[MAC80211]: don't send invalid QoS frames
[linux-2.6] / net / 802 / tr.c
1 /*
2  * NET3:        Token ring device handling subroutines
3  *
4  *              This program is free software; you can redistribute it and/or
5  *              modify it under the terms of the GNU General Public License
6  *              as published by the Free Software Foundation; either version
7  *              2 of the License, or (at your option) any later version.
8  *
9  * Fixes:       3 Feb 97 Paul Norton <pnorton@cts.com> Minor routing fixes.
10  *              Added rif table to /proc/net/tr_rif and rif timeout to
11  *              /proc/sys/net/token-ring/rif_timeout.
12  *              22 Jun 98 Paul Norton <p.norton@computer.org> Rearranged
13  *              tr_header and tr_type_trans to handle passing IPX SNAP and
14  *              802.2 through the correct layers. Eliminated tr_reformat.
15  *
16  */
17
18 #include <asm/uaccess.h>
19 #include <asm/system.h>
20 #include <linux/module.h>
21 #include <linux/types.h>
22 #include <linux/kernel.h>
23 #include <linux/jiffies.h>
24 #include <linux/string.h>
25 #include <linux/mm.h>
26 #include <linux/socket.h>
27 #include <linux/in.h>
28 #include <linux/inet.h>
29 #include <linux/netdevice.h>
30 #include <linux/trdevice.h>
31 #include <linux/skbuff.h>
32 #include <linux/errno.h>
33 #include <linux/timer.h>
34 #include <linux/net.h>
35 #include <linux/proc_fs.h>
36 #include <linux/seq_file.h>
37 #include <linux/init.h>
38 #include <net/arp.h>
39 #include <net/net_namespace.h>
40
41 static void tr_add_rif_info(struct trh_hdr *trh, struct net_device *dev);
42 static void rif_check_expire(unsigned long dummy);
43
44 #define TR_SR_DEBUG 0
45
46 /*
47  *      Each RIF entry we learn is kept this way
48  */
49
50 struct rif_cache {
51         unsigned char addr[TR_ALEN];
52         int iface;
53         __be16 rcf;
54         __be16 rseg[8];
55         struct rif_cache *next;
56         unsigned long last_used;
57         unsigned char local_ring;
58 };
59
60 #define RIF_TABLE_SIZE 32
61
62 /*
63  *      We hash the RIF cache 32 ways. We do after all have to look it
64  *      up a lot.
65  */
66
67 static struct rif_cache *rif_table[RIF_TABLE_SIZE];
68
69 static DEFINE_SPINLOCK(rif_lock);
70
71
72 /*
73  *      Garbage disposal timer.
74  */
75
76 static struct timer_list rif_timer;
77
78 int sysctl_tr_rif_timeout = 60*10*HZ;
79
80 static inline unsigned long rif_hash(const unsigned char *addr)
81 {
82         unsigned long x;
83
84         x = addr[0];
85         x = (x << 2) ^ addr[1];
86         x = (x << 2) ^ addr[2];
87         x = (x << 2) ^ addr[3];
88         x = (x << 2) ^ addr[4];
89         x = (x << 2) ^ addr[5];
90
91         x ^= x >> 8;
92
93         return x & (RIF_TABLE_SIZE - 1);
94 }
95
96 /*
97  *      Put the headers on a token ring packet. Token ring source routing
98  *      makes this a little more exciting than on ethernet.
99  */
100
101 static int tr_header(struct sk_buff *skb, struct net_device *dev,
102                      unsigned short type,
103                      void *daddr, void *saddr, unsigned len)
104 {
105         struct trh_hdr *trh;
106         int hdr_len;
107
108         /*
109          * Add the 802.2 SNAP header if IP as the IPv4/IPv6 code calls
110          * dev->hard_header directly.
111          */
112         if (type == ETH_P_IP || type == ETH_P_IPV6 || type == ETH_P_ARP)
113         {
114                 struct trllc *trllc;
115
116                 hdr_len = sizeof(struct trh_hdr) + sizeof(struct trllc);
117                 trh = (struct trh_hdr *)skb_push(skb, hdr_len);
118                 trllc = (struct trllc *)(trh+1);
119                 trllc->dsap = trllc->ssap = EXTENDED_SAP;
120                 trllc->llc = UI_CMD;
121                 trllc->protid[0] = trllc->protid[1] = trllc->protid[2] = 0x00;
122                 trllc->ethertype = htons(type);
123         }
124         else
125         {
126                 hdr_len = sizeof(struct trh_hdr);
127                 trh = (struct trh_hdr *)skb_push(skb, hdr_len);
128         }
129
130         trh->ac=AC;
131         trh->fc=LLC_FRAME;
132
133         if(saddr)
134                 memcpy(trh->saddr,saddr,dev->addr_len);
135         else
136                 memcpy(trh->saddr,dev->dev_addr,dev->addr_len);
137
138         /*
139          *      Build the destination and then source route the frame
140          */
141
142         if(daddr)
143         {
144                 memcpy(trh->daddr,daddr,dev->addr_len);
145                 tr_source_route(skb,trh,dev);
146                 return(hdr_len);
147         }
148
149         return -hdr_len;
150 }
151
152 /*
153  *      A neighbour discovery of some species (eg arp) has completed. We
154  *      can now send the packet.
155  */
156
157 static int tr_rebuild_header(struct sk_buff *skb)
158 {
159         struct trh_hdr *trh=(struct trh_hdr *)skb->data;
160         struct trllc *trllc=(struct trllc *)(skb->data+sizeof(struct trh_hdr));
161         struct net_device *dev = skb->dev;
162
163         /*
164          *      FIXME: We don't yet support IPv6 over token rings
165          */
166
167         if(trllc->ethertype != htons(ETH_P_IP)) {
168                 printk("tr_rebuild_header: Don't know how to resolve type %04X addresses ?\n", ntohs(trllc->ethertype));
169                 return 0;
170         }
171
172 #ifdef CONFIG_INET
173         if(arp_find(trh->daddr, skb)) {
174                         return 1;
175         }
176         else
177 #endif
178         {
179                 tr_source_route(skb,trh,dev);
180                 return 0;
181         }
182 }
183
184 /*
185  *      Some of this is a bit hackish. We intercept RIF information
186  *      used for source routing. We also grab IP directly and don't feed
187  *      it via SNAP.
188  */
189
190 __be16 tr_type_trans(struct sk_buff *skb, struct net_device *dev)
191 {
192
193         struct trh_hdr *trh;
194         struct trllc *trllc;
195         unsigned riflen=0;
196
197         skb->dev = dev;
198         skb_reset_mac_header(skb);
199         trh = tr_hdr(skb);
200
201         if(trh->saddr[0] & TR_RII)
202                 riflen = (ntohs(trh->rcf) & TR_RCF_LEN_MASK) >> 8;
203
204         trllc = (struct trllc *)(skb->data+sizeof(struct trh_hdr)-TR_MAXRIFLEN+riflen);
205
206         skb_pull(skb,sizeof(struct trh_hdr)-TR_MAXRIFLEN+riflen);
207
208         if(*trh->daddr & 0x80)
209         {
210                 if(!memcmp(trh->daddr,dev->broadcast,TR_ALEN))
211                         skb->pkt_type=PACKET_BROADCAST;
212                 else
213                         skb->pkt_type=PACKET_MULTICAST;
214         }
215         else if ( (trh->daddr[0] & 0x01) && (trh->daddr[1] & 0x00) && (trh->daddr[2] & 0x5E))
216         {
217                 skb->pkt_type=PACKET_MULTICAST;
218         }
219         else if(dev->flags & IFF_PROMISC)
220         {
221                 if(memcmp(trh->daddr, dev->dev_addr, TR_ALEN))
222                         skb->pkt_type=PACKET_OTHERHOST;
223         }
224
225         if ((skb->pkt_type != PACKET_BROADCAST) &&
226             (skb->pkt_type != PACKET_MULTICAST))
227                 tr_add_rif_info(trh,dev) ;
228
229         /*
230          * Strip the SNAP header from ARP packets since we don't
231          * pass them through to the 802.2/SNAP layers.
232          */
233
234         if (trllc->dsap == EXTENDED_SAP &&
235             (trllc->ethertype == htons(ETH_P_IP) ||
236              trllc->ethertype == htons(ETH_P_IPV6) ||
237              trllc->ethertype == htons(ETH_P_ARP)))
238         {
239                 skb_pull(skb, sizeof(struct trllc));
240                 return trllc->ethertype;
241         }
242
243         return htons(ETH_P_TR_802_2);
244 }
245
246 /*
247  *      We try to do source routing...
248  */
249
250 void tr_source_route(struct sk_buff *skb,struct trh_hdr *trh,struct net_device *dev)
251 {
252         int slack;
253         unsigned int hash;
254         struct rif_cache *entry;
255         unsigned char *olddata;
256         unsigned long flags;
257         static const unsigned char mcast_func_addr[]
258                 = {0xC0,0x00,0x00,0x04,0x00,0x00};
259
260         spin_lock_irqsave(&rif_lock, flags);
261
262         /*
263          *      Broadcasts are single route as stated in RFC 1042
264          */
265         if( (!memcmp(&(trh->daddr[0]),&(dev->broadcast[0]),TR_ALEN)) ||
266             (!memcmp(&(trh->daddr[0]),&(mcast_func_addr[0]), TR_ALEN))  )
267         {
268                 trh->rcf=htons((((sizeof(trh->rcf)) << 8) & TR_RCF_LEN_MASK)
269                                | TR_RCF_FRAME2K | TR_RCF_LIMITED_BROADCAST);
270                 trh->saddr[0]|=TR_RII;
271         }
272         else
273         {
274                 hash = rif_hash(trh->daddr);
275                 /*
276                  *      Walk the hash table and look for an entry
277                  */
278                 for(entry=rif_table[hash];entry && memcmp(&(entry->addr[0]),&(trh->daddr[0]),TR_ALEN);entry=entry->next);
279
280                 /*
281                  *      If we found an entry we can route the frame.
282                  */
283                 if(entry)
284                 {
285 #if TR_SR_DEBUG
286 printk("source routing for %02X:%02X:%02X:%02X:%02X:%02X\n",trh->daddr[0],
287                   trh->daddr[1],trh->daddr[2],trh->daddr[3],trh->daddr[4],trh->daddr[5]);
288 #endif
289                         if(!entry->local_ring && (ntohs(entry->rcf) & TR_RCF_LEN_MASK) >> 8)
290                         {
291                                 trh->rcf=entry->rcf;
292                                 memcpy(&trh->rseg[0],&entry->rseg[0],8*sizeof(unsigned short));
293                                 trh->rcf^=htons(TR_RCF_DIR_BIT);
294                                 trh->rcf&=htons(0x1fff);        /* Issam Chehab <ichehab@madge1.demon.co.uk> */
295
296                                 trh->saddr[0]|=TR_RII;
297 #if TR_SR_DEBUG
298                                 printk("entry found with rcf %04x\n", entry->rcf);
299                         }
300                         else
301                         {
302                                 printk("entry found but without rcf length, local=%02x\n", entry->local_ring);
303 #endif
304                         }
305                         entry->last_used=jiffies;
306                 }
307                 else
308                 {
309                         /*
310                          *      Without the information we simply have to shout
311                          *      on the wire. The replies should rapidly clean this
312                          *      situation up.
313                          */
314                         trh->rcf=htons((((sizeof(trh->rcf)) << 8) & TR_RCF_LEN_MASK)
315                                        | TR_RCF_FRAME2K | TR_RCF_LIMITED_BROADCAST);
316                         trh->saddr[0]|=TR_RII;
317 #if TR_SR_DEBUG
318                         printk("no entry in rif table found - broadcasting frame\n");
319 #endif
320                 }
321         }
322
323         /* Compress the RIF here so we don't have to do it in the driver(s) */
324         if (!(trh->saddr[0] & 0x80))
325                 slack = 18;
326         else
327                 slack = 18 - ((ntohs(trh->rcf) & TR_RCF_LEN_MASK)>>8);
328         olddata = skb->data;
329         spin_unlock_irqrestore(&rif_lock, flags);
330
331         skb_pull(skb, slack);
332         memmove(skb->data, olddata, sizeof(struct trh_hdr) - slack);
333 }
334
335 /*
336  *      We have learned some new RIF information for our source
337  *      routing.
338  */
339
340 static void tr_add_rif_info(struct trh_hdr *trh, struct net_device *dev)
341 {
342         unsigned int hash, rii_p = 0;
343         unsigned long flags;
344         struct rif_cache *entry;
345         unsigned char saddr0;
346
347         spin_lock_irqsave(&rif_lock, flags);
348         saddr0 = trh->saddr[0];
349
350         /*
351          *      Firstly see if the entry exists
352          */
353
354         if(trh->saddr[0] & TR_RII)
355         {
356                 trh->saddr[0]&=0x7f;
357                 if (((ntohs(trh->rcf) & TR_RCF_LEN_MASK) >> 8) > 2)
358                 {
359                         rii_p = 1;
360                 }
361         }
362
363         hash = rif_hash(trh->saddr);
364         for(entry=rif_table[hash];entry && memcmp(&(entry->addr[0]),&(trh->saddr[0]),TR_ALEN);entry=entry->next);
365
366         if(entry==NULL)
367         {
368 #if TR_SR_DEBUG
369 printk("adding rif_entry: addr:%02X:%02X:%02X:%02X:%02X:%02X rcf:%04X\n",
370                 trh->saddr[0],trh->saddr[1],trh->saddr[2],
371                 trh->saddr[3],trh->saddr[4],trh->saddr[5],
372                 ntohs(trh->rcf));
373 #endif
374                 /*
375                  *      Allocate our new entry. A failure to allocate loses
376                  *      use the information. This is harmless.
377                  *
378                  *      FIXME: We ought to keep some kind of cache size
379                  *      limiting and adjust the timers to suit.
380                  */
381                 entry=kmalloc(sizeof(struct rif_cache),GFP_ATOMIC);
382
383                 if(!entry)
384                 {
385                         printk(KERN_DEBUG "tr.c: Couldn't malloc rif cache entry !\n");
386                         spin_unlock_irqrestore(&rif_lock, flags);
387                         return;
388                 }
389
390                 memcpy(&(entry->addr[0]),&(trh->saddr[0]),TR_ALEN);
391                 entry->iface = dev->ifindex;
392                 entry->next=rif_table[hash];
393                 entry->last_used=jiffies;
394                 rif_table[hash]=entry;
395
396                 if (rii_p)
397                 {
398                         entry->rcf = trh->rcf & htons((unsigned short)~TR_RCF_BROADCAST_MASK);
399                         memcpy(&(entry->rseg[0]),&(trh->rseg[0]),8*sizeof(unsigned short));
400                         entry->local_ring = 0;
401                 }
402                 else
403                 {
404                         entry->local_ring = 1;
405                 }
406         }
407         else    /* Y. Tahara added */
408         {
409                 /*
410                  *      Update existing entries
411                  */
412                 if (!entry->local_ring)
413                     if (entry->rcf != (trh->rcf & htons((unsigned short)~TR_RCF_BROADCAST_MASK)) &&
414                          !(trh->rcf & htons(TR_RCF_BROADCAST_MASK)))
415                     {
416 #if TR_SR_DEBUG
417 printk("updating rif_entry: addr:%02X:%02X:%02X:%02X:%02X:%02X rcf:%04X\n",
418                 trh->saddr[0],trh->saddr[1],trh->saddr[2],
419                 trh->saddr[3],trh->saddr[4],trh->saddr[5],
420                 ntohs(trh->rcf));
421 #endif
422                             entry->rcf = trh->rcf & htons((unsigned short)~TR_RCF_BROADCAST_MASK);
423                             memcpy(&(entry->rseg[0]),&(trh->rseg[0]),8*sizeof(unsigned short));
424                     }
425                 entry->last_used=jiffies;
426         }
427         trh->saddr[0]=saddr0; /* put the routing indicator back for tcpdump */
428         spin_unlock_irqrestore(&rif_lock, flags);
429 }
430
431 /*
432  *      Scan the cache with a timer and see what we need to throw out.
433  */
434
435 static void rif_check_expire(unsigned long dummy)
436 {
437         int i;
438         unsigned long flags, next_interval = jiffies + sysctl_tr_rif_timeout/2;
439
440         spin_lock_irqsave(&rif_lock, flags);
441
442         for(i =0; i < RIF_TABLE_SIZE; i++) {
443                 struct rif_cache *entry, **pentry;
444
445                 pentry = rif_table+i;
446                 while((entry=*pentry) != NULL) {
447                         unsigned long expires
448                                 = entry->last_used + sysctl_tr_rif_timeout;
449
450                         if (time_before_eq(expires, jiffies)) {
451                                 *pentry = entry->next;
452                                 kfree(entry);
453                         } else {
454                                 pentry = &entry->next;
455
456                                 if (time_before(expires, next_interval))
457                                         next_interval = expires;
458                         }
459                 }
460         }
461
462         spin_unlock_irqrestore(&rif_lock, flags);
463
464         mod_timer(&rif_timer, next_interval);
465
466 }
467
468 /*
469  *      Generate the /proc/net information for the token ring RIF
470  *      routing.
471  */
472
473 #ifdef CONFIG_PROC_FS
474
475 static struct rif_cache *rif_get_idx(loff_t pos)
476 {
477         int i;
478         struct rif_cache *entry;
479         loff_t off = 0;
480
481         for(i = 0; i < RIF_TABLE_SIZE; i++)
482                 for(entry = rif_table[i]; entry; entry = entry->next) {
483                         if (off == pos)
484                                 return entry;
485                         ++off;
486                 }
487
488         return NULL;
489 }
490
491 static void *rif_seq_start(struct seq_file *seq, loff_t *pos)
492 {
493         spin_lock_irq(&rif_lock);
494
495         return *pos ? rif_get_idx(*pos - 1) : SEQ_START_TOKEN;
496 }
497
498 static void *rif_seq_next(struct seq_file *seq, void *v, loff_t *pos)
499 {
500         int i;
501         struct rif_cache *ent = v;
502
503         ++*pos;
504
505         if (v == SEQ_START_TOKEN) {
506                 i = -1;
507                 goto scan;
508         }
509
510         if (ent->next)
511                 return ent->next;
512
513         i = rif_hash(ent->addr);
514  scan:
515         while (++i < RIF_TABLE_SIZE) {
516                 if ((ent = rif_table[i]) != NULL)
517                         return ent;
518         }
519         return NULL;
520 }
521
522 static void rif_seq_stop(struct seq_file *seq, void *v)
523 {
524         spin_unlock_irq(&rif_lock);
525 }
526
527 static int rif_seq_show(struct seq_file *seq, void *v)
528 {
529         int j, rcf_len, segment, brdgnmb;
530         struct rif_cache *entry = v;
531
532         if (v == SEQ_START_TOKEN)
533                 seq_puts(seq,
534                      "if     TR address       TTL   rcf   routing segments\n");
535         else {
536                 struct net_device *dev = dev_get_by_index(&init_net, entry->iface);
537                 long ttl = (long) (entry->last_used + sysctl_tr_rif_timeout)
538                                 - (long) jiffies;
539
540                 seq_printf(seq, "%s %02X:%02X:%02X:%02X:%02X:%02X %7li ",
541                            dev?dev->name:"?",
542                            entry->addr[0],entry->addr[1],entry->addr[2],
543                            entry->addr[3],entry->addr[4],entry->addr[5],
544                            ttl/HZ);
545
546                         if (entry->local_ring)
547                                 seq_puts(seq, "local\n");
548                         else {
549
550                                 seq_printf(seq, "%04X", ntohs(entry->rcf));
551                                 rcf_len = ((ntohs(entry->rcf) & TR_RCF_LEN_MASK)>>8)-2;
552                                 if (rcf_len)
553                                         rcf_len >>= 1;
554                                 for(j = 1; j < rcf_len; j++) {
555                                         if(j==1) {
556                                                 segment=ntohs(entry->rseg[j-1])>>4;
557                                                 seq_printf(seq,"  %03X",segment);
558                                         }
559
560                                         segment=ntohs(entry->rseg[j])>>4;
561                                         brdgnmb=ntohs(entry->rseg[j-1])&0x00f;
562                                         seq_printf(seq,"-%01X-%03X",brdgnmb,segment);
563                                 }
564                                 seq_putc(seq, '\n');
565                         }
566                 }
567         return 0;
568 }
569
570
571 static const struct seq_operations rif_seq_ops = {
572         .start = rif_seq_start,
573         .next  = rif_seq_next,
574         .stop  = rif_seq_stop,
575         .show  = rif_seq_show,
576 };
577
578 static int rif_seq_open(struct inode *inode, struct file *file)
579 {
580         return seq_open(file, &rif_seq_ops);
581 }
582
583 static const struct file_operations rif_seq_fops = {
584         .owner   = THIS_MODULE,
585         .open    = rif_seq_open,
586         .read    = seq_read,
587         .llseek  = seq_lseek,
588         .release = seq_release,
589 };
590
591 #endif
592
593 static void tr_setup(struct net_device *dev)
594 {
595         /*
596          *      Configure and register
597          */
598
599         dev->hard_header        = tr_header;
600         dev->rebuild_header     = tr_rebuild_header;
601
602         dev->type               = ARPHRD_IEEE802_TR;
603         dev->hard_header_len    = TR_HLEN;
604         dev->mtu                = 2000;
605         dev->addr_len           = TR_ALEN;
606         dev->tx_queue_len       = 100;  /* Long queues on tr */
607
608         memset(dev->broadcast,0xFF, TR_ALEN);
609
610         /* New-style flags. */
611         dev->flags              = IFF_BROADCAST | IFF_MULTICAST ;
612 }
613
614 /**
615  * alloc_trdev - Register token ring device
616  * @sizeof_priv: Size of additional driver-private structure to be allocated
617  *      for this token ring device
618  *
619  * Fill in the fields of the device structure with token ring-generic values.
620  *
621  * Constructs a new net device, complete with a private data area of
622  * size @sizeof_priv.  A 32-byte (not bit) alignment is enforced for
623  * this private data area.
624  */
625 struct net_device *alloc_trdev(int sizeof_priv)
626 {
627         return alloc_netdev(sizeof_priv, "tr%d", tr_setup);
628 }
629
630 /*
631  *      Called during bootup.  We don't actually have to initialise
632  *      too much for this.
633  */
634
635 static int __init rif_init(void)
636 {
637         init_timer(&rif_timer);
638         rif_timer.expires  = sysctl_tr_rif_timeout;
639         rif_timer.data     = 0L;
640         rif_timer.function = rif_check_expire;
641         add_timer(&rif_timer);
642
643         proc_net_fops_create(&init_net, "tr_rif", S_IRUGO, &rif_seq_fops);
644         return 0;
645 }
646
647 module_init(rif_init);
648
649 EXPORT_SYMBOL(tr_type_trans);
650 EXPORT_SYMBOL(alloc_trdev);