Linux Kernel  3.7.1
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
ax25_in.c
Go to the documentation of this file.
1 /*
2  * This program is free software; you can redistribute it and/or modify
3  * it under the terms of the GNU General Public License as published by
4  * the Free Software Foundation; either version 2 of the License, or
5  * (at your option) any later version.
6  *
7  * Copyright (C) Alan Cox GW4PTS ([email protected])
8  * Copyright (C) Jonathan Naylor G4KLX ([email protected])
9  * Copyright (C) Joerg Reuter DL1BKE ([email protected])
10  * Copyright (C) Hans-Joachim Hetscher DD8NE ([email protected])
11  */
12 #include <linux/errno.h>
13 #include <linux/types.h>
14 #include <linux/socket.h>
15 #include <linux/in.h>
16 #include <linux/kernel.h>
17 #include <linux/timer.h>
18 #include <linux/string.h>
19 #include <linux/sockios.h>
20 #include <linux/net.h>
21 #include <linux/slab.h>
22 #include <net/ax25.h>
23 #include <linux/inet.h>
24 #include <linux/netdevice.h>
25 #include <linux/skbuff.h>
26 #include <linux/netfilter.h>
27 #include <net/sock.h>
28 #include <net/tcp_states.h>
29 #include <asm/uaccess.h>
30 #include <linux/fcntl.h>
31 #include <linux/mm.h>
32 #include <linux/interrupt.h>
33 
34 /*
35  * Given a fragment, queue it on the fragment queue and if the fragment
36  * is complete, send it back to ax25_rx_iframe.
37  */
38 static int ax25_rx_fragment(ax25_cb *ax25, struct sk_buff *skb)
39 {
40  struct sk_buff *skbn, *skbo;
41 
42  if (ax25->fragno != 0) {
43  if (!(*skb->data & AX25_SEG_FIRST)) {
44  if ((ax25->fragno - 1) == (*skb->data & AX25_SEG_REM)) {
45  /* Enqueue fragment */
46  ax25->fragno = *skb->data & AX25_SEG_REM;
47  skb_pull(skb, 1); /* skip fragno */
48  ax25->fraglen += skb->len;
49  skb_queue_tail(&ax25->frag_queue, skb);
50 
51  /* Last fragment received ? */
52  if (ax25->fragno == 0) {
53  skbn = alloc_skb(AX25_MAX_HEADER_LEN +
54  ax25->fraglen,
55  GFP_ATOMIC);
56  if (!skbn) {
58  return 1;
59  }
60 
61  skb_reserve(skbn, AX25_MAX_HEADER_LEN);
62 
63  skbn->dev = ax25->ax25_dev->dev;
64  skb_reset_network_header(skbn);
65  skb_reset_transport_header(skbn);
66 
67  /* Copy data from the fragments */
68  while ((skbo = skb_dequeue(&ax25->frag_queue)) != NULL) {
69  skb_copy_from_linear_data(skbo,
70  skb_put(skbn, skbo->len),
71  skbo->len);
72  kfree_skb(skbo);
73  }
74 
75  ax25->fraglen = 0;
76 
77  if (ax25_rx_iframe(ax25, skbn) == 0)
78  kfree_skb(skbn);
79  }
80 
81  return 1;
82  }
83  }
84  } else {
85  /* First fragment received */
86  if (*skb->data & AX25_SEG_FIRST) {
88  ax25->fragno = *skb->data & AX25_SEG_REM;
89  skb_pull(skb, 1); /* skip fragno */
90  ax25->fraglen = skb->len;
91  skb_queue_tail(&ax25->frag_queue, skb);
92  return 1;
93  }
94  }
95 
96  return 0;
97 }
98 
99 /*
100  * This is where all valid I frames are sent to, to be dispatched to
101  * whichever protocol requires them.
102  */
103 int ax25_rx_iframe(ax25_cb *ax25, struct sk_buff *skb)
104 {
105  int (*func)(struct sk_buff *, ax25_cb *);
106  unsigned char pid;
107  int queued = 0;
108 
109  if (skb == NULL) return 0;
110 
111  ax25_start_idletimer(ax25);
112 
113  pid = *skb->data;
114 
115  if (pid == AX25_P_IP) {
116  /* working around a TCP bug to keep additional listeners
117  * happy. TCP re-uses the buffer and destroys the original
118  * content.
119  */
120  struct sk_buff *skbn = skb_copy(skb, GFP_ATOMIC);
121  if (skbn != NULL) {
122  kfree_skb(skb);
123  skb = skbn;
124  }
125 
126  skb_pull(skb, 1); /* Remove PID */
127  skb->mac_header = skb->network_header;
128  skb_reset_network_header(skb);
129  skb->dev = ax25->ax25_dev->dev;
130  skb->pkt_type = PACKET_HOST;
131  skb->protocol = htons(ETH_P_IP);
132  netif_rx(skb);
133  return 1;
134  }
135  if (pid == AX25_P_SEGMENT) {
136  skb_pull(skb, 1); /* Remove PID */
137  return ax25_rx_fragment(ax25, skb);
138  }
139 
140  if ((func = ax25_protocol_function(pid)) != NULL) {
141  skb_pull(skb, 1); /* Remove PID */
142  return (*func)(skb, ax25);
143  }
144 
145  if (ax25->sk != NULL && ax25->ax25_dev->values[AX25_VALUES_CONMODE] == 2) {
146  if ((!ax25->pidincl && ax25->sk->sk_protocol == pid) ||
147  ax25->pidincl) {
148  if (sock_queue_rcv_skb(ax25->sk, skb) == 0)
149  queued = 1;
150  else
152  }
153  }
154 
155  return queued;
156 }
157 
158 /*
159  * Higher level upcall for a LAPB frame
160  */
161 static int ax25_process_rx_frame(ax25_cb *ax25, struct sk_buff *skb, int type, int dama)
162 {
163  int queued = 0;
164 
165  if (ax25->state == AX25_STATE_0)
166  return 0;
167 
168  switch (ax25->ax25_dev->values[AX25_VALUES_PROTOCOL]) {
171  queued = ax25_std_frame_in(ax25, skb, type);
172  break;
173 
174 #ifdef CONFIG_AX25_DAMA_SLAVE
175  case AX25_PROTO_DAMA_SLAVE:
176  if (dama || ax25->ax25_dev->dama.slave)
177  queued = ax25_ds_frame_in(ax25, skb, type);
178  else
179  queued = ax25_std_frame_in(ax25, skb, type);
180  break;
181 #endif
182  }
183 
184  return queued;
185 }
186 
187 static int ax25_rcv(struct sk_buff *skb, struct net_device *dev,
188  ax25_address *dev_addr, struct packet_type *ptype)
189 {
190  ax25_address src, dest, *next_digi = NULL;
191  int type = 0, mine = 0, dama;
192  struct sock *make, *sk;
193  ax25_digi dp, reverse_dp;
194  ax25_cb *ax25;
196 
197  /*
198  * Process the AX.25/LAPB frame.
199  */
200 
201  skb_reset_transport_header(skb);
202 
203  if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL)
204  goto free;
205 
206  /*
207  * Parse the address header.
208  */
209 
210  if (ax25_addr_parse(skb->data, skb->len, &src, &dest, &dp, &type, &dama) == NULL)
211  goto free;
212 
213  /*
214  * Ours perhaps ?
215  */
216  if (dp.lastrepeat + 1 < dp.ndigi) /* Not yet digipeated completely */
217  next_digi = &dp.calls[dp.lastrepeat + 1];
218 
219  /*
220  * Pull of the AX.25 headers leaving the CTRL/PID bytes
221  */
222  skb_pull(skb, ax25_addr_size(&dp));
223 
224  /* For our port addresses ? */
225  if (ax25cmp(&dest, dev_addr) == 0 && dp.lastrepeat + 1 == dp.ndigi)
226  mine = 1;
227 
228  /* Also match on any registered callsign from L3/4 */
229  if (!mine && ax25_listen_mine(&dest, dev) && dp.lastrepeat + 1 == dp.ndigi)
230  mine = 1;
231 
232  /* UI frame - bypass LAPB processing */
233  if ((*skb->data & ~0x10) == AX25_UI && dp.lastrepeat + 1 == dp.ndigi) {
234  skb_set_transport_header(skb, 2); /* skip control and pid */
235 
236  ax25_send_to_raw(&dest, skb, skb->data[1]);
237 
238  if (!mine && ax25cmp(&dest, (ax25_address *)dev->broadcast) != 0)
239  goto free;
240 
241  /* Now we are pointing at the pid byte */
242  switch (skb->data[1]) {
243  case AX25_P_IP:
244  skb_pull(skb,2); /* drop PID/CTRL */
245  skb_reset_transport_header(skb);
246  skb_reset_network_header(skb);
247  skb->dev = dev;
248  skb->pkt_type = PACKET_HOST;
249  skb->protocol = htons(ETH_P_IP);
250  netif_rx(skb);
251  break;
252 
253  case AX25_P_ARP:
254  skb_pull(skb,2);
255  skb_reset_transport_header(skb);
256  skb_reset_network_header(skb);
257  skb->dev = dev;
258  skb->pkt_type = PACKET_HOST;
259  skb->protocol = htons(ETH_P_ARP);
260  netif_rx(skb);
261  break;
262  case AX25_P_TEXT:
263  /* Now find a suitable dgram socket */
264  sk = ax25_get_socket(&dest, &src, SOCK_DGRAM);
265  if (sk != NULL) {
266  bh_lock_sock(sk);
267  if (atomic_read(&sk->sk_rmem_alloc) >=
268  sk->sk_rcvbuf) {
269  kfree_skb(skb);
270  } else {
271  /*
272  * Remove the control and PID.
273  */
274  skb_pull(skb, 2);
275  if (sock_queue_rcv_skb(sk, skb) != 0)
276  kfree_skb(skb);
277  }
278  bh_unlock_sock(sk);
279  sock_put(sk);
280  } else {
281  kfree_skb(skb);
282  }
283  break;
284 
285  default:
286  kfree_skb(skb); /* Will scan SOCK_AX25 RAW sockets */
287  break;
288  }
289 
290  return 0;
291  }
292 
293  /*
294  * Is connected mode supported on this device ?
295  * If not, should we DM the incoming frame (except DMs) or
296  * silently ignore them. For now we stay quiet.
297  */
298  if (ax25_dev->values[AX25_VALUES_CONMODE] == 0)
299  goto free;
300 
301  /* LAPB */
302 
303  /* AX.25 state 1-4 */
304 
305  ax25_digi_invert(&dp, &reverse_dp);
306 
307  if ((ax25 = ax25_find_cb(&dest, &src, &reverse_dp, dev)) != NULL) {
308  /*
309  * Process the frame. If it is queued up internally it
310  * returns one otherwise we free it immediately. This
311  * routine itself wakes the user context layers so we do
312  * no further work
313  */
314  if (ax25_process_rx_frame(ax25, skb, type, dama) == 0)
315  kfree_skb(skb);
316 
317  ax25_cb_put(ax25);
318  return 0;
319  }
320 
321  /* AX.25 state 0 (disconnected) */
322 
323  /* a) received not a SABM(E) */
324 
325  if ((*skb->data & ~AX25_PF) != AX25_SABM &&
326  (*skb->data & ~AX25_PF) != AX25_SABME) {
327  /*
328  * Never reply to a DM. Also ignore any connects for
329  * addresses that are not our interfaces and not a socket.
330  */
331  if ((*skb->data & ~AX25_PF) != AX25_DM && mine)
332  ax25_return_dm(dev, &src, &dest, &dp);
333 
334  goto free;
335  }
336 
337  /* b) received SABM(E) */
338 
339  if (dp.lastrepeat + 1 == dp.ndigi)
340  sk = ax25_find_listener(&dest, 0, dev, SOCK_SEQPACKET);
341  else
342  sk = ax25_find_listener(next_digi, 1, dev, SOCK_SEQPACKET);
343 
344  if (sk != NULL) {
345  bh_lock_sock(sk);
346  if (sk_acceptq_is_full(sk) ||
347  (make = ax25_make_new(sk, ax25_dev)) == NULL) {
348  if (mine)
349  ax25_return_dm(dev, &src, &dest, &dp);
350  kfree_skb(skb);
351  bh_unlock_sock(sk);
352  sock_put(sk);
353 
354  return 0;
355  }
356 
357  ax25 = ax25_sk(make);
358  skb_set_owner_r(skb, make);
359  skb_queue_head(&sk->sk_receive_queue, skb);
360 
361  make->sk_state = TCP_ESTABLISHED;
362 
363  sk->sk_ack_backlog++;
364  bh_unlock_sock(sk);
365  } else {
366  if (!mine)
367  goto free;
368 
369  if ((ax25 = ax25_create_cb()) == NULL) {
370  ax25_return_dm(dev, &src, &dest, &dp);
371  goto free;
372  }
373 
374  ax25_fillin_cb(ax25, ax25_dev);
375  }
376 
377  ax25->source_addr = dest;
378  ax25->dest_addr = src;
379 
380  /*
381  * Sort out any digipeated paths.
382  */
383  if (dp.ndigi && !ax25->digipeat &&
384  (ax25->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
385  kfree_skb(skb);
386  ax25_destroy_socket(ax25);
387  if (sk)
388  sock_put(sk);
389  return 0;
390  }
391 
392  if (dp.ndigi == 0) {
393  kfree(ax25->digipeat);
394  ax25->digipeat = NULL;
395  } else {
396  /* Reverse the source SABM's path */
397  memcpy(ax25->digipeat, &reverse_dp, sizeof(ax25_digi));
398  }
399 
400  if ((*skb->data & ~AX25_PF) == AX25_SABME) {
401  ax25->modulus = AX25_EMODULUS;
402  ax25->window = ax25_dev->values[AX25_VALUES_EWINDOW];
403  } else {
404  ax25->modulus = AX25_MODULUS;
405  ax25->window = ax25_dev->values[AX25_VALUES_WINDOW];
406  }
407 
409 
410 #ifdef CONFIG_AX25_DAMA_SLAVE
411  if (dama && ax25->ax25_dev->values[AX25_VALUES_PROTOCOL] == AX25_PROTO_DAMA_SLAVE)
412  ax25_dama_on(ax25);
413 #endif
414 
415  ax25->state = AX25_STATE_3;
416 
417  ax25_cb_add(ax25);
418 
419  ax25_start_heartbeat(ax25);
420  ax25_start_t3timer(ax25);
421  ax25_start_idletimer(ax25);
422 
423  if (sk) {
424  if (!sock_flag(sk, SOCK_DEAD))
425  sk->sk_data_ready(sk, skb->len);
426  sock_put(sk);
427  } else {
428 free:
429  kfree_skb(skb);
430  }
431  return 0;
432 }
433 
434 /*
435  * Receive an AX.25 frame via a SLIP interface.
436  */
437 int ax25_kiss_rcv(struct sk_buff *skb, struct net_device *dev,
438  struct packet_type *ptype, struct net_device *orig_dev)
439 {
440  skb_orphan(skb);
441 
442  if (!net_eq(dev_net(dev), &init_net)) {
443  kfree_skb(skb);
444  return 0;
445  }
446 
447  if ((*skb->data & 0x0F) != 0) {
448  kfree_skb(skb); /* Not a KISS data frame */
449  return 0;
450  }
451 
452  skb_pull(skb, AX25_KISS_HEADER_LEN); /* Remove the KISS byte */
453 
454  return ax25_rcv(skb, dev, (ax25_address *)dev->dev_addr, ptype);
455 }