linux/drivers/net/pppoe.c
<<
>>
Prefs
   1/** -*- linux-c -*- ***********************************************************
   2 * Linux PPP over Ethernet (PPPoX/PPPoE) Sockets
   3 *
   4 * PPPoX --- Generic PPP encapsulation socket family
   5 * PPPoE --- PPP over Ethernet (RFC 2516)
   6 *
   7 *
   8 * Version:     0.7.0
   9 *
  10 * 070228 :     Fix to allow multiple sessions with same remote MAC and same
  11 *              session id by including the local device ifindex in the
  12 *              tuple identifying a session. This also ensures packets can't
  13 *              be injected into a session from interfaces other than the one
  14 *              specified by userspace. Florian Zumbiehl <florz@florz.de>
  15 *              (Oh, BTW, this one is YYMMDD, in case you were wondering ...)
  16 * 220102 :     Fix module use count on failure in pppoe_create, pppox_sk -acme
  17 * 030700 :     Fixed connect logic to allow for disconnect.
  18 * 270700 :     Fixed potential SMP problems; we must protect against
  19 *              simultaneous invocation of ppp_input
  20 *              and ppp_unregister_channel.
  21 * 040800 :     Respect reference count mechanisms on net-devices.
  22 * 200800 :     fix kfree(skb) in pppoe_rcv (acme)
  23 *              Module reference count is decremented in the right spot now,
  24 *              guards against sock_put not actually freeing the sk
  25 *              in pppoe_release.
  26 * 051000 :     Initialization cleanup.
  27 * 111100 :     Fix recvmsg.
  28 * 050101 :     Fix PADT procesing.
  29 * 140501 :     Use pppoe_rcv_core to handle all backlog. (Alexey)
  30 * 170701 :     Do not lock_sock with rwlock held. (DaveM)
  31 *              Ignore discovery frames if user has socket
  32 *              locked. (DaveM)
  33 *              Ignore return value of dev_queue_xmit in __pppoe_xmit
  34 *              or else we may kfree an SKB twice. (DaveM)
  35 * 190701 :     When doing copies of skb's in __pppoe_xmit, always delete
  36 *              the original skb that was passed in on success, never on
  37 *              failure.  Delete the copy of the skb on failure to avoid
  38 *              a memory leak.
  39 * 081001 :     Misc. cleanup (licence string, non-blocking, prevent
  40 *              reference of device on close).
  41 * 121301 :     New ppp channels interface; cannot unregister a channel
  42 *              from interrupts.  Thus, we mark the socket as a ZOMBIE
  43 *              and do the unregistration later.
  44 * 081002 :     seq_file support for proc stuff -acme
  45 * 111602 :     Merge all 2.4 fixes into 2.5/2.6 tree.  Label 2.5/2.6
  46 *              as version 0.7.  Spacing cleanup.
  47 * Author:      Michal Ostrowski <mostrows@speakeasy.net>
  48 * Contributors:
  49 *              Arnaldo Carvalho de Melo <acme@conectiva.com.br>
  50 *              David S. Miller (davem@redhat.com)
  51 *
  52 * License:
  53 *              This program is free software; you can redistribute it and/or
  54 *              modify it under the terms of the GNU General Public License
  55 *              as published by the Free Software Foundation; either version
  56 *              2 of the License, or (at your option) any later version.
  57 *
  58 */
  59
  60#include <linux/string.h>
  61#include <linux/module.h>
  62#include <linux/kernel.h>
  63#include <linux/slab.h>
  64#include <linux/errno.h>
  65#include <linux/netdevice.h>
  66#include <linux/net.h>
  67#include <linux/inetdevice.h>
  68#include <linux/etherdevice.h>
  69#include <linux/skbuff.h>
  70#include <linux/init.h>
  71#include <linux/if_ether.h>
  72#include <linux/if_pppox.h>
  73#include <linux/ppp_channel.h>
  74#include <linux/ppp_defs.h>
  75#include <linux/if_ppp.h>
  76#include <linux/notifier.h>
  77#include <linux/file.h>
  78#include <linux/proc_fs.h>
  79#include <linux/seq_file.h>
  80
  81#include <linux/nsproxy.h>
  82#include <net/net_namespace.h>
  83#include <net/netns/generic.h>
  84#include <net/sock.h>
  85
  86#include <asm/uaccess.h>
  87
  88#define PPPOE_HASH_BITS 4
  89#define PPPOE_HASH_SIZE (1 << PPPOE_HASH_BITS)
  90#define PPPOE_HASH_MASK (PPPOE_HASH_SIZE - 1)
  91
  92static int pppoe_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
  93static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb);
  94static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb);
  95
  96static const struct proto_ops pppoe_ops;
  97static struct ppp_channel_ops pppoe_chan_ops;
  98
  99/* per-net private data for this module */
 100static int pppoe_net_id;
 101struct pppoe_net {
 102        /*
 103         * we could use _single_ hash table for all
 104         * nets by injecting net id into the hash but
 105         * it would increase hash chains and add
 106         * a few additional math comparations messy
 107         * as well, moreover in case of SMP less locking
 108         * controversy here
 109         */
 110        struct pppox_sock *hash_table[PPPOE_HASH_SIZE];
 111        rwlock_t hash_lock;
 112};
 113
 114/*
 115 * PPPoE could be in the following stages:
 116 * 1) Discovery stage (to obtain remote MAC and Session ID)
 117 * 2) Session stage (MAC and SID are known)
 118 *
 119 * Ethernet frames have a special tag for this but
 120 * we use simplier approach based on session id
 121 */
 122static inline bool stage_session(__be16 sid)
 123{
 124        return sid != 0;
 125}
 126
 127static inline struct pppoe_net *pppoe_pernet(struct net *net)
 128{
 129        BUG_ON(!net);
 130
 131        return net_generic(net, pppoe_net_id);
 132}
 133
 134static inline int cmp_2_addr(struct pppoe_addr *a, struct pppoe_addr *b)
 135{
 136        return a->sid == b->sid && !memcmp(a->remote, b->remote, ETH_ALEN);
 137}
 138
 139static inline int cmp_addr(struct pppoe_addr *a, __be16 sid, char *addr)
 140{
 141        return a->sid == sid && !memcmp(a->remote, addr, ETH_ALEN);
 142}
 143
 144#if 8 % PPPOE_HASH_BITS
 145#error 8 must be a multiple of PPPOE_HASH_BITS
 146#endif
 147
 148static int hash_item(__be16 sid, unsigned char *addr)
 149{
 150        unsigned char hash = 0;
 151        unsigned int i;
 152
 153        for (i = 0; i < ETH_ALEN; i++)
 154                hash ^= addr[i];
 155        for (i = 0; i < sizeof(sid_t) * 8; i += 8)
 156                hash ^= (__force __u32)sid >> i;
 157        for (i = 8; (i >>= 1) >= PPPOE_HASH_BITS;)
 158                hash ^= hash >> i;
 159
 160        return hash & PPPOE_HASH_MASK;
 161}
 162
 163/**********************************************************************
 164 *
 165 *  Set/get/delete/rehash items  (internal versions)
 166 *
 167 **********************************************************************/
 168static struct pppox_sock *__get_item(struct pppoe_net *pn, __be16 sid,
 169                                unsigned char *addr, int ifindex)
 170{
 171        int hash = hash_item(sid, addr);
 172        struct pppox_sock *ret;
 173
 174        ret = pn->hash_table[hash];
 175        while (ret) {
 176                if (cmp_addr(&ret->pppoe_pa, sid, addr) &&
 177                    ret->pppoe_ifindex == ifindex)
 178                        return ret;
 179
 180                ret = ret->next;
 181        }
 182
 183        return NULL;
 184}
 185
 186static int __set_item(struct pppoe_net *pn, struct pppox_sock *po)
 187{
 188        int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
 189        struct pppox_sock *ret;
 190
 191        ret = pn->hash_table[hash];
 192        while (ret) {
 193                if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa) &&
 194                    ret->pppoe_ifindex == po->pppoe_ifindex)
 195                        return -EALREADY;
 196
 197                ret = ret->next;
 198        }
 199
 200        po->next = pn->hash_table[hash];
 201        pn->hash_table[hash] = po;
 202
 203        return 0;
 204}
 205
 206static struct pppox_sock *__delete_item(struct pppoe_net *pn, __be16 sid,
 207                                        char *addr, int ifindex)
 208{
 209        int hash = hash_item(sid, addr);
 210        struct pppox_sock *ret, **src;
 211
 212        ret = pn->hash_table[hash];
 213        src = &pn->hash_table[hash];
 214
 215        while (ret) {
 216                if (cmp_addr(&ret->pppoe_pa, sid, addr) &&
 217                    ret->pppoe_ifindex == ifindex) {
 218                        *src = ret->next;
 219                        break;
 220                }
 221
 222                src = &ret->next;
 223                ret = ret->next;
 224        }
 225
 226        return ret;
 227}
 228
 229/**********************************************************************
 230 *
 231 *  Set/get/delete/rehash items
 232 *
 233 **********************************************************************/
 234static inline struct pppox_sock *get_item(struct pppoe_net *pn, __be16 sid,
 235                                        unsigned char *addr, int ifindex)
 236{
 237        struct pppox_sock *po;
 238
 239        read_lock_bh(&pn->hash_lock);
 240        po = __get_item(pn, sid, addr, ifindex);
 241        if (po)
 242                sock_hold(sk_pppox(po));
 243        read_unlock_bh(&pn->hash_lock);
 244
 245        return po;
 246}
 247
 248static inline struct pppox_sock *get_item_by_addr(struct net *net,
 249                                                struct sockaddr_pppox *sp)
 250{
 251        struct net_device *dev;
 252        struct pppoe_net *pn;
 253        struct pppox_sock *pppox_sock;
 254
 255        int ifindex;
 256
 257        dev = dev_get_by_name(net, sp->sa_addr.pppoe.dev);
 258        if (!dev)
 259                return NULL;
 260
 261        ifindex = dev->ifindex;
 262        pn = net_generic(net, pppoe_net_id);
 263        pppox_sock = get_item(pn, sp->sa_addr.pppoe.sid,
 264                                sp->sa_addr.pppoe.remote, ifindex);
 265        dev_put(dev);
 266
 267        return pppox_sock;
 268}
 269
 270static inline struct pppox_sock *delete_item(struct pppoe_net *pn, __be16 sid,
 271                                        char *addr, int ifindex)
 272{
 273        struct pppox_sock *ret;
 274
 275        write_lock_bh(&pn->hash_lock);
 276        ret = __delete_item(pn, sid, addr, ifindex);
 277        write_unlock_bh(&pn->hash_lock);
 278
 279        return ret;
 280}
 281
 282/***************************************************************************
 283 *
 284 *  Handler for device events.
 285 *  Certain device events require that sockets be unconnected.
 286 *
 287 **************************************************************************/
 288
 289static void pppoe_flush_dev(struct net_device *dev)
 290{
 291        struct pppoe_net *pn;
 292        int i;
 293
 294        BUG_ON(dev == NULL);
 295
 296        pn = pppoe_pernet(dev_net(dev));
 297        if (!pn) /* already freed */
 298                return;
 299
 300        write_lock_bh(&pn->hash_lock);
 301        for (i = 0; i < PPPOE_HASH_SIZE; i++) {
 302                struct pppox_sock *po = pn->hash_table[i];
 303                struct sock *sk;
 304
 305                while (po) {
 306                        while (po && po->pppoe_dev != dev) {
 307                                po = po->next;
 308                        }
 309
 310                        if (!po)
 311                                break;
 312
 313                        sk = sk_pppox(po);
 314
 315                        /* We always grab the socket lock, followed by the
 316                         * hash_lock, in that order.  Since we should hold the
 317                         * sock lock while doing any unbinding, we need to
 318                         * release the lock we're holding.  Hold a reference to
 319                         * the sock so it doesn't disappear as we're jumping
 320                         * between locks.
 321                         */
 322
 323                        sock_hold(sk);
 324                        write_unlock_bh(&pn->hash_lock);
 325                        lock_sock(sk);
 326
 327                        if (po->pppoe_dev == dev
 328                            && sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
 329                                pppox_unbind_sock(sk);
 330                                sk->sk_state = PPPOX_ZOMBIE;
 331                                sk->sk_state_change(sk);
 332                                po->pppoe_dev = NULL;
 333                                dev_put(dev);
 334                        }
 335
 336                        release_sock(sk);
 337                        sock_put(sk);
 338
 339                        /* Restart the process from the start of the current
 340                         * hash chain. We dropped locks so the world may have
 341                         * change from underneath us.
 342                         */
 343
 344                        BUG_ON(pppoe_pernet(dev_net(dev)) == NULL);
 345                        write_lock_bh(&pn->hash_lock);
 346                        po = pn->hash_table[i];
 347                }
 348        }
 349        write_unlock_bh(&pn->hash_lock);
 350}
 351
 352static int pppoe_device_event(struct notifier_block *this,
 353                              unsigned long event, void *ptr)
 354{
 355        struct net_device *dev = (struct net_device *)ptr;
 356
 357        /* Only look at sockets that are using this specific device. */
 358        switch (event) {
 359        case NETDEV_CHANGEMTU:
 360                /* A change in mtu is a bad thing, requiring
 361                 * LCP re-negotiation.
 362                 */
 363
 364        case NETDEV_GOING_DOWN:
 365        case NETDEV_DOWN:
 366                /* Find every socket on this device and kill it. */
 367                pppoe_flush_dev(dev);
 368                break;
 369
 370        default:
 371                break;
 372        };
 373
 374        return NOTIFY_DONE;
 375}
 376
 377static struct notifier_block pppoe_notifier = {
 378        .notifier_call = pppoe_device_event,
 379};
 380
 381/************************************************************************
 382 *
 383 * Do the real work of receiving a PPPoE Session frame.
 384 *
 385 ***********************************************************************/
 386static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
 387{
 388        struct pppox_sock *po = pppox_sk(sk);
 389        struct pppox_sock *relay_po;
 390
 391        /* Backlog receive. Semantics of backlog rcv preclude any code from
 392         * executing in lock_sock()/release_sock() bounds; meaning sk->sk_state
 393         * can't change.
 394         */
 395
 396        if (sk->sk_state & PPPOX_BOUND) {
 397                ppp_input(&po->chan, skb);
 398        } else if (sk->sk_state & PPPOX_RELAY) {
 399                relay_po = get_item_by_addr(sock_net(sk),
 400                                            &po->pppoe_relay);
 401                if (relay_po == NULL)
 402                        goto abort_kfree;
 403
 404                if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0)
 405                        goto abort_put;
 406
 407                if (!__pppoe_xmit(sk_pppox(relay_po), skb))
 408                        goto abort_put;
 409        } else {
 410                if (sock_queue_rcv_skb(sk, skb))
 411                        goto abort_kfree;
 412        }
 413
 414        return NET_RX_SUCCESS;
 415
 416abort_put:
 417        sock_put(sk_pppox(relay_po));
 418
 419abort_kfree:
 420        kfree_skb(skb);
 421        return NET_RX_DROP;
 422}
 423
 424/************************************************************************
 425 *
 426 * Receive wrapper called in BH context.
 427 *
 428 ***********************************************************************/
 429static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
 430                     struct packet_type *pt, struct net_device *orig_dev)
 431{
 432        struct pppoe_hdr *ph;
 433        struct pppox_sock *po;
 434        struct pppoe_net *pn;
 435        int len;
 436
 437        skb = skb_share_check(skb, GFP_ATOMIC);
 438        if (!skb)
 439                goto out;
 440
 441        if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
 442                goto drop;
 443
 444        ph = pppoe_hdr(skb);
 445        len = ntohs(ph->length);
 446
 447        skb_pull_rcsum(skb, sizeof(*ph));
 448        if (skb->len < len)
 449                goto drop;
 450
 451        if (pskb_trim_rcsum(skb, len))
 452                goto drop;
 453
 454        pn = pppoe_pernet(dev_net(dev));
 455
 456        /* Note that get_item does a sock_hold(), so sk_pppox(po)
 457         * is known to be safe.
 458         */
 459        po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
 460        if (!po)
 461                goto drop;
 462
 463        return sk_receive_skb(sk_pppox(po), skb, 0);
 464
 465drop:
 466        kfree_skb(skb);
 467out:
 468        return NET_RX_DROP;
 469}
 470
 471/************************************************************************
 472 *
 473 * Receive a PPPoE Discovery frame.
 474 * This is solely for detection of PADT frames
 475 *
 476 ***********************************************************************/
 477static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev,
 478                          struct packet_type *pt, struct net_device *orig_dev)
 479
 480{
 481        struct pppoe_hdr *ph;
 482        struct pppox_sock *po;
 483        struct pppoe_net *pn;
 484
 485        skb = skb_share_check(skb, GFP_ATOMIC);
 486        if (!skb)
 487                goto out;
 488
 489        if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
 490                goto abort;
 491
 492        ph = pppoe_hdr(skb);
 493        if (ph->code != PADT_CODE)
 494                goto abort;
 495
 496        pn = pppoe_pernet(dev_net(dev));
 497        po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
 498        if (po) {
 499                struct sock *sk = sk_pppox(po);
 500
 501                bh_lock_sock(sk);
 502
 503                /* If the user has locked the socket, just ignore
 504                 * the packet.  With the way two rcv protocols hook into
 505                 * one socket family type, we cannot (easily) distinguish
 506                 * what kind of SKB it is during backlog rcv.
 507                 */
 508                if (sock_owned_by_user(sk) == 0) {
 509                        /* We're no longer connect at the PPPOE layer,
 510                         * and must wait for ppp channel to disconnect us.
 511                         */
 512                        sk->sk_state = PPPOX_ZOMBIE;
 513                }
 514
 515                bh_unlock_sock(sk);
 516                sock_put(sk);
 517        }
 518
 519abort:
 520        kfree_skb(skb);
 521out:
 522        return NET_RX_SUCCESS; /* Lies... :-) */
 523}
 524
 525static struct packet_type pppoes_ptype __read_mostly = {
 526        .type   = cpu_to_be16(ETH_P_PPP_SES),
 527        .func   = pppoe_rcv,
 528};
 529
 530static struct packet_type pppoed_ptype __read_mostly = {
 531        .type   = cpu_to_be16(ETH_P_PPP_DISC),
 532        .func   = pppoe_disc_rcv,
 533};
 534
 535static struct proto pppoe_sk_proto __read_mostly = {
 536        .name     = "PPPOE",
 537        .owner    = THIS_MODULE,
 538        .obj_size = sizeof(struct pppox_sock),
 539};
 540
 541/***********************************************************************
 542 *
 543 * Initialize a new struct sock.
 544 *
 545 **********************************************************************/
 546static int pppoe_create(struct net *net, struct socket *sock)
 547{
 548        struct sock *sk;
 549
 550        sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppoe_sk_proto);
 551        if (!sk)
 552                return -ENOMEM;
 553
 554        sock_init_data(sock, sk);
 555
 556        sock->state     = SS_UNCONNECTED;
 557        sock->ops       = &pppoe_ops;
 558
 559        sk->sk_backlog_rcv      = pppoe_rcv_core;
 560        sk->sk_state            = PPPOX_NONE;
 561        sk->sk_type             = SOCK_STREAM;
 562        sk->sk_family           = PF_PPPOX;
 563        sk->sk_protocol         = PX_PROTO_OE;
 564
 565        return 0;
 566}
 567
 568static int pppoe_release(struct socket *sock)
 569{
 570        struct sock *sk = sock->sk;
 571        struct pppox_sock *po;
 572        struct pppoe_net *pn;
 573        struct net *net = NULL;
 574
 575        if (!sk)
 576                return 0;
 577
 578        lock_sock(sk);
 579        if (sock_flag(sk, SOCK_DEAD)) {
 580                release_sock(sk);
 581                return -EBADF;
 582        }
 583
 584        po = pppox_sk(sk);
 585
 586        if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
 587                dev_put(po->pppoe_dev);
 588                po->pppoe_dev = NULL;
 589        }
 590
 591        pppox_unbind_sock(sk);
 592
 593        /* Signal the death of the socket. */
 594        sk->sk_state = PPPOX_DEAD;
 595
 596        net = sock_net(sk);
 597        pn = pppoe_pernet(net);
 598
 599        /*
 600         * protect "po" from concurrent updates
 601         * on pppoe_flush_dev
 602         */
 603        delete_item(pn, po->pppoe_pa.sid, po->pppoe_pa.remote,
 604                    po->pppoe_ifindex);
 605
 606        sock_orphan(sk);
 607        sock->sk = NULL;
 608
 609        skb_queue_purge(&sk->sk_receive_queue);
 610        release_sock(sk);
 611        sock_put(sk);
 612
 613        return 0;
 614}
 615
 616static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
 617                  int sockaddr_len, int flags)
 618{
 619        struct sock *sk = sock->sk;
 620        struct sockaddr_pppox *sp = (struct sockaddr_pppox *)uservaddr;
 621        struct pppox_sock *po = pppox_sk(sk);
 622        struct net_device *dev = NULL;
 623        struct pppoe_net *pn;
 624        struct net *net = NULL;
 625        int error;
 626
 627        lock_sock(sk);
 628
 629        error = -EINVAL;
 630        if (sp->sa_protocol != PX_PROTO_OE)
 631                goto end;
 632
 633        /* Check for already bound sockets */
 634        error = -EBUSY;
 635        if ((sk->sk_state & PPPOX_CONNECTED) &&
 636             stage_session(sp->sa_addr.pppoe.sid))
 637                goto end;
 638
 639        /* Check for already disconnected sockets, on attempts to disconnect */
 640        error = -EALREADY;
 641        if ((sk->sk_state & PPPOX_DEAD) &&
 642             !stage_session(sp->sa_addr.pppoe.sid))
 643                goto end;
 644
 645        error = 0;
 646
 647        /* Delete the old binding */
 648        if (stage_session(po->pppoe_pa.sid)) {
 649                pppox_unbind_sock(sk);
 650                pn = pppoe_pernet(sock_net(sk));
 651                delete_item(pn, po->pppoe_pa.sid,
 652                            po->pppoe_pa.remote, po->pppoe_ifindex);
 653                if (po->pppoe_dev) {
 654                        dev_put(po->pppoe_dev);
 655                        po->pppoe_dev = NULL;
 656                }
 657
 658                memset(sk_pppox(po) + 1, 0,
 659                       sizeof(struct pppox_sock) - sizeof(struct sock));
 660                sk->sk_state = PPPOX_NONE;
 661        }
 662
 663        /* Re-bind in session stage only */
 664        if (stage_session(sp->sa_addr.pppoe.sid)) {
 665                error = -ENODEV;
 666                net = sock_net(sk);
 667                dev = dev_get_by_name(net, sp->sa_addr.pppoe.dev);
 668                if (!dev)
 669                        goto err_put;
 670
 671                po->pppoe_dev = dev;
 672                po->pppoe_ifindex = dev->ifindex;
 673                pn = pppoe_pernet(net);
 674                if (!(dev->flags & IFF_UP)) {
 675                        goto err_put;
 676                }
 677
 678                memcpy(&po->pppoe_pa,
 679                       &sp->sa_addr.pppoe,
 680                       sizeof(struct pppoe_addr));
 681
 682                write_lock_bh(&pn->hash_lock);
 683                error = __set_item(pn, po);
 684                write_unlock_bh(&pn->hash_lock);
 685                if (error < 0)
 686                        goto err_put;
 687
 688                po->chan.hdrlen = (sizeof(struct pppoe_hdr) +
 689                                   dev->hard_header_len);
 690
 691                po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr);
 692                po->chan.private = sk;
 693                po->chan.ops = &pppoe_chan_ops;
 694
 695                error = ppp_register_net_channel(dev_net(dev), &po->chan);
 696                if (error) {
 697                        delete_item(pn, po->pppoe_pa.sid,
 698                                    po->pppoe_pa.remote, po->pppoe_ifindex);
 699                        goto err_put;
 700                }
 701
 702                sk->sk_state = PPPOX_CONNECTED;
 703        }
 704
 705        po->num = sp->sa_addr.pppoe.sid;
 706
 707end:
 708        release_sock(sk);
 709        return error;
 710err_put:
 711        if (po->pppoe_dev) {
 712                dev_put(po->pppoe_dev);
 713                po->pppoe_dev = NULL;
 714        }
 715        goto end;
 716}
 717
 718static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr,
 719                  int *usockaddr_len, int peer)
 720{
 721        int len = sizeof(struct sockaddr_pppox);
 722        struct sockaddr_pppox sp;
 723
 724        sp.sa_family    = AF_PPPOX;
 725        sp.sa_protocol  = PX_PROTO_OE;
 726        memcpy(&sp.sa_addr.pppoe, &pppox_sk(sock->sk)->pppoe_pa,
 727               sizeof(struct pppoe_addr));
 728
 729        memcpy(uaddr, &sp, len);
 730
 731        *usockaddr_len = len;
 732
 733        return 0;
 734}
 735
 736static int pppoe_ioctl(struct socket *sock, unsigned int cmd,
 737                unsigned long arg)
 738{
 739        struct sock *sk = sock->sk;
 740        struct pppox_sock *po = pppox_sk(sk);
 741        int val;
 742        int err;
 743
 744        switch (cmd) {
 745        case PPPIOCGMRU:
 746                err = -ENXIO;
 747                if (!(sk->sk_state & PPPOX_CONNECTED))
 748                        break;
 749
 750                err = -EFAULT;
 751                if (put_user(po->pppoe_dev->mtu -
 752                             sizeof(struct pppoe_hdr) -
 753                             PPP_HDRLEN,
 754                             (int __user *)arg))
 755                        break;
 756                err = 0;
 757                break;
 758
 759        case PPPIOCSMRU:
 760                err = -ENXIO;
 761                if (!(sk->sk_state & PPPOX_CONNECTED))
 762                        break;
 763
 764                err = -EFAULT;
 765                if (get_user(val, (int __user *)arg))
 766                        break;
 767
 768                if (val < (po->pppoe_dev->mtu
 769                           - sizeof(struct pppoe_hdr)
 770                           - PPP_HDRLEN))
 771                        err = 0;
 772                else
 773                        err = -EINVAL;
 774                break;
 775
 776        case PPPIOCSFLAGS:
 777                err = -EFAULT;
 778                if (get_user(val, (int __user *)arg))
 779                        break;
 780                err = 0;
 781                break;
 782
 783        case PPPOEIOCSFWD:
 784        {
 785                struct pppox_sock *relay_po;
 786
 787                err = -EBUSY;
 788                if (sk->sk_state & (PPPOX_BOUND | PPPOX_ZOMBIE | PPPOX_DEAD))
 789                        break;
 790
 791                err = -ENOTCONN;
 792                if (!(sk->sk_state & PPPOX_CONNECTED))
 793                        break;
 794
 795                /* PPPoE address from the user specifies an outbound
 796                   PPPoE address which frames are forwarded to */
 797                err = -EFAULT;
 798                if (copy_from_user(&po->pppoe_relay,
 799                                   (void __user *)arg,
 800                                   sizeof(struct sockaddr_pppox)))
 801                        break;
 802
 803                err = -EINVAL;
 804                if (po->pppoe_relay.sa_family != AF_PPPOX ||
 805                    po->pppoe_relay.sa_protocol != PX_PROTO_OE)
 806                        break;
 807
 808                /* Check that the socket referenced by the address
 809                   actually exists. */
 810                relay_po = get_item_by_addr(sock_net(sk), &po->pppoe_relay);
 811                if (!relay_po)
 812                        break;
 813
 814                sock_put(sk_pppox(relay_po));
 815                sk->sk_state |= PPPOX_RELAY;
 816                err = 0;
 817                break;
 818        }
 819
 820        case PPPOEIOCDFWD:
 821                err = -EALREADY;
 822                if (!(sk->sk_state & PPPOX_RELAY))
 823                        break;
 824
 825                sk->sk_state &= ~PPPOX_RELAY;
 826                err = 0;
 827                break;
 828
 829        default:
 830                err = -ENOTTY;
 831        }
 832
 833        return err;
 834}
 835
 836static int pppoe_sendmsg(struct kiocb *iocb, struct socket *sock,
 837                  struct msghdr *m, size_t total_len)
 838{
 839        struct sk_buff *skb;
 840        struct sock *sk = sock->sk;
 841        struct pppox_sock *po = pppox_sk(sk);
 842        int error;
 843        struct pppoe_hdr hdr;
 844        struct pppoe_hdr *ph;
 845        struct net_device *dev;
 846        char *start;
 847
 848        lock_sock(sk);
 849        if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) {
 850                error = -ENOTCONN;
 851                goto end;
 852        }
 853
 854        hdr.ver = 1;
 855        hdr.type = 1;
 856        hdr.code = 0;
 857        hdr.sid = po->num;
 858
 859        dev = po->pppoe_dev;
 860
 861        error = -EMSGSIZE;
 862        if (total_len > (dev->mtu + dev->hard_header_len))
 863                goto end;
 864
 865
 866        skb = sock_wmalloc(sk, total_len + dev->hard_header_len + 32,
 867                           0, GFP_KERNEL);
 868        if (!skb) {
 869                error = -ENOMEM;
 870                goto end;
 871        }
 872
 873        /* Reserve space for headers. */
 874        skb_reserve(skb, dev->hard_header_len);
 875        skb_reset_network_header(skb);
 876
 877        skb->dev = dev;
 878
 879        skb->priority = sk->sk_priority;
 880        skb->protocol = cpu_to_be16(ETH_P_PPP_SES);
 881
 882        ph = (struct pppoe_hdr *)skb_put(skb, total_len + sizeof(struct pppoe_hdr));
 883        start = (char *)&ph->tag[0];
 884
 885        error = memcpy_fromiovec(start, m->msg_iov, total_len);
 886        if (error < 0) {
 887                kfree_skb(skb);
 888                goto end;
 889        }
 890
 891        error = total_len;
 892        dev_hard_header(skb, dev, ETH_P_PPP_SES,
 893                        po->pppoe_pa.remote, NULL, total_len);
 894
 895        memcpy(ph, &hdr, sizeof(struct pppoe_hdr));
 896
 897        ph->length = htons(total_len);
 898
 899        dev_queue_xmit(skb);
 900
 901end:
 902        release_sock(sk);
 903        return error;
 904}
 905
 906/************************************************************************
 907 *
 908 * xmit function for internal use.
 909 *
 910 ***********************************************************************/
 911static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
 912{
 913        struct pppox_sock *po = pppox_sk(sk);
 914        struct net_device *dev = po->pppoe_dev;
 915        struct pppoe_hdr *ph;
 916        int data_len = skb->len;
 917
 918        /* The higher-level PPP code (ppp_unregister_channel()) ensures the PPP
 919         * xmit operations conclude prior to an unregistration call.  Thus
 920         * sk->sk_state cannot change, so we don't need to do lock_sock().
 921         * But, we also can't do a lock_sock since that introduces a potential
 922         * deadlock as we'd reverse the lock ordering used when calling
 923         * ppp_unregister_channel().
 924         */
 925
 926        if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
 927                goto abort;
 928
 929        if (!dev)
 930                goto abort;
 931
 932        /* Copy the data if there is no space for the header or if it's
 933         * read-only.
 934         */
 935        if (skb_cow_head(skb, sizeof(*ph) + dev->hard_header_len))
 936                goto abort;
 937
 938        __skb_push(skb, sizeof(*ph));
 939        skb_reset_network_header(skb);
 940
 941        ph = pppoe_hdr(skb);
 942        ph->ver = 1;
 943        ph->type = 1;
 944        ph->code = 0;
 945        ph->sid = po->num;
 946        ph->length = htons(data_len);
 947
 948        skb->protocol = cpu_to_be16(ETH_P_PPP_SES);
 949        skb->dev = dev;
 950
 951        dev_hard_header(skb, dev, ETH_P_PPP_SES,
 952                        po->pppoe_pa.remote, NULL, data_len);
 953
 954        dev_queue_xmit(skb);
 955        return 1;
 956
 957abort:
 958        kfree_skb(skb);
 959        return 1;
 960}
 961
 962/************************************************************************
 963 *
 964 * xmit function called by generic PPP driver
 965 * sends PPP frame over PPPoE socket
 966 *
 967 ***********************************************************************/
 968static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb)
 969{
 970        struct sock *sk = (struct sock *)chan->private;
 971        return __pppoe_xmit(sk, skb);
 972}
 973
 974static struct ppp_channel_ops pppoe_chan_ops = {
 975        .start_xmit = pppoe_xmit,
 976};
 977
 978static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock,
 979                  struct msghdr *m, size_t total_len, int flags)
 980{
 981        struct sock *sk = sock->sk;
 982        struct sk_buff *skb;
 983        int error = 0;
 984
 985        if (sk->sk_state & PPPOX_BOUND) {
 986                error = -EIO;
 987                goto end;
 988        }
 989
 990        skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
 991                                flags & MSG_DONTWAIT, &error);
 992        if (error < 0)
 993                goto end;
 994
 995        m->msg_namelen = 0;
 996
 997        if (skb) {
 998                total_len = min_t(size_t, total_len, skb->len);
 999                error = skb_copy_datagram_iovec(skb, 0, m->msg_iov, total_len);
1000                if (error == 0)
1001                        error = total_len;
1002        }
1003
1004        kfree_skb(skb);
1005end:
1006        return error;
1007}
1008
1009#ifdef CONFIG_PROC_FS
1010static int pppoe_seq_show(struct seq_file *seq, void *v)
1011{
1012        struct pppox_sock *po;
1013        char *dev_name;
1014
1015        if (v == SEQ_START_TOKEN) {
1016                seq_puts(seq, "Id       Address              Device\n");
1017                goto out;
1018        }
1019
1020        po = v;
1021        dev_name = po->pppoe_pa.dev;
1022
1023        seq_printf(seq, "%08X %pM %8s\n",
1024                po->pppoe_pa.sid, po->pppoe_pa.remote, dev_name);
1025out:
1026        return 0;
1027}
1028
1029static inline struct pppox_sock *pppoe_get_idx(struct pppoe_net *pn, loff_t pos)
1030{
1031        struct pppox_sock *po;
1032        int i;
1033
1034        for (i = 0; i < PPPOE_HASH_SIZE; i++) {
1035                po = pn->hash_table[i];
1036                while (po) {
1037                        if (!pos--)
1038                                goto out;
1039                        po = po->next;
1040                }
1041        }
1042
1043out:
1044        return po;
1045}
1046
1047static void *pppoe_seq_start(struct seq_file *seq, loff_t *pos)
1048        __acquires(pn->hash_lock)
1049{
1050        struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq));
1051        loff_t l = *pos;
1052
1053        read_lock_bh(&pn->hash_lock);
1054        return l ? pppoe_get_idx(pn, --l) : SEQ_START_TOKEN;
1055}
1056
1057static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1058{
1059        struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq));
1060        struct pppox_sock *po;
1061
1062        ++*pos;
1063        if (v == SEQ_START_TOKEN) {
1064                po = pppoe_get_idx(pn, 0);
1065                goto out;
1066        }
1067        po = v;
1068        if (po->next)
1069                po = po->next;
1070        else {
1071                int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
1072
1073                po = NULL;
1074                while (++hash < PPPOE_HASH_SIZE) {
1075                        po = pn->hash_table[hash];
1076                        if (po)
1077                                break;
1078                }
1079        }
1080
1081out:
1082        return po;
1083}
1084
1085static void pppoe_seq_stop(struct seq_file *seq, void *v)
1086        __releases(pn->hash_lock)
1087{
1088        struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq));
1089        read_unlock_bh(&pn->hash_lock);
1090}
1091
1092static const struct seq_operations pppoe_seq_ops = {
1093        .start          = pppoe_seq_start,
1094        .next           = pppoe_seq_next,
1095        .stop           = pppoe_seq_stop,
1096        .show           = pppoe_seq_show,
1097};
1098
1099static int pppoe_seq_open(struct inode *inode, struct file *file)
1100{
1101        return seq_open_net(inode, file, &pppoe_seq_ops,
1102                        sizeof(struct seq_net_private));
1103}
1104
1105static const struct file_operations pppoe_seq_fops = {
1106        .owner          = THIS_MODULE,
1107        .open           = pppoe_seq_open,
1108        .read           = seq_read,
1109        .llseek         = seq_lseek,
1110        .release        = seq_release_net,
1111};
1112
1113#endif /* CONFIG_PROC_FS */
1114
1115static const struct proto_ops pppoe_ops = {
1116        .family         = AF_PPPOX,
1117        .owner          = THIS_MODULE,
1118        .release        = pppoe_release,
1119        .bind           = sock_no_bind,
1120        .connect        = pppoe_connect,
1121        .socketpair     = sock_no_socketpair,
1122        .accept         = sock_no_accept,
1123        .getname        = pppoe_getname,
1124        .poll           = datagram_poll,
1125        .listen         = sock_no_listen,
1126        .shutdown       = sock_no_shutdown,
1127        .setsockopt     = sock_no_setsockopt,
1128        .getsockopt     = sock_no_getsockopt,
1129        .sendmsg        = pppoe_sendmsg,
1130        .recvmsg        = pppoe_recvmsg,
1131        .mmap           = sock_no_mmap,
1132        .ioctl          = pppox_ioctl,
1133};
1134
1135static struct pppox_proto pppoe_proto = {
1136        .create = pppoe_create,
1137        .ioctl  = pppoe_ioctl,
1138        .owner  = THIS_MODULE,
1139};
1140
1141static __net_init int pppoe_init_net(struct net *net)
1142{
1143        struct pppoe_net *pn;
1144        struct proc_dir_entry *pde;
1145        int err;
1146
1147        pn = kzalloc(sizeof(*pn), GFP_KERNEL);
1148        if (!pn)
1149                return -ENOMEM;
1150
1151        rwlock_init(&pn->hash_lock);
1152
1153        err = net_assign_generic(net, pppoe_net_id, pn);
1154        if (err)
1155                goto out;
1156
1157        pde = proc_net_fops_create(net, "pppoe", S_IRUGO, &pppoe_seq_fops);
1158#ifdef CONFIG_PROC_FS
1159        if (!pde) {
1160                err = -ENOMEM;
1161                goto out;
1162        }
1163#endif
1164
1165        return 0;
1166
1167out:
1168        kfree(pn);
1169        return err;
1170}
1171
1172static __net_exit void pppoe_exit_net(struct net *net)
1173{
1174        struct pppoe_net *pn;
1175
1176        proc_net_remove(net, "pppoe");
1177        pn = net_generic(net, pppoe_net_id);
1178        /*
1179         * if someone has cached our net then
1180         * further net_generic call will return NULL
1181         */
1182        net_assign_generic(net, pppoe_net_id, NULL);
1183        kfree(pn);
1184}
1185
1186static struct pernet_operations pppoe_net_ops = {
1187        .init = pppoe_init_net,
1188        .exit = pppoe_exit_net,
1189};
1190
1191static int __init pppoe_init(void)
1192{
1193        int err;
1194
1195        err = register_pernet_gen_device(&pppoe_net_id, &pppoe_net_ops);
1196        if (err)
1197                goto out;
1198
1199        err = proto_register(&pppoe_sk_proto, 0);
1200        if (err)
1201                goto out_unregister_net_ops;
1202
1203        err = register_pppox_proto(PX_PROTO_OE, &pppoe_proto);
1204        if (err)
1205                goto out_unregister_pppoe_proto;
1206
1207        dev_add_pack(&pppoes_ptype);
1208        dev_add_pack(&pppoed_ptype);
1209        register_netdevice_notifier(&pppoe_notifier);
1210
1211        return 0;
1212
1213out_unregister_pppoe_proto:
1214        proto_unregister(&pppoe_sk_proto);
1215out_unregister_net_ops:
1216        unregister_pernet_gen_device(pppoe_net_id, &pppoe_net_ops);
1217out:
1218        return err;
1219}
1220
1221static void __exit pppoe_exit(void)
1222{
1223        unregister_netdevice_notifier(&pppoe_notifier);
1224        dev_remove_pack(&pppoed_ptype);
1225        dev_remove_pack(&pppoes_ptype);
1226        unregister_pppox_proto(PX_PROTO_OE);
1227        proto_unregister(&pppoe_sk_proto);
1228        unregister_pernet_gen_device(pppoe_net_id, &pppoe_net_ops);
1229}
1230
1231module_init(pppoe_init);
1232module_exit(pppoe_exit);
1233
1234MODULE_AUTHOR("Michal Ostrowski <mostrows@speakeasy.net>");
1235MODULE_DESCRIPTION("PPP over Ethernet driver");
1236MODULE_LICENSE("GPL");
1237MODULE_ALIAS_NETPROTO(PF_PPPOX);
1238