[SK_BUFF]: Introduce skb_reset_network_header(skb)

[net-next-2.6.git] / drivers / net / pppoe.c

diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index 860bb0f60f688892e27e2cdb76837a421f08066b..e94790632d558b6b5b4221fcccf0905a4630ed75 100644 (file)
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -7,6 +7,12 @@
  *
  * Version:    0.7.0
  *
+ * 070228 :    Fix to allow multiple sessions with same remote MAC and same
+ *             session id by including the local device ifindex in the
+ *             tuple identifying a session. This also ensures packets can't
+ *             be injected into a session from interfaces other than the one
+ *             specified by userspace. Florian Zumbiehl <florz@florz.de>
+ *             (Oh, BTW, this one is YYMMDD, in case you were wondering ...)
  * 220102 :    Fix module use count on failure in pppoe_create, pppox_sk -acme
  * 030700 :    Fixed connect logic to allow for disconnect.
  * 270700 :    Fixed potential SMP problems; we must protect against
@@ -127,14 +133,14 @@ static struct pppox_sock *item_hash_table[PPPOE_HASH_SIZE];
  *  Set/get/delete/rehash items  (internal versions)
  *
  **********************************************************************/
-static struct pppox_sock *__get_item(unsigned long sid, unsigned char *addr)
+static struct pppox_sock *__get_item(unsigned long sid, unsigned char *addr, int ifindex)
 {
        int hash = hash_item(sid, addr);
        struct pppox_sock *ret;
 
        ret = item_hash_table[hash];
 
-       while (ret && !cmp_addr(&ret->pppoe_pa, sid, addr))
+       while (ret && !(cmp_addr(&ret->pppoe_pa, sid, addr) && ret->pppoe_ifindex == ifindex))
                ret = ret->next;
 
        return ret;
@@ -147,21 +153,19 @@ static int __set_item(struct pppox_sock *po)
 
        ret = item_hash_table[hash];
        while (ret) {
-               if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa))
+               if (cmp_2_addr(&ret->pppoe_pa, &po->pppoe_pa) && ret->pppoe_ifindex == po->pppoe_ifindex)
                        return -EALREADY;
 
                ret = ret->next;
        }
 
-       if (!ret) {
-               po->next = item_hash_table[hash];
-               item_hash_table[hash] = po;
-       }
+       po->next = item_hash_table[hash];
+       item_hash_table[hash] = po;
 
        return 0;
 }
 
-static struct pppox_sock *__delete_item(unsigned long sid, char *addr)
+static struct pppox_sock *__delete_item(unsigned long sid, char *addr, int ifindex)
 {
        int hash = hash_item(sid, addr);
        struct pppox_sock *ret, **src;
@@ -170,7 +174,7 @@ static struct pppox_sock *__delete_item(unsigned long sid, char *addr)
        src = &item_hash_table[hash];
 
        while (ret) {
-               if (cmp_addr(&ret->pppoe_pa, sid, addr)) {
+               if (cmp_addr(&ret->pppoe_pa, sid, addr) && ret->pppoe_ifindex == ifindex) {
                        *src = ret->next;
                        break;
                }
@@ -188,12 +192,12 @@ static struct pppox_sock *__delete_item(unsigned long sid, char *addr)
  *
  **********************************************************************/
 static inline struct pppox_sock *get_item(unsigned long sid,
-                                        unsigned char *addr)
+                                        unsigned char *addr, int ifindex)
 {
        struct pppox_sock *po;
 
        read_lock_bh(&pppoe_hash_lock);
-       po = __get_item(sid, addr);
+       po = __get_item(sid, addr, ifindex);
        if (po)
                sock_hold(sk_pppox(po));
        read_unlock_bh(&pppoe_hash_lock);
@@ -203,7 +207,15 @@ static inline struct pppox_sock *get_item(unsigned long sid,
 
 static inline struct pppox_sock *get_item_by_addr(struct sockaddr_pppox *sp)
 {
-       return get_item(sp->sa_addr.pppoe.sid, sp->sa_addr.pppoe.remote);
+       struct net_device *dev = NULL;
+       int ifindex;
+
+       dev = dev_get_by_name(sp->sa_addr.pppoe.dev);
+       if(!dev)
+               return NULL;
+       ifindex = dev->ifindex;
+       dev_put(dev);
+       return get_item(sp->sa_addr.pppoe.sid, sp->sa_addr.pppoe.remote, ifindex);
 }
 
 static inline int set_item(struct pppox_sock *po)
@@ -220,12 +232,12 @@ static inline int set_item(struct pppox_sock *po)
        return i;
 }
 
-static inline struct pppox_sock *delete_item(unsigned long sid, char *addr)
+static inline struct pppox_sock *delete_item(unsigned long sid, char *addr, int ifindex)
 {
        struct pppox_sock *ret;
 
        write_lock_bh(&pppoe_hash_lock);
-       ret = __delete_item(sid, addr);
+       ret = __delete_item(sid, addr, ifindex);
        write_unlock_bh(&pppoe_hash_lock);
 
        return ret;
@@ -335,7 +347,7 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
        struct pppox_sock *relay_po = NULL;
 
        if (sk->sk_state & PPPOX_BOUND) {
-               struct pppoe_hdr *ph = (struct pppoe_hdr *) skb->nh.raw;
+               struct pppoe_hdr *ph = pppoe_hdr(skb);
                int len = ntohs(ph->length);
                skb_pull_rcsum(skb, sizeof(struct pppoe_hdr));
                if (pskb_trim_rcsum(skb, len))
@@ -389,9 +401,9 @@ static int pppoe_rcv(struct sk_buff *skb,
        if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
                goto out;
 
-       ph = (struct pppoe_hdr *) skb->nh.raw;
+       ph = pppoe_hdr(skb);
 
-       po = get_item((unsigned long) ph->sid, eth_hdr(skb)->h_source);
+       po = get_item((unsigned long) ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
        if (po != NULL)
                return sk_receive_skb(sk_pppox(po), skb, 0);
 drop:
@@ -421,11 +433,11 @@ static int pppoe_disc_rcv(struct sk_buff *skb,
        if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
                goto out;
 
-       ph = (struct pppoe_hdr *) skb->nh.raw;
+       ph = pppoe_hdr(skb);
        if (ph->code != PADT_CODE)
                goto abort;
 
-       po = get_item((unsigned long) ph->sid, eth_hdr(skb)->h_source);
+       po = get_item((unsigned long) ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
        if (po) {
                struct sock *sk = sk_pppox(po);
 
@@ -517,7 +529,7 @@ static int pppoe_release(struct socket *sock)
 
        po = pppox_sk(sk);
        if (po->pppoe_pa.sid) {
-               delete_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
+               delete_item(po->pppoe_pa.sid, po->pppoe_pa.remote, po->pppoe_ifindex);
        }
 
        if (po->pppoe_dev)
@@ -539,7 +551,7 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
                  int sockaddr_len, int flags)
 {
        struct sock *sk = sock->sk;
-       struct net_device *dev = NULL;
+       struct net_device *dev;
        struct sockaddr_pppox *sp = (struct sockaddr_pppox *) uservaddr;
        struct pppox_sock *po = pppox_sk(sk);
        int error;
@@ -565,7 +577,7 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
                pppox_unbind_sock(sk);
 
                /* Delete the old binding */
-               delete_item(po->pppoe_pa.sid,po->pppoe_pa.remote);
+               delete_item(po->pppoe_pa.sid,po->pppoe_pa.remote,po->pppoe_ifindex);
 
                if(po->pppoe_dev)
                        dev_put(po->pppoe_dev);
@@ -585,6 +597,7 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
                        goto end;
 
                po->pppoe_dev = dev;
+               po->pppoe_ifindex = dev->ifindex;
 
                if (!(dev->flags & IFF_UP))
                        goto err_put;
@@ -705,7 +718,7 @@ static int pppoe_ioctl(struct socket *sock, unsigned int cmd,
                        break;
 
                /* PPPoE address from the user specifies an outbound
-                  PPPoE address to which frames are forwarded to */
+                  PPPoE address which frames are forwarded to */
                err = -EFAULT;
                if (copy_from_user(&po->pppoe_relay,
                                   (void __user *)arg,
@@ -786,7 +799,7 @@ static int pppoe_sendmsg(struct kiocb *iocb, struct socket *sock,
 
        /* Reserve space for headers. */
        skb_reserve(skb, dev->hard_header_len);
-       skb->nh.raw = skb->data;
+       skb_reset_network_header(skb);
 
        skb->dev = dev;
 
@@ -871,7 +884,7 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
        memcpy(ph, &hdr, sizeof(struct pppoe_hdr));
        skb2->protocol = __constant_htons(ETH_P_PPP_SES);
 
-       skb2->nh.raw = skb2->data;
+       skb_reset_network_header(skb2);
 
        skb2->dev = dev;
 
@@ -918,8 +931,6 @@ static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock,
        struct sock *sk = sock->sk;
        struct sk_buff *skb = NULL;
        int error = 0;
-       int len;
-       struct pppoe_hdr *ph = NULL;
 
        if (sk->sk_state & PPPOX_BOUND) {
                error = -EIO;
@@ -936,19 +947,15 @@ static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock,
        m->msg_namelen = 0;
 
        if (skb) {
-               error = 0;
-               ph = (struct pppoe_hdr *) skb->nh.raw;
-               len = ntohs(ph->length);
+               struct pppoe_hdr *ph = pppoe_hdr(skb);
+               const int len = ntohs(ph->length);
 
                error = memcpy_toiovec(m->msg_iov, (unsigned char *) &ph->tag[0], len);
-               if (error < 0)
-                       goto do_skb_free;
-               error = len;
+               if (error == 0)
+                       error = len;
        }
 
-do_skb_free:
-       if (skb)
-               kfree_skb(skb);
+       kfree_skb(skb);
 end:
        return error;
 }