1/* 2 * DECnet An implementation of the DECnet protocol suite for the LINUX 3 * operating system. DECnet is implemented using the BSD Socket 4 * interface as the means of communication with the user level. 5 * 6 * DECnet Network Services Protocol (Input) 7 * 8 * Author: Eduardo Marcelo Serrat <emserrat@geocities.com> 9 * 10 * Changes: 11 * 12 * Steve Whitehouse: Split into dn_nsp_in.c and dn_nsp_out.c from 13 * original dn_nsp.c. 14 * Steve Whitehouse: Updated to work with my new routing architecture. 15 * Steve Whitehouse: Add changes from Eduardo Serrat's patches. 16 * Steve Whitehouse: Put all ack handling code in a common routine. 17 * Steve Whitehouse: Put other common bits into dn_nsp_rx() 18 * Steve Whitehouse: More checks on skb->len to catch bogus packets 19 * Fixed various race conditions and possible nasties. 20 * Steve Whitehouse: Now handles returned conninit frames. 21 * David S. Miller: New socket locking 22 * Steve Whitehouse: Fixed lockup when socket filtering was enabled. 23 * Paul Koning: Fix to push CC sockets into RUN when acks are 24 * received. 25 * Steve Whitehouse: 26 * Patrick Caulfield: Checking conninits for correctness & sending of error 27 * responses. 28 * Steve Whitehouse: Added backlog congestion level return codes. 29 * Patrick Caulfield: 30 * Steve Whitehouse: Added flow control support (outbound) 31 * Steve Whitehouse: Prepare for nonlinear skbs 32 */ 33 34/****************************************************************************** 35 (c) 1995-1998 E.M. Serrat emserrat@geocities.com 36 37 This program is free software; you can redistribute it and/or modify 38 it under the terms of the GNU General Public License as published by 39 the Free Software Foundation; either version 2 of the License, or 40 any later version. 41 42 This program is distributed in the hope that it will be useful, 43 but WITHOUT ANY WARRANTY; without even the implied warranty of 44 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 45 GNU General Public License for more details. 46*******************************************************************************/ 47 48#include <linux/errno.h> 49#include <linux/types.h> 50#include <linux/socket.h> 51#include <linux/in.h> 52#include <linux/kernel.h> 53#include <linux/timer.h> 54#include <linux/string.h> 55#include <linux/sockios.h> 56#include <linux/net.h> 57#include <linux/netdevice.h> 58#include <linux/inet.h> 59#include <linux/route.h> 60#include <net/sock.h> 61#include <net/tcp_states.h> 62#include <asm/system.h> 63#include <linux/fcntl.h> 64#include <linux/mm.h> 65#include <linux/termios.h> 66#include <linux/interrupt.h> 67#include <linux/proc_fs.h> 68#include <linux/stat.h> 69#include <linux/init.h> 70#include <linux/poll.h> 71#include <linux/netfilter_decnet.h> 72#include <net/neighbour.h> 73#include <net/dst.h> 74#include <net/dn.h> 75#include <net/dn_nsp.h> 76#include <net/dn_dev.h> 77#include <net/dn_route.h> 78 79extern int decnet_log_martians; 80 81static void dn_log_martian(struct sk_buff *skb, const char *msg) 82{ 83 if (decnet_log_martians && net_ratelimit()) { 84 char *devname = skb->dev ? skb->dev->name : "???"; 85 struct dn_skb_cb *cb = DN_SKB_CB(skb); 86 printk(KERN_INFO "DECnet: Martian packet (%s) dev=%s src=0x%04hx dst=0x%04hx srcport=0x%04hx dstport=0x%04hx\n", msg, devname, dn_ntohs(cb->src), dn_ntohs(cb->dst), dn_ntohs(cb->src_port), dn_ntohs(cb->dst_port)); 87 } 88} 89 90/* 91 * For this function we've flipped the cross-subchannel bit 92 * if the message is an otherdata or linkservice message. Thus 93 * we can use it to work out what to update. 94 */ 95static void dn_ack(struct sock *sk, struct sk_buff *skb, unsigned short ack) 96{ 97 struct dn_scp *scp = DN_SK(sk); 98 unsigned short type = ((ack >> 12) & 0x0003); 99 int wakeup = 0; 100 101 switch(type) { 102 case 0: /* ACK - Data */ 103 if (dn_after(ack, scp->ackrcv_dat)) { 104 scp->ackrcv_dat = ack & 0x0fff; 105 wakeup |= dn_nsp_check_xmit_queue(sk, skb, &scp->data_xmit_queue, ack); 106 } 107 break; 108 case 1: /* NAK - Data */ 109 break; 110 case 2: /* ACK - OtherData */ 111 if (dn_after(ack, scp->ackrcv_oth)) { 112 scp->ackrcv_oth = ack & 0x0fff; 113 wakeup |= dn_nsp_check_xmit_queue(sk, skb, &scp->other_xmit_queue, ack); 114 } 115 break; 116 case 3: /* NAK - OtherData */ 117 break; 118 } 119 120 if (wakeup && !sock_flag(sk, SOCK_DEAD)) 121 sk->sk_state_change(sk); 122} 123 124/* 125 * This function is a universal ack processor. 126 */ 127static int dn_process_ack(struct sock *sk, struct sk_buff *skb, int oth) 128{ 129 __le16 *ptr = (__le16 *)skb->data; 130 int len = 0; 131 unsigned short ack; 132 133 if (skb->len < 2) 134 return len; 135 136 if ((ack = dn_ntohs(*ptr)) & 0x8000) { 137 skb_pull(skb, 2); 138 ptr++; 139 len += 2; 140 if ((ack & 0x4000) == 0) { 141 if (oth) 142 ack ^= 0x2000; 143 dn_ack(sk, skb, ack); 144 } 145 } 146 147 if (skb->len < 2) 148 return len; 149 150 if ((ack = dn_ntohs(*ptr)) & 0x8000) { 151 skb_pull(skb, 2); 152 len += 2; 153 if ((ack & 0x4000) == 0) { 154 if (oth) 155 ack ^= 0x2000; 156 dn_ack(sk, skb, ack); 157 } 158 } 159 160 return len; 161} 162 163 164/** 165 * dn_check_idf - Check an image data field format is correct. 166 * @pptr: Pointer to pointer to image data 167 * @len: Pointer to length of image data 168 * @max: The maximum allowed length of the data in the image data field 169 * @follow_on: Check that this many bytes exist beyond the end of the image data 170 * 171 * Returns: 0 if ok, -1 on error 172 */ 173static inline int dn_check_idf(unsigned char **pptr, int *len, unsigned char max, unsigned char follow_on) 174{ 175 unsigned char *ptr = *pptr; 176 unsigned char flen = *ptr++; 177 178 (*len)--; 179 if (flen > max) 180 return -1; 181 if ((flen + follow_on) > *len) 182 return -1; 183 184 *len -= flen; 185 *pptr = ptr + flen; 186 return 0; 187} 188 189/* 190 * Table of reason codes to pass back to node which sent us a badly 191 * formed message, plus text messages for the log. A zero entry in 192 * the reason field means "don't reply" otherwise a disc init is sent with 193 * the specified reason code. 194 */ 195static struct { 196 unsigned short reason; 197 const char *text; 198} ci_err_table[] = { 199 { 0, "CI: Truncated message" }, 200 { NSP_REASON_ID, "CI: Destination username error" }, 201 { NSP_REASON_ID, "CI: Destination username type" }, 202 { NSP_REASON_US, "CI: Source username error" }, 203 { 0, "CI: Truncated at menuver" }, 204 { 0, "CI: Truncated before access or user data" }, 205 { NSP_REASON_IO, "CI: Access data format error" }, 206 { NSP_REASON_IO, "CI: User data format error" } 207}; 208 209/* 210 * This function uses a slightly different lookup method 211 * to find its sockets, since it searches on object name/number 212 * rather than port numbers. Various tests are done to ensure that 213 * the incoming data is in the correct format before it is queued to 214 * a socket. 215 */ 216static struct sock *dn_find_listener(struct sk_buff *skb, unsigned short *reason) 217{ 218 struct dn_skb_cb *cb = DN_SKB_CB(skb); 219 struct nsp_conn_init_msg *msg = (struct nsp_conn_init_msg *)skb->data; 220 struct sockaddr_dn dstaddr; 221 struct sockaddr_dn srcaddr; 222 unsigned char type = 0; 223 int dstlen; 224 int srclen; 225 unsigned char *ptr; 226 int len; 227 int err = 0; 228 unsigned char menuver; 229 230 memset(&dstaddr, 0, sizeof(struct sockaddr_dn)); 231 memset(&srcaddr, 0, sizeof(struct sockaddr_dn)); 232 233 /* 234 * 1. Decode & remove message header 235 */ 236 cb->src_port = msg->srcaddr; 237 cb->dst_port = msg->dstaddr; 238 cb->services = msg->services; 239 cb->info = msg->info; 240 cb->segsize = dn_ntohs(msg->segsize); 241 242 if (!pskb_may_pull(skb, sizeof(*msg))) 243 goto err_out; 244 245 skb_pull(skb, sizeof(*msg)); 246 247 len = skb->len; 248 ptr = skb->data; 249 250 /* 251 * 2. Check destination end username format 252 */ 253 dstlen = dn_username2sockaddr(ptr, len, &dstaddr, &type); 254 err++; 255 if (dstlen < 0) 256 goto err_out; 257 258 err++; 259 if (type > 1) 260 goto err_out; 261 262 len -= dstlen; 263 ptr += dstlen; 264 265 /* 266 * 3. Check source end username format 267 */ 268 srclen = dn_username2sockaddr(ptr, len, &srcaddr, &type); 269 err++; 270 if (srclen < 0) 271 goto err_out; 272 273 len -= srclen; 274 ptr += srclen; 275 err++; 276 if (len < 1) 277 goto err_out; 278 279 menuver = *ptr; 280 ptr++; 281 len--; 282 283 /* 284 * 4. Check that optional data actually exists if menuver says it does 285 */ 286 err++; 287 if ((menuver & (DN_MENUVER_ACC | DN_MENUVER_USR)) && (len < 1)) 288 goto err_out; 289 290 /* 291 * 5. Check optional access data format 292 */ 293 err++; 294 if (menuver & DN_MENUVER_ACC) { 295 if (dn_check_idf(&ptr, &len, 39, 1)) 296 goto err_out; 297 if (dn_check_idf(&ptr, &len, 39, 1)) 298 goto err_out; 299 if (dn_check_idf(&ptr, &len, 39, (menuver & DN_MENUVER_USR) ? 1 : 0)) 300 goto err_out; 301 } 302 303 /* 304 * 6. Check optional user data format 305 */ 306 err++; 307 if (menuver & DN_MENUVER_USR) { 308 if (dn_check_idf(&ptr, &len, 16, 0)) 309 goto err_out; 310 } 311 312 /* 313 * 7. Look up socket based on destination end username 314 */ 315 return dn_sklist_find_listener(&dstaddr); 316err_out: 317 dn_log_martian(skb, ci_err_table[err].text); 318 *reason = ci_err_table[err].reason; 319 return NULL; 320} 321 322 323static void dn_nsp_conn_init(struct sock *sk, struct sk_buff *skb) 324{ 325 if (sk_acceptq_is_full(sk)) { 326 kfree_skb(skb); 327 return; 328 } 329 330 sk->sk_ack_backlog++; 331 skb_queue_tail(&sk->sk_receive_queue, skb); 332 sk->sk_state_change(sk); 333} 334 335static void dn_nsp_conn_conf(struct sock *sk, struct sk_buff *skb) 336{ 337 struct dn_skb_cb *cb = DN_SKB_CB(skb); 338 struct dn_scp *scp = DN_SK(sk); 339 unsigned char *ptr; 340 341 if (skb->len < 4) 342 goto out; 343 344 ptr = skb->data; 345 cb->services = *ptr++; 346 cb->info = *ptr++; 347 cb->segsize = dn_ntohs(*(__le16 *)ptr); 348 349 if ((scp->state == DN_CI) || (scp->state == DN_CD)) { 350 scp->persist = 0; 351 scp->addrrem = cb->src_port; 352 sk->sk_state = TCP_ESTABLISHED; 353 scp->state = DN_RUN; 354 scp->services_rem = cb->services; 355 scp->info_rem = cb->info; 356 scp->segsize_rem = cb->segsize; 357 358 if ((scp->services_rem & NSP_FC_MASK) == NSP_FC_NONE) 359 scp->max_window = decnet_no_fc_max_cwnd; 360 361 if (skb->len > 0) { 362 u16 dlen = *skb->data; 363 if ((dlen <= 16) && (dlen <= skb->len)) { 364 scp->conndata_in.opt_optl = dn_htons(dlen); 365 skb_copy_from_linear_data_offset(skb, 1, 366 scp->conndata_in.opt_data, dlen); 367 } 368 } 369 dn_nsp_send_link(sk, DN_NOCHANGE, 0); 370 if (!sock_flag(sk, SOCK_DEAD)) 371 sk->sk_state_change(sk); 372 } 373 374out: 375 kfree_skb(skb); 376} 377 378static void dn_nsp_conn_ack(struct sock *sk, struct sk_buff *skb) 379{ 380 struct dn_scp *scp = DN_SK(sk); 381 382 if (scp->state == DN_CI) { 383 scp->state = DN_CD; 384 scp->persist = 0; 385 } 386 387 kfree_skb(skb); 388} 389 390static void dn_nsp_disc_init(struct sock *sk, struct sk_buff *skb) 391{ 392 struct dn_scp *scp = DN_SK(sk); 393 struct dn_skb_cb *cb = DN_SKB_CB(skb); 394 unsigned short reason; 395 396 if (skb->len < 2) 397 goto out; 398 399 reason = dn_ntohs(*(__le16 *)skb->data); 400 skb_pull(skb, 2); 401 402 scp->discdata_in.opt_status = dn_htons(reason); 403 scp->discdata_in.opt_optl = 0; 404 memset(scp->discdata_in.opt_data, 0, 16); 405 406 if (skb->len > 0) { 407 u16 dlen = *skb->data; 408 if ((dlen <= 16) && (dlen <= skb->len)) { 409 scp->discdata_in.opt_optl = dn_htons(dlen); 410 skb_copy_from_linear_data_offset(skb, 1, scp->discdata_in.opt_data, dlen); 411 } 412 } 413 414 scp->addrrem = cb->src_port; 415 sk->sk_state = TCP_CLOSE; 416 417 switch(scp->state) { 418 case DN_CI: 419 case DN_CD: 420 scp->state = DN_RJ; 421 sk->sk_err = ECONNREFUSED; 422 break; 423 case DN_RUN: 424 sk->sk_shutdown |= SHUTDOWN_MASK; 425 scp->state = DN_DN; 426 break; 427 case DN_DI: 428 scp->state = DN_DIC; 429 break; 430 } 431 432 if (!sock_flag(sk, SOCK_DEAD)) { 433 if (sk->sk_socket->state != SS_UNCONNECTED) 434 sk->sk_socket->state = SS_DISCONNECTING; 435 sk->sk_state_change(sk); 436 } 437 438 /* 439 * It appears that its possible for remote machines to send disc 440 * init messages with no port identifier if we are in the CI and 441 * possibly also the CD state. Obviously we shouldn't reply with 442 * a message if we don't know what the end point is. 443 */ 444 if (scp->addrrem) { 445 dn_nsp_send_disc(sk, NSP_DISCCONF, NSP_REASON_DC, GFP_ATOMIC); 446 } 447 scp->persist_fxn = dn_destroy_timer; 448 scp->persist = dn_nsp_persist(sk); 449 450out: 451 kfree_skb(skb); 452} 453 454/* 455 * disc_conf messages are also called no_resources or no_link 456 * messages depending upon the "reason" field. 457 */ 458static void dn_nsp_disc_conf(struct sock *sk, struct sk_buff *skb) 459{ 460 struct dn_scp *scp = DN_SK(sk); 461 unsigned short reason; 462 463 if (skb->len != 2) 464 goto out; 465 466 reason = dn_ntohs(*(__le16 *)skb->data); 467 468 sk->sk_state = TCP_CLOSE; 469 470 switch(scp->state) { 471 case DN_CI: 472 scp->state = DN_NR; 473 break; 474 case DN_DR: 475 if (reason == NSP_REASON_DC) 476 scp->state = DN_DRC; 477 if (reason == NSP_REASON_NL) 478 scp->state = DN_CN; 479 break; 480 case DN_DI: 481 scp->state = DN_DIC; 482 break; 483 case DN_RUN: 484 sk->sk_shutdown |= SHUTDOWN_MASK; 485 case DN_CC: 486 scp->state = DN_CN; 487 } 488 489 if (!sock_flag(sk, SOCK_DEAD)) { 490 if (sk->sk_socket->state != SS_UNCONNECTED) 491 sk->sk_socket->state = SS_DISCONNECTING; 492 sk->sk_state_change(sk); 493 } 494 495 scp->persist_fxn = dn_destroy_timer; 496 scp->persist = dn_nsp_persist(sk); 497 498out: 499 kfree_skb(skb); 500} 501 502static void dn_nsp_linkservice(struct sock *sk, struct sk_buff *skb) 503{ 504 struct dn_scp *scp = DN_SK(sk); 505 unsigned short segnum; 506 unsigned char lsflags; 507 signed char fcval; 508 int wake_up = 0; 509 char *ptr = skb->data; 510 unsigned char fctype = scp->services_rem & NSP_FC_MASK; 511 512 if (skb->len != 4) 513 goto out; 514 515 segnum = dn_ntohs(*(__le16 *)ptr); 516 ptr += 2; 517 lsflags = *(unsigned char *)ptr++; 518 fcval = *ptr; 519 520 /* 521 * Here we ignore erronous packets which should really 522 * should cause a connection abort. It is not critical 523 * for now though. 524 */ 525 if (lsflags & 0xf8) 526 goto out; 527 528 if (seq_next(scp->numoth_rcv, segnum)) { 529 seq_add(&scp->numoth_rcv, 1); 530 switch(lsflags & 0x04) { /* FCVAL INT */ 531 case 0x00: /* Normal Request */ 532 switch(lsflags & 0x03) { /* FCVAL MOD */ 533 case 0x00: /* Request count */ 534 if (fcval < 0) { 535 unsigned char p_fcval = -fcval; 536 if ((scp->flowrem_dat > p_fcval) && 537 (fctype == NSP_FC_SCMC)) { 538 scp->flowrem_dat -= p_fcval; 539 } 540 } else if (fcval > 0) { 541 scp->flowrem_dat += fcval; 542 wake_up = 1; 543 } 544 break; 545 case 0x01: /* Stop outgoing data */ 546 scp->flowrem_sw = DN_DONTSEND; 547 break; 548 case 0x02: /* Ok to start again */ 549 scp->flowrem_sw = DN_SEND; 550 dn_nsp_output(sk); 551 wake_up = 1; 552 } 553 break; 554 case 0x04: /* Interrupt Request */ 555 if (fcval > 0) { 556 scp->flowrem_oth += fcval; 557 wake_up = 1; 558 } 559 break; 560 } 561 if (wake_up && !sock_flag(sk, SOCK_DEAD)) 562 sk->sk_state_change(sk); 563 } 564 565 dn_nsp_send_oth_ack(sk); 566 567out: 568 kfree_skb(skb); 569} 570 571/* 572 * Copy of sock_queue_rcv_skb (from sock.h) without 573 * bh_lock_sock() (its already held when this is called) which 574 * also allows data and other data to be queued to a socket. 575 */ 576static __inline__ int dn_queue_skb(struct sock *sk, struct sk_buff *skb, int sig, struct sk_buff_head *queue) 577{ 578 int err; 579 580 /* Cast skb->rcvbuf to unsigned... It's pointless, but reduces 581 number of warnings when compiling with -W --ANK 582 */ 583 if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >= 584 (unsigned)sk->sk_rcvbuf) { 585 err = -ENOMEM; 586 goto out; 587 } 588 589 err = sk_filter(sk, skb); 590 if (err) 591 goto out; 592 593 skb_set_owner_r(skb, sk); 594 skb_queue_tail(queue, skb); 595 596 /* This code only runs from BH or BH protected context. 597 * Therefore the plain read_lock is ok here. -DaveM 598 */ 599 read_lock(&sk->sk_callback_lock); 600 if (!sock_flag(sk, SOCK_DEAD)) { 601 struct socket *sock = sk->sk_socket; 602 wake_up_interruptible(sk->sk_sleep); 603 if (sock && sock->fasync_list && 604 !test_bit(SOCK_ASYNC_WAITDATA, &sock->flags)) 605 __kill_fasync(sock->fasync_list, sig, 606 (sig == SIGURG) ? POLL_PRI : POLL_IN); 607 } 608 read_unlock(&sk->sk_callback_lock); 609out: 610 return err; 611} 612 613static void dn_nsp_otherdata(struct sock *sk, struct sk_buff *skb) 614{ 615 struct dn_scp *scp = DN_SK(sk); 616 unsigned short segnum; 617 struct dn_skb_cb *cb = DN_SKB_CB(skb); 618 int queued = 0; 619 620 if (skb->len < 2) 621 goto out; 622 623 cb->segnum = segnum = dn_ntohs(*(__le16 *)skb->data); 624 skb_pull(skb, 2); 625 626 if (seq_next(scp->numoth_rcv, segnum)) { 627 628 if (dn_queue_skb(sk, skb, SIGURG, &scp->other_receive_queue) == 0) { 629 seq_add(&scp->numoth_rcv, 1); 630 scp->other_report = 0; 631 queued = 1; 632 } 633 } 634 635 dn_nsp_send_oth_ack(sk); 636out: 637 if (!queued) 638 kfree_skb(skb); 639} 640 641static void dn_nsp_data(struct sock *sk, struct sk_buff *skb) 642{ 643 int queued = 0; 644 unsigned short segnum; 645 struct dn_skb_cb *cb = DN_SKB_CB(skb); 646 struct dn_scp *scp = DN_SK(sk); 647 648 if (skb->len < 2) 649 goto out; 650 651 cb->segnum = segnum = dn_ntohs(*(__le16 *)skb->data); 652 skb_pull(skb, 2); 653 654 if (seq_next(scp->numdat_rcv, segnum)) { 655 if (dn_queue_skb(sk, skb, SIGIO, &sk->sk_receive_queue) == 0) { 656 seq_add(&scp->numdat_rcv, 1); 657 queued = 1; 658 } 659 660 if ((scp->flowloc_sw == DN_SEND) && dn_congested(sk)) { 661 scp->flowloc_sw = DN_DONTSEND; 662 dn_nsp_send_link(sk, DN_DONTSEND, 0); 663 } 664 } 665 666 dn_nsp_send_data_ack(sk); 667out: 668 if (!queued) 669 kfree_skb(skb); 670} 671 672/* 673 * If one of our conninit messages is returned, this function 674 * deals with it. It puts the socket into the NO_COMMUNICATION 675 * state. 676 */ 677static void dn_returned_conn_init(struct sock *sk, struct sk_buff *skb) 678{ 679 struct dn_scp *scp = DN_SK(sk); 680 681 if (scp->state == DN_CI) { 682 scp->state = DN_NC; 683 sk->sk_state = TCP_CLOSE; 684 if (!sock_flag(sk, SOCK_DEAD)) 685 sk->sk_state_change(sk); 686 } 687 688 kfree_skb(skb); 689} 690 691static int dn_nsp_no_socket(struct sk_buff *skb, unsigned short reason) 692{ 693 struct dn_skb_cb *cb = DN_SKB_CB(skb); 694 int ret = NET_RX_DROP; 695 696 /* Must not reply to returned packets */ 697 if (cb->rt_flags & DN_RT_F_RTS) 698 goto out; 699 700 if ((reason != NSP_REASON_OK) && ((cb->nsp_flags & 0x0c) == 0x08)) { 701 switch(cb->nsp_flags & 0x70) { 702 case 0x10: 703 case 0x60: /* (Retransmitted) Connect Init */ 704 dn_nsp_return_disc(skb, NSP_DISCINIT, reason); 705 ret = NET_RX_SUCCESS; 706 break; 707 case 0x20: /* Connect Confirm */ 708 dn_nsp_return_disc(skb, NSP_DISCCONF, reason); 709 ret = NET_RX_SUCCESS; 710 break; 711 } 712 } 713 714out: 715 kfree_skb(skb); 716 return ret; 717} 718 719static int dn_nsp_rx_packet(struct sk_buff *skb) 720{ 721 struct dn_skb_cb *cb = DN_SKB_CB(skb); 722 struct sock *sk = NULL; 723 unsigned char *ptr = (unsigned char *)skb->data; 724 unsigned short reason = NSP_REASON_NL; 725 726 if (!pskb_may_pull(skb, 2)) 727 goto free_out; 728 729 skb_reset_transport_header(skb); 730 cb->nsp_flags = *ptr++; 731 732 if (decnet_debug_level & 2) 733 printk(KERN_DEBUG "dn_nsp_rx: Message type 0x%02x\n", (int)cb->nsp_flags); 734 735 if (cb->nsp_flags & 0x83) 736 goto free_out; 737 738 /* 739 * Filter out conninits and useless packet types 740 */ 741 if ((cb->nsp_flags & 0x0c) == 0x08) { 742 switch(cb->nsp_flags & 0x70) { 743 case 0x00: /* NOP */ 744 case 0x70: /* Reserved */ 745 case 0x50: /* Reserved, Phase II node init */ 746 goto free_out; 747 case 0x10: 748 case 0x60: 749 if (unlikely(cb->rt_flags & DN_RT_F_RTS)) 750 goto free_out; 751 sk = dn_find_listener(skb, &reason); 752 goto got_it; 753 } 754 } 755 756 if (!pskb_may_pull(skb, 3)) 757 goto free_out; 758 759 /* 760 * Grab the destination address. 761 */ 762 cb->dst_port = *(__le16 *)ptr; 763 cb->src_port = 0; 764 ptr += 2; 765 766 /* 767 * If not a connack, grab the source address too. 768 */ 769 if (pskb_may_pull(skb, 5)) { 770 cb->src_port = *(__le16 *)ptr; 771 ptr += 2; 772 skb_pull(skb, 5); 773 } 774 775 /* 776 * Returned packets... 777 * Swap src & dst and look up in the normal way. 778 */ 779 if (unlikely(cb->rt_flags & DN_RT_F_RTS)) { 780 __le16 tmp = cb->dst_port; 781 cb->dst_port = cb->src_port; 782 cb->src_port = tmp; 783 tmp = cb->dst; 784 cb->dst = cb->src; 785 cb->src = tmp; 786 } 787 788 /* 789 * Find the socket to which this skb is destined. 790 */ 791 sk = dn_find_by_skb(skb); 792got_it: 793 if (sk != NULL) { 794 struct dn_scp *scp = DN_SK(sk); 795 796 /* Reset backoff */ 797 scp->nsp_rxtshift = 0; 798 799 /* 800 * We linearize everything except data segments here. 801 */ 802 if (cb->nsp_flags & ~0x60) { 803 if (unlikely(skb_linearize(skb))) 804 goto free_out; 805 } 806 807 return sk_receive_skb(sk, skb, 0); 808 } 809 810 return dn_nsp_no_socket(skb, reason); 811 812free_out: 813 kfree_skb(skb); 814 return NET_RX_DROP; 815} 816 817int dn_nsp_rx(struct sk_buff *skb) 818{ 819 return NF_HOOK(PF_DECnet, NF_DN_LOCAL_IN, skb, skb->dev, NULL, dn_nsp_rx_packet); 820} 821 822/* 823 * This is the main receive routine for sockets. It is called 824 * from the above when the socket is not busy, and also from 825 * sock_release() when there is a backlog queued up. 826 */ 827int dn_nsp_backlog_rcv(struct sock *sk, struct sk_buff *skb) 828{ 829 struct dn_scp *scp = DN_SK(sk); 830 struct dn_skb_cb *cb = DN_SKB_CB(skb); 831 832 if (cb->rt_flags & DN_RT_F_RTS) { 833 if (cb->nsp_flags == 0x18 || cb->nsp_flags == 0x68) 834 dn_returned_conn_init(sk, skb); 835 else 836 kfree_skb(skb); 837 return NET_RX_SUCCESS; 838 } 839 840 /* 841 * Control packet. 842 */ 843 if ((cb->nsp_flags & 0x0c) == 0x08) { 844 switch(cb->nsp_flags & 0x70) { 845 case 0x10: 846 case 0x60: 847 dn_nsp_conn_init(sk, skb); 848 break; 849 case 0x20: 850 dn_nsp_conn_conf(sk, skb); 851 break; 852 case 0x30: 853 dn_nsp_disc_init(sk, skb); 854 break; 855 case 0x40: 856 dn_nsp_disc_conf(sk, skb); 857 break; 858 } 859 860 } else if (cb->nsp_flags == 0x24) { 861 /* 862 * Special for connacks, 'cos they don't have 863 * ack data or ack otherdata info. 864 */ 865 dn_nsp_conn_ack(sk, skb); 866 } else { 867 int other = 1; 868 869 /* both data and ack frames can kick a CC socket into RUN */ 870 if ((scp->state == DN_CC) && !sock_flag(sk, SOCK_DEAD)) { 871 scp->state = DN_RUN; 872 sk->sk_state = TCP_ESTABLISHED; 873 sk->sk_state_change(sk); 874 } 875 876 if ((cb->nsp_flags & 0x1c) == 0) 877 other = 0; 878 if (cb->nsp_flags == 0x04) 879 other = 0; 880 881 /* 882 * Read out ack data here, this applies equally 883 * to data, other data, link serivce and both 884 * ack data and ack otherdata. 885 */ 886 dn_process_ack(sk, skb, other); 887 888 /* 889 * If we've some sort of data here then call a 890 * suitable routine for dealing with it, otherwise 891 * the packet is an ack and can be discarded. 892 */ 893 if ((cb->nsp_flags & 0x0c) == 0) { 894 895 if (scp->state != DN_RUN) 896 goto free_out; 897 898 switch(cb->nsp_flags) { 899 case 0x10: /* LS */ 900 dn_nsp_linkservice(sk, skb); 901 break; 902 case 0x30: /* OD */ 903 dn_nsp_otherdata(sk, skb); 904 break; 905 default: 906 dn_nsp_data(sk, skb); 907 } 908 909 } else { /* Ack, chuck it out here */ 910free_out: 911 kfree_skb(skb); 912 } 913 } 914 915 return NET_RX_SUCCESS; 916} 917