1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *	X.25 Packet Layer release 002
4  *
5  *	This is ALPHA test software. This code may break your machine,
6  *	randomly fail to work with new releases, misbehave and/or generally
7  *	screw up. It might even work.
8  *
9  *	This code REQUIRES 2.1.15 or higher
10  *
11  *	History
12  *	X.25 001	Jonathan Naylor	Started coding.
13  *	X.25 002	Jonathan Naylor	Centralised disconnect handling.
14  *					New timer architecture.
15  *	2000-03-11	Henner Eisen	MSG_EOR handling more POSIX compliant.
16  *	2000-03-22	Daniela Squassoni Allowed disabling/enabling of
17  *					  facilities negotiation and increased
18  *					  the throughput upper limit.
19  *	2000-08-27	Arnaldo C. Melo s/suser/capable/ + micro cleanups
20  *	2000-09-04	Henner Eisen	Set sock->state in x25_accept().
21  *					Fixed x25_output() related skb leakage.
22  *	2000-10-02	Henner Eisen	Made x25_kick() single threaded per socket.
23  *	2000-10-27	Henner Eisen    MSG_DONTWAIT for fragment allocation.
24  *	2000-11-14	Henner Eisen    Closing datalink from NETDEV_GOING_DOWN
25  *	2002-10-06	Arnaldo C. Melo Get rid of cli/sti, move proc stuff to
26  *					x25_proc.c, using seq_file
27  *	2005-04-02	Shaun Pereira	Selective sub address matching
28  *					with call user data
29  *	2005-04-15	Shaun Pereira	Fast select with no restriction on
30  *					response
31  */
32 
33 #define pr_fmt(fmt) "X25: " fmt
34 
35 #include <linux/module.h>
36 #include <linux/capability.h>
37 #include <linux/errno.h>
38 #include <linux/kernel.h>
39 #include <linux/sched/signal.h>
40 #include <linux/timer.h>
41 #include <linux/string.h>
42 #include <linux/net.h>
43 #include <linux/netdevice.h>
44 #include <linux/if_arp.h>
45 #include <linux/skbuff.h>
46 #include <linux/slab.h>
47 #include <net/sock.h>
48 #include <net/tcp_states.h>
49 #include <linux/uaccess.h>
50 #include <linux/fcntl.h>
51 #include <linux/termios.h>	/* For TIOCINQ/OUTQ */
52 #include <linux/notifier.h>
53 #include <linux/init.h>
54 #include <linux/compat.h>
55 #include <linux/ctype.h>
56 
57 #include <net/x25.h>
58 #include <net/compat.h>
59 
60 int sysctl_x25_restart_request_timeout = X25_DEFAULT_T20;
61 int sysctl_x25_call_request_timeout    = X25_DEFAULT_T21;
62 int sysctl_x25_reset_request_timeout   = X25_DEFAULT_T22;
63 int sysctl_x25_clear_request_timeout   = X25_DEFAULT_T23;
64 int sysctl_x25_ack_holdback_timeout    = X25_DEFAULT_T2;
65 int sysctl_x25_forward                 = 0;
66 
67 HLIST_HEAD(x25_list);
68 DEFINE_RWLOCK(x25_list_lock);
69 
70 static const struct proto_ops x25_proto_ops;
71 
72 static const struct x25_address null_x25_address = {"               "};
73 
74 #ifdef CONFIG_COMPAT
75 struct compat_x25_subscrip_struct {
76 	char device[200-sizeof(compat_ulong_t)];
77 	compat_ulong_t global_facil_mask;
78 	compat_uint_t extended;
79 };
80 #endif
81 
82 
x25_parse_address_block(struct sk_buff * skb,struct x25_address * called_addr,struct x25_address * calling_addr)83 int x25_parse_address_block(struct sk_buff *skb,
84 		struct x25_address *called_addr,
85 		struct x25_address *calling_addr)
86 {
87 	unsigned char len;
88 	int needed;
89 	int rc;
90 
91 	if (!pskb_may_pull(skb, 1)) {
92 		/* packet has no address block */
93 		rc = 0;
94 		goto empty;
95 	}
96 
97 	len = *skb->data;
98 	needed = 1 + ((len >> 4) + (len & 0x0f) + 1) / 2;
99 
100 	if (!pskb_may_pull(skb, needed)) {
101 		/* packet is too short to hold the addresses it claims
102 		   to hold */
103 		rc = -1;
104 		goto empty;
105 	}
106 
107 	return x25_addr_ntoa(skb->data, called_addr, calling_addr);
108 
109 empty:
110 	*called_addr->x25_addr = 0;
111 	*calling_addr->x25_addr = 0;
112 
113 	return rc;
114 }
115 
116 
x25_addr_ntoa(unsigned char * p,struct x25_address * called_addr,struct x25_address * calling_addr)117 int x25_addr_ntoa(unsigned char *p, struct x25_address *called_addr,
118 		  struct x25_address *calling_addr)
119 {
120 	unsigned int called_len, calling_len;
121 	char *called, *calling;
122 	unsigned int i;
123 
124 	called_len  = (*p >> 0) & 0x0F;
125 	calling_len = (*p >> 4) & 0x0F;
126 
127 	called  = called_addr->x25_addr;
128 	calling = calling_addr->x25_addr;
129 	p++;
130 
131 	for (i = 0; i < (called_len + calling_len); i++) {
132 		if (i < called_len) {
133 			if (i % 2 != 0) {
134 				*called++ = ((*p >> 0) & 0x0F) + '0';
135 				p++;
136 			} else {
137 				*called++ = ((*p >> 4) & 0x0F) + '0';
138 			}
139 		} else {
140 			if (i % 2 != 0) {
141 				*calling++ = ((*p >> 0) & 0x0F) + '0';
142 				p++;
143 			} else {
144 				*calling++ = ((*p >> 4) & 0x0F) + '0';
145 			}
146 		}
147 	}
148 
149 	*called = *calling = '\0';
150 
151 	return 1 + (called_len + calling_len + 1) / 2;
152 }
153 
x25_addr_aton(unsigned char * p,struct x25_address * called_addr,struct x25_address * calling_addr)154 int x25_addr_aton(unsigned char *p, struct x25_address *called_addr,
155 		  struct x25_address *calling_addr)
156 {
157 	unsigned int called_len, calling_len;
158 	char *called, *calling;
159 	int i;
160 
161 	called  = called_addr->x25_addr;
162 	calling = calling_addr->x25_addr;
163 
164 	called_len  = strlen(called);
165 	calling_len = strlen(calling);
166 
167 	*p++ = (calling_len << 4) | (called_len << 0);
168 
169 	for (i = 0; i < (called_len + calling_len); i++) {
170 		if (i < called_len) {
171 			if (i % 2 != 0) {
172 				*p |= (*called++ - '0') << 0;
173 				p++;
174 			} else {
175 				*p = 0x00;
176 				*p |= (*called++ - '0') << 4;
177 			}
178 		} else {
179 			if (i % 2 != 0) {
180 				*p |= (*calling++ - '0') << 0;
181 				p++;
182 			} else {
183 				*p = 0x00;
184 				*p |= (*calling++ - '0') << 4;
185 			}
186 		}
187 	}
188 
189 	return 1 + (called_len + calling_len + 1) / 2;
190 }
191 
192 /*
193  *	Socket removal during an interrupt is now safe.
194  */
x25_remove_socket(struct sock * sk)195 static void x25_remove_socket(struct sock *sk)
196 {
197 	write_lock_bh(&x25_list_lock);
198 	sk_del_node_init(sk);
199 	write_unlock_bh(&x25_list_lock);
200 }
201 
202 /*
203  *	Handle device status changes.
204  */
x25_device_event(struct notifier_block * this,unsigned long event,void * ptr)205 static int x25_device_event(struct notifier_block *this, unsigned long event,
206 			    void *ptr)
207 {
208 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
209 	struct x25_neigh *nb;
210 
211 	if (!net_eq(dev_net(dev), &init_net))
212 		return NOTIFY_DONE;
213 
214 	if (dev->type == ARPHRD_X25) {
215 		switch (event) {
216 		case NETDEV_REGISTER:
217 		case NETDEV_POST_TYPE_CHANGE:
218 			x25_link_device_up(dev);
219 			break;
220 		case NETDEV_DOWN:
221 			nb = x25_get_neigh(dev);
222 			if (nb) {
223 				x25_link_terminated(nb);
224 				x25_neigh_put(nb);
225 			}
226 			x25_route_device_down(dev);
227 			break;
228 		case NETDEV_PRE_TYPE_CHANGE:
229 		case NETDEV_UNREGISTER:
230 			x25_link_device_down(dev);
231 			break;
232 		case NETDEV_CHANGE:
233 			if (!netif_carrier_ok(dev)) {
234 				nb = x25_get_neigh(dev);
235 				if (nb) {
236 					x25_link_terminated(nb);
237 					x25_neigh_put(nb);
238 				}
239 			}
240 			break;
241 		}
242 	}
243 
244 	return NOTIFY_DONE;
245 }
246 
247 /*
248  *	Add a socket to the bound sockets list.
249  */
x25_insert_socket(struct sock * sk)250 static void x25_insert_socket(struct sock *sk)
251 {
252 	write_lock_bh(&x25_list_lock);
253 	sk_add_node(sk, &x25_list);
254 	write_unlock_bh(&x25_list_lock);
255 }
256 
257 /*
258  *	Find a socket that wants to accept the Call Request we just
259  *	received. Check the full list for an address/cud match.
260  *	If no cuds match return the next_best thing, an address match.
261  *	Note: if a listening socket has cud set it must only get calls
262  *	with matching cud.
263  */
x25_find_listener(struct x25_address * addr,struct sk_buff * skb)264 static struct sock *x25_find_listener(struct x25_address *addr,
265 					struct sk_buff *skb)
266 {
267 	struct sock *s;
268 	struct sock *next_best;
269 
270 	read_lock_bh(&x25_list_lock);
271 	next_best = NULL;
272 
273 	sk_for_each(s, &x25_list)
274 		if ((!strcmp(addr->x25_addr,
275 			x25_sk(s)->source_addr.x25_addr) ||
276 				!strcmp(x25_sk(s)->source_addr.x25_addr,
277 					null_x25_address.x25_addr)) &&
278 					s->sk_state == TCP_LISTEN) {
279 			/*
280 			 * Found a listening socket, now check the incoming
281 			 * call user data vs this sockets call user data
282 			 */
283 			if (x25_sk(s)->cudmatchlength > 0 &&
284 				skb->len >= x25_sk(s)->cudmatchlength) {
285 				if((memcmp(x25_sk(s)->calluserdata.cuddata,
286 					skb->data,
287 					x25_sk(s)->cudmatchlength)) == 0) {
288 					sock_hold(s);
289 					goto found;
290 				 }
291 			} else
292 				next_best = s;
293 		}
294 	if (next_best) {
295 		s = next_best;
296 		sock_hold(s);
297 		goto found;
298 	}
299 	s = NULL;
300 found:
301 	read_unlock_bh(&x25_list_lock);
302 	return s;
303 }
304 
305 /*
306  *	Find a connected X.25 socket given my LCI and neighbour.
307  */
__x25_find_socket(unsigned int lci,struct x25_neigh * nb)308 static struct sock *__x25_find_socket(unsigned int lci, struct x25_neigh *nb)
309 {
310 	struct sock *s;
311 
312 	sk_for_each(s, &x25_list)
313 		if (x25_sk(s)->lci == lci && x25_sk(s)->neighbour == nb) {
314 			sock_hold(s);
315 			goto found;
316 		}
317 	s = NULL;
318 found:
319 	return s;
320 }
321 
x25_find_socket(unsigned int lci,struct x25_neigh * nb)322 struct sock *x25_find_socket(unsigned int lci, struct x25_neigh *nb)
323 {
324 	struct sock *s;
325 
326 	read_lock_bh(&x25_list_lock);
327 	s = __x25_find_socket(lci, nb);
328 	read_unlock_bh(&x25_list_lock);
329 	return s;
330 }
331 
332 /*
333  *	Find a unique LCI for a given device.
334  */
x25_new_lci(struct x25_neigh * nb)335 static unsigned int x25_new_lci(struct x25_neigh *nb)
336 {
337 	unsigned int lci = 1;
338 	struct sock *sk;
339 
340 	while ((sk = x25_find_socket(lci, nb)) != NULL) {
341 		sock_put(sk);
342 		if (++lci == 4096) {
343 			lci = 0;
344 			break;
345 		}
346 		cond_resched();
347 	}
348 
349 	return lci;
350 }
351 
352 /*
353  *	Deferred destroy.
354  */
355 static void __x25_destroy_socket(struct sock *);
356 
357 /*
358  *	handler for deferred kills.
359  */
x25_destroy_timer(struct timer_list * t)360 static void x25_destroy_timer(struct timer_list *t)
361 {
362 	struct sock *sk = from_timer(sk, t, sk_timer);
363 
364 	x25_destroy_socket_from_timer(sk);
365 }
366 
367 /*
368  *	This is called from user mode and the timers. Thus it protects itself
369  *	against interrupting users but doesn't worry about being called during
370  *	work. Once it is removed from the queue no interrupt or bottom half
371  *	will touch it and we are (fairly 8-) ) safe.
372  *	Not static as it's used by the timer
373  */
__x25_destroy_socket(struct sock * sk)374 static void __x25_destroy_socket(struct sock *sk)
375 {
376 	struct sk_buff *skb;
377 
378 	x25_stop_heartbeat(sk);
379 	x25_stop_timer(sk);
380 
381 	x25_remove_socket(sk);
382 	x25_clear_queues(sk);		/* Flush the queues */
383 
384 	while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
385 		if (skb->sk != sk) {		/* A pending connection */
386 			/*
387 			 * Queue the unaccepted socket for death
388 			 */
389 			skb->sk->sk_state = TCP_LISTEN;
390 			sock_set_flag(skb->sk, SOCK_DEAD);
391 			x25_start_heartbeat(skb->sk);
392 			x25_sk(skb->sk)->state = X25_STATE_0;
393 		}
394 
395 		kfree_skb(skb);
396 	}
397 
398 	if (sk_has_allocations(sk)) {
399 		/* Defer: outstanding buffers */
400 		sk->sk_timer.expires  = jiffies + 10 * HZ;
401 		sk->sk_timer.function = x25_destroy_timer;
402 		add_timer(&sk->sk_timer);
403 	} else {
404 		/* drop last reference so sock_put will free */
405 		__sock_put(sk);
406 	}
407 }
408 
x25_destroy_socket_from_timer(struct sock * sk)409 void x25_destroy_socket_from_timer(struct sock *sk)
410 {
411 	sock_hold(sk);
412 	bh_lock_sock(sk);
413 	__x25_destroy_socket(sk);
414 	bh_unlock_sock(sk);
415 	sock_put(sk);
416 }
417 
418 /*
419  *	Handling for system calls applied via the various interfaces to a
420  *	X.25 socket object.
421  */
422 
x25_setsockopt(struct socket * sock,int level,int optname,sockptr_t optval,unsigned int optlen)423 static int x25_setsockopt(struct socket *sock, int level, int optname,
424 			  sockptr_t optval, unsigned int optlen)
425 {
426 	int opt;
427 	struct sock *sk = sock->sk;
428 	int rc = -ENOPROTOOPT;
429 
430 	if (level != SOL_X25 || optname != X25_QBITINCL)
431 		goto out;
432 
433 	rc = -EINVAL;
434 	if (optlen < sizeof(int))
435 		goto out;
436 
437 	rc = -EFAULT;
438 	if (copy_from_sockptr(&opt, optval, sizeof(int)))
439 		goto out;
440 
441 	if (opt)
442 		set_bit(X25_Q_BIT_FLAG, &x25_sk(sk)->flags);
443 	else
444 		clear_bit(X25_Q_BIT_FLAG, &x25_sk(sk)->flags);
445 	rc = 0;
446 out:
447 	return rc;
448 }
449 
x25_getsockopt(struct socket * sock,int level,int optname,char __user * optval,int __user * optlen)450 static int x25_getsockopt(struct socket *sock, int level, int optname,
451 			  char __user *optval, int __user *optlen)
452 {
453 	struct sock *sk = sock->sk;
454 	int val, len, rc = -ENOPROTOOPT;
455 
456 	if (level != SOL_X25 || optname != X25_QBITINCL)
457 		goto out;
458 
459 	rc = -EFAULT;
460 	if (get_user(len, optlen))
461 		goto out;
462 
463 	len = min_t(unsigned int, len, sizeof(int));
464 
465 	rc = -EINVAL;
466 	if (len < 0)
467 		goto out;
468 
469 	rc = -EFAULT;
470 	if (put_user(len, optlen))
471 		goto out;
472 
473 	val = test_bit(X25_Q_BIT_FLAG, &x25_sk(sk)->flags);
474 	rc = copy_to_user(optval, &val, len) ? -EFAULT : 0;
475 out:
476 	return rc;
477 }
478 
x25_listen(struct socket * sock,int backlog)479 static int x25_listen(struct socket *sock, int backlog)
480 {
481 	struct sock *sk = sock->sk;
482 	int rc = -EOPNOTSUPP;
483 
484 	lock_sock(sk);
485 	if (sk->sk_state != TCP_LISTEN) {
486 		memset(&x25_sk(sk)->dest_addr, 0, X25_ADDR_LEN);
487 		sk->sk_max_ack_backlog = backlog;
488 		sk->sk_state           = TCP_LISTEN;
489 		rc = 0;
490 	}
491 	release_sock(sk);
492 
493 	return rc;
494 }
495 
496 static struct proto x25_proto = {
497 	.name	  = "X25",
498 	.owner	  = THIS_MODULE,
499 	.obj_size = sizeof(struct x25_sock),
500 };
501 
x25_alloc_socket(struct net * net,int kern)502 static struct sock *x25_alloc_socket(struct net *net, int kern)
503 {
504 	struct x25_sock *x25;
505 	struct sock *sk = sk_alloc(net, AF_X25, GFP_ATOMIC, &x25_proto, kern);
506 
507 	if (!sk)
508 		goto out;
509 
510 	sock_init_data(NULL, sk);
511 
512 	x25 = x25_sk(sk);
513 	skb_queue_head_init(&x25->ack_queue);
514 	skb_queue_head_init(&x25->fragment_queue);
515 	skb_queue_head_init(&x25->interrupt_in_queue);
516 	skb_queue_head_init(&x25->interrupt_out_queue);
517 out:
518 	return sk;
519 }
520 
x25_create(struct net * net,struct socket * sock,int protocol,int kern)521 static int x25_create(struct net *net, struct socket *sock, int protocol,
522 		      int kern)
523 {
524 	struct sock *sk;
525 	struct x25_sock *x25;
526 	int rc = -EAFNOSUPPORT;
527 
528 	if (!net_eq(net, &init_net))
529 		goto out;
530 
531 	rc = -ESOCKTNOSUPPORT;
532 	if (sock->type != SOCK_SEQPACKET)
533 		goto out;
534 
535 	rc = -EINVAL;
536 	if (protocol)
537 		goto out;
538 
539 	rc = -ENOMEM;
540 	if ((sk = x25_alloc_socket(net, kern)) == NULL)
541 		goto out;
542 
543 	x25 = x25_sk(sk);
544 
545 	sock_init_data(sock, sk);
546 
547 	x25_init_timers(sk);
548 
549 	sock->ops    = &x25_proto_ops;
550 	sk->sk_protocol = protocol;
551 	sk->sk_backlog_rcv = x25_backlog_rcv;
552 
553 	x25->t21   = sysctl_x25_call_request_timeout;
554 	x25->t22   = sysctl_x25_reset_request_timeout;
555 	x25->t23   = sysctl_x25_clear_request_timeout;
556 	x25->t2    = sysctl_x25_ack_holdback_timeout;
557 	x25->state = X25_STATE_0;
558 	x25->cudmatchlength = 0;
559 	set_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);	/* normally no cud  */
560 							/* on call accept   */
561 
562 	x25->facilities.winsize_in  = X25_DEFAULT_WINDOW_SIZE;
563 	x25->facilities.winsize_out = X25_DEFAULT_WINDOW_SIZE;
564 	x25->facilities.pacsize_in  = X25_DEFAULT_PACKET_SIZE;
565 	x25->facilities.pacsize_out = X25_DEFAULT_PACKET_SIZE;
566 	x25->facilities.throughput  = 0;	/* by default don't negotiate
567 						   throughput */
568 	x25->facilities.reverse     = X25_DEFAULT_REVERSE;
569 	x25->dte_facilities.calling_len = 0;
570 	x25->dte_facilities.called_len = 0;
571 	memset(x25->dte_facilities.called_ae, '\0',
572 			sizeof(x25->dte_facilities.called_ae));
573 	memset(x25->dte_facilities.calling_ae, '\0',
574 			sizeof(x25->dte_facilities.calling_ae));
575 
576 	rc = 0;
577 out:
578 	return rc;
579 }
580 
x25_make_new(struct sock * osk)581 static struct sock *x25_make_new(struct sock *osk)
582 {
583 	struct sock *sk = NULL;
584 	struct x25_sock *x25, *ox25;
585 
586 	if (osk->sk_type != SOCK_SEQPACKET)
587 		goto out;
588 
589 	if ((sk = x25_alloc_socket(sock_net(osk), 0)) == NULL)
590 		goto out;
591 
592 	x25 = x25_sk(sk);
593 
594 	sk->sk_type        = osk->sk_type;
595 	sk->sk_priority    = osk->sk_priority;
596 	sk->sk_protocol    = osk->sk_protocol;
597 	sk->sk_rcvbuf      = osk->sk_rcvbuf;
598 	sk->sk_sndbuf      = osk->sk_sndbuf;
599 	sk->sk_state       = TCP_ESTABLISHED;
600 	sk->sk_backlog_rcv = osk->sk_backlog_rcv;
601 	sock_copy_flags(sk, osk);
602 
603 	ox25 = x25_sk(osk);
604 	x25->t21        = ox25->t21;
605 	x25->t22        = ox25->t22;
606 	x25->t23        = ox25->t23;
607 	x25->t2         = ox25->t2;
608 	x25->flags	= ox25->flags;
609 	x25->facilities = ox25->facilities;
610 	x25->dte_facilities = ox25->dte_facilities;
611 	x25->cudmatchlength = ox25->cudmatchlength;
612 
613 	clear_bit(X25_INTERRUPT_FLAG, &x25->flags);
614 	x25_init_timers(sk);
615 out:
616 	return sk;
617 }
618 
x25_release(struct socket * sock)619 static int x25_release(struct socket *sock)
620 {
621 	struct sock *sk = sock->sk;
622 	struct x25_sock *x25;
623 
624 	if (!sk)
625 		return 0;
626 
627 	x25 = x25_sk(sk);
628 
629 	sock_hold(sk);
630 	lock_sock(sk);
631 	switch (x25->state) {
632 
633 		case X25_STATE_0:
634 		case X25_STATE_2:
635 			x25_disconnect(sk, 0, 0, 0);
636 			__x25_destroy_socket(sk);
637 			goto out;
638 
639 		case X25_STATE_1:
640 		case X25_STATE_3:
641 		case X25_STATE_4:
642 			x25_clear_queues(sk);
643 			x25_write_internal(sk, X25_CLEAR_REQUEST);
644 			x25_start_t23timer(sk);
645 			x25->state = X25_STATE_2;
646 			sk->sk_state	= TCP_CLOSE;
647 			sk->sk_shutdown	|= SEND_SHUTDOWN;
648 			sk->sk_state_change(sk);
649 			sock_set_flag(sk, SOCK_DEAD);
650 			sock_set_flag(sk, SOCK_DESTROY);
651 			break;
652 
653 		case X25_STATE_5:
654 			x25_write_internal(sk, X25_CLEAR_REQUEST);
655 			x25_disconnect(sk, 0, 0, 0);
656 			__x25_destroy_socket(sk);
657 			goto out;
658 	}
659 
660 	sock_orphan(sk);
661 out:
662 	release_sock(sk);
663 	sock_put(sk);
664 	return 0;
665 }
666 
x25_bind(struct socket * sock,struct sockaddr * uaddr,int addr_len)667 static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
668 {
669 	struct sock *sk = sock->sk;
670 	struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;
671 	int len, i, rc = 0;
672 
673 	if (addr_len != sizeof(struct sockaddr_x25) ||
674 	    addr->sx25_family != AF_X25 ||
675 	    strnlen(addr->sx25_addr.x25_addr, X25_ADDR_LEN) == X25_ADDR_LEN) {
676 		rc = -EINVAL;
677 		goto out;
678 	}
679 
680 	/* check for the null_x25_address */
681 	if (strcmp(addr->sx25_addr.x25_addr, null_x25_address.x25_addr)) {
682 
683 		len = strlen(addr->sx25_addr.x25_addr);
684 		for (i = 0; i < len; i++) {
685 			if (!isdigit(addr->sx25_addr.x25_addr[i])) {
686 				rc = -EINVAL;
687 				goto out;
688 			}
689 		}
690 	}
691 
692 	lock_sock(sk);
693 	if (sock_flag(sk, SOCK_ZAPPED)) {
694 		x25_sk(sk)->source_addr = addr->sx25_addr;
695 		x25_insert_socket(sk);
696 		sock_reset_flag(sk, SOCK_ZAPPED);
697 	} else {
698 		rc = -EINVAL;
699 	}
700 	release_sock(sk);
701 	SOCK_DEBUG(sk, "x25_bind: socket is bound\n");
702 out:
703 	return rc;
704 }
705 
x25_wait_for_connection_establishment(struct sock * sk)706 static int x25_wait_for_connection_establishment(struct sock *sk)
707 {
708 	DECLARE_WAITQUEUE(wait, current);
709 	int rc;
710 
711 	add_wait_queue_exclusive(sk_sleep(sk), &wait);
712 	for (;;) {
713 		__set_current_state(TASK_INTERRUPTIBLE);
714 		rc = -ERESTARTSYS;
715 		if (signal_pending(current))
716 			break;
717 		rc = sock_error(sk);
718 		if (rc) {
719 			sk->sk_socket->state = SS_UNCONNECTED;
720 			break;
721 		}
722 		rc = -ENOTCONN;
723 		if (sk->sk_state == TCP_CLOSE) {
724 			sk->sk_socket->state = SS_UNCONNECTED;
725 			break;
726 		}
727 		rc = 0;
728 		if (sk->sk_state != TCP_ESTABLISHED) {
729 			release_sock(sk);
730 			schedule();
731 			lock_sock(sk);
732 		} else
733 			break;
734 	}
735 	__set_current_state(TASK_RUNNING);
736 	remove_wait_queue(sk_sleep(sk), &wait);
737 	return rc;
738 }
739 
x25_connect(struct socket * sock,struct sockaddr * uaddr,int addr_len,int flags)740 static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
741 		       int addr_len, int flags)
742 {
743 	struct sock *sk = sock->sk;
744 	struct x25_sock *x25 = x25_sk(sk);
745 	struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;
746 	struct x25_route *rt;
747 	int rc = 0;
748 
749 	lock_sock(sk);
750 	if (sk->sk_state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
751 		sock->state = SS_CONNECTED;
752 		goto out; /* Connect completed during a ERESTARTSYS event */
753 	}
754 
755 	rc = -ECONNREFUSED;
756 	if (sk->sk_state == TCP_CLOSE && sock->state == SS_CONNECTING) {
757 		sock->state = SS_UNCONNECTED;
758 		goto out;
759 	}
760 
761 	rc = -EISCONN;	/* No reconnect on a seqpacket socket */
762 	if (sk->sk_state == TCP_ESTABLISHED)
763 		goto out;
764 
765 	rc = -EALREADY;	/* Do nothing if call is already in progress */
766 	if (sk->sk_state == TCP_SYN_SENT)
767 		goto out;
768 
769 	sk->sk_state   = TCP_CLOSE;
770 	sock->state = SS_UNCONNECTED;
771 
772 	rc = -EINVAL;
773 	if (addr_len != sizeof(struct sockaddr_x25) ||
774 	    addr->sx25_family != AF_X25 ||
775 	    strnlen(addr->sx25_addr.x25_addr, X25_ADDR_LEN) == X25_ADDR_LEN)
776 		goto out;
777 
778 	rc = -ENETUNREACH;
779 	rt = x25_get_route(&addr->sx25_addr);
780 	if (!rt)
781 		goto out;
782 
783 	x25->neighbour = x25_get_neigh(rt->dev);
784 	if (!x25->neighbour)
785 		goto out_put_route;
786 
787 	x25_limit_facilities(&x25->facilities, x25->neighbour);
788 
789 	x25->lci = x25_new_lci(x25->neighbour);
790 	if (!x25->lci)
791 		goto out_put_neigh;
792 
793 	rc = -EINVAL;
794 	if (sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
795 		goto out_put_neigh;
796 
797 	if (!strcmp(x25->source_addr.x25_addr, null_x25_address.x25_addr))
798 		memset(&x25->source_addr, '\0', X25_ADDR_LEN);
799 
800 	x25->dest_addr = addr->sx25_addr;
801 
802 	/* Move to connecting socket, start sending Connect Requests */
803 	sock->state   = SS_CONNECTING;
804 	sk->sk_state  = TCP_SYN_SENT;
805 
806 	x25->state = X25_STATE_1;
807 
808 	x25_write_internal(sk, X25_CALL_REQUEST);
809 
810 	x25_start_heartbeat(sk);
811 	x25_start_t21timer(sk);
812 
813 	/* Now the loop */
814 	rc = -EINPROGRESS;
815 	if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK))
816 		goto out;
817 
818 	rc = x25_wait_for_connection_establishment(sk);
819 	if (rc)
820 		goto out_put_neigh;
821 
822 	sock->state = SS_CONNECTED;
823 	rc = 0;
824 out_put_neigh:
825 	if (rc && x25->neighbour) {
826 		read_lock_bh(&x25_list_lock);
827 		x25_neigh_put(x25->neighbour);
828 		x25->neighbour = NULL;
829 		read_unlock_bh(&x25_list_lock);
830 		x25->state = X25_STATE_0;
831 	}
832 out_put_route:
833 	x25_route_put(rt);
834 out:
835 	release_sock(sk);
836 	return rc;
837 }
838 
x25_wait_for_data(struct sock * sk,long timeout)839 static int x25_wait_for_data(struct sock *sk, long timeout)
840 {
841 	DECLARE_WAITQUEUE(wait, current);
842 	int rc = 0;
843 
844 	add_wait_queue_exclusive(sk_sleep(sk), &wait);
845 	for (;;) {
846 		__set_current_state(TASK_INTERRUPTIBLE);
847 		if (sk->sk_shutdown & RCV_SHUTDOWN)
848 			break;
849 		rc = -ERESTARTSYS;
850 		if (signal_pending(current))
851 			break;
852 		rc = -EAGAIN;
853 		if (!timeout)
854 			break;
855 		rc = 0;
856 		if (skb_queue_empty(&sk->sk_receive_queue)) {
857 			release_sock(sk);
858 			timeout = schedule_timeout(timeout);
859 			lock_sock(sk);
860 		} else
861 			break;
862 	}
863 	__set_current_state(TASK_RUNNING);
864 	remove_wait_queue(sk_sleep(sk), &wait);
865 	return rc;
866 }
867 
x25_accept(struct socket * sock,struct socket * newsock,int flags,bool kern)868 static int x25_accept(struct socket *sock, struct socket *newsock, int flags,
869 		      bool kern)
870 {
871 	struct sock *sk = sock->sk;
872 	struct sock *newsk;
873 	struct sk_buff *skb;
874 	int rc = -EINVAL;
875 
876 	if (!sk)
877 		goto out;
878 
879 	rc = -EOPNOTSUPP;
880 	if (sk->sk_type != SOCK_SEQPACKET)
881 		goto out;
882 
883 	lock_sock(sk);
884 	rc = -EINVAL;
885 	if (sk->sk_state != TCP_LISTEN)
886 		goto out2;
887 
888 	rc = x25_wait_for_data(sk, sk->sk_rcvtimeo);
889 	if (rc)
890 		goto out2;
891 	skb = skb_dequeue(&sk->sk_receive_queue);
892 	rc = -EINVAL;
893 	if (!skb->sk)
894 		goto out2;
895 	newsk		 = skb->sk;
896 	sock_graft(newsk, newsock);
897 
898 	/* Now attach up the new socket */
899 	skb->sk = NULL;
900 	kfree_skb(skb);
901 	sk_acceptq_removed(sk);
902 	newsock->state = SS_CONNECTED;
903 	rc = 0;
904 out2:
905 	release_sock(sk);
906 out:
907 	return rc;
908 }
909 
x25_getname(struct socket * sock,struct sockaddr * uaddr,int peer)910 static int x25_getname(struct socket *sock, struct sockaddr *uaddr,
911 		       int peer)
912 {
913 	struct sockaddr_x25 *sx25 = (struct sockaddr_x25 *)uaddr;
914 	struct sock *sk = sock->sk;
915 	struct x25_sock *x25 = x25_sk(sk);
916 	int rc = 0;
917 
918 	if (peer) {
919 		if (sk->sk_state != TCP_ESTABLISHED) {
920 			rc = -ENOTCONN;
921 			goto out;
922 		}
923 		sx25->sx25_addr = x25->dest_addr;
924 	} else
925 		sx25->sx25_addr = x25->source_addr;
926 
927 	sx25->sx25_family = AF_X25;
928 	rc = sizeof(*sx25);
929 
930 out:
931 	return rc;
932 }
933 
x25_rx_call_request(struct sk_buff * skb,struct x25_neigh * nb,unsigned int lci)934 int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
935 			unsigned int lci)
936 {
937 	struct sock *sk;
938 	struct sock *make;
939 	struct x25_sock *makex25;
940 	struct x25_address source_addr, dest_addr;
941 	struct x25_facilities facilities;
942 	struct x25_dte_facilities dte_facilities;
943 	int len, addr_len, rc;
944 
945 	/*
946 	 *	Remove the LCI and frame type.
947 	 */
948 	skb_pull(skb, X25_STD_MIN_LEN);
949 
950 	/*
951 	 *	Extract the X.25 addresses and convert them to ASCII strings,
952 	 *	and remove them.
953 	 *
954 	 *	Address block is mandatory in call request packets
955 	 */
956 	addr_len = x25_parse_address_block(skb, &source_addr, &dest_addr);
957 	if (addr_len <= 0)
958 		goto out_clear_request;
959 	skb_pull(skb, addr_len);
960 
961 	/*
962 	 *	Get the length of the facilities, skip past them for the moment
963 	 *	get the call user data because this is needed to determine
964 	 *	the correct listener
965 	 *
966 	 *	Facilities length is mandatory in call request packets
967 	 */
968 	if (!pskb_may_pull(skb, 1))
969 		goto out_clear_request;
970 	len = skb->data[0] + 1;
971 	if (!pskb_may_pull(skb, len))
972 		goto out_clear_request;
973 	skb_pull(skb,len);
974 
975 	/*
976 	 *	Ensure that the amount of call user data is valid.
977 	 */
978 	if (skb->len > X25_MAX_CUD_LEN)
979 		goto out_clear_request;
980 
981 	/*
982 	 *	Get all the call user data so it can be used in
983 	 *	x25_find_listener and skb_copy_from_linear_data up ahead.
984 	 */
985 	if (!pskb_may_pull(skb, skb->len))
986 		goto out_clear_request;
987 
988 	/*
989 	 *	Find a listener for the particular address/cud pair.
990 	 */
991 	sk = x25_find_listener(&source_addr,skb);
992 	skb_push(skb,len);
993 
994 	if (sk != NULL && sk_acceptq_is_full(sk)) {
995 		goto out_sock_put;
996 	}
997 
998 	/*
999 	 *	We dont have any listeners for this incoming call.
1000 	 *	Try forwarding it.
1001 	 */
1002 	if (sk == NULL) {
1003 		skb_push(skb, addr_len + X25_STD_MIN_LEN);
1004 		if (sysctl_x25_forward &&
1005 				x25_forward_call(&dest_addr, nb, skb, lci) > 0)
1006 		{
1007 			/* Call was forwarded, dont process it any more */
1008 			kfree_skb(skb);
1009 			rc = 1;
1010 			goto out;
1011 		} else {
1012 			/* No listeners, can't forward, clear the call */
1013 			goto out_clear_request;
1014 		}
1015 	}
1016 
1017 	/*
1018 	 *	Try to reach a compromise on the requested facilities.
1019 	 */
1020 	len = x25_negotiate_facilities(skb, sk, &facilities, &dte_facilities);
1021 	if (len == -1)
1022 		goto out_sock_put;
1023 
1024 	/*
1025 	 * current neighbour/link might impose additional limits
1026 	 * on certain facilities
1027 	 */
1028 
1029 	x25_limit_facilities(&facilities, nb);
1030 
1031 	/*
1032 	 *	Try to create a new socket.
1033 	 */
1034 	make = x25_make_new(sk);
1035 	if (!make)
1036 		goto out_sock_put;
1037 
1038 	/*
1039 	 *	Remove the facilities
1040 	 */
1041 	skb_pull(skb, len);
1042 
1043 	skb->sk     = make;
1044 	make->sk_state = TCP_ESTABLISHED;
1045 
1046 	makex25 = x25_sk(make);
1047 	makex25->lci           = lci;
1048 	makex25->dest_addr     = dest_addr;
1049 	makex25->source_addr   = source_addr;
1050 	x25_neigh_hold(nb);
1051 	makex25->neighbour     = nb;
1052 	makex25->facilities    = facilities;
1053 	makex25->dte_facilities= dte_facilities;
1054 	makex25->vc_facil_mask = x25_sk(sk)->vc_facil_mask;
1055 	/* ensure no reverse facil on accept */
1056 	makex25->vc_facil_mask &= ~X25_MASK_REVERSE;
1057 	/* ensure no calling address extension on accept */
1058 	makex25->vc_facil_mask &= ~X25_MASK_CALLING_AE;
1059 	makex25->cudmatchlength = x25_sk(sk)->cudmatchlength;
1060 
1061 	/* Normally all calls are accepted immediately */
1062 	if (test_bit(X25_ACCPT_APPRV_FLAG, &makex25->flags)) {
1063 		x25_write_internal(make, X25_CALL_ACCEPTED);
1064 		makex25->state = X25_STATE_3;
1065 	} else {
1066 		makex25->state = X25_STATE_5;
1067 	}
1068 
1069 	/*
1070 	 *	Incoming Call User Data.
1071 	 */
1072 	skb_copy_from_linear_data(skb, makex25->calluserdata.cuddata, skb->len);
1073 	makex25->calluserdata.cudlength = skb->len;
1074 
1075 	sk_acceptq_added(sk);
1076 
1077 	x25_insert_socket(make);
1078 
1079 	skb_queue_head(&sk->sk_receive_queue, skb);
1080 
1081 	x25_start_heartbeat(make);
1082 
1083 	if (!sock_flag(sk, SOCK_DEAD))
1084 		sk->sk_data_ready(sk);
1085 	rc = 1;
1086 	sock_put(sk);
1087 out:
1088 	return rc;
1089 out_sock_put:
1090 	sock_put(sk);
1091 out_clear_request:
1092 	rc = 0;
1093 	x25_transmit_clear_request(nb, lci, 0x01);
1094 	goto out;
1095 }
1096 
x25_sendmsg(struct socket * sock,struct msghdr * msg,size_t len)1097 static int x25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
1098 {
1099 	struct sock *sk = sock->sk;
1100 	struct x25_sock *x25 = x25_sk(sk);
1101 	DECLARE_SOCKADDR(struct sockaddr_x25 *, usx25, msg->msg_name);
1102 	struct sockaddr_x25 sx25;
1103 	struct sk_buff *skb;
1104 	unsigned char *asmptr;
1105 	int noblock = msg->msg_flags & MSG_DONTWAIT;
1106 	size_t size;
1107 	int qbit = 0, rc = -EINVAL;
1108 
1109 	lock_sock(sk);
1110 	if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_OOB|MSG_EOR|MSG_CMSG_COMPAT))
1111 		goto out;
1112 
1113 	/* we currently don't support segmented records at the user interface */
1114 	if (!(msg->msg_flags & (MSG_EOR|MSG_OOB)))
1115 		goto out;
1116 
1117 	rc = -EADDRNOTAVAIL;
1118 	if (sock_flag(sk, SOCK_ZAPPED))
1119 		goto out;
1120 
1121 	rc = -EPIPE;
1122 	if (sk->sk_shutdown & SEND_SHUTDOWN) {
1123 		send_sig(SIGPIPE, current, 0);
1124 		goto out;
1125 	}
1126 
1127 	rc = -ENETUNREACH;
1128 	if (!x25->neighbour)
1129 		goto out;
1130 
1131 	if (usx25) {
1132 		rc = -EINVAL;
1133 		if (msg->msg_namelen < sizeof(sx25))
1134 			goto out;
1135 		memcpy(&sx25, usx25, sizeof(sx25));
1136 		rc = -EISCONN;
1137 		if (strcmp(x25->dest_addr.x25_addr, sx25.sx25_addr.x25_addr))
1138 			goto out;
1139 		rc = -EINVAL;
1140 		if (sx25.sx25_family != AF_X25)
1141 			goto out;
1142 	} else {
1143 		/*
1144 		 *	FIXME 1003.1g - if the socket is like this because
1145 		 *	it has become closed (not started closed) we ought
1146 		 *	to SIGPIPE, EPIPE;
1147 		 */
1148 		rc = -ENOTCONN;
1149 		if (sk->sk_state != TCP_ESTABLISHED)
1150 			goto out;
1151 
1152 		sx25.sx25_family = AF_X25;
1153 		sx25.sx25_addr   = x25->dest_addr;
1154 	}
1155 
1156 	/* Sanity check the packet size */
1157 	if (len > 65535) {
1158 		rc = -EMSGSIZE;
1159 		goto out;
1160 	}
1161 
1162 	SOCK_DEBUG(sk, "x25_sendmsg: sendto: Addresses built.\n");
1163 
1164 	/* Build a packet */
1165 	SOCK_DEBUG(sk, "x25_sendmsg: sendto: building packet.\n");
1166 
1167 	if ((msg->msg_flags & MSG_OOB) && len > 32)
1168 		len = 32;
1169 
1170 	size = len + X25_MAX_L2_LEN + X25_EXT_MIN_LEN;
1171 
1172 	release_sock(sk);
1173 	skb = sock_alloc_send_skb(sk, size, noblock, &rc);
1174 	lock_sock(sk);
1175 	if (!skb)
1176 		goto out;
1177 	X25_SKB_CB(skb)->flags = msg->msg_flags;
1178 
1179 	skb_reserve(skb, X25_MAX_L2_LEN + X25_EXT_MIN_LEN);
1180 
1181 	/*
1182 	 *	Put the data on the end
1183 	 */
1184 	SOCK_DEBUG(sk, "x25_sendmsg: Copying user data\n");
1185 
1186 	skb_reset_transport_header(skb);
1187 	skb_put(skb, len);
1188 
1189 	rc = memcpy_from_msg(skb_transport_header(skb), msg, len);
1190 	if (rc)
1191 		goto out_kfree_skb;
1192 
1193 	/*
1194 	 *	If the Q BIT Include socket option is in force, the first
1195 	 *	byte of the user data is the logical value of the Q Bit.
1196 	 */
1197 	if (test_bit(X25_Q_BIT_FLAG, &x25->flags)) {
1198 		if (!pskb_may_pull(skb, 1))
1199 			goto out_kfree_skb;
1200 
1201 		qbit = skb->data[0];
1202 		skb_pull(skb, 1);
1203 	}
1204 
1205 	/*
1206 	 *	Push down the X.25 header
1207 	 */
1208 	SOCK_DEBUG(sk, "x25_sendmsg: Building X.25 Header.\n");
1209 
1210 	if (msg->msg_flags & MSG_OOB) {
1211 		if (x25->neighbour->extended) {
1212 			asmptr    = skb_push(skb, X25_STD_MIN_LEN);
1213 			*asmptr++ = ((x25->lci >> 8) & 0x0F) | X25_GFI_EXTSEQ;
1214 			*asmptr++ = (x25->lci >> 0) & 0xFF;
1215 			*asmptr++ = X25_INTERRUPT;
1216 		} else {
1217 			asmptr    = skb_push(skb, X25_STD_MIN_LEN);
1218 			*asmptr++ = ((x25->lci >> 8) & 0x0F) | X25_GFI_STDSEQ;
1219 			*asmptr++ = (x25->lci >> 0) & 0xFF;
1220 			*asmptr++ = X25_INTERRUPT;
1221 		}
1222 	} else {
1223 		if (x25->neighbour->extended) {
1224 			/* Build an Extended X.25 header */
1225 			asmptr    = skb_push(skb, X25_EXT_MIN_LEN);
1226 			*asmptr++ = ((x25->lci >> 8) & 0x0F) | X25_GFI_EXTSEQ;
1227 			*asmptr++ = (x25->lci >> 0) & 0xFF;
1228 			*asmptr++ = X25_DATA;
1229 			*asmptr++ = X25_DATA;
1230 		} else {
1231 			/* Build an Standard X.25 header */
1232 			asmptr    = skb_push(skb, X25_STD_MIN_LEN);
1233 			*asmptr++ = ((x25->lci >> 8) & 0x0F) | X25_GFI_STDSEQ;
1234 			*asmptr++ = (x25->lci >> 0) & 0xFF;
1235 			*asmptr++ = X25_DATA;
1236 		}
1237 
1238 		if (qbit)
1239 			skb->data[0] |= X25_Q_BIT;
1240 	}
1241 
1242 	SOCK_DEBUG(sk, "x25_sendmsg: Built header.\n");
1243 	SOCK_DEBUG(sk, "x25_sendmsg: Transmitting buffer\n");
1244 
1245 	rc = -ENOTCONN;
1246 	if (sk->sk_state != TCP_ESTABLISHED)
1247 		goto out_kfree_skb;
1248 
1249 	if (msg->msg_flags & MSG_OOB)
1250 		skb_queue_tail(&x25->interrupt_out_queue, skb);
1251 	else {
1252 		rc = x25_output(sk, skb);
1253 		len = rc;
1254 		if (rc < 0)
1255 			kfree_skb(skb);
1256 		else if (test_bit(X25_Q_BIT_FLAG, &x25->flags))
1257 			len++;
1258 	}
1259 
1260 	x25_kick(sk);
1261 	rc = len;
1262 out:
1263 	release_sock(sk);
1264 	return rc;
1265 out_kfree_skb:
1266 	kfree_skb(skb);
1267 	goto out;
1268 }
1269 
1270 
x25_recvmsg(struct socket * sock,struct msghdr * msg,size_t size,int flags)1271 static int x25_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
1272 		       int flags)
1273 {
1274 	struct sock *sk = sock->sk;
1275 	struct x25_sock *x25 = x25_sk(sk);
1276 	DECLARE_SOCKADDR(struct sockaddr_x25 *, sx25, msg->msg_name);
1277 	size_t copied;
1278 	int qbit, header_len;
1279 	struct sk_buff *skb;
1280 	unsigned char *asmptr;
1281 	int rc = -ENOTCONN;
1282 
1283 	lock_sock(sk);
1284 
1285 	if (x25->neighbour == NULL)
1286 		goto out;
1287 
1288 	header_len = x25->neighbour->extended ?
1289 		X25_EXT_MIN_LEN : X25_STD_MIN_LEN;
1290 
1291 	/*
1292 	 * This works for seqpacket too. The receiver has ordered the queue for
1293 	 * us! We do one quick check first though
1294 	 */
1295 	if (sk->sk_state != TCP_ESTABLISHED)
1296 		goto out;
1297 
1298 	if (flags & MSG_OOB) {
1299 		rc = -EINVAL;
1300 		if (sock_flag(sk, SOCK_URGINLINE) ||
1301 		    !skb_peek(&x25->interrupt_in_queue))
1302 			goto out;
1303 
1304 		skb = skb_dequeue(&x25->interrupt_in_queue);
1305 
1306 		if (!pskb_may_pull(skb, X25_STD_MIN_LEN))
1307 			goto out_free_dgram;
1308 
1309 		skb_pull(skb, X25_STD_MIN_LEN);
1310 
1311 		/*
1312 		 *	No Q bit information on Interrupt data.
1313 		 */
1314 		if (test_bit(X25_Q_BIT_FLAG, &x25->flags)) {
1315 			asmptr  = skb_push(skb, 1);
1316 			*asmptr = 0x00;
1317 		}
1318 
1319 		msg->msg_flags |= MSG_OOB;
1320 	} else {
1321 		/* Now we can treat all alike */
1322 		release_sock(sk);
1323 		skb = skb_recv_datagram(sk, flags, &rc);
1324 		lock_sock(sk);
1325 		if (!skb)
1326 			goto out;
1327 
1328 		if (!pskb_may_pull(skb, header_len))
1329 			goto out_free_dgram;
1330 
1331 		qbit = (skb->data[0] & X25_Q_BIT) == X25_Q_BIT;
1332 
1333 		skb_pull(skb, header_len);
1334 
1335 		if (test_bit(X25_Q_BIT_FLAG, &x25->flags)) {
1336 			asmptr  = skb_push(skb, 1);
1337 			*asmptr = qbit;
1338 		}
1339 	}
1340 
1341 	skb_reset_transport_header(skb);
1342 	copied = skb->len;
1343 
1344 	if (copied > size) {
1345 		copied = size;
1346 		msg->msg_flags |= MSG_TRUNC;
1347 	}
1348 
1349 	/* Currently, each datagram always contains a complete record */
1350 	msg->msg_flags |= MSG_EOR;
1351 
1352 	rc = skb_copy_datagram_msg(skb, 0, msg, copied);
1353 	if (rc)
1354 		goto out_free_dgram;
1355 
1356 	if (sx25) {
1357 		sx25->sx25_family = AF_X25;
1358 		sx25->sx25_addr   = x25->dest_addr;
1359 		msg->msg_namelen = sizeof(*sx25);
1360 	}
1361 
1362 	x25_check_rbuf(sk);
1363 	rc = copied;
1364 out_free_dgram:
1365 	skb_free_datagram(sk, skb);
1366 out:
1367 	release_sock(sk);
1368 	return rc;
1369 }
1370 
1371 
x25_ioctl(struct socket * sock,unsigned int cmd,unsigned long arg)1372 static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
1373 {
1374 	struct sock *sk = sock->sk;
1375 	struct x25_sock *x25 = x25_sk(sk);
1376 	void __user *argp = (void __user *)arg;
1377 	int rc;
1378 
1379 	switch (cmd) {
1380 	case TIOCOUTQ: {
1381 		int amount;
1382 
1383 		amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
1384 		if (amount < 0)
1385 			amount = 0;
1386 		rc = put_user(amount, (unsigned int __user *)argp);
1387 		break;
1388 	}
1389 
1390 	case TIOCINQ: {
1391 		struct sk_buff *skb;
1392 		int amount = 0;
1393 		/*
1394 		 * These two are safe on a single CPU system as
1395 		 * only user tasks fiddle here
1396 		 */
1397 		lock_sock(sk);
1398 		if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL)
1399 			amount = skb->len;
1400 		release_sock(sk);
1401 		rc = put_user(amount, (unsigned int __user *)argp);
1402 		break;
1403 	}
1404 
1405 	case SIOCGIFADDR:
1406 	case SIOCSIFADDR:
1407 	case SIOCGIFDSTADDR:
1408 	case SIOCSIFDSTADDR:
1409 	case SIOCGIFBRDADDR:
1410 	case SIOCSIFBRDADDR:
1411 	case SIOCGIFNETMASK:
1412 	case SIOCSIFNETMASK:
1413 	case SIOCGIFMETRIC:
1414 	case SIOCSIFMETRIC:
1415 		rc = -EINVAL;
1416 		break;
1417 	case SIOCADDRT:
1418 	case SIOCDELRT:
1419 		rc = -EPERM;
1420 		if (!capable(CAP_NET_ADMIN))
1421 			break;
1422 		rc = x25_route_ioctl(cmd, argp);
1423 		break;
1424 	case SIOCX25GSUBSCRIP:
1425 		rc = x25_subscr_ioctl(cmd, argp);
1426 		break;
1427 	case SIOCX25SSUBSCRIP:
1428 		rc = -EPERM;
1429 		if (!capable(CAP_NET_ADMIN))
1430 			break;
1431 		rc = x25_subscr_ioctl(cmd, argp);
1432 		break;
1433 	case SIOCX25GFACILITIES: {
1434 		lock_sock(sk);
1435 		rc = copy_to_user(argp, &x25->facilities,
1436 				  sizeof(x25->facilities))
1437 			? -EFAULT : 0;
1438 		release_sock(sk);
1439 		break;
1440 	}
1441 
1442 	case SIOCX25SFACILITIES: {
1443 		struct x25_facilities facilities;
1444 		rc = -EFAULT;
1445 		if (copy_from_user(&facilities, argp, sizeof(facilities)))
1446 			break;
1447 		rc = -EINVAL;
1448 		lock_sock(sk);
1449 		if (sk->sk_state != TCP_LISTEN &&
1450 		    sk->sk_state != TCP_CLOSE)
1451 			goto out_fac_release;
1452 		if (facilities.pacsize_in < X25_PS16 ||
1453 		    facilities.pacsize_in > X25_PS4096)
1454 			goto out_fac_release;
1455 		if (facilities.pacsize_out < X25_PS16 ||
1456 		    facilities.pacsize_out > X25_PS4096)
1457 			goto out_fac_release;
1458 		if (facilities.winsize_in < 1 ||
1459 		    facilities.winsize_in > 127)
1460 			goto out_fac_release;
1461 		if (facilities.throughput) {
1462 			int out = facilities.throughput & 0xf0;
1463 			int in  = facilities.throughput & 0x0f;
1464 			if (!out)
1465 				facilities.throughput |=
1466 					X25_DEFAULT_THROUGHPUT << 4;
1467 			else if (out < 0x30 || out > 0xD0)
1468 				goto out_fac_release;
1469 			if (!in)
1470 				facilities.throughput |=
1471 					X25_DEFAULT_THROUGHPUT;
1472 			else if (in < 0x03 || in > 0x0D)
1473 				goto out_fac_release;
1474 		}
1475 		if (facilities.reverse &&
1476 		    (facilities.reverse & 0x81) != 0x81)
1477 			goto out_fac_release;
1478 		x25->facilities = facilities;
1479 		rc = 0;
1480 out_fac_release:
1481 		release_sock(sk);
1482 		break;
1483 	}
1484 
1485 	case SIOCX25GDTEFACILITIES: {
1486 		lock_sock(sk);
1487 		rc = copy_to_user(argp, &x25->dte_facilities,
1488 				  sizeof(x25->dte_facilities));
1489 		release_sock(sk);
1490 		if (rc)
1491 			rc = -EFAULT;
1492 		break;
1493 	}
1494 
1495 	case SIOCX25SDTEFACILITIES: {
1496 		struct x25_dte_facilities dtefacs;
1497 		rc = -EFAULT;
1498 		if (copy_from_user(&dtefacs, argp, sizeof(dtefacs)))
1499 			break;
1500 		rc = -EINVAL;
1501 		lock_sock(sk);
1502 		if (sk->sk_state != TCP_LISTEN &&
1503 		    sk->sk_state != TCP_CLOSE)
1504 			goto out_dtefac_release;
1505 		if (dtefacs.calling_len > X25_MAX_AE_LEN)
1506 			goto out_dtefac_release;
1507 		if (dtefacs.called_len > X25_MAX_AE_LEN)
1508 			goto out_dtefac_release;
1509 		x25->dte_facilities = dtefacs;
1510 		rc = 0;
1511 out_dtefac_release:
1512 		release_sock(sk);
1513 		break;
1514 	}
1515 
1516 	case SIOCX25GCALLUSERDATA: {
1517 		lock_sock(sk);
1518 		rc = copy_to_user(argp, &x25->calluserdata,
1519 				  sizeof(x25->calluserdata))
1520 			? -EFAULT : 0;
1521 		release_sock(sk);
1522 		break;
1523 	}
1524 
1525 	case SIOCX25SCALLUSERDATA: {
1526 		struct x25_calluserdata calluserdata;
1527 
1528 		rc = -EFAULT;
1529 		if (copy_from_user(&calluserdata, argp, sizeof(calluserdata)))
1530 			break;
1531 		rc = -EINVAL;
1532 		if (calluserdata.cudlength > X25_MAX_CUD_LEN)
1533 			break;
1534 		lock_sock(sk);
1535 		x25->calluserdata = calluserdata;
1536 		release_sock(sk);
1537 		rc = 0;
1538 		break;
1539 	}
1540 
1541 	case SIOCX25GCAUSEDIAG: {
1542 		lock_sock(sk);
1543 		rc = copy_to_user(argp, &x25->causediag, sizeof(x25->causediag))
1544 			? -EFAULT : 0;
1545 		release_sock(sk);
1546 		break;
1547 	}
1548 
1549 	case SIOCX25SCAUSEDIAG: {
1550 		struct x25_causediag causediag;
1551 		rc = -EFAULT;
1552 		if (copy_from_user(&causediag, argp, sizeof(causediag)))
1553 			break;
1554 		lock_sock(sk);
1555 		x25->causediag = causediag;
1556 		release_sock(sk);
1557 		rc = 0;
1558 		break;
1559 
1560 	}
1561 
1562 	case SIOCX25SCUDMATCHLEN: {
1563 		struct x25_subaddr sub_addr;
1564 		rc = -EINVAL;
1565 		lock_sock(sk);
1566 		if(sk->sk_state != TCP_CLOSE)
1567 			goto out_cud_release;
1568 		rc = -EFAULT;
1569 		if (copy_from_user(&sub_addr, argp,
1570 				   sizeof(sub_addr)))
1571 			goto out_cud_release;
1572 		rc = -EINVAL;
1573 		if (sub_addr.cudmatchlength > X25_MAX_CUD_LEN)
1574 			goto out_cud_release;
1575 		x25->cudmatchlength = sub_addr.cudmatchlength;
1576 		rc = 0;
1577 out_cud_release:
1578 		release_sock(sk);
1579 		break;
1580 	}
1581 
1582 	case SIOCX25CALLACCPTAPPRV: {
1583 		rc = -EINVAL;
1584 		lock_sock(sk);
1585 		if (sk->sk_state == TCP_CLOSE) {
1586 			clear_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);
1587 			rc = 0;
1588 		}
1589 		release_sock(sk);
1590 		break;
1591 	}
1592 
1593 	case SIOCX25SENDCALLACCPT:  {
1594 		rc = -EINVAL;
1595 		lock_sock(sk);
1596 		if (sk->sk_state != TCP_ESTABLISHED)
1597 			goto out_sendcallaccpt_release;
1598 		/* must call accptapprv above */
1599 		if (test_bit(X25_ACCPT_APPRV_FLAG, &x25->flags))
1600 			goto out_sendcallaccpt_release;
1601 		x25_write_internal(sk, X25_CALL_ACCEPTED);
1602 		x25->state = X25_STATE_3;
1603 		rc = 0;
1604 out_sendcallaccpt_release:
1605 		release_sock(sk);
1606 		break;
1607 	}
1608 
1609 	default:
1610 		rc = -ENOIOCTLCMD;
1611 		break;
1612 	}
1613 
1614 	return rc;
1615 }
1616 
1617 static const struct net_proto_family x25_family_ops = {
1618 	.family =	AF_X25,
1619 	.create =	x25_create,
1620 	.owner	=	THIS_MODULE,
1621 };
1622 
1623 #ifdef CONFIG_COMPAT
compat_x25_subscr_ioctl(unsigned int cmd,struct compat_x25_subscrip_struct __user * x25_subscr32)1624 static int compat_x25_subscr_ioctl(unsigned int cmd,
1625 		struct compat_x25_subscrip_struct __user *x25_subscr32)
1626 {
1627 	struct compat_x25_subscrip_struct x25_subscr;
1628 	struct x25_neigh *nb;
1629 	struct net_device *dev;
1630 	int rc = -EINVAL;
1631 
1632 	rc = -EFAULT;
1633 	if (copy_from_user(&x25_subscr, x25_subscr32, sizeof(*x25_subscr32)))
1634 		goto out;
1635 
1636 	rc = -EINVAL;
1637 	dev = x25_dev_get(x25_subscr.device);
1638 	if (dev == NULL)
1639 		goto out;
1640 
1641 	nb = x25_get_neigh(dev);
1642 	if (nb == NULL)
1643 		goto out_dev_put;
1644 
1645 	dev_put(dev);
1646 
1647 	if (cmd == SIOCX25GSUBSCRIP) {
1648 		read_lock_bh(&x25_neigh_list_lock);
1649 		x25_subscr.extended = nb->extended;
1650 		x25_subscr.global_facil_mask = nb->global_facil_mask;
1651 		read_unlock_bh(&x25_neigh_list_lock);
1652 		rc = copy_to_user(x25_subscr32, &x25_subscr,
1653 				sizeof(*x25_subscr32)) ? -EFAULT : 0;
1654 	} else {
1655 		rc = -EINVAL;
1656 		if (x25_subscr.extended == 0 || x25_subscr.extended == 1) {
1657 			rc = 0;
1658 			write_lock_bh(&x25_neigh_list_lock);
1659 			nb->extended = x25_subscr.extended;
1660 			nb->global_facil_mask = x25_subscr.global_facil_mask;
1661 			write_unlock_bh(&x25_neigh_list_lock);
1662 		}
1663 	}
1664 	x25_neigh_put(nb);
1665 out:
1666 	return rc;
1667 out_dev_put:
1668 	dev_put(dev);
1669 	goto out;
1670 }
1671 
compat_x25_ioctl(struct socket * sock,unsigned int cmd,unsigned long arg)1672 static int compat_x25_ioctl(struct socket *sock, unsigned int cmd,
1673 				unsigned long arg)
1674 {
1675 	void __user *argp = compat_ptr(arg);
1676 	int rc = -ENOIOCTLCMD;
1677 
1678 	switch(cmd) {
1679 	case TIOCOUTQ:
1680 	case TIOCINQ:
1681 		rc = x25_ioctl(sock, cmd, (unsigned long)argp);
1682 		break;
1683 	case SIOCGIFADDR:
1684 	case SIOCSIFADDR:
1685 	case SIOCGIFDSTADDR:
1686 	case SIOCSIFDSTADDR:
1687 	case SIOCGIFBRDADDR:
1688 	case SIOCSIFBRDADDR:
1689 	case SIOCGIFNETMASK:
1690 	case SIOCSIFNETMASK:
1691 	case SIOCGIFMETRIC:
1692 	case SIOCSIFMETRIC:
1693 		rc = -EINVAL;
1694 		break;
1695 	case SIOCADDRT:
1696 	case SIOCDELRT:
1697 		rc = -EPERM;
1698 		if (!capable(CAP_NET_ADMIN))
1699 			break;
1700 		rc = x25_route_ioctl(cmd, argp);
1701 		break;
1702 	case SIOCX25GSUBSCRIP:
1703 		rc = compat_x25_subscr_ioctl(cmd, argp);
1704 		break;
1705 	case SIOCX25SSUBSCRIP:
1706 		rc = -EPERM;
1707 		if (!capable(CAP_NET_ADMIN))
1708 			break;
1709 		rc = compat_x25_subscr_ioctl(cmd, argp);
1710 		break;
1711 	case SIOCX25GFACILITIES:
1712 	case SIOCX25SFACILITIES:
1713 	case SIOCX25GDTEFACILITIES:
1714 	case SIOCX25SDTEFACILITIES:
1715 	case SIOCX25GCALLUSERDATA:
1716 	case SIOCX25SCALLUSERDATA:
1717 	case SIOCX25GCAUSEDIAG:
1718 	case SIOCX25SCAUSEDIAG:
1719 	case SIOCX25SCUDMATCHLEN:
1720 	case SIOCX25CALLACCPTAPPRV:
1721 	case SIOCX25SENDCALLACCPT:
1722 		rc = x25_ioctl(sock, cmd, (unsigned long)argp);
1723 		break;
1724 	default:
1725 		rc = -ENOIOCTLCMD;
1726 		break;
1727 	}
1728 	return rc;
1729 }
1730 #endif
1731 
1732 static const struct proto_ops x25_proto_ops = {
1733 	.family =	AF_X25,
1734 	.owner =	THIS_MODULE,
1735 	.release =	x25_release,
1736 	.bind =		x25_bind,
1737 	.connect =	x25_connect,
1738 	.socketpair =	sock_no_socketpair,
1739 	.accept =	x25_accept,
1740 	.getname =	x25_getname,
1741 	.poll =		datagram_poll,
1742 	.ioctl =	x25_ioctl,
1743 #ifdef CONFIG_COMPAT
1744 	.compat_ioctl = compat_x25_ioctl,
1745 #endif
1746 	.gettstamp =	sock_gettstamp,
1747 	.listen =	x25_listen,
1748 	.shutdown =	sock_no_shutdown,
1749 	.setsockopt =	x25_setsockopt,
1750 	.getsockopt =	x25_getsockopt,
1751 	.sendmsg =	x25_sendmsg,
1752 	.recvmsg =	x25_recvmsg,
1753 	.mmap =		sock_no_mmap,
1754 	.sendpage =	sock_no_sendpage,
1755 };
1756 
1757 static struct packet_type x25_packet_type __read_mostly = {
1758 	.type =	cpu_to_be16(ETH_P_X25),
1759 	.func =	x25_lapb_receive_frame,
1760 };
1761 
1762 static struct notifier_block x25_dev_notifier = {
1763 	.notifier_call = x25_device_event,
1764 };
1765 
x25_kill_by_neigh(struct x25_neigh * nb)1766 void x25_kill_by_neigh(struct x25_neigh *nb)
1767 {
1768 	struct sock *s;
1769 
1770 	write_lock_bh(&x25_list_lock);
1771 
1772 	sk_for_each(s, &x25_list) {
1773 		if (x25_sk(s)->neighbour == nb) {
1774 			write_unlock_bh(&x25_list_lock);
1775 			lock_sock(s);
1776 			x25_disconnect(s, ENETUNREACH, 0, 0);
1777 			release_sock(s);
1778 			write_lock_bh(&x25_list_lock);
1779 		}
1780 	}
1781 	write_unlock_bh(&x25_list_lock);
1782 
1783 	/* Remove any related forwards */
1784 	x25_clear_forward_by_dev(nb->dev);
1785 }
1786 
x25_init(void)1787 static int __init x25_init(void)
1788 {
1789 	int rc;
1790 
1791 	rc = proto_register(&x25_proto, 0);
1792 	if (rc)
1793 		goto out;
1794 
1795 	rc = sock_register(&x25_family_ops);
1796 	if (rc)
1797 		goto out_proto;
1798 
1799 	dev_add_pack(&x25_packet_type);
1800 
1801 	rc = register_netdevice_notifier(&x25_dev_notifier);
1802 	if (rc)
1803 		goto out_sock;
1804 
1805 	rc = x25_register_sysctl();
1806 	if (rc)
1807 		goto out_dev;
1808 
1809 	rc = x25_proc_init();
1810 	if (rc)
1811 		goto out_sysctl;
1812 
1813 	pr_info("Linux Version 0.2\n");
1814 
1815 out:
1816 	return rc;
1817 out_sysctl:
1818 	x25_unregister_sysctl();
1819 out_dev:
1820 	unregister_netdevice_notifier(&x25_dev_notifier);
1821 out_sock:
1822 	dev_remove_pack(&x25_packet_type);
1823 	sock_unregister(AF_X25);
1824 out_proto:
1825 	proto_unregister(&x25_proto);
1826 	goto out;
1827 }
1828 module_init(x25_init);
1829 
x25_exit(void)1830 static void __exit x25_exit(void)
1831 {
1832 	x25_proc_exit();
1833 	x25_link_free();
1834 	x25_route_free();
1835 
1836 	x25_unregister_sysctl();
1837 
1838 	unregister_netdevice_notifier(&x25_dev_notifier);
1839 
1840 	dev_remove_pack(&x25_packet_type);
1841 
1842 	sock_unregister(AF_X25);
1843 	proto_unregister(&x25_proto);
1844 }
1845 module_exit(x25_exit);
1846 
1847 MODULE_AUTHOR("Jonathan Naylor <g4klx@g4klx.demon.co.uk>");
1848 MODULE_DESCRIPTION("The X.25 Packet Layer network layer protocol");
1849 MODULE_LICENSE("GPL");
1850 MODULE_ALIAS_NETPROTO(PF_X25);
1851