1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /** -*- linux-c -*- *********************************************************** 3 * Linux PPP over Ethernet (PPPoX/PPPoE) Sockets 4 * 5 * PPPoX --- Generic PPP encapsulation socket family 6 * PPPoE --- PPP over Ethernet (RFC 2516) 7 * 8 * Version: 0.7.0 9 * 10 * 070228 : Fix to allow multiple sessions with same remote MAC and same 11 * session id by including the local device ifindex in the 12 * tuple identifying a session. This also ensures packets can't 13 * be injected into a session from interfaces other than the one 14 * specified by userspace. Florian Zumbiehl <florz@florz.de> 15 * (Oh, BTW, this one is YYMMDD, in case you were wondering ...) 16 * 220102 : Fix module use count on failure in pppoe_create, pppox_sk -acme 17 * 030700 : Fixed connect logic to allow for disconnect. 18 * 270700 : Fixed potential SMP problems; we must protect against 19 * simultaneous invocation of ppp_input 20 * and ppp_unregister_channel. 21 * 040800 : Respect reference count mechanisms on net-devices. 22 * 200800 : fix kfree(skb) in pppoe_rcv (acme) 23 * Module reference count is decremented in the right spot now, 24 * guards against sock_put not actually freeing the sk 25 * in pppoe_release. 26 * 051000 : Initialization cleanup. 27 * 111100 : Fix recvmsg. 28 * 050101 : Fix PADT processing. 29 * 140501 : Use pppoe_rcv_core to handle all backlog. (Alexey) 30 * 170701 : Do not lock_sock with rwlock held. (DaveM) 31 * Ignore discovery frames if user has socket 32 * locked. (DaveM) 33 * Ignore return value of dev_queue_xmit in __pppoe_xmit 34 * or else we may kfree an SKB twice. (DaveM) 35 * 190701 : When doing copies of skb's in __pppoe_xmit, always delete 36 * the original skb that was passed in on success, never on 37 * failure. Delete the copy of the skb on failure to avoid 38 * a memory leak. 39 * 081001 : Misc. cleanup (licence string, non-blocking, prevent 40 * reference of device on close). 41 * 121301 : New ppp channels interface; cannot unregister a channel 42 * from interrupts. Thus, we mark the socket as a ZOMBIE 43 * and do the unregistration later. 44 * 081002 : seq_file support for proc stuff -acme 45 * 111602 : Merge all 2.4 fixes into 2.5/2.6 tree. Label 2.5/2.6 46 * as version 0.7. Spacing cleanup. 47 * Author: Michal Ostrowski <mostrows@speakeasy.net> 48 * Contributors: 49 * Arnaldo Carvalho de Melo <acme@conectiva.com.br> 50 * David S. Miller (davem@redhat.com) 51 * 52 * License: 53 */ 54 55 #include <linux/string.h> 56 #include <linux/module.h> 57 #include <linux/kernel.h> 58 #include <linux/slab.h> 59 #include <linux/errno.h> 60 #include <linux/netdevice.h> 61 #include <linux/net.h> 62 #include <linux/inetdevice.h> 63 #include <linux/etherdevice.h> 64 #include <linux/skbuff.h> 65 #include <linux/init.h> 66 #include <linux/if_ether.h> 67 #include <linux/if_pppox.h> 68 #include <linux/ppp_channel.h> 69 #include <linux/ppp_defs.h> 70 #include <linux/ppp-ioctl.h> 71 #include <linux/notifier.h> 72 #include <linux/file.h> 73 #include <linux/proc_fs.h> 74 #include <linux/seq_file.h> 75 76 #include <linux/nsproxy.h> 77 #include <net/net_namespace.h> 78 #include <net/netns/generic.h> 79 #include <net/sock.h> 80 #include <net/gro.h> 81 82 #include <linux/uaccess.h> 83 84 #define PPPOE_HASH_BITS CONFIG_PPPOE_HASH_BITS 85 #define PPPOE_HASH_SIZE (1 << PPPOE_HASH_BITS) 86 #define PPPOE_HASH_MASK (PPPOE_HASH_SIZE - 1) 87 88 static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb); 89 90 static const struct proto_ops pppoe_ops; 91 static const struct ppp_channel_ops pppoe_chan_ops; 92 93 /* per-net private data for this module */ 94 static unsigned int pppoe_net_id __read_mostly; 95 struct pppoe_net { 96 /* 97 * we could use _single_ hash table for all 98 * nets by injecting net id into the hash but 99 * it would increase hash chains and add 100 * a few additional math comparisons messy 101 * as well, moreover in case of SMP less locking 102 * controversy here 103 */ 104 struct pppox_sock __rcu *hash_table[PPPOE_HASH_SIZE]; 105 spinlock_t hash_lock; 106 }; 107 108 /* 109 * PPPoE could be in the following stages: 110 * 1) Discovery stage (to obtain remote MAC and Session ID) 111 * 2) Session stage (MAC and SID are known) 112 * 113 * Ethernet frames have a special tag for this but 114 * we use simpler approach based on session id 115 */ 116 static inline bool stage_session(__be16 sid) 117 { 118 return sid != 0; 119 } 120 121 static inline struct pppoe_net *pppoe_pernet(struct net *net) 122 { 123 return net_generic(net, pppoe_net_id); 124 } 125 126 static inline int cmp_2_addr(struct pppoe_addr *a, struct pppoe_addr *b) 127 { 128 return a->sid == b->sid && ether_addr_equal(a->remote, b->remote); 129 } 130 131 static inline int cmp_addr(struct pppoe_addr *a, __be16 sid, char *addr) 132 { 133 return a->sid == sid && ether_addr_equal(a->remote, addr); 134 } 135 136 #if 8 % PPPOE_HASH_BITS 137 #error 8 must be a multiple of PPPOE_HASH_BITS 138 #endif 139 140 static u8 hash_item(__be16 sid, const u8 addr[ETH_ALEN]) 141 { 142 const u16 *addr16 = (const u16 *)addr; 143 unsigned int i; 144 u16 hash16; 145 u8 hash; 146 147 hash16 = addr16[0] ^ addr16[1] ^ addr16[2] ^ (__force u16)sid; 148 hash = (hash16 >> 8) ^ hash16; 149 for (i = 8; (i >>= 1) >= PPPOE_HASH_BITS;) 150 hash ^= hash >> i; 151 152 return hash & PPPOE_HASH_MASK; 153 } 154 155 /********************************************************************** 156 * 157 * Set/get/delete/rehash items (internal versions) 158 * 159 **********************************************************************/ 160 static struct pppox_sock *__get_item(struct pppoe_net *pn, __be16 sid, 161 unsigned char *addr, int ifindex) 162 { 163 int hash = hash_item(sid, addr); 164 struct pppox_sock *ret; 165 166 ret = rcu_dereference(pn->hash_table[hash]); 167 while (ret) { 168 if (cmp_addr(&ret->pppoe_pa, sid, addr) && 169 ret->pppoe_ifindex == ifindex) 170 return ret; 171 172 ret = rcu_dereference(ret->next); 173 } 174 175 return NULL; 176 } 177 178 static int __set_item(struct pppoe_net *pn, struct pppox_sock *po) 179 { 180 int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); 181 struct pppox_sock *ret, *first; 182 183 first = rcu_dereference_protected(pn->hash_table[hash], lockdep_is_held(&pn->hash_lock)); 184 ret = first; 185 while (ret) { 186 if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa) && 187 ret->pppoe_ifindex == po->pppoe_ifindex) 188 return -EALREADY; 189 190 ret = rcu_dereference_protected(ret->next, lockdep_is_held(&pn->hash_lock)); 191 } 192 193 RCU_INIT_POINTER(po->next, first); 194 rcu_assign_pointer(pn->hash_table[hash], po); 195 196 return 0; 197 } 198 199 static void __delete_item(struct pppoe_net *pn, __be16 sid, 200 char *addr, int ifindex) 201 { 202 int hash = hash_item(sid, addr); 203 struct pppox_sock *ret, __rcu **src; 204 205 ret = rcu_dereference_protected(pn->hash_table[hash], lockdep_is_held(&pn->hash_lock)); 206 src = &pn->hash_table[hash]; 207 208 while (ret) { 209 if (cmp_addr(&ret->pppoe_pa, sid, addr) && 210 ret->pppoe_ifindex == ifindex) { 211 struct pppox_sock *next; 212 213 next = rcu_dereference_protected(ret->next, 214 lockdep_is_held(&pn->hash_lock)); 215 rcu_assign_pointer(*src, next); 216 break; 217 } 218 219 src = &ret->next; 220 ret = rcu_dereference_protected(ret->next, lockdep_is_held(&pn->hash_lock)); 221 } 222 } 223 224 /********************************************************************** 225 * 226 * Set/get/delete/rehash items 227 * 228 **********************************************************************/ 229 static inline struct pppox_sock *get_item(struct pppoe_net *pn, __be16 sid, 230 unsigned char *addr, int ifindex) 231 { 232 struct pppox_sock *po; 233 234 po = __get_item(pn, sid, addr, ifindex); 235 if (po && !refcount_inc_not_zero(&po->sk.sk_refcnt)) 236 po = NULL; 237 238 return po; 239 } 240 241 static inline void delete_item(struct pppoe_net *pn, __be16 sid, 242 char *addr, int ifindex) 243 { 244 spin_lock(&pn->hash_lock); 245 __delete_item(pn, sid, addr, ifindex); 246 spin_unlock(&pn->hash_lock); 247 } 248 249 /*************************************************************************** 250 * 251 * Handler for device events. 252 * Certain device events require that sockets be unconnected. 253 * 254 **************************************************************************/ 255 256 static void pppoe_flush_dev(struct net_device *dev) 257 { 258 struct pppoe_net *pn; 259 int i; 260 261 pn = pppoe_pernet(dev_net(dev)); 262 spin_lock(&pn->hash_lock); 263 for (i = 0; i < PPPOE_HASH_SIZE; i++) { 264 struct pppox_sock *po = rcu_dereference_protected(pn->hash_table[i], 265 lockdep_is_held(&pn->hash_lock)); 266 struct sock *sk; 267 268 while (po) { 269 while (po && po->pppoe_dev != dev) { 270 po = rcu_dereference_protected(po->next, 271 lockdep_is_held(&pn->hash_lock)); 272 } 273 274 if (!po) 275 break; 276 277 sk = &po->sk; 278 279 /* We always grab the socket lock, followed by the 280 * hash_lock, in that order. Since we should hold the 281 * sock lock while doing any unbinding, we need to 282 * release the lock we're holding. Hold a reference to 283 * the sock so it doesn't disappear as we're jumping 284 * between locks. 285 */ 286 287 sock_hold(sk); 288 spin_unlock(&pn->hash_lock); 289 lock_sock(sk); 290 291 if (po->pppoe_dev == dev && 292 sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) { 293 pppox_unbind_sock(sk); 294 sk->sk_state_change(sk); 295 po->pppoe_dev = NULL; 296 dev_put(dev); 297 } 298 299 release_sock(sk); 300 sock_put(sk); 301 302 /* Restart the process from the start of the current 303 * hash chain. We dropped locks so the world may have 304 * change from underneath us. 305 */ 306 307 BUG_ON(pppoe_pernet(dev_net(dev)) == NULL); 308 spin_lock(&pn->hash_lock); 309 po = rcu_dereference_protected(pn->hash_table[i], 310 lockdep_is_held(&pn->hash_lock)); 311 } 312 } 313 spin_unlock(&pn->hash_lock); 314 } 315 316 static int pppoe_device_event(struct notifier_block *this, 317 unsigned long event, void *ptr) 318 { 319 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 320 321 /* Only look at sockets that are using this specific device. */ 322 switch (event) { 323 case NETDEV_CHANGEADDR: 324 case NETDEV_CHANGEMTU: 325 /* A change in mtu or address is a bad thing, requiring 326 * LCP re-negotiation. 327 */ 328 329 case NETDEV_GOING_DOWN: 330 case NETDEV_DOWN: 331 /* Find every socket on this device and kill it. */ 332 pppoe_flush_dev(dev); 333 break; 334 335 default: 336 break; 337 } 338 339 return NOTIFY_DONE; 340 } 341 342 static struct notifier_block pppoe_notifier = { 343 .notifier_call = pppoe_device_event, 344 }; 345 346 /************************************************************************ 347 * 348 * Do the real work of receiving a PPPoE Session frame. 349 * 350 ***********************************************************************/ 351 static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb) 352 { 353 struct pppox_sock *po = pppox_sk(sk); 354 355 /* Backlog receive. Semantics of backlog rcv preclude any code from 356 * executing in lock_sock()/release_sock() bounds; meaning sk->sk_state 357 * can't change. 358 */ 359 360 if (sk->sk_state & PPPOX_BOUND) { 361 ppp_input(&po->chan, skb); 362 } else { 363 if (sock_queue_rcv_skb(sk, skb)) 364 goto abort_kfree; 365 } 366 367 return NET_RX_SUCCESS; 368 369 abort_kfree: 370 kfree_skb(skb); 371 return NET_RX_DROP; 372 } 373 374 /************************************************************************ 375 * 376 * Receive wrapper called in BH context. 377 * 378 ***********************************************************************/ 379 static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev, 380 struct packet_type *pt, struct net_device *orig_dev) 381 { 382 struct pppoe_hdr *ph; 383 struct pppox_sock *po; 384 struct pppoe_net *pn; 385 int len; 386 387 if (skb->pkt_type == PACKET_OTHERHOST) 388 goto drop; 389 390 skb = skb_share_check(skb, GFP_ATOMIC); 391 if (!skb) 392 goto out; 393 394 if (skb_mac_header_len(skb) < ETH_HLEN) 395 goto drop; 396 397 if (!pskb_may_pull(skb, PPPOE_SES_HLEN)) 398 goto drop; 399 400 ph = pppoe_hdr(skb); 401 len = ntohs(ph->length); 402 403 skb_pull_rcsum(skb, sizeof(*ph)); 404 if (skb->len < len) 405 goto drop; 406 407 /* skb->data points to the PPP protocol header after skb_pull_rcsum. 408 * Drop PFC frames. 409 */ 410 if (ppp_skb_is_compressed_proto(skb)) 411 goto drop; 412 413 if (!skb_is_gso(skb) && pskb_trim_rcsum(skb, len)) 414 goto drop; 415 416 ph = pppoe_hdr(skb); 417 pn = pppoe_pernet(dev_net(dev)); 418 419 po = __get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); 420 if (!po) 421 goto drop; 422 423 return __sk_receive_skb(&po->sk, skb, 0, 1, false); 424 425 drop: 426 kfree_skb(skb); 427 out: 428 return NET_RX_DROP; 429 } 430 431 static void pppoe_unbind_sock_work(struct work_struct *work) 432 { 433 struct pppox_sock *po = container_of(work, struct pppox_sock, 434 proto.pppoe.padt_work); 435 struct sock *sk = &po->sk; 436 437 lock_sock(sk); 438 if (po->pppoe_dev) { 439 dev_put(po->pppoe_dev); 440 po->pppoe_dev = NULL; 441 } 442 pppox_unbind_sock(sk); 443 release_sock(sk); 444 sock_put(sk); 445 } 446 447 /************************************************************************ 448 * 449 * Receive a PPPoE Discovery frame. 450 * This is solely for detection of PADT frames 451 * 452 ***********************************************************************/ 453 static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev, 454 struct packet_type *pt, struct net_device *orig_dev) 455 456 { 457 struct pppoe_hdr *ph; 458 struct pppox_sock *po; 459 struct pppoe_net *pn; 460 461 skb = skb_share_check(skb, GFP_ATOMIC); 462 if (!skb) 463 goto out; 464 465 if (skb->pkt_type != PACKET_HOST) 466 goto abort; 467 468 if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) 469 goto abort; 470 471 ph = pppoe_hdr(skb); 472 if (ph->code != PADT_CODE) 473 goto abort; 474 475 pn = pppoe_pernet(dev_net(dev)); 476 po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); 477 if (po) 478 if (!schedule_work(&po->proto.pppoe.padt_work)) 479 sock_put(&po->sk); 480 481 abort: 482 kfree_skb(skb); 483 out: 484 return NET_RX_SUCCESS; /* Lies... :-) */ 485 } 486 487 static struct packet_type pppoes_ptype __read_mostly = { 488 .type = cpu_to_be16(ETH_P_PPP_SES), 489 .func = pppoe_rcv, 490 }; 491 492 static struct packet_type pppoed_ptype __read_mostly = { 493 .type = cpu_to_be16(ETH_P_PPP_DISC), 494 .func = pppoe_disc_rcv, 495 }; 496 497 static struct proto pppoe_sk_proto __read_mostly = { 498 .name = "PPPOE", 499 .owner = THIS_MODULE, 500 .obj_size = sizeof(struct pppox_sock), 501 }; 502 503 static void pppoe_destruct(struct sock *sk) 504 { 505 skb_queue_purge(&sk->sk_receive_queue); 506 } 507 508 /*********************************************************************** 509 * 510 * Initialize a new struct sock. 511 * 512 **********************************************************************/ 513 static int pppoe_create(struct net *net, struct socket *sock, int kern) 514 { 515 struct sock *sk; 516 517 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppoe_sk_proto, kern); 518 if (!sk) 519 return -ENOMEM; 520 521 sock_init_data(sock, sk); 522 sock_set_flag(sk, SOCK_RCU_FREE); 523 524 sock->state = SS_UNCONNECTED; 525 sock->ops = &pppoe_ops; 526 527 sk->sk_backlog_rcv = pppoe_rcv_core; 528 sk->sk_destruct = pppoe_destruct; 529 sk->sk_state = PPPOX_NONE; 530 sk->sk_type = SOCK_STREAM; 531 sk->sk_family = PF_PPPOX; 532 sk->sk_protocol = PX_PROTO_OE; 533 534 INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work, 535 pppoe_unbind_sock_work); 536 537 return 0; 538 } 539 540 static int pppoe_release(struct socket *sock) 541 { 542 struct sock *sk = sock->sk; 543 struct pppox_sock *po; 544 struct pppoe_net *pn; 545 struct net *net = NULL; 546 547 if (!sk) 548 return 0; 549 550 lock_sock(sk); 551 if (sock_flag(sk, SOCK_DEAD)) { 552 release_sock(sk); 553 return -EBADF; 554 } 555 556 po = pppox_sk(sk); 557 558 if (po->pppoe_dev) { 559 dev_put(po->pppoe_dev); 560 po->pppoe_dev = NULL; 561 } 562 563 pppox_unbind_sock(sk); 564 565 /* Signal the death of the socket. */ 566 sk->sk_state = PPPOX_DEAD; 567 568 net = sock_net(sk); 569 pn = pppoe_pernet(net); 570 571 /* 572 * protect "po" from concurrent updates 573 * on pppoe_flush_dev 574 */ 575 delete_item(pn, po->pppoe_pa.sid, po->pppoe_pa.remote, 576 po->pppoe_ifindex); 577 578 sock_orphan(sk); 579 sock->sk = NULL; 580 581 release_sock(sk); 582 sock_put(sk); 583 584 return 0; 585 } 586 587 static int pppoe_connect(struct socket *sock, struct sockaddr_unsized *uservaddr, 588 int sockaddr_len, int flags) 589 { 590 struct sock *sk = sock->sk; 591 struct sockaddr_pppox *sp = (struct sockaddr_pppox *)uservaddr; 592 struct pppox_sock *po = pppox_sk(sk); 593 struct net_device *dev = NULL; 594 struct pppoe_net *pn; 595 struct net *net = NULL; 596 int error; 597 598 lock_sock(sk); 599 600 error = -EINVAL; 601 602 if (sockaddr_len != sizeof(struct sockaddr_pppox)) 603 goto end; 604 605 if (sp->sa_protocol != PX_PROTO_OE) 606 goto end; 607 608 /* Check for already bound sockets */ 609 error = -EBUSY; 610 if ((sk->sk_state & PPPOX_CONNECTED) && 611 stage_session(sp->sa_addr.pppoe.sid)) 612 goto end; 613 614 /* Check for already disconnected sockets, on attempts to disconnect */ 615 error = -EALREADY; 616 if ((sk->sk_state & PPPOX_DEAD) && 617 !stage_session(sp->sa_addr.pppoe.sid)) 618 goto end; 619 620 error = 0; 621 622 /* Delete the old binding */ 623 if (stage_session(po->pppoe_pa.sid)) { 624 pppox_unbind_sock(sk); 625 pn = pppoe_pernet(sock_net(sk)); 626 delete_item(pn, po->pppoe_pa.sid, 627 po->pppoe_pa.remote, po->pppoe_ifindex); 628 if (po->pppoe_dev) { 629 dev_put(po->pppoe_dev); 630 po->pppoe_dev = NULL; 631 } 632 633 po->pppoe_ifindex = 0; 634 memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa)); 635 memset(&po->chan, 0, sizeof(po->chan)); 636 po->next = NULL; 637 po->num = 0; 638 639 sk->sk_state = PPPOX_NONE; 640 } 641 642 /* Re-bind in session stage only */ 643 if (stage_session(sp->sa_addr.pppoe.sid)) { 644 error = -ENODEV; 645 net = sock_net(sk); 646 dev = dev_get_by_name(net, sp->sa_addr.pppoe.dev); 647 if (!dev) 648 goto err_put; 649 650 po->pppoe_dev = dev; 651 po->pppoe_ifindex = dev->ifindex; 652 pn = pppoe_pernet(net); 653 if (!(dev->flags & IFF_UP)) { 654 goto err_put; 655 } 656 657 memcpy(&po->pppoe_pa, 658 &sp->sa_addr.pppoe, 659 sizeof(struct pppoe_addr)); 660 661 spin_lock(&pn->hash_lock); 662 error = __set_item(pn, po); 663 spin_unlock(&pn->hash_lock); 664 if (error < 0) 665 goto err_put; 666 667 po->chan.hdrlen = (sizeof(struct pppoe_hdr) + 668 dev->hard_header_len); 669 670 po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2; 671 po->chan.private = sk; 672 po->chan.ops = &pppoe_chan_ops; 673 po->chan.direct_xmit = true; 674 675 error = ppp_register_net_channel(dev_net(dev), &po->chan); 676 if (error) { 677 delete_item(pn, po->pppoe_pa.sid, 678 po->pppoe_pa.remote, po->pppoe_ifindex); 679 goto err_put; 680 } 681 682 sk->sk_state = PPPOX_CONNECTED; 683 } 684 685 po->num = sp->sa_addr.pppoe.sid; 686 687 end: 688 release_sock(sk); 689 return error; 690 err_put: 691 if (po->pppoe_dev) { 692 dev_put(po->pppoe_dev); 693 po->pppoe_dev = NULL; 694 } 695 goto end; 696 } 697 698 static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr, 699 int peer) 700 { 701 int len = sizeof(struct sockaddr_pppox); 702 struct sockaddr_pppox sp; 703 704 sp.sa_family = AF_PPPOX; 705 sp.sa_protocol = PX_PROTO_OE; 706 memcpy(&sp.sa_addr.pppoe, &pppox_sk(sock->sk)->pppoe_pa, 707 sizeof(struct pppoe_addr)); 708 709 memcpy(uaddr, &sp, len); 710 711 return len; 712 } 713 714 static int pppoe_ioctl(struct socket *sock, unsigned int cmd, 715 unsigned long arg) 716 { 717 struct sock *sk = sock->sk; 718 struct pppox_sock *po = pppox_sk(sk); 719 int val; 720 int err; 721 722 switch (cmd) { 723 case PPPIOCGMRU: 724 err = -ENXIO; 725 if (!(sk->sk_state & PPPOX_CONNECTED)) 726 break; 727 728 err = -EFAULT; 729 if (put_user(po->pppoe_dev->mtu - 730 sizeof(struct pppoe_hdr) - 731 PPP_HDRLEN, 732 (int __user *)arg)) 733 break; 734 err = 0; 735 break; 736 737 case PPPIOCSMRU: 738 err = -ENXIO; 739 if (!(sk->sk_state & PPPOX_CONNECTED)) 740 break; 741 742 err = -EFAULT; 743 if (get_user(val, (int __user *)arg)) 744 break; 745 746 if (val < (po->pppoe_dev->mtu 747 - sizeof(struct pppoe_hdr) 748 - PPP_HDRLEN)) 749 err = 0; 750 else 751 err = -EINVAL; 752 break; 753 754 case PPPIOCSFLAGS: 755 err = -EFAULT; 756 if (get_user(val, (int __user *)arg)) 757 break; 758 err = 0; 759 break; 760 761 default: 762 err = -ENOTTY; 763 } 764 765 return err; 766 } 767 768 static int pppoe_sendmsg(struct socket *sock, struct msghdr *m, 769 size_t total_len) 770 { 771 struct sk_buff *skb; 772 struct sock *sk = sock->sk; 773 struct pppox_sock *po = pppox_sk(sk); 774 int error; 775 struct pppoe_hdr hdr; 776 struct pppoe_hdr *ph; 777 struct net_device *dev; 778 char *start; 779 int hlen; 780 781 lock_sock(sk); 782 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) { 783 error = -ENOTCONN; 784 goto end; 785 } 786 787 hdr.ver = 1; 788 hdr.type = 1; 789 hdr.code = 0; 790 hdr.sid = po->num; 791 792 dev = po->pppoe_dev; 793 794 error = -EMSGSIZE; 795 if (total_len > (dev->mtu + dev->hard_header_len)) 796 goto end; 797 798 hlen = LL_RESERVED_SPACE(dev); 799 skb = sock_wmalloc(sk, hlen + sizeof(*ph) + total_len + 800 dev->needed_tailroom, 0, GFP_KERNEL); 801 if (!skb) { 802 error = -ENOMEM; 803 goto end; 804 } 805 806 /* Reserve space for headers. */ 807 skb_reserve(skb, hlen); 808 skb_reset_network_header(skb); 809 810 skb->dev = dev; 811 812 skb->priority = READ_ONCE(sk->sk_priority); 813 skb->protocol = cpu_to_be16(ETH_P_PPP_SES); 814 815 ph = skb_put(skb, total_len + sizeof(struct pppoe_hdr)); 816 start = (char *)ph + sizeof(*ph); 817 818 error = memcpy_from_msg(start, m, total_len); 819 if (error < 0) { 820 kfree_skb(skb); 821 goto end; 822 } 823 824 error = total_len; 825 dev_hard_header(skb, dev, ETH_P_PPP_SES, 826 po->pppoe_pa.remote, NULL, total_len); 827 828 ph = pppoe_hdr(skb); 829 memcpy(ph, &hdr, sizeof(struct pppoe_hdr)); 830 831 ph->length = htons(total_len); 832 833 dev_queue_xmit(skb); 834 835 end: 836 release_sock(sk); 837 return error; 838 } 839 840 /************************************************************************ 841 * 842 * xmit function for internal use. 843 * 844 ***********************************************************************/ 845 static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb) 846 { 847 struct pppox_sock *po = pppox_sk(sk); 848 struct net_device *dev = po->pppoe_dev; 849 struct pppoe_hdr *ph; 850 int data_len = skb->len; 851 852 /* The higher-level PPP code (ppp_unregister_channel()) ensures the PPP 853 * xmit operations conclude prior to an unregistration call. Thus 854 * sk->sk_state cannot change, so we don't need to do lock_sock(). 855 * But, we also can't do a lock_sock since that introduces a potential 856 * deadlock as we'd reverse the lock ordering used when calling 857 * ppp_unregister_channel(). 858 */ 859 860 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 861 goto abort; 862 863 if (!dev) 864 goto abort; 865 866 /* Copy the data if there is no space for the header or if it's 867 * read-only. 868 */ 869 if (skb_cow_head(skb, LL_RESERVED_SPACE(dev) + sizeof(*ph))) 870 goto abort; 871 872 __skb_push(skb, sizeof(*ph)); 873 skb_reset_network_header(skb); 874 875 ph = pppoe_hdr(skb); 876 ph->ver = 1; 877 ph->type = 1; 878 ph->code = 0; 879 ph->sid = po->num; 880 ph->length = htons(data_len); 881 882 skb->protocol = cpu_to_be16(ETH_P_PPP_SES); 883 skb->dev = dev; 884 885 dev_hard_header(skb, dev, ETH_P_PPP_SES, 886 po->pppoe_pa.remote, NULL, data_len); 887 888 dev_queue_xmit(skb); 889 return 1; 890 891 abort: 892 kfree_skb(skb); 893 return 1; 894 } 895 896 /************************************************************************ 897 * 898 * xmit function called by generic PPP driver 899 * sends PPP frame over PPPoE socket 900 * 901 ***********************************************************************/ 902 static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb) 903 { 904 struct sock *sk = chan->private; 905 return __pppoe_xmit(sk, skb); 906 } 907 908 static int pppoe_fill_forward_path(struct net_device_path_ctx *ctx, 909 struct net_device_path *path, 910 const struct ppp_channel *chan) 911 { 912 struct sock *sk = chan->private; 913 struct pppox_sock *po = pppox_sk(sk); 914 struct net_device *dev = po->pppoe_dev; 915 916 if (sock_flag(sk, SOCK_DEAD) || 917 !(sk->sk_state & PPPOX_CONNECTED) || !dev) 918 return -1; 919 920 path->type = DEV_PATH_PPPOE; 921 path->encap.proto = htons(ETH_P_PPP_SES); 922 path->encap.id = be16_to_cpu(po->num); 923 memcpy(path->encap.h_dest, po->pppoe_pa.remote, ETH_ALEN); 924 memcpy(ctx->daddr, po->pppoe_pa.remote, ETH_ALEN); 925 path->dev = ctx->dev; 926 ctx->dev = dev; 927 928 return 0; 929 } 930 931 static const struct ppp_channel_ops pppoe_chan_ops = { 932 .start_xmit = pppoe_xmit, 933 .fill_forward_path = pppoe_fill_forward_path, 934 }; 935 936 static int pppoe_recvmsg(struct socket *sock, struct msghdr *m, 937 size_t total_len, int flags) 938 { 939 struct sock *sk = sock->sk; 940 struct sk_buff *skb; 941 int error = 0; 942 943 if (sk->sk_state & PPPOX_BOUND) 944 return -EIO; 945 946 skb = skb_recv_datagram(sk, flags, &error); 947 if (!skb) 948 return error; 949 950 total_len = min_t(size_t, total_len, skb->len); 951 error = skb_copy_datagram_msg(skb, 0, m, total_len); 952 if (error == 0) { 953 consume_skb(skb); 954 return total_len; 955 } 956 957 kfree_skb(skb); 958 return error; 959 } 960 961 #ifdef CONFIG_PROC_FS 962 static int pppoe_seq_show(struct seq_file *seq, void *v) 963 { 964 struct pppox_sock *po; 965 char *dev_name; 966 967 if (v == SEQ_START_TOKEN) { 968 seq_puts(seq, "Id Address Device\n"); 969 goto out; 970 } 971 972 po = v; 973 dev_name = po->pppoe_pa.dev; 974 975 seq_printf(seq, "%08X %pM %8s\n", 976 po->pppoe_pa.sid, po->pppoe_pa.remote, dev_name); 977 out: 978 return 0; 979 } 980 981 static inline struct pppox_sock *pppoe_get_idx(struct pppoe_net *pn, loff_t pos) 982 { 983 struct pppox_sock *po; 984 int i; 985 986 for (i = 0; i < PPPOE_HASH_SIZE; i++) { 987 po = rcu_dereference(pn->hash_table[i]); 988 while (po) { 989 if (!pos--) 990 goto out; 991 po = rcu_dereference(po->next); 992 } 993 } 994 995 out: 996 return po; 997 } 998 999 static void *pppoe_seq_start(struct seq_file *seq, loff_t *pos) 1000 __acquires(RCU) 1001 { 1002 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 1003 loff_t l = *pos; 1004 1005 rcu_read_lock(); 1006 return l ? pppoe_get_idx(pn, --l) : SEQ_START_TOKEN; 1007 } 1008 1009 static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos) 1010 { 1011 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 1012 struct pppox_sock *po, *next; 1013 1014 ++*pos; 1015 if (v == SEQ_START_TOKEN) { 1016 po = pppoe_get_idx(pn, 0); 1017 goto out; 1018 } 1019 po = v; 1020 next = rcu_dereference(po->next); 1021 if (next) 1022 po = next; 1023 else { 1024 int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); 1025 1026 po = NULL; 1027 while (++hash < PPPOE_HASH_SIZE) { 1028 po = rcu_dereference(pn->hash_table[hash]); 1029 if (po) 1030 break; 1031 } 1032 } 1033 1034 out: 1035 return po; 1036 } 1037 1038 static void pppoe_seq_stop(struct seq_file *seq, void *v) 1039 __releases(RCU) 1040 { 1041 rcu_read_unlock(); 1042 } 1043 1044 static const struct seq_operations pppoe_seq_ops = { 1045 .start = pppoe_seq_start, 1046 .next = pppoe_seq_next, 1047 .stop = pppoe_seq_stop, 1048 .show = pppoe_seq_show, 1049 }; 1050 #endif /* CONFIG_PROC_FS */ 1051 1052 static const struct proto_ops pppoe_ops = { 1053 .family = AF_PPPOX, 1054 .owner = THIS_MODULE, 1055 .release = pppoe_release, 1056 .bind = sock_no_bind, 1057 .connect = pppoe_connect, 1058 .socketpair = sock_no_socketpair, 1059 .accept = sock_no_accept, 1060 .getname = pppoe_getname, 1061 .poll = datagram_poll, 1062 .listen = sock_no_listen, 1063 .shutdown = sock_no_shutdown, 1064 .sendmsg = pppoe_sendmsg, 1065 .recvmsg = pppoe_recvmsg, 1066 .mmap = sock_no_mmap, 1067 .ioctl = pppox_ioctl, 1068 #ifdef CONFIG_COMPAT 1069 .compat_ioctl = pppox_compat_ioctl, 1070 #endif 1071 }; 1072 1073 static const struct pppox_proto pppoe_proto = { 1074 .create = pppoe_create, 1075 .ioctl = pppoe_ioctl, 1076 .owner = THIS_MODULE, 1077 }; 1078 1079 static __net_init int pppoe_init_net(struct net *net) 1080 { 1081 struct pppoe_net *pn = pppoe_pernet(net); 1082 struct proc_dir_entry *pde; 1083 1084 spin_lock_init(&pn->hash_lock); 1085 1086 pde = proc_create_net("pppoe", 0444, net->proc_net, 1087 &pppoe_seq_ops, sizeof(struct seq_net_private)); 1088 #ifdef CONFIG_PROC_FS 1089 if (!pde) 1090 return -ENOMEM; 1091 #endif 1092 1093 return 0; 1094 } 1095 1096 static __net_exit void pppoe_exit_net(struct net *net) 1097 { 1098 remove_proc_entry("pppoe", net->proc_net); 1099 } 1100 1101 static struct pernet_operations pppoe_net_ops = { 1102 .init = pppoe_init_net, 1103 .exit = pppoe_exit_net, 1104 .id = &pppoe_net_id, 1105 .size = sizeof(struct pppoe_net), 1106 }; 1107 1108 static u16 1109 compare_pppoe_header(const struct pppoe_hdr *phdr, 1110 const struct pppoe_hdr *phdr2) 1111 { 1112 __be16 proto = *(const __be16 *)(phdr + 1); 1113 __be16 proto2 = *(const __be16 *)(phdr2 + 1); 1114 1115 return (__force u16)((phdr->sid ^ phdr2->sid) | (proto ^ proto2)); 1116 } 1117 1118 static __be16 pppoe_hdr_proto(const struct pppoe_hdr *phdr) 1119 { 1120 __be16 proto = *(const __be16 *)(phdr + 1); 1121 1122 switch (proto) { 1123 case cpu_to_be16(PPP_IP): 1124 return cpu_to_be16(ETH_P_IP); 1125 #if IS_ENABLED(CONFIG_IPV6) 1126 case cpu_to_be16(PPP_IPV6): 1127 return cpu_to_be16(ETH_P_IPV6); 1128 #endif 1129 default: 1130 return 0; 1131 } 1132 } 1133 1134 static struct sk_buff *pppoe_gro_receive(struct list_head *head, 1135 struct sk_buff *skb) 1136 { 1137 const struct packet_offload *ptype; 1138 unsigned int hlen, off_pppoe; 1139 const struct pppoe_hdr *phdr; 1140 struct sk_buff *pp = NULL; 1141 struct sk_buff *p; 1142 int flush = 1; 1143 __be16 type; 1144 1145 off_pppoe = skb_gro_offset(skb); 1146 hlen = off_pppoe + PPPOE_SES_HLEN; 1147 phdr = skb_gro_header(skb, hlen, off_pppoe); 1148 if (unlikely(!phdr)) 1149 goto out; 1150 1151 /* filter for session packets (type:1, ver:1, code:0) */ 1152 if (*(const __be16 *)phdr != cpu_to_be16(0x1100)) 1153 goto out; 1154 1155 /* ignore packets with padding or invalid length */ 1156 if (skb_gro_len(skb) != be16_to_cpu(phdr->length) + sizeof(*phdr)) 1157 goto out; 1158 1159 type = pppoe_hdr_proto(phdr); 1160 ptype = gro_find_receive_by_type(type); 1161 if (!ptype) 1162 goto out; 1163 1164 flush = 0; 1165 1166 list_for_each_entry(p, head, list) { 1167 const struct pppoe_hdr *phdr2; 1168 1169 if (!NAPI_GRO_CB(p)->same_flow) 1170 continue; 1171 1172 phdr2 = (const struct pppoe_hdr *)(p->data + off_pppoe); 1173 if (compare_pppoe_header(phdr, phdr2)) 1174 NAPI_GRO_CB(p)->same_flow = 0; 1175 } 1176 1177 skb_gro_pull(skb, PPPOE_SES_HLEN); 1178 skb_gro_postpull_rcsum(skb, phdr, PPPOE_SES_HLEN); 1179 1180 pp = indirect_call_gro_receive_inet(ptype->callbacks.gro_receive, 1181 ipv6_gro_receive, inet_gro_receive, 1182 head, skb); 1183 1184 out: 1185 skb_gro_flush_final(skb, pp, flush); 1186 1187 return pp; 1188 } 1189 1190 static int pppoe_gro_complete(struct sk_buff *skb, int nhoff) 1191 { 1192 struct pppoe_hdr *phdr = (struct pppoe_hdr *)(skb->data + nhoff); 1193 __be16 type = pppoe_hdr_proto(phdr); 1194 struct packet_offload *ptype; 1195 unsigned int len; 1196 1197 ptype = gro_find_complete_by_type(type); 1198 if (!ptype) 1199 return -ENOENT; 1200 1201 len = skb->len - (nhoff + sizeof(*phdr)); 1202 len = min(len, 0xFFFFU); 1203 phdr->length = cpu_to_be16(len); 1204 1205 return INDIRECT_CALL_INET(ptype->callbacks.gro_complete, 1206 ipv6_gro_complete, inet_gro_complete, 1207 skb, nhoff + PPPOE_SES_HLEN); 1208 } 1209 1210 static struct sk_buff *pppoe_gso_segment(struct sk_buff *skb, 1211 netdev_features_t features) 1212 { 1213 struct sk_buff *segs = ERR_PTR(-EINVAL); 1214 struct packet_offload *ptype; 1215 struct pppoe_hdr *phdr; 1216 __be16 orig_type, type; 1217 int len, nhoff; 1218 1219 skb_reset_network_header(skb); 1220 nhoff = skb_network_header(skb) - skb_mac_header(skb); 1221 1222 if (unlikely(!pskb_may_pull(skb, PPPOE_SES_HLEN))) 1223 goto out; 1224 1225 phdr = (struct pppoe_hdr *)skb_network_header(skb); 1226 type = pppoe_hdr_proto(phdr); 1227 ptype = gro_find_complete_by_type(type); 1228 if (!ptype) 1229 goto out; 1230 1231 orig_type = skb->protocol; 1232 __skb_pull(skb, PPPOE_SES_HLEN); 1233 features &= ~NETIF_F_GSO_SOFTWARE; 1234 segs = ptype->callbacks.gso_segment(skb, features); 1235 if (IS_ERR_OR_NULL(segs)) 1236 goto out; 1237 1238 skb = segs; 1239 do { 1240 phdr = (struct pppoe_hdr *)(skb_mac_header(skb) + nhoff); 1241 len = skb->len - (nhoff + sizeof(*phdr)); 1242 phdr->length = cpu_to_be16(len); 1243 skb->network_header = (u8 *)phdr - skb->head; 1244 skb->protocol = orig_type; 1245 skb_reset_mac_len(skb); 1246 } while ((skb = skb->next)); 1247 1248 out: 1249 return segs; 1250 } 1251 1252 static struct packet_offload pppoe_packet_offload __read_mostly = { 1253 .type = cpu_to_be16(ETH_P_PPP_SES), 1254 .priority = 20, 1255 .callbacks = { 1256 .gro_receive = pppoe_gro_receive, 1257 .gro_complete = pppoe_gro_complete, 1258 .gso_segment = pppoe_gso_segment, 1259 }, 1260 }; 1261 1262 static int __init pppoe_init(void) 1263 { 1264 int err; 1265 1266 err = register_pernet_device(&pppoe_net_ops); 1267 if (err) 1268 goto out; 1269 1270 err = proto_register(&pppoe_sk_proto, 0); 1271 if (err) 1272 goto out_unregister_net_ops; 1273 1274 err = register_pppox_proto(PX_PROTO_OE, &pppoe_proto); 1275 if (err) 1276 goto out_unregister_pppoe_proto; 1277 1278 if (IS_ENABLED(CONFIG_INET)) 1279 dev_add_offload(&pppoe_packet_offload); 1280 dev_add_pack(&pppoes_ptype); 1281 dev_add_pack(&pppoed_ptype); 1282 register_netdevice_notifier(&pppoe_notifier); 1283 1284 return 0; 1285 1286 out_unregister_pppoe_proto: 1287 proto_unregister(&pppoe_sk_proto); 1288 out_unregister_net_ops: 1289 unregister_pernet_device(&pppoe_net_ops); 1290 out: 1291 return err; 1292 } 1293 1294 static void __exit pppoe_exit(void) 1295 { 1296 unregister_netdevice_notifier(&pppoe_notifier); 1297 dev_remove_pack(&pppoed_ptype); 1298 dev_remove_pack(&pppoes_ptype); 1299 if (IS_ENABLED(CONFIG_INET)) 1300 dev_remove_offload(&pppoe_packet_offload); 1301 unregister_pppox_proto(PX_PROTO_OE); 1302 proto_unregister(&pppoe_sk_proto); 1303 unregister_pernet_device(&pppoe_net_ops); 1304 } 1305 1306 module_init(pppoe_init); 1307 module_exit(pppoe_exit); 1308 1309 MODULE_AUTHOR("Michal Ostrowski <mostrows@speakeasy.net>"); 1310 MODULE_DESCRIPTION("PPP over Ethernet driver"); 1311 MODULE_LICENSE("GPL"); 1312 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OE); 1313