1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /** -*- linux-c -*- *********************************************************** 3 * Linux PPP over Ethernet (PPPoX/PPPoE) Sockets 4 * 5 * PPPoX --- Generic PPP encapsulation socket family 6 * PPPoE --- PPP over Ethernet (RFC 2516) 7 * 8 * Version: 0.7.0 9 * 10 * 070228 : Fix to allow multiple sessions with same remote MAC and same 11 * session id by including the local device ifindex in the 12 * tuple identifying a session. This also ensures packets can't 13 * be injected into a session from interfaces other than the one 14 * specified by userspace. Florian Zumbiehl <florz@florz.de> 15 * (Oh, BTW, this one is YYMMDD, in case you were wondering ...) 16 * 220102 : Fix module use count on failure in pppoe_create, pppox_sk -acme 17 * 030700 : Fixed connect logic to allow for disconnect. 18 * 270700 : Fixed potential SMP problems; we must protect against 19 * simultaneous invocation of ppp_input 20 * and ppp_unregister_channel. 21 * 040800 : Respect reference count mechanisms on net-devices. 22 * 200800 : fix kfree(skb) in pppoe_rcv (acme) 23 * Module reference count is decremented in the right spot now, 24 * guards against sock_put not actually freeing the sk 25 * in pppoe_release. 26 * 051000 : Initialization cleanup. 27 * 111100 : Fix recvmsg. 28 * 050101 : Fix PADT processing. 29 * 140501 : Use pppoe_rcv_core to handle all backlog. (Alexey) 30 * 170701 : Do not lock_sock with rwlock held. (DaveM) 31 * Ignore discovery frames if user has socket 32 * locked. (DaveM) 33 * Ignore return value of dev_queue_xmit in __pppoe_xmit 34 * or else we may kfree an SKB twice. (DaveM) 35 * 190701 : When doing copies of skb's in __pppoe_xmit, always delete 36 * the original skb that was passed in on success, never on 37 * failure. Delete the copy of the skb on failure to avoid 38 * a memory leak. 39 * 081001 : Misc. cleanup (licence string, non-blocking, prevent 40 * reference of device on close). 41 * 121301 : New ppp channels interface; cannot unregister a channel 42 * from interrupts. Thus, we mark the socket as a ZOMBIE 43 * and do the unregistration later. 44 * 081002 : seq_file support for proc stuff -acme 45 * 111602 : Merge all 2.4 fixes into 2.5/2.6 tree. Label 2.5/2.6 46 * as version 0.7. Spacing cleanup. 47 * Author: Michal Ostrowski <mostrows@speakeasy.net> 48 * Contributors: 49 * Arnaldo Carvalho de Melo <acme@conectiva.com.br> 50 * David S. Miller (davem@redhat.com) 51 * 52 * License: 53 */ 54 55 #include <linux/string.h> 56 #include <linux/module.h> 57 #include <linux/kernel.h> 58 #include <linux/slab.h> 59 #include <linux/errno.h> 60 #include <linux/netdevice.h> 61 #include <linux/net.h> 62 #include <linux/inetdevice.h> 63 #include <linux/etherdevice.h> 64 #include <linux/skbuff.h> 65 #include <linux/init.h> 66 #include <linux/if_ether.h> 67 #include <linux/if_pppox.h> 68 #include <linux/ppp_channel.h> 69 #include <linux/ppp_defs.h> 70 #include <linux/ppp-ioctl.h> 71 #include <linux/notifier.h> 72 #include <linux/file.h> 73 #include <linux/proc_fs.h> 74 #include <linux/seq_file.h> 75 76 #include <linux/nsproxy.h> 77 #include <net/net_namespace.h> 78 #include <net/netns/generic.h> 79 #include <net/sock.h> 80 #include <net/gro.h> 81 82 #include <linux/uaccess.h> 83 84 #define PPPOE_HASH_BITS CONFIG_PPPOE_HASH_BITS 85 #define PPPOE_HASH_SIZE (1 << PPPOE_HASH_BITS) 86 #define PPPOE_HASH_MASK (PPPOE_HASH_SIZE - 1) 87 88 static const struct proto_ops pppoe_ops; 89 static const struct ppp_channel_ops pppoe_chan_ops; 90 91 /* per-net private data for this module */ 92 static unsigned int pppoe_net_id __read_mostly; 93 struct pppoe_net { 94 /* 95 * we could use _single_ hash table for all 96 * nets by injecting net id into the hash but 97 * it would increase hash chains and add 98 * a few additional math comparisons messy 99 * as well, moreover in case of SMP less locking 100 * controversy here 101 */ 102 struct pppox_sock __rcu *hash_table[PPPOE_HASH_SIZE]; 103 spinlock_t hash_lock; 104 }; 105 106 /* 107 * PPPoE could be in the following stages: 108 * 1) Discovery stage (to obtain remote MAC and Session ID) 109 * 2) Session stage (MAC and SID are known) 110 * 111 * Ethernet frames have a special tag for this but 112 * we use simpler approach based on session id 113 */ 114 static inline bool stage_session(__be16 sid) 115 { 116 return sid != 0; 117 } 118 119 static inline struct pppoe_net *pppoe_pernet(struct net *net) 120 { 121 return net_generic(net, pppoe_net_id); 122 } 123 124 static inline int cmp_2_addr(struct pppoe_addr *a, struct pppoe_addr *b) 125 { 126 return a->sid == b->sid && ether_addr_equal(a->remote, b->remote); 127 } 128 129 static inline int cmp_addr(struct pppoe_addr *a, __be16 sid, char *addr) 130 { 131 return a->sid == sid && ether_addr_equal(a->remote, addr); 132 } 133 134 #if 8 % PPPOE_HASH_BITS 135 #error 8 must be a multiple of PPPOE_HASH_BITS 136 #endif 137 138 static u8 hash_item(__be16 sid, const u8 addr[ETH_ALEN]) 139 { 140 const u16 *addr16 = (const u16 *)addr; 141 unsigned int i; 142 u16 hash16; 143 u8 hash; 144 145 hash16 = addr16[0] ^ addr16[1] ^ addr16[2] ^ (__force u16)sid; 146 hash = (hash16 >> 8) ^ hash16; 147 for (i = 8; (i >>= 1) >= PPPOE_HASH_BITS;) 148 hash ^= hash >> i; 149 150 return hash & PPPOE_HASH_MASK; 151 } 152 153 /********************************************************************** 154 * 155 * Set/get/delete/rehash items (internal versions) 156 * 157 **********************************************************************/ 158 static struct pppox_sock *__get_item(struct pppoe_net *pn, __be16 sid, 159 unsigned char *addr, int ifindex) 160 { 161 int hash = hash_item(sid, addr); 162 struct pppox_sock *ret; 163 164 ret = rcu_dereference(pn->hash_table[hash]); 165 while (ret) { 166 if (cmp_addr(&ret->pppoe_pa, sid, addr) && 167 ret->pppoe_ifindex == ifindex) 168 return ret; 169 170 ret = rcu_dereference(ret->next); 171 } 172 173 return NULL; 174 } 175 176 static int __set_item(struct pppoe_net *pn, struct pppox_sock *po) 177 { 178 int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); 179 struct pppox_sock *ret, *first; 180 181 first = rcu_dereference_protected(pn->hash_table[hash], lockdep_is_held(&pn->hash_lock)); 182 ret = first; 183 while (ret) { 184 if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa) && 185 ret->pppoe_ifindex == po->pppoe_ifindex) 186 return -EALREADY; 187 188 ret = rcu_dereference_protected(ret->next, lockdep_is_held(&pn->hash_lock)); 189 } 190 191 RCU_INIT_POINTER(po->next, first); 192 rcu_assign_pointer(pn->hash_table[hash], po); 193 194 return 0; 195 } 196 197 static void __delete_item(struct pppoe_net *pn, __be16 sid, 198 char *addr, int ifindex) 199 { 200 int hash = hash_item(sid, addr); 201 struct pppox_sock *ret, __rcu **src; 202 203 ret = rcu_dereference_protected(pn->hash_table[hash], lockdep_is_held(&pn->hash_lock)); 204 src = &pn->hash_table[hash]; 205 206 while (ret) { 207 if (cmp_addr(&ret->pppoe_pa, sid, addr) && 208 ret->pppoe_ifindex == ifindex) { 209 struct pppox_sock *next; 210 211 next = rcu_dereference_protected(ret->next, 212 lockdep_is_held(&pn->hash_lock)); 213 rcu_assign_pointer(*src, next); 214 break; 215 } 216 217 src = &ret->next; 218 ret = rcu_dereference_protected(ret->next, lockdep_is_held(&pn->hash_lock)); 219 } 220 } 221 222 /********************************************************************** 223 * 224 * Set/get/delete/rehash items 225 * 226 **********************************************************************/ 227 static inline struct pppox_sock *get_item(struct pppoe_net *pn, __be16 sid, 228 unsigned char *addr, int ifindex) 229 { 230 struct pppox_sock *po; 231 232 po = __get_item(pn, sid, addr, ifindex); 233 if (po && !refcount_inc_not_zero(&po->sk.sk_refcnt)) 234 po = NULL; 235 236 return po; 237 } 238 239 static inline void delete_item(struct pppoe_net *pn, __be16 sid, 240 char *addr, int ifindex) 241 { 242 spin_lock(&pn->hash_lock); 243 __delete_item(pn, sid, addr, ifindex); 244 spin_unlock(&pn->hash_lock); 245 } 246 247 /*************************************************************************** 248 * 249 * Handler for device events. 250 * Certain device events require that sockets be unconnected. 251 * 252 **************************************************************************/ 253 254 static void pppoe_flush_dev(struct net_device *dev) 255 { 256 struct pppoe_net *pn; 257 int i; 258 259 pn = pppoe_pernet(dev_net(dev)); 260 spin_lock(&pn->hash_lock); 261 for (i = 0; i < PPPOE_HASH_SIZE; i++) { 262 struct pppox_sock *po = rcu_dereference_protected(pn->hash_table[i], 263 lockdep_is_held(&pn->hash_lock)); 264 struct sock *sk; 265 266 while (po) { 267 while (po && po->pppoe_dev != dev) { 268 po = rcu_dereference_protected(po->next, 269 lockdep_is_held(&pn->hash_lock)); 270 } 271 272 if (!po) 273 break; 274 275 sk = &po->sk; 276 277 /* We always grab the socket lock, followed by the 278 * hash_lock, in that order. Since we should hold the 279 * sock lock while doing any unbinding, we need to 280 * release the lock we're holding. Hold a reference to 281 * the sock so it doesn't disappear as we're jumping 282 * between locks. 283 */ 284 285 sock_hold(sk); 286 spin_unlock(&pn->hash_lock); 287 lock_sock(sk); 288 289 if (po->pppoe_dev == dev && 290 sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) { 291 pppox_unbind_sock(sk); 292 sk->sk_state_change(sk); 293 po->pppoe_dev = NULL; 294 dev_put(dev); 295 } 296 297 release_sock(sk); 298 sock_put(sk); 299 300 /* Restart the process from the start of the current 301 * hash chain. We dropped locks so the world may have 302 * change from underneath us. 303 */ 304 305 BUG_ON(pppoe_pernet(dev_net(dev)) == NULL); 306 spin_lock(&pn->hash_lock); 307 po = rcu_dereference_protected(pn->hash_table[i], 308 lockdep_is_held(&pn->hash_lock)); 309 } 310 } 311 spin_unlock(&pn->hash_lock); 312 } 313 314 static int pppoe_device_event(struct notifier_block *this, 315 unsigned long event, void *ptr) 316 { 317 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 318 319 /* Only look at sockets that are using this specific device. */ 320 switch (event) { 321 case NETDEV_CHANGEADDR: 322 case NETDEV_CHANGEMTU: 323 /* A change in mtu or address is a bad thing, requiring 324 * LCP re-negotiation. 325 */ 326 327 case NETDEV_GOING_DOWN: 328 case NETDEV_DOWN: 329 /* Find every socket on this device and kill it. */ 330 pppoe_flush_dev(dev); 331 break; 332 333 default: 334 break; 335 } 336 337 return NOTIFY_DONE; 338 } 339 340 static struct notifier_block pppoe_notifier = { 341 .notifier_call = pppoe_device_event, 342 }; 343 344 /************************************************************************ 345 * 346 * Do the real work of receiving a PPPoE Session frame. 347 * 348 ***********************************************************************/ 349 static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb) 350 { 351 struct pppox_sock *po = pppox_sk(sk); 352 353 /* Backlog receive. Semantics of backlog rcv preclude any code from 354 * executing in lock_sock()/release_sock() bounds; meaning sk->sk_state 355 * can't change. 356 */ 357 358 if (sk->sk_state & PPPOX_BOUND) { 359 ppp_input(&po->chan, skb); 360 } else { 361 if (sock_queue_rcv_skb(sk, skb)) 362 goto abort_kfree; 363 } 364 365 return NET_RX_SUCCESS; 366 367 abort_kfree: 368 kfree_skb(skb); 369 return NET_RX_DROP; 370 } 371 372 /************************************************************************ 373 * 374 * Receive wrapper called in BH context. 375 * 376 ***********************************************************************/ 377 static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev, 378 struct packet_type *pt, struct net_device *orig_dev) 379 { 380 struct pppoe_hdr *ph; 381 struct pppox_sock *po; 382 struct pppoe_net *pn; 383 int len; 384 385 if (skb->pkt_type == PACKET_OTHERHOST) 386 goto drop; 387 388 skb = skb_share_check(skb, GFP_ATOMIC); 389 if (!skb) 390 goto out; 391 392 if (skb_mac_header_len(skb) < ETH_HLEN) 393 goto drop; 394 395 if (!pskb_may_pull(skb, PPPOE_SES_HLEN)) 396 goto drop; 397 398 ph = pppoe_hdr(skb); 399 len = ntohs(ph->length); 400 401 skb_pull_rcsum(skb, sizeof(*ph)); 402 if (skb->len < len) 403 goto drop; 404 405 /* skb->data points to the PPP protocol header after skb_pull_rcsum. 406 * Drop PFC frames. 407 */ 408 if (ppp_skb_is_compressed_proto(skb)) 409 goto drop; 410 411 if (!skb_is_gso(skb) && pskb_trim_rcsum(skb, len)) 412 goto drop; 413 414 ph = pppoe_hdr(skb); 415 pn = pppoe_pernet(dev_net(dev)); 416 417 po = __get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); 418 if (!po) 419 goto drop; 420 421 return __sk_receive_skb(&po->sk, skb, 0, 1, false); 422 423 drop: 424 kfree_skb(skb); 425 out: 426 return NET_RX_DROP; 427 } 428 429 static void pppoe_unbind_sock_work(struct work_struct *work) 430 { 431 struct pppox_sock *po = container_of(work, struct pppox_sock, 432 proto.pppoe.padt_work); 433 struct sock *sk = &po->sk; 434 435 lock_sock(sk); 436 if (po->pppoe_dev) { 437 dev_put(po->pppoe_dev); 438 po->pppoe_dev = NULL; 439 } 440 pppox_unbind_sock(sk); 441 release_sock(sk); 442 sock_put(sk); 443 } 444 445 /************************************************************************ 446 * 447 * Receive a PPPoE Discovery frame. 448 * This is solely for detection of PADT frames 449 * 450 ***********************************************************************/ 451 static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev, 452 struct packet_type *pt, struct net_device *orig_dev) 453 454 { 455 struct pppoe_hdr *ph; 456 struct pppox_sock *po; 457 struct pppoe_net *pn; 458 459 skb = skb_share_check(skb, GFP_ATOMIC); 460 if (!skb) 461 goto out; 462 463 if (skb->pkt_type != PACKET_HOST) 464 goto abort; 465 466 if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) 467 goto abort; 468 469 ph = pppoe_hdr(skb); 470 if (ph->code != PADT_CODE) 471 goto abort; 472 473 pn = pppoe_pernet(dev_net(dev)); 474 po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex); 475 if (po) 476 if (!schedule_work(&po->proto.pppoe.padt_work)) 477 sock_put(&po->sk); 478 479 abort: 480 kfree_skb(skb); 481 out: 482 return NET_RX_SUCCESS; /* Lies... :-) */ 483 } 484 485 static struct packet_type pppoes_ptype __read_mostly = { 486 .type = cpu_to_be16(ETH_P_PPP_SES), 487 .func = pppoe_rcv, 488 }; 489 490 static struct packet_type pppoed_ptype __read_mostly = { 491 .type = cpu_to_be16(ETH_P_PPP_DISC), 492 .func = pppoe_disc_rcv, 493 }; 494 495 static struct proto pppoe_sk_proto __read_mostly = { 496 .name = "PPPOE", 497 .owner = THIS_MODULE, 498 .obj_size = sizeof(struct pppox_sock), 499 }; 500 501 static void pppoe_destruct(struct sock *sk) 502 { 503 skb_queue_purge(&sk->sk_receive_queue); 504 } 505 506 /*********************************************************************** 507 * 508 * Initialize a new struct sock. 509 * 510 **********************************************************************/ 511 static int pppoe_create(struct net *net, struct socket *sock, int kern) 512 { 513 struct sock *sk; 514 515 sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppoe_sk_proto, kern); 516 if (!sk) 517 return -ENOMEM; 518 519 sock_init_data(sock, sk); 520 sock_set_flag(sk, SOCK_RCU_FREE); 521 522 sock->state = SS_UNCONNECTED; 523 sock->ops = &pppoe_ops; 524 525 sk->sk_backlog_rcv = pppoe_rcv_core; 526 sk->sk_destruct = pppoe_destruct; 527 sk->sk_state = PPPOX_NONE; 528 sk->sk_type = SOCK_STREAM; 529 sk->sk_family = PF_PPPOX; 530 sk->sk_protocol = PX_PROTO_OE; 531 532 INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work, 533 pppoe_unbind_sock_work); 534 535 return 0; 536 } 537 538 static int pppoe_release(struct socket *sock) 539 { 540 struct sock *sk = sock->sk; 541 struct pppox_sock *po; 542 struct pppoe_net *pn; 543 struct net *net = NULL; 544 545 if (!sk) 546 return 0; 547 548 lock_sock(sk); 549 if (sock_flag(sk, SOCK_DEAD)) { 550 release_sock(sk); 551 return -EBADF; 552 } 553 554 po = pppox_sk(sk); 555 556 if (po->pppoe_dev) { 557 dev_put(po->pppoe_dev); 558 po->pppoe_dev = NULL; 559 } 560 561 pppox_unbind_sock(sk); 562 563 /* Signal the death of the socket. */ 564 sk->sk_state = PPPOX_DEAD; 565 566 net = sock_net(sk); 567 pn = pppoe_pernet(net); 568 569 /* 570 * protect "po" from concurrent updates 571 * on pppoe_flush_dev 572 */ 573 delete_item(pn, po->pppoe_pa.sid, po->pppoe_pa.remote, 574 po->pppoe_ifindex); 575 576 sock_orphan(sk); 577 sock->sk = NULL; 578 579 release_sock(sk); 580 sock_put(sk); 581 582 return 0; 583 } 584 585 static int pppoe_connect(struct socket *sock, struct sockaddr_unsized *uservaddr, 586 int sockaddr_len, int flags) 587 { 588 struct sock *sk = sock->sk; 589 struct sockaddr_pppox *sp = (struct sockaddr_pppox *)uservaddr; 590 struct pppox_sock *po = pppox_sk(sk); 591 struct net_device *dev = NULL; 592 struct pppoe_net *pn; 593 struct net *net = NULL; 594 int error; 595 596 lock_sock(sk); 597 598 error = -EINVAL; 599 600 if (sockaddr_len != sizeof(struct sockaddr_pppox)) 601 goto end; 602 603 if (sp->sa_protocol != PX_PROTO_OE) 604 goto end; 605 606 /* Check for already bound sockets */ 607 error = -EBUSY; 608 if ((sk->sk_state & PPPOX_CONNECTED) && 609 stage_session(sp->sa_addr.pppoe.sid)) 610 goto end; 611 612 /* Check for already disconnected sockets, on attempts to disconnect */ 613 error = -EALREADY; 614 if ((sk->sk_state & PPPOX_DEAD) && 615 !stage_session(sp->sa_addr.pppoe.sid)) 616 goto end; 617 618 error = 0; 619 620 /* Delete the old binding */ 621 if (stage_session(po->pppoe_pa.sid)) { 622 pppox_unbind_sock(sk); 623 pn = pppoe_pernet(sock_net(sk)); 624 delete_item(pn, po->pppoe_pa.sid, 625 po->pppoe_pa.remote, po->pppoe_ifindex); 626 if (po->pppoe_dev) { 627 dev_put(po->pppoe_dev); 628 po->pppoe_dev = NULL; 629 } 630 631 po->pppoe_ifindex = 0; 632 memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa)); 633 memset(&po->chan, 0, sizeof(po->chan)); 634 po->next = NULL; 635 po->num = 0; 636 637 sk->sk_state = PPPOX_NONE; 638 } 639 640 /* Re-bind in session stage only */ 641 if (stage_session(sp->sa_addr.pppoe.sid)) { 642 error = -ENODEV; 643 net = sock_net(sk); 644 dev = dev_get_by_name(net, sp->sa_addr.pppoe.dev); 645 if (!dev) 646 goto err_put; 647 648 po->pppoe_dev = dev; 649 po->pppoe_ifindex = dev->ifindex; 650 pn = pppoe_pernet(net); 651 if (!(dev->flags & IFF_UP)) { 652 goto err_put; 653 } 654 655 memcpy(&po->pppoe_pa, 656 &sp->sa_addr.pppoe, 657 sizeof(struct pppoe_addr)); 658 659 spin_lock(&pn->hash_lock); 660 error = __set_item(pn, po); 661 spin_unlock(&pn->hash_lock); 662 if (error < 0) 663 goto err_put; 664 665 po->chan.hdrlen = (sizeof(struct pppoe_hdr) + 666 dev->hard_header_len); 667 668 po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2; 669 po->chan.private = sk; 670 po->chan.ops = &pppoe_chan_ops; 671 po->chan.direct_xmit = true; 672 673 error = ppp_register_net_channel(dev_net(dev), &po->chan); 674 if (error) { 675 delete_item(pn, po->pppoe_pa.sid, 676 po->pppoe_pa.remote, po->pppoe_ifindex); 677 goto err_put; 678 } 679 680 sk->sk_state = PPPOX_CONNECTED; 681 } 682 683 po->num = sp->sa_addr.pppoe.sid; 684 685 end: 686 release_sock(sk); 687 return error; 688 err_put: 689 if (po->pppoe_dev) { 690 dev_put(po->pppoe_dev); 691 po->pppoe_dev = NULL; 692 } 693 goto end; 694 } 695 696 static int pppoe_getname(struct socket *sock, struct sockaddr *uaddr, 697 int peer) 698 { 699 int len = sizeof(struct sockaddr_pppox); 700 struct sockaddr_pppox sp; 701 702 sp.sa_family = AF_PPPOX; 703 sp.sa_protocol = PX_PROTO_OE; 704 memcpy(&sp.sa_addr.pppoe, &pppox_sk(sock->sk)->pppoe_pa, 705 sizeof(struct pppoe_addr)); 706 707 memcpy(uaddr, &sp, len); 708 709 return len; 710 } 711 712 static int pppoe_ioctl(struct socket *sock, unsigned int cmd, 713 unsigned long arg) 714 { 715 struct sock *sk = sock->sk; 716 struct pppox_sock *po = pppox_sk(sk); 717 int val; 718 int err; 719 720 switch (cmd) { 721 case PPPIOCGMRU: 722 err = -ENXIO; 723 if (!(sk->sk_state & PPPOX_CONNECTED)) 724 break; 725 726 err = -EFAULT; 727 if (put_user(po->pppoe_dev->mtu - 728 sizeof(struct pppoe_hdr) - 729 PPP_HDRLEN, 730 (int __user *)arg)) 731 break; 732 err = 0; 733 break; 734 735 case PPPIOCSMRU: 736 err = -ENXIO; 737 if (!(sk->sk_state & PPPOX_CONNECTED)) 738 break; 739 740 err = -EFAULT; 741 if (get_user(val, (int __user *)arg)) 742 break; 743 744 if (val < (po->pppoe_dev->mtu 745 - sizeof(struct pppoe_hdr) 746 - PPP_HDRLEN)) 747 err = 0; 748 else 749 err = -EINVAL; 750 break; 751 752 case PPPIOCSFLAGS: 753 err = -EFAULT; 754 if (get_user(val, (int __user *)arg)) 755 break; 756 err = 0; 757 break; 758 759 default: 760 err = -ENOTTY; 761 } 762 763 return err; 764 } 765 766 static int pppoe_sendmsg(struct socket *sock, struct msghdr *m, 767 size_t total_len) 768 { 769 struct sk_buff *skb; 770 struct sock *sk = sock->sk; 771 struct pppox_sock *po = pppox_sk(sk); 772 int error; 773 struct pppoe_hdr hdr; 774 struct pppoe_hdr *ph; 775 struct net_device *dev; 776 char *start; 777 int hlen; 778 779 lock_sock(sk); 780 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) { 781 error = -ENOTCONN; 782 goto end; 783 } 784 785 hdr.ver = 1; 786 hdr.type = 1; 787 hdr.code = 0; 788 hdr.sid = po->num; 789 790 dev = po->pppoe_dev; 791 792 error = -EMSGSIZE; 793 if (total_len > (dev->mtu + dev->hard_header_len)) 794 goto end; 795 796 hlen = LL_RESERVED_SPACE(dev); 797 skb = sock_wmalloc(sk, hlen + sizeof(*ph) + total_len + 798 dev->needed_tailroom, 0, GFP_KERNEL); 799 if (!skb) { 800 error = -ENOMEM; 801 goto end; 802 } 803 804 /* Reserve space for headers. */ 805 skb_reserve(skb, hlen); 806 skb_reset_network_header(skb); 807 808 skb->dev = dev; 809 810 skb->priority = READ_ONCE(sk->sk_priority); 811 skb->protocol = cpu_to_be16(ETH_P_PPP_SES); 812 813 ph = skb_put(skb, total_len + sizeof(struct pppoe_hdr)); 814 start = (char *)ph + sizeof(*ph); 815 816 error = memcpy_from_msg(start, m, total_len); 817 if (error < 0) { 818 kfree_skb(skb); 819 goto end; 820 } 821 822 error = total_len; 823 dev_hard_header(skb, dev, ETH_P_PPP_SES, 824 po->pppoe_pa.remote, NULL, total_len); 825 826 ph = pppoe_hdr(skb); 827 memcpy(ph, &hdr, sizeof(struct pppoe_hdr)); 828 829 ph->length = htons(total_len); 830 831 dev_queue_xmit(skb); 832 833 end: 834 release_sock(sk); 835 return error; 836 } 837 838 /************************************************************************ 839 * 840 * xmit function called by generic PPP driver 841 * sends PPP frame over PPPoE socket 842 * 843 ***********************************************************************/ 844 static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb) 845 { 846 struct sock *sk = chan->private; 847 struct pppox_sock *po = pppox_sk(sk); 848 struct net_device *dev = po->pppoe_dev; 849 struct pppoe_hdr *ph; 850 int data_len = skb->len; 851 852 /* The higher-level PPP code (ppp_unregister_channel()) ensures the PPP 853 * xmit operations conclude prior to an unregistration call. Thus 854 * sk->sk_state cannot change, so we don't need to do lock_sock(). 855 * But, we also can't do a lock_sock since that introduces a potential 856 * deadlock as we'd reverse the lock ordering used when calling 857 * ppp_unregister_channel(). 858 */ 859 860 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) 861 goto abort; 862 863 if (!dev) 864 goto abort; 865 866 /* Copy the data if there is no space for the header or if it's 867 * read-only. 868 */ 869 if (skb_cow_head(skb, LL_RESERVED_SPACE(dev) + sizeof(*ph))) 870 goto abort; 871 872 __skb_push(skb, sizeof(*ph)); 873 skb_reset_network_header(skb); 874 875 ph = pppoe_hdr(skb); 876 ph->ver = 1; 877 ph->type = 1; 878 ph->code = 0; 879 ph->sid = po->num; 880 ph->length = htons(data_len); 881 882 skb->protocol = cpu_to_be16(ETH_P_PPP_SES); 883 skb->dev = dev; 884 885 dev_hard_header(skb, dev, ETH_P_PPP_SES, 886 po->pppoe_pa.remote, NULL, data_len); 887 888 dev_queue_xmit(skb); 889 return 1; 890 891 abort: 892 kfree_skb(skb); 893 return 1; 894 } 895 896 static int pppoe_fill_forward_path(struct net_device_path_ctx *ctx, 897 struct net_device_path *path, 898 const struct ppp_channel *chan) 899 { 900 struct sock *sk = chan->private; 901 struct pppox_sock *po = pppox_sk(sk); 902 struct net_device *dev = po->pppoe_dev; 903 904 if (sock_flag(sk, SOCK_DEAD) || 905 !(sk->sk_state & PPPOX_CONNECTED) || !dev) 906 return -1; 907 908 path->type = DEV_PATH_PPPOE; 909 path->encap.proto = htons(ETH_P_PPP_SES); 910 path->encap.id = be16_to_cpu(po->num); 911 memcpy(path->encap.h_dest, po->pppoe_pa.remote, ETH_ALEN); 912 memcpy(ctx->daddr, po->pppoe_pa.remote, ETH_ALEN); 913 path->dev = ctx->dev; 914 ctx->dev = dev; 915 916 return 0; 917 } 918 919 static const struct ppp_channel_ops pppoe_chan_ops = { 920 .start_xmit = pppoe_xmit, 921 .fill_forward_path = pppoe_fill_forward_path, 922 }; 923 924 static int pppoe_recvmsg(struct socket *sock, struct msghdr *m, 925 size_t total_len, int flags) 926 { 927 struct sock *sk = sock->sk; 928 struct sk_buff *skb; 929 int error = 0; 930 931 if (sk->sk_state & PPPOX_BOUND) 932 return -EIO; 933 934 skb = skb_recv_datagram(sk, flags, &error); 935 if (!skb) 936 return error; 937 938 total_len = min_t(size_t, total_len, skb->len); 939 error = skb_copy_datagram_msg(skb, 0, m, total_len); 940 if (error == 0) { 941 consume_skb(skb); 942 return total_len; 943 } 944 945 kfree_skb(skb); 946 return error; 947 } 948 949 #ifdef CONFIG_PROC_FS 950 static int pppoe_seq_show(struct seq_file *seq, void *v) 951 { 952 struct pppox_sock *po; 953 char *dev_name; 954 955 if (v == SEQ_START_TOKEN) { 956 seq_puts(seq, "Id Address Device\n"); 957 goto out; 958 } 959 960 po = v; 961 dev_name = po->pppoe_pa.dev; 962 963 seq_printf(seq, "%08X %pM %8s\n", 964 po->pppoe_pa.sid, po->pppoe_pa.remote, dev_name); 965 out: 966 return 0; 967 } 968 969 static inline struct pppox_sock *pppoe_get_idx(struct pppoe_net *pn, loff_t pos) 970 { 971 struct pppox_sock *po; 972 int i; 973 974 for (i = 0; i < PPPOE_HASH_SIZE; i++) { 975 po = rcu_dereference(pn->hash_table[i]); 976 while (po) { 977 if (!pos--) 978 goto out; 979 po = rcu_dereference(po->next); 980 } 981 } 982 983 out: 984 return po; 985 } 986 987 static void *pppoe_seq_start(struct seq_file *seq, loff_t *pos) 988 __acquires(RCU) 989 { 990 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 991 loff_t l = *pos; 992 993 rcu_read_lock(); 994 return l ? pppoe_get_idx(pn, --l) : SEQ_START_TOKEN; 995 } 996 997 static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos) 998 { 999 struct pppoe_net *pn = pppoe_pernet(seq_file_net(seq)); 1000 struct pppox_sock *po, *next; 1001 1002 ++*pos; 1003 if (v == SEQ_START_TOKEN) { 1004 po = pppoe_get_idx(pn, 0); 1005 goto out; 1006 } 1007 po = v; 1008 next = rcu_dereference(po->next); 1009 if (next) 1010 po = next; 1011 else { 1012 int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote); 1013 1014 po = NULL; 1015 while (++hash < PPPOE_HASH_SIZE) { 1016 po = rcu_dereference(pn->hash_table[hash]); 1017 if (po) 1018 break; 1019 } 1020 } 1021 1022 out: 1023 return po; 1024 } 1025 1026 static void pppoe_seq_stop(struct seq_file *seq, void *v) 1027 __releases(RCU) 1028 { 1029 rcu_read_unlock(); 1030 } 1031 1032 static const struct seq_operations pppoe_seq_ops = { 1033 .start = pppoe_seq_start, 1034 .next = pppoe_seq_next, 1035 .stop = pppoe_seq_stop, 1036 .show = pppoe_seq_show, 1037 }; 1038 #endif /* CONFIG_PROC_FS */ 1039 1040 static const struct proto_ops pppoe_ops = { 1041 .family = AF_PPPOX, 1042 .owner = THIS_MODULE, 1043 .release = pppoe_release, 1044 .bind = sock_no_bind, 1045 .connect = pppoe_connect, 1046 .socketpair = sock_no_socketpair, 1047 .accept = sock_no_accept, 1048 .getname = pppoe_getname, 1049 .poll = datagram_poll, 1050 .listen = sock_no_listen, 1051 .shutdown = sock_no_shutdown, 1052 .sendmsg = pppoe_sendmsg, 1053 .recvmsg = pppoe_recvmsg, 1054 .mmap = sock_no_mmap, 1055 .ioctl = pppox_ioctl, 1056 #ifdef CONFIG_COMPAT 1057 .compat_ioctl = pppox_compat_ioctl, 1058 #endif 1059 }; 1060 1061 static const struct pppox_proto pppoe_proto = { 1062 .create = pppoe_create, 1063 .ioctl = pppoe_ioctl, 1064 .owner = THIS_MODULE, 1065 }; 1066 1067 static __net_init int pppoe_init_net(struct net *net) 1068 { 1069 struct pppoe_net *pn = pppoe_pernet(net); 1070 struct proc_dir_entry *pde; 1071 1072 spin_lock_init(&pn->hash_lock); 1073 1074 pde = proc_create_net("pppoe", 0444, net->proc_net, 1075 &pppoe_seq_ops, sizeof(struct seq_net_private)); 1076 #ifdef CONFIG_PROC_FS 1077 if (!pde) 1078 return -ENOMEM; 1079 #endif 1080 1081 return 0; 1082 } 1083 1084 static __net_exit void pppoe_exit_net(struct net *net) 1085 { 1086 remove_proc_entry("pppoe", net->proc_net); 1087 } 1088 1089 static struct pernet_operations pppoe_net_ops = { 1090 .init = pppoe_init_net, 1091 .exit = pppoe_exit_net, 1092 .id = &pppoe_net_id, 1093 .size = sizeof(struct pppoe_net), 1094 }; 1095 1096 static u16 1097 compare_pppoe_header(const struct pppoe_hdr *phdr, 1098 const struct pppoe_hdr *phdr2) 1099 { 1100 __be16 proto = *(const __be16 *)(phdr + 1); 1101 __be16 proto2 = *(const __be16 *)(phdr2 + 1); 1102 1103 return (__force u16)((phdr->sid ^ phdr2->sid) | (proto ^ proto2)); 1104 } 1105 1106 static __be16 pppoe_hdr_proto(const struct pppoe_hdr *phdr) 1107 { 1108 __be16 proto = *(const __be16 *)(phdr + 1); 1109 1110 switch (proto) { 1111 case cpu_to_be16(PPP_IP): 1112 return cpu_to_be16(ETH_P_IP); 1113 #if IS_ENABLED(CONFIG_IPV6) 1114 case cpu_to_be16(PPP_IPV6): 1115 return cpu_to_be16(ETH_P_IPV6); 1116 #endif 1117 default: 1118 return 0; 1119 } 1120 } 1121 1122 static struct sk_buff *pppoe_gro_receive(struct list_head *head, 1123 struct sk_buff *skb) 1124 { 1125 const struct packet_offload *ptype; 1126 unsigned int hlen, off_pppoe; 1127 const struct pppoe_hdr *phdr; 1128 struct sk_buff *pp = NULL; 1129 struct sk_buff *p; 1130 int flush = 1; 1131 __be16 type; 1132 1133 off_pppoe = skb_gro_offset(skb); 1134 hlen = off_pppoe + PPPOE_SES_HLEN; 1135 phdr = skb_gro_header(skb, hlen, off_pppoe); 1136 if (unlikely(!phdr)) 1137 goto out; 1138 1139 /* filter for session packets (type:1, ver:1, code:0) */ 1140 if (*(const __be16 *)phdr != cpu_to_be16(0x1100)) 1141 goto out; 1142 1143 /* ignore packets with padding or invalid length */ 1144 if (skb_gro_len(skb) != be16_to_cpu(phdr->length) + sizeof(*phdr)) 1145 goto out; 1146 1147 type = pppoe_hdr_proto(phdr); 1148 ptype = gro_find_receive_by_type(type); 1149 if (!ptype) 1150 goto out; 1151 1152 flush = 0; 1153 1154 list_for_each_entry(p, head, list) { 1155 const struct pppoe_hdr *phdr2; 1156 1157 if (!NAPI_GRO_CB(p)->same_flow) 1158 continue; 1159 1160 phdr2 = (const struct pppoe_hdr *)(p->data + off_pppoe); 1161 if (compare_pppoe_header(phdr, phdr2)) 1162 NAPI_GRO_CB(p)->same_flow = 0; 1163 } 1164 1165 skb_gro_pull(skb, PPPOE_SES_HLEN); 1166 skb_gro_postpull_rcsum(skb, phdr, PPPOE_SES_HLEN); 1167 1168 pp = indirect_call_gro_receive_inet(ptype->callbacks.gro_receive, 1169 ipv6_gro_receive, inet_gro_receive, 1170 head, skb); 1171 1172 out: 1173 skb_gro_flush_final(skb, pp, flush); 1174 1175 return pp; 1176 } 1177 1178 static int pppoe_gro_complete(struct sk_buff *skb, int nhoff) 1179 { 1180 struct pppoe_hdr *phdr = (struct pppoe_hdr *)(skb->data + nhoff); 1181 __be16 type = pppoe_hdr_proto(phdr); 1182 struct packet_offload *ptype; 1183 unsigned int len; 1184 1185 ptype = gro_find_complete_by_type(type); 1186 if (!ptype) 1187 return -ENOENT; 1188 1189 len = skb->len - (nhoff + sizeof(*phdr)); 1190 len = min(len, 0xFFFFU); 1191 phdr->length = cpu_to_be16(len); 1192 1193 return INDIRECT_CALL_INET(ptype->callbacks.gro_complete, 1194 ipv6_gro_complete, inet_gro_complete, 1195 skb, nhoff + PPPOE_SES_HLEN); 1196 } 1197 1198 static struct sk_buff *pppoe_gso_segment(struct sk_buff *skb, 1199 netdev_features_t features) 1200 { 1201 struct sk_buff *segs = ERR_PTR(-EINVAL); 1202 struct packet_offload *ptype; 1203 struct pppoe_hdr *phdr; 1204 __be16 orig_type, type; 1205 int len, nhoff; 1206 1207 skb_reset_network_header(skb); 1208 nhoff = skb_network_header(skb) - skb_mac_header(skb); 1209 1210 if (unlikely(!pskb_may_pull(skb, PPPOE_SES_HLEN))) 1211 goto out; 1212 1213 phdr = (struct pppoe_hdr *)skb_network_header(skb); 1214 type = pppoe_hdr_proto(phdr); 1215 ptype = gro_find_complete_by_type(type); 1216 if (!ptype) 1217 goto out; 1218 1219 orig_type = skb->protocol; 1220 __skb_pull(skb, PPPOE_SES_HLEN); 1221 features &= ~NETIF_F_GSO_SOFTWARE; 1222 segs = ptype->callbacks.gso_segment(skb, features); 1223 if (IS_ERR_OR_NULL(segs)) 1224 goto out; 1225 1226 skb = segs; 1227 do { 1228 phdr = (struct pppoe_hdr *)(skb_mac_header(skb) + nhoff); 1229 len = skb->len - (nhoff + sizeof(*phdr)); 1230 phdr->length = cpu_to_be16(len); 1231 skb->network_header = (u8 *)phdr - skb->head; 1232 skb->protocol = orig_type; 1233 skb_reset_mac_len(skb); 1234 } while ((skb = skb->next)); 1235 1236 out: 1237 return segs; 1238 } 1239 1240 static struct packet_offload pppoe_packet_offload __read_mostly = { 1241 .type = cpu_to_be16(ETH_P_PPP_SES), 1242 .priority = 20, 1243 .callbacks = { 1244 .gro_receive = pppoe_gro_receive, 1245 .gro_complete = pppoe_gro_complete, 1246 .gso_segment = pppoe_gso_segment, 1247 }, 1248 }; 1249 1250 static int __init pppoe_init(void) 1251 { 1252 int err; 1253 1254 err = register_pernet_device(&pppoe_net_ops); 1255 if (err) 1256 goto out; 1257 1258 err = proto_register(&pppoe_sk_proto, 0); 1259 if (err) 1260 goto out_unregister_net_ops; 1261 1262 err = register_pppox_proto(PX_PROTO_OE, &pppoe_proto); 1263 if (err) 1264 goto out_unregister_pppoe_proto; 1265 1266 if (IS_ENABLED(CONFIG_INET)) 1267 dev_add_offload(&pppoe_packet_offload); 1268 dev_add_pack(&pppoes_ptype); 1269 dev_add_pack(&pppoed_ptype); 1270 register_netdevice_notifier(&pppoe_notifier); 1271 1272 return 0; 1273 1274 out_unregister_pppoe_proto: 1275 proto_unregister(&pppoe_sk_proto); 1276 out_unregister_net_ops: 1277 unregister_pernet_device(&pppoe_net_ops); 1278 out: 1279 return err; 1280 } 1281 1282 static void __exit pppoe_exit(void) 1283 { 1284 unregister_netdevice_notifier(&pppoe_notifier); 1285 dev_remove_pack(&pppoed_ptype); 1286 dev_remove_pack(&pppoes_ptype); 1287 if (IS_ENABLED(CONFIG_INET)) 1288 dev_remove_offload(&pppoe_packet_offload); 1289 unregister_pppox_proto(PX_PROTO_OE); 1290 proto_unregister(&pppoe_sk_proto); 1291 unregister_pernet_device(&pppoe_net_ops); 1292 } 1293 1294 module_init(pppoe_init); 1295 module_exit(pppoe_exit); 1296 1297 MODULE_AUTHOR("Michal Ostrowski <mostrows@speakeasy.net>"); 1298 MODULE_DESCRIPTION("PPP over Ethernet driver"); 1299 MODULE_LICENSE("GPL"); 1300 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OE); 1301