pppoe.c 28 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /** -*- linux-c -*- ***********************************************************
  3. * Linux PPP over Ethernet (PPPoX/PPPoE) Sockets
  4. *
  5. * PPPoX --- Generic PPP encapsulation socket family
  6. * PPPoE --- PPP over Ethernet (RFC 2516)
  7. *
  8. * Version: 0.7.0
  9. *
  10. * 070228 : Fix to allow multiple sessions with same remote MAC and same
  11. * session id by including the local device ifindex in the
  12. * tuple identifying a session. This also ensures packets can't
  13. * be injected into a session from interfaces other than the one
  14. * specified by userspace. Florian Zumbiehl <[email protected]>
  15. * (Oh, BTW, this one is YYMMDD, in case you were wondering ...)
  16. * 220102 : Fix module use count on failure in pppoe_create, pppox_sk -acme
  17. * 030700 : Fixed connect logic to allow for disconnect.
  18. * 270700 : Fixed potential SMP problems; we must protect against
  19. * simultaneous invocation of ppp_input
  20. * and ppp_unregister_channel.
  21. * 040800 : Respect reference count mechanisms on net-devices.
  22. * 200800 : fix kfree(skb) in pppoe_rcv (acme)
  23. * Module reference count is decremented in the right spot now,
  24. * guards against sock_put not actually freeing the sk
  25. * in pppoe_release.
  26. * 051000 : Initialization cleanup.
  27. * 111100 : Fix recvmsg.
  28. * 050101 : Fix PADT processing.
  29. * 140501 : Use pppoe_rcv_core to handle all backlog. (Alexey)
  30. * 170701 : Do not lock_sock with rwlock held. (DaveM)
  31. * Ignore discovery frames if user has socket
  32. * locked. (DaveM)
  33. * Ignore return value of dev_queue_xmit in __pppoe_xmit
  34. * or else we may kfree an SKB twice. (DaveM)
  35. * 190701 : When doing copies of skb's in __pppoe_xmit, always delete
  36. * the original skb that was passed in on success, never on
  37. * failure. Delete the copy of the skb on failure to avoid
  38. * a memory leak.
  39. * 081001 : Misc. cleanup (licence string, non-blocking, prevent
  40. * reference of device on close).
  41. * 121301 : New ppp channels interface; cannot unregister a channel
  42. * from interrupts. Thus, we mark the socket as a ZOMBIE
  43. * and do the unregistration later.
  44. * 081002 : seq_file support for proc stuff -acme
  45. * 111602 : Merge all 2.4 fixes into 2.5/2.6 tree. Label 2.5/2.6
  46. * as version 0.7. Spacing cleanup.
  47. * Author: Michal Ostrowski <[email protected]>
  48. * Contributors:
  49. * Arnaldo Carvalho de Melo <[email protected]>
  50. * David S. Miller ([email protected])
  51. *
  52. * License:
  53. */
  54. #include <linux/string.h>
  55. #include <linux/module.h>
  56. #include <linux/kernel.h>
  57. #include <linux/slab.h>
  58. #include <linux/errno.h>
  59. #include <linux/netdevice.h>
  60. #include <linux/net.h>
  61. #include <linux/inetdevice.h>
  62. #include <linux/etherdevice.h>
  63. #include <linux/skbuff.h>
  64. #include <linux/init.h>
  65. #include <linux/if_ether.h>
  66. #include <linux/if_pppox.h>
  67. #include <linux/ppp_channel.h>
  68. #include <linux/ppp_defs.h>
  69. #include <linux/ppp-ioctl.h>
  70. #include <linux/notifier.h>
  71. #include <linux/file.h>
  72. #include <linux/proc_fs.h>
  73. #include <linux/seq_file.h>
  74. #include <linux/nsproxy.h>
  75. #include <net/net_namespace.h>
  76. #include <net/netns/generic.h>
  77. #include <net/sock.h>
  78. #include <linux/uaccess.h>
  79. #define PPPOE_HASH_BITS 4
  80. #define PPPOE_HASH_SIZE (1 << PPPOE_HASH_BITS)
  81. #define PPPOE_HASH_MASK (PPPOE_HASH_SIZE - 1)
  82. static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb);
  83. static const struct proto_ops pppoe_ops;
  84. static const struct ppp_channel_ops pppoe_chan_ops;
  85. /* per-net private data for this module */
  86. static unsigned int pppoe_net_id __read_mostly;
  87. struct pppoe_net {
  88. /*
  89. * we could use _single_ hash table for all
  90. * nets by injecting net id into the hash but
  91. * it would increase hash chains and add
  92. * a few additional math comparisons messy
  93. * as well, moreover in case of SMP less locking
  94. * controversy here
  95. */
  96. struct pppox_sock *hash_table[PPPOE_HASH_SIZE];
  97. rwlock_t hash_lock;
  98. };
  99. /*
  100. * PPPoE could be in the following stages:
  101. * 1) Discovery stage (to obtain remote MAC and Session ID)
  102. * 2) Session stage (MAC and SID are known)
  103. *
  104. * Ethernet frames have a special tag for this but
  105. * we use simpler approach based on session id
  106. */
  107. static inline bool stage_session(__be16 sid)
  108. {
  109. return sid != 0;
  110. }
  111. static inline struct pppoe_net *pppoe_pernet(struct net *net)
  112. {
  113. return net_generic(net, pppoe_net_id);
  114. }
  115. static inline int cmp_2_addr(struct pppoe_addr *a, struct pppoe_addr *b)
  116. {
  117. return a->sid == b->sid && ether_addr_equal(a->remote, b->remote);
  118. }
  119. static inline int cmp_addr(struct pppoe_addr *a, __be16 sid, char *addr)
  120. {
  121. return a->sid == sid && ether_addr_equal(a->remote, addr);
  122. }
  123. #if 8 % PPPOE_HASH_BITS
  124. #error 8 must be a multiple of PPPOE_HASH_BITS
  125. #endif
  126. static int hash_item(__be16 sid, unsigned char *addr)
  127. {
  128. unsigned char hash = 0;
  129. unsigned int i;
  130. for (i = 0; i < ETH_ALEN; i++)
  131. hash ^= addr[i];
  132. for (i = 0; i < sizeof(sid_t) * 8; i += 8)
  133. hash ^= (__force __u32)sid >> i;
  134. for (i = 8; (i >>= 1) >= PPPOE_HASH_BITS;)
  135. hash ^= hash >> i;
  136. return hash & PPPOE_HASH_MASK;
  137. }
  138. /**********************************************************************
  139. *
  140. * Set/get/delete/rehash items (internal versions)
  141. *
  142. **********************************************************************/
  143. static struct pppox_sock *__get_item(struct pppoe_net *pn, __be16 sid,
  144. unsigned char *addr, int ifindex)
  145. {
  146. int hash = hash_item(sid, addr);
  147. struct pppox_sock *ret;
  148. ret = pn->hash_table[hash];
  149. while (ret) {
  150. if (cmp_addr(&ret->pppoe_pa, sid, addr) &&
  151. ret->pppoe_ifindex == ifindex)
  152. return ret;
  153. ret = ret->next;
  154. }
  155. return NULL;
  156. }
  157. static int __set_item(struct pppoe_net *pn, struct pppox_sock *po)
  158. {
  159. int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
  160. struct pppox_sock *ret;
  161. ret = pn->hash_table[hash];
  162. while (ret) {
  163. if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa) &&
  164. ret->pppoe_ifindex == po->pppoe_ifindex)
  165. return -EALREADY;
  166. ret = ret->next;
  167. }
  168. po->next = pn->hash_table[hash];
  169. pn->hash_table[hash] = po;
  170. return 0;
  171. }
  172. static void __delete_item(struct pppoe_net *pn, __be16 sid,
  173. char *addr, int ifindex)
  174. {
  175. int hash = hash_item(sid, addr);
  176. struct pppox_sock *ret, **src;
  177. ret = pn->hash_table[hash];
  178. src = &pn->hash_table[hash];
  179. while (ret) {
  180. if (cmp_addr(&ret->pppoe_pa, sid, addr) &&
  181. ret->pppoe_ifindex == ifindex) {
  182. *src = ret->next;
  183. break;
  184. }
  185. src = &ret->next;
  186. ret = ret->next;
  187. }
  188. }
  189. /**********************************************************************
  190. *
  191. * Set/get/delete/rehash items
  192. *
  193. **********************************************************************/
  194. static inline struct pppox_sock *get_item(struct pppoe_net *pn, __be16 sid,
  195. unsigned char *addr, int ifindex)
  196. {
  197. struct pppox_sock *po;
  198. read_lock_bh(&pn->hash_lock);
  199. po = __get_item(pn, sid, addr, ifindex);
  200. if (po)
  201. sock_hold(sk_pppox(po));
  202. read_unlock_bh(&pn->hash_lock);
  203. return po;
  204. }
  205. static inline struct pppox_sock *get_item_by_addr(struct net *net,
  206. struct sockaddr_pppox *sp)
  207. {
  208. struct net_device *dev;
  209. struct pppoe_net *pn;
  210. struct pppox_sock *pppox_sock = NULL;
  211. int ifindex;
  212. rcu_read_lock();
  213. dev = dev_get_by_name_rcu(net, sp->sa_addr.pppoe.dev);
  214. if (dev) {
  215. ifindex = dev->ifindex;
  216. pn = pppoe_pernet(net);
  217. pppox_sock = get_item(pn, sp->sa_addr.pppoe.sid,
  218. sp->sa_addr.pppoe.remote, ifindex);
  219. }
  220. rcu_read_unlock();
  221. return pppox_sock;
  222. }
  223. static inline void delete_item(struct pppoe_net *pn, __be16 sid,
  224. char *addr, int ifindex)
  225. {
  226. write_lock_bh(&pn->hash_lock);
  227. __delete_item(pn, sid, addr, ifindex);
  228. write_unlock_bh(&pn->hash_lock);
  229. }
  230. /***************************************************************************
  231. *
  232. * Handler for device events.
  233. * Certain device events require that sockets be unconnected.
  234. *
  235. **************************************************************************/
  236. static void pppoe_flush_dev(struct net_device *dev)
  237. {
  238. struct pppoe_net *pn;
  239. int i;
  240. pn = pppoe_pernet(dev_net(dev));
  241. write_lock_bh(&pn->hash_lock);
  242. for (i = 0; i < PPPOE_HASH_SIZE; i++) {
  243. struct pppox_sock *po = pn->hash_table[i];
  244. struct sock *sk;
  245. while (po) {
  246. while (po && po->pppoe_dev != dev) {
  247. po = po->next;
  248. }
  249. if (!po)
  250. break;
  251. sk = sk_pppox(po);
  252. /* We always grab the socket lock, followed by the
  253. * hash_lock, in that order. Since we should hold the
  254. * sock lock while doing any unbinding, we need to
  255. * release the lock we're holding. Hold a reference to
  256. * the sock so it doesn't disappear as we're jumping
  257. * between locks.
  258. */
  259. sock_hold(sk);
  260. write_unlock_bh(&pn->hash_lock);
  261. lock_sock(sk);
  262. if (po->pppoe_dev == dev &&
  263. sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
  264. pppox_unbind_sock(sk);
  265. sk->sk_state_change(sk);
  266. po->pppoe_dev = NULL;
  267. dev_put(dev);
  268. }
  269. release_sock(sk);
  270. sock_put(sk);
  271. /* Restart the process from the start of the current
  272. * hash chain. We dropped locks so the world may have
  273. * change from underneath us.
  274. */
  275. BUG_ON(pppoe_pernet(dev_net(dev)) == NULL);
  276. write_lock_bh(&pn->hash_lock);
  277. po = pn->hash_table[i];
  278. }
  279. }
  280. write_unlock_bh(&pn->hash_lock);
  281. }
  282. static int pppoe_device_event(struct notifier_block *this,
  283. unsigned long event, void *ptr)
  284. {
  285. struct net_device *dev = netdev_notifier_info_to_dev(ptr);
  286. /* Only look at sockets that are using this specific device. */
  287. switch (event) {
  288. case NETDEV_CHANGEADDR:
  289. case NETDEV_CHANGEMTU:
  290. /* A change in mtu or address is a bad thing, requiring
  291. * LCP re-negotiation.
  292. */
  293. case NETDEV_GOING_DOWN:
  294. case NETDEV_DOWN:
  295. /* Find every socket on this device and kill it. */
  296. pppoe_flush_dev(dev);
  297. break;
  298. default:
  299. break;
  300. }
  301. return NOTIFY_DONE;
  302. }
  303. static struct notifier_block pppoe_notifier = {
  304. .notifier_call = pppoe_device_event,
  305. };
  306. /************************************************************************
  307. *
  308. * Do the real work of receiving a PPPoE Session frame.
  309. *
  310. ***********************************************************************/
  311. static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
  312. {
  313. struct pppox_sock *po = pppox_sk(sk);
  314. struct pppox_sock *relay_po;
  315. /* Backlog receive. Semantics of backlog rcv preclude any code from
  316. * executing in lock_sock()/release_sock() bounds; meaning sk->sk_state
  317. * can't change.
  318. */
  319. if (skb->pkt_type == PACKET_OTHERHOST)
  320. goto abort_kfree;
  321. if (sk->sk_state & PPPOX_BOUND) {
  322. ppp_input(&po->chan, skb);
  323. } else if (sk->sk_state & PPPOX_RELAY) {
  324. relay_po = get_item_by_addr(sock_net(sk),
  325. &po->pppoe_relay);
  326. if (relay_po == NULL)
  327. goto abort_kfree;
  328. if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0)
  329. goto abort_put;
  330. if (!__pppoe_xmit(sk_pppox(relay_po), skb))
  331. goto abort_put;
  332. sock_put(sk_pppox(relay_po));
  333. } else {
  334. if (sock_queue_rcv_skb(sk, skb))
  335. goto abort_kfree;
  336. }
  337. return NET_RX_SUCCESS;
  338. abort_put:
  339. sock_put(sk_pppox(relay_po));
  340. abort_kfree:
  341. kfree_skb(skb);
  342. return NET_RX_DROP;
  343. }
  344. /************************************************************************
  345. *
  346. * Receive wrapper called in BH context.
  347. *
  348. ***********************************************************************/
  349. static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
  350. struct packet_type *pt, struct net_device *orig_dev)
  351. {
  352. struct pppoe_hdr *ph;
  353. struct pppox_sock *po;
  354. struct pppoe_net *pn;
  355. int len;
  356. skb = skb_share_check(skb, GFP_ATOMIC);
  357. if (!skb)
  358. goto out;
  359. if (skb_mac_header_len(skb) < ETH_HLEN)
  360. goto drop;
  361. if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
  362. goto drop;
  363. ph = pppoe_hdr(skb);
  364. len = ntohs(ph->length);
  365. skb_pull_rcsum(skb, sizeof(*ph));
  366. if (skb->len < len)
  367. goto drop;
  368. if (pskb_trim_rcsum(skb, len))
  369. goto drop;
  370. ph = pppoe_hdr(skb);
  371. pn = pppoe_pernet(dev_net(dev));
  372. /* Note that get_item does a sock_hold(), so sk_pppox(po)
  373. * is known to be safe.
  374. */
  375. po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
  376. if (!po)
  377. goto drop;
  378. return sk_receive_skb(sk_pppox(po), skb, 0);
  379. drop:
  380. kfree_skb(skb);
  381. out:
  382. return NET_RX_DROP;
  383. }
  384. static void pppoe_unbind_sock_work(struct work_struct *work)
  385. {
  386. struct pppox_sock *po = container_of(work, struct pppox_sock,
  387. proto.pppoe.padt_work);
  388. struct sock *sk = sk_pppox(po);
  389. lock_sock(sk);
  390. if (po->pppoe_dev) {
  391. dev_put(po->pppoe_dev);
  392. po->pppoe_dev = NULL;
  393. }
  394. pppox_unbind_sock(sk);
  395. release_sock(sk);
  396. sock_put(sk);
  397. }
  398. /************************************************************************
  399. *
  400. * Receive a PPPoE Discovery frame.
  401. * This is solely for detection of PADT frames
  402. *
  403. ***********************************************************************/
  404. static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev,
  405. struct packet_type *pt, struct net_device *orig_dev)
  406. {
  407. struct pppoe_hdr *ph;
  408. struct pppox_sock *po;
  409. struct pppoe_net *pn;
  410. skb = skb_share_check(skb, GFP_ATOMIC);
  411. if (!skb)
  412. goto out;
  413. if (skb->pkt_type != PACKET_HOST)
  414. goto abort;
  415. if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
  416. goto abort;
  417. ph = pppoe_hdr(skb);
  418. if (ph->code != PADT_CODE)
  419. goto abort;
  420. pn = pppoe_pernet(dev_net(dev));
  421. po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
  422. if (po)
  423. if (!schedule_work(&po->proto.pppoe.padt_work))
  424. sock_put(sk_pppox(po));
  425. abort:
  426. kfree_skb(skb);
  427. out:
  428. return NET_RX_SUCCESS; /* Lies... :-) */
  429. }
  430. static struct packet_type pppoes_ptype __read_mostly = {
  431. .type = cpu_to_be16(ETH_P_PPP_SES),
  432. .func = pppoe_rcv,
  433. };
  434. static struct packet_type pppoed_ptype __read_mostly = {
  435. .type = cpu_to_be16(ETH_P_PPP_DISC),
  436. .func = pppoe_disc_rcv,
  437. };
  438. static struct proto pppoe_sk_proto __read_mostly = {
  439. .name = "PPPOE",
  440. .owner = THIS_MODULE,
  441. .obj_size = sizeof(struct pppox_sock),
  442. };
  443. /***********************************************************************
  444. *
  445. * Initialize a new struct sock.
  446. *
  447. **********************************************************************/
  448. static int pppoe_create(struct net *net, struct socket *sock, int kern)
  449. {
  450. struct sock *sk;
  451. sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppoe_sk_proto, kern);
  452. if (!sk)
  453. return -ENOMEM;
  454. sock_init_data(sock, sk);
  455. sock->state = SS_UNCONNECTED;
  456. sock->ops = &pppoe_ops;
  457. sk->sk_backlog_rcv = pppoe_rcv_core;
  458. sk->sk_state = PPPOX_NONE;
  459. sk->sk_type = SOCK_STREAM;
  460. sk->sk_family = PF_PPPOX;
  461. sk->sk_protocol = PX_PROTO_OE;
  462. INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work,
  463. pppoe_unbind_sock_work);
  464. return 0;
  465. }
  466. static int pppoe_release(struct socket *sock)
  467. {
  468. struct sock *sk = sock->sk;
  469. struct pppox_sock *po;
  470. struct pppoe_net *pn;
  471. struct net *net = NULL;
  472. if (!sk)
  473. return 0;
  474. lock_sock(sk);
  475. if (sock_flag(sk, SOCK_DEAD)) {
  476. release_sock(sk);
  477. return -EBADF;
  478. }
  479. po = pppox_sk(sk);
  480. if (po->pppoe_dev) {
  481. dev_put(po->pppoe_dev);
  482. po->pppoe_dev = NULL;
  483. }
  484. pppox_unbind_sock(sk);
  485. /* Signal the death of the socket. */
  486. sk->sk_state = PPPOX_DEAD;
  487. net = sock_net(sk);
  488. pn = pppoe_pernet(net);
  489. /*
  490. * protect "po" from concurrent updates
  491. * on pppoe_flush_dev
  492. */
  493. delete_item(pn, po->pppoe_pa.sid, po->pppoe_pa.remote,
  494. po->pppoe_ifindex);
  495. sock_orphan(sk);
  496. sock->sk = NULL;
  497. skb_queue_purge(&sk->sk_receive_queue);
  498. release_sock(sk);
  499. sock_put(sk);
  500. return 0;
  501. }
  502. static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
  503. int sockaddr_len, int flags)
  504. {
  505. struct sock *sk = sock->sk;
  506. struct sockaddr_pppox *sp = (struct sockaddr_pppox *)uservaddr;
  507. struct pppox_sock *po = pppox_sk(sk);
  508. struct net_device *dev = NULL;
  509. struct pppoe_net *pn;
  510. struct net *net = NULL;
  511. int error;
  512. lock_sock(sk);
  513. error = -EINVAL;
  514. if (sockaddr_len != sizeof(struct sockaddr_pppox))
  515. goto end;
  516. if (sp->sa_protocol != PX_PROTO_OE)
  517. goto end;
  518. /* Check for already bound sockets */
  519. error = -EBUSY;
  520. if ((sk->sk_state & PPPOX_CONNECTED) &&
  521. stage_session(sp->sa_addr.pppoe.sid))
  522. goto end;
  523. /* Check for already disconnected sockets, on attempts to disconnect */
  524. error = -EALREADY;
  525. if ((sk->sk_state & PPPOX_DEAD) &&
  526. !stage_session(sp->sa_addr.pppoe.sid))
  527. goto end;
  528. error = 0;
  529. /* Delete the old binding */
  530. if (stage_session(po->pppoe_pa.sid)) {
  531. pppox_unbind_sock(sk);
  532. pn = pppoe_pernet(sock_net(sk));
  533. delete_item(pn, po->pppoe_pa.sid,
  534. po->pppoe_pa.remote, po->pppoe_ifindex);
  535. if (po->pppoe_dev) {
  536. dev_put(po->pppoe_dev);
  537. po->pppoe_dev = NULL;
  538. }
  539. po->pppoe_ifindex = 0;
  540. memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa));
  541. memset(&po->pppoe_relay, 0, sizeof(po->pppoe_relay));
  542. memset(&po->chan, 0, sizeof(po->chan));
  543. po->next = NULL;
  544. po->num = 0;
  545. sk->sk_state = PPPOX_NONE;
  546. }
  547. /* Re-bind in session stage only */
  548. if (stage_session(sp->sa_addr.pppoe.sid)) {
  549. error = -ENODEV;
  550. net = sock_net(sk);
  551. dev = dev_get_by_name(net, sp->sa_addr.pppoe.dev);
  552. if (!dev)
  553. goto err_put;
  554. po->pppoe_dev = dev;
  555. po->pppoe_ifindex = dev->ifindex;
  556. pn = pppoe_pernet(net);
  557. if (!(dev->flags & IFF_UP)) {
  558. goto err_put;
  559. }
  560. memcpy(&po->pppoe_pa,
  561. &sp->sa_addr.pppoe,
  562. sizeof(struct pppoe_addr));
  563. write_lock_bh(&pn->hash_lock);
  564. error = __set_item(pn, po);
  565. write_unlock_bh(&pn->hash_lock);
  566. if (error < 0)
  567. goto err_put;
  568. po->chan.hdrlen = (sizeof(struct pppoe_hdr) +
  569. dev->hard_header_len);
  570. po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2;
  571. po->chan.private = sk;
  572. po->chan.ops = &pppoe_chan_ops;
  573. error = ppp_register_net_channel(dev_net(dev), &po->chan);
  574. if (error) {
  575. delete_item(pn, po->pppoe_pa.sid,
  576. po->pppoe_pa.remote, po->pppoe_ifindex);
  577. goto err_put;
  578. }
  579. sk->sk_state = PPPOX_CONNECTED;
  580. }
  581. po->num = sp->sa_addr.pppoe.sid;
  582. end:
  583. release_sock(sk);
  584. return error;
  585. err_put:
  586. if (po->pppoe_dev) {
  587. dev_put(po->pppoe_dev);
  588. po->pppoe_dev = NULL;
  589. }
  590. goto end;
  591. }
  592. static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr,
  593. int peer)
  594. {
  595. int len = sizeof(struct sockaddr_pppox);
  596. struct sockaddr_pppox sp;
  597. sp.sa_family = AF_PPPOX;
  598. sp.sa_protocol = PX_PROTO_OE;
  599. memcpy(&sp.sa_addr.pppoe, &pppox_sk(sock->sk)->pppoe_pa,
  600. sizeof(struct pppoe_addr));
  601. memcpy(uaddr, &sp, len);
  602. return len;
  603. }
  604. static int pppoe_ioctl(struct socket *sock, unsigned int cmd,
  605. unsigned long arg)
  606. {
  607. struct sock *sk = sock->sk;
  608. struct pppox_sock *po = pppox_sk(sk);
  609. int val;
  610. int err;
  611. switch (cmd) {
  612. case PPPIOCGMRU:
  613. err = -ENXIO;
  614. if (!(sk->sk_state & PPPOX_CONNECTED))
  615. break;
  616. err = -EFAULT;
  617. if (put_user(po->pppoe_dev->mtu -
  618. sizeof(struct pppoe_hdr) -
  619. PPP_HDRLEN,
  620. (int __user *)arg))
  621. break;
  622. err = 0;
  623. break;
  624. case PPPIOCSMRU:
  625. err = -ENXIO;
  626. if (!(sk->sk_state & PPPOX_CONNECTED))
  627. break;
  628. err = -EFAULT;
  629. if (get_user(val, (int __user *)arg))
  630. break;
  631. if (val < (po->pppoe_dev->mtu
  632. - sizeof(struct pppoe_hdr)
  633. - PPP_HDRLEN))
  634. err = 0;
  635. else
  636. err = -EINVAL;
  637. break;
  638. case PPPIOCSFLAGS:
  639. err = -EFAULT;
  640. if (get_user(val, (int __user *)arg))
  641. break;
  642. err = 0;
  643. break;
  644. case PPPOEIOCSFWD:
  645. {
  646. struct pppox_sock *relay_po;
  647. err = -EBUSY;
  648. if (sk->sk_state & (PPPOX_BOUND | PPPOX_DEAD))
  649. break;
  650. err = -ENOTCONN;
  651. if (!(sk->sk_state & PPPOX_CONNECTED))
  652. break;
  653. /* PPPoE address from the user specifies an outbound
  654. PPPoE address which frames are forwarded to */
  655. err = -EFAULT;
  656. if (copy_from_user(&po->pppoe_relay,
  657. (void __user *)arg,
  658. sizeof(struct sockaddr_pppox)))
  659. break;
  660. err = -EINVAL;
  661. if (po->pppoe_relay.sa_family != AF_PPPOX ||
  662. po->pppoe_relay.sa_protocol != PX_PROTO_OE)
  663. break;
  664. /* Check that the socket referenced by the address
  665. actually exists. */
  666. relay_po = get_item_by_addr(sock_net(sk), &po->pppoe_relay);
  667. if (!relay_po)
  668. break;
  669. sock_put(sk_pppox(relay_po));
  670. sk->sk_state |= PPPOX_RELAY;
  671. err = 0;
  672. break;
  673. }
  674. case PPPOEIOCDFWD:
  675. err = -EALREADY;
  676. if (!(sk->sk_state & PPPOX_RELAY))
  677. break;
  678. sk->sk_state &= ~PPPOX_RELAY;
  679. err = 0;
  680. break;
  681. default:
  682. err = -ENOTTY;
  683. }
  684. return err;
  685. }
  686. static int pppoe_sendmsg(struct socket *sock, struct msghdr *m,
  687. size_t total_len)
  688. {
  689. struct sk_buff *skb;
  690. struct sock *sk = sock->sk;
  691. struct pppox_sock *po = pppox_sk(sk);
  692. int error;
  693. struct pppoe_hdr hdr;
  694. struct pppoe_hdr *ph;
  695. struct net_device *dev;
  696. char *start;
  697. int hlen;
  698. lock_sock(sk);
  699. if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) {
  700. error = -ENOTCONN;
  701. goto end;
  702. }
  703. hdr.ver = 1;
  704. hdr.type = 1;
  705. hdr.code = 0;
  706. hdr.sid = po->num;
  707. dev = po->pppoe_dev;
  708. error = -EMSGSIZE;
  709. if (total_len > (dev->mtu + dev->hard_header_len))
  710. goto end;
  711. hlen = LL_RESERVED_SPACE(dev);
  712. skb = sock_wmalloc(sk, hlen + sizeof(*ph) + total_len +
  713. dev->needed_tailroom, 0, GFP_KERNEL);
  714. if (!skb) {
  715. error = -ENOMEM;
  716. goto end;
  717. }
  718. /* Reserve space for headers. */
  719. skb_reserve(skb, hlen);
  720. skb_reset_network_header(skb);
  721. skb->dev = dev;
  722. skb->priority = sk->sk_priority;
  723. skb->protocol = cpu_to_be16(ETH_P_PPP_SES);
  724. ph = skb_put(skb, total_len + sizeof(struct pppoe_hdr));
  725. start = (char *)&ph->tag[0];
  726. error = memcpy_from_msg(start, m, total_len);
  727. if (error < 0) {
  728. kfree_skb(skb);
  729. goto end;
  730. }
  731. error = total_len;
  732. dev_hard_header(skb, dev, ETH_P_PPP_SES,
  733. po->pppoe_pa.remote, NULL, total_len);
  734. memcpy(ph, &hdr, sizeof(struct pppoe_hdr));
  735. ph->length = htons(total_len);
  736. dev_queue_xmit(skb);
  737. end:
  738. release_sock(sk);
  739. return error;
  740. }
  741. /************************************************************************
  742. *
  743. * xmit function for internal use.
  744. *
  745. ***********************************************************************/
  746. static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
  747. {
  748. struct pppox_sock *po = pppox_sk(sk);
  749. struct net_device *dev = po->pppoe_dev;
  750. struct pppoe_hdr *ph;
  751. int data_len = skb->len;
  752. /* The higher-level PPP code (ppp_unregister_channel()) ensures the PPP
  753. * xmit operations conclude prior to an unregistration call. Thus
  754. * sk->sk_state cannot change, so we don't need to do lock_sock().
  755. * But, we also can't do a lock_sock since that introduces a potential
  756. * deadlock as we'd reverse the lock ordering used when calling
  757. * ppp_unregister_channel().
  758. */
  759. if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
  760. goto abort;
  761. if (!dev)
  762. goto abort;
  763. /* Copy the data if there is no space for the header or if it's
  764. * read-only.
  765. */
  766. if (skb_cow_head(skb, LL_RESERVED_SPACE(dev) + sizeof(*ph)))
  767. goto abort;
  768. __skb_push(skb, sizeof(*ph));
  769. skb_reset_network_header(skb);
  770. ph = pppoe_hdr(skb);
  771. ph->ver = 1;
  772. ph->type = 1;
  773. ph->code = 0;
  774. ph->sid = po->num;
  775. ph->length = htons(data_len);
  776. skb->protocol = cpu_to_be16(ETH_P_PPP_SES);
  777. skb->dev = dev;
  778. dev_hard_header(skb, dev, ETH_P_PPP_SES,
  779. po->pppoe_pa.remote, NULL, data_len);
  780. dev_queue_xmit(skb);
  781. return 1;
  782. abort:
  783. kfree_skb(skb);
  784. return 1;
  785. }
  786. /************************************************************************
  787. *
  788. * xmit function called by generic PPP driver
  789. * sends PPP frame over PPPoE socket
  790. *
  791. ***********************************************************************/
  792. static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb)
  793. {
  794. struct sock *sk = (struct sock *)chan->private;
  795. return __pppoe_xmit(sk, skb);
  796. }
  797. static int pppoe_fill_forward_path(struct net_device_path_ctx *ctx,
  798. struct net_device_path *path,
  799. const struct ppp_channel *chan)
  800. {
  801. struct sock *sk = (struct sock *)chan->private;
  802. struct pppox_sock *po = pppox_sk(sk);
  803. struct net_device *dev = po->pppoe_dev;
  804. if (sock_flag(sk, SOCK_DEAD) ||
  805. !(sk->sk_state & PPPOX_CONNECTED) || !dev)
  806. return -1;
  807. path->type = DEV_PATH_PPPOE;
  808. path->encap.proto = htons(ETH_P_PPP_SES);
  809. path->encap.id = be16_to_cpu(po->num);
  810. memcpy(path->encap.h_dest, po->pppoe_pa.remote, ETH_ALEN);
  811. memcpy(ctx->daddr, po->pppoe_pa.remote, ETH_ALEN);
  812. path->dev = ctx->dev;
  813. ctx->dev = dev;
  814. return 0;
  815. }
  816. static const struct ppp_channel_ops pppoe_chan_ops = {
  817. .start_xmit = pppoe_xmit,
  818. .fill_forward_path = pppoe_fill_forward_path,
  819. };
  820. static int pppoe_recvmsg(struct socket *sock, struct msghdr *m,
  821. size_t total_len, int flags)
  822. {
  823. struct sock *sk = sock->sk;
  824. struct sk_buff *skb;
  825. int error = 0;
  826. if (sk->sk_state & PPPOX_BOUND) {
  827. error = -EIO;
  828. goto end;
  829. }
  830. skb = skb_recv_datagram(sk, flags, &error);
  831. if (error < 0)
  832. goto end;
  833. if (skb) {
  834. total_len = min_t(size_t, total_len, skb->len);
  835. error = skb_copy_datagram_msg(skb, 0, m, total_len);
  836. if (error == 0) {
  837. consume_skb(skb);
  838. return total_len;
  839. }
  840. }
  841. kfree_skb(skb);
  842. end:
  843. return error;
  844. }
  845. #ifdef CONFIG_PROC_FS
  846. static int pppoe_seq_show(struct seq_file *seq, void *v)
  847. {
  848. struct pppox_sock *po;
  849. char *dev_name;
  850. if (v == SEQ_START_TOKEN) {
  851. seq_puts(seq, "Id Address Device\n");
  852. goto out;
  853. }
  854. po = v;
  855. dev_name = po->pppoe_pa.dev;
  856. seq_printf(seq, "%08X %pM %8s\n",
  857. po->pppoe_pa.sid, po->pppoe_pa.remote, dev_name);
  858. out:
  859. return 0;
  860. }
  861. static inline struct pppox_sock *pppoe_get_idx(struct pppoe_net *pn, loff_t pos)
  862. {
  863. struct pppox_sock *po;
  864. int i;
  865. for (i = 0; i < PPPOE_HASH_SIZE; i++) {
  866. po = pn->hash_table[i];
  867. while (po) {
  868. if (!pos--)
  869. goto out;
  870. po = po->next;
  871. }
  872. }
  873. out:
  874. return po;
  875. }
  876. static void *pppoe_seq_start(struct seq_file *seq, loff_t *pos)
  877. __acquires(pn->hash_lock)
  878. {
  879. struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq));
  880. loff_t l = *pos;
  881. read_lock_bh(&pn->hash_lock);
  882. return l ? pppoe_get_idx(pn, --l) : SEQ_START_TOKEN;
  883. }
  884. static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos)
  885. {
  886. struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq));
  887. struct pppox_sock *po;
  888. ++*pos;
  889. if (v == SEQ_START_TOKEN) {
  890. po = pppoe_get_idx(pn, 0);
  891. goto out;
  892. }
  893. po = v;
  894. if (po->next)
  895. po = po->next;
  896. else {
  897. int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
  898. po = NULL;
  899. while (++hash < PPPOE_HASH_SIZE) {
  900. po = pn->hash_table[hash];
  901. if (po)
  902. break;
  903. }
  904. }
  905. out:
  906. return po;
  907. }
  908. static void pppoe_seq_stop(struct seq_file *seq, void *v)
  909. __releases(pn->hash_lock)
  910. {
  911. struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq));
  912. read_unlock_bh(&pn->hash_lock);
  913. }
  914. static const struct seq_operations pppoe_seq_ops = {
  915. .start = pppoe_seq_start,
  916. .next = pppoe_seq_next,
  917. .stop = pppoe_seq_stop,
  918. .show = pppoe_seq_show,
  919. };
  920. #endif /* CONFIG_PROC_FS */
  921. static const struct proto_ops pppoe_ops = {
  922. .family = AF_PPPOX,
  923. .owner = THIS_MODULE,
  924. .release = pppoe_release,
  925. .bind = sock_no_bind,
  926. .connect = pppoe_connect,
  927. .socketpair = sock_no_socketpair,
  928. .accept = sock_no_accept,
  929. .getname = pppoe_getname,
  930. .poll = datagram_poll,
  931. .listen = sock_no_listen,
  932. .shutdown = sock_no_shutdown,
  933. .sendmsg = pppoe_sendmsg,
  934. .recvmsg = pppoe_recvmsg,
  935. .mmap = sock_no_mmap,
  936. .ioctl = pppox_ioctl,
  937. #ifdef CONFIG_COMPAT
  938. .compat_ioctl = pppox_compat_ioctl,
  939. #endif
  940. };
  941. static const struct pppox_proto pppoe_proto = {
  942. .create = pppoe_create,
  943. .ioctl = pppoe_ioctl,
  944. .owner = THIS_MODULE,
  945. };
  946. static __net_init int pppoe_init_net(struct net *net)
  947. {
  948. struct pppoe_net *pn = pppoe_pernet(net);
  949. struct proc_dir_entry *pde;
  950. rwlock_init(&pn->hash_lock);
  951. pde = proc_create_net("pppoe", 0444, net->proc_net,
  952. &pppoe_seq_ops, sizeof(struct seq_net_private));
  953. #ifdef CONFIG_PROC_FS
  954. if (!pde)
  955. return -ENOMEM;
  956. #endif
  957. return 0;
  958. }
  959. static __net_exit void pppoe_exit_net(struct net *net)
  960. {
  961. remove_proc_entry("pppoe", net->proc_net);
  962. }
  963. static struct pernet_operations pppoe_net_ops = {
  964. .init = pppoe_init_net,
  965. .exit = pppoe_exit_net,
  966. .id = &pppoe_net_id,
  967. .size = sizeof(struct pppoe_net),
  968. };
  969. static int __init pppoe_init(void)
  970. {
  971. int err;
  972. err = register_pernet_device(&pppoe_net_ops);
  973. if (err)
  974. goto out;
  975. err = proto_register(&pppoe_sk_proto, 0);
  976. if (err)
  977. goto out_unregister_net_ops;
  978. err = register_pppox_proto(PX_PROTO_OE, &pppoe_proto);
  979. if (err)
  980. goto out_unregister_pppoe_proto;
  981. dev_add_pack(&pppoes_ptype);
  982. dev_add_pack(&pppoed_ptype);
  983. register_netdevice_notifier(&pppoe_notifier);
  984. return 0;
  985. out_unregister_pppoe_proto:
  986. proto_unregister(&pppoe_sk_proto);
  987. out_unregister_net_ops:
  988. unregister_pernet_device(&pppoe_net_ops);
  989. out:
  990. return err;
  991. }
  992. static void __exit pppoe_exit(void)
  993. {
  994. unregister_netdevice_notifier(&pppoe_notifier);
  995. dev_remove_pack(&pppoed_ptype);
  996. dev_remove_pack(&pppoes_ptype);
  997. unregister_pppox_proto(PX_PROTO_OE);
  998. proto_unregister(&pppoe_sk_proto);
  999. unregister_pernet_device(&pppoe_net_ops);
  1000. }
  1001. module_init(pppoe_init);
  1002. module_exit(pppoe_exit);
  1003. MODULE_AUTHOR("Michal Ostrowski <[email protected]>");
  1004. MODULE_DESCRIPTION("PPP over Ethernet driver");
  1005. MODULE_LICENSE("GPL");
  1006. MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OE);