1/*
   2 * This program is free software; you can redistribute it and/or modify
   3 * it under the terms of the GNU General Public License as published by
   4 * the Free Software Foundation; either version 2 of the License, or
   5 * (at your option) any later version.
   6 *
   7 * Copyright (C) Alan Cox GW4PTS (alan@lxorguk.ukuu.org.uk)
   8 * Copyright (C) Jonathan Naylor G4KLX (g4klx@g4klx.demon.co.uk)
   9 * Copyright (C) Darryl Miles G7LED (dlm@g7led.demon.co.uk)
  10 * Copyright (C) Steven Whitehouse GW7RRM (stevew@acm.org)
  11 * Copyright (C) Joerg Reuter DL1BKE (jreuter@yaina.de)
  12 * Copyright (C) Hans-Joachim Hetscher DD8NE (dd8ne@bnv-bamberg.de)
  13 * Copyright (C) Hans Alblas PE1AYX (hans@esrac.ele.tue.nl)
  14 * Copyright (C) Frederic Rible F1OAT (frible@teaser.fr)
  15 */
  16#include <linux/capability.h>
  17#include <linux/module.h>
  18#include <linux/errno.h>
  19#include <linux/types.h>
  20#include <linux/socket.h>
  21#include <linux/in.h>
  22#include <linux/kernel.h>
  23#include <linux/sched.h>
  24#include <linux/timer.h>
  25#include <linux/string.h>
  26#include <linux/sockios.h>
  27#include <linux/net.h>
  28#include <linux/slab.h>
  29#include <net/ax25.h>
  30#include <linux/inet.h>
  31#include <linux/netdevice.h>
  32#include <linux/if_arp.h>
  33#include <linux/skbuff.h>
  34#include <net/sock.h>
  35#include <asm/uaccess.h>
  36#include <asm/system.h>
  37#include <linux/fcntl.h>
  38#include <linux/termios.h>	/* For TIOCINQ/OUTQ */
  39#include <linux/mm.h>
  40#include <linux/interrupt.h>
  41#include <linux/notifier.h>
  42#include <linux/proc_fs.h>
  43#include <linux/stat.h>
  44#include <linux/netfilter.h>
  45#include <linux/sysctl.h>
  46#include <linux/init.h>
  47#include <linux/spinlock.h>
  48#include <net/net_namespace.h>
  49#include <net/tcp_states.h>
  50#include <net/ip.h>
  51#include <net/arp.h>
  52
  53
  54
  55HLIST_HEAD(ax25_list);
  56DEFINE_SPINLOCK(ax25_list_lock);
  57
  58static const struct proto_ops ax25_proto_ops;
  59
  60static void ax25_free_sock(struct sock *sk)
  61{
  62	ax25_cb_put(ax25_sk(sk));
  63}
  64
  65/*
  66 *	Socket removal during an interrupt is now safe.
  67 */
  68static void ax25_cb_del(ax25_cb *ax25)
  69{
  70	if (!hlist_unhashed(&ax25->ax25_node)) {
  71		spin_lock_bh(&ax25_list_lock);
  72		hlist_del_init(&ax25->ax25_node);
  73		spin_unlock_bh(&ax25_list_lock);
  74		ax25_cb_put(ax25);
  75	}
  76}
  77
  78/*
  79 *	Kill all bound sockets on a dropped device.
  80 */
  81static void ax25_kill_by_device(struct net_device *dev)
  82{
  83	ax25_dev *ax25_dev;
  84	ax25_cb *s;
  85	struct hlist_node *node;
  86
  87	if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL)
  88		return;
  89
  90	spin_lock_bh(&ax25_list_lock);
  91again:
  92	ax25_for_each(s, node, &ax25_list) {
  93		if (s->ax25_dev == ax25_dev) {
  94			s->ax25_dev = NULL;
  95			spin_unlock_bh(&ax25_list_lock);
  96			ax25_disconnect(s, ENETUNREACH);
  97			spin_lock_bh(&ax25_list_lock);
  98
  99			/* The entry could have been deleted from the
 100			 * list meanwhile and thus the next pointer is
 101			 * no longer valid.  Play it safe and restart
 102			 * the scan.  Forward progress is ensured
 103			 * because we set s->ax25_dev to NULL and we
 104			 * are never passed a NULL 'dev' argument.
 105			 */
 106			goto again;
 107		}
 108	}
 109	spin_unlock_bh(&ax25_list_lock);
 110}
 111
 112/*
 113 *	Handle device status changes.
 114 */
 115static int ax25_device_event(struct notifier_block *this, unsigned long event,
 116	void *ptr)
 117{
 118	struct net_device *dev = (struct net_device *)ptr;
 119
 120	if (!net_eq(dev_net(dev), &init_net))
 121		return NOTIFY_DONE;
 122
 123	/* Reject non AX.25 devices */
 124	if (dev->type != ARPHRD_AX25)
 125		return NOTIFY_DONE;
 126
 127	switch (event) {
 128	case NETDEV_UP:
 129		ax25_dev_device_up(dev);
 130		break;
 131	case NETDEV_DOWN:
 132		ax25_kill_by_device(dev);
 133		ax25_rt_device_down(dev);
 134		ax25_dev_device_down(dev);
 135		break;
 136	default:
 137		break;
 138	}
 139
 140	return NOTIFY_DONE;
 141}
 142
 143/*
 144 *	Add a socket to the bound sockets list.
 145 */
 146void ax25_cb_add(ax25_cb *ax25)
 147{
 148	spin_lock_bh(&ax25_list_lock);
 149	ax25_cb_hold(ax25);
 150	hlist_add_head(&ax25->ax25_node, &ax25_list);
 151	spin_unlock_bh(&ax25_list_lock);
 152}
 153
 154/*
 155 *	Find a socket that wants to accept the SABM we have just
 156 *	received.
 157 */
 158struct sock *ax25_find_listener(ax25_address *addr, int digi,
 159	struct net_device *dev, int type)
 160{
 161	ax25_cb *s;
 162	struct hlist_node *node;
 163
 164	spin_lock(&ax25_list_lock);
 165	ax25_for_each(s, node, &ax25_list) {
 166		if ((s->iamdigi && !digi) || (!s->iamdigi && digi))
 167			continue;
 168		if (s->sk && !ax25cmp(&s->source_addr, addr) &&
 169		    s->sk->sk_type == type && s->sk->sk_state == TCP_LISTEN) {
 170			/* If device is null we match any device */
 171			if (s->ax25_dev == NULL || s->ax25_dev->dev == dev) {
 172				sock_hold(s->sk);
 173				spin_unlock(&ax25_list_lock);
 174				return s->sk;
 175			}
 176		}
 177	}
 178	spin_unlock(&ax25_list_lock);
 179
 180	return NULL;
 181}
 182
 183/*
 184 *	Find an AX.25 socket given both ends.
 185 */
 186struct sock *ax25_get_socket(ax25_address *my_addr, ax25_address *dest_addr,
 187	int type)
 188{
 189	struct sock *sk = NULL;
 190	ax25_cb *s;
 191	struct hlist_node *node;
 192
 193	spin_lock(&ax25_list_lock);
 194	ax25_for_each(s, node, &ax25_list) {
 195		if (s->sk && !ax25cmp(&s->source_addr, my_addr) &&
 196		    !ax25cmp(&s->dest_addr, dest_addr) &&
 197		    s->sk->sk_type == type) {
 198			sk = s->sk;
 199			sock_hold(sk);
 200			break;
 201		}
 202	}
 203
 204	spin_unlock(&ax25_list_lock);
 205
 206	return sk;
 207}
 208
 209/*
 210 *	Find an AX.25 control block given both ends. It will only pick up
 211 *	floating AX.25 control blocks or non Raw socket bound control blocks.
 212 */
 213ax25_cb *ax25_find_cb(ax25_address *src_addr, ax25_address *dest_addr,
 214	ax25_digi *digi, struct net_device *dev)
 215{
 216	ax25_cb *s;
 217	struct hlist_node *node;
 218
 219	spin_lock_bh(&ax25_list_lock);
 220	ax25_for_each(s, node, &ax25_list) {
 221		if (s->sk && s->sk->sk_type != SOCK_SEQPACKET)
 222			continue;
 223		if (s->ax25_dev == NULL)
 224			continue;
 225		if (ax25cmp(&s->source_addr, src_addr) == 0 && ax25cmp(&s->dest_addr, dest_addr) == 0 && s->ax25_dev->dev == dev) {
 226			if (digi != NULL && digi->ndigi != 0) {
 227				if (s->digipeat == NULL)
 228					continue;
 229				if (ax25digicmp(s->digipeat, digi) != 0)
 230					continue;
 231			} else {
 232				if (s->digipeat != NULL && s->digipeat->ndigi != 0)
 233					continue;
 234			}
 235			ax25_cb_hold(s);
 236			spin_unlock_bh(&ax25_list_lock);
 237
 238			return s;
 239		}
 240	}
 241	spin_unlock_bh(&ax25_list_lock);
 242
 243	return NULL;
 244}
 245
 246EXPORT_SYMBOL(ax25_find_cb);
 247
 248void ax25_send_to_raw(ax25_address *addr, struct sk_buff *skb, int proto)
 249{
 250	ax25_cb *s;
 251	struct sk_buff *copy;
 252	struct hlist_node *node;
 253
 254	spin_lock(&ax25_list_lock);
 255	ax25_for_each(s, node, &ax25_list) {
 256		if (s->sk != NULL && ax25cmp(&s->source_addr, addr) == 0 &&
 257		    s->sk->sk_type == SOCK_RAW &&
 258		    s->sk->sk_protocol == proto &&
 259		    s->ax25_dev->dev == skb->dev &&
 260		    atomic_read(&s->sk->sk_rmem_alloc) <= s->sk->sk_rcvbuf) {
 261			if ((copy = skb_clone(skb, GFP_ATOMIC)) == NULL)
 262				continue;
 263			if (sock_queue_rcv_skb(s->sk, copy) != 0)
 264				kfree_skb(copy);
 265		}
 266	}
 267	spin_unlock(&ax25_list_lock);
 268}
 269
 270/*
 271 *	Deferred destroy.
 272 */
 273void ax25_destroy_socket(ax25_cb *);
 274
 275/*
 276 *	Handler for deferred kills.
 277 */
 278static void ax25_destroy_timer(unsigned long data)
 279{
 280	ax25_cb *ax25=(ax25_cb *)data;
 281	struct sock *sk;
 282
 283	sk=ax25->sk;
 284
 285	bh_lock_sock(sk);
 286	sock_hold(sk);
 287	ax25_destroy_socket(ax25);
 288	bh_unlock_sock(sk);
 289	sock_put(sk);
 290}
 291
 292/*
 293 *	This is called from user mode and the timers. Thus it protects itself
 294 *	against interrupt users but doesn't worry about being called during
 295 *	work. Once it is removed from the queue no interrupt or bottom half
 296 *	will touch it and we are (fairly 8-) ) safe.
 297 */
 298void ax25_destroy_socket(ax25_cb *ax25)
 299{
 300	struct sk_buff *skb;
 301
 302	ax25_cb_del(ax25);
 303
 304	ax25_stop_heartbeat(ax25);
 305	ax25_stop_t1timer(ax25);
 306	ax25_stop_t2timer(ax25);
 307	ax25_stop_t3timer(ax25);
 308	ax25_stop_idletimer(ax25);
 309
 310	ax25_clear_queues(ax25);	/* Flush the queues */
 311
 312	if (ax25->sk != NULL) {
 313		while ((skb = skb_dequeue(&ax25->sk->sk_receive_queue)) != NULL) {
 314			if (skb->sk != ax25->sk) {
 315				/* A pending connection */
 316				ax25_cb *sax25 = ax25_sk(skb->sk);
 317
 318				/* Queue the unaccepted socket for death */
 319				sock_orphan(skb->sk);
 320
 321				/* 9A4GL: hack to release unaccepted sockets */
 322				skb->sk->sk_state = TCP_LISTEN;
 323
 324				ax25_start_heartbeat(sax25);
 325				sax25->state = AX25_STATE_0;
 326			}
 327
 328			kfree_skb(skb);
 329		}
 330		skb_queue_purge(&ax25->sk->sk_write_queue);
 331	}
 332
 333	if (ax25->sk != NULL) {
 334		if (sk_has_allocations(ax25->sk)) {
 335			/* Defer: outstanding buffers */
 336			setup_timer(&ax25->dtimer, ax25_destroy_timer,
 337					(unsigned long)ax25);
 338			ax25->dtimer.expires  = jiffies + 2 * HZ;
 339			add_timer(&ax25->dtimer);
 340		} else {
 341			struct sock *sk=ax25->sk;
 342			ax25->sk=NULL;
 343			sock_put(sk);
 344		}
 345	} else {
 346		ax25_cb_put(ax25);
 347	}
 348}
 349
 350/*
 351 * dl1bke 960311: set parameters for existing AX.25 connections,
 352 *		  includes a KILL command to abort any connection.
 353 *		  VERY useful for debugging ;-)
 354 */
 355static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
 356{
 357	struct ax25_ctl_struct ax25_ctl;
 358	ax25_digi digi;
 359	ax25_dev *ax25_dev;
 360	ax25_cb *ax25;
 361	unsigned int k;
 362	int ret = 0;
 363
 364	if (copy_from_user(&ax25_ctl, arg, sizeof(ax25_ctl)))
 365		return -EFAULT;
 366
 367	if ((ax25_dev = ax25_addr_ax25dev(&ax25_ctl.port_addr)) == NULL)
 368		return -ENODEV;
 369
 370	if (ax25_ctl.digi_count > AX25_MAX_DIGIS)
 371		return -EINVAL;
 372
 373	if (ax25_ctl.arg > ULONG_MAX / HZ && ax25_ctl.cmd != AX25_KILL)
 374		return -EINVAL;
 375
 376	digi.ndigi = ax25_ctl.digi_count;
 377	for (k = 0; k < digi.ndigi; k++)
 378		digi.calls[k] = ax25_ctl.digi_addr[k];
 379
 380	if ((ax25 = ax25_find_cb(&ax25_ctl.source_addr, &ax25_ctl.dest_addr, &digi, ax25_dev->dev)) == NULL)
 381		return -ENOTCONN;
 382
 383	switch (ax25_ctl.cmd) {
 384	case AX25_KILL:
 385		ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
 386#ifdef CONFIG_AX25_DAMA_SLAVE
 387		if (ax25_dev->dama.slave && ax25->ax25_dev->values[AX25_VALUES_PROTOCOL] == AX25_PROTO_DAMA_SLAVE)
 388			ax25_dama_off(ax25);
 389#endif
 390		ax25_disconnect(ax25, ENETRESET);
 391		break;
 392
 393	case AX25_WINDOW:
 394		if (ax25->modulus == AX25_MODULUS) {
 395			if (ax25_ctl.arg < 1 || ax25_ctl.arg > 7)
 396				goto einval_put;
 397		} else {
 398			if (ax25_ctl.arg < 1 || ax25_ctl.arg > 63)
 399				goto einval_put;
 400		}
 401		ax25->window = ax25_ctl.arg;
 402		break;
 403
 404	case AX25_T1:
 405		if (ax25_ctl.arg < 1)
 406			goto einval_put;
 407		ax25->rtt = (ax25_ctl.arg * HZ) / 2;
 408		ax25->t1  = ax25_ctl.arg * HZ;
 409		break;
 410
 411	case AX25_T2:
 412		if (ax25_ctl.arg < 1)
 413			goto einval_put;
 414		ax25->t2 = ax25_ctl.arg * HZ;
 415		break;
 416
 417	case AX25_N2:
 418		if (ax25_ctl.arg < 1 || ax25_ctl.arg > 31)
 419			goto einval_put;
 420		ax25->n2count = 0;
 421		ax25->n2 = ax25_ctl.arg;
 422		break;
 423
 424	case AX25_T3:
 
 
 425		ax25->t3 = ax25_ctl.arg * HZ;
 426		break;
 427
 428	case AX25_IDLE:
 
 
 
 429		ax25->idle = ax25_ctl.arg * 60 * HZ;
 430		break;
 431
 432	case AX25_PACLEN:
 433		if (ax25_ctl.arg < 16 || ax25_ctl.arg > 65535)
 434			goto einval_put;
 435		ax25->paclen = ax25_ctl.arg;
 436		break;
 437
 438	default:
 439		goto einval_put;
 440	  }
 441
 442out_put:
 443	ax25_cb_put(ax25);
 444	return ret;
 445
 446einval_put:
 447	ret = -EINVAL;
 448	goto out_put;
 449}
 450
 451static void ax25_fillin_cb_from_dev(ax25_cb *ax25, ax25_dev *ax25_dev)
 452{
 453	ax25->rtt     = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T1]) / 2;
 454	ax25->t1      = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T1]);
 455	ax25->t2      = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T2]);
 456	ax25->t3      = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T3]);
 457	ax25->n2      = ax25_dev->values[AX25_VALUES_N2];
 458	ax25->paclen  = ax25_dev->values[AX25_VALUES_PACLEN];
 459	ax25->idle    = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_IDLE]);
 460	ax25->backoff = ax25_dev->values[AX25_VALUES_BACKOFF];
 461
 462	if (ax25_dev->values[AX25_VALUES_AXDEFMODE]) {
 463		ax25->modulus = AX25_EMODULUS;
 464		ax25->window  = ax25_dev->values[AX25_VALUES_EWINDOW];
 465	} else {
 466		ax25->modulus = AX25_MODULUS;
 467		ax25->window  = ax25_dev->values[AX25_VALUES_WINDOW];
 468	}
 469}
 470
 471/*
 472 *	Fill in a created AX.25 created control block with the default
 473 *	values for a particular device.
 474 */
 475void ax25_fillin_cb(ax25_cb *ax25, ax25_dev *ax25_dev)
 476{
 477	ax25->ax25_dev = ax25_dev;
 478
 479	if (ax25->ax25_dev != NULL) {
 480		ax25_fillin_cb_from_dev(ax25, ax25_dev);
 481		return;
 482	}
 483
 484	/*
 485	 * No device, use kernel / AX.25 spec default values
 486	 */
 487	ax25->rtt     = msecs_to_jiffies(AX25_DEF_T1) / 2;
 488	ax25->t1      = msecs_to_jiffies(AX25_DEF_T1);
 489	ax25->t2      = msecs_to_jiffies(AX25_DEF_T2);
 490	ax25->t3      = msecs_to_jiffies(AX25_DEF_T3);
 491	ax25->n2      = AX25_DEF_N2;
 492	ax25->paclen  = AX25_DEF_PACLEN;
 493	ax25->idle    = msecs_to_jiffies(AX25_DEF_IDLE);
 494	ax25->backoff = AX25_DEF_BACKOFF;
 495
 496	if (AX25_DEF_AXDEFMODE) {
 497		ax25->modulus = AX25_EMODULUS;
 498		ax25->window  = AX25_DEF_EWINDOW;
 499	} else {
 500		ax25->modulus = AX25_MODULUS;
 501		ax25->window  = AX25_DEF_WINDOW;
 502	}
 503}
 504
 505/*
 506 * Create an empty AX.25 control block.
 507 */
 508ax25_cb *ax25_create_cb(void)
 509{
 510	ax25_cb *ax25;
 511
 512	if ((ax25 = kzalloc(sizeof(*ax25), GFP_ATOMIC)) == NULL)
 513		return NULL;
 514
 515	atomic_set(&ax25->refcount, 1);
 516
 517	skb_queue_head_init(&ax25->write_queue);
 518	skb_queue_head_init(&ax25->frag_queue);
 519	skb_queue_head_init(&ax25->ack_queue);
 520	skb_queue_head_init(&ax25->reseq_queue);
 521
 522	ax25_setup_timers(ax25);
 523
 524	ax25_fillin_cb(ax25, NULL);
 525
 526	ax25->state = AX25_STATE_0;
 527
 528	return ax25;
 529}
 530
 531/*
 532 *	Handling for system calls applied via the various interfaces to an
 533 *	AX25 socket object
 534 */
 535
 536static int ax25_setsockopt(struct socket *sock, int level, int optname,
 537	char __user *optval, unsigned int optlen)
 538{
 539	struct sock *sk = sock->sk;
 540	ax25_cb *ax25;
 541	struct net_device *dev;
 542	char devname[IFNAMSIZ];
 543	int opt, res = 0;
 
 544
 545	if (level != SOL_AX25)
 546		return -ENOPROTOOPT;
 547
 548	if (optlen < sizeof(int))
 549		return -EINVAL;
 550
 551	if (get_user(opt, (int __user *)optval))
 552		return -EFAULT;
 553
 554	lock_sock(sk);
 555	ax25 = ax25_sk(sk);
 556
 557	switch (optname) {
 558	case AX25_WINDOW:
 559		if (ax25->modulus == AX25_MODULUS) {
 560			if (opt < 1 || opt > 7) {
 561				res = -EINVAL;
 562				break;
 563			}
 564		} else {
 565			if (opt < 1 || opt > 63) {
 566				res = -EINVAL;
 567				break;
 568			}
 569		}
 570		ax25->window = opt;
 571		break;
 572
 573	case AX25_T1:
 574		if (opt < 1) {
 575			res = -EINVAL;
 576			break;
 577		}
 578		ax25->rtt = (opt * HZ) >> 1;
 579		ax25->t1  = opt * HZ;
 580		break;
 581
 582	case AX25_T2:
 583		if (opt < 1) {
 584			res = -EINVAL;
 585			break;
 586		}
 587		ax25->t2 = opt * HZ;
 588		break;
 589
 590	case AX25_N2:
 591		if (opt < 1 || opt > 31) {
 592			res = -EINVAL;
 593			break;
 594		}
 595		ax25->n2 = opt;
 596		break;
 597
 598	case AX25_T3:
 599		if (opt < 1) {
 600			res = -EINVAL;
 601			break;
 602		}
 603		ax25->t3 = opt * HZ;
 604		break;
 605
 606	case AX25_IDLE:
 607		if (opt < 0) {
 608			res = -EINVAL;
 609			break;
 610		}
 611		ax25->idle = opt * 60 * HZ;
 612		break;
 613
 614	case AX25_BACKOFF:
 615		if (opt < 0 || opt > 2) {
 616			res = -EINVAL;
 617			break;
 618		}
 619		ax25->backoff = opt;
 620		break;
 621
 622	case AX25_EXTSEQ:
 623		ax25->modulus = opt ? AX25_EMODULUS : AX25_MODULUS;
 624		break;
 625
 626	case AX25_PIDINCL:
 627		ax25->pidincl = opt ? 1 : 0;
 628		break;
 629
 630	case AX25_IAMDIGI:
 631		ax25->iamdigi = opt ? 1 : 0;
 632		break;
 633
 634	case AX25_PACLEN:
 635		if (opt < 16 || opt > 65535) {
 636			res = -EINVAL;
 637			break;
 638		}
 639		ax25->paclen = opt;
 640		break;
 641
 642	case SO_BINDTODEVICE:
 643		if (optlen > IFNAMSIZ)
 644			optlen = IFNAMSIZ;
 645
 646		if (copy_from_user(devname, optval, optlen)) {
 647			res = -EFAULT;
 648			break;
 649		}
 650
 651		if (sk->sk_type == SOCK_SEQPACKET &&
 652		   (sock->state != SS_UNCONNECTED ||
 653		    sk->sk_state == TCP_LISTEN)) {
 654			res = -EADDRNOTAVAIL;
 655			break;
 656		}
 657
 658		dev = dev_get_by_name(&init_net, devname);
 659		if (!dev) {
 660			res = -ENODEV;
 661			break;
 662		}
 663
 664		ax25->ax25_dev = ax25_dev_ax25dev(dev);
 665		ax25_fillin_cb(ax25, ax25->ax25_dev);
 666		dev_put(dev);
 667		break;
 668
 669	default:
 670		res = -ENOPROTOOPT;
 671	}
 672	release_sock(sk);
 673
 674	return res;
 675}
 676
 677static int ax25_getsockopt(struct socket *sock, int level, int optname,
 678	char __user *optval, int __user *optlen)
 679{
 680	struct sock *sk = sock->sk;
 681	ax25_cb *ax25;
 682	struct ax25_dev *ax25_dev;
 683	char devname[IFNAMSIZ];
 684	void *valptr;
 685	int val = 0;
 686	int maxlen, length;
 687
 688	if (level != SOL_AX25)
 689		return -ENOPROTOOPT;
 690
 691	if (get_user(maxlen, optlen))
 692		return -EFAULT;
 693
 694	if (maxlen < 1)
 695		return -EFAULT;
 696
 697	valptr = (void *) &val;
 698	length = min_t(unsigned int, maxlen, sizeof(int));
 699
 700	lock_sock(sk);
 701	ax25 = ax25_sk(sk);
 702
 703	switch (optname) {
 704	case AX25_WINDOW:
 705		val = ax25->window;
 706		break;
 707
 708	case AX25_T1:
 709		val = ax25->t1 / HZ;
 710		break;
 711
 712	case AX25_T2:
 713		val = ax25->t2 / HZ;
 714		break;
 715
 716	case AX25_N2:
 717		val = ax25->n2;
 718		break;
 719
 720	case AX25_T3:
 721		val = ax25->t3 / HZ;
 722		break;
 723
 724	case AX25_IDLE:
 725		val = ax25->idle / (60 * HZ);
 726		break;
 727
 728	case AX25_BACKOFF:
 729		val = ax25->backoff;
 730		break;
 731
 732	case AX25_EXTSEQ:
 733		val = (ax25->modulus == AX25_EMODULUS);
 734		break;
 735
 736	case AX25_PIDINCL:
 737		val = ax25->pidincl;
 738		break;
 739
 740	case AX25_IAMDIGI:
 741		val = ax25->iamdigi;
 742		break;
 743
 744	case AX25_PACLEN:
 745		val = ax25->paclen;
 746		break;
 747
 748	case SO_BINDTODEVICE:
 749		ax25_dev = ax25->ax25_dev;
 750
 751		if (ax25_dev != NULL && ax25_dev->dev != NULL) {
 752			strlcpy(devname, ax25_dev->dev->name, sizeof(devname));
 753			length = strlen(devname) + 1;
 754		} else {
 755			*devname = '\0';
 756			length = 1;
 757		}
 758
 759		valptr = (void *) devname;
 760		break;
 761
 762	default:
 763		release_sock(sk);
 764		return -ENOPROTOOPT;
 765	}
 766	release_sock(sk);
 767
 768	if (put_user(length, optlen))
 769		return -EFAULT;
 770
 771	return copy_to_user(optval, valptr, length) ? -EFAULT : 0;
 772}
 773
 774static int ax25_listen(struct socket *sock, int backlog)
 775{
 776	struct sock *sk = sock->sk;
 777	int res = 0;
 778
 779	lock_sock(sk);
 780	if (sk->sk_type == SOCK_SEQPACKET && sk->sk_state != TCP_LISTEN) {
 781		sk->sk_max_ack_backlog = backlog;
 782		sk->sk_state           = TCP_LISTEN;
 783		goto out;
 784	}
 785	res = -EOPNOTSUPP;
 786
 787out:
 788	release_sock(sk);
 789
 790	return res;
 791}
 792
 793/*
 794 * XXX: when creating ax25_sock we should update the .obj_size setting
 795 * below.
 796 */
 797static struct proto ax25_proto = {
 798	.name	  = "AX25",
 799	.owner	  = THIS_MODULE,
 800	.obj_size = sizeof(struct sock),
 801};
 802
 803static int ax25_create(struct net *net, struct socket *sock, int protocol,
 804		       int kern)
 805{
 806	struct sock *sk;
 807	ax25_cb *ax25;
 808
 809	if (!net_eq(net, &init_net))
 810		return -EAFNOSUPPORT;
 811
 812	switch (sock->type) {
 813	case SOCK_DGRAM:
 814		if (protocol == 0 || protocol == PF_AX25)
 815			protocol = AX25_P_TEXT;
 816		break;
 817
 818	case SOCK_SEQPACKET:
 819		switch (protocol) {
 820		case 0:
 821		case PF_AX25:	/* For CLX */
 822			protocol = AX25_P_TEXT;
 823			break;
 824		case AX25_P_SEGMENT:
 825#ifdef CONFIG_INET
 826		case AX25_P_ARP:
 827		case AX25_P_IP:
 828#endif
 829#ifdef CONFIG_NETROM
 830		case AX25_P_NETROM:
 831#endif
 832#ifdef CONFIG_ROSE
 833		case AX25_P_ROSE:
 834#endif
 835			return -ESOCKTNOSUPPORT;
 836#ifdef CONFIG_NETROM_MODULE
 837		case AX25_P_NETROM:
 838			if (ax25_protocol_is_registered(AX25_P_NETROM))
 839				return -ESOCKTNOSUPPORT;
 
 840#endif
 841#ifdef CONFIG_ROSE_MODULE
 842		case AX25_P_ROSE:
 843			if (ax25_protocol_is_registered(AX25_P_ROSE))
 844				return -ESOCKTNOSUPPORT;
 845#endif
 846		default:
 847			break;
 848		}
 849		break;
 850
 851	case SOCK_RAW:
 852		break;
 853	default:
 854		return -ESOCKTNOSUPPORT;
 855	}
 856
 857	sk = sk_alloc(net, PF_AX25, GFP_ATOMIC, &ax25_proto);
 858	if (sk == NULL)
 859		return -ENOMEM;
 860
 861	ax25 = sk->sk_protinfo = ax25_create_cb();
 862	if (!ax25) {
 863		sk_free(sk);
 864		return -ENOMEM;
 865	}
 866
 867	sock_init_data(sock, sk);
 868
 869	sk->sk_destruct = ax25_free_sock;
 870	sock->ops    = &ax25_proto_ops;
 871	sk->sk_protocol = protocol;
 872
 873	ax25->sk    = sk;
 874
 875	return 0;
 876}
 877
 878struct sock *ax25_make_new(struct sock *osk, struct ax25_dev *ax25_dev)
 879{
 880	struct sock *sk;
 881	ax25_cb *ax25, *oax25;
 882
 883	sk = sk_alloc(sock_net(osk), PF_AX25, GFP_ATOMIC,	osk->sk_prot);
 884	if (sk == NULL)
 885		return NULL;
 886
 887	if ((ax25 = ax25_create_cb()) == NULL) {
 888		sk_free(sk);
 889		return NULL;
 890	}
 891
 892	switch (osk->sk_type) {
 893	case SOCK_DGRAM:
 894		break;
 895	case SOCK_SEQPACKET:
 896		break;
 897	default:
 898		sk_free(sk);
 899		ax25_cb_put(ax25);
 900		return NULL;
 901	}
 902
 903	sock_init_data(NULL, sk);
 904
 905	sk->sk_type     = osk->sk_type;
 906	sk->sk_priority = osk->sk_priority;
 907	sk->sk_protocol = osk->sk_protocol;
 908	sk->sk_rcvbuf   = osk->sk_rcvbuf;
 909	sk->sk_sndbuf   = osk->sk_sndbuf;
 910	sk->sk_state    = TCP_ESTABLISHED;
 911	sock_copy_flags(sk, osk);
 912
 913	oax25 = ax25_sk(osk);
 914
 915	ax25->modulus = oax25->modulus;
 916	ax25->backoff = oax25->backoff;
 917	ax25->pidincl = oax25->pidincl;
 918	ax25->iamdigi = oax25->iamdigi;
 919	ax25->rtt     = oax25->rtt;
 920	ax25->t1      = oax25->t1;
 921	ax25->t2      = oax25->t2;
 922	ax25->t3      = oax25->t3;
 923	ax25->n2      = oax25->n2;
 924	ax25->idle    = oax25->idle;
 925	ax25->paclen  = oax25->paclen;
 926	ax25->window  = oax25->window;
 927
 928	ax25->ax25_dev    = ax25_dev;
 929	ax25->source_addr = oax25->source_addr;
 930
 931	if (oax25->digipeat != NULL) {
 932		ax25->digipeat = kmemdup(oax25->digipeat, sizeof(ax25_digi),
 933					 GFP_ATOMIC);
 934		if (ax25->digipeat == NULL) {
 935			sk_free(sk);
 936			ax25_cb_put(ax25);
 937			return NULL;
 938		}
 939	}
 940
 941	sk->sk_protinfo = ax25;
 942	sk->sk_destruct = ax25_free_sock;
 943	ax25->sk    = sk;
 944
 945	return sk;
 946}
 947
 948static int ax25_release(struct socket *sock)
 949{
 950	struct sock *sk = sock->sk;
 951	ax25_cb *ax25;
 952
 953	if (sk == NULL)
 954		return 0;
 955
 956	sock_hold(sk);
 957	sock_orphan(sk);
 958	lock_sock(sk);
 959	ax25 = ax25_sk(sk);
 960
 961	if (sk->sk_type == SOCK_SEQPACKET) {
 962		switch (ax25->state) {
 963		case AX25_STATE_0:
 964			release_sock(sk);
 965			ax25_disconnect(ax25, 0);
 966			lock_sock(sk);
 967			ax25_destroy_socket(ax25);
 968			break;
 969
 970		case AX25_STATE_1:
 971		case AX25_STATE_2:
 972			ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
 973			release_sock(sk);
 974			ax25_disconnect(ax25, 0);
 975			lock_sock(sk);
 976			ax25_destroy_socket(ax25);
 977			break;
 978
 979		case AX25_STATE_3:
 980		case AX25_STATE_4:
 981			ax25_clear_queues(ax25);
 982			ax25->n2count = 0;
 983
 984			switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
 985			case AX25_PROTO_STD_SIMPLEX:
 986			case AX25_PROTO_STD_DUPLEX:
 987				ax25_send_control(ax25,
 988						  AX25_DISC,
 989						  AX25_POLLON,
 990						  AX25_COMMAND);
 991				ax25_stop_t2timer(ax25);
 992				ax25_stop_t3timer(ax25);
 993				ax25_stop_idletimer(ax25);
 994				break;
 995#ifdef CONFIG_AX25_DAMA_SLAVE
 996			case AX25_PROTO_DAMA_SLAVE:
 997				ax25_stop_t3timer(ax25);
 998				ax25_stop_idletimer(ax25);
 999				break;
1000#endif
1001			}
1002			ax25_calculate_t1(ax25);
1003			ax25_start_t1timer(ax25);
1004			ax25->state = AX25_STATE_2;
1005			sk->sk_state                = TCP_CLOSE;
1006			sk->sk_shutdown            |= SEND_SHUTDOWN;
1007			sk->sk_state_change(sk);
1008			sock_set_flag(sk, SOCK_DESTROY);
1009			break;
1010
1011		default:
1012			break;
1013		}
1014	} else {
1015		sk->sk_state     = TCP_CLOSE;
1016		sk->sk_shutdown |= SEND_SHUTDOWN;
1017		sk->sk_state_change(sk);
1018		ax25_destroy_socket(ax25);
1019	}
1020
1021	sock->sk   = NULL;
1022	release_sock(sk);
1023	sock_put(sk);
1024
1025	return 0;
1026}
1027
1028/*
1029 *	We support a funny extension here so you can (as root) give any callsign
1030 *	digipeated via a local address as source. This hack is obsolete now
1031 *	that we've implemented support for SO_BINDTODEVICE. It is however small
1032 *	and trivially backward compatible.
1033 */
1034static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
1035{
1036	struct sock *sk = sock->sk;
1037	struct full_sockaddr_ax25 *addr = (struct full_sockaddr_ax25 *)uaddr;
1038	ax25_dev *ax25_dev = NULL;
1039	ax25_uid_assoc *user;
1040	ax25_address call;
1041	ax25_cb *ax25;
1042	int err = 0;
1043
1044	if (addr_len != sizeof(struct sockaddr_ax25) &&
1045	    addr_len != sizeof(struct full_sockaddr_ax25))
1046		/* support for old structure may go away some time
1047		 * ax25_bind(): uses old (6 digipeater) socket structure.
1048		 */
1049		if ((addr_len < sizeof(struct sockaddr_ax25) + sizeof(ax25_address) * 6) ||
1050		    (addr_len > sizeof(struct full_sockaddr_ax25)))
1051			return -EINVAL;
1052
1053	if (addr->fsa_ax25.sax25_family != AF_AX25)
1054		return -EINVAL;
1055
1056	user = ax25_findbyuid(current_euid());
1057	if (user) {
1058		call = user->call;
1059		ax25_uid_put(user);
1060	} else {
1061		if (ax25_uid_policy && !capable(CAP_NET_ADMIN))
1062			return -EACCES;
1063
1064		call = addr->fsa_ax25.sax25_call;
1065	}
1066
1067	lock_sock(sk);
1068
1069	ax25 = ax25_sk(sk);
1070	if (!sock_flag(sk, SOCK_ZAPPED)) {
1071		err = -EINVAL;
1072		goto out;
1073	}
1074
1075	ax25->source_addr = call;
1076
1077	/*
1078	 * User already set interface with SO_BINDTODEVICE
1079	 */
1080	if (ax25->ax25_dev != NULL)
1081		goto done;
1082
1083	if (addr_len > sizeof(struct sockaddr_ax25) && addr->fsa_ax25.sax25_ndigis == 1) {
1084		if (ax25cmp(&addr->fsa_digipeater[0], &null_ax25_address) != 0 &&
1085		    (ax25_dev = ax25_addr_ax25dev(&addr->fsa_digipeater[0])) == NULL) {
1086			err = -EADDRNOTAVAIL;
1087			goto out;
1088		}
1089	} else {
1090		if ((ax25_dev = ax25_addr_ax25dev(&addr->fsa_ax25.sax25_call)) == NULL) {
1091			err = -EADDRNOTAVAIL;
1092			goto out;
1093		}
1094	}
1095
1096	if (ax25_dev != NULL)
1097		ax25_fillin_cb(ax25, ax25_dev);
1098
1099done:
1100	ax25_cb_add(ax25);
1101	sock_reset_flag(sk, SOCK_ZAPPED);
1102
1103out:
1104	release_sock(sk);
1105
1106	return err;
1107}
1108
1109/*
1110 *	FIXME: nonblock behaviour looks like it may have a bug.
1111 */
1112static int __must_check ax25_connect(struct socket *sock,
1113	struct sockaddr *uaddr, int addr_len, int flags)
1114{
1115	struct sock *sk = sock->sk;
1116	ax25_cb *ax25 = ax25_sk(sk), *ax25t;
1117	struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)uaddr;
1118	ax25_digi *digi = NULL;
1119	int ct = 0, err = 0;
1120
1121	/*
1122	 * some sanity checks. code further down depends on this
1123	 */
1124
1125	if (addr_len == sizeof(struct sockaddr_ax25))
1126		/* support for this will go away in early 2.5.x
1127		 * ax25_connect(): uses obsolete socket structure
1128		 */
1129		;
1130	else if (addr_len != sizeof(struct full_sockaddr_ax25))
1131		/* support for old structure may go away some time
1132		 * ax25_connect(): uses old (6 digipeater) socket structure.
1133		 */
1134		if ((addr_len < sizeof(struct sockaddr_ax25) + sizeof(ax25_address) * 6) ||
1135		    (addr_len > sizeof(struct full_sockaddr_ax25)))
1136			return -EINVAL;
1137
1138
1139	if (fsa->fsa_ax25.sax25_family != AF_AX25)
1140		return -EINVAL;
1141
1142	lock_sock(sk);
1143
1144	/* deal with restarts */
1145	if (sock->state == SS_CONNECTING) {
1146		switch (sk->sk_state) {
1147		case TCP_SYN_SENT: /* still trying */
1148			err = -EINPROGRESS;
1149			goto out_release;
1150
1151		case TCP_ESTABLISHED: /* connection established */
1152			sock->state = SS_CONNECTED;
1153			goto out_release;
1154
1155		case TCP_CLOSE: /* connection refused */
1156			sock->state = SS_UNCONNECTED;
1157			err = -ECONNREFUSED;
1158			goto out_release;
1159		}
1160	}
1161
1162	if (sk->sk_state == TCP_ESTABLISHED && sk->sk_type == SOCK_SEQPACKET) {
1163		err = -EISCONN;	/* No reconnect on a seqpacket socket */
1164		goto out_release;
1165	}
1166
1167	sk->sk_state   = TCP_CLOSE;
1168	sock->state = SS_UNCONNECTED;
1169
1170	kfree(ax25->digipeat);
1171	ax25->digipeat = NULL;
1172
1173	/*
1174	 *	Handle digi-peaters to be used.
1175	 */
1176	if (addr_len > sizeof(struct sockaddr_ax25) &&
1177	    fsa->fsa_ax25.sax25_ndigis != 0) {
1178		/* Valid number of digipeaters ? */
1179		if (fsa->fsa_ax25.sax25_ndigis < 1 || fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS) {
1180			err = -EINVAL;
1181			goto out_release;
1182		}
1183
1184		if ((digi = kmalloc(sizeof(ax25_digi), GFP_KERNEL)) == NULL) {
1185			err = -ENOBUFS;
1186			goto out_release;
1187		}
1188
1189		digi->ndigi      = fsa->fsa_ax25.sax25_ndigis;
1190		digi->lastrepeat = -1;
1191
1192		while (ct < fsa->fsa_ax25.sax25_ndigis) {
1193			if ((fsa->fsa_digipeater[ct].ax25_call[6] &
1194			     AX25_HBIT) && ax25->iamdigi) {
1195				digi->repeated[ct] = 1;
1196				digi->lastrepeat   = ct;
1197			} else {
1198				digi->repeated[ct] = 0;
1199			}
1200			digi->calls[ct] = fsa->fsa_digipeater[ct];
1201			ct++;
1202		}
1203	}
1204
1205	/*
1206	 *	Must bind first - autobinding in this may or may not work. If
1207	 *	the socket is already bound, check to see if the device has
1208	 *	been filled in, error if it hasn't.
1209	 */
1210	if (sock_flag(sk, SOCK_ZAPPED)) {
1211		/* check if we can remove this feature. It is broken. */
1212		printk(KERN_WARNING "ax25_connect(): %s uses autobind, please contact jreuter@yaina.de\n",
1213			current->comm);
1214		if ((err = ax25_rt_autobind(ax25, &fsa->fsa_ax25.sax25_call)) < 0) {
1215			kfree(digi);
1216			goto out_release;
1217		}
1218
1219		ax25_fillin_cb(ax25, ax25->ax25_dev);
1220		ax25_cb_add(ax25);
1221	} else {
1222		if (ax25->ax25_dev == NULL) {
1223			kfree(digi);
1224			err = -EHOSTUNREACH;
1225			goto out_release;
1226		}
1227	}
1228
1229	if (sk->sk_type == SOCK_SEQPACKET &&
1230	    (ax25t=ax25_find_cb(&ax25->source_addr, &fsa->fsa_ax25.sax25_call, digi,
1231			 ax25->ax25_dev->dev))) {
1232		kfree(digi);
1233		err = -EADDRINUSE;		/* Already such a connection */
1234		ax25_cb_put(ax25t);
1235		goto out_release;
1236	}
1237
1238	ax25->dest_addr = fsa->fsa_ax25.sax25_call;
1239	ax25->digipeat  = digi;
1240
1241	/* First the easy one */
1242	if (sk->sk_type != SOCK_SEQPACKET) {
1243		sock->state = SS_CONNECTED;
1244		sk->sk_state   = TCP_ESTABLISHED;
1245		goto out_release;
1246	}
1247
1248	/* Move to connecting socket, ax.25 lapb WAIT_UA.. */
1249	sock->state        = SS_CONNECTING;
1250	sk->sk_state          = TCP_SYN_SENT;
1251
1252	switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
1253	case AX25_PROTO_STD_SIMPLEX:
1254	case AX25_PROTO_STD_DUPLEX:
1255		ax25_std_establish_data_link(ax25);
1256		break;
1257
1258#ifdef CONFIG_AX25_DAMA_SLAVE
1259	case AX25_PROTO_DAMA_SLAVE:
1260		ax25->modulus = AX25_MODULUS;
1261		ax25->window  = ax25->ax25_dev->values[AX25_VALUES_WINDOW];
1262		if (ax25->ax25_dev->dama.slave)
1263			ax25_ds_establish_data_link(ax25);
1264		else
1265			ax25_std_establish_data_link(ax25);
1266		break;
1267#endif
1268	}
1269
1270	ax25->state = AX25_STATE_1;
1271
1272	ax25_start_heartbeat(ax25);
1273
1274	/* Now the loop */
1275	if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK)) {
1276		err = -EINPROGRESS;
1277		goto out_release;
1278	}
1279
1280	if (sk->sk_state == TCP_SYN_SENT) {
1281		DEFINE_WAIT(wait);
1282
1283		for (;;) {
1284			prepare_to_wait(sk_sleep(sk), &wait,
1285					TASK_INTERRUPTIBLE);
1286			if (sk->sk_state != TCP_SYN_SENT)
1287				break;
1288			if (!signal_pending(current)) {
1289				release_sock(sk);
1290				schedule();
1291				lock_sock(sk);
1292				continue;
1293			}
1294			err = -ERESTARTSYS;
1295			break;
1296		}
1297		finish_wait(sk_sleep(sk), &wait);
1298
1299		if (err)
1300			goto out_release;
1301	}
1302
1303	if (sk->sk_state != TCP_ESTABLISHED) {
1304		/* Not in ABM, not in WAIT_UA -> failed */
1305		sock->state = SS_UNCONNECTED;
1306		err = sock_error(sk);	/* Always set at this point */
1307		goto out_release;
1308	}
1309
1310	sock->state = SS_CONNECTED;
1311
1312	err = 0;
1313out_release:
1314	release_sock(sk);
1315
1316	return err;
1317}
1318
1319static int ax25_accept(struct socket *sock, struct socket *newsock, int flags)
1320{
1321	struct sk_buff *skb;
1322	struct sock *newsk;
1323	DEFINE_WAIT(wait);
1324	struct sock *sk;
1325	int err = 0;
1326
1327	if (sock->state != SS_UNCONNECTED)
1328		return -EINVAL;
1329
1330	if ((sk = sock->sk) == NULL)
1331		return -EINVAL;
1332
1333	lock_sock(sk);
1334	if (sk->sk_type != SOCK_SEQPACKET) {
1335		err = -EOPNOTSUPP;
1336		goto out;
1337	}
1338
1339	if (sk->sk_state != TCP_LISTEN) {
1340		err = -EINVAL;
1341		goto out;
1342	}
1343
1344	/*
1345	 *	The read queue this time is holding sockets ready to use
1346	 *	hooked into the SABM we saved
1347	 */
1348	for (;;) {
1349		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
1350		skb = skb_dequeue(&sk->sk_receive_queue);
1351		if (skb)
1352			break;
1353
1354		if (flags & O_NONBLOCK) {
1355			err = -EWOULDBLOCK;
1356			break;
1357		}
1358		if (!signal_pending(current)) {
1359			release_sock(sk);
1360			schedule();
1361			lock_sock(sk);
1362			continue;
1363		}
1364		err = -ERESTARTSYS;
1365		break;
1366	}
1367	finish_wait(sk_sleep(sk), &wait);
1368
1369	if (err)
1370		goto out;
1371
1372	newsk		 = skb->sk;
1373	sock_graft(newsk, newsock);
1374
1375	/* Now attach up the new socket */
1376	kfree_skb(skb);
1377	sk->sk_ack_backlog--;
1378	newsock->state = SS_CONNECTED;
1379
1380out:
1381	release_sock(sk);
1382
1383	return err;
1384}
1385
1386static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
1387	int *uaddr_len, int peer)
1388{
1389	struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)uaddr;
1390	struct sock *sk = sock->sk;
1391	unsigned char ndigi, i;
1392	ax25_cb *ax25;
1393	int err = 0;
1394
1395	memset(fsa, 0, sizeof(*fsa));
1396	lock_sock(sk);
1397	ax25 = ax25_sk(sk);
1398
1399	if (peer != 0) {
1400		if (sk->sk_state != TCP_ESTABLISHED) {
1401			err = -ENOTCONN;
1402			goto out;
1403		}
1404
1405		fsa->fsa_ax25.sax25_family = AF_AX25;
1406		fsa->fsa_ax25.sax25_call   = ax25->dest_addr;
1407
1408		if (ax25->digipeat != NULL) {
1409			ndigi = ax25->digipeat->ndigi;
1410			fsa->fsa_ax25.sax25_ndigis = ndigi;
1411			for (i = 0; i < ndigi; i++)
1412				fsa->fsa_digipeater[i] =
1413						ax25->digipeat->calls[i];
1414		}
1415	} else {
1416		fsa->fsa_ax25.sax25_family = AF_AX25;
1417		fsa->fsa_ax25.sax25_call   = ax25->source_addr;
1418		fsa->fsa_ax25.sax25_ndigis = 1;
1419		if (ax25->ax25_dev != NULL) {
1420			memcpy(&fsa->fsa_digipeater[0],
1421			       ax25->ax25_dev->dev->dev_addr, AX25_ADDR_LEN);
1422		} else {
1423			fsa->fsa_digipeater[0] = null_ax25_address;
1424		}
1425	}
1426	*uaddr_len = sizeof (struct full_sockaddr_ax25);
1427
1428out:
1429	release_sock(sk);
1430
1431	return err;
1432}
1433
1434static int ax25_sendmsg(struct kiocb *iocb, struct socket *sock,
1435			struct msghdr *msg, size_t len)
1436{
1437	struct sockaddr_ax25 *usax = (struct sockaddr_ax25 *)msg->msg_name;
1438	struct sock *sk = sock->sk;
1439	struct sockaddr_ax25 sax;
1440	struct sk_buff *skb;
1441	ax25_digi dtmp, *dp;
1442	ax25_cb *ax25;
1443	size_t size;
1444	int lv, err, addr_len = msg->msg_namelen;
1445
1446	if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_CMSG_COMPAT))
1447		return -EINVAL;
1448
1449	lock_sock(sk);
1450	ax25 = ax25_sk(sk);
1451
1452	if (sock_flag(sk, SOCK_ZAPPED)) {
1453		err = -EADDRNOTAVAIL;
1454		goto out;
1455	}
1456
1457	if (sk->sk_shutdown & SEND_SHUTDOWN) {
1458		send_sig(SIGPIPE, current, 0);
1459		err = -EPIPE;
1460		goto out;
1461	}
1462
1463	if (ax25->ax25_dev == NULL) {
1464		err = -ENETUNREACH;
1465		goto out;
1466	}
1467
1468	if (len > ax25->ax25_dev->dev->mtu) {
1469		err = -EMSGSIZE;
1470		goto out;
1471	}
1472
1473	if (usax != NULL) {
1474		if (usax->sax25_family != AF_AX25) {
1475			err = -EINVAL;
1476			goto out;
1477		}
1478
1479		if (addr_len == sizeof(struct sockaddr_ax25))
1480			/* ax25_sendmsg(): uses obsolete socket structure */
1481			;
1482		else if (addr_len != sizeof(struct full_sockaddr_ax25))
1483			/* support for old structure may go away some time
1484			 * ax25_sendmsg(): uses old (6 digipeater)
1485			 * socket structure.
1486			 */
1487			if ((addr_len < sizeof(struct sockaddr_ax25) + sizeof(ax25_address) * 6) ||
1488			    (addr_len > sizeof(struct full_sockaddr_ax25))) {
1489				err = -EINVAL;
1490				goto out;
1491			}
1492
1493
1494		if (addr_len > sizeof(struct sockaddr_ax25) && usax->sax25_ndigis != 0) {
1495			int ct           = 0;
1496			struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax;
1497
1498			/* Valid number of digipeaters ? */
1499			if (usax->sax25_ndigis < 1 || usax->sax25_ndigis > AX25_MAX_DIGIS) {
1500				err = -EINVAL;
1501				goto out;
1502			}
1503
1504			dtmp.ndigi      = usax->sax25_ndigis;
1505
1506			while (ct < usax->sax25_ndigis) {
1507				dtmp.repeated[ct] = 0;
1508				dtmp.calls[ct]    = fsa->fsa_digipeater[ct];
1509				ct++;
1510			}
1511
1512			dtmp.lastrepeat = 0;
1513		}
1514
1515		sax = *usax;
1516		if (sk->sk_type == SOCK_SEQPACKET &&
1517		    ax25cmp(&ax25->dest_addr, &sax.sax25_call)) {
1518			err = -EISCONN;
1519			goto out;
1520		}
1521		if (usax->sax25_ndigis == 0)
1522			dp = NULL;
1523		else
1524			dp = &dtmp;
1525	} else {
1526		/*
1527		 *	FIXME: 1003.1g - if the socket is like this because
1528		 *	it has become closed (not started closed) and is VC
1529		 *	we ought to SIGPIPE, EPIPE
1530		 */
1531		if (sk->sk_state != TCP_ESTABLISHED) {
1532			err = -ENOTCONN;
1533			goto out;
1534		}
1535		sax.sax25_family = AF_AX25;
1536		sax.sax25_call   = ax25->dest_addr;
1537		dp = ax25->digipeat;
1538	}
1539
1540	/* Build a packet */
1541	/* Assume the worst case */
1542	size = len + ax25->ax25_dev->dev->hard_header_len;
1543
1544	skb = sock_alloc_send_skb(sk, size, msg->msg_flags&MSG_DONTWAIT, &err);
1545	if (skb == NULL)
1546		goto out;
1547
1548	skb_reserve(skb, size - len);
1549
1550	/* User data follows immediately after the AX.25 data */
1551	if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
1552		err = -EFAULT;
1553		kfree_skb(skb);
1554		goto out;
1555	}
1556
1557	skb_reset_network_header(skb);
1558
1559	/* Add the PID if one is not supplied by the user in the skb */
1560	if (!ax25->pidincl)
1561		*skb_push(skb, 1) = sk->sk_protocol;
1562
1563	if (sk->sk_type == SOCK_SEQPACKET) {
1564		/* Connected mode sockets go via the LAPB machine */
1565		if (sk->sk_state != TCP_ESTABLISHED) {
1566			kfree_skb(skb);
1567			err = -ENOTCONN;
1568			goto out;
1569		}
1570
1571		/* Shove it onto the queue and kick */
1572		ax25_output(ax25, ax25->paclen, skb);
1573
1574		err = len;
1575		goto out;
1576	}
1577
1578	skb_push(skb, 1 + ax25_addr_size(dp));
1579
1580	/* Building AX.25 Header */
1581
1582	/* Build an AX.25 header */
1583	lv = ax25_addr_build(skb->data, &ax25->source_addr, &sax.sax25_call,
1584			     dp, AX25_COMMAND, AX25_MODULUS);
1585
1586	skb_set_transport_header(skb, lv);
1587
1588	*skb_transport_header(skb) = AX25_UI;
1589
1590	/* Datagram frames go straight out of the door as UI */
1591	ax25_queue_xmit(skb, ax25->ax25_dev->dev);
1592
1593	err = len;
1594
1595out:
1596	release_sock(sk);
1597
1598	return err;
1599}
1600
1601static int ax25_recvmsg(struct kiocb *iocb, struct socket *sock,
1602	struct msghdr *msg, size_t size, int flags)
1603{
1604	struct sock *sk = sock->sk;
1605	struct sk_buff *skb;
1606	int copied;
1607	int err = 0;
1608
1609	lock_sock(sk);
1610	/*
1611	 * 	This works for seqpacket too. The receiver has ordered the
1612	 *	queue for us! We do one quick check first though
1613	 */
1614	if (sk->sk_type == SOCK_SEQPACKET && sk->sk_state != TCP_ESTABLISHED) {
1615		err =  -ENOTCONN;
1616		goto out;
1617	}
1618
1619	/* Now we can treat all alike */
1620	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
1621				flags & MSG_DONTWAIT, &err);
1622	if (skb == NULL)
1623		goto out;
1624
1625	if (!ax25_sk(sk)->pidincl)
1626		skb_pull(skb, 1);		/* Remove PID */
1627
1628	skb_reset_transport_header(skb);
1629	copied = skb->len;
1630
1631	if (copied > size) {
1632		copied = size;
1633		msg->msg_flags |= MSG_TRUNC;
1634	}
1635
1636	skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1637
1638	if (msg->msg_namelen != 0) {
1639		struct sockaddr_ax25 *sax = (struct sockaddr_ax25 *)msg->msg_name;
1640		ax25_digi digi;
1641		ax25_address src;
1642		const unsigned char *mac = skb_mac_header(skb);
 
1643
 
1644		ax25_addr_parse(mac + 1, skb->data - mac - 1, &src, NULL,
1645				&digi, NULL, NULL);
1646		sax->sax25_family = AF_AX25;
1647		/* We set this correctly, even though we may not let the
1648		   application know the digi calls further down (because it
1649		   did NOT ask to know them).  This could get political... **/
1650		sax->sax25_ndigis = digi.ndigi;
1651		sax->sax25_call   = src;
1652
1653		if (sax->sax25_ndigis != 0) {
1654			int ct;
1655			struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)sax;
1656
1657			for (ct = 0; ct < digi.ndigi; ct++)
1658				fsa->fsa_digipeater[ct] = digi.calls[ct];
1659		}
1660		msg->msg_namelen = sizeof(struct full_sockaddr_ax25);
1661	}
1662
1663	skb_free_datagram(sk, skb);
1664	err = copied;
1665
1666out:
1667	release_sock(sk);
1668
1669	return err;
1670}
1671
1672static int ax25_shutdown(struct socket *sk, int how)
1673{
1674	/* FIXME - generate DM and RNR states */
1675	return -EOPNOTSUPP;
1676}
1677
1678static int ax25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
1679{
1680	struct sock *sk = sock->sk;
1681	void __user *argp = (void __user *)arg;
1682	int res = 0;
1683
1684	lock_sock(sk);
1685	switch (cmd) {
1686	case TIOCOUTQ: {
1687		long amount;
1688
1689		amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
1690		if (amount < 0)
1691			amount = 0;
1692		res = put_user(amount, (int __user *)argp);
1693		break;
1694	}
1695
1696	case TIOCINQ: {
1697		struct sk_buff *skb;
1698		long amount = 0L;
1699		/* These two are safe on a single CPU system as only user tasks fiddle here */
1700		if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL)
1701			amount = skb->len;
1702		res = put_user(amount, (int __user *) argp);
1703		break;
1704	}
1705
1706	case SIOCGSTAMP:
1707		res = sock_get_timestamp(sk, argp);
1708		break;
1709
1710	case SIOCGSTAMPNS:
1711		res = sock_get_timestampns(sk, argp);
1712		break;
1713
1714	case SIOCAX25ADDUID:	/* Add a uid to the uid/call map table */
1715	case SIOCAX25DELUID:	/* Delete a uid from the uid/call map table */
1716	case SIOCAX25GETUID: {
1717		struct sockaddr_ax25 sax25;
1718		if (copy_from_user(&sax25, argp, sizeof(sax25))) {
1719			res = -EFAULT;
1720			break;
1721		}
1722		res = ax25_uid_ioctl(cmd, &sax25);
1723		break;
1724	}
1725
1726	case SIOCAX25NOUID: {	/* Set the default policy (default/bar) */
1727		long amount;
1728		if (!capable(CAP_NET_ADMIN)) {
1729			res = -EPERM;
1730			break;
1731		}
1732		if (get_user(amount, (long __user *)argp)) {
1733			res = -EFAULT;
1734			break;
1735		}
1736		if (amount > AX25_NOUID_BLOCK) {
1737			res = -EINVAL;
1738			break;
1739		}
1740		ax25_uid_policy = amount;
1741		res = 0;
1742		break;
1743	}
1744
1745	case SIOCADDRT:
1746	case SIOCDELRT:
1747	case SIOCAX25OPTRT:
1748		if (!capable(CAP_NET_ADMIN)) {
1749			res = -EPERM;
1750			break;
1751		}
1752		res = ax25_rt_ioctl(cmd, argp);
1753		break;
1754
1755	case SIOCAX25CTLCON:
1756		if (!capable(CAP_NET_ADMIN)) {
1757			res = -EPERM;
1758			break;
1759		}
1760		res = ax25_ctl_ioctl(cmd, argp);
1761		break;
1762
1763	case SIOCAX25GETINFO:
1764	case SIOCAX25GETINFOOLD: {
1765		ax25_cb *ax25 = ax25_sk(sk);
1766		struct ax25_info_struct ax25_info;
1767
1768		ax25_info.t1        = ax25->t1   / HZ;
1769		ax25_info.t2        = ax25->t2   / HZ;
1770		ax25_info.t3        = ax25->t3   / HZ;
1771		ax25_info.idle      = ax25->idle / (60 * HZ);
1772		ax25_info.n2        = ax25->n2;
1773		ax25_info.t1timer   = ax25_display_timer(&ax25->t1timer)   / HZ;
1774		ax25_info.t2timer   = ax25_display_timer(&ax25->t2timer)   / HZ;
1775		ax25_info.t3timer   = ax25_display_timer(&ax25->t3timer)   / HZ;
1776		ax25_info.idletimer = ax25_display_timer(&ax25->idletimer) / (60 * HZ);
1777		ax25_info.n2count   = ax25->n2count;
1778		ax25_info.state     = ax25->state;
1779		ax25_info.rcv_q     = sk_rmem_alloc_get(sk);
1780		ax25_info.snd_q     = sk_wmem_alloc_get(sk);
1781		ax25_info.vs        = ax25->vs;
1782		ax25_info.vr        = ax25->vr;
1783		ax25_info.va        = ax25->va;
1784		ax25_info.vs_max    = ax25->vs; /* reserved */
1785		ax25_info.paclen    = ax25->paclen;
1786		ax25_info.window    = ax25->window;
1787
1788		/* old structure? */
1789		if (cmd == SIOCAX25GETINFOOLD) {
1790			static int warned = 0;
1791			if (!warned) {
1792				printk(KERN_INFO "%s uses old SIOCAX25GETINFO\n",
1793					current->comm);
1794				warned=1;
1795			}
1796
1797			if (copy_to_user(argp, &ax25_info, sizeof(struct ax25_info_struct_deprecated))) {
1798				res = -EFAULT;
1799				break;
1800			}
1801		} else {
1802			if (copy_to_user(argp, &ax25_info, sizeof(struct ax25_info_struct))) {
1803				res = -EINVAL;
1804				break;
1805			}
1806		}
1807		res = 0;
1808		break;
1809	}
1810
1811	case SIOCAX25ADDFWD:
1812	case SIOCAX25DELFWD: {
1813		struct ax25_fwd_struct ax25_fwd;
1814		if (!capable(CAP_NET_ADMIN)) {
1815			res = -EPERM;
1816			break;
1817		}
1818		if (copy_from_user(&ax25_fwd, argp, sizeof(ax25_fwd))) {
1819			res = -EFAULT;
1820			break;
1821		}
1822		res = ax25_fwd_ioctl(cmd, &ax25_fwd);
1823		break;
1824	}
1825
1826	case SIOCGIFADDR:
1827	case SIOCSIFADDR:
1828	case SIOCGIFDSTADDR:
1829	case SIOCSIFDSTADDR:
1830	case SIOCGIFBRDADDR:
1831	case SIOCSIFBRDADDR:
1832	case SIOCGIFNETMASK:
1833	case SIOCSIFNETMASK:
1834	case SIOCGIFMETRIC:
1835	case SIOCSIFMETRIC:
1836		res = -EINVAL;
1837		break;
1838
1839	default:
1840		res = -ENOIOCTLCMD;
1841		break;
1842	}
1843	release_sock(sk);
1844
1845	return res;
1846}
1847
1848#ifdef CONFIG_PROC_FS
1849
1850static void *ax25_info_start(struct seq_file *seq, loff_t *pos)
1851	__acquires(ax25_list_lock)
1852{
1853	spin_lock_bh(&ax25_list_lock);
1854	return seq_hlist_start(&ax25_list, *pos);
1855}
1856
1857static void *ax25_info_next(struct seq_file *seq, void *v, loff_t *pos)
1858{
1859	return seq_hlist_next(v, &ax25_list, pos);
1860}
1861
1862static void ax25_info_stop(struct seq_file *seq, void *v)
1863	__releases(ax25_list_lock)
1864{
1865	spin_unlock_bh(&ax25_list_lock);
1866}
1867
1868static int ax25_info_show(struct seq_file *seq, void *v)
1869{
1870	ax25_cb *ax25 = hlist_entry(v, struct ax25_cb, ax25_node);
1871	char buf[11];
1872	int k;
1873
1874
1875	/*
1876	 * New format:
1877	 * magic dev src_addr dest_addr,digi1,digi2,.. st vs vr va t1 t1 t2 t2 t3 t3 idle idle n2 n2 rtt window paclen Snd-Q Rcv-Q inode
1878	 */
1879
1880	seq_printf(seq, "%8.8lx %s %s%s ",
1881		   (long) ax25,
1882		   ax25->ax25_dev == NULL? "???" : ax25->ax25_dev->dev->name,
1883		   ax2asc(buf, &ax25->source_addr),
1884		   ax25->iamdigi? "*":"");
1885	seq_printf(seq, "%s", ax2asc(buf, &ax25->dest_addr));
1886
1887	for (k=0; (ax25->digipeat != NULL) && (k < ax25->digipeat->ndigi); k++) {
1888		seq_printf(seq, ",%s%s",
1889			   ax2asc(buf, &ax25->digipeat->calls[k]),
1890			   ax25->digipeat->repeated[k]? "*":"");
1891	}
1892
1893	seq_printf(seq, " %d %d %d %d %lu %lu %lu %lu %lu %lu %lu %lu %d %d %lu %d %d",
1894		   ax25->state,
1895		   ax25->vs, ax25->vr, ax25->va,
1896		   ax25_display_timer(&ax25->t1timer) / HZ, ax25->t1 / HZ,
1897		   ax25_display_timer(&ax25->t2timer) / HZ, ax25->t2 / HZ,
1898		   ax25_display_timer(&ax25->t3timer) / HZ, ax25->t3 / HZ,
1899		   ax25_display_timer(&ax25->idletimer) / (60 * HZ),
1900		   ax25->idle / (60 * HZ),
1901		   ax25->n2count, ax25->n2,
1902		   ax25->rtt / HZ,
1903		   ax25->window,
1904		   ax25->paclen);
1905
1906	if (ax25->sk != NULL) {
1907		seq_printf(seq, " %d %d %lu\n",
1908			   sk_wmem_alloc_get(ax25->sk),
1909			   sk_rmem_alloc_get(ax25->sk),
1910			   sock_i_ino(ax25->sk));
1911	} else {
1912		seq_puts(seq, " * * *\n");
1913	}
1914	return 0;
1915}
1916
1917static const struct seq_operations ax25_info_seqops = {
1918	.start = ax25_info_start,
1919	.next = ax25_info_next,
1920	.stop = ax25_info_stop,
1921	.show = ax25_info_show,
1922};
1923
1924static int ax25_info_open(struct inode *inode, struct file *file)
1925{
1926	return seq_open(file, &ax25_info_seqops);
1927}
1928
1929static const struct file_operations ax25_info_fops = {
1930	.owner = THIS_MODULE,
1931	.open = ax25_info_open,
1932	.read = seq_read,
1933	.llseek = seq_lseek,
1934	.release = seq_release,
1935};
1936
1937#endif
1938
1939static const struct net_proto_family ax25_family_ops = {
1940	.family =	PF_AX25,
1941	.create =	ax25_create,
1942	.owner	=	THIS_MODULE,
1943};
1944
1945static const struct proto_ops ax25_proto_ops = {
1946	.family		= PF_AX25,
1947	.owner		= THIS_MODULE,
1948	.release	= ax25_release,
1949	.bind		= ax25_bind,
1950	.connect	= ax25_connect,
1951	.socketpair	= sock_no_socketpair,
1952	.accept		= ax25_accept,
1953	.getname	= ax25_getname,
1954	.poll		= datagram_poll,
1955	.ioctl		= ax25_ioctl,
1956	.listen		= ax25_listen,
1957	.shutdown	= ax25_shutdown,
1958	.setsockopt	= ax25_setsockopt,
1959	.getsockopt	= ax25_getsockopt,
1960	.sendmsg	= ax25_sendmsg,
1961	.recvmsg	= ax25_recvmsg,
1962	.mmap		= sock_no_mmap,
1963	.sendpage	= sock_no_sendpage,
1964};
1965
1966/*
1967 *	Called by socket.c on kernel start up
1968 */
1969static struct packet_type ax25_packet_type __read_mostly = {
1970	.type	=	cpu_to_be16(ETH_P_AX25),
1971	.func	=	ax25_kiss_rcv,
1972};
1973
1974static struct notifier_block ax25_dev_notifier = {
1975	.notifier_call =ax25_device_event,
1976};
1977
1978static int __init ax25_init(void)
1979{
1980	int rc = proto_register(&ax25_proto, 0);
1981
1982	if (rc != 0)
1983		goto out;
1984
1985	sock_register(&ax25_family_ops);
1986	dev_add_pack(&ax25_packet_type);
1987	register_netdevice_notifier(&ax25_dev_notifier);
1988	ax25_register_sysctl();
1989
1990	proc_net_fops_create(&init_net, "ax25_route", S_IRUGO, &ax25_route_fops);
1991	proc_net_fops_create(&init_net, "ax25", S_IRUGO, &ax25_info_fops);
1992	proc_net_fops_create(&init_net, "ax25_calls", S_IRUGO, &ax25_uid_fops);
 
1993out:
1994	return rc;
1995}
1996module_init(ax25_init);
1997
1998
1999MODULE_AUTHOR("Jonathan Naylor G4KLX <g4klx@g4klx.demon.co.uk>");
2000MODULE_DESCRIPTION("The amateur radio AX.25 link layer protocol");
2001MODULE_LICENSE("GPL");
2002MODULE_ALIAS_NETPROTO(PF_AX25);
2003
2004static void __exit ax25_exit(void)
2005{
2006	proc_net_remove(&init_net, "ax25_route");
2007	proc_net_remove(&init_net, "ax25");
2008	proc_net_remove(&init_net, "ax25_calls");
2009	ax25_rt_free();
2010	ax25_uid_free();
2011	ax25_dev_free();
2012
2013	ax25_unregister_sysctl();
2014	unregister_netdevice_notifier(&ax25_dev_notifier);
2015
2016	dev_remove_pack(&ax25_packet_type);
2017
2018	sock_unregister(PF_AX25);
2019	proto_unregister(&ax25_proto);
 
 
 
 
2020}
2021module_exit(ax25_exit);