1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /** -*- linux-c -*- *********************************************************** 3 * Linux PPP over Ethernet (PPPoX/PPPoE) Sockets 4 * 5 * PPPoX --- Generic PPP encapsulation socket family 6 * PPPoE --- PPP over Ethernet (RFC 2516) 7 * 8 * Version: 0.7.0 9 * 10 * 070228 : Fix to allow multiple sessions with same remote MAC and same 11 * session id by including the local device ifindex in the 12 * tuple identifying a session. This also ensures packets can't 13 * be injected into a session from interfaces other than the one 14 * specified by userspace. Florian Zumbiehl <florz@florz.de> 15 * (Oh, BTW, this one is YYMMDD, in case you were wondering ...) 16 * 220102 : Fix module use count on failure in pppoe_create, pppox_sk -acme 17 * 030700 : Fixed connect logic to allow for disconnect. 18 * 270700 : Fixed potential SMP problems; we must protect against 19 * simultaneous invocation of ppp_input 20 * and ppp_unregister_channel. 21 * 040800 : Respect reference count mechanisms on net-devices. 22 * 200800 : fix kfree(skb) in pppoe_rcv (acme) 23 * Module reference count is decremented in the right spot now, 24 * guards against sock_put not actually freeing the sk 25 * in pppoe_release. 26 * 051000 : Initialization cleanup. 27 * 111100 : Fix recvmsg. 28 * 050101 : Fix PADT processing. 29 * 140501 : Use pppoe_rcv_core to handle all backlog. (Alexey) 30 * 170701 : Do not lock_sock with rwlock held. (DaveM) 31 * Ignore discovery frames if user has socket 32 * locked. (DaveM) 33 * Ignore return value of dev_queue_xmit in __pppoe_xmit 34 * or else we may kfree an SKB twice. (DaveM) 35 * 190701 : When doing copies of skb's in __pppoe_xmit, always delete 36 * the original skb that was passed in on success, never on 37 * failure. Delete the copy of the skb on failure to avoid 38 * a memory leak. 39 * 081001 : Misc. cleanup (licence string, non-blocking, prevent 40 * reference of device on close). 41 * 121301 : New ppp channels interface; cannot unregister a channel 42 * from interrupts. Thus, we mark the socket as a ZOMBIE 43 * and do the unregistration later. 44 * 081002 : seq_file support for proc stuff -acme 45 * 111602 : Merge all 2.4 fixes into 2.5/2.6 tree. Label 2.5/2.6 46 * as version 0.7. Spacing cleanup. 47 * Author: Michal Ostrowski <mostrows@speakeasy.net> 48 * Contributors: 49 * Arnaldo Carvalho de Melo <acme@conectiva.com.br> 50 * David S. Miller (davem@redhat.com) 51 * 52 * License: 53 */ 54 55 #include <linux/string.h> 56 #include <linux/module.h> 57 #include <linux/kernel.h> 58 #include <linux/slab.h> 59 #include <linux/errno.h> 60 #include <linux/netdevice.h> 61 #include <linux/net.h> 62 #include <linux/inetdevice.h> 63 #include <linux/etherdevice.h> 64 #include <linux/skbuff.h> 65 #include <linux/init.h> 66 #include <linux/if_ether.h> 67 #include <linux/if_pppox.h> 68 #include <linux/ppp_channel.h> 69 #include <linux/ppp_defs.h> 70 #include <linux/ppp-ioctl.h> 71 #include <linux/notifier.h> 72 #include <linux/file.h> 73 #include <linux/proc_fs.h> 74 #include <linux/seq_file.h> 75 76 #include <linux/nsproxy.h> 77 #include <net/net_namespace.h> 78 #include <net/netns/generic.h> 79 #include <net/sock.h> 80 81 #include <linux/uaccess.h> 82 83 #define PPPOE_HASH_BITS CONFIG_PPPOE_HASH_BITS 84 #define PPPOE_HASH_SIZE (1 << PPPOE_HASH_BITS) 85 #define PPPOE_HASH_MASK (PPPOE_HASH_SIZE - 1) 86 87 static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb); 88 89 static const struct proto_ops pppoe_ops; 90 static const struct ppp_channel_ops pppoe_chan_ops; 91 92 /* per-net private data for this module */ 93 static unsigned int pppoe_net_id __read_mostly; 94 struct pppoe_net { 95 /* 96 * we could use _single_ hash table for all 97 * nets by injecting net id into the hash but 98 * it would increase hash chains and add 99 * a few additional math comparisons messy 100 * as well, moreover in case of SMP less locking 101 * controversy here 102 */ 103 struct pppox_sock __rcu *hash_table[PPPOE_HASH_SIZE]; 104 spinlock_t hash_lock; 105 }; 106 107 /* 108 * PPPoE could be in the following stages: 109 * 1) Discovery stage (to obtain remote MAC and Session ID) 110 * 2) Session stage (MAC and SID are known) 111 * 112 * Ethernet frames have a special tag for this but 113 * we use simpler approach based on session id 114 */ 115 static inline bool stage_session(__be16 sid) 116 { 117 return sid != 0; 118 } 119 120 static inline struct pppoe_net *pppoe_pernet(struct net *net) 121 { 122 return net_generic(net, pppoe_net_id); 123 } 124 125 static inline int cmp_2_addr(struct pppoe_addr *a, struct pppoe_addr *b) 126 { 127 return a->sid == b->sid && ether_addr_equal(a->remote, b->remote); 128 } 129 130 static inline int cmp_addr(struct pppoe_addr *a, __be16 sid, char *addr) 131 { 132 return a->sid == sid && ether_addr_equal(a->remote, addr); 133 } 134 135 #if 8 % PPPOE_HASH_BITS 136 #error 8 must be a multiple of PPPOE_HASH_BITS 137 #endif 138 139 static int hash_item(__be16 sid, unsigned char *addr) 140 { 141 unsigned char hash = 0; 142 unsigned int i; 143 144 for (i = 0; i < ETH_ALEN; i++) 145 hash ^= addr[i]; 146 for (i = 0; i < sizeof(sid_t) * 8; i += 8) 147 hash ^= (__force __u32)sid >> i; 148 for (i = 8; (i >>= 1) >= PPPOE_HASH_BITS;) 149 hash ^= hash >> i; 150 151 return hash & PPPOE_HASH_MASK; 152 } 153 154 /********************************************************************** 155 * 156 * Set/get/delete/rehash items (internal versions) 157 * 158 **********************************************************************/ 159 static struct pppox_sock *__get_item(struct pppoe_net *pn, __be16 sid, 160 unsigned char *addr, int ifindex) 161 { 162 int hash = hash_item(sid, addr); 163 struct pppox_sock *ret; 164 165 ret = rcu_dereference(pn->hash_table[hash]); 166 while (ret) { 167 if (cmp_addr(&ret->pppoe_pa, sid, addr) && 168 ret->pppoe_ifindex == ifindex) 169 return ret; 170 171 ret = rcu_dereference(ret->next); 172 } 173 174 return NULL; 175 } 176 177 static int __set_item(struct pppoe_net *pn, struct pppox_sock *po) 178 { 179 int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); 180 struct pppox_sock *ret, *first; 181 182 first = rcu_dereference_protected(pn->hash_table[hash], lockdep_is_held(&pn->hash_lock)); 183 ret = first; 184 while (ret) { 185 if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa) && 186 ret->pppoe_ifindex == po->pppoe_ifindex) 187 return -EALREADY; 188 189 ret = rcu_dereference_protected(ret->next, lockdep_is_held(&pn->hash_lock)); 190 } 191 192 RCU_INIT_POINTER(po->next, first); 193 rcu_assign_pointer(pn->hash_table[hash], po); 194 195 return 0; 196 } 197 198 static void __delete_item(struct pppoe_net *pn, __be16 sid, 199 char *addr, int ifindex) 200 { 201 int hash = hash_item(sid, addr); 202 struct pppox_sock *ret, __rcu **src; 203 204 ret = rcu_dereference_protected(pn->hash_table[hash], lockdep_is_held(&pn->hash_lock)); 205 src = &pn->hash_table[hash]; 206 207 while (ret) { 208 if (cmp_addr(&ret->pppoe_pa, sid, addr) && 209 ret->pppoe_ifindex == ifindex) { 210 struct pppox_sock *next; 211 212 next = rcu_dereference_protected(ret->next, 213 lockdep_is_held(&pn->hash_lock)); 214 rcu_assign_pointer(*src, next); 215 break; 216 } 217 218 src = &ret->next; 219 ret = rcu_dereference_protected(ret->next, lockdep_is_held(&pn->hash_lock)); 220 } 221 } 222 223 /********************************************************************** 224 * 225 * Set/get/delete/rehash items 226 * 227 **********************************************************************/ 228 static inline struct pppox_sock *get_item(struct pppoe_net *pn, __be16 sid, 229 unsigned char *addr, int ifindex) 230 { 231 struct pppox_sock *po; 232 233 po = __get_item(pn, sid, addr, ifindex); 234 if (po && !refcount_inc_not_zero(&sk_pppox(po)->sk_refcnt)) 235 po = NULL; 236 237 return po; 238 } 239 240 static inline struct pppox_sock *__get_item_by_addr(struct net *net, 241 struct sockaddr_pppox *sp) 242 { 243 struct net_device *dev; 244 struct pppoe_net *pn; 245 struct pppox_sock *pppox_sock = NULL; 246 247 int ifindex; 248 249 dev = dev_get_by_name_rcu(net, sp->sa_addr.pppoe.dev); 250 if (dev) { 251 ifindex = dev->ifindex; 252 pn = pppoe_pernet(net); 253 pppox_sock = __get_item(pn, sp->sa_addr.pppoe.sid, 254 sp->sa_addr.pppoe.remote, ifindex); 255 } 256 return pppox_sock; 257 } 258 259 static inline void delete_item(struct pppoe_net *pn, __be16 sid, 260 char *addr, int ifindex) 261 { 262 spin_lock(&pn->hash_lock); 263 __delete_item(pn, sid, addr, ifindex); 264 spin_unlock(&pn->hash_lock); 265 } 266 267 /*************************************************************************** 268 * 269 * Handler for device events. 270 * Certain device events require that sockets be unconnected. 271 * 272 **************************************************************************/ 273 274 static void pppoe_flush_dev(struct net_device *dev) 275 { 276 struct pppoe_net *pn; 277 int i; 278 279 pn = pppoe_pernet(dev_net(dev)); 280 spin_lock(&pn->hash_lock); 281 for (i = 0; i < PPPOE_HASH_SIZE; i++) { 282 struct pppox_sock *po = rcu_dereference_protected(pn->hash_table[i], 283 lockdep_is_held(&pn->hash_lock)); 284 struct sock *sk; 285 286 while (po) { 287 while (po && po->pppoe_dev != dev) { 288 po = rcu_dereference_protected(po->next, 289 lockdep_is_held(&pn->hash_lock)); 290 } 291 292 if (!po) 293 break; 294 295 sk = sk_pppox(po); 296 297 /* We always grab the socket lock, followed by the 298 * hash_lock, in that order. Since we should hold the 299 * sock lock while doing any unbinding, we need to 300 * release the lock we're holding. Hold a reference to 301 * the sock so it doesn't disappear as we're jumping 302 * between locks. 303 */ 304 305 sock_hold(sk); 306 spin_unlock(&pn->hash_lock); 307 lock_sock(sk); 308 309 if (po->pppoe_dev == dev && 310 sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) { 311 pppox_unbind_sock(sk); 312 sk->sk_state_change(sk); 313 po->pppoe_dev = NULL; 314 dev_put(dev); 315 } 316 317 release_sock(sk); 318 sock_put(sk); 319 320 /* Restart the process from the start of the current 321 * hash chain. We dropped locks so the world may have 322 * change from underneath us. 323 */ 324 325 BUG_ON(pppoe_pernet(dev_net(dev)) == NULL); 326 spin_lock(&pn->hash_lock); 327 po = rcu_dereference_protected(pn->hash_table[i], 328 lockdep_is_held(&pn->hash_lock)); 329 } 330 } 331 spin_unlock(&pn->hash_lock); 332 } 333 334 static int pppoe_device_event(struct notifier_block *this, 335 unsigned long event, void *ptr) 336 { 337 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 338 339 /* Only look at sockets that are using this specific device. */ 340 switch (event) { 341 case NETDEV_CHANGEADDR: 342 case NETDEV_CHANGEMTU: 343 /* A change in mtu or address is a bad thing, requiring 344 * LCP re-negotiation. 345 */ 346 347 case NETDEV_GOING_DOWN: 348 case NETDEV_DOWN: 349 /* Find every socket on this device and kill it. */ 350 pppoe_flush_dev(dev); 351 break; 352 353 default: 354 break; 355 } 356 357 return NOTIFY_DONE; 358 } 359 360 static struct notifier_block pppoe_notifier = { 361 .notifier_call = pppoe_device_event, 362 }; 363 364 /************************************************************************ 365 * 366 * Do the real work of receiving a PPPoE Session frame. 367 * 368 ***********************************************************************/ 369 static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb) 370 { 371 struct pppox_sock *po = pppox_sk(sk); 372 struct pppox_sock *relay_po; 373 374 /* Backlog receive. Semantics of backlog rcv preclude any code from 375 * executing in lock_sock()/release_sock() bounds; meaning sk->sk_state 376 * can't change. 377 */ 378 379 if (sk->sk_state & PPPOX_BOUND) { 380 ppp_input(&po->chan, skb); 381 } else if (sk->sk_state & PPPOX_RELAY) { 382 relay_po = __get_item_by_addr(sock_net(sk), 383 &po->pppoe_relay); 384 if (relay_po == NULL) 385 goto abort_kfree; 386 387 if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0) 388 goto abort_kfree; 389 390 if (!__pppoe_xmit(sk_pppox(relay_po), skb)) 391 goto abort_kfree; 392 } else { 393 if (sock_queue_rcv_skb(sk, skb)) 394 goto abort_kfree; 395 } 396 397 return NET_RX_SUCCESS; 398 399 abort_kfree: 400 kfree_skb(skb); 401 return NET_RX_DROP; 402 } 403 404 /************************************************************************ 405 * 406 * Receive wrapper called in BH context. 407 * 408 ***********************************************************************/ 409 static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev, 410 struct packet_type *pt, struct net_device *orig_dev) 411 { 412 struct pppoe_hdr *ph; 413 struct pppox_sock *po; 414 struct pppoe_net *pn; 415 int len; 416 417 if (skb->pkt_type == PACKET_OTHERHOST) 418 goto drop; 419 420 skb = skb_share_check(skb, GFP_ATOMIC); 421 if (!skb) 422 goto out; 423 424 if (skb_mac_header_len(skb) < ETH_HLEN) 425 goto drop; 426 427 if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) 428 goto drop; 429 430 ph = pppoe_hdr(skb); 431 len = ntohs(ph->length); 432 433 skb_pull_rcsum(skb, sizeof(*ph)); 434 if (skb->len < len) 435 goto drop; 436 437 if (pskb_trim_rcsum(skb, len)) 438 goto drop; 439 440 ph = pppoe_hdr(skb); 441 pn = pppoe_pernet(dev_net(dev)); 442 443 po = __get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); 444 if (!po) 445 goto drop; 446 447 return __sk_receive_skb(sk_pppox(po), skb, 0, 1, false); 448 449 drop: 450 kfree_skb(skb); 451 out: 452 return NET_RX_DROP; 453 } 454 455 static void pppoe_unbind_sock_work(struct work_struct *work) 456 { 457 struct pppox_sock *po = container_of(work, struct pppox_sock, 458 proto.pppoe.padt_work); 459 struct sock *sk = sk_pppox(po); 460 461 lock_sock(sk); 462 if (po->pppoe_dev) { 463 dev_put(po->pppoe_dev); 464 po->pppoe_dev = NULL; 465 } 466 pppox_unbind_sock(sk); 467 release_sock(sk); 468 sock_put(sk); 469 } 470 471 /************************************************************************ 472 * 473 * Receive a PPPoE Discovery frame. 474 * This is solely for detection of PADT frames 475 * 476 ***********************************************************************/ 477 static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev, 478 struct packet_type *pt, struct net_device *orig_dev) 479 480 { 481 struct pppoe_hdr *ph; 482 struct pppox_sock *po; 483 struct pppoe_net *pn; 484 485 skb = skb_share_check(skb, GFP_ATOMIC); 486 if (!skb) 487 goto out; 488 489 if (skb->pkt_type != PACKET_HOST) 490 goto abort; 491 492 if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) 493 goto abort; 494 495 ph = pppoe_hdr(skb); 496 if (ph->code != PADT_CODE) 497 goto abort; 498 499 pn = pppoe_pernet(dev_net(dev)); 500 po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); 501 if (po) 502 if (!schedule_work(&po->proto.pppoe.padt_work)) 503 sock_put(sk_pppox(po)); 504 505 abort: 506 kfree_skb(skb); 507 out: 508 return NET_RX_SUCCESS; /* Lies... :-) */ 509 } 510 511 static struct packet_type pppoes_ptype __read_mostly = { 512 .type = cpu_to_be16(ETH_P_PPP_SES), 513 .func = pppoe_rcv, 514 }; 515 516 static struct packet_type pppoed_ptype __read_mostly = { 517 .type = cpu_to_be16(ETH_P_PPP_DISC), 518 .func = pppoe_disc_rcv, 519 }; 520 521 static struct proto pppoe_sk_proto __read_mostly = { 522 .name = "PPPOE", 523 .owner = THIS_MODULE, 524 .obj_size = sizeof(struct pppox_sock), 525 }; 526 527 static void pppoe_destruct(struct sock *sk) 528 { 529 skb_queue_purge(&sk->sk_receive_queue); 530 } 531 532 /*********************************************************************** 533 * 534 * Initialize a new struct sock. 535 * 536 **********************************************************************/ 537 static int pppoe_create(struct net *net, struct socket *sock, int kern) 538 { 539 struct sock *sk; 540 541 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppoe_sk_proto, kern); 542 if (!sk) 543 return -ENOMEM; 544 545 sock_init_data(sock, sk); 546 sock_set_flag(sk, SOCK_RCU_FREE); 547 548 sock->state = SS_UNCONNECTED; 549 sock->ops = &pppoe_ops; 550 551 sk->sk_backlog_rcv = pppoe_rcv_core; 552 sk->sk_destruct = pppoe_destruct; 553 sk->sk_state = PPPOX_NONE; 554 sk->sk_type = SOCK_STREAM; 555 sk->sk_family = PF_PPPOX; 556 sk->sk_protocol = PX_PROTO_OE; 557 558 INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work, 559 pppoe_unbind_sock_work); 560 561 return 0; 562 } 563 564 static int pppoe_release(struct socket *sock) 565 { 566 struct sock *sk = sock->sk; 567 struct pppox_sock *po; 568 struct pppoe_net *pn; 569 struct net *net = NULL; 570 571 if (!sk) 572 return 0; 573 574 lock_sock(sk); 575 if (sock_flag(sk, SOCK_DEAD)) { 576 release_sock(sk); 577 return -EBADF; 578 } 579 580 po = pppox_sk(sk); 581 582 if (po->pppoe_dev) { 583 dev_put(po->pppoe_dev); 584 po->pppoe_dev = NULL; 585 } 586 587 pppox_unbind_sock(sk); 588 589 /* Signal the death of the socket. */ 590 sk->sk_state = PPPOX_DEAD; 591 592 net = sock_net(sk); 593 pn = pppoe_pernet(net); 594 595 /* 596 * protect "po" from concurrent updates 597 * on pppoe_flush_dev 598 */ 599 delete_item(pn, po->pppoe_pa.sid, po->pppoe_pa.remote, 600 po->pppoe_ifindex); 601 602 sock_orphan(sk); 603 sock->sk = NULL; 604 605 release_sock(sk); 606 sock_put(sk); 607 608 return 0; 609 } 610 611 static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr, 612 int sockaddr_len, int flags) 613 { 614 struct sock *sk = sock->sk; 615 struct sockaddr_pppox *sp = (struct sockaddr_pppox *)uservaddr; 616 struct pppox_sock *po = pppox_sk(sk); 617 struct net_device *dev = NULL; 618 struct pppoe_net *pn; 619 struct net *net = NULL; 620 int error; 621 622 lock_sock(sk); 623 624 error = -EINVAL; 625 626 if (sockaddr_len != sizeof(struct sockaddr_pppox)) 627 goto end; 628 629 if (sp->sa_protocol != PX_PROTO_OE) 630 goto end; 631 632 /* Check for already bound sockets */ 633 error = -EBUSY; 634 if ((sk->sk_state & PPPOX_CONNECTED) && 635 stage_session(sp->sa_addr.pppoe.sid)) 636 goto end; 637 638 /* Check for already disconnected sockets, on attempts to disconnect */ 639 error = -EALREADY; 640 if ((sk->sk_state & PPPOX_DEAD) && 641 !stage_session(sp->sa_addr.pppoe.sid)) 642 goto end; 643 644 error = 0; 645 646 /* Delete the old binding */ 647 if (stage_session(po->pppoe_pa.sid)) { 648 pppox_unbind_sock(sk); 649 pn = pppoe_pernet(sock_net(sk)); 650 delete_item(pn, po->pppoe_pa.sid, 651 po->pppoe_pa.remote, po->pppoe_ifindex); 652 if (po->pppoe_dev) { 653 dev_put(po->pppoe_dev); 654 po->pppoe_dev = NULL; 655 } 656 657 po->pppoe_ifindex = 0; 658 memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa)); 659 memset(&po->pppoe_relay, 0, sizeof(po->pppoe_relay)); 660 memset(&po->chan, 0, sizeof(po->chan)); 661 po->next = NULL; 662 po->num = 0; 663 664 sk->sk_state = PPPOX_NONE; 665 } 666 667 /* Re-bind in session stage only */ 668 if (stage_session(sp->sa_addr.pppoe.sid)) { 669 error = -ENODEV; 670 net = sock_net(sk); 671 dev = dev_get_by_name(net, sp->sa_addr.pppoe.dev); 672 if (!dev) 673 goto err_put; 674 675 po->pppoe_dev = dev; 676 po->pppoe_ifindex = dev->ifindex; 677 pn = pppoe_pernet(net); 678 if (!(dev->flags & IFF_UP)) { 679 goto err_put; 680 } 681 682 memcpy(&po->pppoe_pa, 683 &sp->sa_addr.pppoe, 684 sizeof(struct pppoe_addr)); 685 686 spin_lock(&pn->hash_lock); 687 error = __set_item(pn, po); 688 spin_unlock(&pn->hash_lock); 689 if (error < 0) 690 goto err_put; 691 692 po->chan.hdrlen = (sizeof(struct pppoe_hdr) + 693 dev->hard_header_len); 694 695 po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2; 696 po->chan.private = sk; 697 po->chan.ops = &pppoe_chan_ops; 698 po->chan.direct_xmit = true; 699 700 error = ppp_register_net_channel(dev_net(dev), &po->chan); 701 if (error) { 702 delete_item(pn, po->pppoe_pa.sid, 703 po->pppoe_pa.remote, po->pppoe_ifindex); 704 goto err_put; 705 } 706 707 sk->sk_state = PPPOX_CONNECTED; 708 } 709 710 po->num = sp->sa_addr.pppoe.sid; 711 712 end: 713 release_sock(sk); 714 return error; 715 err_put: 716 if (po->pppoe_dev) { 717 dev_put(po->pppoe_dev); 718 po->pppoe_dev = NULL; 719 } 720 goto end; 721 } 722 723 static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr, 724 int peer) 725 { 726 int len = sizeof(struct sockaddr_pppox); 727 struct sockaddr_pppox sp; 728 729 sp.sa_family = AF_PPPOX; 730 sp.sa_protocol = PX_PROTO_OE; 731 memcpy(&sp.sa_addr.pppoe, &pppox_sk(sock->sk)->pppoe_pa, 732 sizeof(struct pppoe_addr)); 733 734 memcpy(uaddr, &sp, len); 735 736 return len; 737 } 738 739 static int pppoe_ioctl(struct socket *sock, unsigned int cmd, 740 unsigned long arg) 741 { 742 struct sock *sk = sock->sk; 743 struct pppox_sock *po = pppox_sk(sk); 744 int val; 745 int err; 746 747 switch (cmd) { 748 case PPPIOCGMRU: 749 err = -ENXIO; 750 if (!(sk->sk_state & PPPOX_CONNECTED)) 751 break; 752 753 err = -EFAULT; 754 if (put_user(po->pppoe_dev->mtu - 755 sizeof(struct pppoe_hdr) - 756 PPP_HDRLEN, 757 (int __user *)arg)) 758 break; 759 err = 0; 760 break; 761 762 case PPPIOCSMRU: 763 err = -ENXIO; 764 if (!(sk->sk_state & PPPOX_CONNECTED)) 765 break; 766 767 err = -EFAULT; 768 if (get_user(val, (int __user *)arg)) 769 break; 770 771 if (val < (po->pppoe_dev->mtu 772 - sizeof(struct pppoe_hdr) 773 - PPP_HDRLEN)) 774 err = 0; 775 else 776 err = -EINVAL; 777 break; 778 779 case PPPIOCSFLAGS: 780 err = -EFAULT; 781 if (get_user(val, (int __user *)arg)) 782 break; 783 err = 0; 784 break; 785 786 case PPPOEIOCSFWD: 787 { 788 struct pppox_sock *relay_po; 789 790 err = -EBUSY; 791 if (sk->sk_state & (PPPOX_BOUND | PPPOX_DEAD)) 792 break; 793 794 err = -ENOTCONN; 795 if (!(sk->sk_state & PPPOX_CONNECTED)) 796 break; 797 798 /* PPPoE address from the user specifies an outbound 799 PPPoE address which frames are forwarded to */ 800 err = -EFAULT; 801 if (copy_from_user(&po->pppoe_relay, 802 (void __user *)arg, 803 sizeof(struct sockaddr_pppox))) 804 break; 805 806 err = -EINVAL; 807 if (po->pppoe_relay.sa_family != AF_PPPOX || 808 po->pppoe_relay.sa_protocol != PX_PROTO_OE) 809 break; 810 811 /* Check that the socket referenced by the address 812 actually exists. */ 813 rcu_read_lock(); 814 relay_po = __get_item_by_addr(sock_net(sk), &po->pppoe_relay); 815 rcu_read_unlock(); 816 if (!relay_po) 817 break; 818 819 sk->sk_state |= PPPOX_RELAY; 820 err = 0; 821 break; 822 } 823 824 case PPPOEIOCDFWD: 825 err = -EALREADY; 826 if (!(sk->sk_state & PPPOX_RELAY)) 827 break; 828 829 sk->sk_state &= ~PPPOX_RELAY; 830 err = 0; 831 break; 832 833 default: 834 err = -ENOTTY; 835 } 836 837 return err; 838 } 839 840 static int pppoe_sendmsg(struct socket *sock, struct msghdr *m, 841 size_t total_len) 842 { 843 struct sk_buff *skb; 844 struct sock *sk = sock->sk; 845 struct pppox_sock *po = pppox_sk(sk); 846 int error; 847 struct pppoe_hdr hdr; 848 struct pppoe_hdr *ph; 849 struct net_device *dev; 850 char *start; 851 int hlen; 852 853 lock_sock(sk); 854 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) { 855 error = -ENOTCONN; 856 goto end; 857 } 858 859 hdr.ver = 1; 860 hdr.type = 1; 861 hdr.code = 0; 862 hdr.sid = po->num; 863 864 dev = po->pppoe_dev; 865 866 error = -EMSGSIZE; 867 if (total_len > (dev->mtu + dev->hard_header_len)) 868 goto end; 869 870 hlen = LL_RESERVED_SPACE(dev); 871 skb = sock_wmalloc(sk, hlen + sizeof(*ph) + total_len + 872 dev->needed_tailroom, 0, GFP_KERNEL); 873 if (!skb) { 874 error = -ENOMEM; 875 goto end; 876 } 877 878 /* Reserve space for headers. */ 879 skb_reserve(skb, hlen); 880 skb_reset_network_header(skb); 881 882 skb->dev = dev; 883 884 skb->priority = READ_ONCE(sk->sk_priority); 885 skb->protocol = cpu_to_be16(ETH_P_PPP_SES); 886 887 ph = skb_put(skb, total_len + sizeof(struct pppoe_hdr)); 888 start = (char *)&ph->tag[0]; 889 890 error = memcpy_from_msg(start, m, total_len); 891 if (error < 0) { 892 kfree_skb(skb); 893 goto end; 894 } 895 896 error = total_len; 897 dev_hard_header(skb, dev, ETH_P_PPP_SES, 898 po->pppoe_pa.remote, NULL, total_len); 899 900 memcpy(ph, &hdr, sizeof(struct pppoe_hdr)); 901 902 ph->length = htons(total_len); 903 904 dev_queue_xmit(skb); 905 906 end: 907 release_sock(sk); 908 return error; 909 } 910 911 /************************************************************************ 912 * 913 * xmit function for internal use. 914 * 915 ***********************************************************************/ 916 static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb) 917 { 918 struct pppox_sock *po = pppox_sk(sk); 919 struct net_device *dev = po->pppoe_dev; 920 struct pppoe_hdr *ph; 921 int data_len = skb->len; 922 923 /* The higher-level PPP code (ppp_unregister_channel()) ensures the PPP 924 * xmit operations conclude prior to an unregistration call. Thus 925 * sk->sk_state cannot change, so we don't need to do lock_sock(). 926 * But, we also can't do a lock_sock since that introduces a potential 927 * deadlock as we'd reverse the lock ordering used when calling 928 * ppp_unregister_channel(). 929 */ 930 931 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 932 goto abort; 933 934 if (!dev) 935 goto abort; 936 937 /* Copy the data if there is no space for the header or if it's 938 * read-only. 939 */ 940 if (skb_cow_head(skb, LL_RESERVED_SPACE(dev) + sizeof(*ph))) 941 goto abort; 942 943 __skb_push(skb, sizeof(*ph)); 944 skb_reset_network_header(skb); 945 946 ph = pppoe_hdr(skb); 947 ph->ver = 1; 948 ph->type = 1; 949 ph->code = 0; 950 ph->sid = po->num; 951 ph->length = htons(data_len); 952 953 skb->protocol = cpu_to_be16(ETH_P_PPP_SES); 954 skb->dev = dev; 955 956 dev_hard_header(skb, dev, ETH_P_PPP_SES, 957 po->pppoe_pa.remote, NULL, data_len); 958 959 dev_queue_xmit(skb); 960 return 1; 961 962 abort: 963 kfree_skb(skb); 964 return 1; 965 } 966 967 /************************************************************************ 968 * 969 * xmit function called by generic PPP driver 970 * sends PPP frame over PPPoE socket 971 * 972 ***********************************************************************/ 973 static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb) 974 { 975 struct sock *sk = chan->private; 976 return __pppoe_xmit(sk, skb); 977 } 978 979 static int pppoe_fill_forward_path(struct net_device_path_ctx *ctx, 980 struct net_device_path *path, 981 const struct ppp_channel *chan) 982 { 983 struct sock *sk = chan->private; 984 struct pppox_sock *po = pppox_sk(sk); 985 struct net_device *dev = po->pppoe_dev; 986 987 if (sock_flag(sk, SOCK_DEAD) || 988 !(sk->sk_state & PPPOX_CONNECTED) || !dev) 989 return -1; 990 991 path->type = DEV_PATH_PPPOE; 992 path->encap.proto = htons(ETH_P_PPP_SES); 993 path->encap.id = be16_to_cpu(po->num); 994 memcpy(path->encap.h_dest, po->pppoe_pa.remote, ETH_ALEN); 995 memcpy(ctx->daddr, po->pppoe_pa.remote, ETH_ALEN); 996 path->dev = ctx->dev; 997 ctx->dev = dev; 998 999 return 0; 1000 } 1001 1002 static const struct ppp_channel_ops pppoe_chan_ops = { 1003 .start_xmit = pppoe_xmit, 1004 .fill_forward_path = pppoe_fill_forward_path, 1005 }; 1006 1007 static int pppoe_recvmsg(struct socket *sock, struct msghdr *m, 1008 size_t total_len, int flags) 1009 { 1010 struct sock *sk = sock->sk; 1011 struct sk_buff *skb; 1012 int error = 0; 1013 1014 if (sk->sk_state & PPPOX_BOUND) 1015 return -EIO; 1016 1017 skb = skb_recv_datagram(sk, flags, &error); 1018 if (!skb) 1019 return error; 1020 1021 total_len = min_t(size_t, total_len, skb->len); 1022 error = skb_copy_datagram_msg(skb, 0, m, total_len); 1023 if (error == 0) { 1024 consume_skb(skb); 1025 return total_len; 1026 } 1027 1028 kfree_skb(skb); 1029 return error; 1030 } 1031 1032 #ifdef CONFIG_PROC_FS 1033 static int pppoe_seq_show(struct seq_file *seq, void *v) 1034 { 1035 struct pppox_sock *po; 1036 char *dev_name; 1037 1038 if (v == SEQ_START_TOKEN) { 1039 seq_puts(seq, "Id Address Device\n"); 1040 goto out; 1041 } 1042 1043 po = v; 1044 dev_name = po->pppoe_pa.dev; 1045 1046 seq_printf(seq, "%08X %pM %8s\n", 1047 po->pppoe_pa.sid, po->pppoe_pa.remote, dev_name); 1048 out: 1049 return 0; 1050 } 1051 1052 static inline struct pppox_sock *pppoe_get_idx(struct pppoe_net *pn, loff_t pos) 1053 { 1054 struct pppox_sock *po; 1055 int i; 1056 1057 for (i = 0; i < PPPOE_HASH_SIZE; i++) { 1058 po = rcu_dereference(pn->hash_table[i]); 1059 while (po) { 1060 if (!pos--) 1061 goto out; 1062 po = rcu_dereference(po->next); 1063 } 1064 } 1065 1066 out: 1067 return po; 1068 } 1069 1070 static void *pppoe_seq_start(struct seq_file *seq, loff_t *pos) 1071 __acquires(RCU) 1072 { 1073 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 1074 loff_t l = *pos; 1075 1076 rcu_read_lock(); 1077 return l ? pppoe_get_idx(pn, --l) : SEQ_START_TOKEN; 1078 } 1079 1080 static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos) 1081 { 1082 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 1083 struct pppox_sock *po, *next; 1084 1085 ++*pos; 1086 if (v == SEQ_START_TOKEN) { 1087 po = pppoe_get_idx(pn, 0); 1088 goto out; 1089 } 1090 po = v; 1091 next = rcu_dereference(po->next); 1092 if (next) 1093 po = next; 1094 else { 1095 int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); 1096 1097 po = NULL; 1098 while (++hash < PPPOE_HASH_SIZE) { 1099 po = rcu_dereference(pn->hash_table[hash]); 1100 if (po) 1101 break; 1102 } 1103 } 1104 1105 out: 1106 return po; 1107 } 1108 1109 static void pppoe_seq_stop(struct seq_file *seq, void *v) 1110 __releases(RCU) 1111 { 1112 rcu_read_unlock(); 1113 } 1114 1115 static const struct seq_operations pppoe_seq_ops = { 1116 .start = pppoe_seq_start, 1117 .next = pppoe_seq_next, 1118 .stop = pppoe_seq_stop, 1119 .show = pppoe_seq_show, 1120 }; 1121 #endif /* CONFIG_PROC_FS */ 1122 1123 static const struct proto_ops pppoe_ops = { 1124 .family = AF_PPPOX, 1125 .owner = THIS_MODULE, 1126 .release = pppoe_release, 1127 .bind = sock_no_bind, 1128 .connect = pppoe_connect, 1129 .socketpair = sock_no_socketpair, 1130 .accept = sock_no_accept, 1131 .getname = pppoe_getname, 1132 .poll = datagram_poll, 1133 .listen = sock_no_listen, 1134 .shutdown = sock_no_shutdown, 1135 .sendmsg = pppoe_sendmsg, 1136 .recvmsg = pppoe_recvmsg, 1137 .mmap = sock_no_mmap, 1138 .ioctl = pppox_ioctl, 1139 #ifdef CONFIG_COMPAT 1140 .compat_ioctl = pppox_compat_ioctl, 1141 #endif 1142 }; 1143 1144 static const struct pppox_proto pppoe_proto = { 1145 .create = pppoe_create, 1146 .ioctl = pppoe_ioctl, 1147 .owner = THIS_MODULE, 1148 }; 1149 1150 static __net_init int pppoe_init_net(struct net *net) 1151 { 1152 struct pppoe_net *pn = pppoe_pernet(net); 1153 struct proc_dir_entry *pde; 1154 1155 spin_lock_init(&pn->hash_lock); 1156 1157 pde = proc_create_net("pppoe", 0444, net->proc_net, 1158 &pppoe_seq_ops, sizeof(struct seq_net_private)); 1159 #ifdef CONFIG_PROC_FS 1160 if (!pde) 1161 return -ENOMEM; 1162 #endif 1163 1164 return 0; 1165 } 1166 1167 static __net_exit void pppoe_exit_net(struct net *net) 1168 { 1169 remove_proc_entry("pppoe", net->proc_net); 1170 } 1171 1172 static struct pernet_operations pppoe_net_ops = { 1173 .init = pppoe_init_net, 1174 .exit = pppoe_exit_net, 1175 .id = &pppoe_net_id, 1176 .size = sizeof(struct pppoe_net), 1177 }; 1178 1179 static int __init pppoe_init(void) 1180 { 1181 int err; 1182 1183 err = register_pernet_device(&pppoe_net_ops); 1184 if (err) 1185 goto out; 1186 1187 err = proto_register(&pppoe_sk_proto, 0); 1188 if (err) 1189 goto out_unregister_net_ops; 1190 1191 err = register_pppox_proto(PX_PROTO_OE, &pppoe_proto); 1192 if (err) 1193 goto out_unregister_pppoe_proto; 1194 1195 dev_add_pack(&pppoes_ptype); 1196 dev_add_pack(&pppoed_ptype); 1197 register_netdevice_notifier(&pppoe_notifier); 1198 1199 return 0; 1200 1201 out_unregister_pppoe_proto: 1202 proto_unregister(&pppoe_sk_proto); 1203 out_unregister_net_ops: 1204 unregister_pernet_device(&pppoe_net_ops); 1205 out: 1206 return err; 1207 } 1208 1209 static void __exit pppoe_exit(void) 1210 { 1211 unregister_netdevice_notifier(&pppoe_notifier); 1212 dev_remove_pack(&pppoed_ptype); 1213 dev_remove_pack(&pppoes_ptype); 1214 unregister_pppox_proto(PX_PROTO_OE); 1215 proto_unregister(&pppoe_sk_proto); 1216 unregister_pernet_device(&pppoe_net_ops); 1217 } 1218 1219 module_init(pppoe_init); 1220 module_exit(pppoe_exit); 1221 1222 MODULE_AUTHOR("Michal Ostrowski <mostrows@speakeasy.net>"); 1223 MODULE_DESCRIPTION("PPP over Ethernet driver"); 1224 MODULE_LICENSE("GPL"); 1225 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OE); 1226