1/*
2 * This program is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License as published by
4 * the Free Software Foundation; either version 2 of the License, or
5 * (at your option) any later version.
6 *
7 * Copyright (C) Alan Cox GW4PTS (alan@lxorguk.ukuu.org.uk)
8 * Copyright (C) Jonathan Naylor G4KLX (g4klx@g4klx.demon.co.uk)
9 * Copyright (C) Darryl Miles G7LED (dlm@g7led.demon.co.uk)
10 * Copyright (C) Steven Whitehouse GW7RRM (stevew@acm.org)
11 * Copyright (C) Joerg Reuter DL1BKE (jreuter@yaina.de)
12 * Copyright (C) Hans-Joachim Hetscher DD8NE (dd8ne@bnv-bamberg.de)
13 * Copyright (C) Hans Alblas PE1AYX (hans@esrac.ele.tue.nl)
14 * Copyright (C) Frederic Rible F1OAT (frible@teaser.fr)
15 */
16#include <linux/capability.h>
17#include <linux/module.h>
18#include <linux/errno.h>
19#include <linux/types.h>
20#include <linux/socket.h>
21#include <linux/in.h>
22#include <linux/kernel.h>
23#include <linux/sched.h>
24#include <linux/timer.h>
25#include <linux/string.h>
26#include <linux/sockios.h>
27#include <linux/net.h>
28#include <net/ax25.h>
29#include <linux/inet.h>
30#include <linux/netdevice.h>
31#include <linux/if_arp.h>
32#include <linux/skbuff.h>
33#include <net/sock.h>
34#include <asm/uaccess.h>
35#include <asm/system.h>
36#include <linux/fcntl.h>
37#include <linux/termios.h>	/* For TIOCINQ/OUTQ */
38#include <linux/mm.h>
39#include <linux/interrupt.h>
40#include <linux/notifier.h>
41#include <linux/proc_fs.h>
42#include <linux/stat.h>
43#include <linux/netfilter.h>
44#include <linux/sysctl.h>
45#include <linux/init.h>
46#include <linux/spinlock.h>
47#include <net/tcp_states.h>
48#include <net/ip.h>
49#include <net/arp.h>
50
51
52
53HLIST_HEAD(ax25_list);
54DEFINE_SPINLOCK(ax25_list_lock);
55
56static const struct proto_ops ax25_proto_ops;
57
58static void ax25_free_sock(struct sock *sk)
59{
60	ax25_cb_put(ax25_sk(sk));
61}
62
63/*
64 *	Socket removal during an interrupt is now safe.
65 */
66static void ax25_cb_del(ax25_cb *ax25)
67{
68	if (!hlist_unhashed(&ax25->ax25_node)) {
69		spin_lock_bh(&ax25_list_lock);
70		hlist_del_init(&ax25->ax25_node);
71		spin_unlock_bh(&ax25_list_lock);
72		ax25_cb_put(ax25);
73	}
74}
75
76/*
77 *	Kill all bound sockets on a dropped device.
78 */
79static void ax25_kill_by_device(struct net_device *dev)
80{
81	ax25_dev *ax25_dev;
82	ax25_cb *s;
83	struct hlist_node *node;
84
85	if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL)
86		return;
87
88	spin_lock_bh(&ax25_list_lock);
89	ax25_for_each(s, node, &ax25_list) {
90		if (s->ax25_dev == ax25_dev) {
91			s->ax25_dev = NULL;
92			ax25_disconnect(s, ENETUNREACH);
93		}
94	}
95	spin_unlock_bh(&ax25_list_lock);
96}
97
98/*
99 *	Handle device status changes.
100 */
101static int ax25_device_event(struct notifier_block *this, unsigned long event,
102	void *ptr)
103{
104	struct net_device *dev = (struct net_device *)ptr;
105
106	/* Reject non AX.25 devices */
107	if (dev->type != ARPHRD_AX25)
108		return NOTIFY_DONE;
109
110	switch (event) {
111	case NETDEV_UP:
112		ax25_dev_device_up(dev);
113		break;
114	case NETDEV_DOWN:
115		ax25_kill_by_device(dev);
116		ax25_rt_device_down(dev);
117		ax25_dev_device_down(dev);
118		break;
119	default:
120		break;
121	}
122
123	return NOTIFY_DONE;
124}
125
126/*
127 *	Add a socket to the bound sockets list.
128 */
129void ax25_cb_add(ax25_cb *ax25)
130{
131	spin_lock_bh(&ax25_list_lock);
132	ax25_cb_hold(ax25);
133	hlist_add_head(&ax25->ax25_node, &ax25_list);
134	spin_unlock_bh(&ax25_list_lock);
135}
136
137/*
138 *	Find a socket that wants to accept the SABM we have just
139 *	received.
140 */
141struct sock *ax25_find_listener(ax25_address *addr, int digi,
142	struct net_device *dev, int type)
143{
144	ax25_cb *s;
145	struct hlist_node *node;
146
147	spin_lock(&ax25_list_lock);
148	ax25_for_each(s, node, &ax25_list) {
149		if ((s->iamdigi && !digi) || (!s->iamdigi && digi))
150			continue;
151		if (s->sk && !ax25cmp(&s->source_addr, addr) &&
152		    s->sk->sk_type == type && s->sk->sk_state == TCP_LISTEN) {
153			/* If device is null we match any device */
154			if (s->ax25_dev == NULL || s->ax25_dev->dev == dev) {
155				sock_hold(s->sk);
156				spin_unlock(&ax25_list_lock);
157				return s->sk;
158			}
159		}
160	}
161	spin_unlock(&ax25_list_lock);
162
163	return NULL;
164}
165
166/*
167 *	Find an AX.25 socket given both ends.
168 */
169struct sock *ax25_get_socket(ax25_address *my_addr, ax25_address *dest_addr,
170	int type)
171{
172	struct sock *sk = NULL;
173	ax25_cb *s;
174	struct hlist_node *node;
175
176	spin_lock(&ax25_list_lock);
177	ax25_for_each(s, node, &ax25_list) {
178		if (s->sk && !ax25cmp(&s->source_addr, my_addr) &&
179		    !ax25cmp(&s->dest_addr, dest_addr) &&
180		    s->sk->sk_type == type) {
181			sk = s->sk;
182			sock_hold(sk);
183			break;
184		}
185	}
186
187	spin_unlock(&ax25_list_lock);
188
189	return sk;
190}
191
192/*
193 *	Find an AX.25 control block given both ends. It will only pick up
194 *	floating AX.25 control blocks or non Raw socket bound control blocks.
195 */
196ax25_cb *ax25_find_cb(ax25_address *src_addr, ax25_address *dest_addr,
197	ax25_digi *digi, struct net_device *dev)
198{
199	ax25_cb *s;
200	struct hlist_node *node;
201
202	spin_lock_bh(&ax25_list_lock);
203	ax25_for_each(s, node, &ax25_list) {
204		if (s->sk && s->sk->sk_type != SOCK_SEQPACKET)
205			continue;
206		if (s->ax25_dev == NULL)
207			continue;
208		if (ax25cmp(&s->source_addr, src_addr) == 0 && ax25cmp(&s->dest_addr, dest_addr) == 0 && s->ax25_dev->dev == dev) {
209			if (digi != NULL && digi->ndigi != 0) {
210				if (s->digipeat == NULL)
211					continue;
212				if (ax25digicmp(s->digipeat, digi) != 0)
213					continue;
214			} else {
215				if (s->digipeat != NULL && s->digipeat->ndigi != 0)
216					continue;
217			}
218			ax25_cb_hold(s);
219			spin_unlock_bh(&ax25_list_lock);
220
221			return s;
222		}
223	}
224	spin_unlock_bh(&ax25_list_lock);
225
226	return NULL;
227}
228
229EXPORT_SYMBOL(ax25_find_cb);
230
231void ax25_send_to_raw(ax25_address *addr, struct sk_buff *skb, int proto)
232{
233	ax25_cb *s;
234	struct sk_buff *copy;
235	struct hlist_node *node;
236
237	spin_lock(&ax25_list_lock);
238	ax25_for_each(s, node, &ax25_list) {
239		if (s->sk != NULL && ax25cmp(&s->source_addr, addr) == 0 &&
240		    s->sk->sk_type == SOCK_RAW &&
241		    s->sk->sk_protocol == proto &&
242		    s->ax25_dev->dev == skb->dev &&
243		    atomic_read(&s->sk->sk_rmem_alloc) <= s->sk->sk_rcvbuf) {
244			if ((copy = skb_clone(skb, GFP_ATOMIC)) == NULL)
245				continue;
246			if (sock_queue_rcv_skb(s->sk, copy) != 0)
247				kfree_skb(copy);
248		}
249	}
250	spin_unlock(&ax25_list_lock);
251}
252
253/*
254 *	Deferred destroy.
255 */
256void ax25_destroy_socket(ax25_cb *);
257
258/*
259 *	Handler for deferred kills.
260 */
261static void ax25_destroy_timer(unsigned long data)
262{
263	ax25_cb *ax25=(ax25_cb *)data;
264	struct sock *sk;
265
266	sk=ax25->sk;
267
268	bh_lock_sock(sk);
269	sock_hold(sk);
270	ax25_destroy_socket(ax25);
271	bh_unlock_sock(sk);
272	sock_put(sk);
273}
274
275/*
276 *	This is called from user mode and the timers. Thus it protects itself
277 *	against interrupt users but doesn't worry about being called during
278 *	work. Once it is removed from the queue no interrupt or bottom half
279 *	will touch it and we are (fairly 8-) ) safe.
280 */
281void ax25_destroy_socket(ax25_cb *ax25)
282{
283	struct sk_buff *skb;
284
285	ax25_cb_del(ax25);
286
287	ax25_stop_heartbeat(ax25);
288	ax25_stop_t1timer(ax25);
289	ax25_stop_t2timer(ax25);
290	ax25_stop_t3timer(ax25);
291	ax25_stop_idletimer(ax25);
292
293	ax25_clear_queues(ax25);	/* Flush the queues */
294
295	if (ax25->sk != NULL) {
296		while ((skb = skb_dequeue(&ax25->sk->sk_receive_queue)) != NULL) {
297			if (skb->sk != ax25->sk) {
298				/* A pending connection */
299				ax25_cb *sax25 = ax25_sk(skb->sk);
300
301				/* Queue the unaccepted socket for death */
302				sock_orphan(skb->sk);
303
304				ax25_start_heartbeat(sax25);
305				sax25->state = AX25_STATE_0;
306			}
307
308			kfree_skb(skb);
309		}
310		skb_queue_purge(&ax25->sk->sk_write_queue);
311	}
312
313	if (ax25->sk != NULL) {
314		if (atomic_read(&ax25->sk->sk_wmem_alloc) ||
315		    atomic_read(&ax25->sk->sk_rmem_alloc)) {
316			/* Defer: outstanding buffers */
317			init_timer(&ax25->dtimer);
318			ax25->dtimer.expires  = jiffies + 2 * HZ;
319			ax25->dtimer.function = ax25_destroy_timer;
320			ax25->dtimer.data     = (unsigned long)ax25;
321			add_timer(&ax25->dtimer);
322		} else {
323			struct sock *sk=ax25->sk;
324			ax25->sk=NULL;
325			sock_put(sk);
326		}
327	} else {
328		ax25_cb_put(ax25);
329	}
330}
331
332/*
333 * dl1bke 960311: set parameters for existing AX.25 connections,
334 *		  includes a KILL command to abort any connection.
335 *		  VERY useful for debugging ;-)
336 */
337static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
338{
339	struct ax25_ctl_struct ax25_ctl;
340	ax25_digi digi;
341	ax25_dev *ax25_dev;
342	ax25_cb *ax25;
343	unsigned int k;
344
345	if (copy_from_user(&ax25_ctl, arg, sizeof(ax25_ctl)))
346		return -EFAULT;
347
348	if ((ax25_dev = ax25_addr_ax25dev(&ax25_ctl.port_addr)) == NULL)
349		return -ENODEV;
350
351	if (ax25_ctl.digi_count > AX25_MAX_DIGIS)
352		return -EINVAL;
353
354	digi.ndigi = ax25_ctl.digi_count;
355	for (k = 0; k < digi.ndigi; k++)
356		digi.calls[k] = ax25_ctl.digi_addr[k];
357
358	if ((ax25 = ax25_find_cb(&ax25_ctl.source_addr, &ax25_ctl.dest_addr, &digi, ax25_dev->dev)) == NULL)
359		return -ENOTCONN;
360
361	switch (ax25_ctl.cmd) {
362	case AX25_KILL:
363		ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
364#ifdef CONFIG_AX25_DAMA_SLAVE
365		if (ax25_dev->dama.slave && ax25->ax25_dev->values[AX25_VALUES_PROTOCOL] == AX25_PROTO_DAMA_SLAVE)
366			ax25_dama_off(ax25);
367#endif
368		ax25_disconnect(ax25, ENETRESET);
369		break;
370
371	case AX25_WINDOW:
372		if (ax25->modulus == AX25_MODULUS) {
373			if (ax25_ctl.arg < 1 || ax25_ctl.arg > 7)
374				return -EINVAL;
375		} else {
376			if (ax25_ctl.arg < 1 || ax25_ctl.arg > 63)
377				return -EINVAL;
378		}
379		ax25->window = ax25_ctl.arg;
380		break;
381
382	case AX25_T1:
383		if (ax25_ctl.arg < 1)
384			return -EINVAL;
385		ax25->rtt = (ax25_ctl.arg * HZ) / 2;
386		ax25->t1  = ax25_ctl.arg * HZ;
387		break;
388
389	case AX25_T2:
390		if (ax25_ctl.arg < 1)
391			return -EINVAL;
392		ax25->t2 = ax25_ctl.arg * HZ;
393		break;
394
395	case AX25_N2:
396		if (ax25_ctl.arg < 1 || ax25_ctl.arg > 31)
397			return -EINVAL;
398		ax25->n2count = 0;
399		ax25->n2 = ax25_ctl.arg;
400		break;
401
402	case AX25_T3:
403		if (ax25_ctl.arg < 0)
404			return -EINVAL;
405		ax25->t3 = ax25_ctl.arg * HZ;
406		break;
407
408	case AX25_IDLE:
409		if (ax25_ctl.arg < 0)
410			return -EINVAL;
411		ax25->idle = ax25_ctl.arg * 60 * HZ;
412		break;
413
414	case AX25_PACLEN:
415		if (ax25_ctl.arg < 16 || ax25_ctl.arg > 65535)
416			return -EINVAL;
417		ax25->paclen = ax25_ctl.arg;
418		break;
419
420	default:
421		return -EINVAL;
422	  }
423
424	return 0;
425}
426
427static void ax25_fillin_cb_from_dev(ax25_cb *ax25, ax25_dev *ax25_dev)
428{
429	ax25->rtt     = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T1]) / 2;
430	ax25->t1      = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T1]);
431	ax25->t2      = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T2]);
432	ax25->t3      = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T3]);
433	ax25->n2      = ax25_dev->values[AX25_VALUES_N2];
434	ax25->paclen  = ax25_dev->values[AX25_VALUES_PACLEN];
435	ax25->idle    = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_IDLE]);
436	ax25->backoff = ax25_dev->values[AX25_VALUES_BACKOFF];
437
438	if (ax25_dev->values[AX25_VALUES_AXDEFMODE]) {
439		ax25->modulus = AX25_EMODULUS;
440		ax25->window  = ax25_dev->values[AX25_VALUES_EWINDOW];
441	} else {
442		ax25->modulus = AX25_MODULUS;
443		ax25->window  = ax25_dev->values[AX25_VALUES_WINDOW];
444	}
445}
446
447/*
448 *	Fill in a created AX.25 created control block with the default
449 *	values for a particular device.
450 */
451void ax25_fillin_cb(ax25_cb *ax25, ax25_dev *ax25_dev)
452{
453	ax25->ax25_dev = ax25_dev;
454
455	if (ax25->ax25_dev != NULL) {
456		ax25_fillin_cb_from_dev(ax25, ax25_dev);
457		return;
458	}
459
460	/*
461	 * No device, use kernel / AX.25 spec default values
462	 */
463	ax25->rtt     = msecs_to_jiffies(AX25_DEF_T1) / 2;
464	ax25->t1      = msecs_to_jiffies(AX25_DEF_T1);
465	ax25->t2      = msecs_to_jiffies(AX25_DEF_T2);
466	ax25->t3      = msecs_to_jiffies(AX25_DEF_T3);
467	ax25->n2      = AX25_DEF_N2;
468	ax25->paclen  = AX25_DEF_PACLEN;
469	ax25->idle    = msecs_to_jiffies(AX25_DEF_IDLE);
470	ax25->backoff = AX25_DEF_BACKOFF;
471
472	if (AX25_DEF_AXDEFMODE) {
473		ax25->modulus = AX25_EMODULUS;
474		ax25->window  = AX25_DEF_EWINDOW;
475	} else {
476		ax25->modulus = AX25_MODULUS;
477		ax25->window  = AX25_DEF_WINDOW;
478	}
479}
480
481/*
482 * Create an empty AX.25 control block.
483 */
484ax25_cb *ax25_create_cb(void)
485{
486	ax25_cb *ax25;
487
488	if ((ax25 = kzalloc(sizeof(*ax25), GFP_ATOMIC)) == NULL)
489		return NULL;
490
491	atomic_set(&ax25->refcount, 1);
492
493	skb_queue_head_init(&ax25->write_queue);
494	skb_queue_head_init(&ax25->frag_queue);
495	skb_queue_head_init(&ax25->ack_queue);
496	skb_queue_head_init(&ax25->reseq_queue);
497
498	init_timer(&ax25->timer);
499	init_timer(&ax25->t1timer);
500	init_timer(&ax25->t2timer);
501	init_timer(&ax25->t3timer);
502	init_timer(&ax25->idletimer);
503
504	ax25_fillin_cb(ax25, NULL);
505
506	ax25->state = AX25_STATE_0;
507
508	return ax25;
509}
510
511/*
512 *	Handling for system calls applied via the various interfaces to an
513 *	AX25 socket object
514 */
515
516static int ax25_setsockopt(struct socket *sock, int level, int optname,
517	char __user *optval, int optlen)
518{
519	struct sock *sk = sock->sk;
520	ax25_cb *ax25;
521	struct net_device *dev;
522	char devname[IFNAMSIZ];
523	int opt, res = 0;
524
525	if (level != SOL_AX25)
526		return -ENOPROTOOPT;
527
528	if (optlen < sizeof(int))
529		return -EINVAL;
530
531	if (get_user(opt, (int __user *)optval))
532		return -EFAULT;
533
534	lock_sock(sk);
535	ax25 = ax25_sk(sk);
536
537	switch (optname) {
538	case AX25_WINDOW:
539		if (ax25->modulus == AX25_MODULUS) {
540			if (opt < 1 || opt > 7) {
541				res = -EINVAL;
542				break;
543			}
544		} else {
545			if (opt < 1 || opt > 63) {
546				res = -EINVAL;
547				break;
548			}
549		}
550		ax25->window = opt;
551		break;
552
553	case AX25_T1:
554		if (opt < 1) {
555			res = -EINVAL;
556			break;
557		}
558		ax25->rtt = (opt * HZ) / 2;
559		ax25->t1  = opt * HZ;
560		break;
561
562	case AX25_T2:
563		if (opt < 1) {
564			res = -EINVAL;
565			break;
566		}
567		ax25->t2 = opt * HZ;
568		break;
569
570	case AX25_N2:
571		if (opt < 1 || opt > 31) {
572			res = -EINVAL;
573			break;
574		}
575		ax25->n2 = opt;
576		break;
577
578	case AX25_T3:
579		if (opt < 1) {
580			res = -EINVAL;
581			break;
582		}
583		ax25->t3 = opt * HZ;
584		break;
585
586	case AX25_IDLE:
587		if (opt < 0) {
588			res = -EINVAL;
589			break;
590		}
591		ax25->idle = opt * 60 * HZ;
592		break;
593
594	case AX25_BACKOFF:
595		if (opt < 0 || opt > 2) {
596			res = -EINVAL;
597			break;
598		}
599		ax25->backoff = opt;
600		break;
601
602	case AX25_EXTSEQ:
603		ax25->modulus = opt ? AX25_EMODULUS : AX25_MODULUS;
604		break;
605
606	case AX25_PIDINCL:
607		ax25->pidincl = opt ? 1 : 0;
608		break;
609
610	case AX25_IAMDIGI:
611		ax25->iamdigi = opt ? 1 : 0;
612		break;
613
614	case AX25_PACLEN:
615		if (opt < 16 || opt > 65535) {
616			res = -EINVAL;
617			break;
618		}
619		ax25->paclen = opt;
620		break;
621
622	case SO_BINDTODEVICE:
623		if (optlen > IFNAMSIZ)
624			optlen=IFNAMSIZ;
625		if (copy_from_user(devname, optval, optlen)) {
626		res = -EFAULT;
627			break;
628		}
629
630		dev = dev_get_by_name(devname);
631		if (dev == NULL) {
632			res = -ENODEV;
633			break;
634		}
635
636		if (sk->sk_type == SOCK_SEQPACKET &&
637		   (sock->state != SS_UNCONNECTED ||
638		    sk->sk_state == TCP_LISTEN)) {
639			res = -EADDRNOTAVAIL;
640			dev_put(dev);
641			break;
642		}
643
644		ax25->ax25_dev = ax25_dev_ax25dev(dev);
645		ax25_fillin_cb(ax25, ax25->ax25_dev);
646		break;
647
648	default:
649		res = -ENOPROTOOPT;
650	}
651	release_sock(sk);
652
653	return res;
654}
655
656static int ax25_getsockopt(struct socket *sock, int level, int optname,
657	char __user *optval, int __user *optlen)
658{
659	struct sock *sk = sock->sk;
660	ax25_cb *ax25;
661	struct ax25_dev *ax25_dev;
662	char devname[IFNAMSIZ];
663	void *valptr;
664	int val = 0;
665	int maxlen, length;
666
667	if (level != SOL_AX25)
668		return -ENOPROTOOPT;
669
670	if (get_user(maxlen, optlen))
671		return -EFAULT;
672
673	if (maxlen < 1)
674		return -EFAULT;
675
676	valptr = (void *) &val;
677	length = min_t(unsigned int, maxlen, sizeof(int));
678
679	lock_sock(sk);
680	ax25 = ax25_sk(sk);
681
682	switch (optname) {
683	case AX25_WINDOW:
684		val = ax25->window;
685		break;
686
687	case AX25_T1:
688		val = ax25->t1 / HZ;
689		break;
690
691	case AX25_T2:
692		val = ax25->t2 / HZ;
693		break;
694
695	case AX25_N2:
696		val = ax25->n2;
697		break;
698
699	case AX25_T3:
700		val = ax25->t3 / HZ;
701		break;
702
703	case AX25_IDLE:
704		val = ax25->idle / (60 * HZ);
705		break;
706
707	case AX25_BACKOFF:
708		val = ax25->backoff;
709		break;
710
711	case AX25_EXTSEQ:
712		val = (ax25->modulus == AX25_EMODULUS);
713		break;
714
715	case AX25_PIDINCL:
716		val = ax25->pidincl;
717		break;
718
719	case AX25_IAMDIGI:
720		val = ax25->iamdigi;
721		break;
722
723	case AX25_PACLEN:
724		val = ax25->paclen;
725		break;
726
727	case SO_BINDTODEVICE:
728		ax25_dev = ax25->ax25_dev;
729
730		if (ax25_dev != NULL && ax25_dev->dev != NULL) {
731			strlcpy(devname, ax25_dev->dev->name, sizeof(devname));
732			length = strlen(devname) + 1;
733		} else {
734			*devname = '\0';
735			length = 1;
736		}
737
738		valptr = (void *) devname;
739		break;
740
741	default:
742		release_sock(sk);
743		return -ENOPROTOOPT;
744	}
745	release_sock(sk);
746
747	if (put_user(length, optlen))
748		return -EFAULT;
749
750	return copy_to_user(optval, valptr, length) ? -EFAULT : 0;
751}
752
753static int ax25_listen(struct socket *sock, int backlog)
754{
755	struct sock *sk = sock->sk;
756	int res = 0;
757
758	lock_sock(sk);
759	if (sk->sk_type == SOCK_SEQPACKET && sk->sk_state != TCP_LISTEN) {
760		sk->sk_max_ack_backlog = backlog;
761		sk->sk_state           = TCP_LISTEN;
762		goto out;
763	}
764	res = -EOPNOTSUPP;
765
766out:
767	release_sock(sk);
768
769	return res;
770}
771
772static struct proto ax25_proto = {
773	.name	  = "AX25",
774	.owner	  = THIS_MODULE,
775	.obj_size = sizeof(struct sock),
776};
777
778static int ax25_create(struct socket *sock, int protocol)
779{
780	struct sock *sk;
781	ax25_cb *ax25;
782
783	switch (sock->type) {
784	case SOCK_DGRAM:
785		if (protocol == 0 || protocol == PF_AX25)
786			protocol = AX25_P_TEXT;
787		break;
788
789	case SOCK_SEQPACKET:
790		switch (protocol) {
791		case 0:
792		case PF_AX25:	/* For CLX */
793			protocol = AX25_P_TEXT;
794			break;
795		case AX25_P_SEGMENT:
796#ifdef CONFIG_INET
797		case AX25_P_ARP:
798		case AX25_P_IP:
799#endif
800#ifdef CONFIG_NETROM
801		case AX25_P_NETROM:
802#endif
803#ifdef CONFIG_ROSE
804		case AX25_P_ROSE:
805#endif
806			return -ESOCKTNOSUPPORT;
807#ifdef CONFIG_NETROM_MODULE
808		case AX25_P_NETROM:
809			if (ax25_protocol_is_registered(AX25_P_NETROM))
810				return -ESOCKTNOSUPPORT;
811#endif
812#ifdef CONFIG_ROSE_MODULE
813		case AX25_P_ROSE:
814			if (ax25_protocol_is_registered(AX25_P_ROSE))
815				return -ESOCKTNOSUPPORT;
816#endif
817		default:
818			break;
819		}
820		break;
821
822	case SOCK_RAW:
823		break;
824	default:
825		return -ESOCKTNOSUPPORT;
826	}
827
828	if ((sk = sk_alloc(PF_AX25, GFP_ATOMIC, &ax25_proto, 1)) == NULL)
829		return -ENOMEM;
830
831	ax25 = sk->sk_protinfo = ax25_create_cb();
832	if (!ax25) {
833		sk_free(sk);
834		return -ENOMEM;
835	}
836
837	sock_init_data(sock, sk);
838
839	sk->sk_destruct = ax25_free_sock;
840	sock->ops    = &ax25_proto_ops;
841	sk->sk_protocol = protocol;
842
843	ax25->sk    = sk;
844
845	return 0;
846}
847
848struct sock *ax25_make_new(struct sock *osk, struct ax25_dev *ax25_dev)
849{
850	struct sock *sk;
851	ax25_cb *ax25, *oax25;
852
853	if ((sk = sk_alloc(PF_AX25, GFP_ATOMIC, osk->sk_prot, 1)) == NULL)
854		return NULL;
855
856	if ((ax25 = ax25_create_cb()) == NULL) {
857		sk_free(sk);
858		return NULL;
859	}
860
861	switch (osk->sk_type) {
862	case SOCK_DGRAM:
863		break;
864	case SOCK_SEQPACKET:
865		break;
866	default:
867		sk_free(sk);
868		ax25_cb_put(ax25);
869		return NULL;
870	}
871
872	sock_init_data(NULL, sk);
873
874	sk->sk_destruct = ax25_free_sock;
875	sk->sk_type     = osk->sk_type;
876	sk->sk_socket   = osk->sk_socket;
877	sk->sk_priority = osk->sk_priority;
878	sk->sk_protocol = osk->sk_protocol;
879	sk->sk_rcvbuf   = osk->sk_rcvbuf;
880	sk->sk_sndbuf   = osk->sk_sndbuf;
881	sk->sk_state    = TCP_ESTABLISHED;
882	sk->sk_sleep    = osk->sk_sleep;
883	sock_copy_flags(sk, osk);
884
885	oax25 = ax25_sk(osk);
886
887	ax25->modulus = oax25->modulus;
888	ax25->backoff = oax25->backoff;
889	ax25->pidincl = oax25->pidincl;
890	ax25->iamdigi = oax25->iamdigi;
891	ax25->rtt     = oax25->rtt;
892	ax25->t1      = oax25->t1;
893	ax25->t2      = oax25->t2;
894	ax25->t3      = oax25->t3;
895	ax25->n2      = oax25->n2;
896	ax25->idle    = oax25->idle;
897	ax25->paclen  = oax25->paclen;
898	ax25->window  = oax25->window;
899
900	ax25->ax25_dev    = ax25_dev;
901	ax25->source_addr = oax25->source_addr;
902
903	if (oax25->digipeat != NULL) {
904		ax25->digipeat = kmemdup(oax25->digipeat, sizeof(ax25_digi),
905					 GFP_ATOMIC);
906		if (ax25->digipeat == NULL) {
907			sk_free(sk);
908			ax25_cb_put(ax25);
909			return NULL;
910		}
911	}
912
913	sk->sk_protinfo = ax25;
914	ax25->sk    = sk;
915
916	return sk;
917}
918
919static int ax25_release(struct socket *sock)
920{
921	struct sock *sk = sock->sk;
922	ax25_cb *ax25;
923
924	if (sk == NULL)
925		return 0;
926
927	sock_hold(sk);
928	sock_orphan(sk);
929	lock_sock(sk);
930	ax25 = ax25_sk(sk);
931
932	if (sk->sk_type == SOCK_SEQPACKET) {
933		switch (ax25->state) {
934		case AX25_STATE_0:
935			release_sock(sk);
936			ax25_disconnect(ax25, 0);
937			lock_sock(sk);
938			ax25_destroy_socket(ax25);
939			break;
940
941		case AX25_STATE_1:
942		case AX25_STATE_2:
943			ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
944			release_sock(sk);
945			ax25_disconnect(ax25, 0);
946			lock_sock(sk);
947			ax25_destroy_socket(ax25);
948			break;
949
950		case AX25_STATE_3:
951		case AX25_STATE_4:
952			ax25_clear_queues(ax25);
953			ax25->n2count = 0;
954
955			switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
956			case AX25_PROTO_STD_SIMPLEX:
957			case AX25_PROTO_STD_DUPLEX:
958				ax25_send_control(ax25,
959						  AX25_DISC,
960						  AX25_POLLON,
961						  AX25_COMMAND);
962				ax25_stop_t2timer(ax25);
963				ax25_stop_t3timer(ax25);
964				ax25_stop_idletimer(ax25);
965				break;
966#ifdef CONFIG_AX25_DAMA_SLAVE
967			case AX25_PROTO_DAMA_SLAVE:
968				ax25_stop_t3timer(ax25);
969				ax25_stop_idletimer(ax25);
970				break;
971#endif
972			}
973			ax25_calculate_t1(ax25);
974			ax25_start_t1timer(ax25);
975			ax25->state = AX25_STATE_2;
976			sk->sk_state                = TCP_CLOSE;
977			sk->sk_shutdown            |= SEND_SHUTDOWN;
978			sk->sk_state_change(sk);
979			sock_set_flag(sk, SOCK_DESTROY);
980			break;
981
982		default:
983			break;
984		}
985	} else {
986		sk->sk_state     = TCP_CLOSE;
987		sk->sk_shutdown |= SEND_SHUTDOWN;
988		sk->sk_state_change(sk);
989		ax25_destroy_socket(ax25);
990	}
991
992	sock->sk   = NULL;
993	release_sock(sk);
994	sock_put(sk);
995
996	return 0;
997}
998
999/*
1000 *	We support a funny extension here so you can (as root) give any callsign
1001 *	digipeated via a local address as source. This hack is obsolete now
1002 *	that we've implemented support for SO_BINDTODEVICE. It is however small
1003 *	and trivially backward compatible.
1004 */
1005static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
1006{
1007	struct sock *sk = sock->sk;
1008	struct full_sockaddr_ax25 *addr = (struct full_sockaddr_ax25 *)uaddr;
1009	ax25_dev *ax25_dev = NULL;
1010	ax25_uid_assoc *user;
1011	ax25_address call;
1012	ax25_cb *ax25;
1013	int err = 0;
1014
1015	if (addr_len != sizeof(struct sockaddr_ax25) &&
1016	    addr_len != sizeof(struct full_sockaddr_ax25)) {
1017		/* support for old structure may go away some time */
1018		if ((addr_len < sizeof(struct sockaddr_ax25) + sizeof(ax25_address) * 6) ||
1019		    (addr_len > sizeof(struct full_sockaddr_ax25))) {
1020			return -EINVAL;
1021	}
1022
1023		printk(KERN_WARNING "ax25_bind(): %s uses old (6 digipeater) socket structure.\n",
1024			current->comm);
1025	}
1026
1027	if (addr->fsa_ax25.sax25_family != AF_AX25)
1028		return -EINVAL;
1029
1030	user = ax25_findbyuid(current->euid);
1031	if (user) {
1032		call = user->call;
1033		ax25_uid_put(user);
1034	} else {
1035		if (ax25_uid_policy && !capable(CAP_NET_ADMIN))
1036			return -EACCES;
1037
1038		call = addr->fsa_ax25.sax25_call;
1039	}
1040
1041	lock_sock(sk);
1042
1043	ax25 = ax25_sk(sk);
1044	if (!sock_flag(sk, SOCK_ZAPPED)) {
1045		err = -EINVAL;
1046		goto out;
1047	}
1048
1049	ax25->source_addr = call;
1050
1051	/*
1052	 * User already set interface with SO_BINDTODEVICE
1053	 */
1054	if (ax25->ax25_dev != NULL)
1055		goto done;
1056
1057	if (addr_len > sizeof(struct sockaddr_ax25) && addr->fsa_ax25.sax25_ndigis == 1) {
1058		if (ax25cmp(&addr->fsa_digipeater[0], &null_ax25_address) != 0 &&
1059		    (ax25_dev = ax25_addr_ax25dev(&addr->fsa_digipeater[0])) == NULL) {
1060			err = -EADDRNOTAVAIL;
1061			goto out;
1062		}
1063	} else {
1064		if ((ax25_dev = ax25_addr_ax25dev(&addr->fsa_ax25.sax25_call)) == NULL) {
1065			err = -EADDRNOTAVAIL;
1066			goto out;
1067		}
1068	}
1069
1070	if (ax25_dev != NULL)
1071		ax25_fillin_cb(ax25, ax25_dev);
1072
1073done:
1074	ax25_cb_add(ax25);
1075	sock_reset_flag(sk, SOCK_ZAPPED);
1076
1077out:
1078	release_sock(sk);
1079
1080	return 0;
1081}
1082
1083static int __must_check ax25_connect(struct socket *sock,
1084	struct sockaddr *uaddr, int addr_len, int flags)
1085{
1086	struct sock *sk = sock->sk;
1087	ax25_cb *ax25 = ax25_sk(sk), *ax25t;
1088	struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)uaddr;
1089	ax25_digi *digi = NULL;
1090	int ct = 0, err = 0;
1091
1092	/*
1093	 * some sanity checks. code further down depends on this
1094	 */
1095
1096	if (addr_len == sizeof(struct sockaddr_ax25)) {
1097		/* support for this will go away in early 2.5.x */
1098		printk(KERN_WARNING "ax25_connect(): %s uses obsolete socket structure\n",
1099			current->comm);
1100	}
1101	else if (addr_len != sizeof(struct full_sockaddr_ax25)) {
1102		/* support for old structure may go away some time */
1103		if ((addr_len < sizeof(struct sockaddr_ax25) + sizeof(ax25_address) * 6) ||
1104		    (addr_len > sizeof(struct full_sockaddr_ax25))) {
1105			return -EINVAL;
1106		}
1107
1108		printk(KERN_WARNING "ax25_connect(): %s uses old (6 digipeater) socket structure.\n",
1109			current->comm);
1110	}
1111
1112	if (fsa->fsa_ax25.sax25_family != AF_AX25)
1113		return -EINVAL;
1114
1115	lock_sock(sk);
1116
1117	/* deal with restarts */
1118	if (sock->state == SS_CONNECTING) {
1119		switch (sk->sk_state) {
1120		case TCP_SYN_SENT: /* still trying */
1121			err = -EINPROGRESS;
1122			goto out_release;
1123
1124		case TCP_ESTABLISHED: /* connection established */
1125			sock->state = SS_CONNECTED;
1126			goto out_release;
1127
1128		case TCP_CLOSE: /* connection refused */
1129			sock->state = SS_UNCONNECTED;
1130			err = -ECONNREFUSED;
1131			goto out_release;
1132		}
1133	}
1134
1135	if (sk->sk_state == TCP_ESTABLISHED && sk->sk_type == SOCK_SEQPACKET) {
1136		err = -EISCONN;	/* No reconnect on a seqpacket socket */
1137		goto out_release;
1138	}
1139
1140	sk->sk_state   = TCP_CLOSE;
1141	sock->state = SS_UNCONNECTED;
1142
1143	kfree(ax25->digipeat);
1144	ax25->digipeat = NULL;
1145
1146	/*
1147	 *	Handle digi-peaters to be used.
1148	 */
1149	if (addr_len > sizeof(struct sockaddr_ax25) &&
1150	    fsa->fsa_ax25.sax25_ndigis != 0) {
1151		/* Valid number of digipeaters ? */
1152		if (fsa->fsa_ax25.sax25_ndigis < 1 || fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS) {
1153			err = -EINVAL;
1154			goto out_release;
1155		}
1156
1157		if ((digi = kmalloc(sizeof(ax25_digi), GFP_KERNEL)) == NULL) {
1158			err = -ENOBUFS;
1159			goto out_release;
1160		}
1161
1162		digi->ndigi      = fsa->fsa_ax25.sax25_ndigis;
1163		digi->lastrepeat = -1;
1164
1165		while (ct < fsa->fsa_ax25.sax25_ndigis) {
1166			if ((fsa->fsa_digipeater[ct].ax25_call[6] &
1167			     AX25_HBIT) && ax25->iamdigi) {
1168				digi->repeated[ct] = 1;
1169				digi->lastrepeat   = ct;
1170			} else {
1171				digi->repeated[ct] = 0;
1172			}
1173			digi->calls[ct] = fsa->fsa_digipeater[ct];
1174			ct++;
1175		}
1176	}
1177
1178	/*
1179	 *	Must bind first - autobinding in this may or may not work. If
1180	 *	the socket is already bound, check to see if the device has
1181	 *	been filled in, error if it hasn't.
1182	 */
1183	if (sock_flag(sk, SOCK_ZAPPED)) {
1184		/* check if we can remove this feature. It is broken. */
1185		printk(KERN_WARNING "ax25_connect(): %s uses autobind, please contact jreuter@yaina.de\n",
1186			current->comm);
1187		if ((err = ax25_rt_autobind(ax25, &fsa->fsa_ax25.sax25_call)) < 0) {
1188			kfree(digi);
1189			goto out_release;
1190		}
1191
1192		ax25_fillin_cb(ax25, ax25->ax25_dev);
1193		ax25_cb_add(ax25);
1194	} else {
1195		if (ax25->ax25_dev == NULL) {
1196			kfree(digi);
1197			err = -EHOSTUNREACH;
1198			goto out_release;
1199		}
1200	}
1201
1202	if (sk->sk_type == SOCK_SEQPACKET &&
1203	    (ax25t=ax25_find_cb(&ax25->source_addr, &fsa->fsa_ax25.sax25_call, digi,
1204			 ax25->ax25_dev->dev))) {
1205		kfree(digi);
1206		err = -EADDRINUSE;		/* Already such a connection */
1207		ax25_cb_put(ax25t);
1208		goto out_release;
1209	}
1210
1211	ax25->dest_addr = fsa->fsa_ax25.sax25_call;
1212	ax25->digipeat  = digi;
1213
1214	/* First the easy one */
1215	if (sk->sk_type != SOCK_SEQPACKET) {
1216		sock->state = SS_CONNECTED;
1217		sk->sk_state   = TCP_ESTABLISHED;
1218		goto out_release;
1219	}
1220
1221	/* Move to connecting socket, ax.25 lapb WAIT_UA.. */
1222	sock->state        = SS_CONNECTING;
1223	sk->sk_state          = TCP_SYN_SENT;
1224
1225	switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
1226	case AX25_PROTO_STD_SIMPLEX:
1227	case AX25_PROTO_STD_DUPLEX:
1228		ax25_std_establish_data_link(ax25);
1229		break;
1230
1231#ifdef CONFIG_AX25_DAMA_SLAVE
1232	case AX25_PROTO_DAMA_SLAVE:
1233		ax25->modulus = AX25_MODULUS;
1234		ax25->window  = ax25->ax25_dev->values[AX25_VALUES_WINDOW];
1235		if (ax25->ax25_dev->dama.slave)
1236			ax25_ds_establish_data_link(ax25);
1237		else
1238			ax25_std_establish_data_link(ax25);
1239		break;
1240#endif
1241	}
1242
1243	ax25->state = AX25_STATE_1;
1244
1245	ax25_start_heartbeat(ax25);
1246
1247	/* Now the loop */
1248	if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK)) {
1249		err = -EINPROGRESS;
1250		goto out_release;
1251	}
1252
1253	if (sk->sk_state == TCP_SYN_SENT) {
1254		DEFINE_WAIT(wait);
1255
1256		for (;;) {
1257			prepare_to_wait(sk->sk_sleep, &wait,
1258			                TASK_INTERRUPTIBLE);
1259			if (sk->sk_state != TCP_SYN_SENT)
1260				break;
1261			if (!signal_pending(current)) {
1262				release_sock(sk);
1263				schedule();
1264				lock_sock(sk);
1265				continue;
1266			}
1267			err = -ERESTARTSYS;
1268			break;
1269		}
1270		finish_wait(sk->sk_sleep, &wait);
1271
1272		if (err)
1273			goto out_release;
1274	}
1275
1276	if (sk->sk_state != TCP_ESTABLISHED) {
1277		/* Not in ABM, not in WAIT_UA -> failed */
1278		sock->state = SS_UNCONNECTED;
1279		err = sock_error(sk);	/* Always set at this point */
1280		goto out_release;
1281	}
1282
1283	sock->state = SS_CONNECTED;
1284
1285	err = 0;
1286out_release:
1287	release_sock(sk);
1288
1289	return err;
1290}
1291
1292static int ax25_accept(struct socket *sock, struct socket *newsock, int flags)
1293{
1294	struct sk_buff *skb;
1295	struct sock *newsk;
1296	DEFINE_WAIT(wait);
1297	struct sock *sk;
1298	int err = 0;
1299
1300	if (sock->state != SS_UNCONNECTED)
1301		return -EINVAL;
1302
1303	if ((sk = sock->sk) == NULL)
1304		return -EINVAL;
1305
1306	lock_sock(sk);
1307	if (sk->sk_type != SOCK_SEQPACKET) {
1308		err = -EOPNOTSUPP;
1309		goto out;
1310	}
1311
1312	if (sk->sk_state != TCP_LISTEN) {
1313		err = -EINVAL;
1314		goto out;
1315	}
1316
1317	/*
1318	 *	The read queue this time is holding sockets ready to use
1319	 *	hooked into the SABM we saved
1320	 */
1321	for (;;) {
1322		prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
1323		skb = skb_dequeue(&sk->sk_receive_queue);
1324		if (skb)
1325			break;
1326
1327		if (flags & O_NONBLOCK) {
1328			err = -EWOULDBLOCK;
1329			break;
1330		}
1331		if (!signal_pending(current)) {
1332			release_sock(sk);
1333			schedule();
1334			lock_sock(sk);
1335			continue;
1336		}
1337		err = -ERESTARTSYS;
1338		break;
1339	}
1340	finish_wait(sk->sk_sleep, &wait);
1341
1342	if (err)
1343		goto out;
1344
1345	newsk		 = skb->sk;
1346	newsk->sk_socket = newsock;
1347	newsk->sk_sleep	 = &newsock->wait;
1348
1349	/* Now attach up the new socket */
1350	kfree_skb(skb);
1351	sk->sk_ack_backlog--;
1352	newsock->sk    = newsk;
1353	newsock->state = SS_CONNECTED;
1354
1355out:
1356	release_sock(sk);
1357
1358	return err;
1359}
1360
1361static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
1362	int *uaddr_len, int peer)
1363{
1364	struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)uaddr;
1365	struct sock *sk = sock->sk;
1366	unsigned char ndigi, i;
1367	ax25_cb *ax25;
1368	int err = 0;
1369
1370	lock_sock(sk);
1371	ax25 = ax25_sk(sk);
1372
1373	if (peer != 0) {
1374		if (sk->sk_state != TCP_ESTABLISHED) {
1375			err = -ENOTCONN;
1376			goto out;
1377		}
1378
1379		fsa->fsa_ax25.sax25_family = AF_AX25;
1380		fsa->fsa_ax25.sax25_call   = ax25->dest_addr;
1381		fsa->fsa_ax25.sax25_ndigis = 0;
1382
1383		if (ax25->digipeat != NULL) {
1384			ndigi = ax25->digipeat->ndigi;
1385			fsa->fsa_ax25.sax25_ndigis = ndigi;
1386			for (i = 0; i < ndigi; i++)
1387				fsa->fsa_digipeater[i] =
1388						ax25->digipeat->calls[i];
1389		}
1390	} else {
1391		fsa->fsa_ax25.sax25_family = AF_AX25;
1392		fsa->fsa_ax25.sax25_call   = ax25->source_addr;
1393		fsa->fsa_ax25.sax25_ndigis = 1;
1394		if (ax25->ax25_dev != NULL) {
1395			memcpy(&fsa->fsa_digipeater[0],
1396			       ax25->ax25_dev->dev->dev_addr, AX25_ADDR_LEN);
1397		} else {
1398			fsa->fsa_digipeater[0] = null_ax25_address;
1399		}
1400	}
1401	*uaddr_len = sizeof (struct full_sockaddr_ax25);
1402
1403out:
1404	release_sock(sk);
1405
1406	return err;
1407}
1408
1409static int ax25_sendmsg(struct kiocb *iocb, struct socket *sock,
1410			struct msghdr *msg, size_t len)
1411{
1412	struct sockaddr_ax25 *usax = (struct sockaddr_ax25 *)msg->msg_name;
1413	struct sock *sk = sock->sk;
1414	struct sockaddr_ax25 sax;
1415	struct sk_buff *skb;
1416	ax25_digi dtmp, *dp;
1417	ax25_cb *ax25;
1418	size_t size;
1419	int lv, err, addr_len = msg->msg_namelen;
1420
1421	if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_CMSG_COMPAT))
1422		return -EINVAL;
1423
1424	lock_sock(sk);
1425	ax25 = ax25_sk(sk);
1426
1427	if (sock_flag(sk, SOCK_ZAPPED)) {
1428		err = -EADDRNOTAVAIL;
1429		goto out;
1430	}
1431
1432	if (sk->sk_shutdown & SEND_SHUTDOWN) {
1433		send_sig(SIGPIPE, current, 0);
1434		err = -EPIPE;
1435		goto out;
1436	}
1437
1438	if (ax25->ax25_dev == NULL) {
1439		err = -ENETUNREACH;
1440		goto out;
1441	}
1442
1443	if (len > ax25->ax25_dev->dev->mtu) {
1444		err = -EMSGSIZE;
1445		goto out;
1446	}
1447
1448	if (usax != NULL) {
1449		if (usax->sax25_family != AF_AX25) {
1450			err = -EINVAL;
1451			goto out;
1452		}
1453
1454		if (addr_len == sizeof(struct sockaddr_ax25)) {
1455			printk(KERN_WARNING "ax25_sendmsg(): %s uses obsolete socket structure\n",
1456				current->comm);
1457		}
1458		else if (addr_len != sizeof(struct full_sockaddr_ax25)) {
1459			/* support for old structure may go away some time */
1460			if ((addr_len < sizeof(struct sockaddr_ax25) + sizeof(ax25_address) * 6) ||
1461			    (addr_len > sizeof(struct full_sockaddr_ax25))) {
1462				err = -EINVAL;
1463				goto out;
1464			}
1465
1466			printk(KERN_WARNING "ax25_sendmsg(): %s uses old (6 digipeater) socket structure.\n",
1467				current->comm);
1468		}
1469
1470		if (addr_len > sizeof(struct sockaddr_ax25) && usax->sax25_ndigis != 0) {
1471			int ct           = 0;
1472			struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax;
1473
1474			/* Valid number of digipeaters ? */
1475			if (usax->sax25_ndigis < 1 || usax->sax25_ndigis > AX25_MAX_DIGIS) {
1476				err = -EINVAL;
1477				goto out;
1478			}
1479
1480			dtmp.ndigi      = usax->sax25_ndigis;
1481
1482			while (ct < usax->sax25_ndigis) {
1483				dtmp.repeated[ct] = 0;
1484				dtmp.calls[ct]    = fsa->fsa_digipeater[ct];
1485				ct++;
1486			}
1487
1488			dtmp.lastrepeat = 0;
1489		}
1490
1491		sax = *usax;
1492		if (sk->sk_type == SOCK_SEQPACKET &&
1493		    ax25cmp(&ax25->dest_addr, &sax.sax25_call)) {
1494			err = -EISCONN;
1495			goto out;
1496		}
1497		if (usax->sax25_ndigis == 0)
1498			dp = NULL;
1499		else
1500			dp = &dtmp;
1501	} else {
1502		if (sk->sk_state != TCP_ESTABLISHED) {
1503			err = -ENOTCONN;
1504			goto out;
1505		}
1506		sax.sax25_family = AF_AX25;
1507		sax.sax25_call   = ax25->dest_addr;
1508		dp = ax25->digipeat;
1509	}
1510
1511	SOCK_DEBUG(sk, "AX.25: sendto: Addresses built.\n");
1512
1513	/* Build a packet */
1514	SOCK_DEBUG(sk, "AX.25: sendto: building packet.\n");
1515
1516	/* Assume the worst case */
1517	size = len + ax25->ax25_dev->dev->hard_header_len;
1518
1519	skb = sock_alloc_send_skb(sk, size, msg->msg_flags&MSG_DONTWAIT, &err);
1520	if (skb == NULL)
1521		goto out;
1522
1523	skb_reserve(skb, size - len);
1524
1525	SOCK_DEBUG(sk, "AX.25: Appending user data\n");
1526
1527	/* User data follows immediately after the AX.25 data */
1528	if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
1529		err = -EFAULT;
1530		kfree_skb(skb);
1531		goto out;
1532	}
1533
1534	skb_reset_network_header(skb);
1535
1536	/* Add the PID if one is not supplied by the user in the skb */
1537	if (!ax25->pidincl)
1538		*skb_push(skb, 1) = sk->sk_protocol;
1539
1540	SOCK_DEBUG(sk, "AX.25: Transmitting buffer\n");
1541
1542	if (sk->sk_type == SOCK_SEQPACKET) {
1543		/* Connected mode sockets go via the LAPB machine */
1544		if (sk->sk_state != TCP_ESTABLISHED) {
1545			kfree_skb(skb);
1546			err = -ENOTCONN;
1547			goto out;
1548		}
1549
1550		/* Shove it onto the queue and kick */
1551		ax25_output(ax25, ax25->paclen, skb);
1552
1553		err = len;
1554		goto out;
1555	}
1556
1557	skb_push(skb, 1 + ax25_addr_size(dp));
1558
1559	SOCK_DEBUG(sk, "Building AX.25 Header (dp=%p).\n", dp);
1560
1561	if (dp != NULL)
1562		SOCK_DEBUG(sk, "Num digipeaters=%d\n", dp->ndigi);
1563
1564	/* Build an AX.25 header */
1565	lv = ax25_addr_build(skb->data, &ax25->source_addr, &sax.sax25_call,
1566			     dp, AX25_COMMAND, AX25_MODULUS);
1567
1568	SOCK_DEBUG(sk, "Built header (%d bytes)\n",lv);
1569
1570	skb_set_transport_header(skb, lv);
1571
1572	SOCK_DEBUG(sk, "base=%p pos=%p\n",
1573		   skb->data, skb_transport_header(skb));
1574
1575	*skb_transport_header(skb) = AX25_UI;
1576
1577	/* Datagram frames go straight out of the door as UI */
1578	ax25_queue_xmit(skb, ax25->ax25_dev->dev);
1579
1580	err = len;
1581
1582out:
1583	release_sock(sk);
1584
1585	return err;
1586}
1587
1588static int ax25_recvmsg(struct kiocb *iocb, struct socket *sock,
1589	struct msghdr *msg, size_t size, int flags)
1590{
1591	struct sock *sk = sock->sk;
1592	struct sk_buff *skb;
1593	int copied;
1594	int err = 0;
1595
1596	lock_sock(sk);
1597	/*
1598	 * 	This works for seqpacket too. The receiver has ordered the
1599	 *	queue for us! We do one quick check first though
1600	 */
1601	if (sk->sk_type == SOCK_SEQPACKET && sk->sk_state != TCP_ESTABLISHED) {
1602		err =  -ENOTCONN;
1603		goto out;
1604	}
1605
1606	/* Now we can treat all alike */
1607	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
1608				flags & MSG_DONTWAIT, &err);
1609	if (skb == NULL)
1610		goto out;
1611
1612	if (!ax25_sk(sk)->pidincl)
1613		skb_pull(skb, 1);		/* Remove PID */
1614
1615	skb_reset_transport_header(skb);
1616	copied = skb->len;
1617
1618	if (copied > size) {
1619		copied = size;
1620		msg->msg_flags |= MSG_TRUNC;
1621	}
1622
1623	skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1624
1625	if (msg->msg_namelen != 0) {
1626		struct sockaddr_ax25 *sax = (struct sockaddr_ax25 *)msg->msg_name;
1627		ax25_digi digi;
1628		ax25_address src;
1629		const unsigned char *mac = skb_mac_header(skb);
1630
1631		ax25_addr_parse(mac + 1, skb->data - mac - 1, &src, NULL,
1632				&digi, NULL, NULL);
1633		sax->sax25_family = AF_AX25;
1634		/* We set this correctly, even though we may not let the
1635		   application know the digi calls further down (because it
1636		   did NOT ask to know them).  This could get political... **/
1637		sax->sax25_ndigis = digi.ndigi;
1638		sax->sax25_call   = src;
1639
1640		if (sax->sax25_ndigis != 0) {
1641			int ct;
1642			struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)sax;
1643
1644			for (ct = 0; ct < digi.ndigi; ct++)
1645				fsa->fsa_digipeater[ct] = digi.calls[ct];
1646		}
1647		msg->msg_namelen = sizeof(struct full_sockaddr_ax25);
1648	}
1649
1650	skb_free_datagram(sk, skb);
1651	err = copied;
1652
1653out:
1654	release_sock(sk);
1655
1656	return err;
1657}
1658
1659static int ax25_shutdown(struct socket *sk, int how)
1660{
1661	return -EOPNOTSUPP;
1662}
1663
1664static int ax25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
1665{
1666	struct sock *sk = sock->sk;
1667	void __user *argp = (void __user *)arg;
1668	int res = 0;
1669
1670	lock_sock(sk);
1671	switch (cmd) {
1672	case TIOCOUTQ: {
1673		long amount;
1674		amount = sk->sk_sndbuf - atomic_read(&sk->sk_wmem_alloc);
1675		if (amount < 0)
1676			amount = 0;
1677		res = put_user(amount, (int __user *)argp);
1678		break;
1679	}
1680
1681	case TIOCINQ: {
1682		struct sk_buff *skb;
1683		long amount = 0L;
1684		/* These two are safe on a single CPU system as only user tasks fiddle here */
1685		if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL)
1686			amount = skb->len;
1687		res = put_user(amount, (int __user *) argp);
1688		break;
1689	}
1690
1691	case SIOCGSTAMP:
1692		res = sock_get_timestamp(sk, argp);
1693		break;
1694
1695	case SIOCGSTAMPNS:
1696		res = sock_get_timestampns(sk, argp);
1697		break;
1698
1699	case SIOCAX25ADDUID:	/* Add a uid to the uid/call map table */
1700	case SIOCAX25DELUID:	/* Delete a uid from the uid/call map table */
1701	case SIOCAX25GETUID: {
1702		struct sockaddr_ax25 sax25;
1703		if (copy_from_user(&sax25, argp, sizeof(sax25))) {
1704			res = -EFAULT;
1705			break;
1706		}
1707		res = ax25_uid_ioctl(cmd, &sax25);
1708		break;
1709	}
1710
1711	case SIOCAX25NOUID: {	/* Set the default policy (default/bar) */
1712		long amount;
1713		if (!capable(CAP_NET_ADMIN)) {
1714			res = -EPERM;
1715			break;
1716		}
1717		if (get_user(amount, (long __user *)argp)) {
1718			res = -EFAULT;
1719			break;
1720		}
1721		if (amount > AX25_NOUID_BLOCK) {
1722			res = -EINVAL;
1723			break;
1724		}
1725		ax25_uid_policy = amount;
1726		res = 0;
1727		break;
1728	}
1729
1730	case SIOCADDRT:
1731	case SIOCDELRT:
1732	case SIOCAX25OPTRT:
1733		if (!capable(CAP_NET_ADMIN)) {
1734			res = -EPERM;
1735			break;
1736		}
1737		res = ax25_rt_ioctl(cmd, argp);
1738		break;
1739
1740	case SIOCAX25CTLCON:
1741		if (!capable(CAP_NET_ADMIN)) {
1742			res = -EPERM;
1743			break;
1744		}
1745		res = ax25_ctl_ioctl(cmd, argp);
1746		break;
1747
1748	case SIOCAX25GETINFO:
1749	case SIOCAX25GETINFOOLD: {
1750		ax25_cb *ax25 = ax25_sk(sk);
1751		struct ax25_info_struct ax25_info;
1752
1753		ax25_info.t1        = ax25->t1   / HZ;
1754		ax25_info.t2        = ax25->t2   / HZ;
1755		ax25_info.t3        = ax25->t3   / HZ;
1756		ax25_info.idle      = ax25->idle / (60 * HZ);
1757		ax25_info.n2        = ax25->n2;
1758		ax25_info.t1timer   = ax25_display_timer(&ax25->t1timer)   / HZ;
1759		ax25_info.t2timer   = ax25_display_timer(&ax25->t2timer)   / HZ;
1760		ax25_info.t3timer   = ax25_display_timer(&ax25->t3timer)   / HZ;
1761		ax25_info.idletimer = ax25_display_timer(&ax25->idletimer) / (60 * HZ);
1762		ax25_info.n2count   = ax25->n2count;
1763		ax25_info.state     = ax25->state;
1764		ax25_info.rcv_q     = atomic_read(&sk->sk_rmem_alloc);
1765		ax25_info.snd_q     = atomic_read(&sk->sk_wmem_alloc);
1766		ax25_info.vs        = ax25->vs;
1767		ax25_info.vr        = ax25->vr;
1768		ax25_info.va        = ax25->va;
1769		ax25_info.vs_max    = ax25->vs; /* reserved */
1770		ax25_info.paclen    = ax25->paclen;
1771		ax25_info.window    = ax25->window;
1772
1773		/* old structure? */
1774		if (cmd == SIOCAX25GETINFOOLD) {
1775			static int warned = 0;
1776			if (!warned) {
1777				printk(KERN_INFO "%s uses old SIOCAX25GETINFO\n",
1778					current->comm);
1779				warned=1;
1780			}
1781
1782			if (copy_to_user(argp, &ax25_info, sizeof(struct ax25_info_struct_deprecated))) {
1783				res = -EFAULT;
1784				break;
1785			}
1786		} else {
1787			if (copy_to_user(argp, &ax25_info, sizeof(struct ax25_info_struct))) {
1788				res = -EINVAL;
1789				break;
1790			}
1791		}
1792		res = 0;
1793		break;
1794	}
1795
1796	case SIOCAX25ADDFWD:
1797	case SIOCAX25DELFWD: {
1798		struct ax25_fwd_struct ax25_fwd;
1799		if (!capable(CAP_NET_ADMIN)) {
1800			res = -EPERM;
1801			break;
1802		}
1803		if (copy_from_user(&ax25_fwd, argp, sizeof(ax25_fwd))) {
1804			res = -EFAULT;
1805			break;
1806		}
1807		res = ax25_fwd_ioctl(cmd, &ax25_fwd);
1808		break;
1809	}
1810
1811	case SIOCGIFADDR:
1812	case SIOCSIFADDR:
1813	case SIOCGIFDSTADDR:
1814	case SIOCSIFDSTADDR:
1815	case SIOCGIFBRDADDR:
1816	case SIOCSIFBRDADDR:
1817	case SIOCGIFNETMASK:
1818	case SIOCSIFNETMASK:
1819	case SIOCGIFMETRIC:
1820	case SIOCSIFMETRIC:
1821		res = -EINVAL;
1822		break;
1823
1824	default:
1825		res = -ENOIOCTLCMD;
1826		break;
1827	}
1828	release_sock(sk);
1829
1830	return res;
1831}
1832
1833#ifdef CONFIG_PROC_FS
1834
1835static void *ax25_info_start(struct seq_file *seq, loff_t *pos)
1836{
1837	struct ax25_cb *ax25;
1838	struct hlist_node *node;
1839	int i = 0;
1840
1841	spin_lock_bh(&ax25_list_lock);
1842	ax25_for_each(ax25, node, &ax25_list) {
1843		if (i == *pos)
1844			return ax25;
1845		++i;
1846	}
1847	return NULL;
1848}
1849
1850static void *ax25_info_next(struct seq_file *seq, void *v, loff_t *pos)
1851{
1852	++*pos;
1853
1854	return hlist_entry( ((struct ax25_cb *)v)->ax25_node.next,
1855			    struct ax25_cb, ax25_node);
1856}
1857
1858static void ax25_info_stop(struct seq_file *seq, void *v)
1859{
1860	spin_unlock_bh(&ax25_list_lock);
1861}
1862
1863static int ax25_info_show(struct seq_file *seq, void *v)
1864{
1865	ax25_cb *ax25 = v;
1866	char buf[11];
1867	int k;
1868
1869
1870	/*
1871	 * New format:
1872	 * magic dev src_addr dest_addr,digi1,digi2,.. st vs vr va t1 t1 t2 t2 t3 t3 idle idle n2 n2 rtt window paclen Snd-Q Rcv-Q inode
1873	 */
1874
1875	seq_printf(seq, "%8.8lx %s %s%s ",
1876		   (long) ax25,
1877		   ax25->ax25_dev == NULL? "???" : ax25->ax25_dev->dev->name,
1878		   ax2asc(buf, &ax25->source_addr),
1879		   ax25->iamdigi? "*":"");
1880	seq_printf(seq, "%s", ax2asc(buf, &ax25->dest_addr));
1881
1882	for (k=0; (ax25->digipeat != NULL) && (k < ax25->digipeat->ndigi); k++) {
1883		seq_printf(seq, ",%s%s",
1884			   ax2asc(buf, &ax25->digipeat->calls[k]),
1885			   ax25->digipeat->repeated[k]? "*":"");
1886	}
1887
1888	seq_printf(seq, " %d %d %d %d %lu %lu %lu %lu %lu %lu %lu %lu %d %d %lu %d %d",
1889		   ax25->state,
1890		   ax25->vs, ax25->vr, ax25->va,
1891		   ax25_display_timer(&ax25->t1timer) / HZ, ax25->t1 / HZ,
1892		   ax25_display_timer(&ax25->t2timer) / HZ, ax25->t2 / HZ,
1893		   ax25_display_timer(&ax25->t3timer) / HZ, ax25->t3 / HZ,
1894		   ax25_display_timer(&ax25->idletimer) / (60 * HZ),
1895		   ax25->idle / (60 * HZ),
1896		   ax25->n2count, ax25->n2,
1897		   ax25->rtt / HZ,
1898		   ax25->window,
1899		   ax25->paclen);
1900
1901	if (ax25->sk != NULL) {
1902		bh_lock_sock(ax25->sk);
1903		seq_printf(seq," %d %d %ld\n",
1904			   atomic_read(&ax25->sk->sk_wmem_alloc),
1905			   atomic_read(&ax25->sk->sk_rmem_alloc),
1906			   ax25->sk->sk_socket != NULL ? SOCK_INODE(ax25->sk->sk_socket)->i_ino : 0L);
1907		bh_unlock_sock(ax25->sk);
1908	} else {
1909		seq_puts(seq, " * * *\n");
1910	}
1911	return 0;
1912}
1913
1914static struct seq_operations ax25_info_seqops = {
1915	.start = ax25_info_start,
1916	.next = ax25_info_next,
1917	.stop = ax25_info_stop,
1918	.show = ax25_info_show,
1919};
1920
1921static int ax25_info_open(struct inode *inode, struct file *file)
1922{
1923	return seq_open(file, &ax25_info_seqops);
1924}
1925
1926static const struct file_operations ax25_info_fops = {
1927	.owner = THIS_MODULE,
1928	.open = ax25_info_open,
1929	.read = seq_read,
1930	.llseek = seq_lseek,
1931	.release = seq_release,
1932};
1933
1934#endif
1935
1936static struct net_proto_family ax25_family_ops = {
1937	.family =	PF_AX25,
1938	.create =	ax25_create,
1939	.owner	=	THIS_MODULE,
1940};
1941
1942static const struct proto_ops ax25_proto_ops = {
1943	.family		= PF_AX25,
1944	.owner		= THIS_MODULE,
1945	.release	= ax25_release,
1946	.bind		= ax25_bind,
1947	.connect	= ax25_connect,
1948	.socketpair	= sock_no_socketpair,
1949	.accept		= ax25_accept,
1950	.getname	= ax25_getname,
1951	.poll		= datagram_poll,
1952	.ioctl		= ax25_ioctl,
1953	.listen		= ax25_listen,
1954	.shutdown	= ax25_shutdown,
1955	.setsockopt	= ax25_setsockopt,
1956	.getsockopt	= ax25_getsockopt,
1957	.sendmsg	= ax25_sendmsg,
1958	.recvmsg	= ax25_recvmsg,
1959	.mmap		= sock_no_mmap,
1960	.sendpage	= sock_no_sendpage,
1961};
1962
1963/*
1964 *	Called by socket.c on kernel start up
1965 */
1966static struct packet_type ax25_packet_type = {
1967	.type	=	__constant_htons(ETH_P_AX25),
1968	.dev	=	NULL,				/* All devices */
1969	.func	=	ax25_kiss_rcv,
1970};
1971
1972static struct notifier_block ax25_dev_notifier = {
1973	.notifier_call =ax25_device_event,
1974};
1975
1976static int __init ax25_init(void)
1977{
1978	int rc = proto_register(&ax25_proto, 0);
1979
1980	if (rc != 0)
1981		goto out;
1982
1983	sock_register(&ax25_family_ops);
1984	dev_add_pack(&ax25_packet_type);
1985	register_netdevice_notifier(&ax25_dev_notifier);
1986	ax25_register_sysctl();
1987
1988	proc_net_fops_create("ax25_route", S_IRUGO, &ax25_route_fops);
1989	proc_net_fops_create("ax25", S_IRUGO, &ax25_info_fops);
1990	proc_net_fops_create("ax25_calls", S_IRUGO, &ax25_uid_fops);
1991out:
1992	return rc;
1993}
1994module_init(ax25_init);
1995
1996
1997MODULE_AUTHOR("Jonathan Naylor G4KLX <g4klx@g4klx.demon.co.uk>");
1998MODULE_DESCRIPTION("The amateur radio AX.25 link layer protocol");
1999MODULE_LICENSE("GPL");
2000MODULE_ALIAS_NETPROTO(PF_AX25);
2001
2002static void __exit ax25_exit(void)
2003{
2004	proc_net_remove("ax25_route");
2005	proc_net_remove("ax25");
2006	proc_net_remove("ax25_calls");
2007	ax25_rt_free();
2008	ax25_uid_free();
2009	ax25_dev_free();
2010
2011	ax25_unregister_sysctl();
2012	unregister_netdevice_notifier(&ax25_dev_notifier);
2013
2014	dev_remove_pack(&ax25_packet_type);
2015
2016	sock_unregister(PF_AX25);
2017	proto_unregister(&ax25_proto);
2018}
2019module_exit(ax25_exit);
2020