1/** -*- linux-c -*- *********************************************************** 2 * Linux PPP over Ethernet (PPPoX/PPPoE) Sockets 3 * 4 * PPPoX --- Generic PPP encapsulation socket family 5 * PPPoE --- PPP over Ethernet (RFC 2516) 6 * 7 * 8 * Version: 0.7.0 9 * 10 * 070228 : Fix to allow multiple sessions with same remote MAC and same 11 * session id by including the local device ifindex in the 12 * tuple identifying a session. This also ensures packets can't 13 * be injected into a session from interfaces other than the one 14 * specified by userspace. Florian Zumbiehl <florz@florz.de> 15 * (Oh, BTW, this one is YYMMDD, in case you were wondering ...) 16 * 220102 : Fix module use count on failure in pppoe_create, pppox_sk -acme 17 * 030700 : Fixed connect logic to allow for disconnect. 18 * 270700 : Fixed potential SMP problems; we must protect against 19 * simultaneous invocation of ppp_input 20 * and ppp_unregister_channel. 21 * 040800 : Respect reference count mechanisms on net-devices. 22 * 200800 : fix kfree(skb) in pppoe_rcv (acme) 23 * Module reference count is decremented in the right spot now, 24 * guards against sock_put not actually freeing the sk 25 * in pppoe_release. 26 * 051000 : Initialization cleanup. 27 * 111100 : Fix recvmsg. 28 * 050101 : Fix PADT procesing. 29 * 140501 : Use pppoe_rcv_core to handle all backlog. (Alexey) 30 * 170701 : Do not lock_sock with rwlock held. (DaveM) 31 * Ignore discovery frames if user has socket 32 * locked. (DaveM) 33 * Ignore return value of dev_queue_xmit in __pppoe_xmit 34 * or else we may kfree an SKB twice. (DaveM) 35 * 190701 : When doing copies of skb's in __pppoe_xmit, always delete 36 * the original skb that was passed in on success, never on 37 * failure. Delete the copy of the skb on failure to avoid 38 * a memory leak. 39 * 081001 : Misc. cleanup (licence string, non-blocking, prevent 40 * reference of device on close). 41 * 121301 : New ppp channels interface; cannot unregister a channel 42 * from interrupts. Thus, we mark the socket as a ZOMBIE 43 * and do the unregistration later. 44 * 081002 : seq_file support for proc stuff -acme 45 * 111602 : Merge all 2.4 fixes into 2.5/2.6 tree. Label 2.5/2.6 46 * as version 0.7. Spacing cleanup. 47 * Author: Michal Ostrowski <mostrows@speakeasy.net> 48 * Contributors: 49 * Arnaldo Carvalho de Melo <acme@conectiva.com.br> 50 * David S. Miller (davem@redhat.com) 51 * 52 * License: 53 * This program is free software; you can redistribute it and/or 54 * modify it under the terms of the GNU General Public License 55 * as published by the Free Software Foundation; either version 56 * 2 of the License, or (at your option) any later version. 57 * 58 */ 59 60#include <linux/string.h> 61#include <linux/module.h> 62#include <linux/kernel.h> 63#include <linux/slab.h> 64#include <linux/errno.h> 65#include <linux/netdevice.h> 66#include <linux/net.h> 67#include <linux/inetdevice.h> 68#include <linux/etherdevice.h> 69#include <linux/skbuff.h> 70#include <linux/init.h> 71#include <linux/if_ether.h> 72#include <linux/if_pppox.h> 73#include <linux/ppp_channel.h> 74#include <linux/ppp_defs.h> 75#include <linux/if_ppp.h> 76#include <linux/notifier.h> 77#include <linux/file.h> 78#include <linux/proc_fs.h> 79#include <linux/seq_file.h> 80 81#include <linux/nsproxy.h> 82#include <net/net_namespace.h> 83#include <net/netns/generic.h> 84#include <net/sock.h> 85 86#include <asm/uaccess.h> 87 88#ifdef HNDCTF 89#include <linux/if.h> 90#include <linux/if_vlan.h> 91#include <ctf/hndctf.h> 92#endif /* HNDCTF */ 93 94#define PPPOE_HASH_BITS 4 95#define PPPOE_HASH_SIZE (1 << PPPOE_HASH_BITS) 96#define PPPOE_HASH_MASK (PPPOE_HASH_SIZE - 1) 97 98static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb); 99 100static const struct proto_ops pppoe_ops; 101static const struct ppp_channel_ops pppoe_chan_ops; 102 103/* per-net private data for this module */ 104static int pppoe_net_id __read_mostly; 105struct pppoe_net { 106 /* 107 * we could use _single_ hash table for all 108 * nets by injecting net id into the hash but 109 * it would increase hash chains and add 110 * a few additional math comparations messy 111 * as well, moreover in case of SMP less locking 112 * controversy here 113 */ 114 struct pppox_sock *hash_table[PPPOE_HASH_SIZE]; 115 rwlock_t hash_lock; 116}; 117 118/* 119 * PPPoE could be in the following stages: 120 * 1) Discovery stage (to obtain remote MAC and Session ID) 121 * 2) Session stage (MAC and SID are known) 122 * 123 * Ethernet frames have a special tag for this but 124 * we use simplier approach based on session id 125 */ 126static inline bool stage_session(__be16 sid) 127{ 128 return sid != 0; 129} 130 131static inline struct pppoe_net *pppoe_pernet(struct net *net) 132{ 133 BUG_ON(!net); 134 135 return net_generic(net, pppoe_net_id); 136} 137 138static inline int cmp_2_addr(struct pppoe_addr *a, struct pppoe_addr *b) 139{ 140 return a->sid == b->sid && !memcmp(a->remote, b->remote, ETH_ALEN); 141} 142 143static inline int cmp_addr(struct pppoe_addr *a, __be16 sid, char *addr) 144{ 145 return a->sid == sid && !memcmp(a->remote, addr, ETH_ALEN); 146} 147 148#if 8 % PPPOE_HASH_BITS 149#error 8 must be a multiple of PPPOE_HASH_BITS 150#endif 151 152static int hash_item(__be16 sid, unsigned char *addr) 153{ 154 unsigned char hash = 0; 155 unsigned int i; 156 157 for (i = 0; i < ETH_ALEN; i++) 158 hash ^= addr[i]; 159 for (i = 0; i < sizeof(sid_t) * 8; i += 8) 160 hash ^= (__force __u32)sid >> i; 161 for (i = 8; (i >>= 1) >= PPPOE_HASH_BITS;) 162 hash ^= hash >> i; 163 164 return hash & PPPOE_HASH_MASK; 165} 166 167/********************************************************************** 168 * 169 * Set/get/delete/rehash items (internal versions) 170 * 171 **********************************************************************/ 172static struct pppox_sock *__get_item(struct pppoe_net *pn, __be16 sid, 173 unsigned char *addr, int ifindex) 174{ 175 int hash = hash_item(sid, addr); 176 struct pppox_sock *ret; 177 178 ret = pn->hash_table[hash]; 179 while (ret) { 180 if (cmp_addr(&ret->pppoe_pa, sid, addr) && 181 ret->pppoe_ifindex == ifindex) 182 return ret; 183 184 ret = ret->next; 185 } 186 187 return NULL; 188} 189 190static int __set_item(struct pppoe_net *pn, struct pppox_sock *po) 191{ 192 int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); 193 struct pppox_sock *ret; 194 195 ret = pn->hash_table[hash]; 196 while (ret) { 197 if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa) && 198 ret->pppoe_ifindex == po->pppoe_ifindex) 199 return -EALREADY; 200 201 ret = ret->next; 202 } 203 204 po->next = pn->hash_table[hash]; 205 pn->hash_table[hash] = po; 206 207 return 0; 208} 209 210static struct pppox_sock *__delete_item(struct pppoe_net *pn, __be16 sid, 211 char *addr, int ifindex) 212{ 213 int hash = hash_item(sid, addr); 214 struct pppox_sock *ret, **src; 215 216 ret = pn->hash_table[hash]; 217 src = &pn->hash_table[hash]; 218 219 while (ret) { 220 if (cmp_addr(&ret->pppoe_pa, sid, addr) && 221 ret->pppoe_ifindex == ifindex) { 222 *src = ret->next; 223 break; 224 } 225 226 src = &ret->next; 227 ret = ret->next; 228 } 229 230 return ret; 231} 232 233/********************************************************************** 234 * 235 * Set/get/delete/rehash items 236 * 237 **********************************************************************/ 238static inline struct pppox_sock *get_item(struct pppoe_net *pn, __be16 sid, 239 unsigned char *addr, int ifindex) 240{ 241 struct pppox_sock *po; 242 243 read_lock_bh(&pn->hash_lock); 244 po = __get_item(pn, sid, addr, ifindex); 245 if (po) 246 sock_hold(sk_pppox(po)); 247 read_unlock_bh(&pn->hash_lock); 248 249 return po; 250} 251 252static inline struct pppox_sock *get_item_by_addr(struct net *net, 253 struct sockaddr_pppox *sp) 254{ 255 struct net_device *dev; 256 struct pppoe_net *pn; 257 struct pppox_sock *pppox_sock = NULL; 258 259 int ifindex; 260 261 rcu_read_lock(); 262 dev = dev_get_by_name_rcu(net, sp->sa_addr.pppoe.dev); 263 if (dev) { 264 ifindex = dev->ifindex; 265 pn = pppoe_pernet(net); 266 pppox_sock = get_item(pn, sp->sa_addr.pppoe.sid, 267 sp->sa_addr.pppoe.remote, ifindex); 268 } 269 rcu_read_unlock(); 270 return pppox_sock; 271} 272 273static inline struct pppox_sock *delete_item(struct pppoe_net *pn, __be16 sid, 274 char *addr, int ifindex) 275{ 276 struct pppox_sock *ret; 277 278 write_lock_bh(&pn->hash_lock); 279 ret = __delete_item(pn, sid, addr, ifindex); 280 write_unlock_bh(&pn->hash_lock); 281 282 return ret; 283} 284 285/*************************************************************************** 286 * 287 * Handler for device events. 288 * Certain device events require that sockets be unconnected. 289 * 290 **************************************************************************/ 291 292static void pppoe_flush_dev(struct net_device *dev) 293{ 294 struct pppoe_net *pn; 295 int i; 296 297 pn = pppoe_pernet(dev_net(dev)); 298 write_lock_bh(&pn->hash_lock); 299 for (i = 0; i < PPPOE_HASH_SIZE; i++) { 300 struct pppox_sock *po = pn->hash_table[i]; 301 struct sock *sk; 302 303 while (po) { 304 while (po && po->pppoe_dev != dev) { 305 po = po->next; 306 } 307 308 if (!po) 309 break; 310 311 sk = sk_pppox(po); 312 313 /* We always grab the socket lock, followed by the 314 * hash_lock, in that order. Since we should hold the 315 * sock lock while doing any unbinding, we need to 316 * release the lock we're holding. Hold a reference to 317 * the sock so it doesn't disappear as we're jumping 318 * between locks. 319 */ 320 321 sock_hold(sk); 322 write_unlock_bh(&pn->hash_lock); 323 lock_sock(sk); 324 325 if (po->pppoe_dev == dev && 326 sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) { 327 pppox_unbind_sock(sk); 328 sk->sk_state = PPPOX_ZOMBIE; 329 sk->sk_state_change(sk); 330 po->pppoe_dev = NULL; 331 dev_put(dev); 332 } 333 334 release_sock(sk); 335 sock_put(sk); 336 337 /* Restart the process from the start of the current 338 * hash chain. We dropped locks so the world may have 339 * change from underneath us. 340 */ 341 342 BUG_ON(pppoe_pernet(dev_net(dev)) == NULL); 343 write_lock_bh(&pn->hash_lock); 344 po = pn->hash_table[i]; 345 } 346 } 347 write_unlock_bh(&pn->hash_lock); 348} 349 350static int pppoe_device_event(struct notifier_block *this, 351 unsigned long event, void *ptr) 352{ 353 struct net_device *dev = (struct net_device *)ptr; 354 355 /* Only look at sockets that are using this specific device. */ 356 switch (event) { 357 case NETDEV_CHANGEMTU: 358 /* A change in mtu is a bad thing, requiring 359 * LCP re-negotiation. 360 */ 361 362 case NETDEV_GOING_DOWN: 363 case NETDEV_DOWN: 364 /* Find every socket on this device and kill it. */ 365 pppoe_flush_dev(dev); 366 break; 367 368 default: 369 break; 370 } 371 372 return NOTIFY_DONE; 373} 374 375static struct notifier_block pppoe_notifier = { 376 .notifier_call = pppoe_device_event, 377}; 378 379/************************************************************************ 380 * 381 * Do the real work of receiving a PPPoE Session frame. 382 * 383 ***********************************************************************/ 384static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb) 385{ 386 struct pppox_sock *po = pppox_sk(sk); 387 struct pppox_sock *relay_po; 388 389 /* Backlog receive. Semantics of backlog rcv preclude any code from 390 * executing in lock_sock()/release_sock() bounds; meaning sk->sk_state 391 * can't change. 392 */ 393 394 if (sk->sk_state & PPPOX_BOUND) { 395 ppp_input(&po->chan, skb); 396 } else if (sk->sk_state & PPPOX_RELAY) { 397 relay_po = get_item_by_addr(sock_net(sk), 398 &po->pppoe_relay); 399 if (relay_po == NULL) 400 goto abort_kfree; 401 402 if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0) 403 goto abort_put; 404 405 if (!__pppoe_xmit(sk_pppox(relay_po), skb)) 406 goto abort_put; 407 } else { 408 if (sock_queue_rcv_skb(sk, skb)) 409 goto abort_kfree; 410 } 411 412 return NET_RX_SUCCESS; 413 414abort_put: 415 sock_put(sk_pppox(relay_po)); 416 417abort_kfree: 418 kfree_skb(skb); 419 return NET_RX_DROP; 420} 421 422/************************************************************************ 423 * 424 * Receive wrapper called in BH context. 425 * 426 ***********************************************************************/ 427static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev, 428 struct packet_type *pt, struct net_device *orig_dev) 429{ 430 struct pppoe_hdr *ph; 431 struct pppox_sock *po; 432 struct pppoe_net *pn; 433 int len; 434 435 skb = skb_share_check(skb, GFP_ATOMIC); 436 if (!skb) 437 goto out; 438 439 if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) 440 goto drop; 441 442 ph = pppoe_hdr(skb); 443 len = ntohs(ph->length); 444 445 skb_pull_rcsum(skb, sizeof(*ph)); 446 if (skb->len < len) 447 goto drop; 448 449 if (pskb_trim_rcsum(skb, len)) 450 goto drop; 451 452 pn = pppoe_pernet(dev_net(dev)); 453 454 /* Note that get_item does a sock_hold(), so sk_pppox(po) 455 * is known to be safe. 456 */ 457 po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); 458 if (!po) 459 goto drop; 460 461#if defined(HNDCTF) && defined(CTF_PPPOE) 462 /* Populate our cb array with values stating skb is pppoe rx 463 * skb and has pppoe sid. 464 */ 465 if (CTF_ENAB(kcih)) { 466 skb->ctf_pppoe_cb[0] = 1; 467 skb->ctf_pppoe_cb[1] = 0; 468 *(__be16 *)&skb->ctf_pppoe_cb[2] = ph->sid; 469 } 470#endif 471 472 return sk_receive_skb(sk_pppox(po), skb, 0); 473 474drop: 475 kfree_skb(skb); 476out: 477 return NET_RX_DROP; 478} 479 480/************************************************************************ 481 * 482 * Receive a PPPoE Discovery frame. 483 * This is solely for detection of PADT frames 484 * 485 ***********************************************************************/ 486static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev, 487 struct packet_type *pt, struct net_device *orig_dev) 488 489{ 490 struct pppoe_hdr *ph; 491 struct pppox_sock *po; 492 struct pppoe_net *pn; 493 494 skb = skb_share_check(skb, GFP_ATOMIC); 495 if (!skb) 496 goto out; 497 498 if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) 499 goto abort; 500 501 ph = pppoe_hdr(skb); 502 if (ph->code != PADT_CODE) 503 goto abort; 504 505 pn = pppoe_pernet(dev_net(dev)); 506 po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); 507 if (po) { 508 struct sock *sk = sk_pppox(po); 509 510 bh_lock_sock(sk); 511 512 /* If the user has locked the socket, just ignore 513 * the packet. With the way two rcv protocols hook into 514 * one socket family type, we cannot (easily) distinguish 515 * what kind of SKB it is during backlog rcv. 516 */ 517 if (sock_owned_by_user(sk) == 0) { 518 /* We're no longer connect at the PPPOE layer, 519 * and must wait for ppp channel to disconnect us. 520 */ 521 sk->sk_state = PPPOX_ZOMBIE; 522 } 523 524 bh_unlock_sock(sk); 525 sock_put(sk); 526 } 527 528abort: 529 kfree_skb(skb); 530out: 531 return NET_RX_SUCCESS; /* Lies... :-) */ 532} 533 534static struct packet_type pppoes_ptype __read_mostly = { 535 /* Foxconn modified start, Winster Chan, 12/21/2006 */ 536 //.type = cpu_to_be16(ETH_P_PPP_SES), 537 .type = cpu_to_be16(ETH_P_PPPOE_SESS), 538 /* Foxconn modified end, Winster Chan, 12/21/2006 */ 539 .func = pppoe_rcv, 540}; 541 542static struct packet_type pppoed_ptype __read_mostly = { 543 /* Foxconn modified start, Winster Chan, 12/21/2006 */ 544 //.type = cpu_to_be16(ETH_P_PPP_DISC), 545 .type = cpu_to_be16(ETH_P_PPPOE_DISC), 546 /* Foxconn modified end, Winster Chan, 12/21/2006 */ 547 .func = pppoe_disc_rcv, 548}; 549 550static struct proto pppoe_sk_proto __read_mostly = { 551 .name = "PPPOE", 552 .owner = THIS_MODULE, 553 .obj_size = sizeof(struct pppox_sock), 554}; 555 556/*********************************************************************** 557 * 558 * Initialize a new struct sock. 559 * 560 **********************************************************************/ 561static int pppoe_create(struct net *net, struct socket *sock) 562{ 563 struct sock *sk; 564 565 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppoe_sk_proto); 566 if (!sk) 567 return -ENOMEM; 568 569 sock_init_data(sock, sk); 570 571 sock->state = SS_UNCONNECTED; 572 sock->ops = &pppoe_ops; 573 574 sk->sk_backlog_rcv = pppoe_rcv_core; 575 sk->sk_state = PPPOX_NONE; 576 sk->sk_type = SOCK_STREAM; 577 sk->sk_family = PF_PPPOX; 578 sk->sk_protocol = PX_PROTO_OE; 579 580 return 0; 581} 582 583static int pppoe_release(struct socket *sock) 584{ 585 struct sock *sk = sock->sk; 586 struct pppox_sock *po; 587 struct pppoe_net *pn; 588 struct net *net = NULL; 589 590 if (!sk) 591 return 0; 592 593 lock_sock(sk); 594 if (sock_flag(sk, SOCK_DEAD)) { 595 release_sock(sk); 596 return -EBADF; 597 } 598 599 po = pppox_sk(sk); 600 601 if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) { 602 dev_put(po->pppoe_dev); 603 po->pppoe_dev = NULL; 604 } 605 606 pppox_unbind_sock(sk); 607 608 /* Signal the death of the socket. */ 609 sk->sk_state = PPPOX_DEAD; 610 611 net = sock_net(sk); 612 pn = pppoe_pernet(net); 613 614 /* 615 * protect "po" from concurrent updates 616 * on pppoe_flush_dev 617 */ 618 delete_item(pn, po->pppoe_pa.sid, po->pppoe_pa.remote, 619 po->pppoe_ifindex); 620 621 sock_orphan(sk); 622 sock->sk = NULL; 623 624 skb_queue_purge(&sk->sk_receive_queue); 625 release_sock(sk); 626 sock_put(sk); 627 628 return 0; 629} 630 631static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr, 632 int sockaddr_len, int flags) 633{ 634 struct sock *sk = sock->sk; 635 struct sockaddr_pppox *sp = (struct sockaddr_pppox *)uservaddr; 636 struct pppox_sock *po = pppox_sk(sk); 637 struct net_device *dev = NULL; 638 struct pppoe_net *pn; 639 struct net *net = NULL; 640 int error; 641 642 lock_sock(sk); 643 644 error = -EINVAL; 645 if (sp->sa_protocol != PX_PROTO_OE) 646 goto end; 647 648 /* Check for already bound sockets */ 649 error = -EBUSY; 650 if ((sk->sk_state & PPPOX_CONNECTED) && 651 stage_session(sp->sa_addr.pppoe.sid)) 652 goto end; 653 654 /* Check for already disconnected sockets, on attempts to disconnect */ 655 error = -EALREADY; 656 if ((sk->sk_state & PPPOX_DEAD) && 657 !stage_session(sp->sa_addr.pppoe.sid)) 658 goto end; 659 660 error = 0; 661 662 /* Delete the old binding */ 663 if (stage_session(po->pppoe_pa.sid)) { 664 pppox_unbind_sock(sk); 665 pn = pppoe_pernet(sock_net(sk)); 666 delete_item(pn, po->pppoe_pa.sid, 667 po->pppoe_pa.remote, po->pppoe_ifindex); 668 if (po->pppoe_dev) { 669 dev_put(po->pppoe_dev); 670 po->pppoe_dev = NULL; 671 } 672 673 memset(sk_pppox(po) + 1, 0, 674 sizeof(struct pppox_sock) - sizeof(struct sock)); 675 sk->sk_state = PPPOX_NONE; 676 } 677 678 /* Re-bind in session stage only */ 679 if (stage_session(sp->sa_addr.pppoe.sid)) { 680 error = -ENODEV; 681 net = sock_net(sk); 682 dev = dev_get_by_name(net, sp->sa_addr.pppoe.dev); 683 if (!dev) 684 goto err_put; 685 686 po->pppoe_dev = dev; 687 po->pppoe_ifindex = dev->ifindex; 688 pn = pppoe_pernet(net); 689 if (!(dev->flags & IFF_UP)) { 690 goto err_put; 691 } 692 693 memcpy(&po->pppoe_pa, 694 &sp->sa_addr.pppoe, 695 sizeof(struct pppoe_addr)); 696 697 write_lock_bh(&pn->hash_lock); 698 error = __set_item(pn, po); 699 write_unlock_bh(&pn->hash_lock); 700 if (error < 0) 701 goto err_put; 702 703 po->chan.hdrlen = (sizeof(struct pppoe_hdr) + 704 dev->hard_header_len); 705 706 po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr); 707 po->chan.private = sk; 708 po->chan.ops = &pppoe_chan_ops; 709 710 error = ppp_register_net_channel(dev_net(dev), &po->chan); 711 if (error) { 712 delete_item(pn, po->pppoe_pa.sid, 713 po->pppoe_pa.remote, po->pppoe_ifindex); 714 goto err_put; 715 } 716 717 sk->sk_state = PPPOX_CONNECTED; 718 } 719 720 po->num = sp->sa_addr.pppoe.sid; 721 722end: 723 release_sock(sk); 724 return error; 725err_put: 726 if (po->pppoe_dev) { 727 dev_put(po->pppoe_dev); 728 po->pppoe_dev = NULL; 729 } 730 goto end; 731} 732 733static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr, 734 int *usockaddr_len, int peer) 735{ 736 int len = sizeof(struct sockaddr_pppox); 737 struct sockaddr_pppox sp; 738 739 sp.sa_family = AF_PPPOX; 740 sp.sa_protocol = PX_PROTO_OE; 741 memcpy(&sp.sa_addr.pppoe, &pppox_sk(sock->sk)->pppoe_pa, 742 sizeof(struct pppoe_addr)); 743 744 memcpy(uaddr, &sp, len); 745 746 *usockaddr_len = len; 747 748 return 0; 749} 750 751static int pppoe_ioctl(struct socket *sock, unsigned int cmd, 752 unsigned long arg) 753{ 754 struct sock *sk = sock->sk; 755 struct pppox_sock *po = pppox_sk(sk); 756 int val; 757 int err; 758 759 switch (cmd) { 760 case PPPIOCGMRU: 761 err = -ENXIO; 762 if (!(sk->sk_state & PPPOX_CONNECTED)) 763 break; 764 765 err = -EFAULT; 766 if (put_user(po->pppoe_dev->mtu - 767 sizeof(struct pppoe_hdr) - 768 PPP_HDRLEN, 769 (int __user *)arg)) 770 break; 771 err = 0; 772 break; 773 774 case PPPIOCSMRU: 775 err = -ENXIO; 776 if (!(sk->sk_state & PPPOX_CONNECTED)) 777 break; 778 779 err = -EFAULT; 780 if (get_user(val, (int __user *)arg)) 781 break; 782 783 if (val < (po->pppoe_dev->mtu 784 - sizeof(struct pppoe_hdr) 785 - PPP_HDRLEN)) 786 err = 0; 787 else 788 err = -EINVAL; 789 break; 790 791 case PPPIOCSFLAGS: 792 err = -EFAULT; 793 if (get_user(val, (int __user *)arg)) 794 break; 795 err = 0; 796 break; 797 798 case PPPOEIOCSFWD: 799 { 800 struct pppox_sock *relay_po; 801 802 err = -EBUSY; 803 if (sk->sk_state & (PPPOX_BOUND | PPPOX_ZOMBIE | PPPOX_DEAD)) 804 break; 805 806 err = -ENOTCONN; 807 if (!(sk->sk_state & PPPOX_CONNECTED)) 808 break; 809 810 /* PPPoE address from the user specifies an outbound 811 PPPoE address which frames are forwarded to */ 812 err = -EFAULT; 813 if (copy_from_user(&po->pppoe_relay, 814 (void __user *)arg, 815 sizeof(struct sockaddr_pppox))) 816 break; 817 818 err = -EINVAL; 819 if (po->pppoe_relay.sa_family != AF_PPPOX || 820 po->pppoe_relay.sa_protocol != PX_PROTO_OE) 821 break; 822 823 /* Check that the socket referenced by the address 824 actually exists. */ 825 relay_po = get_item_by_addr(sock_net(sk), &po->pppoe_relay); 826 if (!relay_po) 827 break; 828 829 sock_put(sk_pppox(relay_po)); 830 sk->sk_state |= PPPOX_RELAY; 831 err = 0; 832 break; 833 } 834 835 case PPPOEIOCDFWD: 836 err = -EALREADY; 837 if (!(sk->sk_state & PPPOX_RELAY)) 838 break; 839 840 sk->sk_state &= ~PPPOX_RELAY; 841 err = 0; 842 break; 843 844 default: 845 err = -ENOTTY; 846 } 847 848 return err; 849} 850 851static int pppoe_sendmsg(struct kiocb *iocb, struct socket *sock, 852 struct msghdr *m, size_t total_len) 853{ 854 struct sk_buff *skb; 855 struct sock *sk = sock->sk; 856 struct pppox_sock *po = pppox_sk(sk); 857 int error; 858 struct pppoe_hdr hdr; 859 struct pppoe_hdr *ph; 860 struct net_device *dev; 861 char *start; 862 863 lock_sock(sk); 864 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) { 865 error = -ENOTCONN; 866 goto end; 867 } 868 869 hdr.ver = 1; 870 hdr.type = 1; 871 hdr.code = 0; 872 hdr.sid = po->num; 873 874 dev = po->pppoe_dev; 875 876 error = -EMSGSIZE; 877 if (total_len > (dev->mtu + dev->hard_header_len)) 878 goto end; 879 880 881 skb = sock_wmalloc(sk, total_len + dev->hard_header_len + 32, 882 0, GFP_KERNEL); 883 if (!skb) { 884 error = -ENOMEM; 885 goto end; 886 } 887 888 /* Reserve space for headers. */ 889 skb_reserve(skb, dev->hard_header_len); 890 skb_reset_network_header(skb); 891 892 skb->dev = dev; 893 894 skb->priority = sk->sk_priority; 895 skb->protocol = cpu_to_be16(ETH_P_PPP_SES); 896 897 ph = (struct pppoe_hdr *)skb_put(skb, total_len + sizeof(struct pppoe_hdr)); 898 start = (char *)&ph->tag[0]; 899 900 error = memcpy_fromiovec(start, m->msg_iov, total_len); 901 if (error < 0) { 902 kfree_skb(skb); 903 goto end; 904 } 905 906 error = total_len; 907 dev_hard_header(skb, dev, ETH_P_PPP_SES, 908 po->pppoe_pa.remote, NULL, total_len); 909 910 memcpy(ph, &hdr, sizeof(struct pppoe_hdr)); 911 912 ph->length = htons(total_len); 913 914 dev_queue_xmit(skb); 915 916end: 917 release_sock(sk); 918 return error; 919} 920 921/************************************************************************ 922 * 923 * xmit function for internal use. 924 * 925 ***********************************************************************/ 926static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb) 927{ 928 struct pppox_sock *po = pppox_sk(sk); 929 struct net_device *dev = po->pppoe_dev; 930 struct pppoe_hdr *ph; 931 int data_len = skb->len; 932 933 /* The higher-level PPP code (ppp_unregister_channel()) ensures the PPP 934 * xmit operations conclude prior to an unregistration call. Thus 935 * sk->sk_state cannot change, so we don't need to do lock_sock(). 936 * But, we also can't do a lock_sock since that introduces a potential 937 * deadlock as we'd reverse the lock ordering used when calling 938 * ppp_unregister_channel(). 939 */ 940 941 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 942 goto abort; 943 944 if (!dev) 945 goto abort; 946 947 /* Copy the data if there is no space for the header or if it's 948 * read-only. 949 */ 950 if (skb_cow_head(skb, sizeof(*ph) + dev->hard_header_len)) 951 goto abort; 952 953 __skb_push(skb, sizeof(*ph)); 954 skb_reset_network_header(skb); 955 956 ph = pppoe_hdr(skb); 957 ph->ver = 1; 958 ph->type = 1; 959 ph->code = 0; 960 ph->sid = po->num; 961 ph->length = htons(data_len); 962 963 skb->protocol = cpu_to_be16(ETH_P_PPP_SES); 964 skb->dev = dev; 965 966#if defined(HNDCTF) && defined(CTF_PPPOE) 967 /* Need to populate the ipct members with pppoe sid and real tx interface */ 968 if (CTF_ENAB(kcih) && (skb->ctf_pppoe_cb[0] == 2)) { 969 ctf_ipc_t *ipc; 970 ipc = (ctf_ipc_t *)(*(uint32 *)&skb->ctf_pppoe_cb[4]); 971 if (ipc != NULL) { 972 if (dev->priv_flags & IFF_802_1Q_VLAN) { 973 ipc->txif = (void *)vlan_dev_real_dev(dev); 974 ipc->vid = vlan_dev_vlan_id(dev); 975 ipc->action |= ((vlan_dev_vlan_flags(dev) & 1) ? 976 CTF_ACTION_TAG : CTF_ACTION_UNTAG); 977 } else { 978 ipc->txif = dev; 979 ipc->action |= CTF_ACTION_UNTAG; 980 } 981 ipc->pppoe_sid = ph->sid; 982 memcpy(ipc->dhost.octet, po->pppoe_pa.remote, ETH_ALEN); 983 memcpy(ipc->shost.octet, dev->dev_addr, ETH_ALEN); 984 } 985 } 986#endif /* HNDCTF && CTF_PPPOE */ 987 988 dev_hard_header(skb, dev, ETH_P_PPP_SES, 989 po->pppoe_pa.remote, NULL, data_len); 990 991 dev_queue_xmit(skb); 992 return 1; 993 994abort: 995 kfree_skb(skb); 996 return 1; 997} 998 999/************************************************************************ 1000 * 1001 * xmit function called by generic PPP driver 1002 * sends PPP frame over PPPoE socket 1003 * 1004 ***********************************************************************/ 1005static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb) 1006{ 1007 struct sock *sk = (struct sock *)chan->private; 1008 return __pppoe_xmit(sk, skb); 1009} 1010 1011static const struct ppp_channel_ops pppoe_chan_ops = { 1012 .start_xmit = pppoe_xmit, 1013}; 1014 1015static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock, 1016 struct msghdr *m, size_t total_len, int flags) 1017{ 1018 struct sock *sk = sock->sk; 1019 struct sk_buff *skb; 1020 int error = 0; 1021 1022 if (sk->sk_state & PPPOX_BOUND) { 1023 error = -EIO; 1024 goto end; 1025 } 1026 1027 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, 1028 flags & MSG_DONTWAIT, &error); 1029 if (error < 0) 1030 goto end; 1031 1032 m->msg_namelen = 0; 1033 1034 if (skb) { 1035 total_len = min_t(size_t, total_len, skb->len); 1036 error = skb_copy_datagram_iovec(skb, 0, m->msg_iov, total_len); 1037 if (error == 0) 1038 error = total_len; 1039 } 1040 1041 kfree_skb(skb); 1042end: 1043 return error; 1044} 1045 1046#ifdef CONFIG_PROC_FS 1047static int pppoe_seq_show(struct seq_file *seq, void *v) 1048{ 1049 struct pppox_sock *po; 1050 char *dev_name; 1051 1052 if (v == SEQ_START_TOKEN) { 1053 seq_puts(seq, "Id Address Device\n"); 1054 goto out; 1055 } 1056 1057 po = v; 1058 dev_name = po->pppoe_pa.dev; 1059 1060 seq_printf(seq, "%08X %pM %8s\n", 1061 po->pppoe_pa.sid, po->pppoe_pa.remote, dev_name); 1062out: 1063 return 0; 1064} 1065 1066static inline struct pppox_sock *pppoe_get_idx(struct pppoe_net *pn, loff_t pos) 1067{ 1068 struct pppox_sock *po; 1069 int i; 1070 1071 for (i = 0; i < PPPOE_HASH_SIZE; i++) { 1072 po = pn->hash_table[i]; 1073 while (po) { 1074 if (!pos--) 1075 goto out; 1076 po = po->next; 1077 } 1078 } 1079 1080out: 1081 return po; 1082} 1083 1084static void *pppoe_seq_start(struct seq_file *seq, loff_t *pos) 1085 __acquires(pn->hash_lock) 1086{ 1087 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 1088 loff_t l = *pos; 1089 1090 read_lock_bh(&pn->hash_lock); 1091 return l ? pppoe_get_idx(pn, --l) : SEQ_START_TOKEN; 1092} 1093 1094static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos) 1095{ 1096 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 1097 struct pppox_sock *po; 1098 1099 ++*pos; 1100 if (v == SEQ_START_TOKEN) { 1101 po = pppoe_get_idx(pn, 0); 1102 goto out; 1103 } 1104 po = v; 1105 if (po->next) 1106 po = po->next; 1107 else { 1108 int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); 1109 1110 po = NULL; 1111 while (++hash < PPPOE_HASH_SIZE) { 1112 po = pn->hash_table[hash]; 1113 if (po) 1114 break; 1115 } 1116 } 1117 1118out: 1119 return po; 1120} 1121 1122static void pppoe_seq_stop(struct seq_file *seq, void *v) 1123 __releases(pn->hash_lock) 1124{ 1125 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 1126 read_unlock_bh(&pn->hash_lock); 1127} 1128 1129static const struct seq_operations pppoe_seq_ops = { 1130 .start = pppoe_seq_start, 1131 .next = pppoe_seq_next, 1132 .stop = pppoe_seq_stop, 1133 .show = pppoe_seq_show, 1134}; 1135 1136static int pppoe_seq_open(struct inode *inode, struct file *file) 1137{ 1138 return seq_open_net(inode, file, &pppoe_seq_ops, 1139 sizeof(struct seq_net_private)); 1140} 1141 1142static const struct file_operations pppoe_seq_fops = { 1143 .owner = THIS_MODULE, 1144 .open = pppoe_seq_open, 1145 .read = seq_read, 1146 .llseek = seq_lseek, 1147 .release = seq_release_net, 1148}; 1149 1150#endif /* CONFIG_PROC_FS */ 1151 1152static const struct proto_ops pppoe_ops = { 1153 .family = AF_PPPOX, 1154 .owner = THIS_MODULE, 1155 .release = pppoe_release, 1156 .bind = sock_no_bind, 1157 .connect = pppoe_connect, 1158 .socketpair = sock_no_socketpair, 1159 .accept = sock_no_accept, 1160 .getname = pppoe_getname, 1161 .poll = datagram_poll, 1162 .listen = sock_no_listen, 1163 .shutdown = sock_no_shutdown, 1164 .setsockopt = sock_no_setsockopt, 1165 .getsockopt = sock_no_getsockopt, 1166 .sendmsg = pppoe_sendmsg, 1167 .recvmsg = pppoe_recvmsg, 1168 .mmap = sock_no_mmap, 1169 .ioctl = pppox_ioctl, 1170}; 1171 1172static struct pppox_proto pppoe_proto = { 1173 .create = pppoe_create, 1174 .ioctl = pppoe_ioctl, 1175 .owner = THIS_MODULE, 1176}; 1177 1178static __net_init int pppoe_init_net(struct net *net) 1179{ 1180 struct pppoe_net *pn = pppoe_pernet(net); 1181 struct proc_dir_entry *pde; 1182 1183 rwlock_init(&pn->hash_lock); 1184 1185 pde = proc_net_fops_create(net, "pppoe", S_IRUGO, &pppoe_seq_fops); 1186#ifdef CONFIG_PROC_FS 1187 if (!pde) 1188 return -ENOMEM; 1189#endif 1190 1191 return 0; 1192} 1193 1194static __net_exit void pppoe_exit_net(struct net *net) 1195{ 1196 proc_net_remove(net, "pppoe"); 1197} 1198 1199static struct pernet_operations pppoe_net_ops = { 1200 .init = pppoe_init_net, 1201 .exit = pppoe_exit_net, 1202 .id = &pppoe_net_id, 1203 .size = sizeof(struct pppoe_net), 1204}; 1205 1206static int __init pppoe_init(void) 1207{ 1208 int err; 1209 1210 err = register_pernet_device(&pppoe_net_ops); 1211 if (err) 1212 goto out; 1213 1214 err = proto_register(&pppoe_sk_proto, 0); 1215 if (err) 1216 goto out_unregister_net_ops; 1217 1218 err = register_pppox_proto(PX_PROTO_OE, &pppoe_proto); 1219 if (err) 1220 goto out_unregister_pppoe_proto; 1221 1222 dev_add_pack(&pppoes_ptype); 1223 dev_add_pack(&pppoed_ptype); 1224 register_netdevice_notifier(&pppoe_notifier); 1225 1226 return 0; 1227 1228out_unregister_pppoe_proto: 1229 proto_unregister(&pppoe_sk_proto); 1230out_unregister_net_ops: 1231 unregister_pernet_device(&pppoe_net_ops); 1232out: 1233 return err; 1234} 1235 1236static void __exit pppoe_exit(void) 1237{ 1238 unregister_netdevice_notifier(&pppoe_notifier); 1239 dev_remove_pack(&pppoed_ptype); 1240 dev_remove_pack(&pppoes_ptype); 1241 unregister_pppox_proto(PX_PROTO_OE); 1242 proto_unregister(&pppoe_sk_proto); 1243 unregister_pernet_device(&pppoe_net_ops); 1244} 1245 1246module_init(pppoe_init); 1247module_exit(pppoe_exit); 1248 1249MODULE_AUTHOR("Michal Ostrowski <mostrows@speakeasy.net>"); 1250MODULE_DESCRIPTION("PPP over Ethernet driver"); 1251MODULE_LICENSE("GPL"); 1252MODULE_ALIAS_NETPROTO(PF_PPPOX); 1253