xref: /linux/net/appletalk/ddp.c (revision 0889d07f3e4b171c453b2aaf2b257f9074cdf624)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *	DDP:	An implementation of the AppleTalk DDP protocol for
4  *		Ethernet 'ELAP'.
5  *
6  *		Alan Cox  <alan@lxorguk.ukuu.org.uk>
7  *
8  *		With more than a little assistance from
9  *
10  *		Wesley Craig <netatalk@umich.edu>
11  *
12  *	Fixes:
13  *		Neil Horman		:	Added missing device ioctls
14  *		Michael Callahan	:	Made routing work
15  *		Wesley Craig		:	Fix probing to listen to a
16  *						passed node id.
17  *		Alan Cox		:	Added send/recvmsg support
18  *		Alan Cox		:	Moved at. to protinfo in
19  *						socket.
20  *		Alan Cox		:	Added firewall hooks.
21  *		Alan Cox		:	Supports new ARPHRD_LOOPBACK
22  *		Christer Weinigel	: 	Routing and /proc fixes.
23  *		Bradford Johnson	:	LocalTalk.
24  *		Tom Dyas		:	Module support.
25  *		Alan Cox		:	Hooks for PPP (based on the
26  *						LocalTalk hook).
27  *		Alan Cox		:	Posix bits
28  *		Alan Cox/Mike Freeman	:	Possible fix to NBP problems
29  *		Bradford Johnson	:	IP-over-DDP (experimental)
30  *		Jay Schulist		:	Moved IP-over-DDP to its own
31  *						driver file. (ipddp.c & ipddp.h)
32  *		Jay Schulist		:	Made work as module with
33  *						AppleTalk drivers, cleaned it.
34  *		Rob Newberry		:	Added proxy AARP and AARP
35  *						procfs, moved probing to AARP
36  *						module.
37  *              Adrian Sun/
38  *              Michael Zuelsdorff      :       fix for net.0 packets. don't
39  *                                              allow illegal ether/tokentalk
40  *                                              port assignment. we lose a
41  *                                              valid localtalk port as a
42  *                                              result.
43  *		Arnaldo C. de Melo	:	Cleanup, in preparation for
44  *						shared skb support 8)
45  *		Arnaldo C. de Melo	:	Move proc stuff to atalk_proc.c,
46  *						use seq_file
47  */
48 
49 #include <linux/capability.h>
50 #include <linux/module.h>
51 #include <linux/if_arp.h>
52 #include <linux/termios.h>	/* For TIOCOUTQ/INQ */
53 #include <linux/compat.h>
54 #include <linux/slab.h>
55 #include <net/datalink.h>
56 #include <net/psnap.h>
57 #include <net/sock.h>
58 #include <net/tcp_states.h>
59 #include <net/route.h>
60 #include <linux/atalk.h>
61 #include <linux/highmem.h>
62 
63 struct datalink_proto *ddp_dl, *aarp_dl;
64 static const struct proto_ops atalk_dgram_ops;
65 
66 /**************************************************************************\
67 *                                                                          *
68 * Handlers for the socket list.                                            *
69 *                                                                          *
70 \**************************************************************************/
71 
72 HLIST_HEAD(atalk_sockets);
73 DEFINE_RWLOCK(atalk_sockets_lock);
74 
75 static inline void __atalk_insert_socket(struct sock *sk)
76 {
77 	sk_add_node(sk, &atalk_sockets);
78 }
79 
80 static inline void atalk_remove_socket(struct sock *sk)
81 {
82 	write_lock_bh(&atalk_sockets_lock);
83 	sk_del_node_init(sk);
84 	write_unlock_bh(&atalk_sockets_lock);
85 }
86 
87 static struct sock *atalk_search_socket(struct sockaddr_at *to,
88 					struct atalk_iface *atif)
89 {
90 	struct sock *s;
91 
92 	read_lock_bh(&atalk_sockets_lock);
93 	sk_for_each(s, &atalk_sockets) {
94 		struct atalk_sock *at = at_sk(s);
95 
96 		if (to->sat_port != at->src_port)
97 			continue;
98 
99 		if (to->sat_addr.s_net == ATADDR_ANYNET &&
100 		    to->sat_addr.s_node == ATADDR_BCAST)
101 			goto found;
102 
103 		if (to->sat_addr.s_net == at->src_net &&
104 		    (to->sat_addr.s_node == at->src_node ||
105 		     to->sat_addr.s_node == ATADDR_BCAST ||
106 		     to->sat_addr.s_node == ATADDR_ANYNODE))
107 			goto found;
108 
109 		/* XXXX.0 -- we got a request for this router. make sure
110 		 * that the node is appropriately set. */
111 		if (to->sat_addr.s_node == ATADDR_ANYNODE &&
112 		    to->sat_addr.s_net != ATADDR_ANYNET &&
113 		    atif->address.s_node == at->src_node) {
114 			to->sat_addr.s_node = atif->address.s_node;
115 			goto found;
116 		}
117 	}
118 	s = NULL;
119 found:
120 	read_unlock_bh(&atalk_sockets_lock);
121 	return s;
122 }
123 
124 /**
125  * atalk_find_or_insert_socket - Try to find a socket matching ADDR
126  * @sk: socket to insert in the list if it is not there already
127  * @sat: address to search for
128  *
129  * Try to find a socket matching ADDR in the socket list, if found then return
130  * it. If not, insert SK into the socket list.
131  *
132  * This entire operation must execute atomically.
133  */
134 static struct sock *atalk_find_or_insert_socket(struct sock *sk,
135 						struct sockaddr_at *sat)
136 {
137 	struct sock *s;
138 	struct atalk_sock *at;
139 
140 	write_lock_bh(&atalk_sockets_lock);
141 	sk_for_each(s, &atalk_sockets) {
142 		at = at_sk(s);
143 
144 		if (at->src_net == sat->sat_addr.s_net &&
145 		    at->src_node == sat->sat_addr.s_node &&
146 		    at->src_port == sat->sat_port)
147 			goto found;
148 	}
149 	s = NULL;
150 	__atalk_insert_socket(sk); /* Wheee, it's free, assign and insert. */
151 found:
152 	write_unlock_bh(&atalk_sockets_lock);
153 	return s;
154 }
155 
156 static void atalk_destroy_timer(struct timer_list *t)
157 {
158 	struct sock *sk = from_timer(sk, t, sk_timer);
159 
160 	if (sk_has_allocations(sk)) {
161 		sk->sk_timer.expires = jiffies + SOCK_DESTROY_TIME;
162 		add_timer(&sk->sk_timer);
163 	} else
164 		sock_put(sk);
165 }
166 
167 static inline void atalk_destroy_socket(struct sock *sk)
168 {
169 	atalk_remove_socket(sk);
170 	skb_queue_purge(&sk->sk_receive_queue);
171 
172 	if (sk_has_allocations(sk)) {
173 		timer_setup(&sk->sk_timer, atalk_destroy_timer, 0);
174 		sk->sk_timer.expires	= jiffies + SOCK_DESTROY_TIME;
175 		add_timer(&sk->sk_timer);
176 	} else
177 		sock_put(sk);
178 }
179 
180 /**************************************************************************\
181 *                                                                          *
182 * Routing tables for the AppleTalk socket layer.                           *
183 *                                                                          *
184 \**************************************************************************/
185 
186 /* Anti-deadlock ordering is atalk_routes_lock --> iface_lock -DaveM */
187 struct atalk_route *atalk_routes;
188 DEFINE_RWLOCK(atalk_routes_lock);
189 
190 struct atalk_iface *atalk_interfaces;
191 DEFINE_RWLOCK(atalk_interfaces_lock);
192 
193 /* For probing devices or in a routerless network */
194 struct atalk_route atrtr_default;
195 
196 /* AppleTalk interface control */
197 /*
198  * Drop a device. Doesn't drop any of its routes - that is the caller's
199  * problem. Called when we down the interface or delete the address.
200  */
201 static void atif_drop_device(struct net_device *dev)
202 {
203 	struct atalk_iface **iface = &atalk_interfaces;
204 	struct atalk_iface *tmp;
205 
206 	write_lock_bh(&atalk_interfaces_lock);
207 	while ((tmp = *iface) != NULL) {
208 		if (tmp->dev == dev) {
209 			*iface = tmp->next;
210 			dev_put(dev);
211 			kfree(tmp);
212 			dev->atalk_ptr = NULL;
213 		} else
214 			iface = &tmp->next;
215 	}
216 	write_unlock_bh(&atalk_interfaces_lock);
217 }
218 
219 static struct atalk_iface *atif_add_device(struct net_device *dev,
220 					   struct atalk_addr *sa)
221 {
222 	struct atalk_iface *iface = kzalloc(sizeof(*iface), GFP_KERNEL);
223 
224 	if (!iface)
225 		goto out;
226 
227 	dev_hold(dev);
228 	iface->dev = dev;
229 	dev->atalk_ptr = iface;
230 	iface->address = *sa;
231 	iface->status = 0;
232 
233 	write_lock_bh(&atalk_interfaces_lock);
234 	iface->next = atalk_interfaces;
235 	atalk_interfaces = iface;
236 	write_unlock_bh(&atalk_interfaces_lock);
237 out:
238 	return iface;
239 }
240 
241 /* Perform phase 2 AARP probing on our tentative address */
242 static int atif_probe_device(struct atalk_iface *atif)
243 {
244 	int netrange = ntohs(atif->nets.nr_lastnet) -
245 			ntohs(atif->nets.nr_firstnet) + 1;
246 	int probe_net = ntohs(atif->address.s_net);
247 	int probe_node = atif->address.s_node;
248 	int netct, nodect;
249 
250 	/* Offset the network we start probing with */
251 	if (probe_net == ATADDR_ANYNET) {
252 		probe_net = ntohs(atif->nets.nr_firstnet);
253 		if (netrange)
254 			probe_net += jiffies % netrange;
255 	}
256 	if (probe_node == ATADDR_ANYNODE)
257 		probe_node = jiffies & 0xFF;
258 
259 	/* Scan the networks */
260 	atif->status |= ATIF_PROBE;
261 	for (netct = 0; netct <= netrange; netct++) {
262 		/* Sweep the available nodes from a given start */
263 		atif->address.s_net = htons(probe_net);
264 		for (nodect = 0; nodect < 256; nodect++) {
265 			atif->address.s_node = (nodect + probe_node) & 0xFF;
266 			if (atif->address.s_node > 0 &&
267 			    atif->address.s_node < 254) {
268 				/* Probe a proposed address */
269 				aarp_probe_network(atif);
270 
271 				if (!(atif->status & ATIF_PROBE_FAIL)) {
272 					atif->status &= ~ATIF_PROBE;
273 					return 0;
274 				}
275 			}
276 			atif->status &= ~ATIF_PROBE_FAIL;
277 		}
278 		probe_net++;
279 		if (probe_net > ntohs(atif->nets.nr_lastnet))
280 			probe_net = ntohs(atif->nets.nr_firstnet);
281 	}
282 	atif->status &= ~ATIF_PROBE;
283 
284 	return -EADDRINUSE;	/* Network is full... */
285 }
286 
287 
288 /* Perform AARP probing for a proxy address */
289 static int atif_proxy_probe_device(struct atalk_iface *atif,
290 				   struct atalk_addr *proxy_addr)
291 {
292 	int netrange = ntohs(atif->nets.nr_lastnet) -
293 			ntohs(atif->nets.nr_firstnet) + 1;
294 	/* we probe the interface's network */
295 	int probe_net = ntohs(atif->address.s_net);
296 	int probe_node = ATADDR_ANYNODE;	    /* we'll take anything */
297 	int netct, nodect;
298 
299 	/* Offset the network we start probing with */
300 	if (probe_net == ATADDR_ANYNET) {
301 		probe_net = ntohs(atif->nets.nr_firstnet);
302 		if (netrange)
303 			probe_net += jiffies % netrange;
304 	}
305 
306 	if (probe_node == ATADDR_ANYNODE)
307 		probe_node = jiffies & 0xFF;
308 
309 	/* Scan the networks */
310 	for (netct = 0; netct <= netrange; netct++) {
311 		/* Sweep the available nodes from a given start */
312 		proxy_addr->s_net = htons(probe_net);
313 		for (nodect = 0; nodect < 256; nodect++) {
314 			proxy_addr->s_node = (nodect + probe_node) & 0xFF;
315 			if (proxy_addr->s_node > 0 &&
316 			    proxy_addr->s_node < 254) {
317 				/* Tell AARP to probe a proposed address */
318 				int ret = aarp_proxy_probe_network(atif,
319 								    proxy_addr);
320 
321 				if (ret != -EADDRINUSE)
322 					return ret;
323 			}
324 		}
325 		probe_net++;
326 		if (probe_net > ntohs(atif->nets.nr_lastnet))
327 			probe_net = ntohs(atif->nets.nr_firstnet);
328 	}
329 
330 	return -EADDRINUSE;	/* Network is full... */
331 }
332 
333 
334 struct atalk_addr *atalk_find_dev_addr(struct net_device *dev)
335 {
336 	struct atalk_iface *iface = dev->atalk_ptr;
337 	return iface ? &iface->address : NULL;
338 }
339 
340 static struct atalk_addr *atalk_find_primary(void)
341 {
342 	struct atalk_iface *fiface = NULL;
343 	struct atalk_addr *retval;
344 	struct atalk_iface *iface;
345 
346 	/*
347 	 * Return a point-to-point interface only if
348 	 * there is no non-ptp interface available.
349 	 */
350 	read_lock_bh(&atalk_interfaces_lock);
351 	for (iface = atalk_interfaces; iface; iface = iface->next) {
352 		if (!fiface && !(iface->dev->flags & IFF_LOOPBACK))
353 			fiface = iface;
354 		if (!(iface->dev->flags & (IFF_LOOPBACK | IFF_POINTOPOINT))) {
355 			retval = &iface->address;
356 			goto out;
357 		}
358 	}
359 
360 	if (fiface)
361 		retval = &fiface->address;
362 	else if (atalk_interfaces)
363 		retval = &atalk_interfaces->address;
364 	else
365 		retval = NULL;
366 out:
367 	read_unlock_bh(&atalk_interfaces_lock);
368 	return retval;
369 }
370 
371 /*
372  * Find a match for 'any network' - ie any of our interfaces with that
373  * node number will do just nicely.
374  */
375 static struct atalk_iface *atalk_find_anynet(int node, struct net_device *dev)
376 {
377 	struct atalk_iface *iface = dev->atalk_ptr;
378 
379 	if (!iface || iface->status & ATIF_PROBE)
380 		goto out_err;
381 
382 	if (node != ATADDR_BCAST &&
383 	    iface->address.s_node != node &&
384 	    node != ATADDR_ANYNODE)
385 		goto out_err;
386 out:
387 	return iface;
388 out_err:
389 	iface = NULL;
390 	goto out;
391 }
392 
393 /* Find a match for a specific network:node pair */
394 static struct atalk_iface *atalk_find_interface(__be16 net, int node)
395 {
396 	struct atalk_iface *iface;
397 
398 	read_lock_bh(&atalk_interfaces_lock);
399 	for (iface = atalk_interfaces; iface; iface = iface->next) {
400 		if ((node == ATADDR_BCAST ||
401 		     node == ATADDR_ANYNODE ||
402 		     iface->address.s_node == node) &&
403 		    iface->address.s_net == net &&
404 		    !(iface->status & ATIF_PROBE))
405 			break;
406 
407 		/* XXXX.0 -- net.0 returns the iface associated with net */
408 		if (node == ATADDR_ANYNODE && net != ATADDR_ANYNET &&
409 		    ntohs(iface->nets.nr_firstnet) <= ntohs(net) &&
410 		    ntohs(net) <= ntohs(iface->nets.nr_lastnet))
411 			break;
412 	}
413 	read_unlock_bh(&atalk_interfaces_lock);
414 	return iface;
415 }
416 
417 
418 /*
419  * Find a route for an AppleTalk packet. This ought to get cached in
420  * the socket (later on...). We know about host routes and the fact
421  * that a route must be direct to broadcast.
422  */
423 static struct atalk_route *atrtr_find(struct atalk_addr *target)
424 {
425 	/*
426 	 * we must search through all routes unless we find a
427 	 * host route, because some host routes might overlap
428 	 * network routes
429 	 */
430 	struct atalk_route *net_route = NULL;
431 	struct atalk_route *r;
432 
433 	read_lock_bh(&atalk_routes_lock);
434 	for (r = atalk_routes; r; r = r->next) {
435 		if (!(r->flags & RTF_UP))
436 			continue;
437 
438 		if (r->target.s_net == target->s_net) {
439 			if (r->flags & RTF_HOST) {
440 				/*
441 				 * if this host route is for the target,
442 				 * the we're done
443 				 */
444 				if (r->target.s_node == target->s_node)
445 					goto out;
446 			} else
447 				/*
448 				 * this route will work if there isn't a
449 				 * direct host route, so cache it
450 				 */
451 				net_route = r;
452 		}
453 	}
454 
455 	/*
456 	 * if we found a network route but not a direct host
457 	 * route, then return it
458 	 */
459 	if (net_route)
460 		r = net_route;
461 	else if (atrtr_default.dev)
462 		r = &atrtr_default;
463 	else /* No route can be found */
464 		r = NULL;
465 out:
466 	read_unlock_bh(&atalk_routes_lock);
467 	return r;
468 }
469 
470 
471 /*
472  * Given an AppleTalk network, find the device to use. This can be
473  * a simple lookup.
474  */
475 struct net_device *atrtr_get_dev(struct atalk_addr *sa)
476 {
477 	struct atalk_route *atr = atrtr_find(sa);
478 	return atr ? atr->dev : NULL;
479 }
480 
481 /* Set up a default router */
482 static void atrtr_set_default(struct net_device *dev)
483 {
484 	atrtr_default.dev	     = dev;
485 	atrtr_default.flags	     = RTF_UP;
486 	atrtr_default.gateway.s_net  = htons(0);
487 	atrtr_default.gateway.s_node = 0;
488 }
489 
490 /*
491  * Add a router. Basically make sure it looks valid and stuff the
492  * entry in the list. While it uses netranges we always set them to one
493  * entry to work like netatalk.
494  */
495 static int atrtr_create(struct rtentry *r, struct net_device *devhint)
496 {
497 	struct sockaddr_at *ta = (struct sockaddr_at *)&r->rt_dst;
498 	struct sockaddr_at *ga = (struct sockaddr_at *)&r->rt_gateway;
499 	struct atalk_route *rt;
500 	struct atalk_iface *iface, *riface;
501 	int retval = -EINVAL;
502 
503 	/*
504 	 * Fixme: Raise/Lower a routing change semaphore for these
505 	 * operations.
506 	 */
507 
508 	/* Validate the request */
509 	if (ta->sat_family != AF_APPLETALK ||
510 	    (!devhint && ga->sat_family != AF_APPLETALK))
511 		goto out;
512 
513 	/* Now walk the routing table and make our decisions */
514 	write_lock_bh(&atalk_routes_lock);
515 	for (rt = atalk_routes; rt; rt = rt->next) {
516 		if (r->rt_flags != rt->flags)
517 			continue;
518 
519 		if (ta->sat_addr.s_net == rt->target.s_net) {
520 			if (!(rt->flags & RTF_HOST))
521 				break;
522 			if (ta->sat_addr.s_node == rt->target.s_node)
523 				break;
524 		}
525 	}
526 
527 	if (!devhint) {
528 		riface = NULL;
529 
530 		read_lock_bh(&atalk_interfaces_lock);
531 		for (iface = atalk_interfaces; iface; iface = iface->next) {
532 			if (!riface &&
533 			    ntohs(ga->sat_addr.s_net) >=
534 					ntohs(iface->nets.nr_firstnet) &&
535 			    ntohs(ga->sat_addr.s_net) <=
536 					ntohs(iface->nets.nr_lastnet))
537 				riface = iface;
538 
539 			if (ga->sat_addr.s_net == iface->address.s_net &&
540 			    ga->sat_addr.s_node == iface->address.s_node)
541 				riface = iface;
542 		}
543 		read_unlock_bh(&atalk_interfaces_lock);
544 
545 		retval = -ENETUNREACH;
546 		if (!riface)
547 			goto out_unlock;
548 
549 		devhint = riface->dev;
550 	}
551 
552 	if (!rt) {
553 		rt = kzalloc(sizeof(*rt), GFP_ATOMIC);
554 
555 		retval = -ENOBUFS;
556 		if (!rt)
557 			goto out_unlock;
558 
559 		rt->next = atalk_routes;
560 		atalk_routes = rt;
561 	}
562 
563 	/* Fill in the routing entry */
564 	rt->target  = ta->sat_addr;
565 	dev_hold(devhint);
566 	rt->dev     = devhint;
567 	rt->flags   = r->rt_flags;
568 	rt->gateway = ga->sat_addr;
569 
570 	retval = 0;
571 out_unlock:
572 	write_unlock_bh(&atalk_routes_lock);
573 out:
574 	return retval;
575 }
576 
577 /* Delete a route. Find it and discard it */
578 static int atrtr_delete(struct atalk_addr *addr)
579 {
580 	struct atalk_route **r = &atalk_routes;
581 	int retval = 0;
582 	struct atalk_route *tmp;
583 
584 	write_lock_bh(&atalk_routes_lock);
585 	while ((tmp = *r) != NULL) {
586 		if (tmp->target.s_net == addr->s_net &&
587 		    (!(tmp->flags&RTF_GATEWAY) ||
588 		     tmp->target.s_node == addr->s_node)) {
589 			*r = tmp->next;
590 			dev_put(tmp->dev);
591 			kfree(tmp);
592 			goto out;
593 		}
594 		r = &tmp->next;
595 	}
596 	retval = -ENOENT;
597 out:
598 	write_unlock_bh(&atalk_routes_lock);
599 	return retval;
600 }
601 
602 /*
603  * Called when a device is downed. Just throw away any routes
604  * via it.
605  */
606 static void atrtr_device_down(struct net_device *dev)
607 {
608 	struct atalk_route **r = &atalk_routes;
609 	struct atalk_route *tmp;
610 
611 	write_lock_bh(&atalk_routes_lock);
612 	while ((tmp = *r) != NULL) {
613 		if (tmp->dev == dev) {
614 			*r = tmp->next;
615 			dev_put(dev);
616 			kfree(tmp);
617 		} else
618 			r = &tmp->next;
619 	}
620 	write_unlock_bh(&atalk_routes_lock);
621 
622 	if (atrtr_default.dev == dev)
623 		atrtr_set_default(NULL);
624 }
625 
626 /* Actually down the interface */
627 static inline void atalk_dev_down(struct net_device *dev)
628 {
629 	atrtr_device_down(dev);	/* Remove all routes for the device */
630 	aarp_device_down(dev);	/* Remove AARP entries for the device */
631 	atif_drop_device(dev);	/* Remove the device */
632 }
633 
634 /*
635  * A device event has occurred. Watch for devices going down and
636  * delete our use of them (iface and route).
637  */
638 static int ddp_device_event(struct notifier_block *this, unsigned long event,
639 			    void *ptr)
640 {
641 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
642 
643 	if (!net_eq(dev_net(dev), &init_net))
644 		return NOTIFY_DONE;
645 
646 	if (event == NETDEV_DOWN)
647 		/* Discard any use of this */
648 		atalk_dev_down(dev);
649 
650 	return NOTIFY_DONE;
651 }
652 
653 /* ioctl calls. Shouldn't even need touching */
654 /* Device configuration ioctl calls */
655 static int atif_ioctl(int cmd, void __user *arg)
656 {
657 	static char aarp_mcast[6] = { 0x09, 0x00, 0x00, 0xFF, 0xFF, 0xFF };
658 	struct ifreq atreq;
659 	struct atalk_netrange *nr;
660 	struct sockaddr_at *sa;
661 	struct net_device *dev;
662 	struct atalk_iface *atif;
663 	int ct;
664 	int limit;
665 	struct rtentry rtdef;
666 	int add_route;
667 
668 	if (copy_from_user(&atreq, arg, sizeof(atreq)))
669 		return -EFAULT;
670 
671 	dev = __dev_get_by_name(&init_net, atreq.ifr_name);
672 	if (!dev)
673 		return -ENODEV;
674 
675 	sa = (struct sockaddr_at *)&atreq.ifr_addr;
676 	atif = atalk_find_dev(dev);
677 
678 	switch (cmd) {
679 	case SIOCSIFADDR:
680 		if (!capable(CAP_NET_ADMIN))
681 			return -EPERM;
682 		if (sa->sat_family != AF_APPLETALK)
683 			return -EINVAL;
684 		if (dev->type != ARPHRD_ETHER &&
685 		    dev->type != ARPHRD_LOOPBACK &&
686 		    dev->type != ARPHRD_LOCALTLK &&
687 		    dev->type != ARPHRD_PPP)
688 			return -EPROTONOSUPPORT;
689 
690 		nr = (struct atalk_netrange *)&sa->sat_zero[0];
691 		add_route = 1;
692 
693 		/*
694 		 * if this is a point-to-point iface, and we already
695 		 * have an iface for this AppleTalk address, then we
696 		 * should not add a route
697 		 */
698 		if ((dev->flags & IFF_POINTOPOINT) &&
699 		    atalk_find_interface(sa->sat_addr.s_net,
700 					 sa->sat_addr.s_node)) {
701 			printk(KERN_DEBUG "AppleTalk: point-to-point "
702 			       "interface added with "
703 			       "existing address\n");
704 			add_route = 0;
705 		}
706 
707 		/*
708 		 * Phase 1 is fine on LocalTalk but we don't do
709 		 * EtherTalk phase 1. Anyone wanting to add it go ahead.
710 		 */
711 		if (dev->type == ARPHRD_ETHER && nr->nr_phase != 2)
712 			return -EPROTONOSUPPORT;
713 		if (sa->sat_addr.s_node == ATADDR_BCAST ||
714 		    sa->sat_addr.s_node == 254)
715 			return -EINVAL;
716 		if (atif) {
717 			/* Already setting address */
718 			if (atif->status & ATIF_PROBE)
719 				return -EBUSY;
720 
721 			atif->address.s_net  = sa->sat_addr.s_net;
722 			atif->address.s_node = sa->sat_addr.s_node;
723 			atrtr_device_down(dev);	/* Flush old routes */
724 		} else {
725 			atif = atif_add_device(dev, &sa->sat_addr);
726 			if (!atif)
727 				return -ENOMEM;
728 		}
729 		atif->nets = *nr;
730 
731 		/*
732 		 * Check if the chosen address is used. If so we
733 		 * error and atalkd will try another.
734 		 */
735 
736 		if (!(dev->flags & IFF_LOOPBACK) &&
737 		    !(dev->flags & IFF_POINTOPOINT) &&
738 		    atif_probe_device(atif) < 0) {
739 			atif_drop_device(dev);
740 			return -EADDRINUSE;
741 		}
742 
743 		/* Hey it worked - add the direct routes */
744 		sa = (struct sockaddr_at *)&rtdef.rt_gateway;
745 		sa->sat_family = AF_APPLETALK;
746 		sa->sat_addr.s_net  = atif->address.s_net;
747 		sa->sat_addr.s_node = atif->address.s_node;
748 		sa = (struct sockaddr_at *)&rtdef.rt_dst;
749 		rtdef.rt_flags = RTF_UP;
750 		sa->sat_family = AF_APPLETALK;
751 		sa->sat_addr.s_node = ATADDR_ANYNODE;
752 		if (dev->flags & IFF_LOOPBACK ||
753 		    dev->flags & IFF_POINTOPOINT)
754 			rtdef.rt_flags |= RTF_HOST;
755 
756 		/* Routerless initial state */
757 		if (nr->nr_firstnet == htons(0) &&
758 		    nr->nr_lastnet == htons(0xFFFE)) {
759 			sa->sat_addr.s_net = atif->address.s_net;
760 			atrtr_create(&rtdef, dev);
761 			atrtr_set_default(dev);
762 		} else {
763 			limit = ntohs(nr->nr_lastnet);
764 			if (limit - ntohs(nr->nr_firstnet) > 4096) {
765 				printk(KERN_WARNING "Too many routes/"
766 				       "iface.\n");
767 				return -EINVAL;
768 			}
769 			if (add_route)
770 				for (ct = ntohs(nr->nr_firstnet);
771 				     ct <= limit; ct++) {
772 					sa->sat_addr.s_net = htons(ct);
773 					atrtr_create(&rtdef, dev);
774 				}
775 		}
776 		dev_mc_add_global(dev, aarp_mcast);
777 		return 0;
778 
779 	case SIOCGIFADDR:
780 		if (!atif)
781 			return -EADDRNOTAVAIL;
782 
783 		sa->sat_family = AF_APPLETALK;
784 		sa->sat_addr = atif->address;
785 		break;
786 
787 	case SIOCGIFBRDADDR:
788 		if (!atif)
789 			return -EADDRNOTAVAIL;
790 
791 		sa->sat_family = AF_APPLETALK;
792 		sa->sat_addr.s_net = atif->address.s_net;
793 		sa->sat_addr.s_node = ATADDR_BCAST;
794 		break;
795 
796 	case SIOCATALKDIFADDR:
797 	case SIOCDIFADDR:
798 		if (!capable(CAP_NET_ADMIN))
799 			return -EPERM;
800 		if (sa->sat_family != AF_APPLETALK)
801 			return -EINVAL;
802 		atalk_dev_down(dev);
803 		break;
804 
805 	case SIOCSARP:
806 		if (!capable(CAP_NET_ADMIN))
807 			return -EPERM;
808 		if (sa->sat_family != AF_APPLETALK)
809 			return -EINVAL;
810 		/*
811 		 * for now, we only support proxy AARP on ELAP;
812 		 * we should be able to do it for LocalTalk, too.
813 		 */
814 		if (dev->type != ARPHRD_ETHER)
815 			return -EPROTONOSUPPORT;
816 
817 		/*
818 		 * atif points to the current interface on this network;
819 		 * we aren't concerned about its current status (at
820 		 * least for now), but it has all the settings about
821 		 * the network we're going to probe. Consequently, it
822 		 * must exist.
823 		 */
824 		if (!atif)
825 			return -EADDRNOTAVAIL;
826 
827 		nr = (struct atalk_netrange *)&(atif->nets);
828 		/*
829 		 * Phase 1 is fine on Localtalk but we don't do
830 		 * Ethertalk phase 1. Anyone wanting to add it go ahead.
831 		 */
832 		if (dev->type == ARPHRD_ETHER && nr->nr_phase != 2)
833 			return -EPROTONOSUPPORT;
834 
835 		if (sa->sat_addr.s_node == ATADDR_BCAST ||
836 		    sa->sat_addr.s_node == 254)
837 			return -EINVAL;
838 
839 		/*
840 		 * Check if the chosen address is used. If so we
841 		 * error and ATCP will try another.
842 		 */
843 		if (atif_proxy_probe_device(atif, &(sa->sat_addr)) < 0)
844 			return -EADDRINUSE;
845 
846 		/*
847 		 * We now have an address on the local network, and
848 		 * the AARP code will defend it for us until we take it
849 		 * down. We don't set up any routes right now, because
850 		 * ATCP will install them manually via SIOCADDRT.
851 		 */
852 		break;
853 
854 	case SIOCDARP:
855 		if (!capable(CAP_NET_ADMIN))
856 			return -EPERM;
857 		if (sa->sat_family != AF_APPLETALK)
858 			return -EINVAL;
859 		if (!atif)
860 			return -EADDRNOTAVAIL;
861 
862 		/* give to aarp module to remove proxy entry */
863 		aarp_proxy_remove(atif->dev, &(sa->sat_addr));
864 		return 0;
865 	}
866 
867 	return copy_to_user(arg, &atreq, sizeof(atreq)) ? -EFAULT : 0;
868 }
869 
870 /* Routing ioctl() calls */
871 static int atrtr_ioctl(unsigned int cmd, void __user *arg)
872 {
873 	struct rtentry rt;
874 
875 	if (copy_from_user(&rt, arg, sizeof(rt)))
876 		return -EFAULT;
877 
878 	switch (cmd) {
879 	case SIOCDELRT:
880 		if (rt.rt_dst.sa_family != AF_APPLETALK)
881 			return -EINVAL;
882 		return atrtr_delete(&((struct sockaddr_at *)
883 				      &rt.rt_dst)->sat_addr);
884 
885 	case SIOCADDRT: {
886 		struct net_device *dev = NULL;
887 		if (rt.rt_dev) {
888 			char name[IFNAMSIZ];
889 			if (copy_from_user(name, rt.rt_dev, IFNAMSIZ-1))
890 				return -EFAULT;
891 			name[IFNAMSIZ-1] = '\0';
892 			dev = __dev_get_by_name(&init_net, name);
893 			if (!dev)
894 				return -ENODEV;
895 		}
896 		return atrtr_create(&rt, dev);
897 	}
898 	}
899 	return -EINVAL;
900 }
901 
902 /**************************************************************************\
903 *                                                                          *
904 * Handling for system calls applied via the various interfaces to an       *
905 * AppleTalk socket object.                                                 *
906 *                                                                          *
907 \**************************************************************************/
908 
909 /*
910  * Checksum: This is 'optional'. It's quite likely also a good
911  * candidate for assembler hackery 8)
912  */
913 static unsigned long atalk_sum_partial(const unsigned char *data,
914 				       int len, unsigned long sum)
915 {
916 	/* This ought to be unwrapped neatly. I'll trust gcc for now */
917 	while (len--) {
918 		sum += *data++;
919 		sum = rol16(sum, 1);
920 	}
921 	return sum;
922 }
923 
924 /*  Checksum skb data --  similar to skb_checksum  */
925 static unsigned long atalk_sum_skb(const struct sk_buff *skb, int offset,
926 				   int len, unsigned long sum)
927 {
928 	int start = skb_headlen(skb);
929 	struct sk_buff *frag_iter;
930 	int i, copy;
931 
932 	/* checksum stuff in header space */
933 	if ((copy = start - offset) > 0) {
934 		if (copy > len)
935 			copy = len;
936 		sum = atalk_sum_partial(skb->data + offset, copy, sum);
937 		if ((len -= copy) == 0)
938 			return sum;
939 
940 		offset += copy;
941 	}
942 
943 	/* checksum stuff in frags */
944 	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
945 		int end;
946 		const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
947 		WARN_ON(start > offset + len);
948 
949 		end = start + skb_frag_size(frag);
950 		if ((copy = end - offset) > 0) {
951 			u8 *vaddr;
952 
953 			if (copy > len)
954 				copy = len;
955 			vaddr = kmap_atomic(skb_frag_page(frag));
956 			sum = atalk_sum_partial(vaddr + skb_frag_off(frag) +
957 						offset - start, copy, sum);
958 			kunmap_atomic(vaddr);
959 
960 			if (!(len -= copy))
961 				return sum;
962 			offset += copy;
963 		}
964 		start = end;
965 	}
966 
967 	skb_walk_frags(skb, frag_iter) {
968 		int end;
969 
970 		WARN_ON(start > offset + len);
971 
972 		end = start + frag_iter->len;
973 		if ((copy = end - offset) > 0) {
974 			if (copy > len)
975 				copy = len;
976 			sum = atalk_sum_skb(frag_iter, offset - start,
977 					    copy, sum);
978 			if ((len -= copy) == 0)
979 				return sum;
980 			offset += copy;
981 		}
982 		start = end;
983 	}
984 
985 	BUG_ON(len > 0);
986 
987 	return sum;
988 }
989 
990 static __be16 atalk_checksum(const struct sk_buff *skb, int len)
991 {
992 	unsigned long sum;
993 
994 	/* skip header 4 bytes */
995 	sum = atalk_sum_skb(skb, 4, len-4, 0);
996 
997 	/* Use 0xFFFF for 0. 0 itself means none */
998 	return sum ? htons((unsigned short)sum) : htons(0xFFFF);
999 }
1000 
1001 static struct proto ddp_proto = {
1002 	.name	  = "DDP",
1003 	.owner	  = THIS_MODULE,
1004 	.obj_size = sizeof(struct atalk_sock),
1005 };
1006 
1007 /*
1008  * Create a socket. Initialise the socket, blank the addresses
1009  * set the state.
1010  */
1011 static int atalk_create(struct net *net, struct socket *sock, int protocol,
1012 			int kern)
1013 {
1014 	struct sock *sk;
1015 	int rc = -ESOCKTNOSUPPORT;
1016 
1017 	if (!net_eq(net, &init_net))
1018 		return -EAFNOSUPPORT;
1019 
1020 	/*
1021 	 * We permit SOCK_DGRAM and RAW is an extension. It is trivial to do
1022 	 * and gives you the full ELAP frame. Should be handy for CAP 8)
1023 	 */
1024 	if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
1025 		goto out;
1026 
1027 	rc = -EPERM;
1028 	if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1029 		goto out;
1030 
1031 	rc = -ENOMEM;
1032 	sk = sk_alloc(net, PF_APPLETALK, GFP_KERNEL, &ddp_proto, kern);
1033 	if (!sk)
1034 		goto out;
1035 	rc = 0;
1036 	sock->ops = &atalk_dgram_ops;
1037 	sock_init_data(sock, sk);
1038 
1039 	/* Checksums on by default */
1040 	sock_set_flag(sk, SOCK_ZAPPED);
1041 out:
1042 	return rc;
1043 }
1044 
1045 /* Free a socket. No work needed */
1046 static int atalk_release(struct socket *sock)
1047 {
1048 	struct sock *sk = sock->sk;
1049 
1050 	if (sk) {
1051 		sock_hold(sk);
1052 		lock_sock(sk);
1053 
1054 		sock_orphan(sk);
1055 		sock->sk = NULL;
1056 		atalk_destroy_socket(sk);
1057 
1058 		release_sock(sk);
1059 		sock_put(sk);
1060 	}
1061 	return 0;
1062 }
1063 
1064 /**
1065  * atalk_pick_and_bind_port - Pick a source port when one is not given
1066  * @sk: socket to insert into the tables
1067  * @sat: address to search for
1068  *
1069  * Pick a source port when one is not given. If we can find a suitable free
1070  * one, we insert the socket into the tables using it.
1071  *
1072  * This whole operation must be atomic.
1073  */
1074 static int atalk_pick_and_bind_port(struct sock *sk, struct sockaddr_at *sat)
1075 {
1076 	int retval;
1077 
1078 	write_lock_bh(&atalk_sockets_lock);
1079 
1080 	for (sat->sat_port = ATPORT_RESERVED;
1081 	     sat->sat_port < ATPORT_LAST;
1082 	     sat->sat_port++) {
1083 		struct sock *s;
1084 
1085 		sk_for_each(s, &atalk_sockets) {
1086 			struct atalk_sock *at = at_sk(s);
1087 
1088 			if (at->src_net == sat->sat_addr.s_net &&
1089 			    at->src_node == sat->sat_addr.s_node &&
1090 			    at->src_port == sat->sat_port)
1091 				goto try_next_port;
1092 		}
1093 
1094 		/* Wheee, it's free, assign and insert. */
1095 		__atalk_insert_socket(sk);
1096 		at_sk(sk)->src_port = sat->sat_port;
1097 		retval = 0;
1098 		goto out;
1099 
1100 try_next_port:;
1101 	}
1102 
1103 	retval = -EBUSY;
1104 out:
1105 	write_unlock_bh(&atalk_sockets_lock);
1106 	return retval;
1107 }
1108 
1109 static int atalk_autobind(struct sock *sk)
1110 {
1111 	struct atalk_sock *at = at_sk(sk);
1112 	struct sockaddr_at sat;
1113 	struct atalk_addr *ap = atalk_find_primary();
1114 	int n = -EADDRNOTAVAIL;
1115 
1116 	if (!ap || ap->s_net == htons(ATADDR_ANYNET))
1117 		goto out;
1118 
1119 	at->src_net  = sat.sat_addr.s_net  = ap->s_net;
1120 	at->src_node = sat.sat_addr.s_node = ap->s_node;
1121 
1122 	n = atalk_pick_and_bind_port(sk, &sat);
1123 	if (!n)
1124 		sock_reset_flag(sk, SOCK_ZAPPED);
1125 out:
1126 	return n;
1127 }
1128 
1129 /* Set the address 'our end' of the connection */
1130 static int atalk_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
1131 {
1132 	struct sockaddr_at *addr = (struct sockaddr_at *)uaddr;
1133 	struct sock *sk = sock->sk;
1134 	struct atalk_sock *at = at_sk(sk);
1135 	int err;
1136 
1137 	if (!sock_flag(sk, SOCK_ZAPPED) ||
1138 	    addr_len != sizeof(struct sockaddr_at))
1139 		return -EINVAL;
1140 
1141 	if (addr->sat_family != AF_APPLETALK)
1142 		return -EAFNOSUPPORT;
1143 
1144 	lock_sock(sk);
1145 	if (addr->sat_addr.s_net == htons(ATADDR_ANYNET)) {
1146 		struct atalk_addr *ap = atalk_find_primary();
1147 
1148 		err = -EADDRNOTAVAIL;
1149 		if (!ap)
1150 			goto out;
1151 
1152 		at->src_net  = addr->sat_addr.s_net = ap->s_net;
1153 		at->src_node = addr->sat_addr.s_node = ap->s_node;
1154 	} else {
1155 		err = -EADDRNOTAVAIL;
1156 		if (!atalk_find_interface(addr->sat_addr.s_net,
1157 					  addr->sat_addr.s_node))
1158 			goto out;
1159 
1160 		at->src_net  = addr->sat_addr.s_net;
1161 		at->src_node = addr->sat_addr.s_node;
1162 	}
1163 
1164 	if (addr->sat_port == ATADDR_ANYPORT) {
1165 		err = atalk_pick_and_bind_port(sk, addr);
1166 
1167 		if (err < 0)
1168 			goto out;
1169 	} else {
1170 		at->src_port = addr->sat_port;
1171 
1172 		err = -EADDRINUSE;
1173 		if (atalk_find_or_insert_socket(sk, addr))
1174 			goto out;
1175 	}
1176 
1177 	sock_reset_flag(sk, SOCK_ZAPPED);
1178 	err = 0;
1179 out:
1180 	release_sock(sk);
1181 	return err;
1182 }
1183 
1184 /* Set the address we talk to */
1185 static int atalk_connect(struct socket *sock, struct sockaddr *uaddr,
1186 			 int addr_len, int flags)
1187 {
1188 	struct sock *sk = sock->sk;
1189 	struct atalk_sock *at = at_sk(sk);
1190 	struct sockaddr_at *addr;
1191 	int err;
1192 
1193 	sk->sk_state   = TCP_CLOSE;
1194 	sock->state = SS_UNCONNECTED;
1195 
1196 	if (addr_len != sizeof(*addr))
1197 		return -EINVAL;
1198 
1199 	addr = (struct sockaddr_at *)uaddr;
1200 
1201 	if (addr->sat_family != AF_APPLETALK)
1202 		return -EAFNOSUPPORT;
1203 
1204 	if (addr->sat_addr.s_node == ATADDR_BCAST &&
1205 	    !sock_flag(sk, SOCK_BROADCAST)) {
1206 #if 1
1207 		pr_warn("atalk_connect: %s is broken and did not set SO_BROADCAST.\n",
1208 			current->comm);
1209 #else
1210 		return -EACCES;
1211 #endif
1212 	}
1213 
1214 	lock_sock(sk);
1215 	err = -EBUSY;
1216 	if (sock_flag(sk, SOCK_ZAPPED))
1217 		if (atalk_autobind(sk) < 0)
1218 			goto out;
1219 
1220 	err = -ENETUNREACH;
1221 	if (!atrtr_get_dev(&addr->sat_addr))
1222 		goto out;
1223 
1224 	at->dest_port = addr->sat_port;
1225 	at->dest_net  = addr->sat_addr.s_net;
1226 	at->dest_node = addr->sat_addr.s_node;
1227 
1228 	sock->state  = SS_CONNECTED;
1229 	sk->sk_state = TCP_ESTABLISHED;
1230 	err = 0;
1231 out:
1232 	release_sock(sk);
1233 	return err;
1234 }
1235 
1236 /*
1237  * Find the name of an AppleTalk socket. Just copy the right
1238  * fields into the sockaddr.
1239  */
1240 static int atalk_getname(struct socket *sock, struct sockaddr *uaddr,
1241 			 int peer)
1242 {
1243 	struct sockaddr_at sat;
1244 	struct sock *sk = sock->sk;
1245 	struct atalk_sock *at = at_sk(sk);
1246 	int err;
1247 
1248 	lock_sock(sk);
1249 	err = -ENOBUFS;
1250 	if (sock_flag(sk, SOCK_ZAPPED))
1251 		if (atalk_autobind(sk) < 0)
1252 			goto out;
1253 
1254 	memset(&sat, 0, sizeof(sat));
1255 
1256 	if (peer) {
1257 		err = -ENOTCONN;
1258 		if (sk->sk_state != TCP_ESTABLISHED)
1259 			goto out;
1260 
1261 		sat.sat_addr.s_net  = at->dest_net;
1262 		sat.sat_addr.s_node = at->dest_node;
1263 		sat.sat_port	    = at->dest_port;
1264 	} else {
1265 		sat.sat_addr.s_net  = at->src_net;
1266 		sat.sat_addr.s_node = at->src_node;
1267 		sat.sat_port	    = at->src_port;
1268 	}
1269 
1270 	sat.sat_family = AF_APPLETALK;
1271 	memcpy(uaddr, &sat, sizeof(sat));
1272 	err = sizeof(struct sockaddr_at);
1273 
1274 out:
1275 	release_sock(sk);
1276 	return err;
1277 }
1278 
1279 #if IS_ENABLED(CONFIG_IPDDP)
1280 static __inline__ int is_ip_over_ddp(struct sk_buff *skb)
1281 {
1282 	return skb->data[12] == 22;
1283 }
1284 
1285 static int handle_ip_over_ddp(struct sk_buff *skb)
1286 {
1287 	struct net_device *dev = __dev_get_by_name(&init_net, "ipddp0");
1288 	struct net_device_stats *stats;
1289 
1290 	/* This needs to be able to handle ipddp"N" devices */
1291 	if (!dev) {
1292 		kfree_skb(skb);
1293 		return NET_RX_DROP;
1294 	}
1295 
1296 	skb->protocol = htons(ETH_P_IP);
1297 	skb_pull(skb, 13);
1298 	skb->dev   = dev;
1299 	skb_reset_transport_header(skb);
1300 
1301 	stats = netdev_priv(dev);
1302 	stats->rx_packets++;
1303 	stats->rx_bytes += skb->len + 13;
1304 	return netif_rx(skb);  /* Send the SKB up to a higher place. */
1305 }
1306 #else
1307 /* make it easy for gcc to optimize this test out, i.e. kill the code */
1308 #define is_ip_over_ddp(skb) 0
1309 #define handle_ip_over_ddp(skb) 0
1310 #endif
1311 
1312 static int atalk_route_packet(struct sk_buff *skb, struct net_device *dev,
1313 			      struct ddpehdr *ddp, __u16 len_hops, int origlen)
1314 {
1315 	struct atalk_route *rt;
1316 	struct atalk_addr ta;
1317 
1318 	/*
1319 	 * Don't route multicast, etc., packets, or packets sent to "this
1320 	 * network"
1321 	 */
1322 	if (skb->pkt_type != PACKET_HOST || !ddp->deh_dnet) {
1323 		/*
1324 		 * FIXME:
1325 		 *
1326 		 * Can it ever happen that a packet is from a PPP iface and
1327 		 * needs to be broadcast onto the default network?
1328 		 */
1329 		if (dev->type == ARPHRD_PPP)
1330 			printk(KERN_DEBUG "AppleTalk: didn't forward broadcast "
1331 					  "packet received from PPP iface\n");
1332 		goto free_it;
1333 	}
1334 
1335 	ta.s_net  = ddp->deh_dnet;
1336 	ta.s_node = ddp->deh_dnode;
1337 
1338 	/* Route the packet */
1339 	rt = atrtr_find(&ta);
1340 	/* increment hops count */
1341 	len_hops += 1 << 10;
1342 	if (!rt || !(len_hops & (15 << 10)))
1343 		goto free_it;
1344 
1345 	/* FIXME: use skb->cb to be able to use shared skbs */
1346 
1347 	/*
1348 	 * Route goes through another gateway, so set the target to the
1349 	 * gateway instead.
1350 	 */
1351 
1352 	if (rt->flags & RTF_GATEWAY) {
1353 		ta.s_net  = rt->gateway.s_net;
1354 		ta.s_node = rt->gateway.s_node;
1355 	}
1356 
1357 	/* Fix up skb->len field */
1358 	skb_trim(skb, min_t(unsigned int, origlen,
1359 			    (rt->dev->hard_header_len +
1360 			     ddp_dl->header_length + (len_hops & 1023))));
1361 
1362 	/* FIXME: use skb->cb to be able to use shared skbs */
1363 	ddp->deh_len_hops = htons(len_hops);
1364 
1365 	/*
1366 	 * Send the buffer onwards
1367 	 *
1368 	 * Now we must always be careful. If it's come from LocalTalk to
1369 	 * EtherTalk it might not fit
1370 	 *
1371 	 * Order matters here: If a packet has to be copied to make a new
1372 	 * headroom (rare hopefully) then it won't need unsharing.
1373 	 *
1374 	 * Note. ddp-> becomes invalid at the realloc.
1375 	 */
1376 	if (skb_headroom(skb) < 22) {
1377 		/* 22 bytes - 12 ether, 2 len, 3 802.2 5 snap */
1378 		struct sk_buff *nskb = skb_realloc_headroom(skb, 32);
1379 		kfree_skb(skb);
1380 		skb = nskb;
1381 	} else
1382 		skb = skb_unshare(skb, GFP_ATOMIC);
1383 
1384 	/*
1385 	 * If the buffer didn't vanish into the lack of space bitbucket we can
1386 	 * send it.
1387 	 */
1388 	if (skb == NULL)
1389 		goto drop;
1390 
1391 	if (aarp_send_ddp(rt->dev, skb, &ta, NULL) == NET_XMIT_DROP)
1392 		return NET_RX_DROP;
1393 	return NET_RX_SUCCESS;
1394 free_it:
1395 	kfree_skb(skb);
1396 drop:
1397 	return NET_RX_DROP;
1398 }
1399 
1400 /**
1401  *	atalk_rcv - Receive a packet (in skb) from device dev
1402  *	@skb - packet received
1403  *	@dev - network device where the packet comes from
1404  *	@pt - packet type
1405  *
1406  *	Receive a packet (in skb) from device dev. This has come from the SNAP
1407  *	decoder, and on entry skb->transport_header is the DDP header, skb->len
1408  *	is the DDP header, skb->len is the DDP length. The physical headers
1409  *	have been extracted. PPP should probably pass frames marked as for this
1410  *	layer.  [ie ARPHRD_ETHERTALK]
1411  */
1412 static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
1413 		     struct packet_type *pt, struct net_device *orig_dev)
1414 {
1415 	struct ddpehdr *ddp;
1416 	struct sock *sock;
1417 	struct atalk_iface *atif;
1418 	struct sockaddr_at tosat;
1419 	int origlen;
1420 	__u16 len_hops;
1421 
1422 	if (!net_eq(dev_net(dev), &init_net))
1423 		goto drop;
1424 
1425 	/* Don't mangle buffer if shared */
1426 	if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
1427 		goto out;
1428 
1429 	/* Size check and make sure header is contiguous */
1430 	if (!pskb_may_pull(skb, sizeof(*ddp)))
1431 		goto drop;
1432 
1433 	ddp = ddp_hdr(skb);
1434 
1435 	len_hops = ntohs(ddp->deh_len_hops);
1436 
1437 	/* Trim buffer in case of stray trailing data */
1438 	origlen = skb->len;
1439 	skb_trim(skb, min_t(unsigned int, skb->len, len_hops & 1023));
1440 
1441 	/*
1442 	 * Size check to see if ddp->deh_len was crap
1443 	 * (Otherwise we'll detonate most spectacularly
1444 	 * in the middle of atalk_checksum() or recvmsg()).
1445 	 */
1446 	if (skb->len < sizeof(*ddp) || skb->len < (len_hops & 1023)) {
1447 		pr_debug("AppleTalk: dropping corrupted frame (deh_len=%u, "
1448 			 "skb->len=%u)\n", len_hops & 1023, skb->len);
1449 		goto drop;
1450 	}
1451 
1452 	/*
1453 	 * Any checksums. Note we don't do htons() on this == is assumed to be
1454 	 * valid for net byte orders all over the networking code...
1455 	 */
1456 	if (ddp->deh_sum &&
1457 	    atalk_checksum(skb, len_hops & 1023) != ddp->deh_sum)
1458 		/* Not a valid AppleTalk frame - dustbin time */
1459 		goto drop;
1460 
1461 	/* Check the packet is aimed at us */
1462 	if (!ddp->deh_dnet)	/* Net 0 is 'this network' */
1463 		atif = atalk_find_anynet(ddp->deh_dnode, dev);
1464 	else
1465 		atif = atalk_find_interface(ddp->deh_dnet, ddp->deh_dnode);
1466 
1467 	if (!atif) {
1468 		/* Not ours, so we route the packet via the correct
1469 		 * AppleTalk iface
1470 		 */
1471 		return atalk_route_packet(skb, dev, ddp, len_hops, origlen);
1472 	}
1473 
1474 	/* if IP over DDP is not selected this code will be optimized out */
1475 	if (is_ip_over_ddp(skb))
1476 		return handle_ip_over_ddp(skb);
1477 	/*
1478 	 * Which socket - atalk_search_socket() looks for a *full match*
1479 	 * of the <net, node, port> tuple.
1480 	 */
1481 	tosat.sat_addr.s_net  = ddp->deh_dnet;
1482 	tosat.sat_addr.s_node = ddp->deh_dnode;
1483 	tosat.sat_port	      = ddp->deh_dport;
1484 
1485 	sock = atalk_search_socket(&tosat, atif);
1486 	if (!sock) /* But not one of our sockets */
1487 		goto drop;
1488 
1489 	/* Queue packet (standard) */
1490 	if (sock_queue_rcv_skb(sock, skb) < 0)
1491 		goto drop;
1492 
1493 	return NET_RX_SUCCESS;
1494 
1495 drop:
1496 	kfree_skb(skb);
1497 out:
1498 	return NET_RX_DROP;
1499 
1500 }
1501 
1502 /*
1503  * Receive a LocalTalk frame. We make some demands on the caller here.
1504  * Caller must provide enough headroom on the packet to pull the short
1505  * header and append a long one.
1506  */
1507 static int ltalk_rcv(struct sk_buff *skb, struct net_device *dev,
1508 		     struct packet_type *pt, struct net_device *orig_dev)
1509 {
1510 	if (!net_eq(dev_net(dev), &init_net))
1511 		goto freeit;
1512 
1513 	/* Expand any short form frames */
1514 	if (skb_mac_header(skb)[2] == 1) {
1515 		struct ddpehdr *ddp;
1516 		/* Find our address */
1517 		struct atalk_addr *ap = atalk_find_dev_addr(dev);
1518 
1519 		if (!ap || skb->len < sizeof(__be16) || skb->len > 1023)
1520 			goto freeit;
1521 
1522 		/* Don't mangle buffer if shared */
1523 		if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
1524 			return 0;
1525 
1526 		/*
1527 		 * The push leaves us with a ddephdr not an shdr, and
1528 		 * handily the port bytes in the right place preset.
1529 		 */
1530 		ddp = skb_push(skb, sizeof(*ddp) - 4);
1531 
1532 		/* Now fill in the long header */
1533 
1534 		/*
1535 		 * These two first. The mac overlays the new source/dest
1536 		 * network information so we MUST copy these before
1537 		 * we write the network numbers !
1538 		 */
1539 
1540 		ddp->deh_dnode = skb_mac_header(skb)[0];     /* From physical header */
1541 		ddp->deh_snode = skb_mac_header(skb)[1];     /* From physical header */
1542 
1543 		ddp->deh_dnet  = ap->s_net;	/* Network number */
1544 		ddp->deh_snet  = ap->s_net;
1545 		ddp->deh_sum   = 0;		/* No checksum */
1546 		/*
1547 		 * Not sure about this bit...
1548 		 */
1549 		/* Non routable, so force a drop if we slip up later */
1550 		ddp->deh_len_hops = htons(skb->len + (DDP_MAXHOPS << 10));
1551 	}
1552 	skb_reset_transport_header(skb);
1553 
1554 	return atalk_rcv(skb, dev, pt, orig_dev);
1555 freeit:
1556 	kfree_skb(skb);
1557 	return 0;
1558 }
1559 
1560 static int atalk_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
1561 {
1562 	struct sock *sk = sock->sk;
1563 	struct atalk_sock *at = at_sk(sk);
1564 	DECLARE_SOCKADDR(struct sockaddr_at *, usat, msg->msg_name);
1565 	int flags = msg->msg_flags;
1566 	int loopback = 0;
1567 	struct sockaddr_at local_satalk, gsat;
1568 	struct sk_buff *skb;
1569 	struct net_device *dev;
1570 	struct ddpehdr *ddp;
1571 	int size;
1572 	struct atalk_route *rt;
1573 	int err;
1574 
1575 	if (flags & ~(MSG_DONTWAIT|MSG_CMSG_COMPAT))
1576 		return -EINVAL;
1577 
1578 	if (len > DDP_MAXSZ)
1579 		return -EMSGSIZE;
1580 
1581 	lock_sock(sk);
1582 	if (usat) {
1583 		err = -EBUSY;
1584 		if (sock_flag(sk, SOCK_ZAPPED))
1585 			if (atalk_autobind(sk) < 0)
1586 				goto out;
1587 
1588 		err = -EINVAL;
1589 		if (msg->msg_namelen < sizeof(*usat) ||
1590 		    usat->sat_family != AF_APPLETALK)
1591 			goto out;
1592 
1593 		err = -EPERM;
1594 		/* netatalk didn't implement this check */
1595 		if (usat->sat_addr.s_node == ATADDR_BCAST &&
1596 		    !sock_flag(sk, SOCK_BROADCAST)) {
1597 			goto out;
1598 		}
1599 	} else {
1600 		err = -ENOTCONN;
1601 		if (sk->sk_state != TCP_ESTABLISHED)
1602 			goto out;
1603 		usat = &local_satalk;
1604 		usat->sat_family      = AF_APPLETALK;
1605 		usat->sat_port	      = at->dest_port;
1606 		usat->sat_addr.s_node = at->dest_node;
1607 		usat->sat_addr.s_net  = at->dest_net;
1608 	}
1609 
1610 	/* Build a packet */
1611 	SOCK_DEBUG(sk, "SK %p: Got address.\n", sk);
1612 
1613 	/* For headers */
1614 	size = sizeof(struct ddpehdr) + len + ddp_dl->header_length;
1615 
1616 	if (usat->sat_addr.s_net || usat->sat_addr.s_node == ATADDR_ANYNODE) {
1617 		rt = atrtr_find(&usat->sat_addr);
1618 	} else {
1619 		struct atalk_addr at_hint;
1620 
1621 		at_hint.s_node = 0;
1622 		at_hint.s_net  = at->src_net;
1623 
1624 		rt = atrtr_find(&at_hint);
1625 	}
1626 	err = -ENETUNREACH;
1627 	if (!rt)
1628 		goto out;
1629 
1630 	dev = rt->dev;
1631 
1632 	SOCK_DEBUG(sk, "SK %p: Size needed %d, device %s\n",
1633 			sk, size, dev->name);
1634 
1635 	size += dev->hard_header_len;
1636 	release_sock(sk);
1637 	skb = sock_alloc_send_skb(sk, size, (flags & MSG_DONTWAIT), &err);
1638 	lock_sock(sk);
1639 	if (!skb)
1640 		goto out;
1641 
1642 	skb_reserve(skb, ddp_dl->header_length);
1643 	skb_reserve(skb, dev->hard_header_len);
1644 	skb->dev = dev;
1645 
1646 	SOCK_DEBUG(sk, "SK %p: Begin build.\n", sk);
1647 
1648 	ddp = skb_put(skb, sizeof(struct ddpehdr));
1649 	ddp->deh_len_hops  = htons(len + sizeof(*ddp));
1650 	ddp->deh_dnet  = usat->sat_addr.s_net;
1651 	ddp->deh_snet  = at->src_net;
1652 	ddp->deh_dnode = usat->sat_addr.s_node;
1653 	ddp->deh_snode = at->src_node;
1654 	ddp->deh_dport = usat->sat_port;
1655 	ddp->deh_sport = at->src_port;
1656 
1657 	SOCK_DEBUG(sk, "SK %p: Copy user data (%zd bytes).\n", sk, len);
1658 
1659 	err = memcpy_from_msg(skb_put(skb, len), msg, len);
1660 	if (err) {
1661 		kfree_skb(skb);
1662 		err = -EFAULT;
1663 		goto out;
1664 	}
1665 
1666 	if (sk->sk_no_check_tx)
1667 		ddp->deh_sum = 0;
1668 	else
1669 		ddp->deh_sum = atalk_checksum(skb, len + sizeof(*ddp));
1670 
1671 	/*
1672 	 * Loopback broadcast packets to non gateway targets (ie routes
1673 	 * to group we are in)
1674 	 */
1675 	if (ddp->deh_dnode == ATADDR_BCAST &&
1676 	    !(rt->flags & RTF_GATEWAY) && !(dev->flags & IFF_LOOPBACK)) {
1677 		struct sk_buff *skb2 = skb_copy(skb, GFP_KERNEL);
1678 
1679 		if (skb2) {
1680 			loopback = 1;
1681 			SOCK_DEBUG(sk, "SK %p: send out(copy).\n", sk);
1682 			/*
1683 			 * If it fails it is queued/sent above in the aarp queue
1684 			 */
1685 			aarp_send_ddp(dev, skb2, &usat->sat_addr, NULL);
1686 		}
1687 	}
1688 
1689 	if (dev->flags & IFF_LOOPBACK || loopback) {
1690 		SOCK_DEBUG(sk, "SK %p: Loop back.\n", sk);
1691 		/* loop back */
1692 		skb_orphan(skb);
1693 		if (ddp->deh_dnode == ATADDR_BCAST) {
1694 			struct atalk_addr at_lo;
1695 
1696 			at_lo.s_node = 0;
1697 			at_lo.s_net  = 0;
1698 
1699 			rt = atrtr_find(&at_lo);
1700 			if (!rt) {
1701 				kfree_skb(skb);
1702 				err = -ENETUNREACH;
1703 				goto out;
1704 			}
1705 			dev = rt->dev;
1706 			skb->dev = dev;
1707 		}
1708 		ddp_dl->request(ddp_dl, skb, dev->dev_addr);
1709 	} else {
1710 		SOCK_DEBUG(sk, "SK %p: send out.\n", sk);
1711 		if (rt->flags & RTF_GATEWAY) {
1712 		    gsat.sat_addr = rt->gateway;
1713 		    usat = &gsat;
1714 		}
1715 
1716 		/*
1717 		 * If it fails it is queued/sent above in the aarp queue
1718 		 */
1719 		aarp_send_ddp(dev, skb, &usat->sat_addr, NULL);
1720 	}
1721 	SOCK_DEBUG(sk, "SK %p: Done write (%zd).\n", sk, len);
1722 
1723 out:
1724 	release_sock(sk);
1725 	return err ? : len;
1726 }
1727 
1728 static int atalk_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
1729 			 int flags)
1730 {
1731 	struct sock *sk = sock->sk;
1732 	struct ddpehdr *ddp;
1733 	int copied = 0;
1734 	int offset = 0;
1735 	int err = 0;
1736 	struct sk_buff *skb;
1737 
1738 	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
1739 						flags & MSG_DONTWAIT, &err);
1740 	lock_sock(sk);
1741 
1742 	if (!skb)
1743 		goto out;
1744 
1745 	/* FIXME: use skb->cb to be able to use shared skbs */
1746 	ddp = ddp_hdr(skb);
1747 	copied = ntohs(ddp->deh_len_hops) & 1023;
1748 
1749 	if (sk->sk_type != SOCK_RAW) {
1750 		offset = sizeof(*ddp);
1751 		copied -= offset;
1752 	}
1753 
1754 	if (copied > size) {
1755 		copied = size;
1756 		msg->msg_flags |= MSG_TRUNC;
1757 	}
1758 	err = skb_copy_datagram_msg(skb, offset, msg, copied);
1759 
1760 	if (!err && msg->msg_name) {
1761 		DECLARE_SOCKADDR(struct sockaddr_at *, sat, msg->msg_name);
1762 		sat->sat_family      = AF_APPLETALK;
1763 		sat->sat_port        = ddp->deh_sport;
1764 		sat->sat_addr.s_node = ddp->deh_snode;
1765 		sat->sat_addr.s_net  = ddp->deh_snet;
1766 		msg->msg_namelen     = sizeof(*sat);
1767 	}
1768 
1769 	skb_free_datagram(sk, skb);	/* Free the datagram. */
1770 
1771 out:
1772 	release_sock(sk);
1773 	return err ? : copied;
1774 }
1775 
1776 
1777 /*
1778  * AppleTalk ioctl calls.
1779  */
1780 static int atalk_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
1781 {
1782 	int rc = -ENOIOCTLCMD;
1783 	struct sock *sk = sock->sk;
1784 	void __user *argp = (void __user *)arg;
1785 
1786 	switch (cmd) {
1787 	/* Protocol layer */
1788 	case TIOCOUTQ: {
1789 		long amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
1790 
1791 		if (amount < 0)
1792 			amount = 0;
1793 		rc = put_user(amount, (int __user *)argp);
1794 		break;
1795 	}
1796 	case TIOCINQ: {
1797 		/*
1798 		 * These two are safe on a single CPU system as only
1799 		 * user tasks fiddle here
1800 		 */
1801 		struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
1802 		long amount = 0;
1803 
1804 		if (skb)
1805 			amount = skb->len - sizeof(struct ddpehdr);
1806 		rc = put_user(amount, (int __user *)argp);
1807 		break;
1808 	}
1809 	/* Routing */
1810 	case SIOCADDRT:
1811 	case SIOCDELRT:
1812 		rc = -EPERM;
1813 		if (capable(CAP_NET_ADMIN))
1814 			rc = atrtr_ioctl(cmd, argp);
1815 		break;
1816 	/* Interface */
1817 	case SIOCGIFADDR:
1818 	case SIOCSIFADDR:
1819 	case SIOCGIFBRDADDR:
1820 	case SIOCATALKDIFADDR:
1821 	case SIOCDIFADDR:
1822 	case SIOCSARP:		/* proxy AARP */
1823 	case SIOCDARP:		/* proxy AARP */
1824 		rtnl_lock();
1825 		rc = atif_ioctl(cmd, argp);
1826 		rtnl_unlock();
1827 		break;
1828 	}
1829 
1830 	return rc;
1831 }
1832 
1833 
1834 #ifdef CONFIG_COMPAT
1835 static int atalk_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
1836 {
1837 	/*
1838 	 * SIOCATALKDIFADDR is a SIOCPROTOPRIVATE ioctl number, so we
1839 	 * cannot handle it in common code. The data we access if ifreq
1840 	 * here is compatible, so we can simply call the native
1841 	 * handler.
1842 	 */
1843 	if (cmd == SIOCATALKDIFADDR)
1844 		return atalk_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
1845 
1846 	return -ENOIOCTLCMD;
1847 }
1848 #endif
1849 
1850 
1851 static const struct net_proto_family atalk_family_ops = {
1852 	.family		= PF_APPLETALK,
1853 	.create		= atalk_create,
1854 	.owner		= THIS_MODULE,
1855 };
1856 
1857 static const struct proto_ops atalk_dgram_ops = {
1858 	.family		= PF_APPLETALK,
1859 	.owner		= THIS_MODULE,
1860 	.release	= atalk_release,
1861 	.bind		= atalk_bind,
1862 	.connect	= atalk_connect,
1863 	.socketpair	= sock_no_socketpair,
1864 	.accept		= sock_no_accept,
1865 	.getname	= atalk_getname,
1866 	.poll		= datagram_poll,
1867 	.ioctl		= atalk_ioctl,
1868 	.gettstamp	= sock_gettstamp,
1869 #ifdef CONFIG_COMPAT
1870 	.compat_ioctl	= atalk_compat_ioctl,
1871 #endif
1872 	.listen		= sock_no_listen,
1873 	.shutdown	= sock_no_shutdown,
1874 	.setsockopt	= sock_no_setsockopt,
1875 	.getsockopt	= sock_no_getsockopt,
1876 	.sendmsg	= atalk_sendmsg,
1877 	.recvmsg	= atalk_recvmsg,
1878 	.mmap		= sock_no_mmap,
1879 	.sendpage	= sock_no_sendpage,
1880 };
1881 
1882 static struct notifier_block ddp_notifier = {
1883 	.notifier_call	= ddp_device_event,
1884 };
1885 
1886 static struct packet_type ltalk_packet_type __read_mostly = {
1887 	.type		= cpu_to_be16(ETH_P_LOCALTALK),
1888 	.func		= ltalk_rcv,
1889 };
1890 
1891 static struct packet_type ppptalk_packet_type __read_mostly = {
1892 	.type		= cpu_to_be16(ETH_P_PPPTALK),
1893 	.func		= atalk_rcv,
1894 };
1895 
1896 static unsigned char ddp_snap_id[] = { 0x08, 0x00, 0x07, 0x80, 0x9B };
1897 
1898 /* Export symbols for use by drivers when AppleTalk is a module */
1899 EXPORT_SYMBOL(atrtr_get_dev);
1900 EXPORT_SYMBOL(atalk_find_dev_addr);
1901 
1902 /* Called by proto.c on kernel start up */
1903 static int __init atalk_init(void)
1904 {
1905 	int rc;
1906 
1907 	rc = proto_register(&ddp_proto, 0);
1908 	if (rc)
1909 		goto out;
1910 
1911 	rc = sock_register(&atalk_family_ops);
1912 	if (rc)
1913 		goto out_proto;
1914 
1915 	ddp_dl = register_snap_client(ddp_snap_id, atalk_rcv);
1916 	if (!ddp_dl) {
1917 		pr_crit("Unable to register DDP with SNAP.\n");
1918 		rc = -ENOMEM;
1919 		goto out_sock;
1920 	}
1921 
1922 	dev_add_pack(&ltalk_packet_type);
1923 	dev_add_pack(&ppptalk_packet_type);
1924 
1925 	rc = register_netdevice_notifier(&ddp_notifier);
1926 	if (rc)
1927 		goto out_snap;
1928 
1929 	rc = aarp_proto_init();
1930 	if (rc)
1931 		goto out_dev;
1932 
1933 	rc = atalk_proc_init();
1934 	if (rc)
1935 		goto out_aarp;
1936 
1937 	rc = atalk_register_sysctl();
1938 	if (rc)
1939 		goto out_proc;
1940 out:
1941 	return rc;
1942 out_proc:
1943 	atalk_proc_exit();
1944 out_aarp:
1945 	aarp_cleanup_module();
1946 out_dev:
1947 	unregister_netdevice_notifier(&ddp_notifier);
1948 out_snap:
1949 	dev_remove_pack(&ppptalk_packet_type);
1950 	dev_remove_pack(&ltalk_packet_type);
1951 	unregister_snap_client(ddp_dl);
1952 out_sock:
1953 	sock_unregister(PF_APPLETALK);
1954 out_proto:
1955 	proto_unregister(&ddp_proto);
1956 	goto out;
1957 }
1958 module_init(atalk_init);
1959 
1960 /*
1961  * No explicit module reference count manipulation is needed in the
1962  * protocol. Socket layer sets module reference count for us
1963  * and interfaces reference counting is done
1964  * by the network device layer.
1965  *
1966  * Ergo, before the AppleTalk module can be removed, all AppleTalk
1967  * sockets be closed from user space.
1968  */
1969 static void __exit atalk_exit(void)
1970 {
1971 #ifdef CONFIG_SYSCTL
1972 	atalk_unregister_sysctl();
1973 #endif /* CONFIG_SYSCTL */
1974 	atalk_proc_exit();
1975 	aarp_cleanup_module();	/* General aarp clean-up. */
1976 	unregister_netdevice_notifier(&ddp_notifier);
1977 	dev_remove_pack(&ltalk_packet_type);
1978 	dev_remove_pack(&ppptalk_packet_type);
1979 	unregister_snap_client(ddp_dl);
1980 	sock_unregister(PF_APPLETALK);
1981 	proto_unregister(&ddp_proto);
1982 }
1983 module_exit(atalk_exit);
1984 
1985 MODULE_LICENSE("GPL");
1986 MODULE_AUTHOR("Alan Cox <alan@lxorguk.ukuu.org.uk>");
1987 MODULE_DESCRIPTION("AppleTalk 0.20\n");
1988 MODULE_ALIAS_NETPROTO(PF_APPLETALK);
1989