drivers/net/pppoe.c

   1 /** -*- linux-c -*- ***********************************************************
   2  * Linux PPP over Ethernet (PPPoX/PPPoE) Sockets
   3  *
   4  * PPPoX --- Generic PPP encapsulation socket family
   5  * PPPoE --- PPP over Ethernet (RFC 2516)
   6  *
   7  *
   8  * Version:    0.6.11
   9  *
  10  * 030700 :     Fixed connect logic to allow for disconnect.
  11  * 270700 :     Fixed potential SMP problems; we must protect against
  12  *              simultaneous invocation of ppp_input
  13  *              and ppp_unregister_channel.
  14  * 040800 :     Respect reference count mechanisms on net-devices.
  15  * 200800 :     fix kfree(skb) in pppoe_rcv (acme)
  16  *              Module reference count is decremented in the right spot now,
  17  *              guards against sock_put not actually freeing the sk
  18  *              in pppoe_release.
  19  * 051000 :     Initialization cleanup.
  20  * 111100 :     Fix recvmsg.
  21  * 050101 :     Fix PADT procesing.
  22  * 140501 :     Use pppoe_rcv_core to handle all backlog. (Alexey)
  23  * 170701 :     Do not lock_sock with rwlock held. (DaveM)
  24  *              Ignore discovery frames if user has socket
  25  *              locked. (DaveM)
  26  *              Ignore return value of dev_queue_xmit in __pppoe_xmit
  27  *              or else we may kfree an SKB twice. (DaveM)
  28  * 190701 :     When doing copies of skb's in __pppoe_xmit, always delete
  29  *              the original skb that was passed in on success, never on
  30  *              failure.  Delete the copy of the skb on failure to avoid
  31  *              a memory leak.
  32  * 081001 :     Misc. cleanup (licence string, non-blocking, prevent
  33  *              reference of device on close).
  34  * 121301 :     New ppp channels interface; cannot unregister a channel
  35  *              from interrupts.  Thus, we mark the socket as a ZOMBIE
  36  *              and do the unregistration later.
  37  * 071502 :     When a connection is being torn down, we must remember that
  38  *              ZOMBIE state connections are still connected and thus
  39  *              pppox_unbind_sock must unbind them (in pppoe_release).
  40  *
  41  * Author:      Michal Ostrowski <mostrows@speakeasy.net>
  42  * Contributors:
  43  *              Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
  44  *              David S. Miller (davem@redhat.com)
  45  *
  46  * License:
  47  *              This program is free software; you can redistribute it and/or
  48  *              modify it under the terms of the GNU General Public License
  49  *              as published by the Free Software Foundation; either version
  50  *              2 of the License, or (at your option) any later version.
  51  *
  52  */
  53
  54 #include <linux/string.h>
  55 #include <linux/module.h>
  56
  57 #include <asm/uaccess.h>
  58
  59 #include <linux/kernel.h>
  60 #include <linux/sched.h>
  61 #include <linux/slab.h>
  62 #include <linux/errno.h>
  63
  64 #include <linux/netdevice.h>
  65 #include <linux/net.h>
  66 #include <linux/inetdevice.h>
  67 #include <linux/etherdevice.h>
  68 #include <linux/skbuff.h>
  69 #include <linux/init.h>
  70 #include <linux/if_ether.h>
  71 #include <linux/if_pppox.h>
  72 #include <net/sock.h>
  73 #include <linux/ppp_channel.h>
  74 #include <linux/ppp_defs.h>
  75 #include <linux/if_ppp.h>
  76 #include <linux/if_pppvar.h>
  77 #include <linux/notifier.h>
  78 #include <linux/file.h>
  79 #include <linux/proc_fs.h>
  80
  81
  82
  83 static int __attribute__((unused)) pppoe_debug = 7;
  84 #define PPPOE_HASH_BITS 4
  85 #define PPPOE_HASH_SIZE (1<<PPPOE_HASH_BITS)
  86
  87 int pppoe_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
  88 int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb);
  89 int __pppoe_xmit(struct sock *sk, struct sk_buff *skb);
  90
  91 struct proto_ops pppoe_ops;
  92
  93
  94 #if 0
  95 #define CHECKPTR(x,y) do { if (!(x) && pppoe_debug &7 ){ printk(KERN_CRIT "PPPoE Invalid pointer : %s , %p\n",#x,(x)); error=-EINVAL; goto y; }} while (0)
  96 #define DEBUG(s,args...) do { if( pppoe_debug & (s) ) printk(KERN_CRIT args ); } while (0)
  97 #else
  98 #define CHECKPTR(x,y) do { } while (0)
  99 #define DEBUG(s,args...) do { } while (0)
 100 #endif
 101
 102
 103
 104 static rwlock_t pppoe_hash_lock = RW_LOCK_UNLOCKED;
 105
 106
 107 static inline int cmp_2_addr(struct pppoe_addr *a, struct pppoe_addr *b)
 108 {
 109         return (a->sid == b->sid &&
 110                 (memcmp(a->remote, b->remote, ETH_ALEN) == 0));
 111 }
 112
 113 static inline int cmp_addr(struct pppoe_addr *a, unsigned long sid, char *addr)
 114 {
 115         return (a->sid == sid &&
 116                 (memcmp(a->remote,addr,ETH_ALEN) == 0));
 117 }
 118
 119 static int hash_item(unsigned long sid, unsigned char *addr)
 120 {
 121         char hash = 0;
 122         int i, j;
 123
 124         for (i = 0; i < ETH_ALEN ; ++i) {
 125                 for (j = 0; j < 8/PPPOE_HASH_BITS ; ++j) {
 126                         hash ^= addr[i] >> ( j * PPPOE_HASH_BITS );
 127                 }
 128         }
 129
 130         for (i = 0; i < (sizeof(unsigned long)*8) / PPPOE_HASH_BITS ; ++i)
 131                 hash ^= sid >> (i*PPPOE_HASH_BITS);
 132
 133         return hash & ( PPPOE_HASH_SIZE - 1 );
 134 }
 135
 136 static struct pppox_opt *item_hash_table[PPPOE_HASH_SIZE] = { 0, };
 137
 138 /**********************************************************************
 139  *
 140  *  Set/get/delete/rehash items  (internal versions)
 141  *
 142  **********************************************************************/
 143 static struct pppox_opt *__get_item(unsigned long sid, unsigned char *addr)
 144 {
 145         int hash = hash_item(sid, addr);
 146         struct pppox_opt *ret;
 147
 148         ret = item_hash_table[hash];
 149
 150         while (ret && !cmp_addr(&ret->pppoe_pa, sid, addr))
 151                 ret = ret->next;
 152
 153         return ret;
 154 }
 155
 156 static int __set_item(struct pppox_opt *po)
 157 {
 158         int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
 159         struct pppox_opt *ret;
 160
 161         ret = item_hash_table[hash];
 162         while (ret) {
 163                 if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa))
 164                         return -EALREADY;
 165
 166                 ret = ret->next;
 167         }
 168
 169         if (!ret) {
 170                 po->next = item_hash_table[hash];
 171                 item_hash_table[hash] = po;
 172         }
 173
 174         return 0;
 175 }
 176
 177 static struct pppox_opt *__delete_item(unsigned long sid, char *addr)
 178 {
 179         int hash = hash_item(sid, addr);
 180         struct pppox_opt *ret, **src;
 181
 182         ret = item_hash_table[hash];
 183         src = &item_hash_table[hash];
 184
 185         while (ret) {
 186                 if (cmp_addr(&ret->pppoe_pa, sid, addr)) {
 187                         *src = ret->next;
 188                         break;
 189                 }
 190
 191                 src = &ret->next;
 192                 ret = ret->next;
 193         }
 194
 195         return ret;
 196 }
 197
 198 /**********************************************************************
 199  *
 200  *  Set/get/delete/rehash items
 201  *
 202  **********************************************************************/
 203 static inline struct pppox_opt *get_item(unsigned long sid,
 204                                          unsigned char *addr)
 205 {
 206         struct pppox_opt *po;
 207
 208         read_lock_bh(&pppoe_hash_lock);
 209         po = __get_item(sid, addr);
 210         if (po)
 211                 sock_hold(po->sk);
 212         read_unlock_bh(&pppoe_hash_lock);
 213
 214         return po;
 215 }
 216
 217 static inline struct pppox_opt *get_item_by_addr(struct sockaddr_pppox *sp)
 218 {
 219         return get_item(sp->sa_addr.pppoe.sid, sp->sa_addr.pppoe.remote);
 220 }
 221
 222 static inline int set_item(struct pppox_opt *po)
 223 {
 224         int i;
 225
 226         if (!po)
 227                 return -EINVAL;
 228
 229         write_lock_bh(&pppoe_hash_lock);
 230         i = __set_item(po);
 231         write_unlock_bh(&pppoe_hash_lock);
 232
 233         return i;
 234 }
 235
 236 static inline struct pppox_opt *delete_item(unsigned long sid, char *addr)
 237 {
 238         struct pppox_opt *ret;
 239
 240         write_lock_bh(&pppoe_hash_lock);
 241         ret = __delete_item(sid, addr);
 242         write_unlock_bh(&pppoe_hash_lock);
 243
 244         return ret;
 245 }
 246
 247
 248
 249 /***************************************************************************
 250  *
 251  *  Handler for device events.
 252  *  Certain device events require that sockets be unconnected.
 253  *
 254  **************************************************************************/
 255
 256 static void pppoe_flush_dev(struct net_device *dev)
 257 {
 258         int hash;
 259
 260         if (dev == NULL)
 261                 BUG();
 262
 263         read_lock_bh(&pppoe_hash_lock);
 264         for (hash = 0; hash < PPPOE_HASH_SIZE; hash++) {
 265                 struct pppox_opt *po = item_hash_table[hash];
 266
 267                 while (po != NULL) {
 268                         if (po->pppoe_dev == dev) {
 269                                 struct sock *sk = po->sk;
 270
 271                                 sock_hold(sk);
 272                                 po->pppoe_dev = NULL;
 273
 274                                 /* We hold a reference to SK, now drop the
 275                                  * hash table lock so that we may attempt
 276                                  * to lock the socket (which can sleep).
 277                                  */
 278                                 read_unlock_bh(&pppoe_hash_lock);
 279
 280                                 lock_sock(sk);
 281
 282                                 if (sk->state & (PPPOX_CONNECTED|PPPOX_BOUND)){
 283                                         pppox_unbind_sock(sk);
 284                                         dev_put(dev);
 285                                         sk->state = PPPOX_ZOMBIE;
 286                                         sk->state_change(sk);
 287                                 }
 288
 289                                 release_sock(sk);
 290
 291                                 sock_put(sk);
 292
 293                                 read_lock_bh(&pppoe_hash_lock);
 294
 295                                 /* Now restart from the beginning of this
 296                                  * hash chain.  We always NULL out pppoe_dev
 297                                  * so we are guarenteed to make forward
 298                                  * progress.
 299                                  */
 300                                 po = item_hash_table[hash];
 301                                 continue;
 302                         }
 303                         po = po->next;
 304                 }
 305         }
 306         read_unlock_bh(&pppoe_hash_lock);
 307 }
 308
 309 static int pppoe_device_event(struct notifier_block *this,
 310                               unsigned long event, void *ptr)
 311 {
 312         struct net_device *dev = (struct net_device *) ptr;
 313
 314         /* Only look at sockets that are using this specific device. */
 315         switch (event) {
 316         case NETDEV_CHANGEMTU:
 317                 /* A change in mtu is a bad thing, requiring
 318                  * LCP re-negotiation.
 319                  */
 320
 321         case NETDEV_GOING_DOWN:
 322         case NETDEV_DOWN:
 323                 /* Find every socket on this device and kill it. */
 324                 pppoe_flush_dev(dev);
 325                 break;
 326
 327         default:
 328                 break;
 329         };
 330
 331         return NOTIFY_DONE;
 332 }
 333
 334
 335 static struct notifier_block pppoe_notifier = {
 336         notifier_call: pppoe_device_event,
 337 };
 338
 339
 340
 341
 342 /************************************************************************
 343  *
 344  * Do the real work of receiving a PPPoE Session frame.
 345  *
 346  ***********************************************************************/
 347 int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
 348 {
 349         struct pppox_opt *po = sk->protinfo.pppox;
 350         struct pppox_opt *relay_po = NULL;
 351
 352         if (sk->state & PPPOX_BOUND) {
 353                 skb_pull(skb, sizeof(struct pppoe_hdr));
 354                 ppp_input(&po->chan, skb);
 355         } else if (sk->state & PPPOX_RELAY) {
 356                 relay_po = get_item_by_addr(&po->pppoe_relay);
 357
 358                 if (relay_po == NULL)
 359                         goto abort_kfree;
 360
 361                 if ((relay_po->sk->state & PPPOX_CONNECTED) == 0)
 362                         goto abort_put;
 363
 364                 skb_pull(skb, sizeof(struct pppoe_hdr));
 365                 if (!__pppoe_xmit( relay_po->sk , skb))
 366                         goto abort_put;
 367         } else {
 368                 if (sock_queue_rcv_skb(sk, skb))
 369                         goto abort_kfree;
 370         }
 371
 372         return NET_RX_SUCCESS;
 373
 374 abort_put:
 375         sock_put(relay_po->sk);
 376
 377 abort_kfree:
 378         kfree_skb(skb);
 379         return NET_RX_DROP;
 380 }
 381
 382 /************************************************************************
 383  *
 384  * Receive wrapper called in BH context.
 385  *
 386  ***********************************************************************/
 387 static int pppoe_rcv(struct sk_buff *skb,
 388                       struct net_device *dev,
 389                       struct packet_type *pt)
 390
 391 {
 392         struct pppoe_hdr *ph = (struct pppoe_hdr *) skb->nh.raw;
 393         struct pppox_opt *po;
 394         struct sock *sk ;
 395         int ret;
 396
 397         po = get_item((unsigned long) ph->sid, skb->mac.ethernet->h_source);
 398
 399         if (!po) {
 400                 kfree_skb(skb);
 401                 return NET_RX_DROP;
 402         }
 403
 404         sk = po->sk;
 405         bh_lock_sock(sk);
 406
 407         /* Socket state is unknown, must put skb into backlog. */
 408         if (sk->lock.users != 0) {
 409                 sk_add_backlog(sk, skb);
 410                 ret = NET_RX_SUCCESS;
 411         } else {
 412                 ret = pppoe_rcv_core(sk, skb);
 413         }
 414
 415         bh_unlock_sock(sk);
 416         sock_put(sk);
 417
 418         return ret;
 419 }
 420
 421 /************************************************************************
 422  *
 423  * Receive a PPPoE Discovery frame.
 424  * This is solely for detection of PADT frames
 425  *
 426  ***********************************************************************/
 427 static int pppoe_disc_rcv(struct sk_buff *skb,
 428                           struct net_device *dev,
 429                           struct packet_type *pt)
 430
 431 {
 432         struct pppoe_hdr *ph = (struct pppoe_hdr *) skb->nh.raw;
 433         struct pppox_opt *po;
 434
 435         if (ph->code != PADT_CODE)
 436                 goto abort;
 437
 438         po = get_item((unsigned long) ph->sid, skb->mac.ethernet->h_source);
 439         if (po) {
 440                 struct sock *sk = po->sk;
 441
 442                 bh_lock_sock(sk);
 443
 444                 /* If the user has locked the socket, just ignore
 445                  * the packet.  With the way two rcv protocols hook into
 446                  * one socket family type, we cannot (easily) distinguish
 447                  * what kind of SKB it is during backlog rcv.
 448                  */
 449                 if (sk->lock.users == 0) {
 450                         /* We're no longer connect at the PPPOE layer,
 451                          * and must wait for ppp channel to disconnect us.
 452                          */
 453                         sk->state = PPPOX_ZOMBIE;
 454                 }
 455
 456                 bh_unlock_sock(sk);
 457                 sock_put(sk);
 458         }
 459
 460 abort:
 461         kfree_skb(skb);
 462         return NET_RX_SUCCESS; /* Lies... :-) */
 463 }
 464
 465 struct packet_type pppoes_ptype = {
 466         type:   __constant_htons(ETH_P_PPP_SES),
 467         func:   pppoe_rcv,
 468 };
 469
 470 struct packet_type pppoed_ptype = {
 471         type:   __constant_htons(ETH_P_PPP_DISC),
 472         func:   pppoe_disc_rcv,
 473 };
 474
 475 /***********************************************************************
 476  *
 477  * Really kill the socket. (Called from sock_put if refcnt == 0.)
 478  *
 479  **********************************************************************/
 480 void pppoe_sock_destruct(struct sock *sk)
 481 {
 482         if (sk->protinfo.destruct_hook)
 483                 kfree(sk->protinfo.destruct_hook);
 484         MOD_DEC_USE_COUNT;
 485 }
 486
 487
 488 /***********************************************************************
 489  *
 490  * Initialize a new struct sock.
 491  *
 492  **********************************************************************/
 493 static int pppoe_create(struct socket *sock)
 494 {
 495         int error = 0;
 496         struct sock *sk;
 497
 498         MOD_INC_USE_COUNT;
 499
 500         sk = sk_alloc(PF_PPPOX, GFP_KERNEL, 1);
 501         if (!sk)
 502                 return -ENOMEM;
 503
 504         sock_init_data(sock, sk);
 505
 506         sock->state = SS_UNCONNECTED;
 507         sock->ops   = &pppoe_ops;
 508
 509         sk->protocol = PX_PROTO_OE;
 510         sk->family = PF_PPPOX;
 511
 512         sk->backlog_rcv = pppoe_rcv_core;
 513         sk->next = NULL;
 514         sk->pprev = NULL;
 515         sk->state = PPPOX_NONE;
 516         sk->type = SOCK_STREAM;
 517         sk->destruct = pppoe_sock_destruct;
 518
 519         sk->protinfo.pppox = kmalloc(sizeof(struct pppox_opt), GFP_KERNEL);
 520         if (!sk->protinfo.pppox) {
 521                 error = -ENOMEM;
 522                 goto free_sk;
 523         }
 524
 525         memset((void *) sk->protinfo.pppox, 0, sizeof(struct pppox_opt));
 526         sk->protinfo.pppox->sk = sk;
 527
 528         /* Delete the protinfo when it is time to do so. */
 529         sk->protinfo.destruct_hook = sk->protinfo.pppox;
 530         sock->sk = sk;
 531
 532         return 0;
 533
 534 free_sk:
 535         sk_free(sk);
 536         return error;
 537 }
 538
 539 int pppoe_release(struct socket *sock)
 540 {
 541         struct sock *sk = sock->sk;
 542         struct pppox_opt *po;
 543         int error = 0;
 544
 545         if (!sk)
 546                 return 0;
 547
 548         if (sk->dead != 0)
 549                 return -EBADF;
 550
 551         pppox_unbind_sock(sk);
 552
 553         /* Signal the death of the socket. */
 554         sk->state = PPPOX_DEAD;
 555
 556         po = sk->protinfo.pppox;
 557         if (po->pppoe_pa.sid) {
 558                 delete_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
 559         }
 560
 561         if (po->pppoe_dev)
 562                 dev_put(po->pppoe_dev);
 563
 564         po->pppoe_dev = NULL;
 565
 566         sock_orphan(sk);
 567         sock->sk = NULL;
 568
 569         skb_queue_purge(&sk->receive_queue);
 570         sock_put(sk);
 571
 572         return error;
 573 }
 574
 575
 576 int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
 577                   int sockaddr_len, int flags)
 578 {
 579         struct sock *sk = sock->sk;
 580         struct net_device *dev = NULL;
 581         struct sockaddr_pppox *sp = (struct sockaddr_pppox *) uservaddr;
 582         struct pppox_opt *po = sk->protinfo.pppox;
 583         int error;
 584
 585         lock_sock(sk);
 586
 587         error = -EINVAL;
 588         if (sp->sa_protocol != PX_PROTO_OE)
 589                 goto end;
 590
 591         /* Check for already bound sockets */
 592         error = -EBUSY;
 593         if ((sk->state & PPPOX_CONNECTED) && sp->sa_addr.pppoe.sid)
 594                 goto end;
 595
 596         /* Check for already disconnected sockets,
 597            on attempts to disconnect */
 598         error = -EALREADY;
 599         if((sk->state & PPPOX_DEAD) && !sp->sa_addr.pppoe.sid )
 600                 goto end;
 601
 602         error = 0;
 603         if (po->pppoe_pa.sid) {
 604                 pppox_unbind_sock(sk);
 605
 606                 /* Delete the old binding */
 607                 delete_item(po->pppoe_pa.sid,po->pppoe_pa.remote);
 608
 609                 if(po->pppoe_dev)
 610                         dev_put(po->pppoe_dev);
 611
 612                 memset(po, 0, sizeof(struct pppox_opt));
 613                 po->sk = sk;
 614
 615                 sk->state = PPPOX_NONE;
 616         }
 617
 618         /* Don't re-bind if sid==0 */
 619         if (sp->sa_addr.pppoe.sid != 0) {
 620                 dev = dev_get_by_name(sp->sa_addr.pppoe.dev);
 621
 622                 error = -ENODEV;
 623                 if (!dev)
 624                         goto end;
 625
 626                 po->pppoe_dev = dev;
 627
 628                 if (!(dev->flags & IFF_UP))
 629                         goto err_put;
 630
 631                 memcpy(&po->pppoe_pa,
 632                        &sp->sa_addr.pppoe,
 633                        sizeof(struct pppoe_addr));
 634
 635                 error = set_item(po);
 636                 if (error < 0)
 637                         goto err_put;
 638
 639                 po->chan.hdrlen = (sizeof(struct pppoe_hdr) +
 640                                    dev->hard_header_len);
 641
 642                 po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr);
 643                 po->chan.private = sk;
 644                 po->chan.ops = &pppoe_chan_ops;
 645
 646                 error = ppp_register_channel(&po->chan);
 647                 if (error)
 648                         goto err_put;
 649
 650                 sk->state = PPPOX_CONNECTED;
 651         }
 652
 653         sk->num = sp->sa_addr.pppoe.sid;
 654
 655  end:
 656         release_sock(sk);
 657         return error;
 658 err_put:
 659         if (po->pppoe_dev) {
 660                 dev_put(po->pppoe_dev);
 661                 po->pppoe_dev = NULL;
 662         }
 663         goto end;
 664 }
 665
 666
 667 int pppoe_getname(struct socket *sock, struct sockaddr *uaddr,
 668                   int *usockaddr_len, int peer)
 669 {
 670         int len = sizeof(struct sockaddr_pppox);
 671         struct sockaddr_pppox sp;
 672
 673         sp.sa_family    = AF_PPPOX;
 674         sp.sa_protocol  = PX_PROTO_OE;
 675         memcpy(&sp.sa_addr.pppoe, &sock->sk->protinfo.pppox->pppoe_pa,
 676                sizeof(struct pppoe_addr));
 677
 678         memcpy(uaddr, &sp, len);
 679
 680         *usockaddr_len = len;
 681
 682         return 0;
 683 }
 684
 685
 686 int pppoe_ioctl(struct socket *sock, unsigned int cmd,
 687                 unsigned long arg)
 688 {
 689         struct sock *sk = sock->sk;
 690         struct pppox_opt *po;
 691         int val = 0;
 692         int err = 0;
 693
 694         po = sk->protinfo.pppox;
 695         switch (cmd) {
 696         case PPPIOCGMRU:
 697                 err = -ENXIO;
 698
 699                 if (!(sk->state & PPPOX_CONNECTED))
 700                         break;
 701
 702                 err = -EFAULT;
 703                 if (put_user(po->pppoe_dev->mtu -
 704                              sizeof(struct pppoe_hdr) -
 705                              PPP_HDRLEN,
 706                              (int *) arg))
 707                         break;
 708                 err = 0;
 709                 break;
 710
 711         case PPPIOCSMRU:
 712                 err = -ENXIO;
 713                 if (!(sk->state & PPPOX_CONNECTED))
 714                         break;
 715
 716                 err = -EFAULT;
 717                 if (get_user(val,(int *) arg))
 718                         break;
 719
 720                 if (val < (po->pppoe_dev->mtu
 721                            - sizeof(struct pppoe_hdr)
 722                            - PPP_HDRLEN))
 723                         err = 0;
 724                 else
 725                         err = -EINVAL;
 726                 break;
 727
 728         case PPPIOCSFLAGS:
 729                 err = -EFAULT;
 730                 if (get_user(val, (int *) arg))
 731                         break;
 732                 err = 0;
 733                 break;
 734
 735         case PPPOEIOCSFWD:
 736         {
 737                 struct pppox_opt *relay_po;
 738
 739                 err = -EBUSY;
 740                 if (sk->state & (PPPOX_BOUND|PPPOX_ZOMBIE|PPPOX_DEAD))
 741                         break;
 742
 743                 err = -ENOTCONN;
 744                 if (!(sk->state & PPPOX_CONNECTED))
 745                         break;
 746
 747                 /* PPPoE address from the user specifies an outbound
 748                    PPPoE address to which frames are forwarded to */
 749                 err = -EFAULT;
 750                 if (copy_from_user(&po->pppoe_relay,
 751                                    (void*)arg,
 752                                    sizeof(struct sockaddr_pppox)))
 753                         break;
 754
 755                 err = -EINVAL;
 756                 if (po->pppoe_relay.sa_family != AF_PPPOX ||
 757                     po->pppoe_relay.sa_protocol!= PX_PROTO_OE)
 758                         break;
 759
 760                 /* Check that the socket referenced by the address
 761                    actually exists. */
 762                 relay_po = get_item_by_addr(&po->pppoe_relay);
 763
 764                 if (!relay_po)
 765                         break;
 766
 767                 sock_put(relay_po->sk);
 768                 sk->state |= PPPOX_RELAY;
 769                 err = 0;
 770                 break;
 771         }
 772
 773         case PPPOEIOCDFWD:
 774                 err = -EALREADY;
 775                 if (!(sk->state & PPPOX_RELAY))
 776                         break;
 777
 778                 sk->state &= ~PPPOX_RELAY;
 779                 err = 0;
 780                 break;
 781
 782         default:;
 783         };
 784
 785         return err;
 786 }
 787
 788
 789 int pppoe_sendmsg(struct socket *sock, struct msghdr *m,
 790                   int total_len, struct scm_cookie *scm)
 791 {
 792         struct sk_buff *skb = NULL;
 793         struct sock *sk = sock->sk;
 794         int error = 0;
 795         struct pppoe_hdr hdr;
 796         struct pppoe_hdr *ph;
 797         struct net_device *dev;
 798         char *start;
 799
 800         if (sk->dead || !(sk->state & PPPOX_CONNECTED)) {
 801                 error = -ENOTCONN;
 802                 goto end;
 803         }
 804
 805         hdr.ver = 1;
 806         hdr.type = 1;
 807         hdr.code = 0;
 808         hdr.sid = sk->num;
 809
 810         lock_sock(sk);
 811
 812         dev = sk->protinfo.pppox->pppoe_dev;
 813
 814         error = -EMSGSIZE;
 815         if (total_len > (dev->mtu + dev->hard_header_len))
 816                 goto end;
 817
 818
 819         skb = sock_wmalloc(sk, total_len + dev->hard_header_len + 32,
 820                            0, GFP_KERNEL);
 821         if (!skb) {
 822                 error = -ENOMEM;
 823                 goto end;
 824         }
 825
 826         /* Reserve space for headers. */
 827         skb_reserve(skb, dev->hard_header_len);
 828         skb->nh.raw = skb->data;
 829
 830         skb->dev = dev;
 831
 832         skb->priority = sk->priority;
 833         skb->protocol = __constant_htons(ETH_P_PPP_SES);
 834
 835         ph = (struct pppoe_hdr *) skb_put(skb, total_len + sizeof(struct pppoe_hdr));
 836         start = (char *) &ph->tag[0];
 837
 838         error = memcpy_fromiovec(start, m->msg_iov, total_len);
 839
 840         if (error < 0) {
 841                 kfree_skb(skb);
 842                 goto end;
 843         }
 844
 845         error = total_len;
 846         dev->hard_header(skb, dev, ETH_P_PPP_SES,
 847                          sk->protinfo.pppox->pppoe_pa.remote,
 848                          NULL, total_len);
 849
 850         memcpy(ph, &hdr, sizeof(struct pppoe_hdr));
 851
 852         ph->length = htons(total_len);
 853
 854         dev_queue_xmit(skb);
 855
 856 end:
 857         release_sock(sk);
 858         return error;
 859 }
 860
 861
 862 /************************************************************************
 863  *
 864  * xmit function for internal use.
 865  *
 866  ***********************************************************************/
 867 int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
 868 {
 869         struct net_device *dev = sk->protinfo.pppox->pppoe_dev;
 870         struct pppoe_hdr hdr;
 871         struct pppoe_hdr *ph;
 872         int headroom = skb_headroom(skb);
 873         int data_len = skb->len;
 874         struct sk_buff *skb2;
 875
 876         if (sk->dead  || !(sk->state & PPPOX_CONNECTED))
 877                 goto abort;
 878
 879         hdr.ver = 1;
 880         hdr.type = 1;
 881         hdr.code = 0;
 882         hdr.sid = sk->num;
 883         hdr.length = htons(skb->len);
 884
 885         if (!dev)
 886                 goto abort;
 887
 888         /* Copy the skb if there is no space for the header. */
 889         if (headroom < (sizeof(struct pppoe_hdr) + dev->hard_header_len)) {
 890                 skb2 = dev_alloc_skb(32+skb->len +
 891                                      sizeof(struct pppoe_hdr) +
 892                                      dev->hard_header_len);
 893
 894                 if (skb2 == NULL)
 895                         goto abort;
 896
 897                 skb_reserve(skb2, dev->hard_header_len + sizeof(struct pppoe_hdr));
 898                 memcpy(skb_put(skb2, skb->len), skb->data, skb->len);
 899         } else {
 900                 /* Make a clone so as to not disturb the original skb,
 901                  * give dev_queue_xmit something it can free.
 902                  */
 903                 skb2 = skb_clone(skb, GFP_ATOMIC);
 904         }
 905
 906         ph = (struct pppoe_hdr *) skb_push(skb2, sizeof(struct pppoe_hdr));
 907         memcpy(ph, &hdr, sizeof(struct pppoe_hdr));
 908         skb2->protocol = __constant_htons(ETH_P_PPP_SES);
 909
 910         skb2->nh.raw = skb2->data;
 911
 912         skb2->dev = dev;
 913
 914         dev->hard_header(skb2, dev, ETH_P_PPP_SES,
 915                          sk->protinfo.pppox->pppoe_pa.remote,
 916                          NULL, data_len);
 917
 918         /* We're transmitting skb2, and assuming that dev_queue_xmit
 919          * will free it.  The generic ppp layer however, is expecting
 920          * that we give back 'skb' (not 'skb2') in case of failure,
 921          * but free it in case of success.
 922          */
 923
 924         if (dev_queue_xmit(skb2) < 0)
 925                 goto abort;
 926
 927         kfree_skb(skb);
 928         return 1;
 929
 930 abort:
 931         return 0;
 932 }
 933
 934
 935 /************************************************************************
 936  *
 937  * xmit function called by generic PPP driver
 938  * sends PPP frame over PPPoE socket
 939  *
 940  ***********************************************************************/
 941 int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb)
 942 {
 943         struct sock *sk = (struct sock *) chan->private;
 944         return __pppoe_xmit(sk, skb);
 945 }
 946
 947
 948 struct ppp_channel_ops pppoe_chan_ops = { pppoe_xmit , NULL };
 949
 950 int pppoe_rcvmsg(struct socket *sock, struct msghdr *m, int total_len, int flags, struct scm_cookie *scm)
 951 {
 952         struct sock *sk = sock->sk;
 953         struct sk_buff *skb = NULL;
 954         int error = 0;
 955         int len;
 956         struct pppoe_hdr *ph = NULL;
 957
 958         if (sk->state & PPPOX_BOUND) {
 959                 error = -EIO;
 960                 goto end;
 961         }
 962
 963         skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
 964                                 flags & MSG_DONTWAIT, &error);
 965
 966         if (error < 0) {
 967                 goto end;
 968         }
 969
 970         m->msg_namelen = 0;
 971
 972         if (skb) {
 973                 error = 0;
 974                 ph = (struct pppoe_hdr *) skb->nh.raw;
 975                 len = ntohs(ph->length);
 976
 977                 error = memcpy_toiovec(m->msg_iov, (unsigned char *) &ph->tag[0], len);
 978                 if (error < 0)
 979                         goto do_skb_free;
 980                 error = len;
 981         }
 982
 983 do_skb_free:
 984         if (skb)
 985                 kfree_skb(skb);
 986 end:
 987         return error;
 988 }
 989
 990 int pppoe_proc_info(char *buffer, char **start, off_t offset, int length)
 991 {
 992         struct pppox_opt *po;
 993         int len = 0;
 994         off_t pos = 0;
 995         off_t begin = 0;
 996         int size;
 997         int i;
 998
 999         len += sprintf(buffer,
1000                        "Id       Address              Device\n");
1001         pos = len;
1002
1003         write_lock_bh(&pppoe_hash_lock);
1004
1005         for (i = 0; i < PPPOE_HASH_SIZE; i++) {
1006                 po = item_hash_table[i];
1007                 while (po) {
1008                         char *dev = po->pppoe_pa.dev;
1009
1010                         size = sprintf(buffer + len,
1011                                        "%08X %02X:%02X:%02X:%02X:%02X:%02X %8s\n",
1012                                        po->pppoe_pa.sid,
1013                                        po->pppoe_pa.remote[0],
1014                                        po->pppoe_pa.remote[1],
1015                                        po->pppoe_pa.remote[2],
1016                                        po->pppoe_pa.remote[3],
1017                                        po->pppoe_pa.remote[4],
1018                                        po->pppoe_pa.remote[5],
1019                                        dev);
1020                         len += size;
1021                         pos += size;
1022                         if (pos < offset) {
1023                                 len = 0;
1024                                 begin = pos;
1025                         }
1026
1027                         if (pos > offset + length)
1028                                 break;
1029
1030                         po = po->next;
1031                 }
1032
1033                 if (po)
1034                         break;
1035         }
1036         write_unlock_bh(&pppoe_hash_lock);
1037
1038         *start = buffer + (offset - begin);
1039         len -= (offset - begin);
1040         if (len > length)
1041                 len = length;
1042         if (len < 0)
1043                 len = 0;
1044         return len;
1045 }
1046
1047
1048 struct proto_ops pppoe_ops = {
1049     family:             AF_PPPOX,
1050     release:            pppoe_release,
1051     bind:               sock_no_bind,
1052     connect:            pppoe_connect,
1053     socketpair:         sock_no_socketpair,
1054     accept:             sock_no_accept,
1055     getname:            pppoe_getname,
1056     poll:               datagram_poll,
1057     ioctl:              pppoe_ioctl,
1058     listen:             sock_no_listen,
1059     shutdown:           sock_no_shutdown,
1060     setsockopt:         sock_no_setsockopt,
1061     getsockopt:         sock_no_getsockopt,
1062     sendmsg:            pppoe_sendmsg,
1063     recvmsg:            pppoe_rcvmsg,
1064     mmap:               sock_no_mmap
1065 };
1066
1067 struct pppox_proto pppoe_proto = {
1068     create:     pppoe_create,
1069     ioctl:      pppoe_ioctl
1070 };
1071
1072
1073 int __init pppoe_init(void)
1074 {
1075         int err = register_pppox_proto(PX_PROTO_OE, &pppoe_proto);
1076
1077         if (err == 0) {
1078                 dev_add_pack(&pppoes_ptype);
1079                 dev_add_pack(&pppoed_ptype);
1080                 register_netdevice_notifier(&pppoe_notifier);
1081                 proc_net_create("pppoe", 0, pppoe_proc_info);
1082         }
1083         return err;
1084 }
1085
1086 void __exit pppoe_exit(void)
1087 {
1088         unregister_pppox_proto(PX_PROTO_OE);
1089         dev_remove_pack(&pppoes_ptype);
1090         dev_remove_pack(&pppoed_ptype);
1091         unregister_netdevice_notifier(&pppoe_notifier);
1092         proc_net_remove("pppoe");
1093 }
1094
1095 module_init(pppoe_init);
1096 module_exit(pppoe_exit);
1097
1098 MODULE_AUTHOR("Michal Ostrowski <mostrows@speakeasy.net>");
1099 MODULE_DESCRIPTION("PPP over Ethernet driver");
1100 MODULE_LICENSE("GPL");