bridge: mcast snooping, fix length check of snooped MLDv1/2
[deliverable/linux.git] / net / batman-adv / icmp_socket.c
1 /*
2 * Copyright (C) 2007-2011 B.A.T.M.A.N. contributors:
3 *
4 * Marek Lindner
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of version 2 of the GNU General Public
8 * License as published by the Free Software Foundation.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 * General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
18 * 02110-1301, USA
19 *
20 */
21
22 #include "main.h"
23 #include <linux/debugfs.h>
24 #include <linux/slab.h>
25 #include "icmp_socket.h"
26 #include "send.h"
27 #include "hash.h"
28 #include "originator.h"
29 #include "hard-interface.h"
30
31 static struct socket_client *socket_client_hash[256];
32
33 static void bat_socket_add_packet(struct socket_client *socket_client,
34 struct icmp_packet_rr *icmp_packet,
35 size_t icmp_len);
36
37 void bat_socket_init(void)
38 {
39 memset(socket_client_hash, 0, sizeof(socket_client_hash));
40 }
41
42 static int bat_socket_open(struct inode *inode, struct file *file)
43 {
44 unsigned int i;
45 struct socket_client *socket_client;
46
47 nonseekable_open(inode, file);
48
49 socket_client = kmalloc(sizeof(struct socket_client), GFP_KERNEL);
50
51 if (!socket_client)
52 return -ENOMEM;
53
54 for (i = 0; i < ARRAY_SIZE(socket_client_hash); i++) {
55 if (!socket_client_hash[i]) {
56 socket_client_hash[i] = socket_client;
57 break;
58 }
59 }
60
61 if (i == ARRAY_SIZE(socket_client_hash)) {
62 pr_err("Error - can't add another packet client: "
63 "maximum number of clients reached\n");
64 kfree(socket_client);
65 return -EXFULL;
66 }
67
68 INIT_LIST_HEAD(&socket_client->queue_list);
69 socket_client->queue_len = 0;
70 socket_client->index = i;
71 socket_client->bat_priv = inode->i_private;
72 spin_lock_init(&socket_client->lock);
73 init_waitqueue_head(&socket_client->queue_wait);
74
75 file->private_data = socket_client;
76
77 inc_module_count();
78 return 0;
79 }
80
81 static int bat_socket_release(struct inode *inode, struct file *file)
82 {
83 struct socket_client *socket_client = file->private_data;
84 struct socket_packet *socket_packet;
85 struct list_head *list_pos, *list_pos_tmp;
86
87 spin_lock_bh(&socket_client->lock);
88
89 /* for all packets in the queue ... */
90 list_for_each_safe(list_pos, list_pos_tmp, &socket_client->queue_list) {
91 socket_packet = list_entry(list_pos,
92 struct socket_packet, list);
93
94 list_del(list_pos);
95 kfree(socket_packet);
96 }
97
98 socket_client_hash[socket_client->index] = NULL;
99 spin_unlock_bh(&socket_client->lock);
100
101 kfree(socket_client);
102 dec_module_count();
103
104 return 0;
105 }
106
107 static ssize_t bat_socket_read(struct file *file, char __user *buf,
108 size_t count, loff_t *ppos)
109 {
110 struct socket_client *socket_client = file->private_data;
111 struct socket_packet *socket_packet;
112 size_t packet_len;
113 int error;
114
115 if ((file->f_flags & O_NONBLOCK) && (socket_client->queue_len == 0))
116 return -EAGAIN;
117
118 if ((!buf) || (count < sizeof(struct icmp_packet)))
119 return -EINVAL;
120
121 if (!access_ok(VERIFY_WRITE, buf, count))
122 return -EFAULT;
123
124 error = wait_event_interruptible(socket_client->queue_wait,
125 socket_client->queue_len);
126
127 if (error)
128 return error;
129
130 spin_lock_bh(&socket_client->lock);
131
132 socket_packet = list_first_entry(&socket_client->queue_list,
133 struct socket_packet, list);
134 list_del(&socket_packet->list);
135 socket_client->queue_len--;
136
137 spin_unlock_bh(&socket_client->lock);
138
139 error = __copy_to_user(buf, &socket_packet->icmp_packet,
140 socket_packet->icmp_len);
141
142 packet_len = socket_packet->icmp_len;
143 kfree(socket_packet);
144
145 if (error)
146 return -EFAULT;
147
148 return packet_len;
149 }
150
151 static ssize_t bat_socket_write(struct file *file, const char __user *buff,
152 size_t len, loff_t *off)
153 {
154 struct socket_client *socket_client = file->private_data;
155 struct bat_priv *bat_priv = socket_client->bat_priv;
156 struct sk_buff *skb;
157 struct icmp_packet_rr *icmp_packet;
158
159 struct orig_node *orig_node = NULL;
160 struct neigh_node *neigh_node = NULL;
161 size_t packet_len = sizeof(struct icmp_packet);
162
163 if (len < sizeof(struct icmp_packet)) {
164 bat_dbg(DBG_BATMAN, bat_priv,
165 "Error - can't send packet from char device: "
166 "invalid packet size\n");
167 return -EINVAL;
168 }
169
170 if (!bat_priv->primary_if)
171 return -EFAULT;
172
173 if (len >= sizeof(struct icmp_packet_rr))
174 packet_len = sizeof(struct icmp_packet_rr);
175
176 skb = dev_alloc_skb(packet_len + sizeof(struct ethhdr));
177 if (!skb)
178 return -ENOMEM;
179
180 skb_reserve(skb, sizeof(struct ethhdr));
181 icmp_packet = (struct icmp_packet_rr *)skb_put(skb, packet_len);
182
183 if (!access_ok(VERIFY_READ, buff, packet_len)) {
184 len = -EFAULT;
185 goto free_skb;
186 }
187
188 if (__copy_from_user(icmp_packet, buff, packet_len)) {
189 len = -EFAULT;
190 goto free_skb;
191 }
192
193 if (icmp_packet->packet_type != BAT_ICMP) {
194 bat_dbg(DBG_BATMAN, bat_priv,
195 "Error - can't send packet from char device: "
196 "got bogus packet type (expected: BAT_ICMP)\n");
197 len = -EINVAL;
198 goto free_skb;
199 }
200
201 if (icmp_packet->msg_type != ECHO_REQUEST) {
202 bat_dbg(DBG_BATMAN, bat_priv,
203 "Error - can't send packet from char device: "
204 "got bogus message type (expected: ECHO_REQUEST)\n");
205 len = -EINVAL;
206 goto free_skb;
207 }
208
209 icmp_packet->uid = socket_client->index;
210
211 if (icmp_packet->version != COMPAT_VERSION) {
212 icmp_packet->msg_type = PARAMETER_PROBLEM;
213 icmp_packet->ttl = COMPAT_VERSION;
214 bat_socket_add_packet(socket_client, icmp_packet, packet_len);
215 goto free_skb;
216 }
217
218 if (atomic_read(&bat_priv->mesh_state) != MESH_ACTIVE)
219 goto dst_unreach;
220
221 rcu_read_lock();
222 orig_node = orig_hash_find(bat_priv, icmp_packet->dst);
223
224 if (!orig_node)
225 goto unlock;
226
227 neigh_node = orig_node->router;
228
229 if (!neigh_node)
230 goto unlock;
231
232 if (!atomic_inc_not_zero(&neigh_node->refcount)) {
233 neigh_node = NULL;
234 goto unlock;
235 }
236
237 rcu_read_unlock();
238
239 if (!neigh_node->if_incoming)
240 goto dst_unreach;
241
242 if (neigh_node->if_incoming->if_status != IF_ACTIVE)
243 goto dst_unreach;
244
245 memcpy(icmp_packet->orig,
246 bat_priv->primary_if->net_dev->dev_addr, ETH_ALEN);
247
248 if (packet_len == sizeof(struct icmp_packet_rr))
249 memcpy(icmp_packet->rr,
250 neigh_node->if_incoming->net_dev->dev_addr, ETH_ALEN);
251
252 send_skb_packet(skb, neigh_node->if_incoming, neigh_node->addr);
253 goto out;
254
255 unlock:
256 rcu_read_unlock();
257 dst_unreach:
258 icmp_packet->msg_type = DESTINATION_UNREACHABLE;
259 bat_socket_add_packet(socket_client, icmp_packet, packet_len);
260 free_skb:
261 kfree_skb(skb);
262 out:
263 if (neigh_node)
264 neigh_node_free_ref(neigh_node);
265 if (orig_node)
266 orig_node_free_ref(orig_node);
267 return len;
268 }
269
270 static unsigned int bat_socket_poll(struct file *file, poll_table *wait)
271 {
272 struct socket_client *socket_client = file->private_data;
273
274 poll_wait(file, &socket_client->queue_wait, wait);
275
276 if (socket_client->queue_len > 0)
277 return POLLIN | POLLRDNORM;
278
279 return 0;
280 }
281
282 static const struct file_operations fops = {
283 .owner = THIS_MODULE,
284 .open = bat_socket_open,
285 .release = bat_socket_release,
286 .read = bat_socket_read,
287 .write = bat_socket_write,
288 .poll = bat_socket_poll,
289 .llseek = no_llseek,
290 };
291
292 int bat_socket_setup(struct bat_priv *bat_priv)
293 {
294 struct dentry *d;
295
296 if (!bat_priv->debug_dir)
297 goto err;
298
299 d = debugfs_create_file(ICMP_SOCKET, S_IFREG | S_IWUSR | S_IRUSR,
300 bat_priv->debug_dir, bat_priv, &fops);
301 if (d)
302 goto err;
303
304 return 0;
305
306 err:
307 return 1;
308 }
309
310 static void bat_socket_add_packet(struct socket_client *socket_client,
311 struct icmp_packet_rr *icmp_packet,
312 size_t icmp_len)
313 {
314 struct socket_packet *socket_packet;
315
316 socket_packet = kmalloc(sizeof(struct socket_packet), GFP_ATOMIC);
317
318 if (!socket_packet)
319 return;
320
321 INIT_LIST_HEAD(&socket_packet->list);
322 memcpy(&socket_packet->icmp_packet, icmp_packet, icmp_len);
323 socket_packet->icmp_len = icmp_len;
324
325 spin_lock_bh(&socket_client->lock);
326
327 /* while waiting for the lock the socket_client could have been
328 * deleted */
329 if (!socket_client_hash[icmp_packet->uid]) {
330 spin_unlock_bh(&socket_client->lock);
331 kfree(socket_packet);
332 return;
333 }
334
335 list_add_tail(&socket_packet->list, &socket_client->queue_list);
336 socket_client->queue_len++;
337
338 if (socket_client->queue_len > 100) {
339 socket_packet = list_first_entry(&socket_client->queue_list,
340 struct socket_packet, list);
341
342 list_del(&socket_packet->list);
343 kfree(socket_packet);
344 socket_client->queue_len--;
345 }
346
347 spin_unlock_bh(&socket_client->lock);
348
349 wake_up(&socket_client->queue_wait);
350 }
351
352 void bat_socket_receive_packet(struct icmp_packet_rr *icmp_packet,
353 size_t icmp_len)
354 {
355 struct socket_client *hash = socket_client_hash[icmp_packet->uid];
356
357 if (hash)
358 bat_socket_add_packet(hash, icmp_packet, icmp_len);
359 }
This page took 0.061518 seconds and 5 git commands to generate.