Linux Audio

Check our new training course

Linux BSP upgrade and security maintenance

Need help to get security updates for your Linux BSP?
Loading...
v5.14.15
   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 *	X.25 Packet Layer release 002
   4 *
   5 *	This is ALPHA test software. This code may break your machine,
   6 *	randomly fail to work with new releases, misbehave and/or generally
   7 *	screw up. It might even work.
   8 *
   9 *	This code REQUIRES 2.1.15 or higher
  10 *
 
 
 
 
 
 
  11 *	History
  12 *	X.25 001	Jonathan Naylor	Started coding.
  13 *	X.25 002	Jonathan Naylor	Centralised disconnect handling.
  14 *					New timer architecture.
  15 *	2000-03-11	Henner Eisen	MSG_EOR handling more POSIX compliant.
  16 *	2000-03-22	Daniela Squassoni Allowed disabling/enabling of
  17 *					  facilities negotiation and increased
  18 *					  the throughput upper limit.
  19 *	2000-08-27	Arnaldo C. Melo s/suser/capable/ + micro cleanups
  20 *	2000-09-04	Henner Eisen	Set sock->state in x25_accept().
  21 *					Fixed x25_output() related skb leakage.
  22 *	2000-10-02	Henner Eisen	Made x25_kick() single threaded per socket.
  23 *	2000-10-27	Henner Eisen    MSG_DONTWAIT for fragment allocation.
  24 *	2000-11-14	Henner Eisen    Closing datalink from NETDEV_GOING_DOWN
  25 *	2002-10-06	Arnaldo C. Melo Get rid of cli/sti, move proc stuff to
  26 *					x25_proc.c, using seq_file
  27 *	2005-04-02	Shaun Pereira	Selective sub address matching
  28 *					with call user data
  29 *	2005-04-15	Shaun Pereira	Fast select with no restriction on
  30 *					response
  31 */
  32
  33#define pr_fmt(fmt) "X25: " fmt
  34
  35#include <linux/module.h>
  36#include <linux/capability.h>
  37#include <linux/errno.h>
  38#include <linux/kernel.h>
  39#include <linux/sched/signal.h>
  40#include <linux/timer.h>
  41#include <linux/string.h>
  42#include <linux/net.h>
  43#include <linux/netdevice.h>
  44#include <linux/if_arp.h>
  45#include <linux/skbuff.h>
  46#include <linux/slab.h>
  47#include <net/sock.h>
  48#include <net/tcp_states.h>
  49#include <linux/uaccess.h>
  50#include <linux/fcntl.h>
  51#include <linux/termios.h>	/* For TIOCINQ/OUTQ */
  52#include <linux/notifier.h>
  53#include <linux/init.h>
  54#include <linux/compat.h>
  55#include <linux/ctype.h>
  56
  57#include <net/x25.h>
  58#include <net/compat.h>
  59
  60int sysctl_x25_restart_request_timeout = X25_DEFAULT_T20;
  61int sysctl_x25_call_request_timeout    = X25_DEFAULT_T21;
  62int sysctl_x25_reset_request_timeout   = X25_DEFAULT_T22;
  63int sysctl_x25_clear_request_timeout   = X25_DEFAULT_T23;
  64int sysctl_x25_ack_holdback_timeout    = X25_DEFAULT_T2;
  65int sysctl_x25_forward                 = 0;
  66
  67HLIST_HEAD(x25_list);
  68DEFINE_RWLOCK(x25_list_lock);
  69
  70static const struct proto_ops x25_proto_ops;
  71
  72static const struct x25_address null_x25_address = {"               "};
  73
  74#ifdef CONFIG_COMPAT
  75struct compat_x25_subscrip_struct {
  76	char device[200-sizeof(compat_ulong_t)];
  77	compat_ulong_t global_facil_mask;
  78	compat_uint_t extended;
  79};
  80#endif
  81
  82
  83int x25_parse_address_block(struct sk_buff *skb,
  84		struct x25_address *called_addr,
  85		struct x25_address *calling_addr)
  86{
  87	unsigned char len;
  88	int needed;
  89	int rc;
  90
  91	if (!pskb_may_pull(skb, 1)) {
  92		/* packet has no address block */
  93		rc = 0;
  94		goto empty;
  95	}
  96
  97	len = *skb->data;
  98	needed = 1 + ((len >> 4) + (len & 0x0f) + 1) / 2;
  99
 100	if (!pskb_may_pull(skb, needed)) {
 101		/* packet is too short to hold the addresses it claims
 102		   to hold */
 103		rc = -1;
 104		goto empty;
 105	}
 106
 107	return x25_addr_ntoa(skb->data, called_addr, calling_addr);
 108
 109empty:
 110	*called_addr->x25_addr = 0;
 111	*calling_addr->x25_addr = 0;
 112
 113	return rc;
 114}
 115
 116
 117int x25_addr_ntoa(unsigned char *p, struct x25_address *called_addr,
 118		  struct x25_address *calling_addr)
 119{
 120	unsigned int called_len, calling_len;
 121	char *called, *calling;
 122	unsigned int i;
 123
 124	called_len  = (*p >> 0) & 0x0F;
 125	calling_len = (*p >> 4) & 0x0F;
 126
 127	called  = called_addr->x25_addr;
 128	calling = calling_addr->x25_addr;
 129	p++;
 130
 131	for (i = 0; i < (called_len + calling_len); i++) {
 132		if (i < called_len) {
 133			if (i % 2 != 0) {
 134				*called++ = ((*p >> 0) & 0x0F) + '0';
 135				p++;
 136			} else {
 137				*called++ = ((*p >> 4) & 0x0F) + '0';
 138			}
 139		} else {
 140			if (i % 2 != 0) {
 141				*calling++ = ((*p >> 0) & 0x0F) + '0';
 142				p++;
 143			} else {
 144				*calling++ = ((*p >> 4) & 0x0F) + '0';
 145			}
 146		}
 147	}
 148
 149	*called = *calling = '\0';
 150
 151	return 1 + (called_len + calling_len + 1) / 2;
 152}
 153
 154int x25_addr_aton(unsigned char *p, struct x25_address *called_addr,
 155		  struct x25_address *calling_addr)
 156{
 157	unsigned int called_len, calling_len;
 158	char *called, *calling;
 159	int i;
 160
 161	called  = called_addr->x25_addr;
 162	calling = calling_addr->x25_addr;
 163
 164	called_len  = strlen(called);
 165	calling_len = strlen(calling);
 166
 167	*p++ = (calling_len << 4) | (called_len << 0);
 168
 169	for (i = 0; i < (called_len + calling_len); i++) {
 170		if (i < called_len) {
 171			if (i % 2 != 0) {
 172				*p |= (*called++ - '0') << 0;
 173				p++;
 174			} else {
 175				*p = 0x00;
 176				*p |= (*called++ - '0') << 4;
 177			}
 178		} else {
 179			if (i % 2 != 0) {
 180				*p |= (*calling++ - '0') << 0;
 181				p++;
 182			} else {
 183				*p = 0x00;
 184				*p |= (*calling++ - '0') << 4;
 185			}
 186		}
 187	}
 188
 189	return 1 + (called_len + calling_len + 1) / 2;
 190}
 191
 192/*
 193 *	Socket removal during an interrupt is now safe.
 194 */
 195static void x25_remove_socket(struct sock *sk)
 196{
 197	write_lock_bh(&x25_list_lock);
 198	sk_del_node_init(sk);
 199	write_unlock_bh(&x25_list_lock);
 200}
 201
 202/*
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 203 *	Handle device status changes.
 204 */
 205static int x25_device_event(struct notifier_block *this, unsigned long event,
 206			    void *ptr)
 207{
 208	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 209	struct x25_neigh *nb;
 210
 211	if (!net_eq(dev_net(dev), &init_net))
 212		return NOTIFY_DONE;
 213
 214	if (dev->type == ARPHRD_X25) {
 
 
 
 
 215		switch (event) {
 216		case NETDEV_REGISTER:
 217		case NETDEV_POST_TYPE_CHANGE:
 218			x25_link_device_up(dev);
 219			break;
 220		case NETDEV_DOWN:
 221			nb = x25_get_neigh(dev);
 222			if (nb) {
 223				x25_link_terminated(nb);
 224				x25_neigh_put(nb);
 225			}
 226			x25_route_device_down(dev);
 227			break;
 228		case NETDEV_PRE_TYPE_CHANGE:
 229		case NETDEV_UNREGISTER:
 
 230			x25_link_device_down(dev);
 231			break;
 232		case NETDEV_CHANGE:
 233			if (!netif_carrier_ok(dev)) {
 234				nb = x25_get_neigh(dev);
 235				if (nb) {
 236					x25_link_terminated(nb);
 237					x25_neigh_put(nb);
 238				}
 239			}
 240			break;
 241		}
 242	}
 243
 244	return NOTIFY_DONE;
 245}
 246
 247/*
 248 *	Add a socket to the bound sockets list.
 249 */
 250static void x25_insert_socket(struct sock *sk)
 251{
 252	write_lock_bh(&x25_list_lock);
 253	sk_add_node(sk, &x25_list);
 254	write_unlock_bh(&x25_list_lock);
 255}
 256
 257/*
 258 *	Find a socket that wants to accept the Call Request we just
 259 *	received. Check the full list for an address/cud match.
 260 *	If no cuds match return the next_best thing, an address match.
 261 *	Note: if a listening socket has cud set it must only get calls
 262 *	with matching cud.
 263 */
 264static struct sock *x25_find_listener(struct x25_address *addr,
 265					struct sk_buff *skb)
 266{
 267	struct sock *s;
 268	struct sock *next_best;
 269
 270	read_lock_bh(&x25_list_lock);
 271	next_best = NULL;
 272
 273	sk_for_each(s, &x25_list)
 274		if ((!strcmp(addr->x25_addr,
 275			x25_sk(s)->source_addr.x25_addr) ||
 276				!strcmp(x25_sk(s)->source_addr.x25_addr,
 277					null_x25_address.x25_addr)) &&
 278					s->sk_state == TCP_LISTEN) {
 279			/*
 280			 * Found a listening socket, now check the incoming
 281			 * call user data vs this sockets call user data
 282			 */
 283			if (x25_sk(s)->cudmatchlength > 0 &&
 284				skb->len >= x25_sk(s)->cudmatchlength) {
 285				if((memcmp(x25_sk(s)->calluserdata.cuddata,
 286					skb->data,
 287					x25_sk(s)->cudmatchlength)) == 0) {
 288					sock_hold(s);
 289					goto found;
 290				 }
 291			} else
 292				next_best = s;
 293		}
 294	if (next_best) {
 295		s = next_best;
 296		sock_hold(s);
 297		goto found;
 298	}
 299	s = NULL;
 300found:
 301	read_unlock_bh(&x25_list_lock);
 302	return s;
 303}
 304
 305/*
 306 *	Find a connected X.25 socket given my LCI and neighbour.
 307 */
 308static struct sock *__x25_find_socket(unsigned int lci, struct x25_neigh *nb)
 309{
 310	struct sock *s;
 311
 312	sk_for_each(s, &x25_list)
 313		if (x25_sk(s)->lci == lci && x25_sk(s)->neighbour == nb) {
 314			sock_hold(s);
 315			goto found;
 316		}
 317	s = NULL;
 318found:
 319	return s;
 320}
 321
 322struct sock *x25_find_socket(unsigned int lci, struct x25_neigh *nb)
 323{
 324	struct sock *s;
 325
 326	read_lock_bh(&x25_list_lock);
 327	s = __x25_find_socket(lci, nb);
 328	read_unlock_bh(&x25_list_lock);
 329	return s;
 330}
 331
 332/*
 333 *	Find a unique LCI for a given device.
 334 */
 335static unsigned int x25_new_lci(struct x25_neigh *nb)
 336{
 337	unsigned int lci = 1;
 338	struct sock *sk;
 339
 340	while ((sk = x25_find_socket(lci, nb)) != NULL) {
 
 
 341		sock_put(sk);
 342		if (++lci == 4096) {
 343			lci = 0;
 344			break;
 345		}
 346		cond_resched();
 347	}
 348
 
 349	return lci;
 350}
 351
 352/*
 353 *	Deferred destroy.
 354 */
 355static void __x25_destroy_socket(struct sock *);
 356
 357/*
 358 *	handler for deferred kills.
 359 */
 360static void x25_destroy_timer(struct timer_list *t)
 361{
 362	struct sock *sk = from_timer(sk, t, sk_timer);
 363
 364	x25_destroy_socket_from_timer(sk);
 365}
 366
 367/*
 368 *	This is called from user mode and the timers. Thus it protects itself
 369 *	against interrupting users but doesn't worry about being called during
 370 *	work. Once it is removed from the queue no interrupt or bottom half
 371 *	will touch it and we are (fairly 8-) ) safe.
 372 *	Not static as it's used by the timer
 373 */
 374static void __x25_destroy_socket(struct sock *sk)
 375{
 376	struct sk_buff *skb;
 377
 378	x25_stop_heartbeat(sk);
 379	x25_stop_timer(sk);
 380
 381	x25_remove_socket(sk);
 382	x25_clear_queues(sk);		/* Flush the queues */
 383
 384	while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
 385		if (skb->sk != sk) {		/* A pending connection */
 386			/*
 387			 * Queue the unaccepted socket for death
 388			 */
 389			skb->sk->sk_state = TCP_LISTEN;
 390			sock_set_flag(skb->sk, SOCK_DEAD);
 391			x25_start_heartbeat(skb->sk);
 392			x25_sk(skb->sk)->state = X25_STATE_0;
 393		}
 394
 395		kfree_skb(skb);
 396	}
 397
 398	if (sk_has_allocations(sk)) {
 399		/* Defer: outstanding buffers */
 400		sk->sk_timer.expires  = jiffies + 10 * HZ;
 401		sk->sk_timer.function = x25_destroy_timer;
 402		add_timer(&sk->sk_timer);
 403	} else {
 404		/* drop last reference so sock_put will free */
 405		__sock_put(sk);
 406	}
 407}
 408
 409void x25_destroy_socket_from_timer(struct sock *sk)
 410{
 411	sock_hold(sk);
 412	bh_lock_sock(sk);
 413	__x25_destroy_socket(sk);
 414	bh_unlock_sock(sk);
 415	sock_put(sk);
 416}
 417
 418/*
 419 *	Handling for system calls applied via the various interfaces to a
 420 *	X.25 socket object.
 421 */
 422
 423static int x25_setsockopt(struct socket *sock, int level, int optname,
 424			  sockptr_t optval, unsigned int optlen)
 425{
 426	int opt;
 427	struct sock *sk = sock->sk;
 428	int rc = -ENOPROTOOPT;
 429
 430	if (level != SOL_X25 || optname != X25_QBITINCL)
 431		goto out;
 432
 433	rc = -EINVAL;
 434	if (optlen < sizeof(int))
 435		goto out;
 436
 437	rc = -EFAULT;
 438	if (copy_from_sockptr(&opt, optval, sizeof(int)))
 439		goto out;
 440
 441	if (opt)
 442		set_bit(X25_Q_BIT_FLAG, &x25_sk(sk)->flags);
 443	else
 444		clear_bit(X25_Q_BIT_FLAG, &x25_sk(sk)->flags);
 445	rc = 0;
 446out:
 447	return rc;
 448}
 449
 450static int x25_getsockopt(struct socket *sock, int level, int optname,
 451			  char __user *optval, int __user *optlen)
 452{
 453	struct sock *sk = sock->sk;
 454	int val, len, rc = -ENOPROTOOPT;
 455
 456	if (level != SOL_X25 || optname != X25_QBITINCL)
 457		goto out;
 458
 459	rc = -EFAULT;
 460	if (get_user(len, optlen))
 461		goto out;
 462
 463	len = min_t(unsigned int, len, sizeof(int));
 464
 465	rc = -EINVAL;
 466	if (len < 0)
 467		goto out;
 468
 469	rc = -EFAULT;
 470	if (put_user(len, optlen))
 471		goto out;
 472
 473	val = test_bit(X25_Q_BIT_FLAG, &x25_sk(sk)->flags);
 474	rc = copy_to_user(optval, &val, len) ? -EFAULT : 0;
 475out:
 476	return rc;
 477}
 478
 479static int x25_listen(struct socket *sock, int backlog)
 480{
 481	struct sock *sk = sock->sk;
 482	int rc = -EOPNOTSUPP;
 483
 484	lock_sock(sk);
 485	if (sk->sk_state != TCP_LISTEN) {
 486		memset(&x25_sk(sk)->dest_addr, 0, X25_ADDR_LEN);
 487		sk->sk_max_ack_backlog = backlog;
 488		sk->sk_state           = TCP_LISTEN;
 489		rc = 0;
 490	}
 491	release_sock(sk);
 492
 493	return rc;
 494}
 495
 496static struct proto x25_proto = {
 497	.name	  = "X25",
 498	.owner	  = THIS_MODULE,
 499	.obj_size = sizeof(struct x25_sock),
 500};
 501
 502static struct sock *x25_alloc_socket(struct net *net, int kern)
 503{
 504	struct x25_sock *x25;
 505	struct sock *sk = sk_alloc(net, AF_X25, GFP_ATOMIC, &x25_proto, kern);
 506
 507	if (!sk)
 508		goto out;
 509
 510	sock_init_data(NULL, sk);
 511
 512	x25 = x25_sk(sk);
 513	skb_queue_head_init(&x25->ack_queue);
 514	skb_queue_head_init(&x25->fragment_queue);
 515	skb_queue_head_init(&x25->interrupt_in_queue);
 516	skb_queue_head_init(&x25->interrupt_out_queue);
 517out:
 518	return sk;
 519}
 520
 521static int x25_create(struct net *net, struct socket *sock, int protocol,
 522		      int kern)
 523{
 524	struct sock *sk;
 525	struct x25_sock *x25;
 526	int rc = -EAFNOSUPPORT;
 527
 528	if (!net_eq(net, &init_net))
 529		goto out;
 530
 531	rc = -ESOCKTNOSUPPORT;
 532	if (sock->type != SOCK_SEQPACKET)
 533		goto out;
 534
 535	rc = -EINVAL;
 536	if (protocol)
 537		goto out;
 538
 539	rc = -ENOMEM;
 540	if ((sk = x25_alloc_socket(net, kern)) == NULL)
 541		goto out;
 542
 543	x25 = x25_sk(sk);
 544
 545	sock_init_data(sock, sk);
 546
 547	x25_init_timers(sk);
 548
 549	sock->ops    = &x25_proto_ops;
 550	sk->sk_protocol = protocol;
 551	sk->sk_backlog_rcv = x25_backlog_rcv;
 552
 553	x25->t21   = sysctl_x25_call_request_timeout;
 554	x25->t22   = sysctl_x25_reset_request_timeout;
 555	x25->t23   = sysctl_x25_clear_request_timeout;
 556	x25->t2    = sysctl_x25_ack_holdback_timeout;
 557	x25->state = X25_STATE_0;
 558	x25->cudmatchlength = 0;
 559	set_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);	/* normally no cud  */
 560							/* on call accept   */
 561
 562	x25->facilities.winsize_in  = X25_DEFAULT_WINDOW_SIZE;
 563	x25->facilities.winsize_out = X25_DEFAULT_WINDOW_SIZE;
 564	x25->facilities.pacsize_in  = X25_DEFAULT_PACKET_SIZE;
 565	x25->facilities.pacsize_out = X25_DEFAULT_PACKET_SIZE;
 566	x25->facilities.throughput  = 0;	/* by default don't negotiate
 567						   throughput */
 568	x25->facilities.reverse     = X25_DEFAULT_REVERSE;
 569	x25->dte_facilities.calling_len = 0;
 570	x25->dte_facilities.called_len = 0;
 571	memset(x25->dte_facilities.called_ae, '\0',
 572			sizeof(x25->dte_facilities.called_ae));
 573	memset(x25->dte_facilities.calling_ae, '\0',
 574			sizeof(x25->dte_facilities.calling_ae));
 575
 576	rc = 0;
 577out:
 578	return rc;
 579}
 580
 581static struct sock *x25_make_new(struct sock *osk)
 582{
 583	struct sock *sk = NULL;
 584	struct x25_sock *x25, *ox25;
 585
 586	if (osk->sk_type != SOCK_SEQPACKET)
 587		goto out;
 588
 589	if ((sk = x25_alloc_socket(sock_net(osk), 0)) == NULL)
 590		goto out;
 591
 592	x25 = x25_sk(sk);
 593
 594	sk->sk_type        = osk->sk_type;
 595	sk->sk_priority    = osk->sk_priority;
 596	sk->sk_protocol    = osk->sk_protocol;
 597	sk->sk_rcvbuf      = osk->sk_rcvbuf;
 598	sk->sk_sndbuf      = osk->sk_sndbuf;
 599	sk->sk_state       = TCP_ESTABLISHED;
 600	sk->sk_backlog_rcv = osk->sk_backlog_rcv;
 601	sock_copy_flags(sk, osk);
 602
 603	ox25 = x25_sk(osk);
 604	x25->t21        = ox25->t21;
 605	x25->t22        = ox25->t22;
 606	x25->t23        = ox25->t23;
 607	x25->t2         = ox25->t2;
 608	x25->flags	= ox25->flags;
 609	x25->facilities = ox25->facilities;
 610	x25->dte_facilities = ox25->dte_facilities;
 611	x25->cudmatchlength = ox25->cudmatchlength;
 612
 613	clear_bit(X25_INTERRUPT_FLAG, &x25->flags);
 614	x25_init_timers(sk);
 615out:
 616	return sk;
 617}
 618
 619static int x25_release(struct socket *sock)
 620{
 621	struct sock *sk = sock->sk;
 622	struct x25_sock *x25;
 623
 624	if (!sk)
 625		return 0;
 626
 627	x25 = x25_sk(sk);
 628
 629	sock_hold(sk);
 630	lock_sock(sk);
 631	switch (x25->state) {
 632
 633		case X25_STATE_0:
 634		case X25_STATE_2:
 635			x25_disconnect(sk, 0, 0, 0);
 636			__x25_destroy_socket(sk);
 637			goto out;
 638
 639		case X25_STATE_1:
 640		case X25_STATE_3:
 641		case X25_STATE_4:
 642			x25_clear_queues(sk);
 643			x25_write_internal(sk, X25_CLEAR_REQUEST);
 644			x25_start_t23timer(sk);
 645			x25->state = X25_STATE_2;
 646			sk->sk_state	= TCP_CLOSE;
 647			sk->sk_shutdown	|= SEND_SHUTDOWN;
 648			sk->sk_state_change(sk);
 649			sock_set_flag(sk, SOCK_DEAD);
 650			sock_set_flag(sk, SOCK_DESTROY);
 651			break;
 652
 653		case X25_STATE_5:
 654			x25_write_internal(sk, X25_CLEAR_REQUEST);
 655			x25_disconnect(sk, 0, 0, 0);
 656			__x25_destroy_socket(sk);
 657			goto out;
 658	}
 659
 660	sock_orphan(sk);
 661out:
 662	release_sock(sk);
 663	sock_put(sk);
 664	return 0;
 665}
 666
 667static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 668{
 669	struct sock *sk = sock->sk;
 670	struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;
 671	int len, i, rc = 0;
 672
 673	if (addr_len != sizeof(struct sockaddr_x25) ||
 674	    addr->sx25_family != AF_X25 ||
 675	    strnlen(addr->sx25_addr.x25_addr, X25_ADDR_LEN) == X25_ADDR_LEN) {
 676		rc = -EINVAL;
 677		goto out;
 678	}
 679
 680	/* check for the null_x25_address */
 681	if (strcmp(addr->sx25_addr.x25_addr, null_x25_address.x25_addr)) {
 682
 683		len = strlen(addr->sx25_addr.x25_addr);
 684		for (i = 0; i < len; i++) {
 685			if (!isdigit(addr->sx25_addr.x25_addr[i])) {
 686				rc = -EINVAL;
 687				goto out;
 688			}
 689		}
 690	}
 691
 692	lock_sock(sk);
 693	if (sock_flag(sk, SOCK_ZAPPED)) {
 694		x25_sk(sk)->source_addr = addr->sx25_addr;
 695		x25_insert_socket(sk);
 696		sock_reset_flag(sk, SOCK_ZAPPED);
 697	} else {
 698		rc = -EINVAL;
 699	}
 700	release_sock(sk);
 701	SOCK_DEBUG(sk, "x25_bind: socket is bound\n");
 702out:
 703	return rc;
 704}
 705
 706static int x25_wait_for_connection_establishment(struct sock *sk)
 707{
 708	DECLARE_WAITQUEUE(wait, current);
 709	int rc;
 710
 711	add_wait_queue_exclusive(sk_sleep(sk), &wait);
 712	for (;;) {
 713		__set_current_state(TASK_INTERRUPTIBLE);
 714		rc = -ERESTARTSYS;
 715		if (signal_pending(current))
 716			break;
 717		rc = sock_error(sk);
 718		if (rc) {
 719			sk->sk_socket->state = SS_UNCONNECTED;
 720			break;
 721		}
 722		rc = 0;
 723		if (sk->sk_state != TCP_ESTABLISHED) {
 724			release_sock(sk);
 725			schedule();
 726			lock_sock(sk);
 727		} else
 728			break;
 729	}
 730	__set_current_state(TASK_RUNNING);
 731	remove_wait_queue(sk_sleep(sk), &wait);
 732	return rc;
 733}
 734
 735static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
 736		       int addr_len, int flags)
 737{
 738	struct sock *sk = sock->sk;
 739	struct x25_sock *x25 = x25_sk(sk);
 740	struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;
 741	struct x25_route *rt;
 742	int rc = 0;
 743
 744	lock_sock(sk);
 745	if (sk->sk_state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
 746		sock->state = SS_CONNECTED;
 747		goto out; /* Connect completed during a ERESTARTSYS event */
 748	}
 749
 750	rc = -ECONNREFUSED;
 751	if (sk->sk_state == TCP_CLOSE && sock->state == SS_CONNECTING) {
 752		sock->state = SS_UNCONNECTED;
 753		goto out;
 754	}
 755
 756	rc = -EISCONN;	/* No reconnect on a seqpacket socket */
 757	if (sk->sk_state == TCP_ESTABLISHED)
 758		goto out;
 759
 760	rc = -EALREADY;	/* Do nothing if call is already in progress */
 761	if (sk->sk_state == TCP_SYN_SENT)
 762		goto out;
 763
 764	sk->sk_state   = TCP_CLOSE;
 765	sock->state = SS_UNCONNECTED;
 766
 767	rc = -EINVAL;
 768	if (addr_len != sizeof(struct sockaddr_x25) ||
 769	    addr->sx25_family != AF_X25 ||
 770	    strnlen(addr->sx25_addr.x25_addr, X25_ADDR_LEN) == X25_ADDR_LEN)
 771		goto out;
 772
 773	rc = -ENETUNREACH;
 774	rt = x25_get_route(&addr->sx25_addr);
 775	if (!rt)
 776		goto out;
 777
 778	x25->neighbour = x25_get_neigh(rt->dev);
 779	if (!x25->neighbour)
 780		goto out_put_route;
 781
 782	x25_limit_facilities(&x25->facilities, x25->neighbour);
 783
 784	x25->lci = x25_new_lci(x25->neighbour);
 785	if (!x25->lci)
 786		goto out_put_neigh;
 787
 788	rc = -EINVAL;
 789	if (sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
 790		goto out_put_neigh;
 791
 792	if (!strcmp(x25->source_addr.x25_addr, null_x25_address.x25_addr))
 793		memset(&x25->source_addr, '\0', X25_ADDR_LEN);
 794
 795	x25->dest_addr = addr->sx25_addr;
 796
 797	/* Move to connecting socket, start sending Connect Requests */
 798	sock->state   = SS_CONNECTING;
 799	sk->sk_state  = TCP_SYN_SENT;
 800
 801	x25->state = X25_STATE_1;
 802
 803	x25_write_internal(sk, X25_CALL_REQUEST);
 804
 805	x25_start_heartbeat(sk);
 806	x25_start_t21timer(sk);
 807
 808	/* Now the loop */
 809	rc = -EINPROGRESS;
 810	if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK))
 811		goto out;
 812
 813	rc = x25_wait_for_connection_establishment(sk);
 814	if (rc)
 815		goto out_put_neigh;
 816
 817	sock->state = SS_CONNECTED;
 818	rc = 0;
 819out_put_neigh:
 820	if (rc && x25->neighbour) {
 821		read_lock_bh(&x25_list_lock);
 822		x25_neigh_put(x25->neighbour);
 823		x25->neighbour = NULL;
 824		read_unlock_bh(&x25_list_lock);
 825		x25->state = X25_STATE_0;
 826	}
 827out_put_route:
 828	x25_route_put(rt);
 829out:
 830	release_sock(sk);
 831	return rc;
 832}
 833
 834static int x25_wait_for_data(struct sock *sk, long timeout)
 835{
 836	DECLARE_WAITQUEUE(wait, current);
 837	int rc = 0;
 838
 839	add_wait_queue_exclusive(sk_sleep(sk), &wait);
 840	for (;;) {
 841		__set_current_state(TASK_INTERRUPTIBLE);
 842		if (sk->sk_shutdown & RCV_SHUTDOWN)
 843			break;
 844		rc = -ERESTARTSYS;
 845		if (signal_pending(current))
 846			break;
 847		rc = -EAGAIN;
 848		if (!timeout)
 849			break;
 850		rc = 0;
 851		if (skb_queue_empty(&sk->sk_receive_queue)) {
 852			release_sock(sk);
 853			timeout = schedule_timeout(timeout);
 854			lock_sock(sk);
 855		} else
 856			break;
 857	}
 858	__set_current_state(TASK_RUNNING);
 859	remove_wait_queue(sk_sleep(sk), &wait);
 860	return rc;
 861}
 862
 863static int x25_accept(struct socket *sock, struct socket *newsock, int flags,
 864		      bool kern)
 865{
 866	struct sock *sk = sock->sk;
 867	struct sock *newsk;
 868	struct sk_buff *skb;
 869	int rc = -EINVAL;
 870
 871	if (!sk)
 872		goto out;
 873
 874	rc = -EOPNOTSUPP;
 875	if (sk->sk_type != SOCK_SEQPACKET)
 876		goto out;
 877
 878	lock_sock(sk);
 879	rc = -EINVAL;
 880	if (sk->sk_state != TCP_LISTEN)
 881		goto out2;
 882
 883	rc = x25_wait_for_data(sk, sk->sk_rcvtimeo);
 884	if (rc)
 885		goto out2;
 886	skb = skb_dequeue(&sk->sk_receive_queue);
 887	rc = -EINVAL;
 888	if (!skb->sk)
 889		goto out2;
 890	newsk		 = skb->sk;
 891	sock_graft(newsk, newsock);
 892
 893	/* Now attach up the new socket */
 894	skb->sk = NULL;
 895	kfree_skb(skb);
 896	sk_acceptq_removed(sk);
 897	newsock->state = SS_CONNECTED;
 898	rc = 0;
 899out2:
 900	release_sock(sk);
 901out:
 902	return rc;
 903}
 904
 905static int x25_getname(struct socket *sock, struct sockaddr *uaddr,
 906		       int peer)
 907{
 908	struct sockaddr_x25 *sx25 = (struct sockaddr_x25 *)uaddr;
 909	struct sock *sk = sock->sk;
 910	struct x25_sock *x25 = x25_sk(sk);
 911	int rc = 0;
 912
 913	if (peer) {
 914		if (sk->sk_state != TCP_ESTABLISHED) {
 915			rc = -ENOTCONN;
 916			goto out;
 917		}
 918		sx25->sx25_addr = x25->dest_addr;
 919	} else
 920		sx25->sx25_addr = x25->source_addr;
 921
 922	sx25->sx25_family = AF_X25;
 923	rc = sizeof(*sx25);
 924
 925out:
 926	return rc;
 927}
 928
 929int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
 930			unsigned int lci)
 931{
 932	struct sock *sk;
 933	struct sock *make;
 934	struct x25_sock *makex25;
 935	struct x25_address source_addr, dest_addr;
 936	struct x25_facilities facilities;
 937	struct x25_dte_facilities dte_facilities;
 938	int len, addr_len, rc;
 939
 940	/*
 941	 *	Remove the LCI and frame type.
 942	 */
 943	skb_pull(skb, X25_STD_MIN_LEN);
 944
 945	/*
 946	 *	Extract the X.25 addresses and convert them to ASCII strings,
 947	 *	and remove them.
 948	 *
 949	 *	Address block is mandatory in call request packets
 950	 */
 951	addr_len = x25_parse_address_block(skb, &source_addr, &dest_addr);
 952	if (addr_len <= 0)
 953		goto out_clear_request;
 954	skb_pull(skb, addr_len);
 955
 956	/*
 957	 *	Get the length of the facilities, skip past them for the moment
 958	 *	get the call user data because this is needed to determine
 959	 *	the correct listener
 960	 *
 961	 *	Facilities length is mandatory in call request packets
 962	 */
 963	if (!pskb_may_pull(skb, 1))
 964		goto out_clear_request;
 965	len = skb->data[0] + 1;
 966	if (!pskb_may_pull(skb, len))
 967		goto out_clear_request;
 968	skb_pull(skb,len);
 969
 970	/*
 971	 *	Ensure that the amount of call user data is valid.
 972	 */
 973	if (skb->len > X25_MAX_CUD_LEN)
 974		goto out_clear_request;
 975
 976	/*
 977	 *	Get all the call user data so it can be used in
 978	 *	x25_find_listener and skb_copy_from_linear_data up ahead.
 979	 */
 980	if (!pskb_may_pull(skb, skb->len))
 981		goto out_clear_request;
 982
 983	/*
 984	 *	Find a listener for the particular address/cud pair.
 985	 */
 986	sk = x25_find_listener(&source_addr,skb);
 987	skb_push(skb,len);
 988
 989	if (sk != NULL && sk_acceptq_is_full(sk)) {
 990		goto out_sock_put;
 991	}
 992
 993	/*
 994	 *	We dont have any listeners for this incoming call.
 995	 *	Try forwarding it.
 996	 */
 997	if (sk == NULL) {
 998		skb_push(skb, addr_len + X25_STD_MIN_LEN);
 999		if (sysctl_x25_forward &&
1000				x25_forward_call(&dest_addr, nb, skb, lci) > 0)
1001		{
1002			/* Call was forwarded, dont process it any more */
1003			kfree_skb(skb);
1004			rc = 1;
1005			goto out;
1006		} else {
1007			/* No listeners, can't forward, clear the call */
1008			goto out_clear_request;
1009		}
1010	}
1011
1012	/*
1013	 *	Try to reach a compromise on the requested facilities.
1014	 */
1015	len = x25_negotiate_facilities(skb, sk, &facilities, &dte_facilities);
1016	if (len == -1)
1017		goto out_sock_put;
1018
1019	/*
1020	 * current neighbour/link might impose additional limits
1021	 * on certain facilities
1022	 */
1023
1024	x25_limit_facilities(&facilities, nb);
1025
1026	/*
1027	 *	Try to create a new socket.
1028	 */
1029	make = x25_make_new(sk);
1030	if (!make)
1031		goto out_sock_put;
1032
1033	/*
1034	 *	Remove the facilities
1035	 */
1036	skb_pull(skb, len);
1037
1038	skb->sk     = make;
1039	make->sk_state = TCP_ESTABLISHED;
1040
1041	makex25 = x25_sk(make);
1042	makex25->lci           = lci;
1043	makex25->dest_addr     = dest_addr;
1044	makex25->source_addr   = source_addr;
1045	x25_neigh_hold(nb);
1046	makex25->neighbour     = nb;
1047	makex25->facilities    = facilities;
1048	makex25->dte_facilities= dte_facilities;
1049	makex25->vc_facil_mask = x25_sk(sk)->vc_facil_mask;
1050	/* ensure no reverse facil on accept */
1051	makex25->vc_facil_mask &= ~X25_MASK_REVERSE;
1052	/* ensure no calling address extension on accept */
1053	makex25->vc_facil_mask &= ~X25_MASK_CALLING_AE;
1054	makex25->cudmatchlength = x25_sk(sk)->cudmatchlength;
1055
1056	/* Normally all calls are accepted immediately */
1057	if (test_bit(X25_ACCPT_APPRV_FLAG, &makex25->flags)) {
1058		x25_write_internal(make, X25_CALL_ACCEPTED);
1059		makex25->state = X25_STATE_3;
1060	} else {
1061		makex25->state = X25_STATE_5;
1062	}
1063
1064	/*
1065	 *	Incoming Call User Data.
1066	 */
1067	skb_copy_from_linear_data(skb, makex25->calluserdata.cuddata, skb->len);
1068	makex25->calluserdata.cudlength = skb->len;
1069
1070	sk_acceptq_added(sk);
1071
1072	x25_insert_socket(make);
1073
1074	skb_queue_head(&sk->sk_receive_queue, skb);
1075
1076	x25_start_heartbeat(make);
1077
1078	if (!sock_flag(sk, SOCK_DEAD))
1079		sk->sk_data_ready(sk);
1080	rc = 1;
1081	sock_put(sk);
1082out:
1083	return rc;
1084out_sock_put:
1085	sock_put(sk);
1086out_clear_request:
1087	rc = 0;
1088	x25_transmit_clear_request(nb, lci, 0x01);
1089	goto out;
1090}
1091
1092static int x25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
1093{
1094	struct sock *sk = sock->sk;
1095	struct x25_sock *x25 = x25_sk(sk);
1096	DECLARE_SOCKADDR(struct sockaddr_x25 *, usx25, msg->msg_name);
1097	struct sockaddr_x25 sx25;
1098	struct sk_buff *skb;
1099	unsigned char *asmptr;
1100	int noblock = msg->msg_flags & MSG_DONTWAIT;
1101	size_t size;
1102	int qbit = 0, rc = -EINVAL;
1103
1104	lock_sock(sk);
1105	if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_OOB|MSG_EOR|MSG_CMSG_COMPAT))
1106		goto out;
1107
1108	/* we currently don't support segmented records at the user interface */
1109	if (!(msg->msg_flags & (MSG_EOR|MSG_OOB)))
1110		goto out;
1111
1112	rc = -EADDRNOTAVAIL;
1113	if (sock_flag(sk, SOCK_ZAPPED))
1114		goto out;
1115
1116	rc = -EPIPE;
1117	if (sk->sk_shutdown & SEND_SHUTDOWN) {
1118		send_sig(SIGPIPE, current, 0);
1119		goto out;
1120	}
1121
1122	rc = -ENETUNREACH;
1123	if (!x25->neighbour)
1124		goto out;
1125
1126	if (usx25) {
1127		rc = -EINVAL;
1128		if (msg->msg_namelen < sizeof(sx25))
1129			goto out;
1130		memcpy(&sx25, usx25, sizeof(sx25));
1131		rc = -EISCONN;
1132		if (strcmp(x25->dest_addr.x25_addr, sx25.sx25_addr.x25_addr))
1133			goto out;
1134		rc = -EINVAL;
1135		if (sx25.sx25_family != AF_X25)
1136			goto out;
1137	} else {
1138		/*
1139		 *	FIXME 1003.1g - if the socket is like this because
1140		 *	it has become closed (not started closed) we ought
1141		 *	to SIGPIPE, EPIPE;
1142		 */
1143		rc = -ENOTCONN;
1144		if (sk->sk_state != TCP_ESTABLISHED)
1145			goto out;
1146
1147		sx25.sx25_family = AF_X25;
1148		sx25.sx25_addr   = x25->dest_addr;
1149	}
1150
1151	/* Sanity check the packet size */
1152	if (len > 65535) {
1153		rc = -EMSGSIZE;
1154		goto out;
1155	}
1156
1157	SOCK_DEBUG(sk, "x25_sendmsg: sendto: Addresses built.\n");
1158
1159	/* Build a packet */
1160	SOCK_DEBUG(sk, "x25_sendmsg: sendto: building packet.\n");
1161
1162	if ((msg->msg_flags & MSG_OOB) && len > 32)
1163		len = 32;
1164
1165	size = len + X25_MAX_L2_LEN + X25_EXT_MIN_LEN;
1166
1167	release_sock(sk);
1168	skb = sock_alloc_send_skb(sk, size, noblock, &rc);
1169	lock_sock(sk);
1170	if (!skb)
1171		goto out;
1172	X25_SKB_CB(skb)->flags = msg->msg_flags;
1173
1174	skb_reserve(skb, X25_MAX_L2_LEN + X25_EXT_MIN_LEN);
1175
1176	/*
1177	 *	Put the data on the end
1178	 */
1179	SOCK_DEBUG(sk, "x25_sendmsg: Copying user data\n");
1180
1181	skb_reset_transport_header(skb);
1182	skb_put(skb, len);
1183
1184	rc = memcpy_from_msg(skb_transport_header(skb), msg, len);
1185	if (rc)
1186		goto out_kfree_skb;
1187
1188	/*
1189	 *	If the Q BIT Include socket option is in force, the first
1190	 *	byte of the user data is the logical value of the Q Bit.
1191	 */
1192	if (test_bit(X25_Q_BIT_FLAG, &x25->flags)) {
1193		if (!pskb_may_pull(skb, 1))
1194			goto out_kfree_skb;
1195
1196		qbit = skb->data[0];
1197		skb_pull(skb, 1);
1198	}
1199
1200	/*
1201	 *	Push down the X.25 header
1202	 */
1203	SOCK_DEBUG(sk, "x25_sendmsg: Building X.25 Header.\n");
1204
1205	if (msg->msg_flags & MSG_OOB) {
1206		if (x25->neighbour->extended) {
1207			asmptr    = skb_push(skb, X25_STD_MIN_LEN);
1208			*asmptr++ = ((x25->lci >> 8) & 0x0F) | X25_GFI_EXTSEQ;
1209			*asmptr++ = (x25->lci >> 0) & 0xFF;
1210			*asmptr++ = X25_INTERRUPT;
1211		} else {
1212			asmptr    = skb_push(skb, X25_STD_MIN_LEN);
1213			*asmptr++ = ((x25->lci >> 8) & 0x0F) | X25_GFI_STDSEQ;
1214			*asmptr++ = (x25->lci >> 0) & 0xFF;
1215			*asmptr++ = X25_INTERRUPT;
1216		}
1217	} else {
1218		if (x25->neighbour->extended) {
1219			/* Build an Extended X.25 header */
1220			asmptr    = skb_push(skb, X25_EXT_MIN_LEN);
1221			*asmptr++ = ((x25->lci >> 8) & 0x0F) | X25_GFI_EXTSEQ;
1222			*asmptr++ = (x25->lci >> 0) & 0xFF;
1223			*asmptr++ = X25_DATA;
1224			*asmptr++ = X25_DATA;
1225		} else {
1226			/* Build an Standard X.25 header */
1227			asmptr    = skb_push(skb, X25_STD_MIN_LEN);
1228			*asmptr++ = ((x25->lci >> 8) & 0x0F) | X25_GFI_STDSEQ;
1229			*asmptr++ = (x25->lci >> 0) & 0xFF;
1230			*asmptr++ = X25_DATA;
1231		}
1232
1233		if (qbit)
1234			skb->data[0] |= X25_Q_BIT;
1235	}
1236
1237	SOCK_DEBUG(sk, "x25_sendmsg: Built header.\n");
1238	SOCK_DEBUG(sk, "x25_sendmsg: Transmitting buffer\n");
1239
1240	rc = -ENOTCONN;
1241	if (sk->sk_state != TCP_ESTABLISHED)
1242		goto out_kfree_skb;
1243
1244	if (msg->msg_flags & MSG_OOB)
1245		skb_queue_tail(&x25->interrupt_out_queue, skb);
1246	else {
1247		rc = x25_output(sk, skb);
1248		len = rc;
1249		if (rc < 0)
1250			kfree_skb(skb);
1251		else if (test_bit(X25_Q_BIT_FLAG, &x25->flags))
1252			len++;
1253	}
1254
1255	x25_kick(sk);
1256	rc = len;
1257out:
1258	release_sock(sk);
1259	return rc;
1260out_kfree_skb:
1261	kfree_skb(skb);
1262	goto out;
1263}
1264
1265
1266static int x25_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
1267		       int flags)
1268{
1269	struct sock *sk = sock->sk;
1270	struct x25_sock *x25 = x25_sk(sk);
1271	DECLARE_SOCKADDR(struct sockaddr_x25 *, sx25, msg->msg_name);
1272	size_t copied;
1273	int qbit, header_len;
1274	struct sk_buff *skb;
1275	unsigned char *asmptr;
1276	int rc = -ENOTCONN;
1277
1278	lock_sock(sk);
1279
1280	if (x25->neighbour == NULL)
1281		goto out;
1282
1283	header_len = x25->neighbour->extended ?
1284		X25_EXT_MIN_LEN : X25_STD_MIN_LEN;
1285
1286	/*
1287	 * This works for seqpacket too. The receiver has ordered the queue for
1288	 * us! We do one quick check first though
1289	 */
1290	if (sk->sk_state != TCP_ESTABLISHED)
1291		goto out;
1292
1293	if (flags & MSG_OOB) {
1294		rc = -EINVAL;
1295		if (sock_flag(sk, SOCK_URGINLINE) ||
1296		    !skb_peek(&x25->interrupt_in_queue))
1297			goto out;
1298
1299		skb = skb_dequeue(&x25->interrupt_in_queue);
1300
1301		if (!pskb_may_pull(skb, X25_STD_MIN_LEN))
1302			goto out_free_dgram;
1303
1304		skb_pull(skb, X25_STD_MIN_LEN);
1305
1306		/*
1307		 *	No Q bit information on Interrupt data.
1308		 */
1309		if (test_bit(X25_Q_BIT_FLAG, &x25->flags)) {
1310			asmptr  = skb_push(skb, 1);
1311			*asmptr = 0x00;
1312		}
1313
1314		msg->msg_flags |= MSG_OOB;
1315	} else {
1316		/* Now we can treat all alike */
1317		release_sock(sk);
1318		skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
1319					flags & MSG_DONTWAIT, &rc);
1320		lock_sock(sk);
1321		if (!skb)
1322			goto out;
1323
1324		if (!pskb_may_pull(skb, header_len))
1325			goto out_free_dgram;
1326
1327		qbit = (skb->data[0] & X25_Q_BIT) == X25_Q_BIT;
1328
1329		skb_pull(skb, header_len);
1330
1331		if (test_bit(X25_Q_BIT_FLAG, &x25->flags)) {
1332			asmptr  = skb_push(skb, 1);
1333			*asmptr = qbit;
1334		}
1335	}
1336
1337	skb_reset_transport_header(skb);
1338	copied = skb->len;
1339
1340	if (copied > size) {
1341		copied = size;
1342		msg->msg_flags |= MSG_TRUNC;
1343	}
1344
1345	/* Currently, each datagram always contains a complete record */
1346	msg->msg_flags |= MSG_EOR;
1347
1348	rc = skb_copy_datagram_msg(skb, 0, msg, copied);
1349	if (rc)
1350		goto out_free_dgram;
1351
1352	if (sx25) {
1353		sx25->sx25_family = AF_X25;
1354		sx25->sx25_addr   = x25->dest_addr;
1355		msg->msg_namelen = sizeof(*sx25);
1356	}
1357
1358	x25_check_rbuf(sk);
1359	rc = copied;
1360out_free_dgram:
1361	skb_free_datagram(sk, skb);
1362out:
1363	release_sock(sk);
1364	return rc;
1365}
1366
1367
1368static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
1369{
1370	struct sock *sk = sock->sk;
1371	struct x25_sock *x25 = x25_sk(sk);
1372	void __user *argp = (void __user *)arg;
1373	int rc;
1374
1375	switch (cmd) {
1376	case TIOCOUTQ: {
1377		int amount;
1378
1379		amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
1380		if (amount < 0)
1381			amount = 0;
1382		rc = put_user(amount, (unsigned int __user *)argp);
1383		break;
1384	}
1385
1386	case TIOCINQ: {
1387		struct sk_buff *skb;
1388		int amount = 0;
1389		/*
1390		 * These two are safe on a single CPU system as
1391		 * only user tasks fiddle here
1392		 */
1393		lock_sock(sk);
1394		if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL)
1395			amount = skb->len;
1396		release_sock(sk);
1397		rc = put_user(amount, (unsigned int __user *)argp);
1398		break;
1399	}
1400
 
 
 
 
 
 
 
 
 
 
 
 
1401	case SIOCGIFADDR:
1402	case SIOCSIFADDR:
1403	case SIOCGIFDSTADDR:
1404	case SIOCSIFDSTADDR:
1405	case SIOCGIFBRDADDR:
1406	case SIOCSIFBRDADDR:
1407	case SIOCGIFNETMASK:
1408	case SIOCSIFNETMASK:
1409	case SIOCGIFMETRIC:
1410	case SIOCSIFMETRIC:
1411		rc = -EINVAL;
1412		break;
1413	case SIOCADDRT:
1414	case SIOCDELRT:
1415		rc = -EPERM;
1416		if (!capable(CAP_NET_ADMIN))
1417			break;
1418		rc = x25_route_ioctl(cmd, argp);
1419		break;
1420	case SIOCX25GSUBSCRIP:
1421		rc = x25_subscr_ioctl(cmd, argp);
1422		break;
1423	case SIOCX25SSUBSCRIP:
1424		rc = -EPERM;
1425		if (!capable(CAP_NET_ADMIN))
1426			break;
1427		rc = x25_subscr_ioctl(cmd, argp);
1428		break;
1429	case SIOCX25GFACILITIES: {
1430		lock_sock(sk);
1431		rc = copy_to_user(argp, &x25->facilities,
1432				  sizeof(x25->facilities))
1433			? -EFAULT : 0;
1434		release_sock(sk);
1435		break;
1436	}
1437
1438	case SIOCX25SFACILITIES: {
1439		struct x25_facilities facilities;
1440		rc = -EFAULT;
1441		if (copy_from_user(&facilities, argp, sizeof(facilities)))
1442			break;
1443		rc = -EINVAL;
1444		lock_sock(sk);
1445		if (sk->sk_state != TCP_LISTEN &&
1446		    sk->sk_state != TCP_CLOSE)
1447			goto out_fac_release;
1448		if (facilities.pacsize_in < X25_PS16 ||
1449		    facilities.pacsize_in > X25_PS4096)
1450			goto out_fac_release;
1451		if (facilities.pacsize_out < X25_PS16 ||
1452		    facilities.pacsize_out > X25_PS4096)
1453			goto out_fac_release;
1454		if (facilities.winsize_in < 1 ||
1455		    facilities.winsize_in > 127)
1456			goto out_fac_release;
1457		if (facilities.throughput) {
1458			int out = facilities.throughput & 0xf0;
1459			int in  = facilities.throughput & 0x0f;
1460			if (!out)
1461				facilities.throughput |=
1462					X25_DEFAULT_THROUGHPUT << 4;
1463			else if (out < 0x30 || out > 0xD0)
1464				goto out_fac_release;
1465			if (!in)
1466				facilities.throughput |=
1467					X25_DEFAULT_THROUGHPUT;
1468			else if (in < 0x03 || in > 0x0D)
1469				goto out_fac_release;
1470		}
1471		if (facilities.reverse &&
1472		    (facilities.reverse & 0x81) != 0x81)
1473			goto out_fac_release;
1474		x25->facilities = facilities;
1475		rc = 0;
1476out_fac_release:
1477		release_sock(sk);
1478		break;
1479	}
1480
1481	case SIOCX25GDTEFACILITIES: {
1482		lock_sock(sk);
1483		rc = copy_to_user(argp, &x25->dte_facilities,
1484				  sizeof(x25->dte_facilities));
1485		release_sock(sk);
1486		if (rc)
1487			rc = -EFAULT;
1488		break;
1489	}
1490
1491	case SIOCX25SDTEFACILITIES: {
1492		struct x25_dte_facilities dtefacs;
1493		rc = -EFAULT;
1494		if (copy_from_user(&dtefacs, argp, sizeof(dtefacs)))
1495			break;
1496		rc = -EINVAL;
1497		lock_sock(sk);
1498		if (sk->sk_state != TCP_LISTEN &&
1499		    sk->sk_state != TCP_CLOSE)
1500			goto out_dtefac_release;
1501		if (dtefacs.calling_len > X25_MAX_AE_LEN)
1502			goto out_dtefac_release;
1503		if (dtefacs.called_len > X25_MAX_AE_LEN)
1504			goto out_dtefac_release;
1505		x25->dte_facilities = dtefacs;
1506		rc = 0;
1507out_dtefac_release:
1508		release_sock(sk);
1509		break;
1510	}
1511
1512	case SIOCX25GCALLUSERDATA: {
1513		lock_sock(sk);
1514		rc = copy_to_user(argp, &x25->calluserdata,
1515				  sizeof(x25->calluserdata))
1516			? -EFAULT : 0;
1517		release_sock(sk);
1518		break;
1519	}
1520
1521	case SIOCX25SCALLUSERDATA: {
1522		struct x25_calluserdata calluserdata;
1523
1524		rc = -EFAULT;
1525		if (copy_from_user(&calluserdata, argp, sizeof(calluserdata)))
1526			break;
1527		rc = -EINVAL;
1528		if (calluserdata.cudlength > X25_MAX_CUD_LEN)
1529			break;
1530		lock_sock(sk);
1531		x25->calluserdata = calluserdata;
1532		release_sock(sk);
1533		rc = 0;
1534		break;
1535	}
1536
1537	case SIOCX25GCAUSEDIAG: {
1538		lock_sock(sk);
1539		rc = copy_to_user(argp, &x25->causediag, sizeof(x25->causediag))
1540			? -EFAULT : 0;
1541		release_sock(sk);
1542		break;
1543	}
1544
1545	case SIOCX25SCAUSEDIAG: {
1546		struct x25_causediag causediag;
1547		rc = -EFAULT;
1548		if (copy_from_user(&causediag, argp, sizeof(causediag)))
1549			break;
1550		lock_sock(sk);
1551		x25->causediag = causediag;
1552		release_sock(sk);
1553		rc = 0;
1554		break;
1555
1556	}
1557
1558	case SIOCX25SCUDMATCHLEN: {
1559		struct x25_subaddr sub_addr;
1560		rc = -EINVAL;
1561		lock_sock(sk);
1562		if(sk->sk_state != TCP_CLOSE)
1563			goto out_cud_release;
1564		rc = -EFAULT;
1565		if (copy_from_user(&sub_addr, argp,
1566				   sizeof(sub_addr)))
1567			goto out_cud_release;
1568		rc = -EINVAL;
1569		if (sub_addr.cudmatchlength > X25_MAX_CUD_LEN)
1570			goto out_cud_release;
1571		x25->cudmatchlength = sub_addr.cudmatchlength;
1572		rc = 0;
1573out_cud_release:
1574		release_sock(sk);
1575		break;
1576	}
1577
1578	case SIOCX25CALLACCPTAPPRV: {
1579		rc = -EINVAL;
1580		lock_sock(sk);
1581		if (sk->sk_state == TCP_CLOSE) {
1582			clear_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);
1583			rc = 0;
1584		}
1585		release_sock(sk);
1586		break;
1587	}
1588
1589	case SIOCX25SENDCALLACCPT:  {
1590		rc = -EINVAL;
1591		lock_sock(sk);
1592		if (sk->sk_state != TCP_ESTABLISHED)
1593			goto out_sendcallaccpt_release;
1594		/* must call accptapprv above */
1595		if (test_bit(X25_ACCPT_APPRV_FLAG, &x25->flags))
1596			goto out_sendcallaccpt_release;
1597		x25_write_internal(sk, X25_CALL_ACCEPTED);
1598		x25->state = X25_STATE_3;
1599		rc = 0;
1600out_sendcallaccpt_release:
1601		release_sock(sk);
1602		break;
1603	}
1604
1605	default:
1606		rc = -ENOIOCTLCMD;
1607		break;
1608	}
1609
1610	return rc;
1611}
1612
1613static const struct net_proto_family x25_family_ops = {
1614	.family =	AF_X25,
1615	.create =	x25_create,
1616	.owner	=	THIS_MODULE,
1617};
1618
1619#ifdef CONFIG_COMPAT
1620static int compat_x25_subscr_ioctl(unsigned int cmd,
1621		struct compat_x25_subscrip_struct __user *x25_subscr32)
1622{
1623	struct compat_x25_subscrip_struct x25_subscr;
1624	struct x25_neigh *nb;
1625	struct net_device *dev;
1626	int rc = -EINVAL;
1627
1628	rc = -EFAULT;
1629	if (copy_from_user(&x25_subscr, x25_subscr32, sizeof(*x25_subscr32)))
1630		goto out;
1631
1632	rc = -EINVAL;
1633	dev = x25_dev_get(x25_subscr.device);
1634	if (dev == NULL)
1635		goto out;
1636
1637	nb = x25_get_neigh(dev);
1638	if (nb == NULL)
1639		goto out_dev_put;
1640
1641	dev_put(dev);
1642
1643	if (cmd == SIOCX25GSUBSCRIP) {
1644		read_lock_bh(&x25_neigh_list_lock);
1645		x25_subscr.extended = nb->extended;
1646		x25_subscr.global_facil_mask = nb->global_facil_mask;
1647		read_unlock_bh(&x25_neigh_list_lock);
1648		rc = copy_to_user(x25_subscr32, &x25_subscr,
1649				sizeof(*x25_subscr32)) ? -EFAULT : 0;
1650	} else {
1651		rc = -EINVAL;
1652		if (x25_subscr.extended == 0 || x25_subscr.extended == 1) {
1653			rc = 0;
1654			write_lock_bh(&x25_neigh_list_lock);
1655			nb->extended = x25_subscr.extended;
1656			nb->global_facil_mask = x25_subscr.global_facil_mask;
1657			write_unlock_bh(&x25_neigh_list_lock);
1658		}
1659	}
1660	x25_neigh_put(nb);
1661out:
1662	return rc;
1663out_dev_put:
1664	dev_put(dev);
1665	goto out;
1666}
1667
1668static int compat_x25_ioctl(struct socket *sock, unsigned int cmd,
1669				unsigned long arg)
1670{
1671	void __user *argp = compat_ptr(arg);
 
 
1672	int rc = -ENOIOCTLCMD;
1673
1674	switch(cmd) {
1675	case TIOCOUTQ:
1676	case TIOCINQ:
1677		rc = x25_ioctl(sock, cmd, (unsigned long)argp);
1678		break;
 
 
 
 
 
 
 
 
 
 
 
 
1679	case SIOCGIFADDR:
1680	case SIOCSIFADDR:
1681	case SIOCGIFDSTADDR:
1682	case SIOCSIFDSTADDR:
1683	case SIOCGIFBRDADDR:
1684	case SIOCSIFBRDADDR:
1685	case SIOCGIFNETMASK:
1686	case SIOCSIFNETMASK:
1687	case SIOCGIFMETRIC:
1688	case SIOCSIFMETRIC:
1689		rc = -EINVAL;
1690		break;
1691	case SIOCADDRT:
1692	case SIOCDELRT:
1693		rc = -EPERM;
1694		if (!capable(CAP_NET_ADMIN))
1695			break;
1696		rc = x25_route_ioctl(cmd, argp);
1697		break;
1698	case SIOCX25GSUBSCRIP:
1699		rc = compat_x25_subscr_ioctl(cmd, argp);
1700		break;
1701	case SIOCX25SSUBSCRIP:
1702		rc = -EPERM;
1703		if (!capable(CAP_NET_ADMIN))
1704			break;
1705		rc = compat_x25_subscr_ioctl(cmd, argp);
1706		break;
1707	case SIOCX25GFACILITIES:
1708	case SIOCX25SFACILITIES:
1709	case SIOCX25GDTEFACILITIES:
1710	case SIOCX25SDTEFACILITIES:
1711	case SIOCX25GCALLUSERDATA:
1712	case SIOCX25SCALLUSERDATA:
1713	case SIOCX25GCAUSEDIAG:
1714	case SIOCX25SCAUSEDIAG:
1715	case SIOCX25SCUDMATCHLEN:
1716	case SIOCX25CALLACCPTAPPRV:
1717	case SIOCX25SENDCALLACCPT:
1718		rc = x25_ioctl(sock, cmd, (unsigned long)argp);
1719		break;
1720	default:
1721		rc = -ENOIOCTLCMD;
1722		break;
1723	}
1724	return rc;
1725}
1726#endif
1727
1728static const struct proto_ops x25_proto_ops = {
1729	.family =	AF_X25,
1730	.owner =	THIS_MODULE,
1731	.release =	x25_release,
1732	.bind =		x25_bind,
1733	.connect =	x25_connect,
1734	.socketpair =	sock_no_socketpair,
1735	.accept =	x25_accept,
1736	.getname =	x25_getname,
1737	.poll =		datagram_poll,
1738	.ioctl =	x25_ioctl,
1739#ifdef CONFIG_COMPAT
1740	.compat_ioctl = compat_x25_ioctl,
1741#endif
1742	.gettstamp =	sock_gettstamp,
1743	.listen =	x25_listen,
1744	.shutdown =	sock_no_shutdown,
1745	.setsockopt =	x25_setsockopt,
1746	.getsockopt =	x25_getsockopt,
1747	.sendmsg =	x25_sendmsg,
1748	.recvmsg =	x25_recvmsg,
1749	.mmap =		sock_no_mmap,
1750	.sendpage =	sock_no_sendpage,
1751};
1752
1753static struct packet_type x25_packet_type __read_mostly = {
1754	.type =	cpu_to_be16(ETH_P_X25),
1755	.func =	x25_lapb_receive_frame,
1756};
1757
1758static struct notifier_block x25_dev_notifier = {
1759	.notifier_call = x25_device_event,
1760};
1761
1762void x25_kill_by_neigh(struct x25_neigh *nb)
1763{
1764	struct sock *s;
1765
1766	write_lock_bh(&x25_list_lock);
1767
1768	sk_for_each(s, &x25_list)
1769		if (x25_sk(s)->neighbour == nb)
1770			x25_disconnect(s, ENETUNREACH, 0, 0);
1771
1772	write_unlock_bh(&x25_list_lock);
1773
1774	/* Remove any related forwards */
1775	x25_clear_forward_by_dev(nb->dev);
1776}
1777
1778static int __init x25_init(void)
1779{
1780	int rc;
1781
1782	rc = proto_register(&x25_proto, 0);
1783	if (rc)
1784		goto out;
1785
1786	rc = sock_register(&x25_family_ops);
1787	if (rc)
1788		goto out_proto;
1789
1790	dev_add_pack(&x25_packet_type);
1791
1792	rc = register_netdevice_notifier(&x25_dev_notifier);
1793	if (rc)
1794		goto out_sock;
1795
1796	rc = x25_register_sysctl();
1797	if (rc)
1798		goto out_dev;
1799
1800	rc = x25_proc_init();
1801	if (rc)
1802		goto out_sysctl;
1803
1804	pr_info("Linux Version 0.2\n");
1805
1806out:
1807	return rc;
1808out_sysctl:
1809	x25_unregister_sysctl();
1810out_dev:
1811	unregister_netdevice_notifier(&x25_dev_notifier);
1812out_sock:
1813	dev_remove_pack(&x25_packet_type);
1814	sock_unregister(AF_X25);
1815out_proto:
1816	proto_unregister(&x25_proto);
1817	goto out;
1818}
1819module_init(x25_init);
1820
1821static void __exit x25_exit(void)
1822{
1823	x25_proc_exit();
1824	x25_link_free();
1825	x25_route_free();
1826
1827	x25_unregister_sysctl();
1828
1829	unregister_netdevice_notifier(&x25_dev_notifier);
1830
1831	dev_remove_pack(&x25_packet_type);
1832
1833	sock_unregister(AF_X25);
1834	proto_unregister(&x25_proto);
1835}
1836module_exit(x25_exit);
1837
1838MODULE_AUTHOR("Jonathan Naylor <g4klx@g4klx.demon.co.uk>");
1839MODULE_DESCRIPTION("The X.25 Packet Layer network layer protocol");
1840MODULE_LICENSE("GPL");
1841MODULE_ALIAS_NETPROTO(PF_X25);
v4.17
 
   1/*
   2 *	X.25 Packet Layer release 002
   3 *
   4 *	This is ALPHA test software. This code may break your machine,
   5 *	randomly fail to work with new releases, misbehave and/or generally
   6 *	screw up. It might even work.
   7 *
   8 *	This code REQUIRES 2.1.15 or higher
   9 *
  10 *	This module:
  11 *		This module is free software; you can redistribute it and/or
  12 *		modify it under the terms of the GNU General Public License
  13 *		as published by the Free Software Foundation; either version
  14 *		2 of the License, or (at your option) any later version.
  15 *
  16 *	History
  17 *	X.25 001	Jonathan Naylor	Started coding.
  18 *	X.25 002	Jonathan Naylor	Centralised disconnect handling.
  19 *					New timer architecture.
  20 *	2000-03-11	Henner Eisen	MSG_EOR handling more POSIX compliant.
  21 *	2000-03-22	Daniela Squassoni Allowed disabling/enabling of
  22 *					  facilities negotiation and increased
  23 *					  the throughput upper limit.
  24 *	2000-08-27	Arnaldo C. Melo s/suser/capable/ + micro cleanups
  25 *	2000-09-04	Henner Eisen	Set sock->state in x25_accept().
  26 *					Fixed x25_output() related skb leakage.
  27 *	2000-10-02	Henner Eisen	Made x25_kick() single threaded per socket.
  28 *	2000-10-27	Henner Eisen    MSG_DONTWAIT for fragment allocation.
  29 *	2000-11-14	Henner Eisen    Closing datalink from NETDEV_GOING_DOWN
  30 *	2002-10-06	Arnaldo C. Melo Get rid of cli/sti, move proc stuff to
  31 *					x25_proc.c, using seq_file
  32 *	2005-04-02	Shaun Pereira	Selective sub address matching
  33 *					with call user data
  34 *	2005-04-15	Shaun Pereira	Fast select with no restriction on
  35 *					response
  36 */
  37
  38#define pr_fmt(fmt) "X25: " fmt
  39
  40#include <linux/module.h>
  41#include <linux/capability.h>
  42#include <linux/errno.h>
  43#include <linux/kernel.h>
  44#include <linux/sched/signal.h>
  45#include <linux/timer.h>
  46#include <linux/string.h>
  47#include <linux/net.h>
  48#include <linux/netdevice.h>
  49#include <linux/if_arp.h>
  50#include <linux/skbuff.h>
  51#include <linux/slab.h>
  52#include <net/sock.h>
  53#include <net/tcp_states.h>
  54#include <linux/uaccess.h>
  55#include <linux/fcntl.h>
  56#include <linux/termios.h>	/* For TIOCINQ/OUTQ */
  57#include <linux/notifier.h>
  58#include <linux/init.h>
  59#include <linux/compat.h>
  60#include <linux/ctype.h>
  61
  62#include <net/x25.h>
  63#include <net/compat.h>
  64
  65int sysctl_x25_restart_request_timeout = X25_DEFAULT_T20;
  66int sysctl_x25_call_request_timeout    = X25_DEFAULT_T21;
  67int sysctl_x25_reset_request_timeout   = X25_DEFAULT_T22;
  68int sysctl_x25_clear_request_timeout   = X25_DEFAULT_T23;
  69int sysctl_x25_ack_holdback_timeout    = X25_DEFAULT_T2;
  70int sysctl_x25_forward                 = 0;
  71
  72HLIST_HEAD(x25_list);
  73DEFINE_RWLOCK(x25_list_lock);
  74
  75static const struct proto_ops x25_proto_ops;
  76
  77static const struct x25_address null_x25_address = {"               "};
  78
  79#ifdef CONFIG_COMPAT
  80struct compat_x25_subscrip_struct {
  81	char device[200-sizeof(compat_ulong_t)];
  82	compat_ulong_t global_facil_mask;
  83	compat_uint_t extended;
  84};
  85#endif
  86
  87
  88int x25_parse_address_block(struct sk_buff *skb,
  89		struct x25_address *called_addr,
  90		struct x25_address *calling_addr)
  91{
  92	unsigned char len;
  93	int needed;
  94	int rc;
  95
  96	if (!pskb_may_pull(skb, 1)) {
  97		/* packet has no address block */
  98		rc = 0;
  99		goto empty;
 100	}
 101
 102	len = *skb->data;
 103	needed = 1 + (len >> 4) + (len & 0x0f);
 104
 105	if (!pskb_may_pull(skb, needed)) {
 106		/* packet is too short to hold the addresses it claims
 107		   to hold */
 108		rc = -1;
 109		goto empty;
 110	}
 111
 112	return x25_addr_ntoa(skb->data, called_addr, calling_addr);
 113
 114empty:
 115	*called_addr->x25_addr = 0;
 116	*calling_addr->x25_addr = 0;
 117
 118	return rc;
 119}
 120
 121
 122int x25_addr_ntoa(unsigned char *p, struct x25_address *called_addr,
 123		  struct x25_address *calling_addr)
 124{
 125	unsigned int called_len, calling_len;
 126	char *called, *calling;
 127	unsigned int i;
 128
 129	called_len  = (*p >> 0) & 0x0F;
 130	calling_len = (*p >> 4) & 0x0F;
 131
 132	called  = called_addr->x25_addr;
 133	calling = calling_addr->x25_addr;
 134	p++;
 135
 136	for (i = 0; i < (called_len + calling_len); i++) {
 137		if (i < called_len) {
 138			if (i % 2 != 0) {
 139				*called++ = ((*p >> 0) & 0x0F) + '0';
 140				p++;
 141			} else {
 142				*called++ = ((*p >> 4) & 0x0F) + '0';
 143			}
 144		} else {
 145			if (i % 2 != 0) {
 146				*calling++ = ((*p >> 0) & 0x0F) + '0';
 147				p++;
 148			} else {
 149				*calling++ = ((*p >> 4) & 0x0F) + '0';
 150			}
 151		}
 152	}
 153
 154	*called = *calling = '\0';
 155
 156	return 1 + (called_len + calling_len + 1) / 2;
 157}
 158
 159int x25_addr_aton(unsigned char *p, struct x25_address *called_addr,
 160		  struct x25_address *calling_addr)
 161{
 162	unsigned int called_len, calling_len;
 163	char *called, *calling;
 164	int i;
 165
 166	called  = called_addr->x25_addr;
 167	calling = calling_addr->x25_addr;
 168
 169	called_len  = strlen(called);
 170	calling_len = strlen(calling);
 171
 172	*p++ = (calling_len << 4) | (called_len << 0);
 173
 174	for (i = 0; i < (called_len + calling_len); i++) {
 175		if (i < called_len) {
 176			if (i % 2 != 0) {
 177				*p |= (*called++ - '0') << 0;
 178				p++;
 179			} else {
 180				*p = 0x00;
 181				*p |= (*called++ - '0') << 4;
 182			}
 183		} else {
 184			if (i % 2 != 0) {
 185				*p |= (*calling++ - '0') << 0;
 186				p++;
 187			} else {
 188				*p = 0x00;
 189				*p |= (*calling++ - '0') << 4;
 190			}
 191		}
 192	}
 193
 194	return 1 + (called_len + calling_len + 1) / 2;
 195}
 196
 197/*
 198 *	Socket removal during an interrupt is now safe.
 199 */
 200static void x25_remove_socket(struct sock *sk)
 201{
 202	write_lock_bh(&x25_list_lock);
 203	sk_del_node_init(sk);
 204	write_unlock_bh(&x25_list_lock);
 205}
 206
 207/*
 208 *	Kill all bound sockets on a dropped device.
 209 */
 210static void x25_kill_by_device(struct net_device *dev)
 211{
 212	struct sock *s;
 213
 214	write_lock_bh(&x25_list_lock);
 215
 216	sk_for_each(s, &x25_list)
 217		if (x25_sk(s)->neighbour && x25_sk(s)->neighbour->dev == dev)
 218			x25_disconnect(s, ENETUNREACH, 0, 0);
 219
 220	write_unlock_bh(&x25_list_lock);
 221}
 222
 223/*
 224 *	Handle device status changes.
 225 */
 226static int x25_device_event(struct notifier_block *this, unsigned long event,
 227			    void *ptr)
 228{
 229	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 230	struct x25_neigh *nb;
 231
 232	if (!net_eq(dev_net(dev), &init_net))
 233		return NOTIFY_DONE;
 234
 235	if (dev->type == ARPHRD_X25
 236#if IS_ENABLED(CONFIG_LLC)
 237	 || dev->type == ARPHRD_ETHER
 238#endif
 239	 ) {
 240		switch (event) {
 241		case NETDEV_UP:
 
 242			x25_link_device_up(dev);
 243			break;
 244		case NETDEV_GOING_DOWN:
 245			nb = x25_get_neigh(dev);
 246			if (nb) {
 247				x25_terminate_link(nb);
 248				x25_neigh_put(nb);
 249			}
 
 250			break;
 251		case NETDEV_DOWN:
 252			x25_kill_by_device(dev);
 253			x25_route_device_down(dev);
 254			x25_link_device_down(dev);
 255			break;
 
 
 
 
 
 
 
 
 
 256		}
 257	}
 258
 259	return NOTIFY_DONE;
 260}
 261
 262/*
 263 *	Add a socket to the bound sockets list.
 264 */
 265static void x25_insert_socket(struct sock *sk)
 266{
 267	write_lock_bh(&x25_list_lock);
 268	sk_add_node(sk, &x25_list);
 269	write_unlock_bh(&x25_list_lock);
 270}
 271
 272/*
 273 *	Find a socket that wants to accept the Call Request we just
 274 *	received. Check the full list for an address/cud match.
 275 *	If no cuds match return the next_best thing, an address match.
 276 *	Note: if a listening socket has cud set it must only get calls
 277 *	with matching cud.
 278 */
 279static struct sock *x25_find_listener(struct x25_address *addr,
 280					struct sk_buff *skb)
 281{
 282	struct sock *s;
 283	struct sock *next_best;
 284
 285	read_lock_bh(&x25_list_lock);
 286	next_best = NULL;
 287
 288	sk_for_each(s, &x25_list)
 289		if ((!strcmp(addr->x25_addr,
 290			x25_sk(s)->source_addr.x25_addr) ||
 291				!strcmp(addr->x25_addr,
 292					null_x25_address.x25_addr)) &&
 293					s->sk_state == TCP_LISTEN) {
 294			/*
 295			 * Found a listening socket, now check the incoming
 296			 * call user data vs this sockets call user data
 297			 */
 298			if (x25_sk(s)->cudmatchlength > 0 &&
 299				skb->len >= x25_sk(s)->cudmatchlength) {
 300				if((memcmp(x25_sk(s)->calluserdata.cuddata,
 301					skb->data,
 302					x25_sk(s)->cudmatchlength)) == 0) {
 303					sock_hold(s);
 304					goto found;
 305				 }
 306			} else
 307				next_best = s;
 308		}
 309	if (next_best) {
 310		s = next_best;
 311		sock_hold(s);
 312		goto found;
 313	}
 314	s = NULL;
 315found:
 316	read_unlock_bh(&x25_list_lock);
 317	return s;
 318}
 319
 320/*
 321 *	Find a connected X.25 socket given my LCI and neighbour.
 322 */
 323static struct sock *__x25_find_socket(unsigned int lci, struct x25_neigh *nb)
 324{
 325	struct sock *s;
 326
 327	sk_for_each(s, &x25_list)
 328		if (x25_sk(s)->lci == lci && x25_sk(s)->neighbour == nb) {
 329			sock_hold(s);
 330			goto found;
 331		}
 332	s = NULL;
 333found:
 334	return s;
 335}
 336
 337struct sock *x25_find_socket(unsigned int lci, struct x25_neigh *nb)
 338{
 339	struct sock *s;
 340
 341	read_lock_bh(&x25_list_lock);
 342	s = __x25_find_socket(lci, nb);
 343	read_unlock_bh(&x25_list_lock);
 344	return s;
 345}
 346
 347/*
 348 *	Find a unique LCI for a given device.
 349 */
 350static unsigned int x25_new_lci(struct x25_neigh *nb)
 351{
 352	unsigned int lci = 1;
 353	struct sock *sk;
 354
 355	read_lock_bh(&x25_list_lock);
 356
 357	while ((sk = __x25_find_socket(lci, nb)) != NULL) {
 358		sock_put(sk);
 359		if (++lci == 4096) {
 360			lci = 0;
 361			break;
 362		}
 
 363	}
 364
 365	read_unlock_bh(&x25_list_lock);
 366	return lci;
 367}
 368
 369/*
 370 *	Deferred destroy.
 371 */
 372static void __x25_destroy_socket(struct sock *);
 373
 374/*
 375 *	handler for deferred kills.
 376 */
 377static void x25_destroy_timer(struct timer_list *t)
 378{
 379	struct sock *sk = from_timer(sk, t, sk_timer);
 380
 381	x25_destroy_socket_from_timer(sk);
 382}
 383
 384/*
 385 *	This is called from user mode and the timers. Thus it protects itself
 386 *	against interrupt users but doesn't worry about being called during
 387 *	work. Once it is removed from the queue no interrupt or bottom half
 388 *	will touch it and we are (fairly 8-) ) safe.
 389 *	Not static as it's used by the timer
 390 */
 391static void __x25_destroy_socket(struct sock *sk)
 392{
 393	struct sk_buff *skb;
 394
 395	x25_stop_heartbeat(sk);
 396	x25_stop_timer(sk);
 397
 398	x25_remove_socket(sk);
 399	x25_clear_queues(sk);		/* Flush the queues */
 400
 401	while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
 402		if (skb->sk != sk) {		/* A pending connection */
 403			/*
 404			 * Queue the unaccepted socket for death
 405			 */
 406			skb->sk->sk_state = TCP_LISTEN;
 407			sock_set_flag(skb->sk, SOCK_DEAD);
 408			x25_start_heartbeat(skb->sk);
 409			x25_sk(skb->sk)->state = X25_STATE_0;
 410		}
 411
 412		kfree_skb(skb);
 413	}
 414
 415	if (sk_has_allocations(sk)) {
 416		/* Defer: outstanding buffers */
 417		sk->sk_timer.expires  = jiffies + 10 * HZ;
 418		sk->sk_timer.function = x25_destroy_timer;
 419		add_timer(&sk->sk_timer);
 420	} else {
 421		/* drop last reference so sock_put will free */
 422		__sock_put(sk);
 423	}
 424}
 425
 426void x25_destroy_socket_from_timer(struct sock *sk)
 427{
 428	sock_hold(sk);
 429	bh_lock_sock(sk);
 430	__x25_destroy_socket(sk);
 431	bh_unlock_sock(sk);
 432	sock_put(sk);
 433}
 434
 435/*
 436 *	Handling for system calls applied via the various interfaces to a
 437 *	X.25 socket object.
 438 */
 439
 440static int x25_setsockopt(struct socket *sock, int level, int optname,
 441			  char __user *optval, unsigned int optlen)
 442{
 443	int opt;
 444	struct sock *sk = sock->sk;
 445	int rc = -ENOPROTOOPT;
 446
 447	if (level != SOL_X25 || optname != X25_QBITINCL)
 448		goto out;
 449
 450	rc = -EINVAL;
 451	if (optlen < sizeof(int))
 452		goto out;
 453
 454	rc = -EFAULT;
 455	if (get_user(opt, (int __user *)optval))
 456		goto out;
 457
 458	if (opt)
 459		set_bit(X25_Q_BIT_FLAG, &x25_sk(sk)->flags);
 460	else
 461		clear_bit(X25_Q_BIT_FLAG, &x25_sk(sk)->flags);
 462	rc = 0;
 463out:
 464	return rc;
 465}
 466
 467static int x25_getsockopt(struct socket *sock, int level, int optname,
 468			  char __user *optval, int __user *optlen)
 469{
 470	struct sock *sk = sock->sk;
 471	int val, len, rc = -ENOPROTOOPT;
 472
 473	if (level != SOL_X25 || optname != X25_QBITINCL)
 474		goto out;
 475
 476	rc = -EFAULT;
 477	if (get_user(len, optlen))
 478		goto out;
 479
 480	len = min_t(unsigned int, len, sizeof(int));
 481
 482	rc = -EINVAL;
 483	if (len < 0)
 484		goto out;
 485
 486	rc = -EFAULT;
 487	if (put_user(len, optlen))
 488		goto out;
 489
 490	val = test_bit(X25_Q_BIT_FLAG, &x25_sk(sk)->flags);
 491	rc = copy_to_user(optval, &val, len) ? -EFAULT : 0;
 492out:
 493	return rc;
 494}
 495
 496static int x25_listen(struct socket *sock, int backlog)
 497{
 498	struct sock *sk = sock->sk;
 499	int rc = -EOPNOTSUPP;
 500
 501	lock_sock(sk);
 502	if (sk->sk_state != TCP_LISTEN) {
 503		memset(&x25_sk(sk)->dest_addr, 0, X25_ADDR_LEN);
 504		sk->sk_max_ack_backlog = backlog;
 505		sk->sk_state           = TCP_LISTEN;
 506		rc = 0;
 507	}
 508	release_sock(sk);
 509
 510	return rc;
 511}
 512
 513static struct proto x25_proto = {
 514	.name	  = "X25",
 515	.owner	  = THIS_MODULE,
 516	.obj_size = sizeof(struct x25_sock),
 517};
 518
 519static struct sock *x25_alloc_socket(struct net *net, int kern)
 520{
 521	struct x25_sock *x25;
 522	struct sock *sk = sk_alloc(net, AF_X25, GFP_ATOMIC, &x25_proto, kern);
 523
 524	if (!sk)
 525		goto out;
 526
 527	sock_init_data(NULL, sk);
 528
 529	x25 = x25_sk(sk);
 530	skb_queue_head_init(&x25->ack_queue);
 531	skb_queue_head_init(&x25->fragment_queue);
 532	skb_queue_head_init(&x25->interrupt_in_queue);
 533	skb_queue_head_init(&x25->interrupt_out_queue);
 534out:
 535	return sk;
 536}
 537
 538static int x25_create(struct net *net, struct socket *sock, int protocol,
 539		      int kern)
 540{
 541	struct sock *sk;
 542	struct x25_sock *x25;
 543	int rc = -EAFNOSUPPORT;
 544
 545	if (!net_eq(net, &init_net))
 546		goto out;
 547
 548	rc = -ESOCKTNOSUPPORT;
 549	if (sock->type != SOCK_SEQPACKET)
 550		goto out;
 551
 552	rc = -EINVAL;
 553	if (protocol)
 554		goto out;
 555
 556	rc = -ENOBUFS;
 557	if ((sk = x25_alloc_socket(net, kern)) == NULL)
 558		goto out;
 559
 560	x25 = x25_sk(sk);
 561
 562	sock_init_data(sock, sk);
 563
 564	x25_init_timers(sk);
 565
 566	sock->ops    = &x25_proto_ops;
 567	sk->sk_protocol = protocol;
 568	sk->sk_backlog_rcv = x25_backlog_rcv;
 569
 570	x25->t21   = sysctl_x25_call_request_timeout;
 571	x25->t22   = sysctl_x25_reset_request_timeout;
 572	x25->t23   = sysctl_x25_clear_request_timeout;
 573	x25->t2    = sysctl_x25_ack_holdback_timeout;
 574	x25->state = X25_STATE_0;
 575	x25->cudmatchlength = 0;
 576	set_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);	/* normally no cud  */
 577							/* on call accept   */
 578
 579	x25->facilities.winsize_in  = X25_DEFAULT_WINDOW_SIZE;
 580	x25->facilities.winsize_out = X25_DEFAULT_WINDOW_SIZE;
 581	x25->facilities.pacsize_in  = X25_DEFAULT_PACKET_SIZE;
 582	x25->facilities.pacsize_out = X25_DEFAULT_PACKET_SIZE;
 583	x25->facilities.throughput  = 0;	/* by default don't negotiate
 584						   throughput */
 585	x25->facilities.reverse     = X25_DEFAULT_REVERSE;
 586	x25->dte_facilities.calling_len = 0;
 587	x25->dte_facilities.called_len = 0;
 588	memset(x25->dte_facilities.called_ae, '\0',
 589			sizeof(x25->dte_facilities.called_ae));
 590	memset(x25->dte_facilities.calling_ae, '\0',
 591			sizeof(x25->dte_facilities.calling_ae));
 592
 593	rc = 0;
 594out:
 595	return rc;
 596}
 597
 598static struct sock *x25_make_new(struct sock *osk)
 599{
 600	struct sock *sk = NULL;
 601	struct x25_sock *x25, *ox25;
 602
 603	if (osk->sk_type != SOCK_SEQPACKET)
 604		goto out;
 605
 606	if ((sk = x25_alloc_socket(sock_net(osk), 0)) == NULL)
 607		goto out;
 608
 609	x25 = x25_sk(sk);
 610
 611	sk->sk_type        = osk->sk_type;
 612	sk->sk_priority    = osk->sk_priority;
 613	sk->sk_protocol    = osk->sk_protocol;
 614	sk->sk_rcvbuf      = osk->sk_rcvbuf;
 615	sk->sk_sndbuf      = osk->sk_sndbuf;
 616	sk->sk_state       = TCP_ESTABLISHED;
 617	sk->sk_backlog_rcv = osk->sk_backlog_rcv;
 618	sock_copy_flags(sk, osk);
 619
 620	ox25 = x25_sk(osk);
 621	x25->t21        = ox25->t21;
 622	x25->t22        = ox25->t22;
 623	x25->t23        = ox25->t23;
 624	x25->t2         = ox25->t2;
 625	x25->flags	= ox25->flags;
 626	x25->facilities = ox25->facilities;
 627	x25->dte_facilities = ox25->dte_facilities;
 628	x25->cudmatchlength = ox25->cudmatchlength;
 629
 630	clear_bit(X25_INTERRUPT_FLAG, &x25->flags);
 631	x25_init_timers(sk);
 632out:
 633	return sk;
 634}
 635
 636static int x25_release(struct socket *sock)
 637{
 638	struct sock *sk = sock->sk;
 639	struct x25_sock *x25;
 640
 641	if (!sk)
 642		return 0;
 643
 644	x25 = x25_sk(sk);
 645
 646	sock_hold(sk);
 647	lock_sock(sk);
 648	switch (x25->state) {
 649
 650		case X25_STATE_0:
 651		case X25_STATE_2:
 652			x25_disconnect(sk, 0, 0, 0);
 653			__x25_destroy_socket(sk);
 654			goto out;
 655
 656		case X25_STATE_1:
 657		case X25_STATE_3:
 658		case X25_STATE_4:
 659			x25_clear_queues(sk);
 660			x25_write_internal(sk, X25_CLEAR_REQUEST);
 661			x25_start_t23timer(sk);
 662			x25->state = X25_STATE_2;
 663			sk->sk_state	= TCP_CLOSE;
 664			sk->sk_shutdown	|= SEND_SHUTDOWN;
 665			sk->sk_state_change(sk);
 666			sock_set_flag(sk, SOCK_DEAD);
 667			sock_set_flag(sk, SOCK_DESTROY);
 668			break;
 
 
 
 
 
 
 669	}
 670
 671	sock_orphan(sk);
 672out:
 673	release_sock(sk);
 674	sock_put(sk);
 675	return 0;
 676}
 677
 678static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 679{
 680	struct sock *sk = sock->sk;
 681	struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;
 682	int len, i, rc = 0;
 683
 684	if (!sock_flag(sk, SOCK_ZAPPED) ||
 685	    addr_len != sizeof(struct sockaddr_x25) ||
 686	    addr->sx25_family != AF_X25) {
 687		rc = -EINVAL;
 688		goto out;
 689	}
 690
 691	len = strlen(addr->sx25_addr.x25_addr);
 692	for (i = 0; i < len; i++) {
 693		if (!isdigit(addr->sx25_addr.x25_addr[i])) {
 694			rc = -EINVAL;
 695			goto out;
 
 
 
 
 696		}
 697	}
 698
 699	lock_sock(sk);
 700	x25_sk(sk)->source_addr = addr->sx25_addr;
 701	x25_insert_socket(sk);
 702	sock_reset_flag(sk, SOCK_ZAPPED);
 
 
 
 
 703	release_sock(sk);
 704	SOCK_DEBUG(sk, "x25_bind: socket is bound\n");
 705out:
 706	return rc;
 707}
 708
 709static int x25_wait_for_connection_establishment(struct sock *sk)
 710{
 711	DECLARE_WAITQUEUE(wait, current);
 712	int rc;
 713
 714	add_wait_queue_exclusive(sk_sleep(sk), &wait);
 715	for (;;) {
 716		__set_current_state(TASK_INTERRUPTIBLE);
 717		rc = -ERESTARTSYS;
 718		if (signal_pending(current))
 719			break;
 720		rc = sock_error(sk);
 721		if (rc) {
 722			sk->sk_socket->state = SS_UNCONNECTED;
 723			break;
 724		}
 725		rc = 0;
 726		if (sk->sk_state != TCP_ESTABLISHED) {
 727			release_sock(sk);
 728			schedule();
 729			lock_sock(sk);
 730		} else
 731			break;
 732	}
 733	__set_current_state(TASK_RUNNING);
 734	remove_wait_queue(sk_sleep(sk), &wait);
 735	return rc;
 736}
 737
 738static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
 739		       int addr_len, int flags)
 740{
 741	struct sock *sk = sock->sk;
 742	struct x25_sock *x25 = x25_sk(sk);
 743	struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;
 744	struct x25_route *rt;
 745	int rc = 0;
 746
 747	lock_sock(sk);
 748	if (sk->sk_state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
 749		sock->state = SS_CONNECTED;
 750		goto out; /* Connect completed during a ERESTARTSYS event */
 751	}
 752
 753	rc = -ECONNREFUSED;
 754	if (sk->sk_state == TCP_CLOSE && sock->state == SS_CONNECTING) {
 755		sock->state = SS_UNCONNECTED;
 756		goto out;
 757	}
 758
 759	rc = -EISCONN;	/* No reconnect on a seqpacket socket */
 760	if (sk->sk_state == TCP_ESTABLISHED)
 761		goto out;
 762
 
 
 
 
 763	sk->sk_state   = TCP_CLOSE;
 764	sock->state = SS_UNCONNECTED;
 765
 766	rc = -EINVAL;
 767	if (addr_len != sizeof(struct sockaddr_x25) ||
 768	    addr->sx25_family != AF_X25)
 
 769		goto out;
 770
 771	rc = -ENETUNREACH;
 772	rt = x25_get_route(&addr->sx25_addr);
 773	if (!rt)
 774		goto out;
 775
 776	x25->neighbour = x25_get_neigh(rt->dev);
 777	if (!x25->neighbour)
 778		goto out_put_route;
 779
 780	x25_limit_facilities(&x25->facilities, x25->neighbour);
 781
 782	x25->lci = x25_new_lci(x25->neighbour);
 783	if (!x25->lci)
 784		goto out_put_neigh;
 785
 786	rc = -EINVAL;
 787	if (sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
 788		goto out_put_neigh;
 789
 790	if (!strcmp(x25->source_addr.x25_addr, null_x25_address.x25_addr))
 791		memset(&x25->source_addr, '\0', X25_ADDR_LEN);
 792
 793	x25->dest_addr = addr->sx25_addr;
 794
 795	/* Move to connecting socket, start sending Connect Requests */
 796	sock->state   = SS_CONNECTING;
 797	sk->sk_state  = TCP_SYN_SENT;
 798
 799	x25->state = X25_STATE_1;
 800
 801	x25_write_internal(sk, X25_CALL_REQUEST);
 802
 803	x25_start_heartbeat(sk);
 804	x25_start_t21timer(sk);
 805
 806	/* Now the loop */
 807	rc = -EINPROGRESS;
 808	if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK))
 809		goto out_put_neigh;
 810
 811	rc = x25_wait_for_connection_establishment(sk);
 812	if (rc)
 813		goto out_put_neigh;
 814
 815	sock->state = SS_CONNECTED;
 816	rc = 0;
 817out_put_neigh:
 818	if (rc)
 
 819		x25_neigh_put(x25->neighbour);
 
 
 
 
 820out_put_route:
 821	x25_route_put(rt);
 822out:
 823	release_sock(sk);
 824	return rc;
 825}
 826
 827static int x25_wait_for_data(struct sock *sk, long timeout)
 828{
 829	DECLARE_WAITQUEUE(wait, current);
 830	int rc = 0;
 831
 832	add_wait_queue_exclusive(sk_sleep(sk), &wait);
 833	for (;;) {
 834		__set_current_state(TASK_INTERRUPTIBLE);
 835		if (sk->sk_shutdown & RCV_SHUTDOWN)
 836			break;
 837		rc = -ERESTARTSYS;
 838		if (signal_pending(current))
 839			break;
 840		rc = -EAGAIN;
 841		if (!timeout)
 842			break;
 843		rc = 0;
 844		if (skb_queue_empty(&sk->sk_receive_queue)) {
 845			release_sock(sk);
 846			timeout = schedule_timeout(timeout);
 847			lock_sock(sk);
 848		} else
 849			break;
 850	}
 851	__set_current_state(TASK_RUNNING);
 852	remove_wait_queue(sk_sleep(sk), &wait);
 853	return rc;
 854}
 855
 856static int x25_accept(struct socket *sock, struct socket *newsock, int flags,
 857		      bool kern)
 858{
 859	struct sock *sk = sock->sk;
 860	struct sock *newsk;
 861	struct sk_buff *skb;
 862	int rc = -EINVAL;
 863
 864	if (!sk)
 865		goto out;
 866
 867	rc = -EOPNOTSUPP;
 868	if (sk->sk_type != SOCK_SEQPACKET)
 869		goto out;
 870
 871	lock_sock(sk);
 872	rc = -EINVAL;
 873	if (sk->sk_state != TCP_LISTEN)
 874		goto out2;
 875
 876	rc = x25_wait_for_data(sk, sk->sk_rcvtimeo);
 877	if (rc)
 878		goto out2;
 879	skb = skb_dequeue(&sk->sk_receive_queue);
 880	rc = -EINVAL;
 881	if (!skb->sk)
 882		goto out2;
 883	newsk		 = skb->sk;
 884	sock_graft(newsk, newsock);
 885
 886	/* Now attach up the new socket */
 887	skb->sk = NULL;
 888	kfree_skb(skb);
 889	sk->sk_ack_backlog--;
 890	newsock->state = SS_CONNECTED;
 891	rc = 0;
 892out2:
 893	release_sock(sk);
 894out:
 895	return rc;
 896}
 897
 898static int x25_getname(struct socket *sock, struct sockaddr *uaddr,
 899		       int peer)
 900{
 901	struct sockaddr_x25 *sx25 = (struct sockaddr_x25 *)uaddr;
 902	struct sock *sk = sock->sk;
 903	struct x25_sock *x25 = x25_sk(sk);
 904	int rc = 0;
 905
 906	if (peer) {
 907		if (sk->sk_state != TCP_ESTABLISHED) {
 908			rc = -ENOTCONN;
 909			goto out;
 910		}
 911		sx25->sx25_addr = x25->dest_addr;
 912	} else
 913		sx25->sx25_addr = x25->source_addr;
 914
 915	sx25->sx25_family = AF_X25;
 916	rc = sizeof(*sx25);
 917
 918out:
 919	return rc;
 920}
 921
 922int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
 923			unsigned int lci)
 924{
 925	struct sock *sk;
 926	struct sock *make;
 927	struct x25_sock *makex25;
 928	struct x25_address source_addr, dest_addr;
 929	struct x25_facilities facilities;
 930	struct x25_dte_facilities dte_facilities;
 931	int len, addr_len, rc;
 932
 933	/*
 934	 *	Remove the LCI and frame type.
 935	 */
 936	skb_pull(skb, X25_STD_MIN_LEN);
 937
 938	/*
 939	 *	Extract the X.25 addresses and convert them to ASCII strings,
 940	 *	and remove them.
 941	 *
 942	 *	Address block is mandatory in call request packets
 943	 */
 944	addr_len = x25_parse_address_block(skb, &source_addr, &dest_addr);
 945	if (addr_len <= 0)
 946		goto out_clear_request;
 947	skb_pull(skb, addr_len);
 948
 949	/*
 950	 *	Get the length of the facilities, skip past them for the moment
 951	 *	get the call user data because this is needed to determine
 952	 *	the correct listener
 953	 *
 954	 *	Facilities length is mandatory in call request packets
 955	 */
 956	if (!pskb_may_pull(skb, 1))
 957		goto out_clear_request;
 958	len = skb->data[0] + 1;
 959	if (!pskb_may_pull(skb, len))
 960		goto out_clear_request;
 961	skb_pull(skb,len);
 962
 963	/*
 964	 *	Ensure that the amount of call user data is valid.
 965	 */
 966	if (skb->len > X25_MAX_CUD_LEN)
 967		goto out_clear_request;
 968
 969	/*
 970	 *	Get all the call user data so it can be used in
 971	 *	x25_find_listener and skb_copy_from_linear_data up ahead.
 972	 */
 973	if (!pskb_may_pull(skb, skb->len))
 974		goto out_clear_request;
 975
 976	/*
 977	 *	Find a listener for the particular address/cud pair.
 978	 */
 979	sk = x25_find_listener(&source_addr,skb);
 980	skb_push(skb,len);
 981
 982	if (sk != NULL && sk_acceptq_is_full(sk)) {
 983		goto out_sock_put;
 984	}
 985
 986	/*
 987	 *	We dont have any listeners for this incoming call.
 988	 *	Try forwarding it.
 989	 */
 990	if (sk == NULL) {
 991		skb_push(skb, addr_len + X25_STD_MIN_LEN);
 992		if (sysctl_x25_forward &&
 993				x25_forward_call(&dest_addr, nb, skb, lci) > 0)
 994		{
 995			/* Call was forwarded, dont process it any more */
 996			kfree_skb(skb);
 997			rc = 1;
 998			goto out;
 999		} else {
1000			/* No listeners, can't forward, clear the call */
1001			goto out_clear_request;
1002		}
1003	}
1004
1005	/*
1006	 *	Try to reach a compromise on the requested facilities.
1007	 */
1008	len = x25_negotiate_facilities(skb, sk, &facilities, &dte_facilities);
1009	if (len == -1)
1010		goto out_sock_put;
1011
1012	/*
1013	 * current neighbour/link might impose additional limits
1014	 * on certain facilties
1015	 */
1016
1017	x25_limit_facilities(&facilities, nb);
1018
1019	/*
1020	 *	Try to create a new socket.
1021	 */
1022	make = x25_make_new(sk);
1023	if (!make)
1024		goto out_sock_put;
1025
1026	/*
1027	 *	Remove the facilities
1028	 */
1029	skb_pull(skb, len);
1030
1031	skb->sk     = make;
1032	make->sk_state = TCP_ESTABLISHED;
1033
1034	makex25 = x25_sk(make);
1035	makex25->lci           = lci;
1036	makex25->dest_addr     = dest_addr;
1037	makex25->source_addr   = source_addr;
 
1038	makex25->neighbour     = nb;
1039	makex25->facilities    = facilities;
1040	makex25->dte_facilities= dte_facilities;
1041	makex25->vc_facil_mask = x25_sk(sk)->vc_facil_mask;
1042	/* ensure no reverse facil on accept */
1043	makex25->vc_facil_mask &= ~X25_MASK_REVERSE;
1044	/* ensure no calling address extension on accept */
1045	makex25->vc_facil_mask &= ~X25_MASK_CALLING_AE;
1046	makex25->cudmatchlength = x25_sk(sk)->cudmatchlength;
1047
1048	/* Normally all calls are accepted immediately */
1049	if (test_bit(X25_ACCPT_APPRV_FLAG, &makex25->flags)) {
1050		x25_write_internal(make, X25_CALL_ACCEPTED);
1051		makex25->state = X25_STATE_3;
 
 
1052	}
1053
1054	/*
1055	 *	Incoming Call User Data.
1056	 */
1057	skb_copy_from_linear_data(skb, makex25->calluserdata.cuddata, skb->len);
1058	makex25->calluserdata.cudlength = skb->len;
1059
1060	sk->sk_ack_backlog++;
1061
1062	x25_insert_socket(make);
1063
1064	skb_queue_head(&sk->sk_receive_queue, skb);
1065
1066	x25_start_heartbeat(make);
1067
1068	if (!sock_flag(sk, SOCK_DEAD))
1069		sk->sk_data_ready(sk);
1070	rc = 1;
1071	sock_put(sk);
1072out:
1073	return rc;
1074out_sock_put:
1075	sock_put(sk);
1076out_clear_request:
1077	rc = 0;
1078	x25_transmit_clear_request(nb, lci, 0x01);
1079	goto out;
1080}
1081
1082static int x25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
1083{
1084	struct sock *sk = sock->sk;
1085	struct x25_sock *x25 = x25_sk(sk);
1086	DECLARE_SOCKADDR(struct sockaddr_x25 *, usx25, msg->msg_name);
1087	struct sockaddr_x25 sx25;
1088	struct sk_buff *skb;
1089	unsigned char *asmptr;
1090	int noblock = msg->msg_flags & MSG_DONTWAIT;
1091	size_t size;
1092	int qbit = 0, rc = -EINVAL;
1093
1094	lock_sock(sk);
1095	if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_OOB|MSG_EOR|MSG_CMSG_COMPAT))
1096		goto out;
1097
1098	/* we currently don't support segmented records at the user interface */
1099	if (!(msg->msg_flags & (MSG_EOR|MSG_OOB)))
1100		goto out;
1101
1102	rc = -EADDRNOTAVAIL;
1103	if (sock_flag(sk, SOCK_ZAPPED))
1104		goto out;
1105
1106	rc = -EPIPE;
1107	if (sk->sk_shutdown & SEND_SHUTDOWN) {
1108		send_sig(SIGPIPE, current, 0);
1109		goto out;
1110	}
1111
1112	rc = -ENETUNREACH;
1113	if (!x25->neighbour)
1114		goto out;
1115
1116	if (usx25) {
1117		rc = -EINVAL;
1118		if (msg->msg_namelen < sizeof(sx25))
1119			goto out;
1120		memcpy(&sx25, usx25, sizeof(sx25));
1121		rc = -EISCONN;
1122		if (strcmp(x25->dest_addr.x25_addr, sx25.sx25_addr.x25_addr))
1123			goto out;
1124		rc = -EINVAL;
1125		if (sx25.sx25_family != AF_X25)
1126			goto out;
1127	} else {
1128		/*
1129		 *	FIXME 1003.1g - if the socket is like this because
1130		 *	it has become closed (not started closed) we ought
1131		 *	to SIGPIPE, EPIPE;
1132		 */
1133		rc = -ENOTCONN;
1134		if (sk->sk_state != TCP_ESTABLISHED)
1135			goto out;
1136
1137		sx25.sx25_family = AF_X25;
1138		sx25.sx25_addr   = x25->dest_addr;
1139	}
1140
1141	/* Sanity check the packet size */
1142	if (len > 65535) {
1143		rc = -EMSGSIZE;
1144		goto out;
1145	}
1146
1147	SOCK_DEBUG(sk, "x25_sendmsg: sendto: Addresses built.\n");
1148
1149	/* Build a packet */
1150	SOCK_DEBUG(sk, "x25_sendmsg: sendto: building packet.\n");
1151
1152	if ((msg->msg_flags & MSG_OOB) && len > 32)
1153		len = 32;
1154
1155	size = len + X25_MAX_L2_LEN + X25_EXT_MIN_LEN;
1156
1157	release_sock(sk);
1158	skb = sock_alloc_send_skb(sk, size, noblock, &rc);
1159	lock_sock(sk);
1160	if (!skb)
1161		goto out;
1162	X25_SKB_CB(skb)->flags = msg->msg_flags;
1163
1164	skb_reserve(skb, X25_MAX_L2_LEN + X25_EXT_MIN_LEN);
1165
1166	/*
1167	 *	Put the data on the end
1168	 */
1169	SOCK_DEBUG(sk, "x25_sendmsg: Copying user data\n");
1170
1171	skb_reset_transport_header(skb);
1172	skb_put(skb, len);
1173
1174	rc = memcpy_from_msg(skb_transport_header(skb), msg, len);
1175	if (rc)
1176		goto out_kfree_skb;
1177
1178	/*
1179	 *	If the Q BIT Include socket option is in force, the first
1180	 *	byte of the user data is the logical value of the Q Bit.
1181	 */
1182	if (test_bit(X25_Q_BIT_FLAG, &x25->flags)) {
1183		if (!pskb_may_pull(skb, 1))
1184			goto out_kfree_skb;
1185
1186		qbit = skb->data[0];
1187		skb_pull(skb, 1);
1188	}
1189
1190	/*
1191	 *	Push down the X.25 header
1192	 */
1193	SOCK_DEBUG(sk, "x25_sendmsg: Building X.25 Header.\n");
1194
1195	if (msg->msg_flags & MSG_OOB) {
1196		if (x25->neighbour->extended) {
1197			asmptr    = skb_push(skb, X25_STD_MIN_LEN);
1198			*asmptr++ = ((x25->lci >> 8) & 0x0F) | X25_GFI_EXTSEQ;
1199			*asmptr++ = (x25->lci >> 0) & 0xFF;
1200			*asmptr++ = X25_INTERRUPT;
1201		} else {
1202			asmptr    = skb_push(skb, X25_STD_MIN_LEN);
1203			*asmptr++ = ((x25->lci >> 8) & 0x0F) | X25_GFI_STDSEQ;
1204			*asmptr++ = (x25->lci >> 0) & 0xFF;
1205			*asmptr++ = X25_INTERRUPT;
1206		}
1207	} else {
1208		if (x25->neighbour->extended) {
1209			/* Build an Extended X.25 header */
1210			asmptr    = skb_push(skb, X25_EXT_MIN_LEN);
1211			*asmptr++ = ((x25->lci >> 8) & 0x0F) | X25_GFI_EXTSEQ;
1212			*asmptr++ = (x25->lci >> 0) & 0xFF;
1213			*asmptr++ = X25_DATA;
1214			*asmptr++ = X25_DATA;
1215		} else {
1216			/* Build an Standard X.25 header */
1217			asmptr    = skb_push(skb, X25_STD_MIN_LEN);
1218			*asmptr++ = ((x25->lci >> 8) & 0x0F) | X25_GFI_STDSEQ;
1219			*asmptr++ = (x25->lci >> 0) & 0xFF;
1220			*asmptr++ = X25_DATA;
1221		}
1222
1223		if (qbit)
1224			skb->data[0] |= X25_Q_BIT;
1225	}
1226
1227	SOCK_DEBUG(sk, "x25_sendmsg: Built header.\n");
1228	SOCK_DEBUG(sk, "x25_sendmsg: Transmitting buffer\n");
1229
1230	rc = -ENOTCONN;
1231	if (sk->sk_state != TCP_ESTABLISHED)
1232		goto out_kfree_skb;
1233
1234	if (msg->msg_flags & MSG_OOB)
1235		skb_queue_tail(&x25->interrupt_out_queue, skb);
1236	else {
1237		rc = x25_output(sk, skb);
1238		len = rc;
1239		if (rc < 0)
1240			kfree_skb(skb);
1241		else if (test_bit(X25_Q_BIT_FLAG, &x25->flags))
1242			len++;
1243	}
1244
1245	x25_kick(sk);
1246	rc = len;
1247out:
1248	release_sock(sk);
1249	return rc;
1250out_kfree_skb:
1251	kfree_skb(skb);
1252	goto out;
1253}
1254
1255
1256static int x25_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
1257		       int flags)
1258{
1259	struct sock *sk = sock->sk;
1260	struct x25_sock *x25 = x25_sk(sk);
1261	DECLARE_SOCKADDR(struct sockaddr_x25 *, sx25, msg->msg_name);
1262	size_t copied;
1263	int qbit, header_len;
1264	struct sk_buff *skb;
1265	unsigned char *asmptr;
1266	int rc = -ENOTCONN;
1267
1268	lock_sock(sk);
1269
1270	if (x25->neighbour == NULL)
1271		goto out;
1272
1273	header_len = x25->neighbour->extended ?
1274		X25_EXT_MIN_LEN : X25_STD_MIN_LEN;
1275
1276	/*
1277	 * This works for seqpacket too. The receiver has ordered the queue for
1278	 * us! We do one quick check first though
1279	 */
1280	if (sk->sk_state != TCP_ESTABLISHED)
1281		goto out;
1282
1283	if (flags & MSG_OOB) {
1284		rc = -EINVAL;
1285		if (sock_flag(sk, SOCK_URGINLINE) ||
1286		    !skb_peek(&x25->interrupt_in_queue))
1287			goto out;
1288
1289		skb = skb_dequeue(&x25->interrupt_in_queue);
1290
1291		if (!pskb_may_pull(skb, X25_STD_MIN_LEN))
1292			goto out_free_dgram;
1293
1294		skb_pull(skb, X25_STD_MIN_LEN);
1295
1296		/*
1297		 *	No Q bit information on Interrupt data.
1298		 */
1299		if (test_bit(X25_Q_BIT_FLAG, &x25->flags)) {
1300			asmptr  = skb_push(skb, 1);
1301			*asmptr = 0x00;
1302		}
1303
1304		msg->msg_flags |= MSG_OOB;
1305	} else {
1306		/* Now we can treat all alike */
1307		release_sock(sk);
1308		skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
1309					flags & MSG_DONTWAIT, &rc);
1310		lock_sock(sk);
1311		if (!skb)
1312			goto out;
1313
1314		if (!pskb_may_pull(skb, header_len))
1315			goto out_free_dgram;
1316
1317		qbit = (skb->data[0] & X25_Q_BIT) == X25_Q_BIT;
1318
1319		skb_pull(skb, header_len);
1320
1321		if (test_bit(X25_Q_BIT_FLAG, &x25->flags)) {
1322			asmptr  = skb_push(skb, 1);
1323			*asmptr = qbit;
1324		}
1325	}
1326
1327	skb_reset_transport_header(skb);
1328	copied = skb->len;
1329
1330	if (copied > size) {
1331		copied = size;
1332		msg->msg_flags |= MSG_TRUNC;
1333	}
1334
1335	/* Currently, each datagram always contains a complete record */
1336	msg->msg_flags |= MSG_EOR;
1337
1338	rc = skb_copy_datagram_msg(skb, 0, msg, copied);
1339	if (rc)
1340		goto out_free_dgram;
1341
1342	if (sx25) {
1343		sx25->sx25_family = AF_X25;
1344		sx25->sx25_addr   = x25->dest_addr;
1345		msg->msg_namelen = sizeof(*sx25);
1346	}
1347
1348	x25_check_rbuf(sk);
1349	rc = copied;
1350out_free_dgram:
1351	skb_free_datagram(sk, skb);
1352out:
1353	release_sock(sk);
1354	return rc;
1355}
1356
1357
1358static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
1359{
1360	struct sock *sk = sock->sk;
1361	struct x25_sock *x25 = x25_sk(sk);
1362	void __user *argp = (void __user *)arg;
1363	int rc;
1364
1365	switch (cmd) {
1366	case TIOCOUTQ: {
1367		int amount;
1368
1369		amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
1370		if (amount < 0)
1371			amount = 0;
1372		rc = put_user(amount, (unsigned int __user *)argp);
1373		break;
1374	}
1375
1376	case TIOCINQ: {
1377		struct sk_buff *skb;
1378		int amount = 0;
1379		/*
1380		 * These two are safe on a single CPU system as
1381		 * only user tasks fiddle here
1382		 */
1383		lock_sock(sk);
1384		if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL)
1385			amount = skb->len;
1386		release_sock(sk);
1387		rc = put_user(amount, (unsigned int __user *)argp);
1388		break;
1389	}
1390
1391	case SIOCGSTAMP:
1392		rc = -EINVAL;
1393		if (sk)
1394			rc = sock_get_timestamp(sk,
1395						(struct timeval __user *)argp);
1396		break;
1397	case SIOCGSTAMPNS:
1398		rc = -EINVAL;
1399		if (sk)
1400			rc = sock_get_timestampns(sk,
1401					(struct timespec __user *)argp);
1402		break;
1403	case SIOCGIFADDR:
1404	case SIOCSIFADDR:
1405	case SIOCGIFDSTADDR:
1406	case SIOCSIFDSTADDR:
1407	case SIOCGIFBRDADDR:
1408	case SIOCSIFBRDADDR:
1409	case SIOCGIFNETMASK:
1410	case SIOCSIFNETMASK:
1411	case SIOCGIFMETRIC:
1412	case SIOCSIFMETRIC:
1413		rc = -EINVAL;
1414		break;
1415	case SIOCADDRT:
1416	case SIOCDELRT:
1417		rc = -EPERM;
1418		if (!capable(CAP_NET_ADMIN))
1419			break;
1420		rc = x25_route_ioctl(cmd, argp);
1421		break;
1422	case SIOCX25GSUBSCRIP:
1423		rc = x25_subscr_ioctl(cmd, argp);
1424		break;
1425	case SIOCX25SSUBSCRIP:
1426		rc = -EPERM;
1427		if (!capable(CAP_NET_ADMIN))
1428			break;
1429		rc = x25_subscr_ioctl(cmd, argp);
1430		break;
1431	case SIOCX25GFACILITIES: {
1432		lock_sock(sk);
1433		rc = copy_to_user(argp, &x25->facilities,
1434				  sizeof(x25->facilities))
1435			? -EFAULT : 0;
1436		release_sock(sk);
1437		break;
1438	}
1439
1440	case SIOCX25SFACILITIES: {
1441		struct x25_facilities facilities;
1442		rc = -EFAULT;
1443		if (copy_from_user(&facilities, argp, sizeof(facilities)))
1444			break;
1445		rc = -EINVAL;
1446		lock_sock(sk);
1447		if (sk->sk_state != TCP_LISTEN &&
1448		    sk->sk_state != TCP_CLOSE)
1449			goto out_fac_release;
1450		if (facilities.pacsize_in < X25_PS16 ||
1451		    facilities.pacsize_in > X25_PS4096)
1452			goto out_fac_release;
1453		if (facilities.pacsize_out < X25_PS16 ||
1454		    facilities.pacsize_out > X25_PS4096)
1455			goto out_fac_release;
1456		if (facilities.winsize_in < 1 ||
1457		    facilities.winsize_in > 127)
1458			goto out_fac_release;
1459		if (facilities.throughput) {
1460			int out = facilities.throughput & 0xf0;
1461			int in  = facilities.throughput & 0x0f;
1462			if (!out)
1463				facilities.throughput |=
1464					X25_DEFAULT_THROUGHPUT << 4;
1465			else if (out < 0x30 || out > 0xD0)
1466				goto out_fac_release;
1467			if (!in)
1468				facilities.throughput |=
1469					X25_DEFAULT_THROUGHPUT;
1470			else if (in < 0x03 || in > 0x0D)
1471				goto out_fac_release;
1472		}
1473		if (facilities.reverse &&
1474		    (facilities.reverse & 0x81) != 0x81)
1475			goto out_fac_release;
1476		x25->facilities = facilities;
1477		rc = 0;
1478out_fac_release:
1479		release_sock(sk);
1480		break;
1481	}
1482
1483	case SIOCX25GDTEFACILITIES: {
1484		lock_sock(sk);
1485		rc = copy_to_user(argp, &x25->dte_facilities,
1486				  sizeof(x25->dte_facilities));
1487		release_sock(sk);
1488		if (rc)
1489			rc = -EFAULT;
1490		break;
1491	}
1492
1493	case SIOCX25SDTEFACILITIES: {
1494		struct x25_dte_facilities dtefacs;
1495		rc = -EFAULT;
1496		if (copy_from_user(&dtefacs, argp, sizeof(dtefacs)))
1497			break;
1498		rc = -EINVAL;
1499		lock_sock(sk);
1500		if (sk->sk_state != TCP_LISTEN &&
1501		    sk->sk_state != TCP_CLOSE)
1502			goto out_dtefac_release;
1503		if (dtefacs.calling_len > X25_MAX_AE_LEN)
1504			goto out_dtefac_release;
1505		if (dtefacs.called_len > X25_MAX_AE_LEN)
1506			goto out_dtefac_release;
1507		x25->dte_facilities = dtefacs;
1508		rc = 0;
1509out_dtefac_release:
1510		release_sock(sk);
1511		break;
1512	}
1513
1514	case SIOCX25GCALLUSERDATA: {
1515		lock_sock(sk);
1516		rc = copy_to_user(argp, &x25->calluserdata,
1517				  sizeof(x25->calluserdata))
1518			? -EFAULT : 0;
1519		release_sock(sk);
1520		break;
1521	}
1522
1523	case SIOCX25SCALLUSERDATA: {
1524		struct x25_calluserdata calluserdata;
1525
1526		rc = -EFAULT;
1527		if (copy_from_user(&calluserdata, argp, sizeof(calluserdata)))
1528			break;
1529		rc = -EINVAL;
1530		if (calluserdata.cudlength > X25_MAX_CUD_LEN)
1531			break;
1532		lock_sock(sk);
1533		x25->calluserdata = calluserdata;
1534		release_sock(sk);
1535		rc = 0;
1536		break;
1537	}
1538
1539	case SIOCX25GCAUSEDIAG: {
1540		lock_sock(sk);
1541		rc = copy_to_user(argp, &x25->causediag, sizeof(x25->causediag))
1542			? -EFAULT : 0;
1543		release_sock(sk);
1544		break;
1545	}
1546
1547	case SIOCX25SCAUSEDIAG: {
1548		struct x25_causediag causediag;
1549		rc = -EFAULT;
1550		if (copy_from_user(&causediag, argp, sizeof(causediag)))
1551			break;
1552		lock_sock(sk);
1553		x25->causediag = causediag;
1554		release_sock(sk);
1555		rc = 0;
1556		break;
1557
1558	}
1559
1560	case SIOCX25SCUDMATCHLEN: {
1561		struct x25_subaddr sub_addr;
1562		rc = -EINVAL;
1563		lock_sock(sk);
1564		if(sk->sk_state != TCP_CLOSE)
1565			goto out_cud_release;
1566		rc = -EFAULT;
1567		if (copy_from_user(&sub_addr, argp,
1568				   sizeof(sub_addr)))
1569			goto out_cud_release;
1570		rc = -EINVAL;
1571		if (sub_addr.cudmatchlength > X25_MAX_CUD_LEN)
1572			goto out_cud_release;
1573		x25->cudmatchlength = sub_addr.cudmatchlength;
1574		rc = 0;
1575out_cud_release:
1576		release_sock(sk);
1577		break;
1578	}
1579
1580	case SIOCX25CALLACCPTAPPRV: {
1581		rc = -EINVAL;
1582		lock_sock(sk);
1583		if (sk->sk_state == TCP_CLOSE) {
1584			clear_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);
1585			rc = 0;
1586		}
1587		release_sock(sk);
1588		break;
1589	}
1590
1591	case SIOCX25SENDCALLACCPT:  {
1592		rc = -EINVAL;
1593		lock_sock(sk);
1594		if (sk->sk_state != TCP_ESTABLISHED)
1595			goto out_sendcallaccpt_release;
1596		/* must call accptapprv above */
1597		if (test_bit(X25_ACCPT_APPRV_FLAG, &x25->flags))
1598			goto out_sendcallaccpt_release;
1599		x25_write_internal(sk, X25_CALL_ACCEPTED);
1600		x25->state = X25_STATE_3;
1601		rc = 0;
1602out_sendcallaccpt_release:
1603		release_sock(sk);
1604		break;
1605	}
1606
1607	default:
1608		rc = -ENOIOCTLCMD;
1609		break;
1610	}
1611
1612	return rc;
1613}
1614
1615static const struct net_proto_family x25_family_ops = {
1616	.family =	AF_X25,
1617	.create =	x25_create,
1618	.owner	=	THIS_MODULE,
1619};
1620
1621#ifdef CONFIG_COMPAT
1622static int compat_x25_subscr_ioctl(unsigned int cmd,
1623		struct compat_x25_subscrip_struct __user *x25_subscr32)
1624{
1625	struct compat_x25_subscrip_struct x25_subscr;
1626	struct x25_neigh *nb;
1627	struct net_device *dev;
1628	int rc = -EINVAL;
1629
1630	rc = -EFAULT;
1631	if (copy_from_user(&x25_subscr, x25_subscr32, sizeof(*x25_subscr32)))
1632		goto out;
1633
1634	rc = -EINVAL;
1635	dev = x25_dev_get(x25_subscr.device);
1636	if (dev == NULL)
1637		goto out;
1638
1639	nb = x25_get_neigh(dev);
1640	if (nb == NULL)
1641		goto out_dev_put;
1642
1643	dev_put(dev);
1644
1645	if (cmd == SIOCX25GSUBSCRIP) {
1646		read_lock_bh(&x25_neigh_list_lock);
1647		x25_subscr.extended = nb->extended;
1648		x25_subscr.global_facil_mask = nb->global_facil_mask;
1649		read_unlock_bh(&x25_neigh_list_lock);
1650		rc = copy_to_user(x25_subscr32, &x25_subscr,
1651				sizeof(*x25_subscr32)) ? -EFAULT : 0;
1652	} else {
1653		rc = -EINVAL;
1654		if (x25_subscr.extended == 0 || x25_subscr.extended == 1) {
1655			rc = 0;
1656			write_lock_bh(&x25_neigh_list_lock);
1657			nb->extended = x25_subscr.extended;
1658			nb->global_facil_mask = x25_subscr.global_facil_mask;
1659			write_unlock_bh(&x25_neigh_list_lock);
1660		}
1661	}
1662	x25_neigh_put(nb);
1663out:
1664	return rc;
1665out_dev_put:
1666	dev_put(dev);
1667	goto out;
1668}
1669
1670static int compat_x25_ioctl(struct socket *sock, unsigned int cmd,
1671				unsigned long arg)
1672{
1673	void __user *argp = compat_ptr(arg);
1674	struct sock *sk = sock->sk;
1675
1676	int rc = -ENOIOCTLCMD;
1677
1678	switch(cmd) {
1679	case TIOCOUTQ:
1680	case TIOCINQ:
1681		rc = x25_ioctl(sock, cmd, (unsigned long)argp);
1682		break;
1683	case SIOCGSTAMP:
1684		rc = -EINVAL;
1685		if (sk)
1686			rc = compat_sock_get_timestamp(sk,
1687					(struct timeval __user*)argp);
1688		break;
1689	case SIOCGSTAMPNS:
1690		rc = -EINVAL;
1691		if (sk)
1692			rc = compat_sock_get_timestampns(sk,
1693					(struct timespec __user*)argp);
1694		break;
1695	case SIOCGIFADDR:
1696	case SIOCSIFADDR:
1697	case SIOCGIFDSTADDR:
1698	case SIOCSIFDSTADDR:
1699	case SIOCGIFBRDADDR:
1700	case SIOCSIFBRDADDR:
1701	case SIOCGIFNETMASK:
1702	case SIOCSIFNETMASK:
1703	case SIOCGIFMETRIC:
1704	case SIOCSIFMETRIC:
1705		rc = -EINVAL;
1706		break;
1707	case SIOCADDRT:
1708	case SIOCDELRT:
1709		rc = -EPERM;
1710		if (!capable(CAP_NET_ADMIN))
1711			break;
1712		rc = x25_route_ioctl(cmd, argp);
1713		break;
1714	case SIOCX25GSUBSCRIP:
1715		rc = compat_x25_subscr_ioctl(cmd, argp);
1716		break;
1717	case SIOCX25SSUBSCRIP:
1718		rc = -EPERM;
1719		if (!capable(CAP_NET_ADMIN))
1720			break;
1721		rc = compat_x25_subscr_ioctl(cmd, argp);
1722		break;
1723	case SIOCX25GFACILITIES:
1724	case SIOCX25SFACILITIES:
1725	case SIOCX25GDTEFACILITIES:
1726	case SIOCX25SDTEFACILITIES:
1727	case SIOCX25GCALLUSERDATA:
1728	case SIOCX25SCALLUSERDATA:
1729	case SIOCX25GCAUSEDIAG:
1730	case SIOCX25SCAUSEDIAG:
1731	case SIOCX25SCUDMATCHLEN:
1732	case SIOCX25CALLACCPTAPPRV:
1733	case SIOCX25SENDCALLACCPT:
1734		rc = x25_ioctl(sock, cmd, (unsigned long)argp);
1735		break;
1736	default:
1737		rc = -ENOIOCTLCMD;
1738		break;
1739	}
1740	return rc;
1741}
1742#endif
1743
1744static const struct proto_ops x25_proto_ops = {
1745	.family =	AF_X25,
1746	.owner =	THIS_MODULE,
1747	.release =	x25_release,
1748	.bind =		x25_bind,
1749	.connect =	x25_connect,
1750	.socketpair =	sock_no_socketpair,
1751	.accept =	x25_accept,
1752	.getname =	x25_getname,
1753	.poll =		datagram_poll,
1754	.ioctl =	x25_ioctl,
1755#ifdef CONFIG_COMPAT
1756	.compat_ioctl = compat_x25_ioctl,
1757#endif
 
1758	.listen =	x25_listen,
1759	.shutdown =	sock_no_shutdown,
1760	.setsockopt =	x25_setsockopt,
1761	.getsockopt =	x25_getsockopt,
1762	.sendmsg =	x25_sendmsg,
1763	.recvmsg =	x25_recvmsg,
1764	.mmap =		sock_no_mmap,
1765	.sendpage =	sock_no_sendpage,
1766};
1767
1768static struct packet_type x25_packet_type __read_mostly = {
1769	.type =	cpu_to_be16(ETH_P_X25),
1770	.func =	x25_lapb_receive_frame,
1771};
1772
1773static struct notifier_block x25_dev_notifier = {
1774	.notifier_call = x25_device_event,
1775};
1776
1777void x25_kill_by_neigh(struct x25_neigh *nb)
1778{
1779	struct sock *s;
1780
1781	write_lock_bh(&x25_list_lock);
1782
1783	sk_for_each(s, &x25_list)
1784		if (x25_sk(s)->neighbour == nb)
1785			x25_disconnect(s, ENETUNREACH, 0, 0);
1786
1787	write_unlock_bh(&x25_list_lock);
1788
1789	/* Remove any related forwards */
1790	x25_clear_forward_by_dev(nb->dev);
1791}
1792
1793static int __init x25_init(void)
1794{
1795	int rc;
1796
1797	rc = proto_register(&x25_proto, 0);
1798	if (rc)
1799		goto out;
1800
1801	rc = sock_register(&x25_family_ops);
1802	if (rc)
1803		goto out_proto;
1804
1805	dev_add_pack(&x25_packet_type);
1806
1807	rc = register_netdevice_notifier(&x25_dev_notifier);
1808	if (rc)
1809		goto out_sock;
1810
1811	rc = x25_register_sysctl();
1812	if (rc)
1813		goto out_dev;
1814
1815	rc = x25_proc_init();
1816	if (rc)
1817		goto out_sysctl;
1818
1819	pr_info("Linux Version 0.2\n");
1820
1821out:
1822	return rc;
1823out_sysctl:
1824	x25_unregister_sysctl();
1825out_dev:
1826	unregister_netdevice_notifier(&x25_dev_notifier);
1827out_sock:
1828	dev_remove_pack(&x25_packet_type);
1829	sock_unregister(AF_X25);
1830out_proto:
1831	proto_unregister(&x25_proto);
1832	goto out;
1833}
1834module_init(x25_init);
1835
1836static void __exit x25_exit(void)
1837{
1838	x25_proc_exit();
1839	x25_link_free();
1840	x25_route_free();
1841
1842	x25_unregister_sysctl();
1843
1844	unregister_netdevice_notifier(&x25_dev_notifier);
1845
1846	dev_remove_pack(&x25_packet_type);
1847
1848	sock_unregister(AF_X25);
1849	proto_unregister(&x25_proto);
1850}
1851module_exit(x25_exit);
1852
1853MODULE_AUTHOR("Jonathan Naylor <g4klx@g4klx.demon.co.uk>");
1854MODULE_DESCRIPTION("The X.25 Packet Layer network layer protocol");
1855MODULE_LICENSE("GPL");
1856MODULE_ALIAS_NETPROTO(PF_X25);