1/*
   2 * This program is free software; you can redistribute it and/or modify
   3 * it under the terms of the GNU General Public License as published by
   4 * the Free Software Foundation; either version 2 of the License, or
   5 * (at your option) any later version.
   6 *
   7 * Copyright (C) Alan Cox GW4PTS (alan@lxorguk.ukuu.org.uk)
   8 * Copyright (C) Jonathan Naylor G4KLX (g4klx@g4klx.demon.co.uk)
   9 * Copyright (C) Darryl Miles G7LED (dlm@g7led.demon.co.uk)
  10 * Copyright (C) Steven Whitehouse GW7RRM (stevew@acm.org)
  11 * Copyright (C) Joerg Reuter DL1BKE (jreuter@yaina.de)
  12 * Copyright (C) Hans-Joachim Hetscher DD8NE (dd8ne@bnv-bamberg.de)
  13 * Copyright (C) Hans Alblas PE1AYX (hans@esrac.ele.tue.nl)
  14 * Copyright (C) Frederic Rible F1OAT (frible@teaser.fr)
  15 */
  16#include <linux/capability.h>
  17#include <linux/module.h>
  18#include <linux/errno.h>
  19#include <linux/types.h>
  20#include <linux/socket.h>
  21#include <linux/in.h>
  22#include <linux/kernel.h>
  23#include <linux/sched.h>
  24#include <linux/timer.h>
  25#include <linux/string.h>
  26#include <linux/sockios.h>
  27#include <linux/net.h>
  28#include <linux/slab.h>
  29#include <net/ax25.h>
  30#include <linux/inet.h>
  31#include <linux/netdevice.h>
  32#include <linux/if_arp.h>
  33#include <linux/skbuff.h>
  34#include <net/sock.h>
  35#include <asm/uaccess.h>
  36#include <linux/fcntl.h>
  37#include <linux/termios.h>	/* For TIOCINQ/OUTQ */
  38#include <linux/mm.h>
  39#include <linux/interrupt.h>
  40#include <linux/notifier.h>
  41#include <linux/proc_fs.h>
  42#include <linux/stat.h>
  43#include <linux/netfilter.h>
  44#include <linux/sysctl.h>
  45#include <linux/init.h>
  46#include <linux/spinlock.h>
  47#include <net/net_namespace.h>
  48#include <net/tcp_states.h>
  49#include <net/ip.h>
  50#include <net/arp.h>
  51
  52
  53
  54HLIST_HEAD(ax25_list);
  55DEFINE_SPINLOCK(ax25_list_lock);
  56
  57static const struct proto_ops ax25_proto_ops;
  58
  59static void ax25_free_sock(struct sock *sk)
  60{
  61	ax25_cb_put(ax25_sk(sk));
  62}
  63
  64/*
  65 *	Socket removal during an interrupt is now safe.
  66 */
  67static void ax25_cb_del(ax25_cb *ax25)
  68{
  69	if (!hlist_unhashed(&ax25->ax25_node)) {
  70		spin_lock_bh(&ax25_list_lock);
  71		hlist_del_init(&ax25->ax25_node);
  72		spin_unlock_bh(&ax25_list_lock);
  73		ax25_cb_put(ax25);
  74	}
  75}
  76
  77/*
  78 *	Kill all bound sockets on a dropped device.
  79 */
  80static void ax25_kill_by_device(struct net_device *dev)
  81{
  82	ax25_dev *ax25_dev;
  83	ax25_cb *s;
  84
  85	if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL)
  86		return;
  87
  88	spin_lock_bh(&ax25_list_lock);
  89again:
  90	ax25_for_each(s, &ax25_list) {
  91		if (s->ax25_dev == ax25_dev) {
  92			s->ax25_dev = NULL;
  93			spin_unlock_bh(&ax25_list_lock);
  94			ax25_disconnect(s, ENETUNREACH);
  95			spin_lock_bh(&ax25_list_lock);
  96
  97			/* The entry could have been deleted from the
  98			 * list meanwhile and thus the next pointer is
  99			 * no longer valid.  Play it safe and restart
 100			 * the scan.  Forward progress is ensured
 101			 * because we set s->ax25_dev to NULL and we
 102			 * are never passed a NULL 'dev' argument.
 103			 */
 104			goto again;
 105		}
 106	}
 107	spin_unlock_bh(&ax25_list_lock);
 108}
 109
 110/*
 111 *	Handle device status changes.
 112 */
 113static int ax25_device_event(struct notifier_block *this, unsigned long event,
 114			     void *ptr)
 115{
 116	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 117
 118	if (!net_eq(dev_net(dev), &init_net))
 119		return NOTIFY_DONE;
 120
 121	/* Reject non AX.25 devices */
 122	if (dev->type != ARPHRD_AX25)
 123		return NOTIFY_DONE;
 124
 125	switch (event) {
 126	case NETDEV_UP:
 127		ax25_dev_device_up(dev);
 128		break;
 129	case NETDEV_DOWN:
 130		ax25_kill_by_device(dev);
 131		ax25_rt_device_down(dev);
 132		ax25_dev_device_down(dev);
 133		break;
 134	default:
 135		break;
 136	}
 137
 138	return NOTIFY_DONE;
 139}
 140
 141/*
 142 *	Add a socket to the bound sockets list.
 143 */
 144void ax25_cb_add(ax25_cb *ax25)
 145{
 146	spin_lock_bh(&ax25_list_lock);
 147	ax25_cb_hold(ax25);
 148	hlist_add_head(&ax25->ax25_node, &ax25_list);
 149	spin_unlock_bh(&ax25_list_lock);
 150}
 151
 152/*
 153 *	Find a socket that wants to accept the SABM we have just
 154 *	received.
 155 */
 156struct sock *ax25_find_listener(ax25_address *addr, int digi,
 157	struct net_device *dev, int type)
 158{
 159	ax25_cb *s;
 160
 161	spin_lock(&ax25_list_lock);
 162	ax25_for_each(s, &ax25_list) {
 163		if ((s->iamdigi && !digi) || (!s->iamdigi && digi))
 164			continue;
 165		if (s->sk && !ax25cmp(&s->source_addr, addr) &&
 166		    s->sk->sk_type == type && s->sk->sk_state == TCP_LISTEN) {
 167			/* If device is null we match any device */
 168			if (s->ax25_dev == NULL || s->ax25_dev->dev == dev) {
 169				sock_hold(s->sk);
 170				spin_unlock(&ax25_list_lock);
 171				return s->sk;
 172			}
 173		}
 174	}
 175	spin_unlock(&ax25_list_lock);
 176
 177	return NULL;
 178}
 179
 180/*
 181 *	Find an AX.25 socket given both ends.
 182 */
 183struct sock *ax25_get_socket(ax25_address *my_addr, ax25_address *dest_addr,
 184	int type)
 185{
 186	struct sock *sk = NULL;
 187	ax25_cb *s;
 188
 189	spin_lock(&ax25_list_lock);
 190	ax25_for_each(s, &ax25_list) {
 191		if (s->sk && !ax25cmp(&s->source_addr, my_addr) &&
 192		    !ax25cmp(&s->dest_addr, dest_addr) &&
 193		    s->sk->sk_type == type) {
 194			sk = s->sk;
 195			sock_hold(sk);
 196			break;
 197		}
 198	}
 199
 200	spin_unlock(&ax25_list_lock);
 201
 202	return sk;
 203}
 204
 205/*
 206 *	Find an AX.25 control block given both ends. It will only pick up
 207 *	floating AX.25 control blocks or non Raw socket bound control blocks.
 208 */
 209ax25_cb *ax25_find_cb(ax25_address *src_addr, ax25_address *dest_addr,
 210	ax25_digi *digi, struct net_device *dev)
 211{
 212	ax25_cb *s;
 213
 214	spin_lock_bh(&ax25_list_lock);
 215	ax25_for_each(s, &ax25_list) {
 216		if (s->sk && s->sk->sk_type != SOCK_SEQPACKET)
 217			continue;
 218		if (s->ax25_dev == NULL)
 219			continue;
 220		if (ax25cmp(&s->source_addr, src_addr) == 0 && ax25cmp(&s->dest_addr, dest_addr) == 0 && s->ax25_dev->dev == dev) {
 221			if (digi != NULL && digi->ndigi != 0) {
 222				if (s->digipeat == NULL)
 223					continue;
 224				if (ax25digicmp(s->digipeat, digi) != 0)
 225					continue;
 226			} else {
 227				if (s->digipeat != NULL && s->digipeat->ndigi != 0)
 228					continue;
 229			}
 230			ax25_cb_hold(s);
 231			spin_unlock_bh(&ax25_list_lock);
 232
 233			return s;
 234		}
 235	}
 236	spin_unlock_bh(&ax25_list_lock);
 237
 238	return NULL;
 239}
 240
 241EXPORT_SYMBOL(ax25_find_cb);
 242
 243void ax25_send_to_raw(ax25_address *addr, struct sk_buff *skb, int proto)
 244{
 245	ax25_cb *s;
 246	struct sk_buff *copy;
 247
 248	spin_lock(&ax25_list_lock);
 249	ax25_for_each(s, &ax25_list) {
 250		if (s->sk != NULL && ax25cmp(&s->source_addr, addr) == 0 &&
 251		    s->sk->sk_type == SOCK_RAW &&
 252		    s->sk->sk_protocol == proto &&
 253		    s->ax25_dev->dev == skb->dev &&
 254		    atomic_read(&s->sk->sk_rmem_alloc) <= s->sk->sk_rcvbuf) {
 255			if ((copy = skb_clone(skb, GFP_ATOMIC)) == NULL)
 256				continue;
 257			if (sock_queue_rcv_skb(s->sk, copy) != 0)
 258				kfree_skb(copy);
 259		}
 260	}
 261	spin_unlock(&ax25_list_lock);
 262}
 263
 264/*
 265 *	Deferred destroy.
 266 */
 267void ax25_destroy_socket(ax25_cb *);
 268
 269/*
 270 *	Handler for deferred kills.
 271 */
 272static void ax25_destroy_timer(unsigned long data)
 273{
 274	ax25_cb *ax25=(ax25_cb *)data;
 275	struct sock *sk;
 276
 277	sk=ax25->sk;
 278
 279	bh_lock_sock(sk);
 280	sock_hold(sk);
 281	ax25_destroy_socket(ax25);
 282	bh_unlock_sock(sk);
 283	sock_put(sk);
 284}
 285
 286/*
 287 *	This is called from user mode and the timers. Thus it protects itself
 288 *	against interrupt users but doesn't worry about being called during
 289 *	work. Once it is removed from the queue no interrupt or bottom half
 290 *	will touch it and we are (fairly 8-) ) safe.
 291 */
 292void ax25_destroy_socket(ax25_cb *ax25)
 293{
 294	struct sk_buff *skb;
 295
 296	ax25_cb_del(ax25);
 297
 298	ax25_stop_heartbeat(ax25);
 299	ax25_stop_t1timer(ax25);
 300	ax25_stop_t2timer(ax25);
 301	ax25_stop_t3timer(ax25);
 302	ax25_stop_idletimer(ax25);
 303
 304	ax25_clear_queues(ax25);	/* Flush the queues */
 305
 306	if (ax25->sk != NULL) {
 307		while ((skb = skb_dequeue(&ax25->sk->sk_receive_queue)) != NULL) {
 308			if (skb->sk != ax25->sk) {
 309				/* A pending connection */
 310				ax25_cb *sax25 = ax25_sk(skb->sk);
 311
 312				/* Queue the unaccepted socket for death */
 313				sock_orphan(skb->sk);
 314
 315				/* 9A4GL: hack to release unaccepted sockets */
 316				skb->sk->sk_state = TCP_LISTEN;
 317
 318				ax25_start_heartbeat(sax25);
 319				sax25->state = AX25_STATE_0;
 320			}
 321
 322			kfree_skb(skb);
 323		}
 324		skb_queue_purge(&ax25->sk->sk_write_queue);
 325	}
 326
 327	if (ax25->sk != NULL) {
 328		if (sk_has_allocations(ax25->sk)) {
 329			/* Defer: outstanding buffers */
 330			setup_timer(&ax25->dtimer, ax25_destroy_timer,
 331					(unsigned long)ax25);
 332			ax25->dtimer.expires  = jiffies + 2 * HZ;
 333			add_timer(&ax25->dtimer);
 334		} else {
 335			struct sock *sk=ax25->sk;
 336			ax25->sk=NULL;
 337			sock_put(sk);
 338		}
 339	} else {
 340		ax25_cb_put(ax25);
 341	}
 342}
 343
 344/*
 345 * dl1bke 960311: set parameters for existing AX.25 connections,
 346 *		  includes a KILL command to abort any connection.
 347 *		  VERY useful for debugging ;-)
 348 */
 349static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
 350{
 351	struct ax25_ctl_struct ax25_ctl;
 352	ax25_digi digi;
 353	ax25_dev *ax25_dev;
 354	ax25_cb *ax25;
 355	unsigned int k;
 356	int ret = 0;
 357
 358	if (copy_from_user(&ax25_ctl, arg, sizeof(ax25_ctl)))
 359		return -EFAULT;
 360
 361	if ((ax25_dev = ax25_addr_ax25dev(&ax25_ctl.port_addr)) == NULL)
 362		return -ENODEV;
 363
 364	if (ax25_ctl.digi_count > AX25_MAX_DIGIS)
 365		return -EINVAL;
 366
 367	if (ax25_ctl.arg > ULONG_MAX / HZ && ax25_ctl.cmd != AX25_KILL)
 368		return -EINVAL;
 369
 370	digi.ndigi = ax25_ctl.digi_count;
 371	for (k = 0; k < digi.ndigi; k++)
 372		digi.calls[k] = ax25_ctl.digi_addr[k];
 373
 374	if ((ax25 = ax25_find_cb(&ax25_ctl.source_addr, &ax25_ctl.dest_addr, &digi, ax25_dev->dev)) == NULL)
 375		return -ENOTCONN;
 376
 377	switch (ax25_ctl.cmd) {
 378	case AX25_KILL:
 379		ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
 380#ifdef CONFIG_AX25_DAMA_SLAVE
 381		if (ax25_dev->dama.slave && ax25->ax25_dev->values[AX25_VALUES_PROTOCOL] == AX25_PROTO_DAMA_SLAVE)
 382			ax25_dama_off(ax25);
 383#endif
 384		ax25_disconnect(ax25, ENETRESET);
 385		break;
 386
 387	case AX25_WINDOW:
 388		if (ax25->modulus == AX25_MODULUS) {
 389			if (ax25_ctl.arg < 1 || ax25_ctl.arg > 7)
 390				goto einval_put;
 391		} else {
 392			if (ax25_ctl.arg < 1 || ax25_ctl.arg > 63)
 393				goto einval_put;
 394		}
 395		ax25->window = ax25_ctl.arg;
 396		break;
 397
 398	case AX25_T1:
 399		if (ax25_ctl.arg < 1 || ax25_ctl.arg > ULONG_MAX / HZ)
 400			goto einval_put;
 401		ax25->rtt = (ax25_ctl.arg * HZ) / 2;
 402		ax25->t1  = ax25_ctl.arg * HZ;
 403		break;
 404
 405	case AX25_T2:
 406		if (ax25_ctl.arg < 1 || ax25_ctl.arg > ULONG_MAX / HZ)
 407			goto einval_put;
 408		ax25->t2 = ax25_ctl.arg * HZ;
 409		break;
 410
 411	case AX25_N2:
 412		if (ax25_ctl.arg < 1 || ax25_ctl.arg > 31)
 413			goto einval_put;
 414		ax25->n2count = 0;
 415		ax25->n2 = ax25_ctl.arg;
 416		break;
 417
 418	case AX25_T3:
 419		if (ax25_ctl.arg > ULONG_MAX / HZ)
 420			goto einval_put;
 421		ax25->t3 = ax25_ctl.arg * HZ;
 422		break;
 423
 424	case AX25_IDLE:
 425		if (ax25_ctl.arg > ULONG_MAX / (60 * HZ))
 426			goto einval_put;
 427
 428		ax25->idle = ax25_ctl.arg * 60 * HZ;
 429		break;
 430
 431	case AX25_PACLEN:
 432		if (ax25_ctl.arg < 16 || ax25_ctl.arg > 65535)
 433			goto einval_put;
 434		ax25->paclen = ax25_ctl.arg;
 435		break;
 436
 437	default:
 438		goto einval_put;
 439	  }
 440
 441out_put:
 442	ax25_cb_put(ax25);
 443	return ret;
 444
 445einval_put:
 446	ret = -EINVAL;
 447	goto out_put;
 448}
 449
 450static void ax25_fillin_cb_from_dev(ax25_cb *ax25, ax25_dev *ax25_dev)
 451{
 452	ax25->rtt     = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T1]) / 2;
 453	ax25->t1      = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T1]);
 454	ax25->t2      = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T2]);
 455	ax25->t3      = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T3]);
 456	ax25->n2      = ax25_dev->values[AX25_VALUES_N2];
 457	ax25->paclen  = ax25_dev->values[AX25_VALUES_PACLEN];
 458	ax25->idle    = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_IDLE]);
 459	ax25->backoff = ax25_dev->values[AX25_VALUES_BACKOFF];
 460
 461	if (ax25_dev->values[AX25_VALUES_AXDEFMODE]) {
 462		ax25->modulus = AX25_EMODULUS;
 463		ax25->window  = ax25_dev->values[AX25_VALUES_EWINDOW];
 464	} else {
 465		ax25->modulus = AX25_MODULUS;
 466		ax25->window  = ax25_dev->values[AX25_VALUES_WINDOW];
 467	}
 468}
 469
 470/*
 471 *	Fill in a created AX.25 created control block with the default
 472 *	values for a particular device.
 473 */
 474void ax25_fillin_cb(ax25_cb *ax25, ax25_dev *ax25_dev)
 475{
 476	ax25->ax25_dev = ax25_dev;
 477
 478	if (ax25->ax25_dev != NULL) {
 479		ax25_fillin_cb_from_dev(ax25, ax25_dev);
 480		return;
 481	}
 482
 483	/*
 484	 * No device, use kernel / AX.25 spec default values
 485	 */
 486	ax25->rtt     = msecs_to_jiffies(AX25_DEF_T1) / 2;
 487	ax25->t1      = msecs_to_jiffies(AX25_DEF_T1);
 488	ax25->t2      = msecs_to_jiffies(AX25_DEF_T2);
 489	ax25->t3      = msecs_to_jiffies(AX25_DEF_T3);
 490	ax25->n2      = AX25_DEF_N2;
 491	ax25->paclen  = AX25_DEF_PACLEN;
 492	ax25->idle    = msecs_to_jiffies(AX25_DEF_IDLE);
 493	ax25->backoff = AX25_DEF_BACKOFF;
 494
 495	if (AX25_DEF_AXDEFMODE) {
 496		ax25->modulus = AX25_EMODULUS;
 497		ax25->window  = AX25_DEF_EWINDOW;
 498	} else {
 499		ax25->modulus = AX25_MODULUS;
 500		ax25->window  = AX25_DEF_WINDOW;
 501	}
 502}
 503
 504/*
 505 * Create an empty AX.25 control block.
 506 */
 507ax25_cb *ax25_create_cb(void)
 508{
 509	ax25_cb *ax25;
 510
 511	if ((ax25 = kzalloc(sizeof(*ax25), GFP_ATOMIC)) == NULL)
 512		return NULL;
 513
 514	atomic_set(&ax25->refcount, 1);
 515
 516	skb_queue_head_init(&ax25->write_queue);
 517	skb_queue_head_init(&ax25->frag_queue);
 518	skb_queue_head_init(&ax25->ack_queue);
 519	skb_queue_head_init(&ax25->reseq_queue);
 520
 521	ax25_setup_timers(ax25);
 522
 523	ax25_fillin_cb(ax25, NULL);
 524
 525	ax25->state = AX25_STATE_0;
 526
 527	return ax25;
 528}
 529
 530/*
 531 *	Handling for system calls applied via the various interfaces to an
 532 *	AX25 socket object
 533 */
 534
 535static int ax25_setsockopt(struct socket *sock, int level, int optname,
 536	char __user *optval, unsigned int optlen)
 537{
 538	struct sock *sk = sock->sk;
 539	ax25_cb *ax25;
 540	struct net_device *dev;
 541	char devname[IFNAMSIZ];
 542	unsigned long opt;
 543	int res = 0;
 544
 545	if (level != SOL_AX25)
 546		return -ENOPROTOOPT;
 547
 548	if (optlen < sizeof(unsigned int))
 549		return -EINVAL;
 550
 551	if (get_user(opt, (unsigned int __user *)optval))
 552		return -EFAULT;
 553
 554	lock_sock(sk);
 555	ax25 = ax25_sk(sk);
 556
 557	switch (optname) {
 558	case AX25_WINDOW:
 559		if (ax25->modulus == AX25_MODULUS) {
 560			if (opt < 1 || opt > 7) {
 561				res = -EINVAL;
 562				break;
 563			}
 564		} else {
 565			if (opt < 1 || opt > 63) {
 566				res = -EINVAL;
 567				break;
 568			}
 569		}
 570		ax25->window = opt;
 571		break;
 572
 573	case AX25_T1:
 574		if (opt < 1 || opt > ULONG_MAX / HZ) {
 575			res = -EINVAL;
 576			break;
 577		}
 578		ax25->rtt = (opt * HZ) >> 1;
 579		ax25->t1  = opt * HZ;
 580		break;
 581
 582	case AX25_T2:
 583		if (opt < 1 || opt > ULONG_MAX / HZ) {
 584			res = -EINVAL;
 585			break;
 586		}
 587		ax25->t2 = opt * HZ;
 588		break;
 589
 590	case AX25_N2:
 591		if (opt < 1 || opt > 31) {
 592			res = -EINVAL;
 593			break;
 594		}
 595		ax25->n2 = opt;
 596		break;
 597
 598	case AX25_T3:
 599		if (opt < 1 || opt > ULONG_MAX / HZ) {
 600			res = -EINVAL;
 601			break;
 602		}
 603		ax25->t3 = opt * HZ;
 604		break;
 605
 606	case AX25_IDLE:
 607		if (opt > ULONG_MAX / (60 * HZ)) {
 608			res = -EINVAL;
 609			break;
 610		}
 611		ax25->idle = opt * 60 * HZ;
 612		break;
 613
 614	case AX25_BACKOFF:
 615		if (opt > 2) {
 616			res = -EINVAL;
 617			break;
 618		}
 619		ax25->backoff = opt;
 620		break;
 621
 622	case AX25_EXTSEQ:
 623		ax25->modulus = opt ? AX25_EMODULUS : AX25_MODULUS;
 624		break;
 625
 626	case AX25_PIDINCL:
 627		ax25->pidincl = opt ? 1 : 0;
 628		break;
 629
 630	case AX25_IAMDIGI:
 631		ax25->iamdigi = opt ? 1 : 0;
 632		break;
 633
 634	case AX25_PACLEN:
 635		if (opt < 16 || opt > 65535) {
 636			res = -EINVAL;
 637			break;
 638		}
 639		ax25->paclen = opt;
 640		break;
 641
 642	case SO_BINDTODEVICE:
 643		if (optlen > IFNAMSIZ)
 644			optlen = IFNAMSIZ;
 645
 646		if (copy_from_user(devname, optval, optlen)) {
 647			res = -EFAULT;
 648			break;
 649		}
 650
 651		if (sk->sk_type == SOCK_SEQPACKET &&
 652		   (sock->state != SS_UNCONNECTED ||
 653		    sk->sk_state == TCP_LISTEN)) {
 654			res = -EADDRNOTAVAIL;
 655			break;
 656		}
 657
 658		dev = dev_get_by_name(&init_net, devname);
 659		if (!dev) {
 660			res = -ENODEV;
 661			break;
 662		}
 663
 664		ax25->ax25_dev = ax25_dev_ax25dev(dev);
 665		ax25_fillin_cb(ax25, ax25->ax25_dev);
 666		dev_put(dev);
 667		break;
 668
 669	default:
 670		res = -ENOPROTOOPT;
 671	}
 672	release_sock(sk);
 673
 674	return res;
 675}
 676
 677static int ax25_getsockopt(struct socket *sock, int level, int optname,
 678	char __user *optval, int __user *optlen)
 679{
 680	struct sock *sk = sock->sk;
 681	ax25_cb *ax25;
 682	struct ax25_dev *ax25_dev;
 683	char devname[IFNAMSIZ];
 684	void *valptr;
 685	int val = 0;
 686	int maxlen, length;
 687
 688	if (level != SOL_AX25)
 689		return -ENOPROTOOPT;
 690
 691	if (get_user(maxlen, optlen))
 692		return -EFAULT;
 693
 694	if (maxlen < 1)
 695		return -EFAULT;
 696
 697	valptr = (void *) &val;
 698	length = min_t(unsigned int, maxlen, sizeof(int));
 699
 700	lock_sock(sk);
 701	ax25 = ax25_sk(sk);
 702
 703	switch (optname) {
 704	case AX25_WINDOW:
 705		val = ax25->window;
 706		break;
 707
 708	case AX25_T1:
 709		val = ax25->t1 / HZ;
 710		break;
 711
 712	case AX25_T2:
 713		val = ax25->t2 / HZ;
 714		break;
 715
 716	case AX25_N2:
 717		val = ax25->n2;
 718		break;
 719
 720	case AX25_T3:
 721		val = ax25->t3 / HZ;
 722		break;
 723
 724	case AX25_IDLE:
 725		val = ax25->idle / (60 * HZ);
 726		break;
 727
 728	case AX25_BACKOFF:
 729		val = ax25->backoff;
 730		break;
 731
 732	case AX25_EXTSEQ:
 733		val = (ax25->modulus == AX25_EMODULUS);
 734		break;
 735
 736	case AX25_PIDINCL:
 737		val = ax25->pidincl;
 738		break;
 739
 740	case AX25_IAMDIGI:
 741		val = ax25->iamdigi;
 742		break;
 743
 744	case AX25_PACLEN:
 745		val = ax25->paclen;
 746		break;
 747
 748	case SO_BINDTODEVICE:
 749		ax25_dev = ax25->ax25_dev;
 750
 751		if (ax25_dev != NULL && ax25_dev->dev != NULL) {
 752			strlcpy(devname, ax25_dev->dev->name, sizeof(devname));
 753			length = strlen(devname) + 1;
 754		} else {
 755			*devname = '\0';
 756			length = 1;
 757		}
 758
 759		valptr = (void *) devname;
 760		break;
 761
 762	default:
 763		release_sock(sk);
 764		return -ENOPROTOOPT;
 765	}
 766	release_sock(sk);
 767
 768	if (put_user(length, optlen))
 769		return -EFAULT;
 770
 771	return copy_to_user(optval, valptr, length) ? -EFAULT : 0;
 772}
 773
 774static int ax25_listen(struct socket *sock, int backlog)
 775{
 776	struct sock *sk = sock->sk;
 777	int res = 0;
 778
 779	lock_sock(sk);
 780	if (sk->sk_type == SOCK_SEQPACKET && sk->sk_state != TCP_LISTEN) {
 781		sk->sk_max_ack_backlog = backlog;
 782		sk->sk_state           = TCP_LISTEN;
 783		goto out;
 784	}
 785	res = -EOPNOTSUPP;
 786
 787out:
 788	release_sock(sk);
 789
 790	return res;
 791}
 792
 793/*
 794 * XXX: when creating ax25_sock we should update the .obj_size setting
 795 * below.
 796 */
 797static struct proto ax25_proto = {
 798	.name	  = "AX25",
 799	.owner	  = THIS_MODULE,
 800	.obj_size = sizeof(struct sock),
 801};
 802
 803static int ax25_create(struct net *net, struct socket *sock, int protocol,
 804		       int kern)
 805{
 806	struct sock *sk;
 807	ax25_cb *ax25;
 808
 
 
 
 809	if (!net_eq(net, &init_net))
 810		return -EAFNOSUPPORT;
 811
 812	switch (sock->type) {
 813	case SOCK_DGRAM:
 814		if (protocol == 0 || protocol == PF_AX25)
 815			protocol = AX25_P_TEXT;
 816		break;
 817
 818	case SOCK_SEQPACKET:
 819		switch (protocol) {
 820		case 0:
 821		case PF_AX25:	/* For CLX */
 822			protocol = AX25_P_TEXT;
 823			break;
 824		case AX25_P_SEGMENT:
 825#ifdef CONFIG_INET
 826		case AX25_P_ARP:
 827		case AX25_P_IP:
 828#endif
 829#ifdef CONFIG_NETROM
 830		case AX25_P_NETROM:
 831#endif
 832#ifdef CONFIG_ROSE
 833		case AX25_P_ROSE:
 834#endif
 835			return -ESOCKTNOSUPPORT;
 836#ifdef CONFIG_NETROM_MODULE
 837		case AX25_P_NETROM:
 838			if (ax25_protocol_is_registered(AX25_P_NETROM))
 839				return -ESOCKTNOSUPPORT;
 840			break;
 841#endif
 842#ifdef CONFIG_ROSE_MODULE
 843		case AX25_P_ROSE:
 844			if (ax25_protocol_is_registered(AX25_P_ROSE))
 845				return -ESOCKTNOSUPPORT;
 846#endif
 847		default:
 848			break;
 849		}
 850		break;
 851
 852	case SOCK_RAW:
 853		break;
 854	default:
 855		return -ESOCKTNOSUPPORT;
 856	}
 857
 858	sk = sk_alloc(net, PF_AX25, GFP_ATOMIC, &ax25_proto);
 859	if (sk == NULL)
 860		return -ENOMEM;
 861
 862	ax25 = sk->sk_protinfo = ax25_create_cb();
 863	if (!ax25) {
 864		sk_free(sk);
 865		return -ENOMEM;
 866	}
 867
 868	sock_init_data(sock, sk);
 869
 870	sk->sk_destruct = ax25_free_sock;
 871	sock->ops    = &ax25_proto_ops;
 872	sk->sk_protocol = protocol;
 873
 874	ax25->sk    = sk;
 875
 876	return 0;
 877}
 878
 879struct sock *ax25_make_new(struct sock *osk, struct ax25_dev *ax25_dev)
 880{
 881	struct sock *sk;
 882	ax25_cb *ax25, *oax25;
 883
 884	sk = sk_alloc(sock_net(osk), PF_AX25, GFP_ATOMIC,	osk->sk_prot);
 885	if (sk == NULL)
 886		return NULL;
 887
 888	if ((ax25 = ax25_create_cb()) == NULL) {
 889		sk_free(sk);
 890		return NULL;
 891	}
 892
 893	switch (osk->sk_type) {
 894	case SOCK_DGRAM:
 895		break;
 896	case SOCK_SEQPACKET:
 897		break;
 898	default:
 899		sk_free(sk);
 900		ax25_cb_put(ax25);
 901		return NULL;
 902	}
 903
 904	sock_init_data(NULL, sk);
 905
 906	sk->sk_type     = osk->sk_type;
 907	sk->sk_priority = osk->sk_priority;
 908	sk->sk_protocol = osk->sk_protocol;
 909	sk->sk_rcvbuf   = osk->sk_rcvbuf;
 910	sk->sk_sndbuf   = osk->sk_sndbuf;
 911	sk->sk_state    = TCP_ESTABLISHED;
 912	sock_copy_flags(sk, osk);
 913
 914	oax25 = ax25_sk(osk);
 915
 916	ax25->modulus = oax25->modulus;
 917	ax25->backoff = oax25->backoff;
 918	ax25->pidincl = oax25->pidincl;
 919	ax25->iamdigi = oax25->iamdigi;
 920	ax25->rtt     = oax25->rtt;
 921	ax25->t1      = oax25->t1;
 922	ax25->t2      = oax25->t2;
 923	ax25->t3      = oax25->t3;
 924	ax25->n2      = oax25->n2;
 925	ax25->idle    = oax25->idle;
 926	ax25->paclen  = oax25->paclen;
 927	ax25->window  = oax25->window;
 928
 929	ax25->ax25_dev    = ax25_dev;
 930	ax25->source_addr = oax25->source_addr;
 931
 932	if (oax25->digipeat != NULL) {
 933		ax25->digipeat = kmemdup(oax25->digipeat, sizeof(ax25_digi),
 934					 GFP_ATOMIC);
 935		if (ax25->digipeat == NULL) {
 936			sk_free(sk);
 937			ax25_cb_put(ax25);
 938			return NULL;
 939		}
 940	}
 941
 942	sk->sk_protinfo = ax25;
 943	sk->sk_destruct = ax25_free_sock;
 944	ax25->sk    = sk;
 945
 946	return sk;
 947}
 948
 949static int ax25_release(struct socket *sock)
 950{
 951	struct sock *sk = sock->sk;
 952	ax25_cb *ax25;
 953
 954	if (sk == NULL)
 955		return 0;
 956
 957	sock_hold(sk);
 958	sock_orphan(sk);
 959	lock_sock(sk);
 960	ax25 = ax25_sk(sk);
 961
 962	if (sk->sk_type == SOCK_SEQPACKET) {
 963		switch (ax25->state) {
 964		case AX25_STATE_0:
 965			release_sock(sk);
 966			ax25_disconnect(ax25, 0);
 967			lock_sock(sk);
 968			ax25_destroy_socket(ax25);
 969			break;
 970
 971		case AX25_STATE_1:
 972		case AX25_STATE_2:
 973			ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
 974			release_sock(sk);
 975			ax25_disconnect(ax25, 0);
 976			lock_sock(sk);
 977			ax25_destroy_socket(ax25);
 
 978			break;
 979
 980		case AX25_STATE_3:
 981		case AX25_STATE_4:
 982			ax25_clear_queues(ax25);
 983			ax25->n2count = 0;
 984
 985			switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
 986			case AX25_PROTO_STD_SIMPLEX:
 987			case AX25_PROTO_STD_DUPLEX:
 988				ax25_send_control(ax25,
 989						  AX25_DISC,
 990						  AX25_POLLON,
 991						  AX25_COMMAND);
 992				ax25_stop_t2timer(ax25);
 993				ax25_stop_t3timer(ax25);
 994				ax25_stop_idletimer(ax25);
 995				break;
 996#ifdef CONFIG_AX25_DAMA_SLAVE
 997			case AX25_PROTO_DAMA_SLAVE:
 998				ax25_stop_t3timer(ax25);
 999				ax25_stop_idletimer(ax25);
1000				break;
1001#endif
1002			}
1003			ax25_calculate_t1(ax25);
1004			ax25_start_t1timer(ax25);
1005			ax25->state = AX25_STATE_2;
1006			sk->sk_state                = TCP_CLOSE;
1007			sk->sk_shutdown            |= SEND_SHUTDOWN;
1008			sk->sk_state_change(sk);
1009			sock_set_flag(sk, SOCK_DESTROY);
1010			break;
1011
1012		default:
1013			break;
1014		}
1015	} else {
1016		sk->sk_state     = TCP_CLOSE;
1017		sk->sk_shutdown |= SEND_SHUTDOWN;
1018		sk->sk_state_change(sk);
1019		ax25_destroy_socket(ax25);
1020	}
1021
1022	sock->sk   = NULL;
1023	release_sock(sk);
1024	sock_put(sk);
1025
1026	return 0;
1027}
1028
1029/*
1030 *	We support a funny extension here so you can (as root) give any callsign
1031 *	digipeated via a local address as source. This hack is obsolete now
1032 *	that we've implemented support for SO_BINDTODEVICE. It is however small
1033 *	and trivially backward compatible.
1034 */
1035static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
1036{
1037	struct sock *sk = sock->sk;
1038	struct full_sockaddr_ax25 *addr = (struct full_sockaddr_ax25 *)uaddr;
1039	ax25_dev *ax25_dev = NULL;
1040	ax25_uid_assoc *user;
1041	ax25_address call;
1042	ax25_cb *ax25;
1043	int err = 0;
1044
1045	if (addr_len != sizeof(struct sockaddr_ax25) &&
1046	    addr_len != sizeof(struct full_sockaddr_ax25))
1047		/* support for old structure may go away some time
1048		 * ax25_bind(): uses old (6 digipeater) socket structure.
1049		 */
1050		if ((addr_len < sizeof(struct sockaddr_ax25) + sizeof(ax25_address) * 6) ||
1051		    (addr_len > sizeof(struct full_sockaddr_ax25)))
1052			return -EINVAL;
1053
1054	if (addr->fsa_ax25.sax25_family != AF_AX25)
1055		return -EINVAL;
1056
1057	user = ax25_findbyuid(current_euid());
1058	if (user) {
1059		call = user->call;
1060		ax25_uid_put(user);
1061	} else {
1062		if (ax25_uid_policy && !capable(CAP_NET_ADMIN))
1063			return -EACCES;
1064
1065		call = addr->fsa_ax25.sax25_call;
1066	}
1067
1068	lock_sock(sk);
1069
1070	ax25 = ax25_sk(sk);
1071	if (!sock_flag(sk, SOCK_ZAPPED)) {
1072		err = -EINVAL;
1073		goto out;
1074	}
1075
1076	ax25->source_addr = call;
1077
1078	/*
1079	 * User already set interface with SO_BINDTODEVICE
1080	 */
1081	if (ax25->ax25_dev != NULL)
1082		goto done;
1083
1084	if (addr_len > sizeof(struct sockaddr_ax25) && addr->fsa_ax25.sax25_ndigis == 1) {
1085		if (ax25cmp(&addr->fsa_digipeater[0], &null_ax25_address) != 0 &&
1086		    (ax25_dev = ax25_addr_ax25dev(&addr->fsa_digipeater[0])) == NULL) {
1087			err = -EADDRNOTAVAIL;
1088			goto out;
1089		}
1090	} else {
1091		if ((ax25_dev = ax25_addr_ax25dev(&addr->fsa_ax25.sax25_call)) == NULL) {
1092			err = -EADDRNOTAVAIL;
1093			goto out;
1094		}
1095	}
1096
1097	if (ax25_dev != NULL)
1098		ax25_fillin_cb(ax25, ax25_dev);
1099
1100done:
1101	ax25_cb_add(ax25);
1102	sock_reset_flag(sk, SOCK_ZAPPED);
1103
1104out:
1105	release_sock(sk);
1106
1107	return err;
1108}
1109
1110/*
1111 *	FIXME: nonblock behaviour looks like it may have a bug.
1112 */
1113static int __must_check ax25_connect(struct socket *sock,
1114	struct sockaddr *uaddr, int addr_len, int flags)
1115{
1116	struct sock *sk = sock->sk;
1117	ax25_cb *ax25 = ax25_sk(sk), *ax25t;
1118	struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)uaddr;
1119	ax25_digi *digi = NULL;
1120	int ct = 0, err = 0;
1121
1122	/*
1123	 * some sanity checks. code further down depends on this
1124	 */
1125
1126	if (addr_len == sizeof(struct sockaddr_ax25))
1127		/* support for this will go away in early 2.5.x
1128		 * ax25_connect(): uses obsolete socket structure
1129		 */
1130		;
1131	else if (addr_len != sizeof(struct full_sockaddr_ax25))
1132		/* support for old structure may go away some time
1133		 * ax25_connect(): uses old (6 digipeater) socket structure.
1134		 */
1135		if ((addr_len < sizeof(struct sockaddr_ax25) + sizeof(ax25_address) * 6) ||
1136		    (addr_len > sizeof(struct full_sockaddr_ax25)))
1137			return -EINVAL;
1138
1139
1140	if (fsa->fsa_ax25.sax25_family != AF_AX25)
1141		return -EINVAL;
1142
1143	lock_sock(sk);
1144
1145	/* deal with restarts */
1146	if (sock->state == SS_CONNECTING) {
1147		switch (sk->sk_state) {
1148		case TCP_SYN_SENT: /* still trying */
1149			err = -EINPROGRESS;
1150			goto out_release;
1151
1152		case TCP_ESTABLISHED: /* connection established */
1153			sock->state = SS_CONNECTED;
1154			goto out_release;
1155
1156		case TCP_CLOSE: /* connection refused */
1157			sock->state = SS_UNCONNECTED;
1158			err = -ECONNREFUSED;
1159			goto out_release;
1160		}
1161	}
1162
1163	if (sk->sk_state == TCP_ESTABLISHED && sk->sk_type == SOCK_SEQPACKET) {
1164		err = -EISCONN;	/* No reconnect on a seqpacket socket */
1165		goto out_release;
1166	}
1167
1168	sk->sk_state   = TCP_CLOSE;
1169	sock->state = SS_UNCONNECTED;
1170
1171	kfree(ax25->digipeat);
1172	ax25->digipeat = NULL;
1173
1174	/*
1175	 *	Handle digi-peaters to be used.
1176	 */
1177	if (addr_len > sizeof(struct sockaddr_ax25) &&
1178	    fsa->fsa_ax25.sax25_ndigis != 0) {
1179		/* Valid number of digipeaters ? */
1180		if (fsa->fsa_ax25.sax25_ndigis < 1 || fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS) {
1181			err = -EINVAL;
1182			goto out_release;
1183		}
1184
1185		if ((digi = kmalloc(sizeof(ax25_digi), GFP_KERNEL)) == NULL) {
1186			err = -ENOBUFS;
1187			goto out_release;
1188		}
1189
1190		digi->ndigi      = fsa->fsa_ax25.sax25_ndigis;
1191		digi->lastrepeat = -1;
1192
1193		while (ct < fsa->fsa_ax25.sax25_ndigis) {
1194			if ((fsa->fsa_digipeater[ct].ax25_call[6] &
1195			     AX25_HBIT) && ax25->iamdigi) {
1196				digi->repeated[ct] = 1;
1197				digi->lastrepeat   = ct;
1198			} else {
1199				digi->repeated[ct] = 0;
1200			}
1201			digi->calls[ct] = fsa->fsa_digipeater[ct];
1202			ct++;
1203		}
1204	}
1205
1206	/*
1207	 *	Must bind first - autobinding in this may or may not work. If
1208	 *	the socket is already bound, check to see if the device has
1209	 *	been filled in, error if it hasn't.
1210	 */
1211	if (sock_flag(sk, SOCK_ZAPPED)) {
1212		/* check if we can remove this feature. It is broken. */
1213		printk(KERN_WARNING "ax25_connect(): %s uses autobind, please contact jreuter@yaina.de\n",
1214			current->comm);
1215		if ((err = ax25_rt_autobind(ax25, &fsa->fsa_ax25.sax25_call)) < 0) {
1216			kfree(digi);
1217			goto out_release;
1218		}
1219
1220		ax25_fillin_cb(ax25, ax25->ax25_dev);
1221		ax25_cb_add(ax25);
1222	} else {
1223		if (ax25->ax25_dev == NULL) {
1224			kfree(digi);
1225			err = -EHOSTUNREACH;
1226			goto out_release;
1227		}
1228	}
1229
1230	if (sk->sk_type == SOCK_SEQPACKET &&
1231	    (ax25t=ax25_find_cb(&ax25->source_addr, &fsa->fsa_ax25.sax25_call, digi,
1232			 ax25->ax25_dev->dev))) {
1233		kfree(digi);
1234		err = -EADDRINUSE;		/* Already such a connection */
1235		ax25_cb_put(ax25t);
1236		goto out_release;
1237	}
1238
1239	ax25->dest_addr = fsa->fsa_ax25.sax25_call;
1240	ax25->digipeat  = digi;
1241
1242	/* First the easy one */
1243	if (sk->sk_type != SOCK_SEQPACKET) {
1244		sock->state = SS_CONNECTED;
1245		sk->sk_state   = TCP_ESTABLISHED;
1246		goto out_release;
1247	}
1248
1249	/* Move to connecting socket, ax.25 lapb WAIT_UA.. */
1250	sock->state        = SS_CONNECTING;
1251	sk->sk_state          = TCP_SYN_SENT;
1252
1253	switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
1254	case AX25_PROTO_STD_SIMPLEX:
1255	case AX25_PROTO_STD_DUPLEX:
1256		ax25_std_establish_data_link(ax25);
1257		break;
1258
1259#ifdef CONFIG_AX25_DAMA_SLAVE
1260	case AX25_PROTO_DAMA_SLAVE:
1261		ax25->modulus = AX25_MODULUS;
1262		ax25->window  = ax25->ax25_dev->values[AX25_VALUES_WINDOW];
1263		if (ax25->ax25_dev->dama.slave)
1264			ax25_ds_establish_data_link(ax25);
1265		else
1266			ax25_std_establish_data_link(ax25);
1267		break;
1268#endif
1269	}
1270
1271	ax25->state = AX25_STATE_1;
1272
1273	ax25_start_heartbeat(ax25);
1274
1275	/* Now the loop */
1276	if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK)) {
1277		err = -EINPROGRESS;
1278		goto out_release;
1279	}
1280
1281	if (sk->sk_state == TCP_SYN_SENT) {
1282		DEFINE_WAIT(wait);
1283
1284		for (;;) {
1285			prepare_to_wait(sk_sleep(sk), &wait,
1286					TASK_INTERRUPTIBLE);
1287			if (sk->sk_state != TCP_SYN_SENT)
1288				break;
1289			if (!signal_pending(current)) {
1290				release_sock(sk);
1291				schedule();
1292				lock_sock(sk);
1293				continue;
1294			}
1295			err = -ERESTARTSYS;
1296			break;
1297		}
1298		finish_wait(sk_sleep(sk), &wait);
1299
1300		if (err)
1301			goto out_release;
1302	}
1303
1304	if (sk->sk_state != TCP_ESTABLISHED) {
1305		/* Not in ABM, not in WAIT_UA -> failed */
1306		sock->state = SS_UNCONNECTED;
1307		err = sock_error(sk);	/* Always set at this point */
1308		goto out_release;
1309	}
1310
1311	sock->state = SS_CONNECTED;
1312
1313	err = 0;
1314out_release:
1315	release_sock(sk);
1316
1317	return err;
1318}
1319
1320static int ax25_accept(struct socket *sock, struct socket *newsock, int flags)
 
1321{
1322	struct sk_buff *skb;
1323	struct sock *newsk;
1324	DEFINE_WAIT(wait);
1325	struct sock *sk;
1326	int err = 0;
1327
1328	if (sock->state != SS_UNCONNECTED)
1329		return -EINVAL;
1330
1331	if ((sk = sock->sk) == NULL)
1332		return -EINVAL;
1333
1334	lock_sock(sk);
1335	if (sk->sk_type != SOCK_SEQPACKET) {
1336		err = -EOPNOTSUPP;
1337		goto out;
1338	}
1339
1340	if (sk->sk_state != TCP_LISTEN) {
1341		err = -EINVAL;
1342		goto out;
1343	}
1344
1345	/*
1346	 *	The read queue this time is holding sockets ready to use
1347	 *	hooked into the SABM we saved
1348	 */
1349	for (;;) {
1350		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
1351		skb = skb_dequeue(&sk->sk_receive_queue);
1352		if (skb)
1353			break;
1354
1355		if (flags & O_NONBLOCK) {
1356			err = -EWOULDBLOCK;
1357			break;
1358		}
1359		if (!signal_pending(current)) {
1360			release_sock(sk);
1361			schedule();
1362			lock_sock(sk);
1363			continue;
1364		}
1365		err = -ERESTARTSYS;
1366		break;
1367	}
1368	finish_wait(sk_sleep(sk), &wait);
1369
1370	if (err)
1371		goto out;
1372
1373	newsk		 = skb->sk;
1374	sock_graft(newsk, newsock);
1375
1376	/* Now attach up the new socket */
1377	kfree_skb(skb);
1378	sk->sk_ack_backlog--;
1379	newsock->state = SS_CONNECTED;
1380
1381out:
1382	release_sock(sk);
1383
1384	return err;
1385}
1386
1387static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
1388	int *uaddr_len, int peer)
1389{
1390	struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)uaddr;
1391	struct sock *sk = sock->sk;
1392	unsigned char ndigi, i;
1393	ax25_cb *ax25;
1394	int err = 0;
1395
1396	memset(fsa, 0, sizeof(*fsa));
1397	lock_sock(sk);
1398	ax25 = ax25_sk(sk);
1399
1400	if (peer != 0) {
1401		if (sk->sk_state != TCP_ESTABLISHED) {
1402			err = -ENOTCONN;
1403			goto out;
1404		}
1405
1406		fsa->fsa_ax25.sax25_family = AF_AX25;
1407		fsa->fsa_ax25.sax25_call   = ax25->dest_addr;
1408
1409		if (ax25->digipeat != NULL) {
1410			ndigi = ax25->digipeat->ndigi;
1411			fsa->fsa_ax25.sax25_ndigis = ndigi;
1412			for (i = 0; i < ndigi; i++)
1413				fsa->fsa_digipeater[i] =
1414						ax25->digipeat->calls[i];
1415		}
1416	} else {
1417		fsa->fsa_ax25.sax25_family = AF_AX25;
1418		fsa->fsa_ax25.sax25_call   = ax25->source_addr;
1419		fsa->fsa_ax25.sax25_ndigis = 1;
1420		if (ax25->ax25_dev != NULL) {
1421			memcpy(&fsa->fsa_digipeater[0],
1422			       ax25->ax25_dev->dev->dev_addr, AX25_ADDR_LEN);
1423		} else {
1424			fsa->fsa_digipeater[0] = null_ax25_address;
1425		}
1426	}
1427	*uaddr_len = sizeof (struct full_sockaddr_ax25);
1428
1429out:
1430	release_sock(sk);
1431
1432	return err;
1433}
1434
1435static int ax25_sendmsg(struct kiocb *iocb, struct socket *sock,
1436			struct msghdr *msg, size_t len)
1437{
1438	DECLARE_SOCKADDR(struct sockaddr_ax25 *, usax, msg->msg_name);
1439	struct sock *sk = sock->sk;
1440	struct sockaddr_ax25 sax;
1441	struct sk_buff *skb;
1442	ax25_digi dtmp, *dp;
1443	ax25_cb *ax25;
1444	size_t size;
1445	int lv, err, addr_len = msg->msg_namelen;
1446
1447	if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_CMSG_COMPAT))
1448		return -EINVAL;
1449
1450	lock_sock(sk);
1451	ax25 = ax25_sk(sk);
1452
1453	if (sock_flag(sk, SOCK_ZAPPED)) {
1454		err = -EADDRNOTAVAIL;
1455		goto out;
1456	}
1457
1458	if (sk->sk_shutdown & SEND_SHUTDOWN) {
1459		send_sig(SIGPIPE, current, 0);
1460		err = -EPIPE;
1461		goto out;
1462	}
1463
1464	if (ax25->ax25_dev == NULL) {
1465		err = -ENETUNREACH;
1466		goto out;
1467	}
1468
1469	if (len > ax25->ax25_dev->dev->mtu) {
1470		err = -EMSGSIZE;
1471		goto out;
1472	}
1473
1474	if (usax != NULL) {
1475		if (usax->sax25_family != AF_AX25) {
1476			err = -EINVAL;
1477			goto out;
1478		}
1479
1480		if (addr_len == sizeof(struct sockaddr_ax25))
1481			/* ax25_sendmsg(): uses obsolete socket structure */
1482			;
1483		else if (addr_len != sizeof(struct full_sockaddr_ax25))
1484			/* support for old structure may go away some time
1485			 * ax25_sendmsg(): uses old (6 digipeater)
1486			 * socket structure.
1487			 */
1488			if ((addr_len < sizeof(struct sockaddr_ax25) + sizeof(ax25_address) * 6) ||
1489			    (addr_len > sizeof(struct full_sockaddr_ax25))) {
1490				err = -EINVAL;
1491				goto out;
1492			}
1493
1494
1495		if (addr_len > sizeof(struct sockaddr_ax25) && usax->sax25_ndigis != 0) {
1496			int ct           = 0;
1497			struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax;
1498
1499			/* Valid number of digipeaters ? */
1500			if (usax->sax25_ndigis < 1 || usax->sax25_ndigis > AX25_MAX_DIGIS) {
1501				err = -EINVAL;
1502				goto out;
1503			}
1504
1505			dtmp.ndigi      = usax->sax25_ndigis;
1506
1507			while (ct < usax->sax25_ndigis) {
1508				dtmp.repeated[ct] = 0;
1509				dtmp.calls[ct]    = fsa->fsa_digipeater[ct];
1510				ct++;
1511			}
1512
1513			dtmp.lastrepeat = 0;
1514		}
1515
1516		sax = *usax;
1517		if (sk->sk_type == SOCK_SEQPACKET &&
1518		    ax25cmp(&ax25->dest_addr, &sax.sax25_call)) {
1519			err = -EISCONN;
1520			goto out;
1521		}
1522		if (usax->sax25_ndigis == 0)
1523			dp = NULL;
1524		else
1525			dp = &dtmp;
1526	} else {
1527		/*
1528		 *	FIXME: 1003.1g - if the socket is like this because
1529		 *	it has become closed (not started closed) and is VC
1530		 *	we ought to SIGPIPE, EPIPE
1531		 */
1532		if (sk->sk_state != TCP_ESTABLISHED) {
1533			err = -ENOTCONN;
1534			goto out;
1535		}
1536		sax.sax25_family = AF_AX25;
1537		sax.sax25_call   = ax25->dest_addr;
1538		dp = ax25->digipeat;
1539	}
1540
1541	/* Build a packet */
1542	/* Assume the worst case */
1543	size = len + ax25->ax25_dev->dev->hard_header_len;
1544
1545	skb = sock_alloc_send_skb(sk, size, msg->msg_flags&MSG_DONTWAIT, &err);
1546	if (skb == NULL)
1547		goto out;
1548
1549	skb_reserve(skb, size - len);
1550
1551	/* User data follows immediately after the AX.25 data */
1552	if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
1553		err = -EFAULT;
1554		kfree_skb(skb);
1555		goto out;
1556	}
1557
1558	skb_reset_network_header(skb);
1559
1560	/* Add the PID if one is not supplied by the user in the skb */
1561	if (!ax25->pidincl)
1562		*skb_push(skb, 1) = sk->sk_protocol;
1563
1564	if (sk->sk_type == SOCK_SEQPACKET) {
1565		/* Connected mode sockets go via the LAPB machine */
1566		if (sk->sk_state != TCP_ESTABLISHED) {
1567			kfree_skb(skb);
1568			err = -ENOTCONN;
1569			goto out;
1570		}
1571
1572		/* Shove it onto the queue and kick */
1573		ax25_output(ax25, ax25->paclen, skb);
1574
1575		err = len;
1576		goto out;
1577	}
1578
1579	skb_push(skb, 1 + ax25_addr_size(dp));
1580
1581	/* Building AX.25 Header */
1582
1583	/* Build an AX.25 header */
1584	lv = ax25_addr_build(skb->data, &ax25->source_addr, &sax.sax25_call,
1585			     dp, AX25_COMMAND, AX25_MODULUS);
1586
1587	skb_set_transport_header(skb, lv);
1588
1589	*skb_transport_header(skb) = AX25_UI;
1590
1591	/* Datagram frames go straight out of the door as UI */
1592	ax25_queue_xmit(skb, ax25->ax25_dev->dev);
1593
1594	err = len;
1595
1596out:
1597	release_sock(sk);
1598
1599	return err;
1600}
1601
1602static int ax25_recvmsg(struct kiocb *iocb, struct socket *sock,
1603	struct msghdr *msg, size_t size, int flags)
1604{
1605	struct sock *sk = sock->sk;
1606	struct sk_buff *skb;
1607	int copied;
1608	int err = 0;
1609
1610	lock_sock(sk);
1611	/*
1612	 * 	This works for seqpacket too. The receiver has ordered the
1613	 *	queue for us! We do one quick check first though
1614	 */
1615	if (sk->sk_type == SOCK_SEQPACKET && sk->sk_state != TCP_ESTABLISHED) {
1616		err =  -ENOTCONN;
1617		goto out;
1618	}
1619
1620	/* Now we can treat all alike */
1621	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
1622				flags & MSG_DONTWAIT, &err);
1623	if (skb == NULL)
1624		goto out;
1625
1626	if (!ax25_sk(sk)->pidincl)
1627		skb_pull(skb, 1);		/* Remove PID */
1628
1629	skb_reset_transport_header(skb);
1630	copied = skb->len;
1631
1632	if (copied > size) {
1633		copied = size;
1634		msg->msg_flags |= MSG_TRUNC;
1635	}
1636
1637	skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1638
1639	if (msg->msg_name) {
1640		ax25_digi digi;
1641		ax25_address src;
1642		const unsigned char *mac = skb_mac_header(skb);
1643		DECLARE_SOCKADDR(struct sockaddr_ax25 *, sax, msg->msg_name);
1644
1645		memset(sax, 0, sizeof(struct full_sockaddr_ax25));
1646		ax25_addr_parse(mac + 1, skb->data - mac - 1, &src, NULL,
1647				&digi, NULL, NULL);
1648		sax->sax25_family = AF_AX25;
1649		/* We set this correctly, even though we may not let the
1650		   application know the digi calls further down (because it
1651		   did NOT ask to know them).  This could get political... **/
1652		sax->sax25_ndigis = digi.ndigi;
1653		sax->sax25_call   = src;
1654
1655		if (sax->sax25_ndigis != 0) {
1656			int ct;
1657			struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)sax;
1658
1659			for (ct = 0; ct < digi.ndigi; ct++)
1660				fsa->fsa_digipeater[ct] = digi.calls[ct];
1661		}
1662		msg->msg_namelen = sizeof(struct full_sockaddr_ax25);
1663	}
1664
1665	skb_free_datagram(sk, skb);
1666	err = copied;
1667
1668out:
1669	release_sock(sk);
1670
1671	return err;
1672}
1673
1674static int ax25_shutdown(struct socket *sk, int how)
1675{
1676	/* FIXME - generate DM and RNR states */
1677	return -EOPNOTSUPP;
1678}
1679
1680static int ax25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
1681{
1682	struct sock *sk = sock->sk;
1683	void __user *argp = (void __user *)arg;
1684	int res = 0;
1685
1686	lock_sock(sk);
1687	switch (cmd) {
1688	case TIOCOUTQ: {
1689		long amount;
1690
1691		amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
1692		if (amount < 0)
1693			amount = 0;
1694		res = put_user(amount, (int __user *)argp);
1695		break;
1696	}
1697
1698	case TIOCINQ: {
1699		struct sk_buff *skb;
1700		long amount = 0L;
1701		/* These two are safe on a single CPU system as only user tasks fiddle here */
1702		if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL)
1703			amount = skb->len;
1704		res = put_user(amount, (int __user *) argp);
1705		break;
1706	}
1707
1708	case SIOCGSTAMP:
1709		res = sock_get_timestamp(sk, argp);
1710		break;
1711
1712	case SIOCGSTAMPNS:
1713		res = sock_get_timestampns(sk, argp);
1714		break;
1715
1716	case SIOCAX25ADDUID:	/* Add a uid to the uid/call map table */
1717	case SIOCAX25DELUID:	/* Delete a uid from the uid/call map table */
1718	case SIOCAX25GETUID: {
1719		struct sockaddr_ax25 sax25;
1720		if (copy_from_user(&sax25, argp, sizeof(sax25))) {
1721			res = -EFAULT;
1722			break;
1723		}
1724		res = ax25_uid_ioctl(cmd, &sax25);
1725		break;
1726	}
1727
1728	case SIOCAX25NOUID: {	/* Set the default policy (default/bar) */
1729		long amount;
1730		if (!capable(CAP_NET_ADMIN)) {
1731			res = -EPERM;
1732			break;
1733		}
1734		if (get_user(amount, (long __user *)argp)) {
1735			res = -EFAULT;
1736			break;
1737		}
1738		if (amount < 0 || amount > AX25_NOUID_BLOCK) {
1739			res = -EINVAL;
1740			break;
1741		}
1742		ax25_uid_policy = amount;
1743		res = 0;
1744		break;
1745	}
1746
1747	case SIOCADDRT:
1748	case SIOCDELRT:
1749	case SIOCAX25OPTRT:
1750		if (!capable(CAP_NET_ADMIN)) {
1751			res = -EPERM;
1752			break;
1753		}
1754		res = ax25_rt_ioctl(cmd, argp);
1755		break;
1756
1757	case SIOCAX25CTLCON:
1758		if (!capable(CAP_NET_ADMIN)) {
1759			res = -EPERM;
1760			break;
1761		}
1762		res = ax25_ctl_ioctl(cmd, argp);
1763		break;
1764
1765	case SIOCAX25GETINFO:
1766	case SIOCAX25GETINFOOLD: {
1767		ax25_cb *ax25 = ax25_sk(sk);
1768		struct ax25_info_struct ax25_info;
1769
1770		ax25_info.t1        = ax25->t1   / HZ;
1771		ax25_info.t2        = ax25->t2   / HZ;
1772		ax25_info.t3        = ax25->t3   / HZ;
1773		ax25_info.idle      = ax25->idle / (60 * HZ);
1774		ax25_info.n2        = ax25->n2;
1775		ax25_info.t1timer   = ax25_display_timer(&ax25->t1timer)   / HZ;
1776		ax25_info.t2timer   = ax25_display_timer(&ax25->t2timer)   / HZ;
1777		ax25_info.t3timer   = ax25_display_timer(&ax25->t3timer)   / HZ;
1778		ax25_info.idletimer = ax25_display_timer(&ax25->idletimer) / (60 * HZ);
1779		ax25_info.n2count   = ax25->n2count;
1780		ax25_info.state     = ax25->state;
1781		ax25_info.rcv_q     = sk_rmem_alloc_get(sk);
1782		ax25_info.snd_q     = sk_wmem_alloc_get(sk);
1783		ax25_info.vs        = ax25->vs;
1784		ax25_info.vr        = ax25->vr;
1785		ax25_info.va        = ax25->va;
1786		ax25_info.vs_max    = ax25->vs; /* reserved */
1787		ax25_info.paclen    = ax25->paclen;
1788		ax25_info.window    = ax25->window;
1789
1790		/* old structure? */
1791		if (cmd == SIOCAX25GETINFOOLD) {
1792			static int warned = 0;
1793			if (!warned) {
1794				printk(KERN_INFO "%s uses old SIOCAX25GETINFO\n",
1795					current->comm);
1796				warned=1;
1797			}
1798
1799			if (copy_to_user(argp, &ax25_info, sizeof(struct ax25_info_struct_deprecated))) {
1800				res = -EFAULT;
1801				break;
1802			}
1803		} else {
1804			if (copy_to_user(argp, &ax25_info, sizeof(struct ax25_info_struct))) {
1805				res = -EINVAL;
1806				break;
1807			}
1808		}
1809		res = 0;
1810		break;
1811	}
1812
1813	case SIOCAX25ADDFWD:
1814	case SIOCAX25DELFWD: {
1815		struct ax25_fwd_struct ax25_fwd;
1816		if (!capable(CAP_NET_ADMIN)) {
1817			res = -EPERM;
1818			break;
1819		}
1820		if (copy_from_user(&ax25_fwd, argp, sizeof(ax25_fwd))) {
1821			res = -EFAULT;
1822			break;
1823		}
1824		res = ax25_fwd_ioctl(cmd, &ax25_fwd);
1825		break;
1826	}
1827
1828	case SIOCGIFADDR:
1829	case SIOCSIFADDR:
1830	case SIOCGIFDSTADDR:
1831	case SIOCSIFDSTADDR:
1832	case SIOCGIFBRDADDR:
1833	case SIOCSIFBRDADDR:
1834	case SIOCGIFNETMASK:
1835	case SIOCSIFNETMASK:
1836	case SIOCGIFMETRIC:
1837	case SIOCSIFMETRIC:
1838		res = -EINVAL;
1839		break;
1840
1841	default:
1842		res = -ENOIOCTLCMD;
1843		break;
1844	}
1845	release_sock(sk);
1846
1847	return res;
1848}
1849
1850#ifdef CONFIG_PROC_FS
1851
1852static void *ax25_info_start(struct seq_file *seq, loff_t *pos)
1853	__acquires(ax25_list_lock)
1854{
1855	spin_lock_bh(&ax25_list_lock);
1856	return seq_hlist_start(&ax25_list, *pos);
1857}
1858
1859static void *ax25_info_next(struct seq_file *seq, void *v, loff_t *pos)
1860{
1861	return seq_hlist_next(v, &ax25_list, pos);
1862}
1863
1864static void ax25_info_stop(struct seq_file *seq, void *v)
1865	__releases(ax25_list_lock)
1866{
1867	spin_unlock_bh(&ax25_list_lock);
1868}
1869
1870static int ax25_info_show(struct seq_file *seq, void *v)
1871{
1872	ax25_cb *ax25 = hlist_entry(v, struct ax25_cb, ax25_node);
1873	char buf[11];
1874	int k;
1875
1876
1877	/*
1878	 * New format:
1879	 * magic dev src_addr dest_addr,digi1,digi2,.. st vs vr va t1 t1 t2 t2 t3 t3 idle idle n2 n2 rtt window paclen Snd-Q Rcv-Q inode
1880	 */
1881
1882	seq_printf(seq, "%8.8lx %s %s%s ",
1883		   (long) ax25,
1884		   ax25->ax25_dev == NULL? "???" : ax25->ax25_dev->dev->name,
1885		   ax2asc(buf, &ax25->source_addr),
1886		   ax25->iamdigi? "*":"");
1887	seq_printf(seq, "%s", ax2asc(buf, &ax25->dest_addr));
1888
1889	for (k=0; (ax25->digipeat != NULL) && (k < ax25->digipeat->ndigi); k++) {
1890		seq_printf(seq, ",%s%s",
1891			   ax2asc(buf, &ax25->digipeat->calls[k]),
1892			   ax25->digipeat->repeated[k]? "*":"");
1893	}
1894
1895	seq_printf(seq, " %d %d %d %d %lu %lu %lu %lu %lu %lu %lu %lu %d %d %lu %d %d",
1896		   ax25->state,
1897		   ax25->vs, ax25->vr, ax25->va,
1898		   ax25_display_timer(&ax25->t1timer) / HZ, ax25->t1 / HZ,
1899		   ax25_display_timer(&ax25->t2timer) / HZ, ax25->t2 / HZ,
1900		   ax25_display_timer(&ax25->t3timer) / HZ, ax25->t3 / HZ,
1901		   ax25_display_timer(&ax25->idletimer) / (60 * HZ),
1902		   ax25->idle / (60 * HZ),
1903		   ax25->n2count, ax25->n2,
1904		   ax25->rtt / HZ,
1905		   ax25->window,
1906		   ax25->paclen);
1907
1908	if (ax25->sk != NULL) {
1909		seq_printf(seq, " %d %d %lu\n",
1910			   sk_wmem_alloc_get(ax25->sk),
1911			   sk_rmem_alloc_get(ax25->sk),
1912			   sock_i_ino(ax25->sk));
1913	} else {
1914		seq_puts(seq, " * * *\n");
1915	}
1916	return 0;
1917}
1918
1919static const struct seq_operations ax25_info_seqops = {
1920	.start = ax25_info_start,
1921	.next = ax25_info_next,
1922	.stop = ax25_info_stop,
1923	.show = ax25_info_show,
1924};
1925
1926static int ax25_info_open(struct inode *inode, struct file *file)
1927{
1928	return seq_open(file, &ax25_info_seqops);
1929}
1930
1931static const struct file_operations ax25_info_fops = {
1932	.owner = THIS_MODULE,
1933	.open = ax25_info_open,
1934	.read = seq_read,
1935	.llseek = seq_lseek,
1936	.release = seq_release,
1937};
1938
1939#endif
1940
1941static const struct net_proto_family ax25_family_ops = {
1942	.family =	PF_AX25,
1943	.create =	ax25_create,
1944	.owner	=	THIS_MODULE,
1945};
1946
1947static const struct proto_ops ax25_proto_ops = {
1948	.family		= PF_AX25,
1949	.owner		= THIS_MODULE,
1950	.release	= ax25_release,
1951	.bind		= ax25_bind,
1952	.connect	= ax25_connect,
1953	.socketpair	= sock_no_socketpair,
1954	.accept		= ax25_accept,
1955	.getname	= ax25_getname,
1956	.poll		= datagram_poll,
1957	.ioctl		= ax25_ioctl,
1958	.listen		= ax25_listen,
1959	.shutdown	= ax25_shutdown,
1960	.setsockopt	= ax25_setsockopt,
1961	.getsockopt	= ax25_getsockopt,
1962	.sendmsg	= ax25_sendmsg,
1963	.recvmsg	= ax25_recvmsg,
1964	.mmap		= sock_no_mmap,
1965	.sendpage	= sock_no_sendpage,
1966};
1967
1968/*
1969 *	Called by socket.c on kernel start up
1970 */
1971static struct packet_type ax25_packet_type __read_mostly = {
1972	.type	=	cpu_to_be16(ETH_P_AX25),
1973	.func	=	ax25_kiss_rcv,
1974};
1975
1976static struct notifier_block ax25_dev_notifier = {
1977	.notifier_call = ax25_device_event,
1978};
1979
1980static int __init ax25_init(void)
1981{
1982	int rc = proto_register(&ax25_proto, 0);
1983
1984	if (rc != 0)
1985		goto out;
1986
1987	sock_register(&ax25_family_ops);
1988	dev_add_pack(&ax25_packet_type);
1989	register_netdevice_notifier(&ax25_dev_notifier);
1990
1991	proc_create("ax25_route", S_IRUGO, init_net.proc_net,
1992		    &ax25_route_fops);
1993	proc_create("ax25", S_IRUGO, init_net.proc_net, &ax25_info_fops);
1994	proc_create("ax25_calls", S_IRUGO, init_net.proc_net, &ax25_uid_fops);
1995out:
1996	return rc;
1997}
1998module_init(ax25_init);
1999
2000
2001MODULE_AUTHOR("Jonathan Naylor G4KLX <g4klx@g4klx.demon.co.uk>");
2002MODULE_DESCRIPTION("The amateur radio AX.25 link layer protocol");
2003MODULE_LICENSE("GPL");
2004MODULE_ALIAS_NETPROTO(PF_AX25);
2005
2006static void __exit ax25_exit(void)
2007{
2008	remove_proc_entry("ax25_route", init_net.proc_net);
2009	remove_proc_entry("ax25", init_net.proc_net);
2010	remove_proc_entry("ax25_calls", init_net.proc_net);
2011
2012	unregister_netdevice_notifier(&ax25_dev_notifier);
2013
2014	dev_remove_pack(&ax25_packet_type);
2015
2016	sock_unregister(PF_AX25);
2017	proto_unregister(&ax25_proto);
2018
2019	ax25_rt_free();
2020	ax25_uid_free();
2021	ax25_dev_free();
2022}
2023module_exit(ax25_exit);