text: /* drivers/net/pppopns.c
   *
   * Driver for PPP on PPTP Network Server / PPPoPNS Socket (RFC 2637)
   *
   * Copyright (C) 2009 Google, Inc.
   *
   * This software is licensed under the terms of the GNU General Public
   * License version 2, as published by the Free Software Foundation, and
   * may be copied, distributed, and modified under those terms.
   *
   * This program is distributed in the hope that it will be useful,
   * but WITHOUT ANY WARRANTY; without even the implied warranty of
   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   * GNU General Public License for more details.
   */
  
  /* This driver handles PPTP data packets between a RAW socket and a PPP channel.
   * The socket is created in the kernel space and connected to the same address
   * of the control socket. Outgoing packets are always sent with sequences but
   * without acknowledgements. Incoming packets with sequences are reordered
   * within a sliding window of one second. Currently reordering only happens when
   * a packet is received. It is done for simplicity since no additional locks or
   * threads are required. This driver should work on both IPv4 and IPv6. */
  
  #include <linux/module.h>
  #include <linux/jiffies.h>
  #include <linux/workqueue.h>
  #include <linux/skbuff.h>
  #include <linux/file.h>
  #include <linux/netdevice.h>
  #include <linux/net.h>
  #include <linux/ppp_defs.h>
  #include <linux/if.h>
  #include <linux/if_ppp.h>
  #include <linux/if_pppox.h>
  #include <linux/ppp_channel.h>
  #include <asm/uaccess.h>
  
  #define GRE_HEADER_SIZE		8
  
  #define PPTP_GRE_BITS		htons(0x2001)
  #define PPTP_GRE_BITS_MASK	htons(0xEF7F)
  #define PPTP_GRE_SEQ_BIT	htons(0x1000)
  #define PPTP_GRE_ACK_BIT	htons(0x0080)
  #define PPTP_GRE_TYPE		htons(0x880B)
  
  #define PPP_ADDR	0xFF
  #define PPP_CTRL	0x03
  
  struct header {
  	__u16	bits;
  	__u16	type;
  	__u16	length;
  	__u16	call;
  	__u32	sequence;
  } __attribute__((packed));
  
  struct meta {
  	__u32 sequence;
  	__u32 timestamp;
  };
  
  static inline struct meta *skb_meta(struct sk_buff *skb)
  {
  	return (struct meta *)skb->cb;
  }
  
  /******************************************************************************/
  
  static int pppopns_recv_core(struct sock *sk_raw, struct sk_buff *skb)
  {
  	struct sock *sk = (struct sock *)sk_raw->sk_user_data;
  	struct pppopns_opt *opt = &pppox_sk(sk)->proto.pns;
  	struct meta *meta = skb_meta(skb);
  	__u32 now = jiffies;
  	struct header *hdr;
  
  	/* Skip transport header */
  	skb_pull(skb, skb_transport_header(skb) - skb->data);
  
  	/* Drop the packet if GRE header is missing. */
  	if (skb->len < GRE_HEADER_SIZE)
  		goto drop;
  	hdr = (struct header *)skb->data;
  
  	/* Check the header. */
  	if (hdr->type != PPTP_GRE_TYPE || hdr->call != opt->local ||
  			(hdr->bits & PPTP_GRE_BITS_MASK) != PPTP_GRE_BITS)
  		goto drop;
  
  	/* Skip all fields including optional ones. */
  	if (!skb_pull(skb, GRE_HEADER_SIZE +
  			(hdr->bits & PPTP_GRE_SEQ_BIT ? 4 : 0) +
  			(hdr->bits & PPTP_GRE_ACK_BIT ? 4 : 0)))
  		goto drop;
  
  	/* Check the length. */
  	if (skb->len != ntohs(hdr->length))
  		goto drop;
  
  	/* Check the sequence if it is present. */
  	if (hdr->bits & PPTP_GRE_SEQ_BIT) {
  		meta->sequence = ntohl(hdr->sequence);
  		if ((__s32)(meta->sequence - opt->recv_sequence) < 0)
  			goto drop;
  	}
  
  	/* Skip PPP address and control if they are present. */
  	if (skb->len >= 2 && skb->data[0] == PPP_ADDR &&
  			skb->data[1] == PPP_CTRL)
  		skb_pull(skb, 2);
  
  	/* Fix PPP protocol if it is compressed. */
  	if (skb->len >= 1 && skb->data[0] & 1)
  		skb_push(skb, 1)[0] = 0;
  
  	/* Drop the packet if PPP protocol is missing. */
  	if (skb->len < 2)
  		goto drop;
  
  	/* Perform reordering if sequencing is enabled. */
  	if (hdr->bits & PPTP_GRE_SEQ_BIT) {
  		struct sk_buff *skb1;
  
  		/* Insert the packet into receive queue in order. */
  		skb_set_owner_r(skb, sk);
  		skb_queue_walk(&sk->sk_receive_queue, skb1) {
  			struct meta *meta1 = skb_meta(skb1);
  			__s32 order = meta->sequence - meta1->sequence;
  			if (order == 0)
  				goto drop;
  			if (order < 0) {
  				meta->timestamp = meta1->timestamp;
  				skb_insert(skb1, skb, &sk->sk_receive_queue);
  				skb = NULL;
  				break;
  			}
  		}
  		if (skb) {
  			meta->timestamp = now;
  			skb_queue_tail(&sk->sk_receive_queue, skb);
  		}
  
  		/* Remove packets from receive queue as long as
  		 * 1. the receive buffer is full,
  		 * 2. they are queued longer than one second, or
  		 * 3. there are no missing packets before them. */
  		skb_queue_walk_safe(&sk->sk_receive_queue, skb, skb1) {
  			meta = skb_meta(skb);
  			if (atomic_read(&sk->sk_rmem_alloc) < sk->sk_rcvbuf &&
  					now - meta->timestamp < HZ &&
  					meta->sequence != opt->recv_sequence)
  				break;
  			skb_unlink(skb, &sk->sk_receive_queue);
  			opt->recv_sequence = meta->sequence + 1;
  			skb_orphan(skb);
  			ppp_input(&pppox_sk(sk)->chan, skb);
  		}
  		return NET_RX_SUCCESS;
  	}
  
  	/* Flush receive queue if sequencing is disabled. */
  	skb_queue_purge(&sk->sk_receive_queue);
  	skb_orphan(skb);
  	ppp_input(&pppox_sk(sk)->chan, skb);
  	return NET_RX_SUCCESS;
  drop:
  	kfree_skb(skb);
  	return NET_RX_DROP;
  }
  
  static void pppopns_recv(struct sock *sk_raw)
  {
  	struct sk_buff *skb;
  	while ((skb = skb_dequeue(&sk_raw->sk_receive_queue))) {
  		sock_hold(sk_raw);
  		sk_receive_skb(sk_raw, skb, 0);
  	}
  }
  
  static struct sk_buff_head delivery_queue;
  
  static void pppopns_xmit_core(struct work_struct *delivery_work)
  {
  	mm_segment_t old_fs = get_fs();
  	struct sk_buff *skb;
  
  	set_fs(KERNEL_DS);
  	while ((skb = skb_dequeue(&delivery_queue))) {
  		struct sock *sk_raw = skb->sk;
  		struct kvec iov = {.iov_base = skb->data, .iov_len = skb->len};
  		struct msghdr msg = {
  			.msg_flags = MSG_NOSIGNAL | MSG_DONTWAIT,
  		};
  
  		iov_iter_kvec(&msg.msg_iter, WRITE | ITER_KVEC, &iov, 1,
  			      skb->len);
  		sk_raw->sk_prot->sendmsg(sk_raw, &msg, skb->len);
  		kfree_skb(skb);
  	}
  	set_fs(old_fs);
  }
  
  static DECLARE_WORK(delivery_work, pppopns_xmit_core);
  
  static int pppopns_xmit(struct ppp_channel *chan, struct sk_buff *skb)
  {
  	struct sock *sk_raw = (struct sock *)chan->private;
  	struct pppopns_opt *opt = &pppox_sk(sk_raw->sk_user_data)->proto.pns;
  	struct header *hdr;
  	__u16 length;
  
  	/* Install PPP address and control. */
  	skb_push(skb, 2);
  	skb->data[0] = PPP_ADDR;
  	skb->data[1] = PPP_CTRL;
  	length = skb->len;
  
  	/* Install PPTP GRE header. */
  	hdr = (struct header *)skb_push(skb, 12);
  	hdr->bits = PPTP_GRE_BITS | PPTP_GRE_SEQ_BIT;
  	hdr->type = PPTP_GRE_TYPE;
  	hdr->length = htons(length);
  	hdr->call = opt->remote;
  	hdr->sequence = htonl(opt->xmit_sequence);
  	opt->xmit_sequence++;
  
  	/* Now send the packet via the delivery queue. */
  	skb_set_owner_w(skb, sk_raw);
  	skb_queue_tail(&delivery_queue, skb);
  	schedule_work(&delivery_work);
  	return 1;
  }
  
  /******************************************************************************/
  
  static struct ppp_channel_ops pppopns_channel_ops = {
  	.start_xmit = pppopns_xmit,
  };
  
  static int pppopns_connect(struct socket *sock, struct sockaddr *useraddr,
  	int addrlen, int flags)
  {
  	struct sock *sk = sock->sk;
  	struct pppox_sock *po = pppox_sk(sk);
  	struct sockaddr_pppopns *addr = (struct sockaddr_pppopns *)useraddr;
  	struct sockaddr_storage ss;
  	struct socket *sock_tcp = NULL;
  	struct socket *sock_raw = NULL;
  	struct sock *sk_tcp;
  	struct sock *sk_raw;
  	int error;
  
  	if (addrlen != sizeof(struct sockaddr_pppopns))
  		return -EINVAL;
  
  	lock_sock(sk);
  	error = -EALREADY;
  	if (sk->sk_state != PPPOX_NONE)
  		goto out;
  
  	sock_tcp = sockfd_lookup(addr->tcp_socket, &error);
  	if (!sock_tcp)
  		goto out;
  	sk_tcp = sock_tcp->sk;
  	error = -EPROTONOSUPPORT;
  	if (sk_tcp->sk_protocol != IPPROTO_TCP)
  		goto out;
  	addrlen = sizeof(struct sockaddr_storage);
  	error = kernel_getpeername(sock_tcp, (struct sockaddr *)&ss, &addrlen);
  	if (error)
  		goto out;
  	if (!sk_tcp->sk_bound_dev_if) {
  		struct dst_entry *dst = sk_dst_get(sk_tcp);
  		error = -ENODEV;
  		if (!dst)
  			goto out;
  		sk_tcp->sk_bound_dev_if = dst->dev->ifindex;
  		dst_release(dst);
  	}
  
  	error = sock_create(ss.ss_family, SOCK_RAW, IPPROTO_GRE, &sock_raw);
  	if (error)
  		goto out;
  	sk_raw = sock_raw->sk;
  	sk_raw->sk_bound_dev_if = sk_tcp->sk_bound_dev_if;
  	error = kernel_connect(sock_raw, (struct sockaddr *)&ss, addrlen, 0);
  	if (error)
  		goto out;
  
  	po->chan.hdrlen = 14;
  	po->chan.private = sk_raw;
  	po->chan.ops = &pppopns_channel_ops;
  	po->chan.mtu = PPP_MRU - 80;
  	po->proto.pns.local = addr->local;
  	po->proto.pns.remote = addr->remote;
  	po->proto.pns.data_ready = sk_raw->sk_data_ready;
  	po->proto.pns.backlog_rcv = sk_raw->sk_backlog_rcv;
  
  	error = ppp_register_channel(&po->chan);
  	if (error)
  		goto out;
  
  	sk->sk_state = PPPOX_CONNECTED;
  	lock_sock(sk_raw);
  	sk_raw->sk_data_ready = pppopns_recv;
  	sk_raw->sk_backlog_rcv = pppopns_recv_core;
  	sk_raw->sk_user_data = sk;
  	release_sock(sk_raw);
  out:
  	if (sock_tcp)
  		sockfd_put(sock_tcp);
  	if (error && sock_raw)
  		sock_release(sock_raw);
  	release_sock(sk);
  	return error;
  }
  
  static int pppopns_release(struct socket *sock)
  {
  	struct sock *sk = sock->sk;
  
  	if (!sk)
  		return 0;
  
  	lock_sock(sk);
  	if (sock_flag(sk, SOCK_DEAD)) {
  		release_sock(sk);
  		return -EBADF;
  	}
  
  	if (sk->sk_state != PPPOX_NONE) {
  		struct sock *sk_raw = (struct sock *)pppox_sk(sk)->chan.private;
  		lock_sock(sk_raw);
  		skb_queue_purge(&sk->sk_receive_queue);
  		pppox_unbind_sock(sk);
  		sk_raw->sk_data_ready = pppox_sk(sk)->proto.pns.data_ready;
  		sk_raw->sk_backlog_rcv = pppox_sk(sk)->proto.pns.backlog_rcv;
  		sk_raw->sk_user_data = NULL;
  		release_sock(sk_raw);
  		sock_release(sk_raw->sk_socket);
  	}
  
  	sock_orphan(sk);
  	sock->sk = NULL;
  	release_sock(sk);
  	sock_put(sk);
  	return 0;
  }
  
  /******************************************************************************/
  
  static struct proto pppopns_proto = {
  	.name = "PPPOPNS",
  	.owner = THIS_MODULE,
  	.obj_size = sizeof(struct pppox_sock),
  };
  
  static struct proto_ops pppopns_proto_ops = {
  	.family = PF_PPPOX,
  	.owner = THIS_MODULE,
  	.release = pppopns_release,
  	.bind = sock_no_bind,
  	.connect = pppopns_connect,
  	.socketpair = sock_no_socketpair,
  	.accept = sock_no_accept,
  	.getname = sock_no_getname,
  	.poll = sock_no_poll,
  	.ioctl = pppox_ioctl,
  	.listen = sock_no_listen,
  	.shutdown = sock_no_shutdown,
  	.setsockopt = sock_no_setsockopt,
  	.getsockopt = sock_no_getsockopt,
  	.sendmsg = sock_no_sendmsg,
  	.recvmsg = sock_no_recvmsg,
  	.mmap = sock_no_mmap,
  };
  
  static int pppopns_create(struct net *net, struct socket *sock, int kern)
  {
  	struct sock *sk;
  
  	sk = sk_alloc(net, PF_PPPOX, GFP_KERNEL, &pppopns_proto, kern);
  	if (!sk)
  		return -ENOMEM;
  
  	sock_init_data(sock, sk);
  	sock->state = SS_UNCONNECTED;
  	sock->ops = &pppopns_proto_ops;
  	sk->sk_protocol = PX_PROTO_OPNS;
  	sk->sk_state = PPPOX_NONE;
  	return 0;
  }
  
  /******************************************************************************/
  
  static struct pppox_proto pppopns_pppox_proto = {
  	.create = pppopns_create,
  	.owner = THIS_MODULE,
  };
  
  static int __init pppopns_init(void)
  {
  	int error;
  
  	error = proto_register(&pppopns_proto, 0);
  	if (error)
  		return error;
  
  	error = register_pppox_proto(PX_PROTO_OPNS, &pppopns_pppox_proto);
  	if (error)
  		proto_unregister(&pppopns_proto);
  	else
  		skb_queue_head_init(&delivery_queue);
  	return error;
  }
  
  static void __exit pppopns_exit(void)
  {
  	unregister_pppox_proto(PX_PROTO_OPNS);
  	proto_unregister(&pppopns_proto);
  }
  
  module_init(pppopns_init);
  module_exit(pppopns_exit);
  
  MODULE_DESCRIPTION("PPP on PPTP Network Server (PPPoPNS)");
  MODULE_AUTHOR("Chia-chi Yeh <chiachi@android.com>");
  MODULE_LICENSE("GPL");
  