pppoe.c 27 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /** -*- linux-c -*- ***********************************************************
  3. * Linux PPP over Ethernet (PPPoX/PPPoE) Sockets
  4. *
  5. * PPPoX --- Generic PPP encapsulation socket family
  6. * PPPoE --- PPP over Ethernet (RFC 2516)
  7. *
  8. * Version: 0.7.0
  9. *
  10. * 070228 : Fix to allow multiple sessions with same remote MAC and same
  11. * session id by including the local device ifindex in the
  12. * tuple identifying a session. This also ensures packets can't
  13. * be injected into a session from interfaces other than the one
  14. * specified by userspace. Florian Zumbiehl <florz@florz.de>
  15. * (Oh, BTW, this one is YYMMDD, in case you were wondering ...)
  16. * 220102 : Fix module use count on failure in pppoe_create, pppox_sk -acme
  17. * 030700 : Fixed connect logic to allow for disconnect.
  18. * 270700 : Fixed potential SMP problems; we must protect against
  19. * simultaneous invocation of ppp_input
  20. * and ppp_unregister_channel.
  21. * 040800 : Respect reference count mechanisms on net-devices.
  22. * 200800 : fix kfree(skb) in pppoe_rcv (acme)
  23. * Module reference count is decremented in the right spot now,
  24. * guards against sock_put not actually freeing the sk
  25. * in pppoe_release.
  26. * 051000 : Initialization cleanup.
  27. * 111100 : Fix recvmsg.
  28. * 050101 : Fix PADT procesing.
  29. * 140501 : Use pppoe_rcv_core to handle all backlog. (Alexey)
  30. * 170701 : Do not lock_sock with rwlock held. (DaveM)
  31. * Ignore discovery frames if user has socket
  32. * locked. (DaveM)
  33. * Ignore return value of dev_queue_xmit in __pppoe_xmit
  34. * or else we may kfree an SKB twice. (DaveM)
  35. * 190701 : When doing copies of skb's in __pppoe_xmit, always delete
  36. * the original skb that was passed in on success, never on
  37. * failure. Delete the copy of the skb on failure to avoid
  38. * a memory leak.
  39. * 081001 : Misc. cleanup (licence string, non-blocking, prevent
  40. * reference of device on close).
  41. * 121301 : New ppp channels interface; cannot unregister a channel
  42. * from interrupts. Thus, we mark the socket as a ZOMBIE
  43. * and do the unregistration later.
  44. * 081002 : seq_file support for proc stuff -acme
  45. * 111602 : Merge all 2.4 fixes into 2.5/2.6 tree. Label 2.5/2.6
  46. * as version 0.7. Spacing cleanup.
  47. * Author: Michal Ostrowski <mostrows@speakeasy.net>
  48. * Contributors:
  49. * Arnaldo Carvalho de Melo <acme@conectiva.com.br>
  50. * David S. Miller (davem@redhat.com)
  51. *
  52. * License:
  53. */
  54. #include <linux/string.h>
  55. #include <linux/module.h>
  56. #include <linux/kernel.h>
  57. #include <linux/slab.h>
  58. #include <linux/errno.h>
  59. #include <linux/netdevice.h>
  60. #include <linux/net.h>
  61. #include <linux/inetdevice.h>
  62. #include <linux/etherdevice.h>
  63. #include <linux/skbuff.h>
  64. #include <linux/init.h>
  65. #include <linux/if_ether.h>
  66. #include <linux/if_pppox.h>
  67. #include <linux/ppp_channel.h>
  68. #include <linux/ppp_defs.h>
  69. #include <linux/ppp-ioctl.h>
  70. #include <linux/notifier.h>
  71. #include <linux/file.h>
  72. #include <linux/proc_fs.h>
  73. #include <linux/seq_file.h>
  74. #include <linux/nsproxy.h>
  75. #include <net/net_namespace.h>
  76. #include <net/netns/generic.h>
  77. #include <net/sock.h>
  78. #include <linux/uaccess.h>
  79. #define PPPOE_HASH_BITS 4
  80. #define PPPOE_HASH_SIZE (1 << PPPOE_HASH_BITS)
  81. #define PPPOE_HASH_MASK (PPPOE_HASH_SIZE - 1)
  82. static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb);
  83. static const struct proto_ops pppoe_ops;
  84. static const struct ppp_channel_ops pppoe_chan_ops;
  85. /* per-net private data for this module */
  86. static unsigned int pppoe_net_id __read_mostly;
  87. struct pppoe_net {
  88. /*
  89. * we could use _single_ hash table for all
  90. * nets by injecting net id into the hash but
  91. * it would increase hash chains and add
  92. * a few additional math comparations messy
  93. * as well, moreover in case of SMP less locking
  94. * controversy here
  95. */
  96. struct pppox_sock *hash_table[PPPOE_HASH_SIZE];
  97. rwlock_t hash_lock;
  98. };
  99. /*
  100. * PPPoE could be in the following stages:
  101. * 1) Discovery stage (to obtain remote MAC and Session ID)
  102. * 2) Session stage (MAC and SID are known)
  103. *
  104. * Ethernet frames have a special tag for this but
  105. * we use simpler approach based on session id
  106. */
  107. static inline bool stage_session(__be16 sid)
  108. {
  109. return sid != 0;
  110. }
  111. static inline struct pppoe_net *pppoe_pernet(struct net *net)
  112. {
  113. return net_generic(net, pppoe_net_id);
  114. }
  115. static inline int cmp_2_addr(struct pppoe_addr *a, struct pppoe_addr *b)
  116. {
  117. return a->sid == b->sid && ether_addr_equal(a->remote, b->remote);
  118. }
  119. static inline int cmp_addr(struct pppoe_addr *a, __be16 sid, char *addr)
  120. {
  121. return a->sid == sid && ether_addr_equal(a->remote, addr);
  122. }
  123. #if 8 % PPPOE_HASH_BITS
  124. #error 8 must be a multiple of PPPOE_HASH_BITS
  125. #endif
  126. static int hash_item(__be16 sid, unsigned char *addr)
  127. {
  128. unsigned char hash = 0;
  129. unsigned int i;
  130. for (i = 0; i < ETH_ALEN; i++)
  131. hash ^= addr[i];
  132. for (i = 0; i < sizeof(sid_t) * 8; i += 8)
  133. hash ^= (__force __u32)sid >> i;
  134. for (i = 8; (i >>= 1) >= PPPOE_HASH_BITS;)
  135. hash ^= hash >> i;
  136. return hash & PPPOE_HASH_MASK;
  137. }
  138. /**********************************************************************
  139. *
  140. * Set/get/delete/rehash items (internal versions)
  141. *
  142. **********************************************************************/
  143. static struct pppox_sock *__get_item(struct pppoe_net *pn, __be16 sid,
  144. unsigned char *addr, int ifindex)
  145. {
  146. int hash = hash_item(sid, addr);
  147. struct pppox_sock *ret;
  148. ret = pn->hash_table[hash];
  149. while (ret) {
  150. if (cmp_addr(&ret->pppoe_pa, sid, addr) &&
  151. ret->pppoe_ifindex == ifindex)
  152. return ret;
  153. ret = ret->next;
  154. }
  155. return NULL;
  156. }
  157. static int __set_item(struct pppoe_net *pn, struct pppox_sock *po)
  158. {
  159. int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
  160. struct pppox_sock *ret;
  161. ret = pn->hash_table[hash];
  162. while (ret) {
  163. if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa) &&
  164. ret->pppoe_ifindex == po->pppoe_ifindex)
  165. return -EALREADY;
  166. ret = ret->next;
  167. }
  168. po->next = pn->hash_table[hash];
  169. pn->hash_table[hash] = po;
  170. return 0;
  171. }
  172. static void __delete_item(struct pppoe_net *pn, __be16 sid,
  173. char *addr, int ifindex)
  174. {
  175. int hash = hash_item(sid, addr);
  176. struct pppox_sock *ret, **src;
  177. ret = pn->hash_table[hash];
  178. src = &pn->hash_table[hash];
  179. while (ret) {
  180. if (cmp_addr(&ret->pppoe_pa, sid, addr) &&
  181. ret->pppoe_ifindex == ifindex) {
  182. *src = ret->next;
  183. break;
  184. }
  185. src = &ret->next;
  186. ret = ret->next;
  187. }
  188. }
  189. /**********************************************************************
  190. *
  191. * Set/get/delete/rehash items
  192. *
  193. **********************************************************************/
  194. static inline struct pppox_sock *get_item(struct pppoe_net *pn, __be16 sid,
  195. unsigned char *addr, int ifindex)
  196. {
  197. struct pppox_sock *po;
  198. read_lock_bh(&pn->hash_lock);
  199. po = __get_item(pn, sid, addr, ifindex);
  200. if (po)
  201. sock_hold(sk_pppox(po));
  202. read_unlock_bh(&pn->hash_lock);
  203. return po;
  204. }
  205. static inline struct pppox_sock *get_item_by_addr(struct net *net,
  206. struct sockaddr_pppox *sp)
  207. {
  208. struct net_device *dev;
  209. struct pppoe_net *pn;
  210. struct pppox_sock *pppox_sock = NULL;
  211. int ifindex;
  212. rcu_read_lock();
  213. dev = dev_get_by_name_rcu(net, sp->sa_addr.pppoe.dev);
  214. if (dev) {
  215. ifindex = dev->ifindex;
  216. pn = pppoe_pernet(net);
  217. pppox_sock = get_item(pn, sp->sa_addr.pppoe.sid,
  218. sp->sa_addr.pppoe.remote, ifindex);
  219. }
  220. rcu_read_unlock();
  221. return pppox_sock;
  222. }
  223. static inline void delete_item(struct pppoe_net *pn, __be16 sid,
  224. char *addr, int ifindex)
  225. {
  226. write_lock_bh(&pn->hash_lock);
  227. __delete_item(pn, sid, addr, ifindex);
  228. write_unlock_bh(&pn->hash_lock);
  229. }
  230. /***************************************************************************
  231. *
  232. * Handler for device events.
  233. * Certain device events require that sockets be unconnected.
  234. *
  235. **************************************************************************/
  236. static void pppoe_flush_dev(struct net_device *dev)
  237. {
  238. struct pppoe_net *pn;
  239. int i;
  240. pn = pppoe_pernet(dev_net(dev));
  241. write_lock_bh(&pn->hash_lock);
  242. for (i = 0; i < PPPOE_HASH_SIZE; i++) {
  243. struct pppox_sock *po = pn->hash_table[i];
  244. struct sock *sk;
  245. while (po) {
  246. while (po && po->pppoe_dev != dev) {
  247. po = po->next;
  248. }
  249. if (!po)
  250. break;
  251. sk = sk_pppox(po);
  252. /* We always grab the socket lock, followed by the
  253. * hash_lock, in that order. Since we should hold the
  254. * sock lock while doing any unbinding, we need to
  255. * release the lock we're holding. Hold a reference to
  256. * the sock so it doesn't disappear as we're jumping
  257. * between locks.
  258. */
  259. sock_hold(sk);
  260. write_unlock_bh(&pn->hash_lock);
  261. lock_sock(sk);
  262. if (po->pppoe_dev == dev &&
  263. sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
  264. pppox_unbind_sock(sk);
  265. sk->sk_state_change(sk);
  266. po->pppoe_dev = NULL;
  267. dev_put(dev);
  268. }
  269. release_sock(sk);
  270. sock_put(sk);
  271. /* Restart the process from the start of the current
  272. * hash chain. We dropped locks so the world may have
  273. * change from underneath us.
  274. */
  275. BUG_ON(pppoe_pernet(dev_net(dev)) == NULL);
  276. write_lock_bh(&pn->hash_lock);
  277. po = pn->hash_table[i];
  278. }
  279. }
  280. write_unlock_bh(&pn->hash_lock);
  281. }
  282. static int pppoe_device_event(struct notifier_block *this,
  283. unsigned long event, void *ptr)
  284. {
  285. struct net_device *dev = netdev_notifier_info_to_dev(ptr);
  286. /* Only look at sockets that are using this specific device. */
  287. switch (event) {
  288. case NETDEV_CHANGEADDR:
  289. case NETDEV_CHANGEMTU:
  290. /* A change in mtu or address is a bad thing, requiring
  291. * LCP re-negotiation.
  292. */
  293. case NETDEV_GOING_DOWN:
  294. case NETDEV_DOWN:
  295. /* Find every socket on this device and kill it. */
  296. pppoe_flush_dev(dev);
  297. break;
  298. default:
  299. break;
  300. }
  301. return NOTIFY_DONE;
  302. }
  303. static struct notifier_block pppoe_notifier = {
  304. .notifier_call = pppoe_device_event,
  305. };
  306. /************************************************************************
  307. *
  308. * Do the real work of receiving a PPPoE Session frame.
  309. *
  310. ***********************************************************************/
  311. static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
  312. {
  313. struct pppox_sock *po = pppox_sk(sk);
  314. struct pppox_sock *relay_po;
  315. /* Backlog receive. Semantics of backlog rcv preclude any code from
  316. * executing in lock_sock()/release_sock() bounds; meaning sk->sk_state
  317. * can't change.
  318. */
  319. if (skb->pkt_type == PACKET_OTHERHOST)
  320. goto abort_kfree;
  321. if (sk->sk_state & PPPOX_BOUND) {
  322. ppp_input(&po->chan, skb);
  323. } else if (sk->sk_state & PPPOX_RELAY) {
  324. relay_po = get_item_by_addr(sock_net(sk),
  325. &po->pppoe_relay);
  326. if (relay_po == NULL)
  327. goto abort_kfree;
  328. if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0)
  329. goto abort_put;
  330. if (!__pppoe_xmit(sk_pppox(relay_po), skb))
  331. goto abort_put;
  332. sock_put(sk_pppox(relay_po));
  333. } else {
  334. if (sock_queue_rcv_skb(sk, skb))
  335. goto abort_kfree;
  336. }
  337. return NET_RX_SUCCESS;
  338. abort_put:
  339. sock_put(sk_pppox(relay_po));
  340. abort_kfree:
  341. kfree_skb(skb);
  342. return NET_RX_DROP;
  343. }
  344. /************************************************************************
  345. *
  346. * Receive wrapper called in BH context.
  347. *
  348. ***********************************************************************/
  349. static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
  350. struct packet_type *pt, struct net_device *orig_dev)
  351. {
  352. struct pppoe_hdr *ph;
  353. struct pppox_sock *po;
  354. struct pppoe_net *pn;
  355. int len;
  356. skb = skb_share_check(skb, GFP_ATOMIC);
  357. if (!skb)
  358. goto out;
  359. if (skb_mac_header_len(skb) < ETH_HLEN)
  360. goto drop;
  361. if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
  362. goto drop;
  363. ph = pppoe_hdr(skb);
  364. len = ntohs(ph->length);
  365. skb_pull_rcsum(skb, sizeof(*ph));
  366. if (skb->len < len)
  367. goto drop;
  368. if (pskb_trim_rcsum(skb, len))
  369. goto drop;
  370. ph = pppoe_hdr(skb);
  371. pn = pppoe_pernet(dev_net(dev));
  372. /* Note that get_item does a sock_hold(), so sk_pppox(po)
  373. * is known to be safe.
  374. */
  375. po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
  376. if (!po)
  377. goto drop;
  378. return sk_receive_skb(sk_pppox(po), skb, 0);
  379. drop:
  380. kfree_skb(skb);
  381. out:
  382. return NET_RX_DROP;
  383. }
  384. static void pppoe_unbind_sock_work(struct work_struct *work)
  385. {
  386. struct pppox_sock *po = container_of(work, struct pppox_sock,
  387. proto.pppoe.padt_work);
  388. struct sock *sk = sk_pppox(po);
  389. lock_sock(sk);
  390. if (po->pppoe_dev) {
  391. dev_put(po->pppoe_dev);
  392. po->pppoe_dev = NULL;
  393. }
  394. pppox_unbind_sock(sk);
  395. release_sock(sk);
  396. sock_put(sk);
  397. }
  398. /************************************************************************
  399. *
  400. * Receive a PPPoE Discovery frame.
  401. * This is solely for detection of PADT frames
  402. *
  403. ***********************************************************************/
  404. static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev,
  405. struct packet_type *pt, struct net_device *orig_dev)
  406. {
  407. struct pppoe_hdr *ph;
  408. struct pppox_sock *po;
  409. struct pppoe_net *pn;
  410. skb = skb_share_check(skb, GFP_ATOMIC);
  411. if (!skb)
  412. goto out;
  413. if (skb->pkt_type != PACKET_HOST)
  414. goto abort;
  415. if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
  416. goto abort;
  417. ph = pppoe_hdr(skb);
  418. if (ph->code != PADT_CODE)
  419. goto abort;
  420. pn = pppoe_pernet(dev_net(dev));
  421. po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
  422. if (po)
  423. if (!schedule_work(&po->proto.pppoe.padt_work))
  424. sock_put(sk_pppox(po));
  425. abort:
  426. kfree_skb(skb);
  427. out:
  428. return NET_RX_SUCCESS; /* Lies... :-) */
  429. }
  430. static struct packet_type pppoes_ptype __read_mostly = {
  431. .type = cpu_to_be16(ETH_P_PPP_SES),
  432. .func = pppoe_rcv,
  433. };
  434. static struct packet_type pppoed_ptype __read_mostly = {
  435. .type = cpu_to_be16(ETH_P_PPP_DISC),
  436. .func = pppoe_disc_rcv,
  437. };
  438. static struct proto pppoe_sk_proto __read_mostly = {
  439. .name = "PPPOE",
  440. .owner = THIS_MODULE,
  441. .obj_size = sizeof(struct pppox_sock),
  442. };
  443. /***********************************************************************
  444. *
  445. * Initialize a new struct sock.
  446. *
  447. **********************************************************************/
  448. static int pppoe_create(struct net *net, struct socket *sock, int kern)
  449. {
  450. struct sock *sk;
  451. sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppoe_sk_proto, kern);
  452. if (!sk)
  453. return -ENOMEM;
  454. sock_init_data(sock, sk);
  455. sock->state = SS_UNCONNECTED;
  456. sock->ops = &pppoe_ops;
  457. sk->sk_backlog_rcv = pppoe_rcv_core;
  458. sk->sk_state = PPPOX_NONE;
  459. sk->sk_type = SOCK_STREAM;
  460. sk->sk_family = PF_PPPOX;
  461. sk->sk_protocol = PX_PROTO_OE;
  462. INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work,
  463. pppoe_unbind_sock_work);
  464. return 0;
  465. }
  466. static int pppoe_release(struct socket *sock)
  467. {
  468. struct sock *sk = sock->sk;
  469. struct pppox_sock *po;
  470. struct pppoe_net *pn;
  471. struct net *net = NULL;
  472. if (!sk)
  473. return 0;
  474. lock_sock(sk);
  475. if (sock_flag(sk, SOCK_DEAD)) {
  476. release_sock(sk);
  477. return -EBADF;
  478. }
  479. po = pppox_sk(sk);
  480. if (po->pppoe_dev) {
  481. dev_put(po->pppoe_dev);
  482. po->pppoe_dev = NULL;
  483. }
  484. pppox_unbind_sock(sk);
  485. /* Signal the death of the socket. */
  486. sk->sk_state = PPPOX_DEAD;
  487. net = sock_net(sk);
  488. pn = pppoe_pernet(net);
  489. /*
  490. * protect "po" from concurrent updates
  491. * on pppoe_flush_dev
  492. */
  493. delete_item(pn, po->pppoe_pa.sid, po->pppoe_pa.remote,
  494. po->pppoe_ifindex);
  495. sock_orphan(sk);
  496. sock->sk = NULL;
  497. skb_queue_purge(&sk->sk_receive_queue);
  498. release_sock(sk);
  499. sock_put(sk);
  500. return 0;
  501. }
  502. static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
  503. int sockaddr_len, int flags)
  504. {
  505. struct sock *sk = sock->sk;
  506. struct sockaddr_pppox *sp = (struct sockaddr_pppox *)uservaddr;
  507. struct pppox_sock *po = pppox_sk(sk);
  508. struct net_device *dev = NULL;
  509. struct pppoe_net *pn;
  510. struct net *net = NULL;
  511. int error;
  512. lock_sock(sk);
  513. error = -EINVAL;
  514. if (sockaddr_len != sizeof(struct sockaddr_pppox))
  515. goto end;
  516. if (sp->sa_protocol != PX_PROTO_OE)
  517. goto end;
  518. /* Check for already bound sockets */
  519. error = -EBUSY;
  520. if ((sk->sk_state & PPPOX_CONNECTED) &&
  521. stage_session(sp->sa_addr.pppoe.sid))
  522. goto end;
  523. /* Check for already disconnected sockets, on attempts to disconnect */
  524. error = -EALREADY;
  525. if ((sk->sk_state & PPPOX_DEAD) &&
  526. !stage_session(sp->sa_addr.pppoe.sid))
  527. goto end;
  528. error = 0;
  529. /* Delete the old binding */
  530. if (stage_session(po->pppoe_pa.sid)) {
  531. pppox_unbind_sock(sk);
  532. pn = pppoe_pernet(sock_net(sk));
  533. delete_item(pn, po->pppoe_pa.sid,
  534. po->pppoe_pa.remote, po->pppoe_ifindex);
  535. if (po->pppoe_dev) {
  536. dev_put(po->pppoe_dev);
  537. po->pppoe_dev = NULL;
  538. }
  539. po->pppoe_ifindex = 0;
  540. memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa));
  541. memset(&po->pppoe_relay, 0, sizeof(po->pppoe_relay));
  542. memset(&po->chan, 0, sizeof(po->chan));
  543. po->next = NULL;
  544. po->num = 0;
  545. sk->sk_state = PPPOX_NONE;
  546. }
  547. /* Re-bind in session stage only */
  548. if (stage_session(sp->sa_addr.pppoe.sid)) {
  549. error = -ENODEV;
  550. net = sock_net(sk);
  551. dev = dev_get_by_name(net, sp->sa_addr.pppoe.dev);
  552. if (!dev)
  553. goto err_put;
  554. po->pppoe_dev = dev;
  555. po->pppoe_ifindex = dev->ifindex;
  556. pn = pppoe_pernet(net);
  557. if (!(dev->flags & IFF_UP)) {
  558. goto err_put;
  559. }
  560. memcpy(&po->pppoe_pa,
  561. &sp->sa_addr.pppoe,
  562. sizeof(struct pppoe_addr));
  563. write_lock_bh(&pn->hash_lock);
  564. error = __set_item(pn, po);
  565. write_unlock_bh(&pn->hash_lock);
  566. if (error < 0)
  567. goto err_put;
  568. po->chan.hdrlen = (sizeof(struct pppoe_hdr) +
  569. dev->hard_header_len);
  570. po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2;
  571. po->chan.private = sk;
  572. po->chan.ops = &pppoe_chan_ops;
  573. error = ppp_register_net_channel(dev_net(dev), &po->chan);
  574. if (error) {
  575. delete_item(pn, po->pppoe_pa.sid,
  576. po->pppoe_pa.remote, po->pppoe_ifindex);
  577. goto err_put;
  578. }
  579. sk->sk_state = PPPOX_CONNECTED;
  580. }
  581. po->num = sp->sa_addr.pppoe.sid;
  582. end:
  583. release_sock(sk);
  584. return error;
  585. err_put:
  586. if (po->pppoe_dev) {
  587. dev_put(po->pppoe_dev);
  588. po->pppoe_dev = NULL;
  589. }
  590. goto end;
  591. }
  592. static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr,
  593. int peer)
  594. {
  595. int len = sizeof(struct sockaddr_pppox);
  596. struct sockaddr_pppox sp;
  597. sp.sa_family = AF_PPPOX;
  598. sp.sa_protocol = PX_PROTO_OE;
  599. memcpy(&sp.sa_addr.pppoe, &pppox_sk(sock->sk)->pppoe_pa,
  600. sizeof(struct pppoe_addr));
  601. memcpy(uaddr, &sp, len);
  602. return len;
  603. }
  604. static int pppoe_ioctl(struct socket *sock, unsigned int cmd,
  605. unsigned long arg)
  606. {
  607. struct sock *sk = sock->sk;
  608. struct pppox_sock *po = pppox_sk(sk);
  609. int val;
  610. int err;
  611. switch (cmd) {
  612. case PPPIOCGMRU:
  613. err = -ENXIO;
  614. if (!(sk->sk_state & PPPOX_CONNECTED))
  615. break;
  616. err = -EFAULT;
  617. if (put_user(po->pppoe_dev->mtu -
  618. sizeof(struct pppoe_hdr) -
  619. PPP_HDRLEN,
  620. (int __user *)arg))
  621. break;
  622. err = 0;
  623. break;
  624. case PPPIOCSMRU:
  625. err = -ENXIO;
  626. if (!(sk->sk_state & PPPOX_CONNECTED))
  627. break;
  628. err = -EFAULT;
  629. if (get_user(val, (int __user *)arg))
  630. break;
  631. if (val < (po->pppoe_dev->mtu
  632. - sizeof(struct pppoe_hdr)
  633. - PPP_HDRLEN))
  634. err = 0;
  635. else
  636. err = -EINVAL;
  637. break;
  638. case PPPIOCSFLAGS:
  639. err = -EFAULT;
  640. if (get_user(val, (int __user *)arg))
  641. break;
  642. err = 0;
  643. break;
  644. case PPPOEIOCSFWD:
  645. {
  646. struct pppox_sock *relay_po;
  647. err = -EBUSY;
  648. if (sk->sk_state & (PPPOX_BOUND | PPPOX_DEAD))
  649. break;
  650. err = -ENOTCONN;
  651. if (!(sk->sk_state & PPPOX_CONNECTED))
  652. break;
  653. /* PPPoE address from the user specifies an outbound
  654. PPPoE address which frames are forwarded to */
  655. err = -EFAULT;
  656. if (copy_from_user(&po->pppoe_relay,
  657. (void __user *)arg,
  658. sizeof(struct sockaddr_pppox)))
  659. break;
  660. err = -EINVAL;
  661. if (po->pppoe_relay.sa_family != AF_PPPOX ||
  662. po->pppoe_relay.sa_protocol != PX_PROTO_OE)
  663. break;
  664. /* Check that the socket referenced by the address
  665. actually exists. */
  666. relay_po = get_item_by_addr(sock_net(sk), &po->pppoe_relay);
  667. if (!relay_po)
  668. break;
  669. sock_put(sk_pppox(relay_po));
  670. sk->sk_state |= PPPOX_RELAY;
  671. err = 0;
  672. break;
  673. }
  674. case PPPOEIOCDFWD:
  675. err = -EALREADY;
  676. if (!(sk->sk_state & PPPOX_RELAY))
  677. break;
  678. sk->sk_state &= ~PPPOX_RELAY;
  679. err = 0;
  680. break;
  681. default:
  682. err = -ENOTTY;
  683. }
  684. return err;
  685. }
  686. static int pppoe_sendmsg(struct socket *sock, struct msghdr *m,
  687. size_t total_len)
  688. {
  689. struct sk_buff *skb;
  690. struct sock *sk = sock->sk;
  691. struct pppox_sock *po = pppox_sk(sk);
  692. int error;
  693. struct pppoe_hdr hdr;
  694. struct pppoe_hdr *ph;
  695. struct net_device *dev;
  696. char *start;
  697. int hlen;
  698. lock_sock(sk);
  699. if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) {
  700. error = -ENOTCONN;
  701. goto end;
  702. }
  703. hdr.ver = 1;
  704. hdr.type = 1;
  705. hdr.code = 0;
  706. hdr.sid = po->num;
  707. dev = po->pppoe_dev;
  708. error = -EMSGSIZE;
  709. if (total_len > (dev->mtu + dev->hard_header_len))
  710. goto end;
  711. hlen = LL_RESERVED_SPACE(dev);
  712. skb = sock_wmalloc(sk, hlen + sizeof(*ph) + total_len +
  713. dev->needed_tailroom, 0, GFP_KERNEL);
  714. if (!skb) {
  715. error = -ENOMEM;
  716. goto end;
  717. }
  718. /* Reserve space for headers. */
  719. skb_reserve(skb, hlen);
  720. skb_reset_network_header(skb);
  721. skb->dev = dev;
  722. skb->priority = sk->sk_priority;
  723. skb->protocol = cpu_to_be16(ETH_P_PPP_SES);
  724. ph = skb_put(skb, total_len + sizeof(struct pppoe_hdr));
  725. start = (char *)&ph->tag[0];
  726. error = memcpy_from_msg(start, m, total_len);
  727. if (error < 0) {
  728. kfree_skb(skb);
  729. goto end;
  730. }
  731. error = total_len;
  732. dev_hard_header(skb, dev, ETH_P_PPP_SES,
  733. po->pppoe_pa.remote, NULL, total_len);
  734. memcpy(ph, &hdr, sizeof(struct pppoe_hdr));
  735. ph->length = htons(total_len);
  736. dev_queue_xmit(skb);
  737. end:
  738. release_sock(sk);
  739. return error;
  740. }
  741. /************************************************************************
  742. *
  743. * xmit function for internal use.
  744. *
  745. ***********************************************************************/
  746. static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
  747. {
  748. struct pppox_sock *po = pppox_sk(sk);
  749. struct net_device *dev = po->pppoe_dev;
  750. struct pppoe_hdr *ph;
  751. int data_len = skb->len;
  752. /* The higher-level PPP code (ppp_unregister_channel()) ensures the PPP
  753. * xmit operations conclude prior to an unregistration call. Thus
  754. * sk->sk_state cannot change, so we don't need to do lock_sock().
  755. * But, we also can't do a lock_sock since that introduces a potential
  756. * deadlock as we'd reverse the lock ordering used when calling
  757. * ppp_unregister_channel().
  758. */
  759. if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
  760. goto abort;
  761. if (!dev)
  762. goto abort;
  763. /* Copy the data if there is no space for the header or if it's
  764. * read-only.
  765. */
  766. if (skb_cow_head(skb, LL_RESERVED_SPACE(dev) + sizeof(*ph)))
  767. goto abort;
  768. __skb_push(skb, sizeof(*ph));
  769. skb_reset_network_header(skb);
  770. ph = pppoe_hdr(skb);
  771. ph->ver = 1;
  772. ph->type = 1;
  773. ph->code = 0;
  774. ph->sid = po->num;
  775. ph->length = htons(data_len);
  776. skb->protocol = cpu_to_be16(ETH_P_PPP_SES);
  777. skb->dev = dev;
  778. dev_hard_header(skb, dev, ETH_P_PPP_SES,
  779. po->pppoe_pa.remote, NULL, data_len);
  780. dev_queue_xmit(skb);
  781. return 1;
  782. abort:
  783. kfree_skb(skb);
  784. return 1;
  785. }
  786. /************************************************************************
  787. *
  788. * xmit function called by generic PPP driver
  789. * sends PPP frame over PPPoE socket
  790. *
  791. ***********************************************************************/
  792. static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb)
  793. {
  794. struct sock *sk = (struct sock *)chan->private;
  795. return __pppoe_xmit(sk, skb);
  796. }
  797. static const struct ppp_channel_ops pppoe_chan_ops = {
  798. .start_xmit = pppoe_xmit,
  799. };
  800. static int pppoe_recvmsg(struct socket *sock, struct msghdr *m,
  801. size_t total_len, int flags)
  802. {
  803. struct sock *sk = sock->sk;
  804. struct sk_buff *skb;
  805. int error = 0;
  806. if (sk->sk_state & PPPOX_BOUND) {
  807. error = -EIO;
  808. goto end;
  809. }
  810. skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
  811. flags & MSG_DONTWAIT, &error);
  812. if (error < 0)
  813. goto end;
  814. if (skb) {
  815. total_len = min_t(size_t, total_len, skb->len);
  816. error = skb_copy_datagram_msg(skb, 0, m, total_len);
  817. if (error == 0) {
  818. consume_skb(skb);
  819. return total_len;
  820. }
  821. }
  822. kfree_skb(skb);
  823. end:
  824. return error;
  825. }
  826. #ifdef CONFIG_PROC_FS
  827. static int pppoe_seq_show(struct seq_file *seq, void *v)
  828. {
  829. struct pppox_sock *po;
  830. char *dev_name;
  831. if (v == SEQ_START_TOKEN) {
  832. seq_puts(seq, "Id Address Device\n");
  833. goto out;
  834. }
  835. po = v;
  836. dev_name = po->pppoe_pa.dev;
  837. seq_printf(seq, "%08X %pM %8s\n",
  838. po->pppoe_pa.sid, po->pppoe_pa.remote, dev_name);
  839. out:
  840. return 0;
  841. }
  842. static inline struct pppox_sock *pppoe_get_idx(struct pppoe_net *pn, loff_t pos)
  843. {
  844. struct pppox_sock *po;
  845. int i;
  846. for (i = 0; i < PPPOE_HASH_SIZE; i++) {
  847. po = pn->hash_table[i];
  848. while (po) {
  849. if (!pos--)
  850. goto out;
  851. po = po->next;
  852. }
  853. }
  854. out:
  855. return po;
  856. }
  857. static void *pppoe_seq_start(struct seq_file *seq, loff_t *pos)
  858. __acquires(pn->hash_lock)
  859. {
  860. struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq));
  861. loff_t l = *pos;
  862. read_lock_bh(&pn->hash_lock);
  863. return l ? pppoe_get_idx(pn, --l) : SEQ_START_TOKEN;
  864. }
  865. static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos)
  866. {
  867. struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq));
  868. struct pppox_sock *po;
  869. ++*pos;
  870. if (v == SEQ_START_TOKEN) {
  871. po = pppoe_get_idx(pn, 0);
  872. goto out;
  873. }
  874. po = v;
  875. if (po->next)
  876. po = po->next;
  877. else {
  878. int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
  879. po = NULL;
  880. while (++hash < PPPOE_HASH_SIZE) {
  881. po = pn->hash_table[hash];
  882. if (po)
  883. break;
  884. }
  885. }
  886. out:
  887. return po;
  888. }
  889. static void pppoe_seq_stop(struct seq_file *seq, void *v)
  890. __releases(pn->hash_lock)
  891. {
  892. struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq));
  893. read_unlock_bh(&pn->hash_lock);
  894. }
  895. static const struct seq_operations pppoe_seq_ops = {
  896. .start = pppoe_seq_start,
  897. .next = pppoe_seq_next,
  898. .stop = pppoe_seq_stop,
  899. .show = pppoe_seq_show,
  900. };
  901. #endif /* CONFIG_PROC_FS */
  902. static const struct proto_ops pppoe_ops = {
  903. .family = AF_PPPOX,
  904. .owner = THIS_MODULE,
  905. .release = pppoe_release,
  906. .bind = sock_no_bind,
  907. .connect = pppoe_connect,
  908. .socketpair = sock_no_socketpair,
  909. .accept = sock_no_accept,
  910. .getname = pppoe_getname,
  911. .poll = datagram_poll,
  912. .listen = sock_no_listen,
  913. .shutdown = sock_no_shutdown,
  914. .sendmsg = pppoe_sendmsg,
  915. .recvmsg = pppoe_recvmsg,
  916. .mmap = sock_no_mmap,
  917. .ioctl = pppox_ioctl,
  918. #ifdef CONFIG_COMPAT
  919. .compat_ioctl = pppox_compat_ioctl,
  920. #endif
  921. };
  922. static const struct pppox_proto pppoe_proto = {
  923. .create = pppoe_create,
  924. .ioctl = pppoe_ioctl,
  925. .owner = THIS_MODULE,
  926. };
  927. static __net_init int pppoe_init_net(struct net *net)
  928. {
  929. struct pppoe_net *pn = pppoe_pernet(net);
  930. struct proc_dir_entry *pde;
  931. rwlock_init(&pn->hash_lock);
  932. pde = proc_create_net("pppoe", 0444, net->proc_net,
  933. &pppoe_seq_ops, sizeof(struct seq_net_private));
  934. #ifdef CONFIG_PROC_FS
  935. if (!pde)
  936. return -ENOMEM;
  937. #endif
  938. return 0;
  939. }
  940. static __net_exit void pppoe_exit_net(struct net *net)
  941. {
  942. remove_proc_entry("pppoe", net->proc_net);
  943. }
  944. static struct pernet_operations pppoe_net_ops = {
  945. .init = pppoe_init_net,
  946. .exit = pppoe_exit_net,
  947. .id = &pppoe_net_id,
  948. .size = sizeof(struct pppoe_net),
  949. };
  950. static int __init pppoe_init(void)
  951. {
  952. int err;
  953. err = register_pernet_device(&pppoe_net_ops);
  954. if (err)
  955. goto out;
  956. err = proto_register(&pppoe_sk_proto, 0);
  957. if (err)
  958. goto out_unregister_net_ops;
  959. err = register_pppox_proto(PX_PROTO_OE, &pppoe_proto);
  960. if (err)
  961. goto out_unregister_pppoe_proto;
  962. dev_add_pack(&pppoes_ptype);
  963. dev_add_pack(&pppoed_ptype);
  964. register_netdevice_notifier(&pppoe_notifier);
  965. return 0;
  966. out_unregister_pppoe_proto:
  967. proto_unregister(&pppoe_sk_proto);
  968. out_unregister_net_ops:
  969. unregister_pernet_device(&pppoe_net_ops);
  970. out:
  971. return err;
  972. }
  973. static void __exit pppoe_exit(void)
  974. {
  975. unregister_netdevice_notifier(&pppoe_notifier);
  976. dev_remove_pack(&pppoed_ptype);
  977. dev_remove_pack(&pppoes_ptype);
  978. unregister_pppox_proto(PX_PROTO_OE);
  979. proto_unregister(&pppoe_sk_proto);
  980. unregister_pernet_device(&pppoe_net_ops);
  981. }
  982. module_init(pppoe_init);
  983. module_exit(pppoe_exit);
  984. MODULE_AUTHOR("Michal Ostrowski <mostrows@speakeasy.net>");
  985. MODULE_DESCRIPTION("PPP over Ethernet driver");
  986. MODULE_LICENSE("GPL");
  987. MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OE);