raw.c 24.9 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1 2 3 4 5 6 7
/*
 * INET		An implementation of the TCP/IP protocol suite for the LINUX
 *		operating system.  INET is implemented using the  BSD Socket
 *		interface as the means of communication with the user level.
 *
 *		RAW - implementation of IP "raw" sockets.
 *
8
 * Authors:	Ross Biro
Linus Torvalds's avatar
Linus Torvalds committed
9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38
 *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
 *
 * Fixes:
 *		Alan Cox	:	verify_area() fixed up
 *		Alan Cox	:	ICMP error handling
 *		Alan Cox	:	EMSGSIZE if you send too big a packet
 *		Alan Cox	: 	Now uses generic datagrams and shared
 *					skbuff library. No more peek crashes,
 *					no more backlogs
 *		Alan Cox	:	Checks sk->broadcast.
 *		Alan Cox	:	Uses skb_free_datagram/skb_copy_datagram
 *		Alan Cox	:	Raw passes ip options too
 *		Alan Cox	:	Setsocketopt added
 *		Alan Cox	:	Fixed error return for broadcasts
 *		Alan Cox	:	Removed wake_up calls
 *		Alan Cox	:	Use ttl/tos
 *		Alan Cox	:	Cleaned up old debugging
 *		Alan Cox	:	Use new kernel side addresses
 *	Arnt Gulbrandsen	:	Fixed MSG_DONTROUTE in raw sockets.
 *		Alan Cox	:	BSD style RAW socket demultiplexing.
 *		Alan Cox	:	Beginnings of mrouted support.
 *		Alan Cox	:	Added IP_HDRINCL option.
 *		Alan Cox	:	Skip broadcast check if BSDism set.
 *		David S. Miller	:	New socket lookup architecture.
 *
 *		This program is free software; you can redistribute it and/or
 *		modify it under the terms of the GNU General Public License
 *		as published by the Free Software Foundation; either version
 *		2 of the License, or (at your option) any later version.
 */
39

40
#include <linux/types.h>
Arun Sharma's avatar
Arun Sharma committed
41
#include <linux/atomic.h>
Linus Torvalds's avatar
Linus Torvalds committed
42 43 44 45 46 47 48 49 50
#include <asm/byteorder.h>
#include <asm/current.h>
#include <asm/uaccess.h>
#include <asm/ioctls.h>
#include <linux/stddef.h>
#include <linux/slab.h>
#include <linux/errno.h>
#include <linux/aio.h>
#include <linux/kernel.h>
51
#include <linux/export.h>
Linus Torvalds's avatar
Linus Torvalds committed
52 53 54 55 56 57 58 59 60
#include <linux/spinlock.h>
#include <linux/sockios.h>
#include <linux/socket.h>
#include <linux/in.h>
#include <linux/mroute.h>
#include <linux/netdevice.h>
#include <linux/in_route.h>
#include <linux/route.h>
#include <linux/skbuff.h>
61
#include <net/net_namespace.h>
Linus Torvalds's avatar
Linus Torvalds committed
62 63 64 65 66 67 68 69 70
#include <net/dst.h>
#include <net/sock.h>
#include <linux/ip.h>
#include <linux/net.h>
#include <net/ip.h>
#include <net/icmp.h>
#include <net/udp.h>
#include <net/raw.h>
#include <net/snmp.h>
71
#include <net/tcp_states.h>
Linus Torvalds's avatar
Linus Torvalds committed
72 73 74 75 76 77 78 79
#include <net/inet_common.h>
#include <net/checksum.h>
#include <net/xfrm.h>
#include <linux/rtnetlink.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
80
#include <linux/compat.h>
Linus Torvalds's avatar
Linus Torvalds committed
81

82
static struct raw_hashinfo raw_v4_hashinfo = {
83
	.lock = __RW_LOCK_UNLOCKED(raw_v4_hashinfo.lock),
84
};
Linus Torvalds's avatar
Linus Torvalds committed
85

86
void raw_hash_sk(struct sock *sk)
Linus Torvalds's avatar
Linus Torvalds committed
87
{
88
	struct raw_hashinfo *h = sk->sk_prot->h.raw_hash;
89
	struct hlist_head *head;
Linus Torvalds's avatar
Linus Torvalds committed
90

91
	head = &h->ht[inet_sk(sk)->inet_num & (RAW_HTABLE_SIZE - 1)];
92 93

	write_lock_bh(&h->lock);
Linus Torvalds's avatar
Linus Torvalds committed
94
	sk_add_node(sk, head);
95
	sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
96 97 98 99
	write_unlock_bh(&h->lock);
}
EXPORT_SYMBOL_GPL(raw_hash_sk);

100
void raw_unhash_sk(struct sock *sk)
101
{
102 103
	struct raw_hashinfo *h = sk->sk_prot->h.raw_hash;

104 105
	write_lock_bh(&h->lock);
	if (sk_del_node_init(sk))
106
		sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
107 108 109 110
	write_unlock_bh(&h->lock);
}
EXPORT_SYMBOL_GPL(raw_unhash_sk);

111 112
static struct sock *__raw_v4_lookup(struct net *net, struct sock *sk,
		unsigned short num, __be32 raddr, __be32 laddr, int dif)
Linus Torvalds's avatar
Linus Torvalds committed
113
{
114
	sk_for_each_from(sk) {
Linus Torvalds's avatar
Linus Torvalds committed
115 116
		struct inet_sock *inet = inet_sk(sk);

117 118 119
		if (net_eq(sock_net(sk), net) && inet->inet_num == num	&&
		    !(inet->inet_daddr && inet->inet_daddr != raddr) 	&&
		    !(inet->inet_rcv_saddr && inet->inet_rcv_saddr != laddr) &&
Linus Torvalds's avatar
Linus Torvalds committed
120 121 122 123 124 125 126 127 128 129 130 131
		    !(sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
			goto found; /* gotcha */
	}
	sk = NULL;
found:
	return sk;
}

/*
 *	0 - deliver
 *	1 - block
 */
Eric Dumazet's avatar
Eric Dumazet committed
132
static int icmp_filter(const struct sock *sk, const struct sk_buff *skb)
Linus Torvalds's avatar
Linus Torvalds committed
133
{
Eric Dumazet's avatar
Eric Dumazet committed
134 135
	struct icmphdr _hdr;
	const struct icmphdr *hdr;
Linus Torvalds's avatar
Linus Torvalds committed
136

Eric Dumazet's avatar
Eric Dumazet committed
137 138 139
	hdr = skb_header_pointer(skb, skb_transport_offset(skb),
				 sizeof(_hdr), &_hdr);
	if (!hdr)
Linus Torvalds's avatar
Linus Torvalds committed
140 141
		return 1;

Eric Dumazet's avatar
Eric Dumazet committed
142
	if (hdr->type < 32) {
Linus Torvalds's avatar
Linus Torvalds committed
143 144
		__u32 data = raw_sk(sk)->filter.data;

Eric Dumazet's avatar
Eric Dumazet committed
145
		return ((1U << hdr->type) & data) != 0;
Linus Torvalds's avatar
Linus Torvalds committed
146 147 148 149 150 151 152 153 154 155 156 157
	}

	/* Do not block unknown ICMP types */
	return 0;
}

/* IP input processing comes here for RAW socket delivery.
 * Caller owns SKB, so we must make clones.
 *
 * RFC 1122: SHOULD pass TOS value up to the transport layer.
 * -> It does. And not only TOS, but all IP header.
 */
158
static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash)
Linus Torvalds's avatar
Linus Torvalds committed
159 160 161
{
	struct sock *sk;
	struct hlist_head *head;
162
	int delivered = 0;
163
	struct net *net;
Linus Torvalds's avatar
Linus Torvalds committed
164

165 166
	read_lock(&raw_v4_hashinfo.lock);
	head = &raw_v4_hashinfo.ht[hash];
Linus Torvalds's avatar
Linus Torvalds committed
167 168
	if (hlist_empty(head))
		goto out;
169

170
	net = dev_net(skb->dev);
171
	sk = __raw_v4_lookup(net, __sk_head(head), iph->protocol,
Linus Torvalds's avatar
Linus Torvalds committed
172 173 174 175
			     iph->saddr, iph->daddr,
			     skb->dev->ifindex);

	while (sk) {
176
		delivered = 1;
Linus Torvalds's avatar
Linus Torvalds committed
177 178 179 180 181 182 183
		if (iph->protocol != IPPROTO_ICMP || !icmp_filter(sk, skb)) {
			struct sk_buff *clone = skb_clone(skb, GFP_ATOMIC);

			/* Not releasing hash table! */
			if (clone)
				raw_rcv(sk, clone);
		}
184
		sk = __raw_v4_lookup(net, sk_next(sk), iph->protocol,
Linus Torvalds's avatar
Linus Torvalds committed
185 186 187 188
				     iph->saddr, iph->daddr,
				     skb->dev->ifindex);
	}
out:
189
	read_unlock(&raw_v4_hashinfo.lock);
190
	return delivered;
Linus Torvalds's avatar
Linus Torvalds committed
191 192
}

193 194 195 196 197
int raw_local_deliver(struct sk_buff *skb, int protocol)
{
	int hash;
	struct sock *raw_sk;

198 199
	hash = protocol & (RAW_HTABLE_SIZE - 1);
	raw_sk = sk_head(&raw_v4_hashinfo.ht[hash]);
200 201 202 203 204 205 206 207 208 209 210 211

	/* If there maybe a raw socket we must check - if not we
	 * don't care less
	 */
	if (raw_sk && !raw_v4_input(skb, ip_hdr(skb), hash))
		raw_sk = NULL;

	return raw_sk != NULL;

}

static void raw_err(struct sock *sk, struct sk_buff *skb, u32 info)
Linus Torvalds's avatar
Linus Torvalds committed
212 213
{
	struct inet_sock *inet = inet_sk(sk);
214 215
	const int type = icmp_hdr(skb)->type;
	const int code = icmp_hdr(skb)->code;
Linus Torvalds's avatar
Linus Torvalds committed
216 217 218
	int err = 0;
	int harderr = 0;

219 220
	if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
		ipv4_sk_update_pmtu(skb, sk, info);
221
	else if (type == ICMP_REDIRECT) {
222
		ipv4_sk_redirect(skb, sk);
223 224
		return;
	}
225

Linus Torvalds's avatar
Linus Torvalds committed
226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257
	/* Report error on raw socket, if:
	   1. User requested ip_recverr.
	   2. Socket is connected (otherwise the error indication
	      is useless without ip_recverr and error is hard.
	 */
	if (!inet->recverr && sk->sk_state != TCP_ESTABLISHED)
		return;

	switch (type) {
	default:
	case ICMP_TIME_EXCEEDED:
		err = EHOSTUNREACH;
		break;
	case ICMP_SOURCE_QUENCH:
		return;
	case ICMP_PARAMETERPROB:
		err = EPROTO;
		harderr = 1;
		break;
	case ICMP_DEST_UNREACH:
		err = EHOSTUNREACH;
		if (code > NR_ICMP_UNREACH)
			break;
		err = icmp_err_convert[code].errno;
		harderr = icmp_err_convert[code].fatal;
		if (code == ICMP_FRAG_NEEDED) {
			harderr = inet->pmtudisc != IP_PMTUDISC_DONT;
			err = EMSGSIZE;
		}
	}

	if (inet->recverr) {
258
		const struct iphdr *iph = (const struct iphdr *)skb->data;
Linus Torvalds's avatar
Linus Torvalds committed
259 260 261 262 263 264 265 266 267 268 269 270 271
		u8 *payload = skb->data + (iph->ihl << 2);

		if (inet->hdrincl)
			payload = skb->data;
		ip_icmp_error(sk, skb, err, 0, info, payload);
	}

	if (inet->recverr || harderr) {
		sk->sk_err = err;
		sk->sk_error_report(sk);
	}
}

272 273 274 275
void raw_icmp_error(struct sk_buff *skb, int protocol, u32 info)
{
	int hash;
	struct sock *raw_sk;
276
	const struct iphdr *iph;
277
	struct net *net;
278

279
	hash = protocol & (RAW_HTABLE_SIZE - 1);
280

281 282
	read_lock(&raw_v4_hashinfo.lock);
	raw_sk = sk_head(&raw_v4_hashinfo.ht[hash]);
283
	if (raw_sk != NULL) {
284
		iph = (const struct iphdr *)skb->data;
285
		net = dev_net(skb->dev);
286 287 288

		while ((raw_sk = __raw_v4_lookup(net, raw_sk, protocol,
						iph->daddr, iph->saddr,
289 290 291
						skb->dev->ifindex)) != NULL) {
			raw_err(raw_sk, skb, info);
			raw_sk = sk_next(raw_sk);
292
			iph = (const struct iphdr *)skb->data;
293 294
		}
	}
295
	read_unlock(&raw_v4_hashinfo.lock);
296 297
}

Daniel Baluta's avatar
Daniel Baluta committed
298
static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
Linus Torvalds's avatar
Linus Torvalds committed
299 300
{
	/* Charge it to the socket. */
301

302
	ipv4_pktinfo_prepare(sk, skb);
303
	if (sock_queue_rcv_skb(sk, skb) < 0) {
Linus Torvalds's avatar
Linus Torvalds committed
304 305 306 307 308 309 310 311 312 313
		kfree_skb(skb);
		return NET_RX_DROP;
	}

	return NET_RX_SUCCESS;
}

int raw_rcv(struct sock *sk, struct sk_buff *skb)
{
	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
Wang Chen's avatar
Wang Chen committed
314
		atomic_inc(&sk->sk_drops);
Linus Torvalds's avatar
Linus Torvalds committed
315 316 317
		kfree_skb(skb);
		return NET_RX_DROP;
	}
318
	nf_reset(skb);
Linus Torvalds's avatar
Linus Torvalds committed
319

320
	skb_push(skb, skb->data - skb_network_header(skb));
Linus Torvalds's avatar
Linus Torvalds committed
321 322 323 324 325

	raw_rcv_skb(sk, skb);
	return 0;
}

326 327 328 329
static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4,
			   void *from, size_t length,
			   struct rtable **rtp,
			   unsigned int flags)
Linus Torvalds's avatar
Linus Torvalds committed
330 331
{
	struct inet_sock *inet = inet_sk(sk);
332
	struct net *net = sock_net(sk);
Linus Torvalds's avatar
Linus Torvalds committed
333 334
	struct iphdr *iph;
	struct sk_buff *skb;
335
	unsigned int iphlen;
Linus Torvalds's avatar
Linus Torvalds committed
336
	int err;
Eric Dumazet's avatar
Eric Dumazet committed
337
	struct rtable *rt = *rtp;
338
	int hlen, tlen;
Linus Torvalds's avatar
Linus Torvalds committed
339

340
	if (length > rt->dst.dev->mtu) {
341
		ip_local_error(sk, EMSGSIZE, fl4->daddr, inet->inet_dport,
342
			       rt->dst.dev->mtu);
Linus Torvalds's avatar
Linus Torvalds committed
343 344 345 346 347
		return -EMSGSIZE;
	}
	if (flags&MSG_PROBE)
		goto out;

348 349
	hlen = LL_RESERVED_SPACE(rt->dst.dev);
	tlen = rt->dst.dev->needed_tailroom;
350
	skb = sock_alloc_send_skb(sk,
351
				  length + hlen + tlen + 15,
352
				  flags & MSG_DONTWAIT, &err);
Linus Torvalds's avatar
Linus Torvalds committed
353
	if (skb == NULL)
354
		goto error;
355
	skb_reserve(skb, hlen);
Linus Torvalds's avatar
Linus Torvalds committed
356 357

	skb->priority = sk->sk_priority;
358
	skb->mark = sk->sk_mark;
359
	skb_dst_set(skb, &rt->dst);
Eric Dumazet's avatar
Eric Dumazet committed
360
	*rtp = NULL;
Linus Torvalds's avatar
Linus Torvalds committed
361

362
	skb_reset_network_header(skb);
363
	iph = ip_hdr(skb);
364
	skb_put(skb, length);
Linus Torvalds's avatar
Linus Torvalds committed
365 366 367

	skb->ip_summed = CHECKSUM_NONE;

368
	skb->transport_header = skb->network_header;
369 370 371
	err = -EFAULT;
	if (memcpy_fromiovecend((void *)iph, from, 0, length))
		goto error_free;
Linus Torvalds's avatar
Linus Torvalds committed
372

373
	iphlen = iph->ihl * 4;
374 375 376 377 378 379 380 381 382 383 384 385 386

	/*
	 * We don't want to modify the ip header, but we do need to
	 * be sure that it won't cause problems later along the network
	 * stack.  Specifically we want to make sure that iph->ihl is a
	 * sane value.  If ihl points beyond the length of the buffer passed
	 * in, reject the frame as invalid
	 */
	err = -EINVAL;
	if (iphlen > length)
		goto error_free;

	if (iphlen >= sizeof(*iph)) {
Linus Torvalds's avatar
Linus Torvalds committed
387
		if (!iph->saddr)
388
			iph->saddr = fl4->saddr;
Linus Torvalds's avatar
Linus Torvalds committed
389 390 391
		iph->check   = 0;
		iph->tot_len = htons(length);
		if (!iph->id)
392
			ip_select_ident(skb, &rt->dst, NULL);
Linus Torvalds's avatar
Linus Torvalds committed
393 394 395

		iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
	}
396
	if (iph->protocol == IPPROTO_ICMP)
397
		icmp_out_count(net, ((struct icmphdr *)
398
			skb_transport_header(skb))->type);
Linus Torvalds's avatar
Linus Torvalds committed
399

400
	err = NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_OUT, skb, NULL,
401
		      rt->dst.dev, dst_output);
Linus Torvalds's avatar
Linus Torvalds committed
402
	if (err > 0)
Eric Dumazet's avatar
Eric Dumazet committed
403
		err = net_xmit_errno(err);
Linus Torvalds's avatar
Linus Torvalds committed
404 405 406 407 408
	if (err)
		goto error;
out:
	return 0;

409
error_free:
Linus Torvalds's avatar
Linus Torvalds committed
410 411
	kfree_skb(skb);
error:
Pavel Emelyanov's avatar
Pavel Emelyanov committed
412
	IP_INC_STATS(net, IPSTATS_MIB_OUTDISCARDS);
Eric Dumazet's avatar
Eric Dumazet committed
413 414
	if (err == -ENOBUFS && !inet->recverr)
		err = 0;
415
	return err;
Linus Torvalds's avatar
Linus Torvalds committed
416 417
}

418
static int raw_probe_proto_opt(struct flowi4 *fl4, struct msghdr *msg)
Linus Torvalds's avatar
Linus Torvalds committed
419 420 421 422 423
{
	struct iovec *iov;
	u8 __user *type = NULL;
	u8 __user *code = NULL;
	int probed = 0;
424
	unsigned int i;
Linus Torvalds's avatar
Linus Torvalds committed
425 426

	if (!msg->msg_iov)
Heiko Carstens's avatar
Heiko Carstens committed
427
		return 0;
Linus Torvalds's avatar
Linus Torvalds committed
428 429 430 431 432 433

	for (i = 0; i < msg->msg_iovlen; i++) {
		iov = &msg->msg_iov[i];
		if (!iov)
			continue;

434
		switch (fl4->flowi4_proto) {
Linus Torvalds's avatar
Linus Torvalds committed
435 436 437 438 439 440 441 442 443 444 445 446 447 448
		case IPPROTO_ICMP:
			/* check if one-byte field is readable or not. */
			if (iov->iov_base && iov->iov_len < 1)
				break;

			if (!type) {
				type = iov->iov_base;
				/* check if code field is readable or not. */
				if (iov->iov_len > 1)
					code = type + 1;
			} else if (!code)
				code = iov->iov_base;

			if (type && code) {
449 450
				if (get_user(fl4->fl4_icmp_type, type) ||
				    get_user(fl4->fl4_icmp_code, code))
Heiko Carstens's avatar
Heiko Carstens committed
451
					return -EFAULT;
Linus Torvalds's avatar
Linus Torvalds committed
452 453 454 455 456 457 458 459 460 461
				probed = 1;
			}
			break;
		default:
			probed = 1;
			break;
		}
		if (probed)
			break;
	}
Heiko Carstens's avatar
Heiko Carstens committed
462
	return 0;
Linus Torvalds's avatar
Linus Torvalds committed
463 464 465 466 467 468 469 470
}

static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
		       size_t len)
{
	struct inet_sock *inet = inet_sk(sk);
	struct ipcm_cookie ipc;
	struct rtable *rt = NULL;
471
	struct flowi4 fl4;
Linus Torvalds's avatar
Linus Torvalds committed
472
	int free = 0;
473
	__be32 daddr;
474
	__be32 saddr;
Linus Torvalds's avatar
Linus Torvalds committed
475 476
	u8  tos;
	int err;
477
	struct ip_options_data opt_copy;
Linus Torvalds's avatar
Linus Torvalds committed
478 479

	err = -EMSGSIZE;
480
	if (len > 0xFFFF)
Linus Torvalds's avatar
Linus Torvalds committed
481 482 483 484 485 486 487 488 489
		goto out;

	/*
	 *	Check the flags.
	 */

	err = -EOPNOTSUPP;
	if (msg->msg_flags & MSG_OOB)	/* Mirror BSD error message */
		goto out;               /* compatibility */
490

Linus Torvalds's avatar
Linus Torvalds committed
491
	/*
492
	 *	Get and verify the address.
Linus Torvalds's avatar
Linus Torvalds committed
493 494 495
	 */

	if (msg->msg_namelen) {
496
		DECLARE_SOCKADDR(struct sockaddr_in *, usin, msg->msg_name);
Linus Torvalds's avatar
Linus Torvalds committed
497 498 499 500
		err = -EINVAL;
		if (msg->msg_namelen < sizeof(*usin))
			goto out;
		if (usin->sin_family != AF_INET) {
501 502
			pr_info_once("%s: %s forgot to set AF_INET. Fix it!\n",
				     __func__, current->comm);
Linus Torvalds's avatar
Linus Torvalds committed
503 504 505 506 507 508 509 510 511 512 513
			err = -EAFNOSUPPORT;
			if (usin->sin_family)
				goto out;
		}
		daddr = usin->sin_addr.s_addr;
		/* ANK: I did not forget to get protocol from port field.
		 * I just do not know, who uses this weirdness.
		 * IP_HDRINCL is much more convenient.
		 */
	} else {
		err = -EDESTADDRREQ;
514
		if (sk->sk_state != TCP_ESTABLISHED)
Linus Torvalds's avatar
Linus Torvalds committed
515
			goto out;
516
		daddr = inet->inet_daddr;
Linus Torvalds's avatar
Linus Torvalds committed
517 518
	}

519
	ipc.addr = inet->inet_saddr;
Linus Torvalds's avatar
Linus Torvalds committed
520
	ipc.opt = NULL;
521
	ipc.tx_flags = 0;
522 523
	ipc.ttl = 0;
	ipc.tos = -1;
Linus Torvalds's avatar
Linus Torvalds committed
524 525 526
	ipc.oif = sk->sk_bound_dev_if;

	if (msg->msg_controllen) {
527
		err = ip_cmsg_send(sock_net(sk), msg, &ipc);
Linus Torvalds's avatar
Linus Torvalds committed
528 529 530 531 532 533 534 535 536
		if (err)
			goto out;
		if (ipc.opt)
			free = 1;
	}

	saddr = ipc.addr;
	ipc.addr = daddr;

537 538 539 540 541 542 543 544 545 546 547 548
	if (!ipc.opt) {
		struct ip_options_rcu *inet_opt;

		rcu_read_lock();
		inet_opt = rcu_dereference(inet->inet_opt);
		if (inet_opt) {
			memcpy(&opt_copy, inet_opt,
			       sizeof(*inet_opt) + inet_opt->opt.optlen);
			ipc.opt = &opt_copy.opt;
		}
		rcu_read_unlock();
	}
Linus Torvalds's avatar
Linus Torvalds committed
549 550 551 552 553 554 555 556

	if (ipc.opt) {
		err = -EINVAL;
		/* Linux does not mangle headers on raw sockets,
		 * so that IP options + IP_HDRINCL is non-sense.
		 */
		if (inet->hdrincl)
			goto done;
557
		if (ipc.opt->opt.srr) {
Linus Torvalds's avatar
Linus Torvalds committed
558 559
			if (!daddr)
				goto done;
560
			daddr = ipc.opt->opt.faddr;
Linus Torvalds's avatar
Linus Torvalds committed
561 562
		}
	}
563
	tos = get_rtconn_flags(&ipc, sk);
Linus Torvalds's avatar
Linus Torvalds committed
564 565 566
	if (msg->msg_flags & MSG_DONTROUTE)
		tos |= RTO_ONLINK;

567
	if (ipv4_is_multicast(daddr)) {
Linus Torvalds's avatar
Linus Torvalds committed
568 569 570 571
		if (!ipc.oif)
			ipc.oif = inet->mc_index;
		if (!saddr)
			saddr = inet->mc_addr;
572 573
	} else if (!ipc.oif)
		ipc.oif = inet->uc_index;
Linus Torvalds's avatar
Linus Torvalds committed
574

575 576 577
	flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
			   RT_SCOPE_UNIVERSE,
			   inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
578
			   inet_sk_flowi_flags(sk) |
579
			    (inet->hdrincl ? FLOWI_FLAG_KNOWN_NH : 0),
580
			   daddr, saddr, 0, 0);
581

582 583 584
	if (!inet->hdrincl) {
		err = raw_probe_proto_opt(&fl4, msg);
		if (err)
585
			goto done;
586 587 588 589 590 591 592 593
	}

	security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
	rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
	if (IS_ERR(rt)) {
		err = PTR_ERR(rt);
		rt = NULL;
		goto done;
Linus Torvalds's avatar
Linus Torvalds committed
594 595 596 597 598 599 600 601 602 603 604
	}

	err = -EACCES;
	if (rt->rt_flags & RTCF_BROADCAST && !sock_flag(sk, SOCK_BROADCAST))
		goto done;

	if (msg->msg_flags & MSG_CONFIRM)
		goto do_confirm;
back_from_confirm:

	if (inet->hdrincl)
605 606
		err = raw_send_hdrinc(sk, &fl4, msg->msg_iov, len,
				      &rt, msg->msg_flags);
607

Linus Torvalds's avatar
Linus Torvalds committed
608 609
	 else {
		if (!ipc.addr)
610
			ipc.addr = fl4.daddr;
Linus Torvalds's avatar
Linus Torvalds committed
611
		lock_sock(sk);
612
		err = ip_append_data(sk, &fl4, ip_generic_getfrag,
613 614
				     msg->msg_iov, len, 0,
				     &ipc, &rt, msg->msg_flags);
Linus Torvalds's avatar
Linus Torvalds committed
615 616
		if (err)
			ip_flush_pending_frames(sk);
Eric Dumazet's avatar
Eric Dumazet committed
617
		else if (!(msg->msg_flags & MSG_MORE)) {
618
			err = ip_push_pending_frames(sk, &fl4);
Eric Dumazet's avatar
Eric Dumazet committed
619 620 621
			if (err == -ENOBUFS && !inet->recverr)
				err = 0;
		}
Linus Torvalds's avatar
Linus Torvalds committed
622 623 624 625 626 627 628
		release_sock(sk);
	}
done:
	if (free)
		kfree(ipc.opt);
	ip_rt_put(rt);

629 630 631 632
out:
	if (err < 0)
		return err;
	return len;
Linus Torvalds's avatar
Linus Torvalds committed
633 634

do_confirm:
635
	dst_confirm(&rt->dst);
Linus Torvalds's avatar
Linus Torvalds committed
636 637 638 639 640 641 642 643
	if (!(msg->msg_flags & MSG_PROBE) || len)
		goto back_from_confirm;
	err = 0;
	goto done;
}

static void raw_close(struct sock *sk, long timeout)
{
644
	/*
Lucas De Marchi's avatar
Lucas De Marchi committed
645
	 * Raw sockets may have direct kernel references. Kill them.
Linus Torvalds's avatar
Linus Torvalds committed
646 647 648 649 650 651
	 */
	ip_ra_control(sk, 0, NULL);

	sk_common_release(sk);
}

652
static void raw_destroy(struct sock *sk)
Denis V. Lunev's avatar
Denis V. Lunev committed
653 654 655 656 657 658
{
	lock_sock(sk);
	ip_flush_pending_frames(sk);
	release_sock(sk);
}

Linus Torvalds's avatar
Linus Torvalds committed
659 660 661 662 663 664 665 666 667 668
/* This gets rid of all the nasties in af_inet. -DaveM */
static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
{
	struct inet_sock *inet = inet_sk(sk);
	struct sockaddr_in *addr = (struct sockaddr_in *) uaddr;
	int ret = -EINVAL;
	int chk_addr_ret;

	if (sk->sk_state != TCP_CLOSE || addr_len < sizeof(struct sockaddr_in))
		goto out;
669
	chk_addr_ret = inet_addr_type(sock_net(sk), addr->sin_addr.s_addr);
Linus Torvalds's avatar
Linus Torvalds committed
670 671 672 673
	ret = -EADDRNOTAVAIL;
	if (addr->sin_addr.s_addr && chk_addr_ret != RTN_LOCAL &&
	    chk_addr_ret != RTN_MULTICAST && chk_addr_ret != RTN_BROADCAST)
		goto out;
674
	inet->inet_rcv_saddr = inet->inet_saddr = addr->sin_addr.s_addr;
Linus Torvalds's avatar
Linus Torvalds committed
675
	if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
676
		inet->inet_saddr = 0;  /* Use device */
Linus Torvalds's avatar
Linus Torvalds committed
677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692
	sk_dst_reset(sk);
	ret = 0;
out:	return ret;
}

/*
 *	This should be easy, if there is something there
 *	we return it, otherwise we block.
 */

static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
		       size_t len, int noblock, int flags, int *addr_len)
{
	struct inet_sock *inet = inet_sk(sk);
	size_t copied = 0;
	int err = -EOPNOTSUPP;
693
	DECLARE_SOCKADDR(struct sockaddr_in *, sin, msg->msg_name);
Linus Torvalds's avatar
Linus Torvalds committed
694 695 696 697 698 699
	struct sk_buff *skb;

	if (flags & MSG_OOB)
		goto out;

	if (flags & MSG_ERRQUEUE) {
700
		err = ip_recv_error(sk, msg, len, addr_len);
Linus Torvalds's avatar
Linus Torvalds committed
701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717
		goto out;
	}

	skb = skb_recv_datagram(sk, flags, noblock, &err);
	if (!skb)
		goto out;

	copied = skb->len;
	if (len < copied) {
		msg->msg_flags |= MSG_TRUNC;
		copied = len;
	}

	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
	if (err)
		goto done;

718
	sock_recv_ts_and_drops(msg, sk, skb);
Linus Torvalds's avatar
Linus Torvalds committed
719 720 721 722

	/* Copy the address. */
	if (sin) {
		sin->sin_family = AF_INET;
723
		sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
724
		sin->sin_port = 0;
Linus Torvalds's avatar
Linus Torvalds committed
725
		memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
726
		*addr_len = sizeof(*sin);
Linus Torvalds's avatar
Linus Torvalds committed
727 728 729 730 731 732 733
	}
	if (inet->cmsg_flags)
		ip_cmsg_recv(msg, skb);
	if (flags & MSG_TRUNC)
		copied = skb->len;
done:
	skb_free_datagram(sk, skb);
734 735 736 737
out:
	if (err)
		return err;
	return copied;
Linus Torvalds's avatar
Linus Torvalds committed
738 739 740 741 742 743
}

static int raw_init(struct sock *sk)
{
	struct raw_sock *rp = raw_sk(sk);

744
	if (inet_sk(sk)->inet_num == IPPROTO_ICMP)
Linus Torvalds's avatar
Linus Torvalds committed
745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776
		memset(&rp->filter, 0, sizeof(rp->filter));
	return 0;
}

static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
{
	if (optlen > sizeof(struct icmp_filter))
		optlen = sizeof(struct icmp_filter);
	if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
		return -EFAULT;
	return 0;
}

static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
{
	int len, ret = -EFAULT;

	if (get_user(len, optlen))
		goto out;
	ret = -EINVAL;
	if (len < 0)
		goto out;
	if (len > sizeof(struct icmp_filter))
		len = sizeof(struct icmp_filter);
	ret = -EFAULT;
	if (put_user(len, optlen) ||
	    copy_to_user(optval, &raw_sk(sk)->filter, len))
		goto out;
	ret = 0;
out:	return ret;
}

777
static int do_raw_setsockopt(struct sock *sk, int level, int optname,
778
			  char __user *optval, unsigned int optlen)
Linus Torvalds's avatar
Linus Torvalds committed
779 780
{
	if (optname == ICMP_FILTER) {
781
		if (inet_sk(sk)->inet_num != IPPROTO_ICMP)
Linus Torvalds's avatar
Linus Torvalds committed
782 783 784 785 786 787 788
			return -EOPNOTSUPP;
		else
			return raw_seticmpfilter(sk, optval, optlen);
	}
	return -ENOPROTOOPT;
}

789
static int raw_setsockopt(struct sock *sk, int level, int optname,
790
			  char __user *optval, unsigned int optlen)
Linus Torvalds's avatar
Linus Torvalds committed
791 792
{
	if (level != SOL_RAW)
793 794 795
		return ip_setsockopt(sk, level, optname, optval, optlen);
	return do_raw_setsockopt(sk, level, optname, optval, optlen);
}
Linus Torvalds's avatar
Linus Torvalds committed
796

797 798
#ifdef CONFIG_COMPAT
static int compat_raw_setsockopt(struct sock *sk, int level, int optname,
799
				 char __user *optval, unsigned int optlen)
800 801
{
	if (level != SOL_RAW)
802
		return compat_ip_setsockopt(sk, level, optname, optval, optlen);
803 804 805 806 807 808 809
	return do_raw_setsockopt(sk, level, optname, optval, optlen);
}
#endif

static int do_raw_getsockopt(struct sock *sk, int level, int optname,
			  char __user *optval, int __user *optlen)
{
Linus Torvalds's avatar
Linus Torvalds committed
810
	if (optname == ICMP_FILTER) {
811
		if (inet_sk(sk)->inet_num != IPPROTO_ICMP)
Linus Torvalds's avatar
Linus Torvalds committed
812 813 814 815 816 817 818
			return -EOPNOTSUPP;
		else
			return raw_geticmpfilter(sk, optval, optlen);
	}
	return -ENOPROTOOPT;
}

819 820 821 822 823 824 825 826 827 828
static int raw_getsockopt(struct sock *sk, int level, int optname,
			  char __user *optval, int __user *optlen)
{
	if (level != SOL_RAW)
		return ip_getsockopt(sk, level, optname, optval, optlen);
	return do_raw_getsockopt(sk, level, optname, optval, optlen);
}

#ifdef CONFIG_COMPAT
static int compat_raw_getsockopt(struct sock *sk, int level, int optname,
829
				 char __user *optval, int __user *optlen)
830 831
{
	if (level != SOL_RAW)
832
		return compat_ip_getsockopt(sk, level, optname, optval, optlen);
833 834 835 836
	return do_raw_getsockopt(sk, level, optname, optval, optlen);
}
#endif

Linus Torvalds's avatar
Linus Torvalds committed
837 838 839
static int raw_ioctl(struct sock *sk, int cmd, unsigned long arg)
{
	switch (cmd) {
Joe Perches's avatar
Joe Perches committed
840 841
	case SIOCOUTQ: {
		int amount = sk_wmem_alloc_get(sk);
842

Joe Perches's avatar
Joe Perches committed
843 844 845 846 847 848 849 850 851 852 853 854 855
		return put_user(amount, (int __user *)arg);
	}
	case SIOCINQ: {
		struct sk_buff *skb;
		int amount = 0;

		spin_lock_bh(&sk->sk_receive_queue.lock);
		skb = skb_peek(&sk->sk_receive_queue);
		if (skb != NULL)
			amount = skb->len;
		spin_unlock_bh(&sk->sk_receive_queue.lock);
		return put_user(amount, (int __user *)arg);
	}
Linus Torvalds's avatar
Linus Torvalds committed
856

Joe Perches's avatar
Joe Perches committed
857
	default:
Linus Torvalds's avatar
Linus Torvalds committed
858
#ifdef CONFIG_IP_MROUTE
Joe Perches's avatar
Joe Perches committed
859
		return ipmr_ioctl(sk, cmd, (void __user *)arg);
Linus Torvalds's avatar
Linus Torvalds committed
860
#else
Joe Perches's avatar
Joe Perches committed
861
		return -ENOIOCTLCMD;
Linus Torvalds's avatar
Linus Torvalds committed
862 863 864 865
#endif
	}
}

866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882
#ifdef CONFIG_COMPAT
static int compat_raw_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
{
	switch (cmd) {
	case SIOCOUTQ:
	case SIOCINQ:
		return -ENOIOCTLCMD;
	default:
#ifdef CONFIG_IP_MROUTE
		return ipmr_compat_ioctl(sk, cmd, compat_ptr(arg));
#else
		return -ENOIOCTLCMD;
#endif
	}
}
#endif

Linus Torvalds's avatar
Linus Torvalds committed
883
struct proto raw_prot = {
884 885 886
	.name		   = "RAW",
	.owner		   = THIS_MODULE,
	.close		   = raw_close,
Denis V. Lunev's avatar
Denis V. Lunev committed
887
	.destroy	   = raw_destroy,
888 889 890 891 892 893 894 895 896 897
	.connect	   = ip4_datagram_connect,
	.disconnect	   = udp_disconnect,
	.ioctl		   = raw_ioctl,
	.init		   = raw_init,
	.setsockopt	   = raw_setsockopt,
	.getsockopt	   = raw_getsockopt,
	.sendmsg	   = raw_sendmsg,
	.recvmsg	   = raw_recvmsg,
	.bind		   = raw_bind,
	.backlog_rcv	   = raw_rcv_skb,
898
	.release_cb	   = ip4_datagram_release_cb,
899 900
	.hash		   = raw_hash_sk,
	.unhash		   = raw_unhash_sk,
901
	.obj_size	   = sizeof(struct raw_sock),
902
	.h.raw_hash	   = &raw_v4_hashinfo,
903
#ifdef CONFIG_COMPAT
904 905
	.compat_setsockopt = compat_raw_setsockopt,
	.compat_getsockopt = compat_raw_getsockopt,
906
	.compat_ioctl	   = compat_raw_ioctl,
907
#endif
Linus Torvalds's avatar
Linus Torvalds committed
908 909 910 911 912 913
};

#ifdef CONFIG_PROC_FS
static struct sock *raw_get_first(struct seq_file *seq)
{
	struct sock *sk;
914
	struct raw_iter_state *state = raw_seq_private(seq);
Linus Torvalds's avatar
Linus Torvalds committed
915

916 917
	for (state->bucket = 0; state->bucket < RAW_HTABLE_SIZE;
			++state->bucket) {
918
		sk_for_each(sk, &state->h->ht[state->bucket])
919
			if (sock_net(sk) == seq_file_net(seq))
Linus Torvalds's avatar
Linus Torvalds committed
920 921 922 923 924 925 926 927 928
				goto found;
	}
	sk = NULL;
found:
	return sk;
}

static struct sock *raw_get_next(struct seq_file *seq, struct sock *sk)
{
929
	struct raw_iter_state *state = raw_seq_private(seq);
Linus Torvalds's avatar
Linus Torvalds committed
930 931 932 933 934

	do {
		sk = sk_next(sk);
try_again:
		;
935
	} while (sk && sock_net(sk) != seq_file_net(seq));
Linus Torvalds's avatar
Linus Torvalds committed
936

937
	if (!sk && ++state->bucket < RAW_HTABLE_SIZE) {
938
		sk = sk_head(&state->h->ht[state->bucket]);
Linus Torvalds's avatar
Linus Torvalds committed
939 940 941 942 943 944 945 946 947 948 949 950 951 952 953
		goto try_again;
	}
	return sk;
}

static struct sock *raw_get_idx(struct seq_file *seq, loff_t pos)
{
	struct sock *sk = raw_get_first(seq);

	if (sk)
		while (pos && (sk = raw_get_next(seq, sk)) != NULL)
			--pos;
	return pos ? NULL : sk;
}

954
void *raw_seq_start(struct seq_file *seq, loff_t *pos)
Linus Torvalds's avatar
Linus Torvalds committed
955
{
956 957 958
	struct raw_iter_state *state = raw_seq_private(seq);

	read_lock(&state->h->lock);
Linus Torvalds's avatar
Linus Torvalds committed
959 960
	return *pos ? raw_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
}
961
EXPORT_SYMBOL_GPL(raw_seq_start);
Linus Torvalds's avatar
Linus Torvalds committed
962

963
void *raw_seq_next(struct seq_file *seq, void *v, loff_t *pos)
Linus Torvalds's avatar
Linus Torvalds committed
964 965 966 967 968 969 970 971 972 973
{
	struct sock *sk;

	if (v == SEQ_START_TOKEN)
		sk = raw_get_first(seq);
	else
		sk = raw_get_next(seq, v);
	++*pos;
	return sk;
}
974
EXPORT_SYMBOL_GPL(raw_seq_next);
Linus Torvalds's avatar
Linus Torvalds committed
975

976
void raw_seq_stop(struct seq_file *seq, void *v)
Linus Torvalds's avatar
Linus Torvalds committed
977
{
978 979 980
	struct raw_iter_state *state = raw_seq_private(seq);

	read_unlock(&state->h->lock);
Linus Torvalds's avatar
Linus Torvalds committed
981
}
982
EXPORT_SYMBOL_GPL(raw_seq_stop);
Linus Torvalds's avatar
Linus Torvalds committed
983

984
static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
Linus Torvalds's avatar
Linus Torvalds committed
985 986
{
	struct inet_sock *inet = inet_sk(sp);
987 988
	__be32 dest = inet->inet_daddr,
	       src = inet->inet_rcv_saddr;
Linus Torvalds's avatar
Linus Torvalds committed
989
	__u16 destp = 0,
990
	      srcp  = inet->inet_num;
Linus Torvalds's avatar
Linus Torvalds committed
991

992
	seq_printf(seq, "%4d: %08X:%04X %08X:%04X"
993
		" %02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %d\n",
994
		i, src, srcp, dest, destp, sp->sk_state,
995 996
		sk_wmem_alloc_get(sp),
		sk_rmem_alloc_get(sp),
997 998 999
		0, 0L, 0,
		from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
		0, sock_i_ino(sp),
Wang Chen's avatar
Wang Chen committed
1000
		atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
Linus Torvalds's avatar
Linus Torvalds committed
1001 1002 1003 1004 1005
}

static int raw_seq_show(struct seq_file *seq, void *v)
{
	if (v == SEQ_START_TOKEN)
1006 1007
		seq_printf(seq, "  sl  local_address rem_address   st tx_queue "
				"rx_queue tr tm->when retrnsmt   uid  timeout "
Eric Dumazet's avatar
Eric Dumazet committed
1008
				"inode ref pointer drops\n");
1009 1010
	else
		raw_sock_seq_show(seq, v, raw_seq_private(seq)->bucket);
Linus Torvalds's avatar
Linus Torvalds committed
1011 1012 1013
	return 0;
}

1014
static const struct seq_operations raw_seq_ops = {
Linus Torvalds's avatar
Linus Torvalds committed
1015 1016 1017 1018 1019 1020
	.start = raw_seq_start,
	.next  = raw_seq_next,
	.stop  = raw_seq_stop,
	.show  = raw_seq_show,
};

1021 1022
int raw_seq_open(struct inode *ino, struct file *file,
		 struct raw_hashinfo *h, const struct seq_operations *ops)
Linus Torvalds's avatar
Linus Torvalds committed
1023
{
1024
	int err;
1025 1026
	struct raw_iter_state *i;

1027
	err = seq_open_net(ino, file, ops, sizeof(struct raw_iter_state));
1028 1029
	if (err < 0)
		return err;
1030

1031
	i = raw_seq_private((struct seq_file *)file->private_data);
1032 1033 1034 1035 1036 1037 1038
	i->h = h;
	return 0;
}
EXPORT_SYMBOL_GPL(raw_seq_open);

static int raw_v4_seq_open(struct inode *inode, struct file *file)
{
1039
	return raw_seq_open(inode, file, &raw_v4_hashinfo, &raw_seq_ops);
Linus Torvalds's avatar
Linus Torvalds committed
1040 1041
}

1042
static const struct file_operations raw_seq_fops = {
Linus Torvalds's avatar
Linus Torvalds committed
1043
	.owner	 = THIS_MODULE,
1044
	.open	 = raw_v4_seq_open,
Linus Torvalds's avatar
Linus Torvalds committed
1045 1046
	.read	 = seq_read,
	.llseek	 = seq_lseek,
1047
	.release = seq_release_net,
Linus Torvalds's avatar
Linus Torvalds committed
1048 1049
};

1050
static __net_init int raw_init_net(struct net *net)
Linus Torvalds's avatar
Linus Torvalds committed
1051
{
1052
	if (!proc_create("raw", S_IRUGO, net->proc_net, &raw_seq_fops))
Linus Torvalds's avatar
Linus Torvalds committed
1053
		return -ENOMEM;
1054

Linus Torvalds's avatar
Linus Torvalds committed
1055 1056 1057
	return 0;
}

1058 1059
static __net_exit void raw_exit_net(struct net *net)
{
1060
	remove_proc_entry("raw", net->proc_net);
1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072
}

static __net_initdata struct pernet_operations raw_net_ops = {
	.init = raw_init_net,
	.exit = raw_exit_net,
};

int __init raw_proc_init(void)
{
	return register_pernet_subsys(&raw_net_ops);
}

Linus Torvalds's avatar
Linus Torvalds committed
1073 1074
void __init raw_proc_exit(void)
{
1075
	unregister_pernet_subsys(&raw_net_ops);
Linus Torvalds's avatar
Linus Torvalds committed
1076 1077
}
#endif /* CONFIG_PROC_FS */