		} else
663 			break;
664 	}
665 	__set_current_state(TASK_RUNNING);
666 	remove_wait_queue(sk->sk_sleep, &wait);
667 	return rc;
668 }
669 
670 static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
671 		       int addr_len, int flags)
672 {
673 	struct sock *sk = sock->sk;
674 	struct x25_sock *x25 = x25_sk(sk);
675 	struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;
676 	struct x25_route *rt;
677 	int rc = 0;
678 
679 	lock_sock(sk);
680 	if (sk->sk_state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
681 		sock->state = SS_CONNECTED;
682 		goto out; /* Connect completed during a ERESTARTSYS event */
683 	}
684 
685 	rc = -ECONNREFUSED;
686 	if (sk->sk_state == TCP_CLOSE && sock->state == SS_CONNECTING) {
687 		sock->state = SS_UNCONNECTED;
688 		goto out;
689 	}
690 
691 	rc = -EISCONN;	/* No reconnect on a seqpacket socket */
692 	if (sk->sk_state == TCP_ESTABLISHED)
693 		goto out;
694 
695 	sk->sk_state   = TCP_CLOSE;
696 	sock->state = SS_UNCONNECTED;
697 
698 	rc = -EINVAL;
699 	if (addr_len != sizeof(struct sockaddr_x25) ||
700 	    addr->sx25_family != AF_X25)
701 		goto out;
702 
703 	rc = -ENETUNREACH;
704 	rt = x25_get_route(&addr->sx25_addr);
705 	if (!rt)
706 		goto out;
707 
708 	x25->neighbour = x25_get_neigh(rt->dev);
709 	if (!x25->neighbour)
710 		goto out_put_route;
711 
712 	x25_limit_facilities(&x25->facilities, x25->neighbour);
713 
714 	x25->lci = x25_new_lci(x25->neighbour);
715 	if (!x25->lci)
716 		goto out_put_neigh;
717 
718 	rc = -EINVAL;
719 	if (sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
720 		goto out_put_neigh;
721 
722 	if (!strcmp(x25->source_addr.x25_addr, null_x25_address.x25_addr))
723 		memset(&x25->source_addr, '\0', X25_ADDR_LEN);
724 
725 	x25->dest_addr = addr->sx25_addr;
726 
727 	/* Move to connecting socket, start sending Connect Requests */
728 	sock->state   = SS_CONNECTING;
729 	sk->sk_state  = TCP_SYN_SENT;
730 
731 	x25->state = X25_STATE_1;
732 
733 	x25_write_internal(sk, X25_CALL_REQUEST);
734 
735 	x25_start_heartbeat(sk);
736 	x25_start_t21timer(sk);
737 
738 	/* Now the loop */
739 	rc = -EINPROGRESS;
740 	if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK))
741 		goto out_put_neigh;
742 
743 	rc = x25_wait_for_connection_establishment(sk);
744 	if (rc)
745 		goto out_put_neigh;
746 
747 	sock->state = SS_CONNECTED;
748 	rc = 0;
749 out_put_neigh:
750 	if (rc)
751 		x25_neigh_put(x25->neighbour);
752 out_put_route:
753 	x25_route_put(rt);
754 out:
755 	release_sock(sk);
756 	return rc;
757 }
758 
759 static int x25_wait_for_data(struct sock *sk, long timeout)
760 {
761 	DECLARE_WAITQUEUE(wait, current);
762 	int rc = 0;
763 
764 	add_wait_queue_exclusive(sk->sk_sleep, &wait);
765 	for (;;) {
766 		__set_current_state(TASK_INTERRUPTIBLE);
767 		if (sk->sk_shutdown & RCV_SHUTDOWN)
768 			break;
769 		rc = -ERESTARTSYS;
770 		if (signal_pending(current))
771 			break;
772 		rc = -EAGAIN;
773 		if (!timeout)
774 			break;
775 		rc = 0;
776 		if (skb_queue_empty(&sk->sk_receive_queue)) {
777 			release_sock(sk);
778 			timeout = schedule_timeout(timeout);
779 			lock_sock(sk);
780 		} else
781 			break;
782 	}
783 	__set_current_state(TASK_RUNNING);
784 	remove_wait_queue(sk->sk_sleep, &wait);
785 	return rc;
786 }
787 
788 static int x25_accept(struct socket *sock, struct socket *newsock, int flags)
789 {
790 	struct sock *sk = sock->sk;
791 	struct sock *newsk;
792 	struct sk_buff *skb;
793 	int rc = -EINVAL;
794 
795 	if (!sk || sk->sk_state != TCP_LISTEN)
796 		goto out;
797 
798 	rc = -EOPNOTSUPP;
799 	if (sk->sk_type != SOCK_SEQPACKET)
800 		goto out;
801 
802 	lock_sock(sk);
803 	rc = x25_wait_for_data(sk, sk->sk_rcvtimeo);
804 	if (rc)
805 		goto out2;
806 	skb = skb_dequeue(&sk->sk_receive_queue);
807 	rc = -EINVAL;
808 	if (!skb->sk)
809 		goto out2;
810 	newsk		 = skb->sk;
811 	newsk->sk_socket = newsock;
812 	newsk->sk_sleep  = &newsock->wait;
813 
814 	/* Now attach up the new socket */
815 	skb->sk = NULL;
816 	kfree_skb(skb);
817 	sk->sk_ack_backlog--;
818 	newsock->sk    = newsk;
819 	newsock->state = SS_CONNECTED;
820 	rc = 0;
821 out2:
822 	release_sock(sk);
823 out:
824 	return rc;
825 }
826 
827 static int x25_getname(struct socket *sock, struct sockaddr *uaddr,
828 		       int *uaddr_len, int peer)
829 {
830 	struct sockaddr_x25 *sx25 = (struct sockaddr_x25 *)uaddr;
831 	struct sock *sk = sock->sk;
832 	struct x25_sock *x25 = x25_sk(sk);
833 
834 	if (peer) {
835 		if (sk->sk_state != TCP_ESTABLISHED)
836 			return -ENOTCONN;
837 		sx25->sx25_addr = x25->dest_addr;
838 	} else
839 		sx25->sx25_addr = x25->source_addr;
840 
841 	sx25->sx25_family = AF_X25;
842 	*uaddr_len = sizeof(*sx25);
843 
844 	return 0;
845 }
846 
847 int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
848 			unsigned int lci)
849 {
850 	struct sock *sk;
851 	struct sock *make;
852 	struct x25_sock *makex25;
853 	struct x25_address source_addr, dest_addr;
854 	struct x25_facilities facilities;
855 	struct x25_dte_facilities dte_facilities;
856 	int len, addr_len, rc;
857 
858 	/*
859 	 *	Remove the LCI and frame type.
860 	 */
861 	skb_pull(skb, X25_STD_MIN_LEN);
862 
863 	/*
864 	 *	Extract the X.25 addresses and convert them to ASCII strings,
865 	 *	and remove them.
866 	 */
867 	addr_len = x25_addr_ntoa(skb->data, &source_addr, &dest_addr);
868 	skb_pull(skb, addr_len);
869 
870 	/*
871 	 *	Get the length of the facilities, skip past them for the moment
872 	 *	get the call user data because this is needed to determine
873 	 *	the correct listener
874 	 */
875 	len = skb->data[0] + 1;
876 	skb_pull(skb,len);
877 
878 	/*
879 	 *	Find a listener for the particular address/cud pair.
880 	 */
881 	sk = x25_find_listener(&source_addr,skb);
882 	skb_push(skb,len);
883 
884 	if (sk != NULL && sk_acceptq_is_full(sk)) {
885 		goto out_sock_put;
886 	}
887 
888 	/*
889 	 *	We dont have any listeners for this incoming call.
890 	 *	Try forwarding it.
891 	 */
892 	if (sk == NULL) {
893 		skb_push(skb, addr_len + X25_STD_MIN_LEN);
894 		if (sysctl_x25_forward &&
895 				x25_forward_call(&dest_addr, nb, skb, lci) > 0)
896 		{
897 			/* Call was forwarded, dont process it any more */
898 			kfree_skb(skb);
899 			rc = 1;
900 			goto out;
901 		} else {
902 			/* No listeners, can't forward, clear the call */
903 			goto out_clear_request;
904 		}
905 	}
906 
907 	/*
908 	 *	Try to reach a compromise on the requested facilities.
909 	 */
910 	len = x25_negotiate_facilities(skb, sk, &facilities, &dte_facilities);
911 	if (len == -1)
912 		goto out_sock_put;
913 
914 	/*
915 	 * current neighbour/link might impose additional limits
916 	 * on certain facilties
917 	 */
918 
919 	x25_limit_facilities(&facilities, nb);
920 
921 	/*
922 	 *	Try to create a new socket.
923 	 */
924 	make = x25_make_new(sk);
925 	if (!make)
926 		goto out_sock_put;
927 
928 	/*
929 	 *	Remove the facilities
930 	 */
931 	skb_pull(skb, len);
932 
933 	skb->sk     = make;
934 	make->sk_state = TCP_ESTABLISHED;
935 
936 	makex25 = x25_sk(make);
937 	makex25->lci           = lci;
938 	makex25->dest_addr     = dest_addr;
939 	makex25->source_addr   = source_addr;
940 	makex25->neighbour     = nb;
941 	makex25->facilities    = facilities;
942 	makex25->dte_facilities= dte_facilities;
943 	makex25->vc_facil_mask = x25_sk(sk)->vc_facil_mask;
944 	/* ensure no reverse facil on accept */
945 	makex25->vc_facil_mask &= ~X25_MASK_REVERSE;
946 	/* ensure no calling address extension on accept */
947 	makex25->vc_facil_mask &= ~X25_MASK_CALLING_AE;
948 	makex25->cudmatchlength = x25_sk(sk)->cudmatchlength;
949 
950 	/* Normally all calls are accepted immediatly */
951 	if(makex25->accptapprv & X25_DENY_ACCPT_APPRV) {
952 		x25_write_internal(make, X25_CALL_ACCEPTED);
953 		makex25->state = X25_STATE_3;
954 	}
955 
956 	/*
957 	 *	Incoming Call User Data.
958 	 */
959 	if (skb->len >= 0) {
960 		skb_copy_from_linear_data(skb, makex25->calluserdata.cuddata, skb->len);
961 		makex25->calluserdata.cudlength = skb->len;
962 	}
963 
964 	sk->sk_ack_backlog++;
965 
966 	x25_insert_socket(make);
967 
968 	skb_queue_head(&sk->sk_receive_queue, skb);
969 
970 	x25_start_heartbeat(make);
971 
972 	if (!sock_flag(sk, SOCK_DEAD))
973 		sk->sk_data_ready(sk, skb->len);
974 	rc = 1;
975 	sock_put(sk);
976 out:
977 	return rc;
978 out_sock_put:
979 	sock_put(sk);
980 out_clear_request:
981 	rc = 0;
982 	x25_transmit_clear_request(nb, lci, 0x01);
983 	goto out;
984 }
985 
986 static int x25_sendmsg(struct kiocb *iocb, struct socket *sock,
987 		       struct msghdr *msg, size_t len)
988 {
989 	struct sock *sk = sock->sk;
990 	struct x25_sock *x25 = x25_sk(sk);
991 	struct sockaddr_x25 *usx25 = (struct sockaddr_x25 *)msg->msg_name;
992 	struct sockaddr_x25 sx25;
993 	struct sk_buff *skb;
994 	unsigned char *asmptr;
995 	int noblock = msg->msg_flags & MSG_DONTWAIT;
996 	size_t size;
997 	int qbit = 0, rc = -EINVAL;
998 
999 	if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_OOB|MSG_EOR|MSG_CMSG_COMPAT))
1000 		goto out;
1001 
1002 	/* we currently don't support segmented records at the user interface */
1003 	if (!(msg->msg_flags & (MSG_EOR|MSG_OOB)))
1004 		goto out;
1005 
1006 	rc = -EADDRNOTAVAIL;
1007 	if (sock_flag(sk, SOCK_ZAPPED))
1008 		goto out;
1009 
1010 	rc = -EPIPE;
1011 	if (sk->sk_shutdown & SEND_SHUTDOWN) {
1012 		send_sig(SIGPIPE, current, 0);
1013 		goto out;
1014 	}
1015 
1016 	rc = -ENETUNREACH;
1017 	if (!x25->neighbour)
1018 		goto out;
1019 
1020 	if (usx25) {
1021 		rc = -EINVAL;
1022 		if (msg->msg_namelen < sizeof(sx25))
1023 			goto out;
1024 		memcpy(&sx25, usx25, sizeof(sx25));
1025 		rc = -EISCONN;
1026 		if (strcmp(x25->dest_addr.x25_addr, sx25.sx25_addr.x25_addr))
1027 			goto out;
1028 		rc = -EINVAL;
1029 		if (sx25.sx25_family != AF_X25)
1030 			goto out;
1031 	} else {
1032 		/*
1033 		 *	FIXME 1003.1g - if the socket is like this because
1034 		 *	it has become closed (not started closed) we ought
1035 		 *	to SIGPIPE, EPIPE;
1036 		 */
1037 		rc = -ENOTCONN;
1038 		if (sk->sk_state != TCP_ESTABLISHED)
1039 			goto out;
1040 
1041 		sx25.sx25_family = AF_X25;
1042 		sx25.sx25_addr   = x25->dest_addr;
1043 	}
1044 
1045 	SOCK_DEBUG(sk, "x25_sendmsg: sendto: Addresses built.\n");
1046 
1047 	/* Build a packet */
1048 	SOCK_DEBUG(sk, "x25_sendmsg: sendto: building packet.\n");
1049 
1050 	if ((msg->msg_flags & MSG_OOB) && len > 32)
1051 		len = 32;
1052 
1053 	size = len + X25_MAX_L2_LEN + X25_EXT_MIN_LEN;
1054 
1055 	skb = sock_alloc_send_skb(sk, size, noblock, &rc);
1056 	if (!skb)
1057 		goto out;
1058 	X25_SKB_CB(skb)->flags = msg->msg_flags;
1059 
1060 	skb_reserve(skb, X25_MAX_L2_LEN + X25_EXT_MIN_LEN);
1061 
1062 	/*
1063 	 *	Put the data on the end
1064 	 */
1065 	SOCK_DEBUG(sk, "x25_sendmsg: Copying user data\n");
1066 
1067 	skb_reset_transport_header(skb);
1068 	skb_put(skb, len);
1069 
1070 	rc = memcpy_fromiovec(skb_transport_header(skb), msg->msg_iov, len);
1071 	if (rc)
1072 		goto out_kfree_skb;
1073 
1074 	/*
1075 	 *	If the Q BIT Include socket option is in force, the first
1076 	 *	byte of the user data is the logical value of the Q Bit.
1077 	 */
1078 	if (x25->qbitincl) {
1079 		qbit = skb->data[0];
1080 		skb_pull(skb, 1);
1081 	}
1082 
1083 	/*
1084 	 *	Push down the X.25 header
1085 	 */
1086 	SOCK_DEBUG(sk, "x25_sendmsg: Building X.25 Header.\n");
1087 
1088 	if (msg->msg_flags & MSG_OOB) {
1089 		if (x25->neighbour->extended) {
1090 			asmptr    = skb_push(skb, X25_STD_MIN_LEN);
1091 			*asmptr++ = ((x25->lci >> 8) & 0x0F) | X25_GFI_EXTSEQ;
1092 			*asmptr++ = (x25->lci >> 0) & 0xFF;
1093 			*asmptr++ = X25_INTERRUPT;
1094 		} else {
1095 			asmptr    = skb_push(skb, X25_STD_MIN_LEN);
1096 			*asmptr++ = ((x25->lci >> 8) & 0x0F) | X25_GFI_STDSEQ;
1097 			*asmptr++ = (x25->lci >> 0) & 0xFF;
1098 			*asmptr++ = X25_INTERRUPT;
1099 		}
1100 	} else {
1101 		if (x25->neighbour->extended) {
1102 			/* Build an Extended X.25 header */
1103 			asmptr    = skb_push(skb, X25_EXT_MIN_LEN);
1104 			*asmptr++ = ((x25->lci >> 8) & 0x0F) | X25_GFI_EXTSEQ;
1105 			*asmptr++ = (x25->lci >> 0) & 0xFF;
1106 			*asmptr++ = X25_DATA;
1107 			*asmptr++ = X25_DATA;
1108 		} else {
1109 			/* Build an Standard X.25 header */
1110 			asmptr    = skb_push(skb, X25_STD_MIN_LEN);
1111 			*asmptr++ = ((x25->lci >> 8) & 0x0F) | X25_GFI_STDSEQ;
1112 			*asmptr++ = (x25->lci >> 0) & 0xFF;
1113 			*asmptr++ = X25_DATA;
1114 		}
1115 
1116 		if (qbit)
1117 			skb->data[0] |= X25_Q_BIT;
1118 	}
1119 
1120 	SOCK_DEBUG(sk, "x25_sendmsg: Built header.\n");
1121 	SOCK_DEBUG(sk, "x25_sendmsg: Transmitting buffer\n");
1122 
1123 	rc = -ENOTCONN;
1124 	if (sk->sk_state != TCP_ESTABLISHED)
1125 		goto out_kfree_skb;
1126 
1127 	if (msg->msg_flags & MSG_OOB)
1128 		skb_queue_tail(&x25->interrupt_out_queue, skb);
1129 	else {
1130 		len = x25_output(sk, skb);
1131 		if (len < 0)
1132 			kfree_skb(skb);
1133 		else if (x25->qbitincl)
1134 			len++;
1135 	}
1136 
1137 	/*
1138 	 * lock_sock() is currently only used to serialize this x25_kick()
1139 	 * against input-driven x25_kick() calls. It currently only blocks
1140 	 * incoming packets for this socket and does not protect against
1141 	 * any other socket state changes and is not called from anywhere
1142 	 * else. As x25_kick() cannot block and as long as all socket
1143 	 * operations are BKL-wrapped, we don't need take to care about
1144 	 * purging the backlog queue in x25_release().
1145 	 *
1146 	 * Using lock_sock() to protect all socket operations entirely
1147 	 * (and making the whole x25 stack SMP aware) unfortunately would
1148 	 * require major changes to {send,recv}msg and skb allocation methods.
1149 	 * -> 2.5 ;)
1150 	 */
1151 	lock_sock(sk);
1152 	x25_kick(sk);
1153 	release_sock(sk);
1154 	rc = len;
1155 out:
1156 	return rc;
1157 out_kfree_skb:
1158 	kfree_skb(skb);
1159 	goto out;
1160 }
1161 
1162 
1163 static int x25_recvmsg(struct kiocb *iocb, struct socket *sock,
1164 		       struct msghdr *msg, size_t size,
1165 		       int flags)
1166 {
1167 	struct sock *sk = sock->sk;
1168 	struct x25_sock *x25 = x25_sk(sk);
1169 	struct sockaddr_x25 *sx25 = (struct sockaddr_x25 *)msg->msg_name;
1170 	size_t copied;
1171 	int qbit;
1172 	struct sk_buff *skb;
1173 	unsigned char *asmptr;
1174 	int rc = -ENOTCONN;
1175 
1176 	/*
1177 	 * This works for seqpacket too. The receiver has ordered the queue for
1178 	 * us! We do one quick check first though
1179 	 */
1180 	if (sk->sk_state != TCP_ESTABLISHED)
1181 		goto out;
1182 
1183 	if (flags & MSG_OOB) {
1184 		rc = -EINVAL;
1185 		if (sock_flag(sk, SOCK_URGINLINE) ||
1186 		    !skb_peek(&x25->interrupt_in_queue))
1187 			goto out;
1188 
1189 		skb = skb_dequeue(&x25->interrupt_in_queue);
1190 
1191 		skb_pull(skb, X25_STD_MIN_LEN);
1192 
1193 		/*
1194 		 *	No Q bit information on Interrupt data.
1195 		 */
1196 		if (x25->qbitincl) {
1197 			asmptr  = skb_push(skb, 1);
1198 			*asmptr = 0x00;
1199 		}
1200 
1201 		msg->msg_flags |= MSG_OOB;
1202 	} else {
1203 		/* Now we can treat all alike */
1204 		skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
1205 					flags & MSG_DONTWAIT, &rc);
1206 		if (!skb)
1207 			goto out;
1208 
1209 		qbit = (skb->data[0] & X25_Q_BIT) == X25_Q_BIT;
1210 
1211 		skb_pull(skb, x25->neighbour->extended ?
1212 				X25_EXT_MIN_LEN : X25_STD_MIN_LEN);
1213 
1214 		if (x25->qbitincl) {
1215 			asmptr  = skb_push(skb, 1);
1216 			*asmptr = qbit;
1217 		}
1218 	}
1219 
1220 	skb_reset_transport_header(skb);
1221 	copied = skb->len;
1222 
1223 	if (copied > size) {
1224 		copied = size;
1225 		msg->msg_flags |= MSG_TRUNC;
1226 	}
1227 
1228 	/* Currently, each datagram always contains a complete record */
1229 	msg->msg_flags |= MSG_EOR;
1230 
1231 	rc = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1232 	if (rc)
1233 		goto out_free_dgram;
1234 
1235 	if (sx25) {
1236 		sx25->sx25_family = AF_X25;
1237 		sx25->sx25_addr   = x25->dest_addr;
1238 	}
1239 
1240 	msg->msg_namelen = sizeof(struct sockaddr_x25);
1241 
1242 	lock_sock(sk);
1243 	x25_check_rbuf(sk);
1244 	release_sock(sk);
1245 	rc = copied;
1246 out_free_dgram:
1247 	skb_free_datagram(sk, skb);
1248 out:
1249 	return rc;
1250 }
1251 
1252 
1253 static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
1254 {
1255 	struct sock *sk = sock->sk;
1256 	struct x25_sock *x25 = x25_sk(sk);
1257 	void __user *argp = (void __user *)arg;
1258 	int rc;
1259 
1260 	switch (cmd) {
1261 		case TIOCOUTQ: {
1262 			int amount = sk->sk_sndbuf -
1263 				     atomic_read(&sk->sk_wmem_alloc);
1264 			if (amount < 0)
1265 				amount = 0;
1266 			rc = put_user(amount, (unsigned int __user *)argp);
1267 			break;
1268 		}
1269 
1270 		case TIOCINQ: {
1271 			struct sk_buff *skb;
1272 			int amount = 0;
1273 			/*
1274 			 * These two are safe on a single CPU system as
1275 			 * only user tasks fiddle here
1276 			 */
1277 			if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL)
1278 				amount = skb->len;
1279 			rc = put_user(amount, (unsigned int __user *)argp);
1280 			break;
1281 		}
1282 
1283 		case SIOCGSTAMP:
1284 			rc = -EINVAL;
1285 			if (sk)
1286 				rc = sock_get_timestamp(sk,
1287 						(struct timeval __user *)argp);
1288 			break;
1289 		case SIOCGSTAMPNS:
1290 			rc = -EINVAL;
1291 			if (sk)
1292 				rc = sock_get_timestampns(sk,
1293 						(struct timespec __user *)argp);
1294 			break;
1295 		case SIOCGIFADDR:
1296 		case SIOCSIFADDR:
1297 		case SIOCGIFDSTADDR:
1298 		case SIOCSIFDSTADDR:
1299 		case SIOCGIFBRDADDR:
1300 		case SIOCSIFBRDADDR:
1301 		case SIOCGIFNETMASK:
1302 		case SIOCSIFNETMASK:
1303 		case SIOCGIFMETRIC:
1304 		case SIOCSIFMETRIC:
1305 			rc = -EINVAL;
1306 			break;
1307 		case SIOCADDRT:
1308 		case SIOCDELRT:
1309 			rc = -EPERM;
1310 			if (!capable(CAP_NET_ADMIN))
1311 				break;
1312 			rc = x25_route_ioctl(cmd, argp);
1313 			break;
1314 		case SIOCX25GSUBSCRIP:
1315 			rc = x25_subscr_ioctl(cmd, argp);
1316 			break;
1317 		case SIOCX25SSUBSCRIP:
1318 			rc = -EPERM;
1319 			if (!capable(CAP_NET_ADMIN))
1320 				break;
1321 			rc = x25_subscr_ioctl(cmd, argp);
1322 			break;
1323 		case SIOCX25GFACILITIES: {
1324 			struct x25_facilities fac = x25->facilities;
1325 			rc = copy_to_user(argp, &fac,
1326 					  sizeof(fac)) ? -EFAULT : 0;
1327 			break;
1328 		}
1329 
1330 		case SIOCX25SFACILITIES: {
1331 			struct x25_facilities facilities;
1332 			rc = -EFAULT;
1333 			if (copy_from_user(&facilities, argp,
1334 					   sizeof(facilities)))
1335 				break;
1336 			rc = -EINVAL;
1337 			if (sk->sk_state != TCP_LISTEN &&
1338 			    sk->sk_state != TCP_CLOSE)
1339 				break;
1340 			if (facilities.pacsize_in < X25_PS16 ||
1341 			    facilities.pacsize_in > X25_PS4096)
1342 				break;
1343 			if (facilities.pacsize_out < X25_PS16 ||
1344 			    facilities.pacsize_out > X25_PS4096)
1345 				break;
1346 			if (facilities.winsize_in < 1 ||
1347 			    facilities.winsize_in > 127)
1348 				break;
1349 			if (facilities.throughput < 0x03 ||
1350 			    facilities.throughput > 0xDD)
1351 				break;
1352 			if (facilities.reverse &&
1353 				(facilities.reverse | 0x81)!= 0x81)
1354 				break;
1355 			x25->facilities = facilities;
1356 			rc = 0;
1357 			break;
1358 		}
1359 
1360 		case SIOCX25GDTEFACILITIES: {
1361 			rc = copy_to_user(argp, &x25->dte_facilities,
1362 						sizeof(x25->dte_facilities));
1363 			if (rc)
1364 				rc = -EFAULT;
1365 			break;
1366 		}
1367 
1368 		case SIOCX25SDTEFACILITIES: {
1369 			struct x25_dte_facilities dtefacs;
1370 			rc = -EFAULT;
1371 			if (copy_from_user(&dtefacs, argp, sizeof(dtefacs)))
1372 				break;
1373 			rc = -EINVAL;
1374 			if (sk->sk_state != TCP_LISTEN &&
1375 					sk->sk_state != TCP_CLOSE)
1376 				break;
1377 			if (dtefacs.calling_len > X25_MAX_AE_LEN)
1378 				break;
1379 			if (dtefacs.calling_ae == NULL)
1380 				break;
1381 			if (dtefacs.called_len > X25_MAX_AE_LEN)
1382 				break;
1383 			if (dtefacs.called_ae == NULL)
1384 				break;
1385 			x25->dte_facilities = dtefacs;
1386 			rc = 0;
1387 			break;
1388 		}
1389 
1390 		case SIOCX25GCALLUSERDATA: {
1391 			struct x25_calluserdata cud = x25->calluserdata;
1392 			rc = copy_to_user(argp, &cud,
1393 					  sizeof(cud)) ? -EFAULT : 0;
1394 			break;
1395 		}
1396 
1397 		case SIOCX25SCALLUSERDATA: {
1398 			struct x25_calluserdata calluserdata;
1399 
1400 			rc = -EFAULT;
1401 			if (copy_from_user(&calluserdata, argp,
1402 					   sizeof(calluserdata)))
1403 				break;
1404 			rc = -EINVAL;
1405 			if (calluserdata.cudlength > X25_MAX_CUD_LEN)
1406 				break;
1407 			x25->calluserdata = calluserdata;
1408 			rc = 0;
1409 			break;
1410 		}
1411 
1412 		case SIOCX25GCAUSEDIAG: {
1413 			struct x25_causediag causediag;
1414 			causediag = x25->causediag;
1415 			rc = copy_to_user(argp, &causediag,
1416 					  sizeof(causediag)) ? -EFAULT : 0;
1417 			break;
1418 		}
1419 
1420 		case SIOCX25SCUDMATCHLEN: {
1421 			struct x25_subaddr sub_addr;
1422 			rc = -EINVAL;
1423 			if(sk->sk_state != TCP_CLOSE)
1424 				break;
1425 			rc = -EFAULT;
1426 			if (copy_from_user(&sub_addr, argp,
1427 					sizeof(sub_addr)))
1428 				break;
1429 			rc = -EINVAL;
1430 			if(sub_addr.cudmatchlength > X25_MAX_CUD_LEN)
1431 				break;
1432 			x25->cudmatchlength = sub_addr.cudmatchlength;
1433 			rc = 0;
1434 			break;
1435 		}
1436 
1437 		case SIOCX25CALLACCPTAPPRV: {
1438 			rc = -EINVAL;
1439 			if (sk->sk_state != TCP_CLOSE)
1440 				break;
1441 			x25->accptapprv = X25_ALLOW_ACCPT_APPRV;
1442 			rc = 0;
1443 			break;
1444 		}
1445 
1446 		case SIOCX25SENDCALLACCPT:  {
1447 			rc = -EINVAL;
1448 			if (sk->sk_state != TCP_ESTABLISHED)
1449 				break;
1450 			if (x25->accptapprv)	/* must call accptapprv above */
1451 				break;
1452 			x25_write_internal(sk, X25_CALL_ACCEPTED);
1453 			x25->state = X25_STATE_3;
1454 			rc = 0;
1455 			break;
1456 		}
1457 
1458 		default:
1459 			rc = -ENOIOCTLCMD;
1460 			break;
1461 	}
1462 
1463 	return rc;
1464 }
1465 
1466 static struct net_proto_family x25_family_ops = {
1467 	.family =	AF_X25,
1468 	.create =	x25_create,
1469 	.owner	=	THIS_MODULE,
1470 };
1471 
1472 #ifdef CONFIG_COMPAT
1473 static int compat_x25_subscr_ioctl(unsigned int cmd,
1474 		struct compat_x25_subscrip_struct __user *x25_subscr32)
1475 {
1476 	struct compat_x25_subscrip_struct x25_subscr;
1477 	struct x25_neigh *nb;
1478 	struct net_device *dev;
1479 	int rc = -EINVAL;
1480 
1481 	rc = -EFAULT;
1482 	if (copy_from_user(&x25_subscr, x25_subscr32, sizeof(*x25_subscr32)))
1483 		goto out;
1484 
1485 	rc = -EINVAL;
1486 	dev = x25_dev_get(x25_subscr.device);
1487 	if (dev == NULL)
1488 		goto out;
1489 
1490 	nb = x25_get_neigh(dev);
1491 	if (nb == NULL)
1492 		goto out_dev_put;
1493 
1494 	dev_put(dev);
1495 
1496 	if (cmd == SIOCX25GSUBSCRIP) {
1497 		x25_subscr.extended = nb->extended;
1498 		x25_subscr.global_facil_mask = nb->global_facil_mask;
1499 		rc = copy_to_user(x25_subscr32, &x25_subscr,
1500 				sizeof(*x25_subscr32)) ? -EFAULT : 0;
1501 	} else {
1502 		rc = -EINVAL;
1503 		if (x25_subscr.extended == 0 || x25_subscr.extended == 1) {
1504 			rc = 0;
1505 			nb->extended = x25_subscr.extended;
1506 			nb->global_facil_mask = x25_subscr.global_facil_mask;
1507 		}
1508 	}
1509 	x25_neigh_put(nb);
1510 out:
1511 	return rc;
1512 out_dev_put:
1513 	dev_put(dev);
1514 	goto out;
1515 }
1516 
1517 static int compat_x25_ioctl(struct socket *sock, unsigned int cmd,
1518 				unsigned long arg)
1519 {
1520 	void __user *argp = compat_ptr(arg);
1521 	struct sock *sk = sock->sk;
1522 
1523 	int rc = -ENOIOCTLCMD;
1524 
1525 	switch(cmd) {
1526 	case TIOCOUTQ:
1527 	case TIOCINQ:
1528 		rc = x25_ioctl(sock, cmd, (unsigned long)argp);
1529 		break;
1530 	case SIOCGSTAMP:
1531 		rc = -EINVAL;
1532 		if (sk)
1533 			rc = compat_sock_get_timestamp(sk,
1534 					(struct timeval __user*)argp);
1535 		break;
1536 	case SIOCGSTAMPNS:
1537 		rc = -EINVAL;
1538 		if (sk)
1539 			rc = compat_sock_get_timestampns(sk,
1540 					(struct timespec __user*)argp);
1541 		break;
1542 	case SIOCGIFADDR:
1543 	case SIOCSIFADDR:
1544 	case SIOCGIFDSTADDR:
1545 	case SIOCSIFDSTADDR:
1546 	case SIOCGIFBRDADDR:
1547 	case SIOCSIFBRDADDR:
1548 	case SIOCGIFNETMASK:
1549 	case SIOCSIFNETMASK:
1550 	case SIOCGIFMETRIC:
1551 	case SIOCSIFMETRIC:
1552 		rc = -EINVAL;
1553 		break;
1554 	case SIOCADDRT:
1555 	case SIOCDELRT:
1556 		rc = -EPERM;
1557 		if (!capable(CAP_NET_ADMIN))
1558 			break;
1559 		rc = x25_route_ioctl(cmd, argp);
1560 		break;
1561 	case SIOCX25GSUBSCRIP:
1562 		rc = compat_x25_subscr_ioctl(cmd, argp);
1563 		break;
1564 	case SIOCX25SSUBSCRIP:
1565 		rc = -EPERM;
1566 		if (!capable(CAP_NET_ADMIN))
1567 			break;
1568 		rc = compat_x25_subscr_ioctl(cmd, argp);
1569 		break;
1570 	case SIOCX25GFACILITIES:
1571 	case SIOCX25SFACILITIES:
1572 	case SIOCX25GDTEFACILITIES:
1573 	case SIOCX25SDTEFACILITIES:
1574 	case SIOCX25GCALLUSERDATA:
1575 	case SIOCX25SCALLUSERDATA:
1576 	case SIOCX25GCAUSEDIAG:
1577 	case SIOCX25SCUDMATCHLEN:
1578 	case SIOCX25CALLACCPTAPPRV:
1579 	case SIOCX25SENDCALLACCPT:
1580 		rc = x25_ioctl(sock, cmd, (unsigned long)argp);
1581 		break;
1582 	default:
1583 		rc = -ENOIOCTLCMD;
1584 		break;
1585 	}
1586 	return rc;
1587 }
1588 #endif
1589 
1590 static const struct proto_ops SOCKOPS_WRAPPED(x25_proto_ops) = {
1591 	.family =	AF_X25,
1592 	.owner =	THIS_MODULE,
1593 	.release =	x25_release,
1594 	.bind =		x25_bind,
1595 	.connect =	x25_connect,
1596 	.socketpair =	sock_no_socketpair,
1597 	.accept =	x25_accept,
1598 	.getname =	x25_getname,
1599 	.poll =		datagram_poll,
1600 	.ioctl =	x25_ioctl,
1601 #ifdef CONFIG_COMPAT
1602 	.compat_ioctl = compat_x25_ioctl,
1603 #endif
1604 	.listen =	x25_listen,
1605 	.shutdown =	sock_no_shutdown,
1606 	.setsockopt =	x25_setsockopt,
1607 	.getsockopt =	x25_getsockopt,
1608 	.sendmsg =	x25_sendmsg,
1609 	.recvmsg =	x25_recvmsg,
1610 	.mmap =		sock_no_mmap,
1611 	.sendpage =	sock_no_sendpage,
1612 };
1613 
1614 SOCKOPS_WRAP(x25_proto, AF_X25);
1615 
1616 static struct packet_type x25_packet_type = {
1617 	.type =	__constant_htons(ETH_P_X25),
1618 	.func =	x25_lapb_receive_frame,
1619 };
1620 
1621 static struct notifier_block x25_dev_notifier = {
1622 	.notifier_call = x25_device_event,
1623 };
1624 
1625 void x25_kill_by_neigh(struct x25_neigh *nb)
1626 {
1627 	struct sock *s;
1628 	struct hlist_node *node;
1629 
1630 	write_lock_bh(&x25_list_lock);
1631 
1632 	sk_for_each(s, node, &x25_list)
1633 		if (x25_sk(s)->neighbour == nb)
1634 			x25_disconnect(s, ENETUNREACH, 0, 0);
1635 
1636 	write_unlock_bh(&x25_list_lock);
1637 
1638 	/* Remove any related forwards */
1639 	x25_clear_forward_by_dev(nb->dev);
1640 }
1641 
1642 static int __init x25_init(void)
1643 {
1644 	int rc = proto_register(&x25_proto, 0);
1645 
1646 	if (rc != 0)
1647 		goto out;
1648 
1649 	sock_register(&x25_family_ops);
1650 
1651 	dev_add_pack(&x25_packet_type);
1652 
1653 	register_netdevice_notifier(&x25_dev_notifier);
1654 
1655 	printk(KERN_INFO "X.25 for Linux. Version 0.2 for Linux 2.1.15\n");
1656 
1657 #ifdef CONFIG_SYSCTL
1658 	x25_register_sysctl();
1659 #endif
1660 	x25_proc_init();
1661 out:
1662 	return rc;
1663 }
1664 module_init(x25_init);
1665 
1666 static void __exit x25_exit(void)
1667 {
1668 	x25_proc_exit();
1669 	x25_link_free();
1670 	x25_route_free();
1671 
1672 #ifdef CONFIG_SYSCTL
1673 	x25_unregister_sysctl();
1674 #endif
1675 
1676 	unregister_netdevice_notifier(&x25_dev_notifier);
1677 
1678 	dev_remove_pack(&x25_packet_type);
1679 
1680 	sock_unregister(AF_X25);
1681 	proto_unregister(&x25_proto);
1682 }
1683 module_exit(x25_exit);
1684 
1685 MODULE_AUTHOR("Jonathan Naylor <g4klx@g4klx.demon.co.uk>");
1686 MODULE_DESCRIPTION("The X.25 Packet Layer network layer protocol");
1687 MODULE_LICENSE("GPL");
1688 MODULE_ALIAS_NETPROTO(PF_X25);
1689