pppoe.c 27 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /** -*- linux-c -*- ***********************************************************
  3. * Linux PPP over Ethernet (PPPoX/PPPoE) Sockets
  4. *
  5. * PPPoX --- Generic PPP encapsulation socket family
  6. * PPPoE --- PPP over Ethernet (RFC 2516)
  7. *
  8. * Version: 0.7.0
  9. *
  10. * 070228 : Fix to allow multiple sessions with same remote MAC and same
  11. * session id by including the local device ifindex in the
  12. * tuple identifying a session. This also ensures packets can't
  13. * be injected into a session from interfaces other than the one
  14. * specified by userspace. Florian Zumbiehl <florz@florz.de>
  15. * (Oh, BTW, this one is YYMMDD, in case you were wondering ...)
  16. * 220102 : Fix module use count on failure in pppoe_create, pppox_sk -acme
  17. * 030700 : Fixed connect logic to allow for disconnect.
  18. * 270700 : Fixed potential SMP problems; we must protect against
  19. * simultaneous invocation of ppp_input
  20. * and ppp_unregister_channel.
  21. * 040800 : Respect reference count mechanisms on net-devices.
  22. * 200800 : fix kfree(skb) in pppoe_rcv (acme)
  23. * Module reference count is decremented in the right spot now,
  24. * guards against sock_put not actually freeing the sk
  25. * in pppoe_release.
  26. * 051000 : Initialization cleanup.
  27. * 111100 : Fix recvmsg.
  28. * 050101 : Fix PADT procesing.
  29. * 140501 : Use pppoe_rcv_core to handle all backlog. (Alexey)
  30. * 170701 : Do not lock_sock with rwlock held. (DaveM)
  31. * Ignore discovery frames if user has socket
  32. * locked. (DaveM)
  33. * Ignore return value of dev_queue_xmit in __pppoe_xmit
  34. * or else we may kfree an SKB twice. (DaveM)
  35. * 190701 : When doing copies of skb's in __pppoe_xmit, always delete
  36. * the original skb that was passed in on success, never on
  37. * failure. Delete the copy of the skb on failure to avoid
  38. * a memory leak.
  39. * 081001 : Misc. cleanup (licence string, non-blocking, prevent
  40. * reference of device on close).
  41. * 121301 : New ppp channels interface; cannot unregister a channel
  42. * from interrupts. Thus, we mark the socket as a ZOMBIE
  43. * and do the unregistration later.
  44. * 081002 : seq_file support for proc stuff -acme
  45. * 111602 : Merge all 2.4 fixes into 2.5/2.6 tree. Label 2.5/2.6
  46. * as version 0.7. Spacing cleanup.
  47. * Author: Michal Ostrowski <mostrows@speakeasy.net>
  48. * Contributors:
  49. * Arnaldo Carvalho de Melo <acme@conectiva.com.br>
  50. * David S. Miller (davem@redhat.com)
  51. *
  52. * License:
  53. */
  54. #include <linux/string.h>
  55. #include <linux/module.h>
  56. #include <linux/kernel.h>
  57. #include <linux/slab.h>
  58. #include <linux/errno.h>
  59. #include <linux/netdevice.h>
  60. #include <linux/net.h>
  61. #include <linux/inetdevice.h>
  62. #include <linux/etherdevice.h>
  63. #include <linux/skbuff.h>
  64. #include <linux/init.h>
  65. #include <linux/if_ether.h>
  66. #include <linux/if_pppox.h>
  67. #include <linux/ppp_channel.h>
  68. #include <linux/ppp_defs.h>
  69. #include <linux/ppp-ioctl.h>
  70. #include <linux/notifier.h>
  71. #include <linux/file.h>
  72. #include <linux/proc_fs.h>
  73. #include <linux/seq_file.h>
  74. #include <linux/nsproxy.h>
  75. #include <net/net_namespace.h>
  76. #include <net/netns/generic.h>
  77. #include <net/sock.h>
  78. #include <linux/uaccess.h>
  79. #define PPPOE_HASH_BITS 4
  80. #define PPPOE_HASH_SIZE (1 << PPPOE_HASH_BITS)
  81. #define PPPOE_HASH_MASK (PPPOE_HASH_SIZE - 1)
  82. static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb);
  83. static const struct proto_ops pppoe_ops;
  84. static const struct ppp_channel_ops pppoe_chan_ops;
  85. /* per-net private data for this module */
  86. static unsigned int pppoe_net_id __read_mostly;
  87. struct pppoe_net {
  88. /*
  89. * we could use _single_ hash table for all
  90. * nets by injecting net id into the hash but
  91. * it would increase hash chains and add
  92. * a few additional math comparations messy
  93. * as well, moreover in case of SMP less locking
  94. * controversy here
  95. */
  96. struct pppox_sock *hash_table[PPPOE_HASH_SIZE];
  97. rwlock_t hash_lock;
  98. };
  99. /*
  100. * PPPoE could be in the following stages:
  101. * 1) Discovery stage (to obtain remote MAC and Session ID)
  102. * 2) Session stage (MAC and SID are known)
  103. *
  104. * Ethernet frames have a special tag for this but
  105. * we use simpler approach based on session id
  106. */
  107. static inline bool stage_session(__be16 sid)
  108. {
  109. return sid != 0;
  110. }
  111. static inline struct pppoe_net *pppoe_pernet(struct net *net)
  112. {
  113. BUG_ON(!net);
  114. return net_generic(net, pppoe_net_id);
  115. }
  116. static inline int cmp_2_addr(struct pppoe_addr *a, struct pppoe_addr *b)
  117. {
  118. return a->sid == b->sid && ether_addr_equal(a->remote, b->remote);
  119. }
  120. static inline int cmp_addr(struct pppoe_addr *a, __be16 sid, char *addr)
  121. {
  122. return a->sid == sid && ether_addr_equal(a->remote, addr);
  123. }
  124. #if 8 % PPPOE_HASH_BITS
  125. #error 8 must be a multiple of PPPOE_HASH_BITS
  126. #endif
  127. static int hash_item(__be16 sid, unsigned char *addr)
  128. {
  129. unsigned char hash = 0;
  130. unsigned int i;
  131. for (i = 0; i < ETH_ALEN; i++)
  132. hash ^= addr[i];
  133. for (i = 0; i < sizeof(sid_t) * 8; i += 8)
  134. hash ^= (__force __u32)sid >> i;
  135. for (i = 8; (i >>= 1) >= PPPOE_HASH_BITS;)
  136. hash ^= hash >> i;
  137. return hash & PPPOE_HASH_MASK;
  138. }
  139. /**********************************************************************
  140. *
  141. * Set/get/delete/rehash items (internal versions)
  142. *
  143. **********************************************************************/
  144. static struct pppox_sock *__get_item(struct pppoe_net *pn, __be16 sid,
  145. unsigned char *addr, int ifindex)
  146. {
  147. int hash = hash_item(sid, addr);
  148. struct pppox_sock *ret;
  149. ret = pn->hash_table[hash];
  150. while (ret) {
  151. if (cmp_addr(&ret->pppoe_pa, sid, addr) &&
  152. ret->pppoe_ifindex == ifindex)
  153. return ret;
  154. ret = ret->next;
  155. }
  156. return NULL;
  157. }
  158. static int __set_item(struct pppoe_net *pn, struct pppox_sock *po)
  159. {
  160. int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
  161. struct pppox_sock *ret;
  162. ret = pn->hash_table[hash];
  163. while (ret) {
  164. if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa) &&
  165. ret->pppoe_ifindex == po->pppoe_ifindex)
  166. return -EALREADY;
  167. ret = ret->next;
  168. }
  169. po->next = pn->hash_table[hash];
  170. pn->hash_table[hash] = po;
  171. return 0;
  172. }
  173. static void __delete_item(struct pppoe_net *pn, __be16 sid,
  174. char *addr, int ifindex)
  175. {
  176. int hash = hash_item(sid, addr);
  177. struct pppox_sock *ret, **src;
  178. ret = pn->hash_table[hash];
  179. src = &pn->hash_table[hash];
  180. while (ret) {
  181. if (cmp_addr(&ret->pppoe_pa, sid, addr) &&
  182. ret->pppoe_ifindex == ifindex) {
  183. *src = ret->next;
  184. break;
  185. }
  186. src = &ret->next;
  187. ret = ret->next;
  188. }
  189. }
  190. /**********************************************************************
  191. *
  192. * Set/get/delete/rehash items
  193. *
  194. **********************************************************************/
  195. static inline struct pppox_sock *get_item(struct pppoe_net *pn, __be16 sid,
  196. unsigned char *addr, int ifindex)
  197. {
  198. struct pppox_sock *po;
  199. read_lock_bh(&pn->hash_lock);
  200. po = __get_item(pn, sid, addr, ifindex);
  201. if (po)
  202. sock_hold(sk_pppox(po));
  203. read_unlock_bh(&pn->hash_lock);
  204. return po;
  205. }
  206. static inline struct pppox_sock *get_item_by_addr(struct net *net,
  207. struct sockaddr_pppox *sp)
  208. {
  209. struct net_device *dev;
  210. struct pppoe_net *pn;
  211. struct pppox_sock *pppox_sock = NULL;
  212. int ifindex;
  213. rcu_read_lock();
  214. dev = dev_get_by_name_rcu(net, sp->sa_addr.pppoe.dev);
  215. if (dev) {
  216. ifindex = dev->ifindex;
  217. pn = pppoe_pernet(net);
  218. pppox_sock = get_item(pn, sp->sa_addr.pppoe.sid,
  219. sp->sa_addr.pppoe.remote, ifindex);
  220. }
  221. rcu_read_unlock();
  222. return pppox_sock;
  223. }
  224. static inline void delete_item(struct pppoe_net *pn, __be16 sid,
  225. char *addr, int ifindex)
  226. {
  227. write_lock_bh(&pn->hash_lock);
  228. __delete_item(pn, sid, addr, ifindex);
  229. write_unlock_bh(&pn->hash_lock);
  230. }
  231. /***************************************************************************
  232. *
  233. * Handler for device events.
  234. * Certain device events require that sockets be unconnected.
  235. *
  236. **************************************************************************/
  237. static void pppoe_flush_dev(struct net_device *dev)
  238. {
  239. struct pppoe_net *pn;
  240. int i;
  241. pn = pppoe_pernet(dev_net(dev));
  242. write_lock_bh(&pn->hash_lock);
  243. for (i = 0; i < PPPOE_HASH_SIZE; i++) {
  244. struct pppox_sock *po = pn->hash_table[i];
  245. struct sock *sk;
  246. while (po) {
  247. while (po && po->pppoe_dev != dev) {
  248. po = po->next;
  249. }
  250. if (!po)
  251. break;
  252. sk = sk_pppox(po);
  253. /* We always grab the socket lock, followed by the
  254. * hash_lock, in that order. Since we should hold the
  255. * sock lock while doing any unbinding, we need to
  256. * release the lock we're holding. Hold a reference to
  257. * the sock so it doesn't disappear as we're jumping
  258. * between locks.
  259. */
  260. sock_hold(sk);
  261. write_unlock_bh(&pn->hash_lock);
  262. lock_sock(sk);
  263. if (po->pppoe_dev == dev &&
  264. sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
  265. pppox_unbind_sock(sk);
  266. sk->sk_state_change(sk);
  267. po->pppoe_dev = NULL;
  268. dev_put(dev);
  269. }
  270. release_sock(sk);
  271. sock_put(sk);
  272. /* Restart the process from the start of the current
  273. * hash chain. We dropped locks so the world may have
  274. * change from underneath us.
  275. */
  276. BUG_ON(pppoe_pernet(dev_net(dev)) == NULL);
  277. write_lock_bh(&pn->hash_lock);
  278. po = pn->hash_table[i];
  279. }
  280. }
  281. write_unlock_bh(&pn->hash_lock);
  282. }
  283. static int pppoe_device_event(struct notifier_block *this,
  284. unsigned long event, void *ptr)
  285. {
  286. struct net_device *dev = netdev_notifier_info_to_dev(ptr);
  287. /* Only look at sockets that are using this specific device. */
  288. switch (event) {
  289. case NETDEV_CHANGEADDR:
  290. case NETDEV_CHANGEMTU:
  291. /* A change in mtu or address is a bad thing, requiring
  292. * LCP re-negotiation.
  293. */
  294. case NETDEV_GOING_DOWN:
  295. case NETDEV_DOWN:
  296. /* Find every socket on this device and kill it. */
  297. pppoe_flush_dev(dev);
  298. break;
  299. default:
  300. break;
  301. }
  302. return NOTIFY_DONE;
  303. }
  304. static struct notifier_block pppoe_notifier = {
  305. .notifier_call = pppoe_device_event,
  306. };
  307. /************************************************************************
  308. *
  309. * Do the real work of receiving a PPPoE Session frame.
  310. *
  311. ***********************************************************************/
  312. static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
  313. {
  314. struct pppox_sock *po = pppox_sk(sk);
  315. struct pppox_sock *relay_po;
  316. /* Backlog receive. Semantics of backlog rcv preclude any code from
  317. * executing in lock_sock()/release_sock() bounds; meaning sk->sk_state
  318. * can't change.
  319. */
  320. if (skb->pkt_type == PACKET_OTHERHOST)
  321. goto abort_kfree;
  322. if (sk->sk_state & PPPOX_BOUND) {
  323. ppp_input(&po->chan, skb);
  324. } else if (sk->sk_state & PPPOX_RELAY) {
  325. relay_po = get_item_by_addr(sock_net(sk),
  326. &po->pppoe_relay);
  327. if (relay_po == NULL)
  328. goto abort_kfree;
  329. if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0)
  330. goto abort_put;
  331. if (!__pppoe_xmit(sk_pppox(relay_po), skb))
  332. goto abort_put;
  333. sock_put(sk_pppox(relay_po));
  334. } else {
  335. if (sock_queue_rcv_skb(sk, skb))
  336. goto abort_kfree;
  337. }
  338. return NET_RX_SUCCESS;
  339. abort_put:
  340. sock_put(sk_pppox(relay_po));
  341. abort_kfree:
  342. kfree_skb(skb);
  343. return NET_RX_DROP;
  344. }
  345. /************************************************************************
  346. *
  347. * Receive wrapper called in BH context.
  348. *
  349. ***********************************************************************/
  350. static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
  351. struct packet_type *pt, struct net_device *orig_dev)
  352. {
  353. struct pppoe_hdr *ph;
  354. struct pppox_sock *po;
  355. struct pppoe_net *pn;
  356. int len;
  357. skb = skb_share_check(skb, GFP_ATOMIC);
  358. if (!skb)
  359. goto out;
  360. if (skb_mac_header_len(skb) < ETH_HLEN)
  361. goto drop;
  362. if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
  363. goto drop;
  364. ph = pppoe_hdr(skb);
  365. len = ntohs(ph->length);
  366. skb_pull_rcsum(skb, sizeof(*ph));
  367. if (skb->len < len)
  368. goto drop;
  369. if (pskb_trim_rcsum(skb, len))
  370. goto drop;
  371. ph = pppoe_hdr(skb);
  372. pn = pppoe_pernet(dev_net(dev));
  373. /* Note that get_item does a sock_hold(), so sk_pppox(po)
  374. * is known to be safe.
  375. */
  376. po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
  377. if (!po)
  378. goto drop;
  379. return sk_receive_skb(sk_pppox(po), skb, 0);
  380. drop:
  381. kfree_skb(skb);
  382. out:
  383. return NET_RX_DROP;
  384. }
  385. static void pppoe_unbind_sock_work(struct work_struct *work)
  386. {
  387. struct pppox_sock *po = container_of(work, struct pppox_sock,
  388. proto.pppoe.padt_work);
  389. struct sock *sk = sk_pppox(po);
  390. lock_sock(sk);
  391. if (po->pppoe_dev) {
  392. dev_put(po->pppoe_dev);
  393. po->pppoe_dev = NULL;
  394. }
  395. pppox_unbind_sock(sk);
  396. release_sock(sk);
  397. sock_put(sk);
  398. }
  399. /************************************************************************
  400. *
  401. * Receive a PPPoE Discovery frame.
  402. * This is solely for detection of PADT frames
  403. *
  404. ***********************************************************************/
  405. static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev,
  406. struct packet_type *pt, struct net_device *orig_dev)
  407. {
  408. struct pppoe_hdr *ph;
  409. struct pppox_sock *po;
  410. struct pppoe_net *pn;
  411. skb = skb_share_check(skb, GFP_ATOMIC);
  412. if (!skb)
  413. goto out;
  414. if (skb->pkt_type != PACKET_HOST)
  415. goto abort;
  416. if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
  417. goto abort;
  418. ph = pppoe_hdr(skb);
  419. if (ph->code != PADT_CODE)
  420. goto abort;
  421. pn = pppoe_pernet(dev_net(dev));
  422. po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
  423. if (po)
  424. if (!schedule_work(&po->proto.pppoe.padt_work))
  425. sock_put(sk_pppox(po));
  426. abort:
  427. kfree_skb(skb);
  428. out:
  429. return NET_RX_SUCCESS; /* Lies... :-) */
  430. }
  431. static struct packet_type pppoes_ptype __read_mostly = {
  432. .type = cpu_to_be16(ETH_P_PPP_SES),
  433. .func = pppoe_rcv,
  434. };
  435. static struct packet_type pppoed_ptype __read_mostly = {
  436. .type = cpu_to_be16(ETH_P_PPP_DISC),
  437. .func = pppoe_disc_rcv,
  438. };
  439. static struct proto pppoe_sk_proto __read_mostly = {
  440. .name = "PPPOE",
  441. .owner = THIS_MODULE,
  442. .obj_size = sizeof(struct pppox_sock),
  443. };
  444. /***********************************************************************
  445. *
  446. * Initialize a new struct sock.
  447. *
  448. **********************************************************************/
  449. static int pppoe_create(struct net *net, struct socket *sock, int kern)
  450. {
  451. struct sock *sk;
  452. sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppoe_sk_proto, kern);
  453. if (!sk)
  454. return -ENOMEM;
  455. sock_init_data(sock, sk);
  456. sock->state = SS_UNCONNECTED;
  457. sock->ops = &pppoe_ops;
  458. sk->sk_backlog_rcv = pppoe_rcv_core;
  459. sk->sk_state = PPPOX_NONE;
  460. sk->sk_type = SOCK_STREAM;
  461. sk->sk_family = PF_PPPOX;
  462. sk->sk_protocol = PX_PROTO_OE;
  463. INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work,
  464. pppoe_unbind_sock_work);
  465. return 0;
  466. }
  467. static int pppoe_release(struct socket *sock)
  468. {
  469. struct sock *sk = sock->sk;
  470. struct pppox_sock *po;
  471. struct pppoe_net *pn;
  472. struct net *net = NULL;
  473. if (!sk)
  474. return 0;
  475. lock_sock(sk);
  476. if (sock_flag(sk, SOCK_DEAD)) {
  477. release_sock(sk);
  478. return -EBADF;
  479. }
  480. po = pppox_sk(sk);
  481. if (po->pppoe_dev) {
  482. dev_put(po->pppoe_dev);
  483. po->pppoe_dev = NULL;
  484. }
  485. pppox_unbind_sock(sk);
  486. /* Signal the death of the socket. */
  487. sk->sk_state = PPPOX_DEAD;
  488. net = sock_net(sk);
  489. pn = pppoe_pernet(net);
  490. /*
  491. * protect "po" from concurrent updates
  492. * on pppoe_flush_dev
  493. */
  494. delete_item(pn, po->pppoe_pa.sid, po->pppoe_pa.remote,
  495. po->pppoe_ifindex);
  496. sock_orphan(sk);
  497. sock->sk = NULL;
  498. skb_queue_purge(&sk->sk_receive_queue);
  499. release_sock(sk);
  500. sock_put(sk);
  501. return 0;
  502. }
  503. static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
  504. int sockaddr_len, int flags)
  505. {
  506. struct sock *sk = sock->sk;
  507. struct sockaddr_pppox *sp = (struct sockaddr_pppox *)uservaddr;
  508. struct pppox_sock *po = pppox_sk(sk);
  509. struct net_device *dev = NULL;
  510. struct pppoe_net *pn;
  511. struct net *net = NULL;
  512. int error;
  513. lock_sock(sk);
  514. error = -EINVAL;
  515. if (sockaddr_len != sizeof(struct sockaddr_pppox))
  516. goto end;
  517. if (sp->sa_protocol != PX_PROTO_OE)
  518. goto end;
  519. /* Check for already bound sockets */
  520. error = -EBUSY;
  521. if ((sk->sk_state & PPPOX_CONNECTED) &&
  522. stage_session(sp->sa_addr.pppoe.sid))
  523. goto end;
  524. /* Check for already disconnected sockets, on attempts to disconnect */
  525. error = -EALREADY;
  526. if ((sk->sk_state & PPPOX_DEAD) &&
  527. !stage_session(sp->sa_addr.pppoe.sid))
  528. goto end;
  529. error = 0;
  530. /* Delete the old binding */
  531. if (stage_session(po->pppoe_pa.sid)) {
  532. pppox_unbind_sock(sk);
  533. pn = pppoe_pernet(sock_net(sk));
  534. delete_item(pn, po->pppoe_pa.sid,
  535. po->pppoe_pa.remote, po->pppoe_ifindex);
  536. if (po->pppoe_dev) {
  537. dev_put(po->pppoe_dev);
  538. po->pppoe_dev = NULL;
  539. }
  540. po->pppoe_ifindex = 0;
  541. memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa));
  542. memset(&po->pppoe_relay, 0, sizeof(po->pppoe_relay));
  543. memset(&po->chan, 0, sizeof(po->chan));
  544. po->next = NULL;
  545. po->num = 0;
  546. sk->sk_state = PPPOX_NONE;
  547. }
  548. /* Re-bind in session stage only */
  549. if (stage_session(sp->sa_addr.pppoe.sid)) {
  550. error = -ENODEV;
  551. net = sock_net(sk);
  552. dev = dev_get_by_name(net, sp->sa_addr.pppoe.dev);
  553. if (!dev)
  554. goto err_put;
  555. po->pppoe_dev = dev;
  556. po->pppoe_ifindex = dev->ifindex;
  557. pn = pppoe_pernet(net);
  558. if (!(dev->flags & IFF_UP)) {
  559. goto err_put;
  560. }
  561. memcpy(&po->pppoe_pa,
  562. &sp->sa_addr.pppoe,
  563. sizeof(struct pppoe_addr));
  564. write_lock_bh(&pn->hash_lock);
  565. error = __set_item(pn, po);
  566. write_unlock_bh(&pn->hash_lock);
  567. if (error < 0)
  568. goto err_put;
  569. po->chan.hdrlen = (sizeof(struct pppoe_hdr) +
  570. dev->hard_header_len);
  571. po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2;
  572. po->chan.private = sk;
  573. po->chan.ops = &pppoe_chan_ops;
  574. error = ppp_register_net_channel(dev_net(dev), &po->chan);
  575. if (error) {
  576. delete_item(pn, po->pppoe_pa.sid,
  577. po->pppoe_pa.remote, po->pppoe_ifindex);
  578. goto err_put;
  579. }
  580. sk->sk_state = PPPOX_CONNECTED;
  581. }
  582. po->num = sp->sa_addr.pppoe.sid;
  583. end:
  584. release_sock(sk);
  585. return error;
  586. err_put:
  587. if (po->pppoe_dev) {
  588. dev_put(po->pppoe_dev);
  589. po->pppoe_dev = NULL;
  590. }
  591. goto end;
  592. }
  593. static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr,
  594. int peer)
  595. {
  596. int len = sizeof(struct sockaddr_pppox);
  597. struct sockaddr_pppox sp;
  598. sp.sa_family = AF_PPPOX;
  599. sp.sa_protocol = PX_PROTO_OE;
  600. memcpy(&sp.sa_addr.pppoe, &pppox_sk(sock->sk)->pppoe_pa,
  601. sizeof(struct pppoe_addr));
  602. memcpy(uaddr, &sp, len);
  603. return len;
  604. }
  605. static int pppoe_ioctl(struct socket *sock, unsigned int cmd,
  606. unsigned long arg)
  607. {
  608. struct sock *sk = sock->sk;
  609. struct pppox_sock *po = pppox_sk(sk);
  610. int val;
  611. int err;
  612. switch (cmd) {
  613. case PPPIOCGMRU:
  614. err = -ENXIO;
  615. if (!(sk->sk_state & PPPOX_CONNECTED))
  616. break;
  617. err = -EFAULT;
  618. if (put_user(po->pppoe_dev->mtu -
  619. sizeof(struct pppoe_hdr) -
  620. PPP_HDRLEN,
  621. (int __user *)arg))
  622. break;
  623. err = 0;
  624. break;
  625. case PPPIOCSMRU:
  626. err = -ENXIO;
  627. if (!(sk->sk_state & PPPOX_CONNECTED))
  628. break;
  629. err = -EFAULT;
  630. if (get_user(val, (int __user *)arg))
  631. break;
  632. if (val < (po->pppoe_dev->mtu
  633. - sizeof(struct pppoe_hdr)
  634. - PPP_HDRLEN))
  635. err = 0;
  636. else
  637. err = -EINVAL;
  638. break;
  639. case PPPIOCSFLAGS:
  640. err = -EFAULT;
  641. if (get_user(val, (int __user *)arg))
  642. break;
  643. err = 0;
  644. break;
  645. case PPPOEIOCSFWD:
  646. {
  647. struct pppox_sock *relay_po;
  648. err = -EBUSY;
  649. if (sk->sk_state & (PPPOX_BOUND | PPPOX_DEAD))
  650. break;
  651. err = -ENOTCONN;
  652. if (!(sk->sk_state & PPPOX_CONNECTED))
  653. break;
  654. /* PPPoE address from the user specifies an outbound
  655. PPPoE address which frames are forwarded to */
  656. err = -EFAULT;
  657. if (copy_from_user(&po->pppoe_relay,
  658. (void __user *)arg,
  659. sizeof(struct sockaddr_pppox)))
  660. break;
  661. err = -EINVAL;
  662. if (po->pppoe_relay.sa_family != AF_PPPOX ||
  663. po->pppoe_relay.sa_protocol != PX_PROTO_OE)
  664. break;
  665. /* Check that the socket referenced by the address
  666. actually exists. */
  667. relay_po = get_item_by_addr(sock_net(sk), &po->pppoe_relay);
  668. if (!relay_po)
  669. break;
  670. sock_put(sk_pppox(relay_po));
  671. sk->sk_state |= PPPOX_RELAY;
  672. err = 0;
  673. break;
  674. }
  675. case PPPOEIOCDFWD:
  676. err = -EALREADY;
  677. if (!(sk->sk_state & PPPOX_RELAY))
  678. break;
  679. sk->sk_state &= ~PPPOX_RELAY;
  680. err = 0;
  681. break;
  682. default:
  683. err = -ENOTTY;
  684. }
  685. return err;
  686. }
  687. static int pppoe_sendmsg(struct socket *sock, struct msghdr *m,
  688. size_t total_len)
  689. {
  690. struct sk_buff *skb;
  691. struct sock *sk = sock->sk;
  692. struct pppox_sock *po = pppox_sk(sk);
  693. int error;
  694. struct pppoe_hdr hdr;
  695. struct pppoe_hdr *ph;
  696. struct net_device *dev;
  697. char *start;
  698. int hlen;
  699. lock_sock(sk);
  700. if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) {
  701. error = -ENOTCONN;
  702. goto end;
  703. }
  704. hdr.ver = 1;
  705. hdr.type = 1;
  706. hdr.code = 0;
  707. hdr.sid = po->num;
  708. dev = po->pppoe_dev;
  709. error = -EMSGSIZE;
  710. if (total_len > (dev->mtu + dev->hard_header_len))
  711. goto end;
  712. hlen = LL_RESERVED_SPACE(dev);
  713. skb = sock_wmalloc(sk, hlen + sizeof(*ph) + total_len +
  714. dev->needed_tailroom, 0, GFP_KERNEL);
  715. if (!skb) {
  716. error = -ENOMEM;
  717. goto end;
  718. }
  719. /* Reserve space for headers. */
  720. skb_reserve(skb, hlen);
  721. skb_reset_network_header(skb);
  722. skb->dev = dev;
  723. skb->priority = sk->sk_priority;
  724. skb->protocol = cpu_to_be16(ETH_P_PPP_SES);
  725. ph = skb_put(skb, total_len + sizeof(struct pppoe_hdr));
  726. start = (char *)&ph->tag[0];
  727. error = memcpy_from_msg(start, m, total_len);
  728. if (error < 0) {
  729. kfree_skb(skb);
  730. goto end;
  731. }
  732. error = total_len;
  733. dev_hard_header(skb, dev, ETH_P_PPP_SES,
  734. po->pppoe_pa.remote, NULL, total_len);
  735. memcpy(ph, &hdr, sizeof(struct pppoe_hdr));
  736. ph->length = htons(total_len);
  737. dev_queue_xmit(skb);
  738. end:
  739. release_sock(sk);
  740. return error;
  741. }
  742. /************************************************************************
  743. *
  744. * xmit function for internal use.
  745. *
  746. ***********************************************************************/
  747. static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
  748. {
  749. struct pppox_sock *po = pppox_sk(sk);
  750. struct net_device *dev = po->pppoe_dev;
  751. struct pppoe_hdr *ph;
  752. int data_len = skb->len;
  753. /* The higher-level PPP code (ppp_unregister_channel()) ensures the PPP
  754. * xmit operations conclude prior to an unregistration call. Thus
  755. * sk->sk_state cannot change, so we don't need to do lock_sock().
  756. * But, we also can't do a lock_sock since that introduces a potential
  757. * deadlock as we'd reverse the lock ordering used when calling
  758. * ppp_unregister_channel().
  759. */
  760. if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
  761. goto abort;
  762. if (!dev)
  763. goto abort;
  764. /* Copy the data if there is no space for the header or if it's
  765. * read-only.
  766. */
  767. if (skb_cow_head(skb, LL_RESERVED_SPACE(dev) + sizeof(*ph)))
  768. goto abort;
  769. __skb_push(skb, sizeof(*ph));
  770. skb_reset_network_header(skb);
  771. ph = pppoe_hdr(skb);
  772. ph->ver = 1;
  773. ph->type = 1;
  774. ph->code = 0;
  775. ph->sid = po->num;
  776. ph->length = htons(data_len);
  777. skb->protocol = cpu_to_be16(ETH_P_PPP_SES);
  778. skb->dev = dev;
  779. dev_hard_header(skb, dev, ETH_P_PPP_SES,
  780. po->pppoe_pa.remote, NULL, data_len);
  781. dev_queue_xmit(skb);
  782. return 1;
  783. abort:
  784. kfree_skb(skb);
  785. return 1;
  786. }
  787. /************************************************************************
  788. *
  789. * xmit function called by generic PPP driver
  790. * sends PPP frame over PPPoE socket
  791. *
  792. ***********************************************************************/
  793. static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb)
  794. {
  795. struct sock *sk = (struct sock *)chan->private;
  796. return __pppoe_xmit(sk, skb);
  797. }
  798. static const struct ppp_channel_ops pppoe_chan_ops = {
  799. .start_xmit = pppoe_xmit,
  800. };
  801. static int pppoe_recvmsg(struct socket *sock, struct msghdr *m,
  802. size_t total_len, int flags)
  803. {
  804. struct sock *sk = sock->sk;
  805. struct sk_buff *skb;
  806. int error = 0;
  807. if (sk->sk_state & PPPOX_BOUND) {
  808. error = -EIO;
  809. goto end;
  810. }
  811. skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
  812. flags & MSG_DONTWAIT, &error);
  813. if (error < 0)
  814. goto end;
  815. if (skb) {
  816. total_len = min_t(size_t, total_len, skb->len);
  817. error = skb_copy_datagram_msg(skb, 0, m, total_len);
  818. if (error == 0) {
  819. consume_skb(skb);
  820. return total_len;
  821. }
  822. }
  823. kfree_skb(skb);
  824. end:
  825. return error;
  826. }
  827. #ifdef CONFIG_PROC_FS
  828. static int pppoe_seq_show(struct seq_file *seq, void *v)
  829. {
  830. struct pppox_sock *po;
  831. char *dev_name;
  832. if (v == SEQ_START_TOKEN) {
  833. seq_puts(seq, "Id Address Device\n");
  834. goto out;
  835. }
  836. po = v;
  837. dev_name = po->pppoe_pa.dev;
  838. seq_printf(seq, "%08X %pM %8s\n",
  839. po->pppoe_pa.sid, po->pppoe_pa.remote, dev_name);
  840. out:
  841. return 0;
  842. }
  843. static inline struct pppox_sock *pppoe_get_idx(struct pppoe_net *pn, loff_t pos)
  844. {
  845. struct pppox_sock *po;
  846. int i;
  847. for (i = 0; i < PPPOE_HASH_SIZE; i++) {
  848. po = pn->hash_table[i];
  849. while (po) {
  850. if (!pos--)
  851. goto out;
  852. po = po->next;
  853. }
  854. }
  855. out:
  856. return po;
  857. }
  858. static void *pppoe_seq_start(struct seq_file *seq, loff_t *pos)
  859. __acquires(pn->hash_lock)
  860. {
  861. struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq));
  862. loff_t l = *pos;
  863. read_lock_bh(&pn->hash_lock);
  864. return l ? pppoe_get_idx(pn, --l) : SEQ_START_TOKEN;
  865. }
  866. static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos)
  867. {
  868. struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq));
  869. struct pppox_sock *po;
  870. ++*pos;
  871. if (v == SEQ_START_TOKEN) {
  872. po = pppoe_get_idx(pn, 0);
  873. goto out;
  874. }
  875. po = v;
  876. if (po->next)
  877. po = po->next;
  878. else {
  879. int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
  880. po = NULL;
  881. while (++hash < PPPOE_HASH_SIZE) {
  882. po = pn->hash_table[hash];
  883. if (po)
  884. break;
  885. }
  886. }
  887. out:
  888. return po;
  889. }
  890. static void pppoe_seq_stop(struct seq_file *seq, void *v)
  891. __releases(pn->hash_lock)
  892. {
  893. struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq));
  894. read_unlock_bh(&pn->hash_lock);
  895. }
  896. static const struct seq_operations pppoe_seq_ops = {
  897. .start = pppoe_seq_start,
  898. .next = pppoe_seq_next,
  899. .stop = pppoe_seq_stop,
  900. .show = pppoe_seq_show,
  901. };
  902. #endif /* CONFIG_PROC_FS */
  903. static const struct proto_ops pppoe_ops = {
  904. .family = AF_PPPOX,
  905. .owner = THIS_MODULE,
  906. .release = pppoe_release,
  907. .bind = sock_no_bind,
  908. .connect = pppoe_connect,
  909. .socketpair = sock_no_socketpair,
  910. .accept = sock_no_accept,
  911. .getname = pppoe_getname,
  912. .poll = datagram_poll,
  913. .listen = sock_no_listen,
  914. .shutdown = sock_no_shutdown,
  915. .setsockopt = sock_no_setsockopt,
  916. .getsockopt = sock_no_getsockopt,
  917. .sendmsg = pppoe_sendmsg,
  918. .recvmsg = pppoe_recvmsg,
  919. .mmap = sock_no_mmap,
  920. .ioctl = pppox_ioctl,
  921. #ifdef CONFIG_COMPAT
  922. .compat_ioctl = pppox_compat_ioctl,
  923. #endif
  924. };
  925. static const struct pppox_proto pppoe_proto = {
  926. .create = pppoe_create,
  927. .ioctl = pppoe_ioctl,
  928. .owner = THIS_MODULE,
  929. };
  930. static __net_init int pppoe_init_net(struct net *net)
  931. {
  932. struct pppoe_net *pn = pppoe_pernet(net);
  933. struct proc_dir_entry *pde;
  934. rwlock_init(&pn->hash_lock);
  935. pde = proc_create_net("pppoe", 0444, net->proc_net,
  936. &pppoe_seq_ops, sizeof(struct seq_net_private));
  937. #ifdef CONFIG_PROC_FS
  938. if (!pde)
  939. return -ENOMEM;
  940. #endif
  941. return 0;
  942. }
  943. static __net_exit void pppoe_exit_net(struct net *net)
  944. {
  945. remove_proc_entry("pppoe", net->proc_net);
  946. }
  947. static struct pernet_operations pppoe_net_ops = {
  948. .init = pppoe_init_net,
  949. .exit = pppoe_exit_net,
  950. .id = &pppoe_net_id,
  951. .size = sizeof(struct pppoe_net),
  952. };
  953. static int __init pppoe_init(void)
  954. {
  955. int err;
  956. err = register_pernet_device(&pppoe_net_ops);
  957. if (err)
  958. goto out;
  959. err = proto_register(&pppoe_sk_proto, 0);
  960. if (err)
  961. goto out_unregister_net_ops;
  962. err = register_pppox_proto(PX_PROTO_OE, &pppoe_proto);
  963. if (err)
  964. goto out_unregister_pppoe_proto;
  965. dev_add_pack(&pppoes_ptype);
  966. dev_add_pack(&pppoed_ptype);
  967. register_netdevice_notifier(&pppoe_notifier);
  968. return 0;
  969. out_unregister_pppoe_proto:
  970. proto_unregister(&pppoe_sk_proto);
  971. out_unregister_net_ops:
  972. unregister_pernet_device(&pppoe_net_ops);
  973. out:
  974. return err;
  975. }
  976. static void __exit pppoe_exit(void)
  977. {
  978. unregister_netdevice_notifier(&pppoe_notifier);
  979. dev_remove_pack(&pppoed_ptype);
  980. dev_remove_pack(&pppoes_ptype);
  981. unregister_pppox_proto(PX_PROTO_OE);
  982. proto_unregister(&pppoe_sk_proto);
  983. unregister_pernet_device(&pppoe_net_ops);
  984. }
  985. module_init(pppoe_init);
  986. module_exit(pppoe_exit);
  987. MODULE_AUTHOR("Michal Ostrowski <mostrows@speakeasy.net>");
  988. MODULE_DESCRIPTION("PPP over Ethernet driver");
  989. MODULE_LICENSE("GPL");
  990. MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OE);