x25_in.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * X.25 Packet Layer release 002
  4. *
  5. * This is ALPHA test software. This code may break your machine,
  6. * randomly fail to work with new releases, misbehave and/or generally
  7. * screw up. It might even work.
  8. *
  9. * This code REQUIRES 2.1.15 or higher
  10. *
  11. * History
  12. * X.25 001 Jonathan Naylor Started coding.
  13. * X.25 002 Jonathan Naylor Centralised disconnection code.
  14. * New timer architecture.
  15. * 2000-03-20 Daniela Squassoni Disabling/enabling of facilities
  16. * negotiation.
  17. * 2000-11-10 Henner Eisen Check and reset for out-of-sequence
  18. * i-frames.
  19. */
  20. #define pr_fmt(fmt) "X25: " fmt
  21. #include <linux/slab.h>
  22. #include <linux/errno.h>
  23. #include <linux/kernel.h>
  24. #include <linux/string.h>
  25. #include <linux/skbuff.h>
  26. #include <net/sock.h>
  27. #include <net/tcp_states.h>
  28. #include <net/x25.h>
  29. static int x25_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more)
  30. {
  31. struct sk_buff *skbo, *skbn = skb;
  32. struct x25_sock *x25 = x25_sk(sk);
  33. if (more) {
  34. x25->fraglen += skb->len;
  35. skb_queue_tail(&x25->fragment_queue, skb);
  36. skb_set_owner_r(skb, sk);
  37. return 0;
  38. }
  39. if (!more && x25->fraglen > 0) { /* End of fragment */
  40. int len = x25->fraglen + skb->len;
  41. if ((skbn = alloc_skb(len, GFP_ATOMIC)) == NULL){
  42. kfree_skb(skb);
  43. return 1;
  44. }
  45. skb_queue_tail(&x25->fragment_queue, skb);
  46. skb_reset_transport_header(skbn);
  47. skbo = skb_dequeue(&x25->fragment_queue);
  48. skb_copy_from_linear_data(skbo, skb_put(skbn, skbo->len),
  49. skbo->len);
  50. kfree_skb(skbo);
  51. while ((skbo =
  52. skb_dequeue(&x25->fragment_queue)) != NULL) {
  53. skb_pull(skbo, (x25->neighbour->extended) ?
  54. X25_EXT_MIN_LEN : X25_STD_MIN_LEN);
  55. skb_copy_from_linear_data(skbo,
  56. skb_put(skbn, skbo->len),
  57. skbo->len);
  58. kfree_skb(skbo);
  59. }
  60. x25->fraglen = 0;
  61. }
  62. skb_set_owner_r(skbn, sk);
  63. skb_queue_tail(&sk->sk_receive_queue, skbn);
  64. if (!sock_flag(sk, SOCK_DEAD))
  65. sk->sk_data_ready(sk);
  66. return 0;
  67. }
  68. /*
  69. * State machine for state 1, Awaiting Call Accepted State.
  70. * The handling of the timer(s) is in file x25_timer.c.
  71. * Handling of state 0 and connection release is in af_x25.c.
  72. */
  73. static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametype)
  74. {
  75. struct x25_address source_addr, dest_addr;
  76. int len;
  77. struct x25_sock *x25 = x25_sk(sk);
  78. switch (frametype) {
  79. case X25_CALL_ACCEPTED: {
  80. x25_stop_timer(sk);
  81. x25->condition = 0x00;
  82. x25->vs = 0;
  83. x25->va = 0;
  84. x25->vr = 0;
  85. x25->vl = 0;
  86. x25->state = X25_STATE_3;
  87. sk->sk_state = TCP_ESTABLISHED;
  88. /*
  89. * Parse the data in the frame.
  90. */
  91. if (!pskb_may_pull(skb, X25_STD_MIN_LEN))
  92. goto out_clear;
  93. skb_pull(skb, X25_STD_MIN_LEN);
  94. len = x25_parse_address_block(skb, &source_addr,
  95. &dest_addr);
  96. if (len > 0)
  97. skb_pull(skb, len);
  98. else if (len < 0)
  99. goto out_clear;
  100. len = x25_parse_facilities(skb, &x25->facilities,
  101. &x25->dte_facilities,
  102. &x25->vc_facil_mask);
  103. if (len > 0)
  104. skb_pull(skb, len);
  105. else if (len < 0)
  106. goto out_clear;
  107. /*
  108. * Copy any Call User Data.
  109. */
  110. if (skb->len > 0) {
  111. if (skb->len > X25_MAX_CUD_LEN)
  112. goto out_clear;
  113. skb_copy_bits(skb, 0, x25->calluserdata.cuddata,
  114. skb->len);
  115. x25->calluserdata.cudlength = skb->len;
  116. }
  117. if (!sock_flag(sk, SOCK_DEAD))
  118. sk->sk_state_change(sk);
  119. break;
  120. }
  121. case X25_CALL_REQUEST:
  122. /* call collision */
  123. x25->causediag.cause = 0x01;
  124. x25->causediag.diagnostic = 0x48;
  125. x25_write_internal(sk, X25_CLEAR_REQUEST);
  126. x25_disconnect(sk, EISCONN, 0x01, 0x48);
  127. break;
  128. case X25_CLEAR_REQUEST:
  129. if (!pskb_may_pull(skb, X25_STD_MIN_LEN + 2))
  130. goto out_clear;
  131. x25_write_internal(sk, X25_CLEAR_CONFIRMATION);
  132. x25_disconnect(sk, ECONNREFUSED, skb->data[3], skb->data[4]);
  133. break;
  134. default:
  135. break;
  136. }
  137. return 0;
  138. out_clear:
  139. x25_write_internal(sk, X25_CLEAR_REQUEST);
  140. x25->state = X25_STATE_2;
  141. x25_start_t23timer(sk);
  142. return 0;
  143. }
  144. /*
  145. * State machine for state 2, Awaiting Clear Confirmation State.
  146. * The handling of the timer(s) is in file x25_timer.c
  147. * Handling of state 0 and connection release is in af_x25.c.
  148. */
  149. static int x25_state2_machine(struct sock *sk, struct sk_buff *skb, int frametype)
  150. {
  151. switch (frametype) {
  152. case X25_CLEAR_REQUEST:
  153. if (!pskb_may_pull(skb, X25_STD_MIN_LEN + 2))
  154. goto out_clear;
  155. x25_write_internal(sk, X25_CLEAR_CONFIRMATION);
  156. x25_disconnect(sk, 0, skb->data[3], skb->data[4]);
  157. break;
  158. case X25_CLEAR_CONFIRMATION:
  159. x25_disconnect(sk, 0, 0, 0);
  160. break;
  161. default:
  162. break;
  163. }
  164. return 0;
  165. out_clear:
  166. x25_write_internal(sk, X25_CLEAR_REQUEST);
  167. x25_start_t23timer(sk);
  168. return 0;
  169. }
  170. /*
  171. * State machine for state 3, Connected State.
  172. * The handling of the timer(s) is in file x25_timer.c
  173. * Handling of state 0 and connection release is in af_x25.c.
  174. */
  175. static int x25_state3_machine(struct sock *sk, struct sk_buff *skb, int frametype, int ns, int nr, int q, int d, int m)
  176. {
  177. int queued = 0;
  178. int modulus;
  179. struct x25_sock *x25 = x25_sk(sk);
  180. modulus = (x25->neighbour->extended) ? X25_EMODULUS : X25_SMODULUS;
  181. switch (frametype) {
  182. case X25_RESET_REQUEST:
  183. x25_write_internal(sk, X25_RESET_CONFIRMATION);
  184. x25_stop_timer(sk);
  185. x25->condition = 0x00;
  186. x25->vs = 0;
  187. x25->vr = 0;
  188. x25->va = 0;
  189. x25->vl = 0;
  190. x25_requeue_frames(sk);
  191. break;
  192. case X25_CLEAR_REQUEST:
  193. if (!pskb_may_pull(skb, X25_STD_MIN_LEN + 2))
  194. goto out_clear;
  195. x25_write_internal(sk, X25_CLEAR_CONFIRMATION);
  196. x25_disconnect(sk, 0, skb->data[3], skb->data[4]);
  197. break;
  198. case X25_RR:
  199. case X25_RNR:
  200. if (!x25_validate_nr(sk, nr)) {
  201. x25_clear_queues(sk);
  202. x25_write_internal(sk, X25_RESET_REQUEST);
  203. x25_start_t22timer(sk);
  204. x25->condition = 0x00;
  205. x25->vs = 0;
  206. x25->vr = 0;
  207. x25->va = 0;
  208. x25->vl = 0;
  209. x25->state = X25_STATE_4;
  210. } else {
  211. x25_frames_acked(sk, nr);
  212. if (frametype == X25_RNR) {
  213. x25->condition |= X25_COND_PEER_RX_BUSY;
  214. } else {
  215. x25->condition &= ~X25_COND_PEER_RX_BUSY;
  216. }
  217. }
  218. break;
  219. case X25_DATA: /* XXX */
  220. x25->condition &= ~X25_COND_PEER_RX_BUSY;
  221. if ((ns != x25->vr) || !x25_validate_nr(sk, nr)) {
  222. x25_clear_queues(sk);
  223. x25_write_internal(sk, X25_RESET_REQUEST);
  224. x25_start_t22timer(sk);
  225. x25->condition = 0x00;
  226. x25->vs = 0;
  227. x25->vr = 0;
  228. x25->va = 0;
  229. x25->vl = 0;
  230. x25->state = X25_STATE_4;
  231. break;
  232. }
  233. x25_frames_acked(sk, nr);
  234. if (ns == x25->vr) {
  235. if (x25_queue_rx_frame(sk, skb, m) == 0) {
  236. x25->vr = (x25->vr + 1) % modulus;
  237. queued = 1;
  238. } else {
  239. /* Should never happen */
  240. x25_clear_queues(sk);
  241. x25_write_internal(sk, X25_RESET_REQUEST);
  242. x25_start_t22timer(sk);
  243. x25->condition = 0x00;
  244. x25->vs = 0;
  245. x25->vr = 0;
  246. x25->va = 0;
  247. x25->vl = 0;
  248. x25->state = X25_STATE_4;
  249. break;
  250. }
  251. if (atomic_read(&sk->sk_rmem_alloc) >
  252. (sk->sk_rcvbuf >> 1))
  253. x25->condition |= X25_COND_OWN_RX_BUSY;
  254. }
  255. /*
  256. * If the window is full Ack it immediately, else
  257. * start the holdback timer.
  258. */
  259. if (((x25->vl + x25->facilities.winsize_in) % modulus) == x25->vr) {
  260. x25->condition &= ~X25_COND_ACK_PENDING;
  261. x25_stop_timer(sk);
  262. x25_enquiry_response(sk);
  263. } else {
  264. x25->condition |= X25_COND_ACK_PENDING;
  265. x25_start_t2timer(sk);
  266. }
  267. break;
  268. case X25_INTERRUPT_CONFIRMATION:
  269. clear_bit(X25_INTERRUPT_FLAG, &x25->flags);
  270. break;
  271. case X25_INTERRUPT:
  272. if (sock_flag(sk, SOCK_URGINLINE))
  273. queued = !sock_queue_rcv_skb(sk, skb);
  274. else {
  275. skb_set_owner_r(skb, sk);
  276. skb_queue_tail(&x25->interrupt_in_queue, skb);
  277. queued = 1;
  278. }
  279. sk_send_sigurg(sk);
  280. x25_write_internal(sk, X25_INTERRUPT_CONFIRMATION);
  281. break;
  282. default:
  283. pr_warn("unknown %02X in state 3\n", frametype);
  284. break;
  285. }
  286. return queued;
  287. out_clear:
  288. x25_write_internal(sk, X25_CLEAR_REQUEST);
  289. x25->state = X25_STATE_2;
  290. x25_start_t23timer(sk);
  291. return 0;
  292. }
  293. /*
  294. * State machine for state 4, Awaiting Reset Confirmation State.
  295. * The handling of the timer(s) is in file x25_timer.c
  296. * Handling of state 0 and connection release is in af_x25.c.
  297. */
  298. static int x25_state4_machine(struct sock *sk, struct sk_buff *skb, int frametype)
  299. {
  300. struct x25_sock *x25 = x25_sk(sk);
  301. switch (frametype) {
  302. case X25_RESET_REQUEST:
  303. x25_write_internal(sk, X25_RESET_CONFIRMATION);
  304. fallthrough;
  305. case X25_RESET_CONFIRMATION: {
  306. x25_stop_timer(sk);
  307. x25->condition = 0x00;
  308. x25->va = 0;
  309. x25->vr = 0;
  310. x25->vs = 0;
  311. x25->vl = 0;
  312. x25->state = X25_STATE_3;
  313. x25_requeue_frames(sk);
  314. break;
  315. }
  316. case X25_CLEAR_REQUEST:
  317. if (!pskb_may_pull(skb, X25_STD_MIN_LEN + 2))
  318. goto out_clear;
  319. x25_write_internal(sk, X25_CLEAR_CONFIRMATION);
  320. x25_disconnect(sk, 0, skb->data[3], skb->data[4]);
  321. break;
  322. default:
  323. break;
  324. }
  325. return 0;
  326. out_clear:
  327. x25_write_internal(sk, X25_CLEAR_REQUEST);
  328. x25->state = X25_STATE_2;
  329. x25_start_t23timer(sk);
  330. return 0;
  331. }
  332. /*
  333. * State machine for state 5, Call Accepted / Call Connected pending (X25_ACCPT_APPRV_FLAG).
  334. * The handling of the timer(s) is in file x25_timer.c
  335. * Handling of state 0 and connection release is in af_x25.c.
  336. */
  337. static int x25_state5_machine(struct sock *sk, struct sk_buff *skb, int frametype)
  338. {
  339. struct x25_sock *x25 = x25_sk(sk);
  340. switch (frametype) {
  341. case X25_CLEAR_REQUEST:
  342. if (!pskb_may_pull(skb, X25_STD_MIN_LEN + 2)) {
  343. x25_write_internal(sk, X25_CLEAR_REQUEST);
  344. x25->state = X25_STATE_2;
  345. x25_start_t23timer(sk);
  346. return 0;
  347. }
  348. x25_write_internal(sk, X25_CLEAR_CONFIRMATION);
  349. x25_disconnect(sk, 0, skb->data[3], skb->data[4]);
  350. break;
  351. default:
  352. break;
  353. }
  354. return 0;
  355. }
  356. /* Higher level upcall for a LAPB frame */
  357. int x25_process_rx_frame(struct sock *sk, struct sk_buff *skb)
  358. {
  359. struct x25_sock *x25 = x25_sk(sk);
  360. int queued = 0, frametype, ns, nr, q, d, m;
  361. if (x25->state == X25_STATE_0)
  362. return 0;
  363. frametype = x25_decode(sk, skb, &ns, &nr, &q, &d, &m);
  364. switch (x25->state) {
  365. case X25_STATE_1:
  366. queued = x25_state1_machine(sk, skb, frametype);
  367. break;
  368. case X25_STATE_2:
  369. queued = x25_state2_machine(sk, skb, frametype);
  370. break;
  371. case X25_STATE_3:
  372. queued = x25_state3_machine(sk, skb, frametype, ns, nr, q, d, m);
  373. break;
  374. case X25_STATE_4:
  375. queued = x25_state4_machine(sk, skb, frametype);
  376. break;
  377. case X25_STATE_5:
  378. queued = x25_state5_machine(sk, skb, frametype);
  379. break;
  380. }
  381. x25_kick(sk);
  382. return queued;
  383. }
  384. int x25_backlog_rcv(struct sock *sk, struct sk_buff *skb)
  385. {
  386. int queued = x25_process_rx_frame(sk, skb);
  387. if (!queued)
  388. kfree_skb(skb);
  389. return 0;
  390. }