1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Multicast support for IPv6
4 * Linux INET6 implementation
5 *
6 * Authors:
7 * Pedro Roque <roque@di.fc.ul.pt>
8 *
9 * Based on linux/ipv4/igmp.c and linux/ipv4/ip_sockglue.c
10 */
11
12 /* Changes:
13 *
14 * yoshfuji : fix format of router-alert option
15 * YOSHIFUJI Hideaki @USAGI:
16 * Fixed source address for MLD message based on
17 * <draft-ietf-magma-mld-source-05.txt>.
18 * YOSHIFUJI Hideaki @USAGI:
19 * - Ignore Queries for invalid addresses.
20 * - MLD for link-local addresses.
21 * David L Stevens <dlstevens@us.ibm.com>:
22 * - MLDv2 support
23 */
24
25 #include <linux/module.h>
26 #include <linux/errno.h>
27 #include <linux/types.h>
28 #include <linux/string.h>
29 #include <linux/socket.h>
30 #include <linux/sockios.h>
31 #include <linux/jiffies.h>
32 #include <linux/net.h>
33 #include <linux/in.h>
34 #include <linux/in6.h>
35 #include <linux/netdevice.h>
36 #include <linux/if_addr.h>
37 #include <linux/if_arp.h>
38 #include <linux/route.h>
39 #include <linux/rtnetlink.h>
40 #include <linux/init.h>
41 #include <linux/proc_fs.h>
42 #include <linux/seq_file.h>
43 #include <linux/slab.h>
44 #include <linux/pkt_sched.h>
45 #include <net/mld.h>
46 #include <linux/workqueue.h>
47
48 #include <linux/netfilter.h>
49 #include <linux/netfilter_ipv6.h>
50
51 #include <net/net_namespace.h>
52 #include <net/netlink.h>
53 #include <net/sock.h>
54 #include <net/snmp.h>
55
56 #include <net/ipv6.h>
57 #include <net/protocol.h>
58 #include <net/if_inet6.h>
59 #include <net/ndisc.h>
60 #include <net/addrconf.h>
61 #include <net/ip6_route.h>
62 #include <net/inet_common.h>
63
64 #include <net/ip6_checksum.h>
65
66 /* Ensure that we have struct in6_addr aligned on 32bit word. */
67 static int __mld2_query_bugs[] __attribute__((__unused__)) = {
68 BUILD_BUG_ON_ZERO(offsetof(struct mld2_query, mld2q_srcs) % 4),
69 BUILD_BUG_ON_ZERO(offsetof(struct mld2_report, mld2r_grec) % 4),
70 BUILD_BUG_ON_ZERO(offsetof(struct mld2_grec, grec_mca) % 4)
71 };
72
73 static struct workqueue_struct *mld_wq;
74 static struct in6_addr mld2_all_mcr = MLD2_ALL_MCR_INIT;
75
76 static void igmp6_join_group(struct ifmcaddr6 *ma);
77 static void igmp6_leave_group(struct ifmcaddr6 *ma);
78 static void mld_mca_work(struct work_struct *work);
79
80 static void mld_ifc_event(struct inet6_dev *idev);
81 static bool mld_in_v1_mode(const struct inet6_dev *idev);
82 static int sf_setstate(struct ifmcaddr6 *pmc);
83 static void sf_markstate(struct ifmcaddr6 *pmc);
84 static void ip6_mc_clear_src(struct ifmcaddr6 *pmc);
85 static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
86 int sfmode, int sfcount, const struct in6_addr *psfsrc,
87 int delta);
88 static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
89 int sfmode, int sfcount, const struct in6_addr *psfsrc,
90 int delta);
91 static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
92 struct inet6_dev *idev);
93 static int __ipv6_dev_mc_inc(struct net_device *dev,
94 const struct in6_addr *addr, unsigned int mode);
95
96 #define MLD_QRV_DEFAULT 2
97 /* RFC3810, 9.2. Query Interval */
98 #define MLD_QI_DEFAULT (125 * HZ)
99 /* RFC3810, 9.3. Query Response Interval */
100 #define MLD_QRI_DEFAULT (10 * HZ)
101
102 /* RFC3810, 8.1 Query Version Distinctions */
103 #define MLD_V1_QUERY_LEN 24
104 #define MLD_V2_QUERY_LEN_MIN 28
105
106 #define IPV6_MLD_MAX_MSF 64
107
108 int sysctl_mld_max_msf __read_mostly = IPV6_MLD_MAX_MSF;
109 int sysctl_mld_qrv __read_mostly = MLD_QRV_DEFAULT;
110
111 #define mc_assert_locked(idev) \
112 lockdep_assert_held(&(idev)->mc_lock)
113
114 #define mc_dereference(e, idev) \
115 rcu_dereference_protected(e, lockdep_is_held(&(idev)->mc_lock))
116
117 #define sock_dereference(e, sk) \
118 rcu_dereference_protected(e, lockdep_sock_is_held(sk))
119
120 #define for_each_pmc_socklock(np, sk, pmc) \
121 for (pmc = sock_dereference((np)->ipv6_mc_list, sk); \
122 pmc; \
123 pmc = sock_dereference(pmc->next, sk))
124
125 #define for_each_pmc_rcu(np, pmc) \
126 for (pmc = rcu_dereference((np)->ipv6_mc_list); \
127 pmc; \
128 pmc = rcu_dereference(pmc->next))
129
130 #define for_each_psf_mclock(mc, psf) \
131 for (psf = mc_dereference((mc)->mca_sources, mc->idev); \
132 psf; \
133 psf = mc_dereference(psf->sf_next, mc->idev))
134
135 #define for_each_psf_rcu(mc, psf) \
136 for (psf = rcu_dereference((mc)->mca_sources); \
137 psf; \
138 psf = rcu_dereference(psf->sf_next))
139
140 #define for_each_psf_tomb(mc, psf) \
141 for (psf = mc_dereference((mc)->mca_tomb, mc->idev); \
142 psf; \
143 psf = mc_dereference(psf->sf_next, mc->idev))
144
145 #define for_each_mc_mclock(idev, mc) \
146 for (mc = mc_dereference((idev)->mc_list, idev); \
147 mc; \
148 mc = mc_dereference(mc->next, idev))
149
150 #define for_each_mc_rcu(idev, mc) \
151 for (mc = rcu_dereference((idev)->mc_list); \
152 mc; \
153 mc = rcu_dereference(mc->next))
154
155 #define for_each_mc_tomb(idev, mc) \
156 for (mc = mc_dereference((idev)->mc_tomb, idev); \
157 mc; \
158 mc = mc_dereference(mc->next, idev))
159
unsolicited_report_interval(struct inet6_dev * idev)160 static int unsolicited_report_interval(struct inet6_dev *idev)
161 {
162 int iv;
163
164 if (mld_in_v1_mode(idev))
165 iv = READ_ONCE(idev->cnf.mldv1_unsolicited_report_interval);
166 else
167 iv = READ_ONCE(idev->cnf.mldv2_unsolicited_report_interval);
168
169 return iv > 0 ? iv : 1;
170 }
171
ip6_mc_find_dev(struct net * net,const struct in6_addr * group,int ifindex)172 static struct net_device *ip6_mc_find_dev(struct net *net,
173 const struct in6_addr *group,
174 int ifindex)
175 {
176 struct net_device *dev = NULL;
177 struct rt6_info *rt;
178
179 if (ifindex == 0) {
180 rcu_read_lock();
181 rt = rt6_lookup(net, group, NULL, 0, NULL, 0);
182 if (rt) {
183 dev = dst_dev_rcu(&rt->dst);
184 dev_hold(dev);
185 ip6_rt_put(rt);
186 }
187 rcu_read_unlock();
188 } else {
189 dev = dev_get_by_index(net, ifindex);
190 }
191
192 return dev;
193 }
194
195 /*
196 * socket join on multicast group
197 */
__ipv6_sock_mc_join(struct sock * sk,int ifindex,const struct in6_addr * addr,unsigned int mode)198 static int __ipv6_sock_mc_join(struct sock *sk, int ifindex,
199 const struct in6_addr *addr, unsigned int mode)
200 {
201 struct ipv6_pinfo *np = inet6_sk(sk);
202 struct ipv6_mc_socklist *mc_lst;
203 struct net *net = sock_net(sk);
204 struct net_device *dev = NULL;
205 int err;
206
207 if (!ipv6_addr_is_multicast(addr))
208 return -EINVAL;
209
210 for_each_pmc_socklock(np, sk, mc_lst) {
211 if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
212 ipv6_addr_equal(&mc_lst->addr, addr))
213 return -EADDRINUSE;
214 }
215
216 mc_lst = sock_kmalloc(sk, sizeof(struct ipv6_mc_socklist), GFP_KERNEL);
217 if (!mc_lst)
218 return -ENOMEM;
219
220 mc_lst->next = NULL;
221 mc_lst->addr = *addr;
222
223 dev = ip6_mc_find_dev(net, addr, ifindex);
224 if (!dev) {
225 sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
226 return -ENODEV;
227 }
228
229 mc_lst->ifindex = dev->ifindex;
230 mc_lst->sfmode = mode;
231 RCU_INIT_POINTER(mc_lst->sflist, NULL);
232
233 /* now add/increase the group membership on the device */
234 err = __ipv6_dev_mc_inc(dev, addr, mode);
235
236 dev_put(dev);
237
238 if (err) {
239 sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
240 return err;
241 }
242
243 mc_lst->next = np->ipv6_mc_list;
244 rcu_assign_pointer(np->ipv6_mc_list, mc_lst);
245
246 return 0;
247 }
248
ipv6_sock_mc_join(struct sock * sk,int ifindex,const struct in6_addr * addr)249 int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
250 {
251 return __ipv6_sock_mc_join(sk, ifindex, addr, MCAST_EXCLUDE);
252 }
253 EXPORT_SYMBOL(ipv6_sock_mc_join);
254
ipv6_sock_mc_join_ssm(struct sock * sk,int ifindex,const struct in6_addr * addr,unsigned int mode)255 int ipv6_sock_mc_join_ssm(struct sock *sk, int ifindex,
256 const struct in6_addr *addr, unsigned int mode)
257 {
258 return __ipv6_sock_mc_join(sk, ifindex, addr, mode);
259 }
260
261 /*
262 * socket leave on multicast group
263 */
__ipv6_sock_mc_drop(struct sock * sk,struct ipv6_mc_socklist * mc_lst)264 static void __ipv6_sock_mc_drop(struct sock *sk, struct ipv6_mc_socklist *mc_lst)
265 {
266 struct net *net = sock_net(sk);
267 struct net_device *dev;
268
269 dev = dev_get_by_index(net, mc_lst->ifindex);
270 if (dev) {
271 struct inet6_dev *idev = in6_dev_get(dev);
272
273 ip6_mc_leave_src(sk, mc_lst, idev);
274
275 if (idev) {
276 __ipv6_dev_mc_dec(idev, &mc_lst->addr);
277 in6_dev_put(idev);
278 }
279
280 dev_put(dev);
281 } else {
282 ip6_mc_leave_src(sk, mc_lst, NULL);
283 }
284
285 atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);
286 kfree_rcu(mc_lst, rcu);
287 }
288
ipv6_sock_mc_drop(struct sock * sk,int ifindex,const struct in6_addr * addr)289 int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
290 {
291 struct ipv6_pinfo *np = inet6_sk(sk);
292 struct ipv6_mc_socklist __rcu **lnk;
293 struct ipv6_mc_socklist *mc_lst;
294
295 if (!ipv6_addr_is_multicast(addr))
296 return -EINVAL;
297
298 for (lnk = &np->ipv6_mc_list;
299 (mc_lst = sock_dereference(*lnk, sk)) != NULL;
300 lnk = &mc_lst->next) {
301 if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
302 ipv6_addr_equal(&mc_lst->addr, addr)) {
303 *lnk = mc_lst->next;
304 __ipv6_sock_mc_drop(sk, mc_lst);
305 return 0;
306 }
307 }
308
309 return -EADDRNOTAVAIL;
310 }
311 EXPORT_SYMBOL(ipv6_sock_mc_drop);
312
ip6_mc_find_idev(struct net * net,const struct in6_addr * group,int ifindex)313 static struct inet6_dev *ip6_mc_find_idev(struct net *net,
314 const struct in6_addr *group,
315 int ifindex)
316 {
317 struct net_device *dev;
318 struct inet6_dev *idev;
319
320 dev = ip6_mc_find_dev(net, group, ifindex);
321 if (!dev)
322 return NULL;
323
324 idev = in6_dev_get(dev);
325 dev_put(dev);
326
327 return idev;
328 }
329
__ipv6_sock_mc_close(struct sock * sk)330 void __ipv6_sock_mc_close(struct sock *sk)
331 {
332 struct ipv6_pinfo *np = inet6_sk(sk);
333 struct ipv6_mc_socklist *mc_lst;
334
335 while ((mc_lst = sock_dereference(np->ipv6_mc_list, sk)) != NULL) {
336 np->ipv6_mc_list = mc_lst->next;
337 __ipv6_sock_mc_drop(sk, mc_lst);
338 }
339 }
340
ipv6_sock_mc_close(struct sock * sk)341 void ipv6_sock_mc_close(struct sock *sk)
342 {
343 struct ipv6_pinfo *np = inet6_sk(sk);
344
345 if (!rcu_access_pointer(np->ipv6_mc_list))
346 return;
347
348 lock_sock(sk);
349 __ipv6_sock_mc_close(sk);
350 release_sock(sk);
351 }
352
ip6_mc_source(int add,int omode,struct sock * sk,struct group_source_req * pgsr)353 int ip6_mc_source(int add, int omode, struct sock *sk,
354 struct group_source_req *pgsr)
355 {
356 struct ipv6_pinfo *inet6 = inet6_sk(sk);
357 struct in6_addr *source, *group;
358 struct net *net = sock_net(sk);
359 struct ipv6_mc_socklist *pmc;
360 struct ip6_sf_socklist *psl;
361 struct inet6_dev *idev;
362 int leavegroup = 0;
363 int i, j, rv;
364 int err;
365
366 source = &((struct sockaddr_in6 *)&pgsr->gsr_source)->sin6_addr;
367 group = &((struct sockaddr_in6 *)&pgsr->gsr_group)->sin6_addr;
368
369 if (!ipv6_addr_is_multicast(group))
370 return -EINVAL;
371
372 idev = ip6_mc_find_idev(net, group, pgsr->gsr_interface);
373 if (!idev)
374 return -ENODEV;
375
376 mutex_lock(&idev->mc_lock);
377
378 if (idev->dead) {
379 err = -ENODEV;
380 goto done;
381 }
382
383 err = -EADDRNOTAVAIL;
384
385 for_each_pmc_socklock(inet6, sk, pmc) {
386 if (pgsr->gsr_interface && pmc->ifindex != pgsr->gsr_interface)
387 continue;
388 if (ipv6_addr_equal(&pmc->addr, group))
389 break;
390 }
391 if (!pmc) { /* must have a prior join */
392 err = -EINVAL;
393 goto done;
394 }
395 /* if a source filter was set, must be the same mode as before */
396 if (rcu_access_pointer(pmc->sflist)) {
397 if (pmc->sfmode != omode) {
398 err = -EINVAL;
399 goto done;
400 }
401 } else if (pmc->sfmode != omode) {
402 /* allow mode switches for empty-set filters */
403 ip6_mc_add_src(idev, group, omode, 0, NULL, 0);
404 ip6_mc_del_src(idev, group, pmc->sfmode, 0, NULL, 0);
405 pmc->sfmode = omode;
406 }
407
408 psl = sock_dereference(pmc->sflist, sk);
409 if (!add) {
410 if (!psl)
411 goto done; /* err = -EADDRNOTAVAIL */
412 rv = !0;
413 for (i = 0; i < psl->sl_count; i++) {
414 rv = !ipv6_addr_equal(&psl->sl_addr[i], source);
415 if (rv == 0)
416 break;
417 }
418 if (rv) /* source not found */
419 goto done; /* err = -EADDRNOTAVAIL */
420
421 /* special case - (INCLUDE, empty) == LEAVE_GROUP */
422 if (psl->sl_count == 1 && omode == MCAST_INCLUDE) {
423 leavegroup = 1;
424 goto done;
425 }
426
427 /* update the interface filter */
428 ip6_mc_del_src(idev, group, omode, 1, source, 1);
429
430 for (j = i+1; j < psl->sl_count; j++)
431 psl->sl_addr[j-1] = psl->sl_addr[j];
432 psl->sl_count--;
433 err = 0;
434 goto done;
435 }
436 /* else, add a new source to the filter */
437
438 if (psl && psl->sl_count >= sysctl_mld_max_msf) {
439 err = -ENOBUFS;
440 goto done;
441 }
442 if (!psl || psl->sl_count == psl->sl_max) {
443 struct ip6_sf_socklist *newpsl;
444 int count = IP6_SFBLOCK;
445
446 if (psl)
447 count += psl->sl_max;
448 newpsl = sock_kmalloc(sk, struct_size(newpsl, sl_addr, count),
449 GFP_KERNEL);
450 if (!newpsl) {
451 err = -ENOBUFS;
452 goto done;
453 }
454 newpsl->sl_max = count;
455 newpsl->sl_count = count - IP6_SFBLOCK;
456 if (psl) {
457 for (i = 0; i < psl->sl_count; i++)
458 newpsl->sl_addr[i] = psl->sl_addr[i];
459 atomic_sub(struct_size(psl, sl_addr, psl->sl_max),
460 &sk->sk_omem_alloc);
461 }
462 rcu_assign_pointer(pmc->sflist, newpsl);
463 kfree_rcu(psl, rcu);
464 psl = newpsl;
465 }
466 rv = 1; /* > 0 for insert logic below if sl_count is 0 */
467 for (i = 0; i < psl->sl_count; i++) {
468 rv = !ipv6_addr_equal(&psl->sl_addr[i], source);
469 if (rv == 0) /* There is an error in the address. */
470 goto done;
471 }
472 for (j = psl->sl_count-1; j >= i; j--)
473 psl->sl_addr[j+1] = psl->sl_addr[j];
474 psl->sl_addr[i] = *source;
475 psl->sl_count++;
476 err = 0;
477 /* update the interface list */
478 ip6_mc_add_src(idev, group, omode, 1, source, 1);
479 done:
480 mutex_unlock(&idev->mc_lock);
481 in6_dev_put(idev);
482 if (leavegroup)
483 err = ipv6_sock_mc_drop(sk, pgsr->gsr_interface, group);
484 return err;
485 }
486
ip6_mc_msfilter(struct sock * sk,struct group_filter * gsf,struct sockaddr_storage * list)487 int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf,
488 struct sockaddr_storage *list)
489 {
490 struct ipv6_pinfo *inet6 = inet6_sk(sk);
491 struct ip6_sf_socklist *newpsl, *psl;
492 struct net *net = sock_net(sk);
493 const struct in6_addr *group;
494 struct ipv6_mc_socklist *pmc;
495 struct inet6_dev *idev;
496 int leavegroup = 0;
497 int i, err;
498
499 group = &((struct sockaddr_in6 *)&gsf->gf_group)->sin6_addr;
500
501 if (!ipv6_addr_is_multicast(group))
502 return -EINVAL;
503 if (gsf->gf_fmode != MCAST_INCLUDE &&
504 gsf->gf_fmode != MCAST_EXCLUDE)
505 return -EINVAL;
506
507 idev = ip6_mc_find_idev(net, group, gsf->gf_interface);
508 if (!idev)
509 return -ENODEV;
510
511 mutex_lock(&idev->mc_lock);
512
513 if (idev->dead) {
514 err = -ENODEV;
515 goto done;
516 }
517
518 err = 0;
519
520 if (gsf->gf_fmode == MCAST_INCLUDE && gsf->gf_numsrc == 0) {
521 leavegroup = 1;
522 goto done;
523 }
524
525 for_each_pmc_socklock(inet6, sk, pmc) {
526 if (pmc->ifindex != gsf->gf_interface)
527 continue;
528 if (ipv6_addr_equal(&pmc->addr, group))
529 break;
530 }
531 if (!pmc) { /* must have a prior join */
532 err = -EINVAL;
533 goto done;
534 }
535 if (gsf->gf_numsrc) {
536 newpsl = sock_kmalloc(sk, struct_size(newpsl, sl_addr,
537 gsf->gf_numsrc),
538 GFP_KERNEL);
539 if (!newpsl) {
540 err = -ENOBUFS;
541 goto done;
542 }
543 newpsl->sl_max = newpsl->sl_count = gsf->gf_numsrc;
544 for (i = 0; i < newpsl->sl_count; ++i, ++list) {
545 struct sockaddr_in6 *psin6;
546
547 psin6 = (struct sockaddr_in6 *)list;
548 newpsl->sl_addr[i] = psin6->sin6_addr;
549 }
550
551 err = ip6_mc_add_src(idev, group, gsf->gf_fmode,
552 newpsl->sl_count, newpsl->sl_addr, 0);
553 if (err) {
554 sock_kfree_s(sk, newpsl, struct_size(newpsl, sl_addr,
555 newpsl->sl_max));
556 goto done;
557 }
558 } else {
559 newpsl = NULL;
560 ip6_mc_add_src(idev, group, gsf->gf_fmode, 0, NULL, 0);
561 }
562
563 psl = sock_dereference(pmc->sflist, sk);
564 if (psl) {
565 ip6_mc_del_src(idev, group, pmc->sfmode,
566 psl->sl_count, psl->sl_addr, 0);
567 atomic_sub(struct_size(psl, sl_addr, psl->sl_max),
568 &sk->sk_omem_alloc);
569 } else {
570 ip6_mc_del_src(idev, group, pmc->sfmode, 0, NULL, 0);
571 }
572
573 rcu_assign_pointer(pmc->sflist, newpsl);
574 kfree_rcu(psl, rcu);
575 pmc->sfmode = gsf->gf_fmode;
576 err = 0;
577 done:
578 mutex_unlock(&idev->mc_lock);
579 in6_dev_put(idev);
580 if (leavegroup)
581 err = ipv6_sock_mc_drop(sk, gsf->gf_interface, group);
582 return err;
583 }
584
ip6_mc_msfget(struct sock * sk,struct group_filter * gsf,sockptr_t optval,size_t ss_offset)585 int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
586 sockptr_t optval, size_t ss_offset)
587 {
588 struct ipv6_pinfo *inet6 = inet6_sk(sk);
589 const struct in6_addr *group;
590 struct ipv6_mc_socklist *pmc;
591 struct ip6_sf_socklist *psl;
592 unsigned int count;
593 int i, copycount;
594
595 group = &((struct sockaddr_in6 *)&gsf->gf_group)->sin6_addr;
596
597 if (!ipv6_addr_is_multicast(group))
598 return -EINVAL;
599
600 for_each_pmc_socklock(inet6, sk, pmc) {
601 if (pmc->ifindex != gsf->gf_interface)
602 continue;
603 if (ipv6_addr_equal(group, &pmc->addr))
604 break;
605 }
606 if (!pmc) /* must have a prior join */
607 return -EADDRNOTAVAIL;
608
609 gsf->gf_fmode = pmc->sfmode;
610 psl = sock_dereference(pmc->sflist, sk);
611 count = psl ? psl->sl_count : 0;
612
613 copycount = min(count, gsf->gf_numsrc);
614 gsf->gf_numsrc = count;
615 for (i = 0; i < copycount; i++) {
616 struct sockaddr_in6 *psin6;
617 struct sockaddr_storage ss;
618
619 psin6 = (struct sockaddr_in6 *)&ss;
620 memset(&ss, 0, sizeof(ss));
621 psin6->sin6_family = AF_INET6;
622 psin6->sin6_addr = psl->sl_addr[i];
623 if (copy_to_sockptr_offset(optval, ss_offset, &ss, sizeof(ss)))
624 return -EFAULT;
625 ss_offset += sizeof(ss);
626 }
627 return 0;
628 }
629
inet6_mc_check(const struct sock * sk,const struct in6_addr * mc_addr,const struct in6_addr * src_addr)630 bool inet6_mc_check(const struct sock *sk, const struct in6_addr *mc_addr,
631 const struct in6_addr *src_addr)
632 {
633 const struct ipv6_pinfo *np = inet6_sk(sk);
634 const struct ipv6_mc_socklist *mc;
635 const struct ip6_sf_socklist *psl;
636 bool rv = true;
637
638 rcu_read_lock();
639 for_each_pmc_rcu(np, mc) {
640 if (ipv6_addr_equal(&mc->addr, mc_addr))
641 break;
642 }
643 if (!mc) {
644 rcu_read_unlock();
645 return inet6_test_bit(MC6_ALL, sk);
646 }
647 psl = rcu_dereference(mc->sflist);
648 if (!psl) {
649 rv = mc->sfmode == MCAST_EXCLUDE;
650 } else {
651 int i;
652
653 for (i = 0; i < psl->sl_count; i++) {
654 if (ipv6_addr_equal(&psl->sl_addr[i], src_addr))
655 break;
656 }
657 if (mc->sfmode == MCAST_INCLUDE && i >= psl->sl_count)
658 rv = false;
659 if (mc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
660 rv = false;
661 }
662 rcu_read_unlock();
663
664 return rv;
665 }
666
igmp6_group_added(struct ifmcaddr6 * mc)667 static void igmp6_group_added(struct ifmcaddr6 *mc)
668 {
669 struct net_device *dev = mc->idev->dev;
670 char buf[MAX_ADDR_LEN];
671
672 mc_assert_locked(mc->idev);
673
674 if (IPV6_ADDR_MC_SCOPE(&mc->mca_addr) <
675 IPV6_ADDR_SCOPE_LINKLOCAL)
676 return;
677
678 if (!(mc->mca_flags&MAF_LOADED)) {
679 WRITE_ONCE(mc->mca_flags, mc->mca_flags | MAF_LOADED);
680 if (ndisc_mc_map(&mc->mca_addr, buf, dev, 0) == 0)
681 dev_mc_add(dev, buf);
682 }
683
684 if (!(dev->flags & IFF_UP) || (mc->mca_flags & MAF_NOREPORT))
685 return;
686
687 if (mld_in_v1_mode(mc->idev)) {
688 igmp6_join_group(mc);
689 return;
690 }
691 /* else v2 */
692
693 /* Based on RFC3810 6.1, for newly added INCLUDE SSM, we
694 * should not send filter-mode change record as the mode
695 * should be from IN() to IN(A).
696 */
697 if (mc->mca_sfmode == MCAST_EXCLUDE)
698 mc->mca_crcount = mc->idev->mc_qrv;
699
700 mld_ifc_event(mc->idev);
701 }
702
igmp6_group_dropped(struct ifmcaddr6 * mc)703 static void igmp6_group_dropped(struct ifmcaddr6 *mc)
704 {
705 struct net_device *dev = mc->idev->dev;
706 char buf[MAX_ADDR_LEN];
707
708 mc_assert_locked(mc->idev);
709
710 if (IPV6_ADDR_MC_SCOPE(&mc->mca_addr) <
711 IPV6_ADDR_SCOPE_LINKLOCAL)
712 return;
713
714 if (mc->mca_flags&MAF_LOADED) {
715 WRITE_ONCE(mc->mca_flags, mc->mca_flags & ~MAF_LOADED);
716 if (ndisc_mc_map(&mc->mca_addr, buf, dev, 0) == 0)
717 dev_mc_del(dev, buf);
718 }
719
720 if (mc->mca_flags & MAF_NOREPORT)
721 return;
722
723 if (!mc->idev->dead)
724 igmp6_leave_group(mc);
725
726 if (cancel_delayed_work(&mc->mca_work))
727 refcount_dec(&mc->mca_refcnt);
728 }
729
730 /* deleted ifmcaddr6 manipulation */
mld_add_delrec(struct inet6_dev * idev,struct ifmcaddr6 * im)731 static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
732 {
733 struct ifmcaddr6 *pmc;
734
735 mc_assert_locked(idev);
736
737 /* this is an "ifmcaddr6" for convenience; only the fields below
738 * are actually used. In particular, the refcnt and users are not
739 * used for management of the delete list. Using the same structure
740 * for deleted items allows change reports to use common code with
741 * non-deleted or query-response MCA's.
742 */
743 pmc = kzalloc_obj(*pmc);
744 if (!pmc)
745 return;
746
747 pmc->idev = im->idev;
748 in6_dev_hold(idev);
749 pmc->mca_addr = im->mca_addr;
750 pmc->mca_crcount = idev->mc_qrv;
751 pmc->mca_sfmode = im->mca_sfmode;
752 if (pmc->mca_sfmode == MCAST_INCLUDE) {
753 struct ip6_sf_list *psf;
754
755 rcu_assign_pointer(pmc->mca_tomb,
756 mc_dereference(im->mca_tomb, idev));
757 rcu_assign_pointer(pmc->mca_sources,
758 mc_dereference(im->mca_sources, idev));
759 RCU_INIT_POINTER(im->mca_tomb, NULL);
760 RCU_INIT_POINTER(im->mca_sources, NULL);
761
762 for_each_psf_mclock(pmc, psf)
763 psf->sf_crcount = pmc->mca_crcount;
764 }
765
766 rcu_assign_pointer(pmc->next, idev->mc_tomb);
767 rcu_assign_pointer(idev->mc_tomb, pmc);
768 }
769
mld_del_delrec(struct inet6_dev * idev,struct ifmcaddr6 * im)770 static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
771 {
772 struct ip6_sf_list *psf, *sources, *tomb;
773 struct in6_addr *pmca = &im->mca_addr;
774 struct ifmcaddr6 *pmc, *pmc_prev;
775
776 mc_assert_locked(idev);
777
778 pmc_prev = NULL;
779 for_each_mc_tomb(idev, pmc) {
780 if (ipv6_addr_equal(&pmc->mca_addr, pmca))
781 break;
782 pmc_prev = pmc;
783 }
784 if (!pmc)
785 return;
786 if (pmc_prev)
787 rcu_assign_pointer(pmc_prev->next, pmc->next);
788 else
789 rcu_assign_pointer(idev->mc_tomb, pmc->next);
790
791 im->idev = pmc->idev;
792 if (im->mca_sfmode == MCAST_INCLUDE) {
793 tomb = rcu_replace_pointer(im->mca_tomb,
794 mc_dereference(pmc->mca_tomb, pmc->idev),
795 lockdep_is_held(&im->idev->mc_lock));
796 rcu_assign_pointer(pmc->mca_tomb, tomb);
797
798 sources = rcu_replace_pointer(im->mca_sources,
799 mc_dereference(pmc->mca_sources, pmc->idev),
800 lockdep_is_held(&im->idev->mc_lock));
801 rcu_assign_pointer(pmc->mca_sources, sources);
802 for_each_psf_mclock(im, psf)
803 psf->sf_crcount = idev->mc_qrv;
804 } else {
805 im->mca_crcount = idev->mc_qrv;
806 }
807 ip6_mc_clear_src(pmc);
808 in6_dev_put(pmc->idev);
809 kfree_rcu(pmc, rcu);
810 }
811
mld_clear_delrec(struct inet6_dev * idev)812 static void mld_clear_delrec(struct inet6_dev *idev)
813 {
814 struct ifmcaddr6 *pmc, *nextpmc;
815
816 mc_assert_locked(idev);
817
818 pmc = mc_dereference(idev->mc_tomb, idev);
819 RCU_INIT_POINTER(idev->mc_tomb, NULL);
820
821 for (; pmc; pmc = nextpmc) {
822 nextpmc = mc_dereference(pmc->next, idev);
823 ip6_mc_clear_src(pmc);
824 in6_dev_put(pmc->idev);
825 kfree_rcu(pmc, rcu);
826 }
827
828 /* clear dead sources, too */
829 for_each_mc_mclock(idev, pmc) {
830 struct ip6_sf_list *psf, *psf_next;
831
832 psf = mc_dereference(pmc->mca_tomb, idev);
833 RCU_INIT_POINTER(pmc->mca_tomb, NULL);
834 for (; psf; psf = psf_next) {
835 psf_next = mc_dereference(psf->sf_next, idev);
836 kfree_rcu(psf, rcu);
837 }
838 }
839 }
840
mld_clear_query(struct inet6_dev * idev)841 static void mld_clear_query(struct inet6_dev *idev)
842 {
843 spin_lock_bh(&idev->mc_query_lock);
844 __skb_queue_purge(&idev->mc_query_queue);
845 spin_unlock_bh(&idev->mc_query_lock);
846 }
847
mld_clear_report(struct inet6_dev * idev)848 static void mld_clear_report(struct inet6_dev *idev)
849 {
850 spin_lock_bh(&idev->mc_report_lock);
851 __skb_queue_purge(&idev->mc_report_queue);
852 spin_unlock_bh(&idev->mc_report_lock);
853 }
854
ma_put(struct ifmcaddr6 * mc)855 static void ma_put(struct ifmcaddr6 *mc)
856 {
857 if (refcount_dec_and_test(&mc->mca_refcnt)) {
858 in6_dev_put(mc->idev);
859 kfree_rcu(mc, rcu);
860 }
861 }
862
mca_alloc(struct inet6_dev * idev,const struct in6_addr * addr,unsigned int mode)863 static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev,
864 const struct in6_addr *addr,
865 unsigned int mode)
866 {
867 struct ifmcaddr6 *mc;
868
869 mc_assert_locked(idev);
870
871 mc = kzalloc_obj(*mc);
872 if (!mc)
873 return NULL;
874
875 INIT_DELAYED_WORK(&mc->mca_work, mld_mca_work);
876
877 mc->mca_addr = *addr;
878 mc->idev = idev; /* reference taken by caller */
879 WRITE_ONCE(mc->mca_users, 1);
880 /* mca_stamp should be updated upon changes */
881 mc->mca_cstamp = mc->mca_tstamp = jiffies;
882 refcount_set(&mc->mca_refcnt, 1);
883
884 mc->mca_sfmode = mode;
885 mc->mca_sfcount[mode] = 1;
886
887 if (ipv6_addr_is_ll_all_nodes(&mc->mca_addr) ||
888 IPV6_ADDR_MC_SCOPE(&mc->mca_addr) < IPV6_ADDR_SCOPE_LINKLOCAL)
889 WRITE_ONCE(mc->mca_flags, mc->mca_flags | MAF_NOREPORT);
890
891 return mc;
892 }
893
inet6_ifmcaddr_notify(struct net_device * dev,const struct ifmcaddr6 * ifmca,int event)894 static void inet6_ifmcaddr_notify(struct net_device *dev,
895 const struct ifmcaddr6 *ifmca, int event)
896 {
897 struct inet6_fill_args fillargs = {
898 .portid = 0,
899 .seq = 0,
900 .event = event,
901 .flags = 0,
902 .netnsid = -1,
903 .force_rt_scope_universe = true,
904 };
905 struct net *net = dev_net(dev);
906 struct sk_buff *skb;
907 int err = -ENOMEM;
908
909 skb = nlmsg_new(NLMSG_ALIGN(sizeof(struct ifaddrmsg)) +
910 nla_total_size(sizeof(struct in6_addr)) +
911 nla_total_size(sizeof(u32)) +
912 nla_total_size(sizeof(struct ifa_cacheinfo)),
913 GFP_KERNEL);
914 if (!skb)
915 goto error;
916
917 err = inet6_fill_ifmcaddr(skb, ifmca, &fillargs);
918 if (err < 0) {
919 WARN_ON_ONCE(err == -EMSGSIZE);
920 nlmsg_free(skb);
921 goto error;
922 }
923
924 rtnl_notify(skb, net, 0, RTNLGRP_IPV6_MCADDR, NULL, GFP_KERNEL);
925 return;
926 error:
927 rtnl_set_sk_err(net, RTNLGRP_IPV6_MCADDR, err);
928 }
929
930 /*
931 * device multicast group inc (add if not found)
932 */
__ipv6_dev_mc_inc(struct net_device * dev,const struct in6_addr * addr,unsigned int mode)933 static int __ipv6_dev_mc_inc(struct net_device *dev,
934 const struct in6_addr *addr, unsigned int mode)
935 {
936 struct inet6_dev *idev;
937 struct ifmcaddr6 *mc;
938
939 /* we need to take a reference on idev */
940 idev = in6_dev_get(dev);
941 if (!idev)
942 return -EINVAL;
943
944 mutex_lock(&idev->mc_lock);
945
946 if (READ_ONCE(idev->dead)) {
947 mutex_unlock(&idev->mc_lock);
948 in6_dev_put(idev);
949 return -ENODEV;
950 }
951
952 for_each_mc_mclock(idev, mc) {
953 if (ipv6_addr_equal(&mc->mca_addr, addr)) {
954 WRITE_ONCE(mc->mca_users, mc->mca_users + 1);
955 ip6_mc_add_src(idev, &mc->mca_addr, mode, 0, NULL, 0);
956 mutex_unlock(&idev->mc_lock);
957 in6_dev_put(idev);
958 return 0;
959 }
960 }
961
962 mc = mca_alloc(idev, addr, mode);
963 if (!mc) {
964 mutex_unlock(&idev->mc_lock);
965 in6_dev_put(idev);
966 return -ENOMEM;
967 }
968
969 rcu_assign_pointer(mc->next, idev->mc_list);
970 rcu_assign_pointer(idev->mc_list, mc);
971
972 mld_del_delrec(idev, mc);
973 igmp6_group_added(mc);
974 inet6_ifmcaddr_notify(dev, mc, RTM_NEWMULTICAST);
975 mutex_unlock(&idev->mc_lock);
976
977 return 0;
978 }
979
ipv6_dev_mc_inc(struct net_device * dev,const struct in6_addr * addr)980 int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)
981 {
982 return __ipv6_dev_mc_inc(dev, addr, MCAST_EXCLUDE);
983 }
984 EXPORT_SYMBOL(ipv6_dev_mc_inc);
985
986 /*
987 * device multicast group del
988 */
__ipv6_dev_mc_dec(struct inet6_dev * idev,const struct in6_addr * addr)989 int __ipv6_dev_mc_dec(struct inet6_dev *idev, const struct in6_addr *addr)
990 {
991 struct ifmcaddr6 *ma, __rcu **map;
992
993 mutex_lock(&idev->mc_lock);
994
995 for (map = &idev->mc_list;
996 (ma = mc_dereference(*map, idev));
997 map = &ma->next) {
998 if (ipv6_addr_equal(&ma->mca_addr, addr)) {
999 int new_users = ma->mca_users - 1;
1000
1001 WRITE_ONCE(ma->mca_users, new_users);
1002 if (new_users == 0) {
1003 *map = ma->next;
1004
1005 igmp6_group_dropped(ma);
1006 inet6_ifmcaddr_notify(idev->dev, ma,
1007 RTM_DELMULTICAST);
1008 ip6_mc_clear_src(ma);
1009 mutex_unlock(&idev->mc_lock);
1010
1011 ma_put(ma);
1012 return 0;
1013 }
1014 mutex_unlock(&idev->mc_lock);
1015 return 0;
1016 }
1017 }
1018
1019 mutex_unlock(&idev->mc_lock);
1020 return -ENOENT;
1021 }
1022
ipv6_dev_mc_dec(struct net_device * dev,const struct in6_addr * addr)1023 int ipv6_dev_mc_dec(struct net_device *dev, const struct in6_addr *addr)
1024 {
1025 struct inet6_dev *idev;
1026 int err;
1027
1028 idev = in6_dev_get(dev);
1029 if (!idev)
1030 return -ENODEV;
1031
1032 err = __ipv6_dev_mc_dec(idev, addr);
1033 in6_dev_put(idev);
1034
1035 return err;
1036 }
1037 EXPORT_SYMBOL(ipv6_dev_mc_dec);
1038
1039 /*
1040 * check if the interface/address pair is valid
1041 */
ipv6_chk_mcast_addr(struct net_device * dev,const struct in6_addr * group,const struct in6_addr * src_addr)1042 bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
1043 const struct in6_addr *src_addr)
1044 {
1045 struct inet6_dev *idev;
1046 struct ifmcaddr6 *mc;
1047 bool rv = false;
1048
1049 rcu_read_lock();
1050 idev = __in6_dev_get(dev);
1051 if (!idev)
1052 goto unlock;
1053 for_each_mc_rcu(idev, mc) {
1054 if (ipv6_addr_equal(&mc->mca_addr, group))
1055 break;
1056 }
1057 if (!mc)
1058 goto unlock;
1059 if (src_addr && !ipv6_addr_any(src_addr)) {
1060 struct ip6_sf_list *psf;
1061
1062 for_each_psf_rcu(mc, psf) {
1063 if (ipv6_addr_equal(&psf->sf_addr, src_addr))
1064 break;
1065 }
1066 if (psf)
1067 rv = READ_ONCE(psf->sf_count[MCAST_INCLUDE]) ||
1068 READ_ONCE(psf->sf_count[MCAST_EXCLUDE]) !=
1069 READ_ONCE(mc->mca_sfcount[MCAST_EXCLUDE]);
1070 else
1071 rv = READ_ONCE(mc->mca_sfcount[MCAST_EXCLUDE]) != 0;
1072 } else {
1073 rv = true; /* don't filter unspecified source */
1074 }
1075 unlock:
1076 rcu_read_unlock();
1077 return rv;
1078 }
1079
mld_gq_start_work(struct inet6_dev * idev)1080 static void mld_gq_start_work(struct inet6_dev *idev)
1081 {
1082 unsigned long tv = get_random_u32_below(idev->mc_maxdelay);
1083
1084 mc_assert_locked(idev);
1085
1086 idev->mc_gq_running = 1;
1087 if (in6_dev_hold_safe(idev)) {
1088 if (mod_delayed_work(mld_wq, &idev->mc_gq_work, tv + 2))
1089 in6_dev_put(idev);
1090 }
1091 }
1092
mld_gq_stop_work(struct inet6_dev * idev)1093 static void mld_gq_stop_work(struct inet6_dev *idev)
1094 {
1095 mc_assert_locked(idev);
1096
1097 idev->mc_gq_running = 0;
1098 if (cancel_delayed_work(&idev->mc_gq_work))
1099 __in6_dev_put(idev);
1100 }
1101
mld_ifc_start_work(struct inet6_dev * idev,unsigned long delay)1102 static void mld_ifc_start_work(struct inet6_dev *idev, unsigned long delay)
1103 {
1104 unsigned long tv = get_random_u32_below(delay);
1105
1106 mc_assert_locked(idev);
1107
1108 if (in6_dev_hold_safe(idev)) {
1109 if (mod_delayed_work(mld_wq, &idev->mc_ifc_work, tv + 2))
1110 in6_dev_put(idev);
1111 }
1112 }
1113
mld_ifc_stop_work(struct inet6_dev * idev)1114 static void mld_ifc_stop_work(struct inet6_dev *idev)
1115 {
1116 mc_assert_locked(idev);
1117
1118 idev->mc_ifc_count = 0;
1119 if (cancel_delayed_work(&idev->mc_ifc_work))
1120 __in6_dev_put(idev);
1121 }
1122
mld_dad_start_work(struct inet6_dev * idev,unsigned long delay)1123 static void mld_dad_start_work(struct inet6_dev *idev, unsigned long delay)
1124 {
1125 unsigned long tv = get_random_u32_below(delay);
1126
1127 mc_assert_locked(idev);
1128
1129 if (in6_dev_hold_safe(idev)) {
1130 if (mod_delayed_work(mld_wq, &idev->mc_dad_work, tv + 2))
1131 in6_dev_put(idev);
1132 }
1133 }
1134
mld_dad_stop_work(struct inet6_dev * idev)1135 static void mld_dad_stop_work(struct inet6_dev *idev)
1136 {
1137 if (cancel_delayed_work(&idev->mc_dad_work))
1138 __in6_dev_put(idev);
1139 }
1140
mld_query_stop_work(struct inet6_dev * idev)1141 static void mld_query_stop_work(struct inet6_dev *idev)
1142 {
1143 spin_lock_bh(&idev->mc_query_lock);
1144 if (cancel_delayed_work(&idev->mc_query_work))
1145 __in6_dev_put(idev);
1146 spin_unlock_bh(&idev->mc_query_lock);
1147 }
1148
mld_report_stop_work(struct inet6_dev * idev)1149 static void mld_report_stop_work(struct inet6_dev *idev)
1150 {
1151 if (cancel_delayed_work_sync(&idev->mc_report_work))
1152 __in6_dev_put(idev);
1153 }
1154
1155 /* IGMP handling (alias multicast ICMPv6 messages) */
igmp6_group_queried(struct ifmcaddr6 * ma,unsigned long resptime)1156 static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
1157 {
1158 unsigned long delay = resptime;
1159
1160 mc_assert_locked(ma->idev);
1161
1162 /* Do not start work for these addresses */
1163 if (ipv6_addr_is_ll_all_nodes(&ma->mca_addr) ||
1164 IPV6_ADDR_MC_SCOPE(&ma->mca_addr) < IPV6_ADDR_SCOPE_LINKLOCAL)
1165 return;
1166
1167 if (cancel_delayed_work(&ma->mca_work)) {
1168 refcount_dec(&ma->mca_refcnt);
1169 delay = ma->mca_work.timer.expires - jiffies;
1170 }
1171
1172 if (delay >= resptime)
1173 delay = get_random_u32_below(resptime);
1174
1175 if (!mod_delayed_work(mld_wq, &ma->mca_work, delay))
1176 refcount_inc(&ma->mca_refcnt);
1177 WRITE_ONCE(ma->mca_flags, ma->mca_flags | MAF_TIMER_RUNNING);
1178 }
1179
1180 /* mark EXCLUDE-mode sources */
mld_xmarksources(struct ifmcaddr6 * pmc,int nsrcs,const struct in6_addr * srcs)1181 static bool mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
1182 const struct in6_addr *srcs)
1183 {
1184 struct ip6_sf_list *psf;
1185 int i, scount;
1186
1187 mc_assert_locked(pmc->idev);
1188
1189 scount = 0;
1190 for_each_psf_mclock(pmc, psf) {
1191 if (scount == nsrcs)
1192 break;
1193 for (i = 0; i < nsrcs; i++) {
1194 /* skip inactive filters */
1195 if (psf->sf_count[MCAST_INCLUDE] ||
1196 pmc->mca_sfcount[MCAST_EXCLUDE] !=
1197 psf->sf_count[MCAST_EXCLUDE])
1198 break;
1199 if (ipv6_addr_equal(&srcs[i], &psf->sf_addr)) {
1200 scount++;
1201 break;
1202 }
1203 }
1204 }
1205 WRITE_ONCE(pmc->mca_flags, pmc->mca_flags & ~MAF_GSQUERY);
1206 if (scount == nsrcs) /* all sources excluded */
1207 return false;
1208 return true;
1209 }
1210
mld_marksources(struct ifmcaddr6 * pmc,int nsrcs,const struct in6_addr * srcs)1211 static bool mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
1212 const struct in6_addr *srcs)
1213 {
1214 struct ip6_sf_list *psf;
1215 int i, scount;
1216
1217 mc_assert_locked(pmc->idev);
1218
1219 if (pmc->mca_sfmode == MCAST_EXCLUDE)
1220 return mld_xmarksources(pmc, nsrcs, srcs);
1221
1222 /* mark INCLUDE-mode sources */
1223
1224 scount = 0;
1225 for_each_psf_mclock(pmc, psf) {
1226 if (scount == nsrcs)
1227 break;
1228 for (i = 0; i < nsrcs; i++) {
1229 if (ipv6_addr_equal(&srcs[i], &psf->sf_addr)) {
1230 psf->sf_gsresp = 1;
1231 scount++;
1232 break;
1233 }
1234 }
1235 }
1236 if (!scount) {
1237 WRITE_ONCE(pmc->mca_flags, pmc->mca_flags & ~MAF_GSQUERY);
1238 return false;
1239 }
1240 WRITE_ONCE(pmc->mca_flags, pmc->mca_flags | MAF_GSQUERY);
1241 return true;
1242 }
1243
mld_force_mld_version(const struct inet6_dev * idev)1244 static int mld_force_mld_version(const struct inet6_dev *idev)
1245 {
1246 const struct net *net = dev_net(idev->dev);
1247 int all_force;
1248
1249 all_force = READ_ONCE(net->ipv6.devconf_all->force_mld_version);
1250 /* Normally, both are 0 here. If enforcement to a particular is
1251 * being used, individual device enforcement will have a lower
1252 * precedence over 'all' device (.../conf/all/force_mld_version).
1253 */
1254 return all_force ?: READ_ONCE(idev->cnf.force_mld_version);
1255 }
1256
mld_in_v2_mode_only(const struct inet6_dev * idev)1257 static bool mld_in_v2_mode_only(const struct inet6_dev *idev)
1258 {
1259 return mld_force_mld_version(idev) == 2;
1260 }
1261
mld_in_v1_mode_only(const struct inet6_dev * idev)1262 static bool mld_in_v1_mode_only(const struct inet6_dev *idev)
1263 {
1264 return mld_force_mld_version(idev) == 1;
1265 }
1266
mld_in_v1_mode(const struct inet6_dev * idev)1267 static bool mld_in_v1_mode(const struct inet6_dev *idev)
1268 {
1269 if (mld_in_v2_mode_only(idev))
1270 return false;
1271 if (mld_in_v1_mode_only(idev))
1272 return true;
1273 if (idev->mc_v1_seen && time_before(jiffies, idev->mc_v1_seen))
1274 return true;
1275
1276 return false;
1277 }
1278
mld_set_v1_mode(struct inet6_dev * idev)1279 static void mld_set_v1_mode(struct inet6_dev *idev)
1280 {
1281 /* RFC3810, relevant sections:
1282 * - 9.1. Robustness Variable
1283 * - 9.2. Query Interval
1284 * - 9.3. Query Response Interval
1285 * - 9.12. Older Version Querier Present Timeout
1286 */
1287 unsigned long switchback;
1288
1289 switchback = (idev->mc_qrv * idev->mc_qi) + idev->mc_qri;
1290
1291 idev->mc_v1_seen = jiffies + switchback;
1292 }
1293
mld_update_qrv(struct inet6_dev * idev,const struct mld2_query * mlh2)1294 static void mld_update_qrv(struct inet6_dev *idev,
1295 const struct mld2_query *mlh2)
1296 {
1297 /* RFC3810, relevant sections:
1298 * - 5.1.8. QRV (Querier's Robustness Variable)
1299 * - 9.1. Robustness Variable
1300 */
1301
1302 /* The value of the Robustness Variable MUST NOT be zero,
1303 * and SHOULD NOT be one. Catch this here if we ever run
1304 * into such a case in future.
1305 */
1306 const int min_qrv = min(MLD_QRV_DEFAULT, sysctl_mld_qrv);
1307 WARN_ON(idev->mc_qrv == 0);
1308
1309 if (mlh2->mld2q_qrv > 0)
1310 idev->mc_qrv = mlh2->mld2q_qrv;
1311
1312 if (unlikely(idev->mc_qrv < min_qrv)) {
1313 net_warn_ratelimited("IPv6: MLD: clamping QRV from %u to %u!\n",
1314 idev->mc_qrv, min_qrv);
1315 idev->mc_qrv = min_qrv;
1316 }
1317 }
1318
mld_update_qi(struct inet6_dev * idev,const struct mld2_query * mlh2)1319 static void mld_update_qi(struct inet6_dev *idev,
1320 const struct mld2_query *mlh2)
1321 {
1322 /* RFC3810, relevant sections:
1323 * - 5.1.9. QQIC (Querier's Query Interval Code)
1324 * - 9.2. Query Interval
1325 * - 9.12. Older Version Querier Present Timeout
1326 * (the [Query Interval] in the last Query received)
1327 */
1328 idev->mc_qi = mldv2_qqi(mlh2) * HZ;
1329 }
1330
mld_update_qri(struct inet6_dev * idev,const struct mld2_query * mlh2)1331 static void mld_update_qri(struct inet6_dev *idev,
1332 const struct mld2_query *mlh2)
1333 {
1334 /* RFC3810, relevant sections:
1335 * - 5.1.3. Maximum Response Code
1336 * - 9.3. Query Response Interval
1337 */
1338 idev->mc_qri = msecs_to_jiffies(mldv2_mrd(mlh2));
1339 }
1340
mld_process_v1(struct inet6_dev * idev,struct mld_msg * mld,unsigned long * max_delay,bool v1_query)1341 static int mld_process_v1(struct inet6_dev *idev, struct mld_msg *mld,
1342 unsigned long *max_delay, bool v1_query)
1343 {
1344 unsigned long mldv1_md;
1345
1346 /* Ignore v1 queries */
1347 if (mld_in_v2_mode_only(idev))
1348 return -EINVAL;
1349
1350 mldv1_md = ntohs(mld->mld_maxdelay);
1351
1352 /* When in MLDv1 fallback and a MLDv2 router start-up being
1353 * unaware of current MLDv1 operation, the MRC == MRD mapping
1354 * only works when the exponential algorithm is not being
1355 * used (as MLDv1 is unaware of such things).
1356 *
1357 * According to the RFC author, the MLDv2 implementations
1358 * he's aware of all use a MRC < 32768 on start up queries.
1359 *
1360 * Thus, should we *ever* encounter something else larger
1361 * than that, just assume the maximum possible within our
1362 * reach.
1363 */
1364 if (!v1_query)
1365 mldv1_md = min(mldv1_md, MLDV1_MRD_MAX_COMPAT);
1366
1367 *max_delay = max(msecs_to_jiffies(mldv1_md), 1UL);
1368
1369 /* MLDv1 router present: we need to go into v1 mode *only*
1370 * when an MLDv1 query is received as per section 9.12. of
1371 * RFC3810! And we know from RFC2710 section 3.7 that MLDv1
1372 * queries MUST be of exactly 24 octets.
1373 */
1374 if (v1_query)
1375 mld_set_v1_mode(idev);
1376
1377 /* cancel MLDv2 report work */
1378 mld_gq_stop_work(idev);
1379 /* cancel the interface change work */
1380 mld_ifc_stop_work(idev);
1381 /* clear deleted report items */
1382 mld_clear_delrec(idev);
1383
1384 return 0;
1385 }
1386
mld_process_v2(struct inet6_dev * idev,struct mld2_query * mld,unsigned long * max_delay)1387 static void mld_process_v2(struct inet6_dev *idev, struct mld2_query *mld,
1388 unsigned long *max_delay)
1389 {
1390 *max_delay = max(msecs_to_jiffies(mldv2_mrd(mld)), 1UL);
1391
1392 mld_update_qrv(idev, mld);
1393 mld_update_qi(idev, mld);
1394 mld_update_qri(idev, mld);
1395
1396 idev->mc_maxdelay = *max_delay;
1397
1398 return;
1399 }
1400
1401 /* called with rcu_read_lock() */
igmp6_event_query(struct sk_buff * skb)1402 void igmp6_event_query(struct sk_buff *skb)
1403 {
1404 struct inet6_dev *idev = __in6_dev_get(skb->dev);
1405 bool put = false;
1406
1407 if (!idev || idev->dead)
1408 goto out;
1409
1410 spin_lock_bh(&idev->mc_query_lock);
1411 if (skb_queue_len(&idev->mc_query_queue) < MLD_MAX_SKBS &&
1412 in6_dev_hold_safe(idev)) {
1413 __skb_queue_tail(&idev->mc_query_queue, skb);
1414 if (mod_delayed_work(mld_wq, &idev->mc_query_work, 0))
1415 put = true;
1416 skb = NULL;
1417 }
1418 spin_unlock_bh(&idev->mc_query_lock);
1419
1420 if (put)
1421 in6_dev_put(idev);
1422 out:
1423 kfree_skb(skb);
1424 }
1425
__mld_query_work(struct sk_buff * skb)1426 static void __mld_query_work(struct sk_buff *skb)
1427 {
1428 struct mld2_query *mlh2 = NULL;
1429 unsigned long max_delay;
1430 struct inet6_dev *idev;
1431 struct in6_addr group;
1432 struct ifmcaddr6 *ma;
1433 struct mld_msg *mld;
1434 int group_type;
1435 int mark = 0;
1436 int len, err;
1437
1438 if (!pskb_may_pull(skb, sizeof(struct in6_addr)))
1439 goto kfree_skb;
1440
1441 /* compute payload length excluding extension headers */
1442 len = ntohs(ipv6_hdr(skb)->payload_len) + sizeof(struct ipv6hdr);
1443 len -= skb_network_header_len(skb);
1444
1445 /* RFC3810 6.2
1446 * Upon reception of an MLD message that contains a Query, the node
1447 * checks if the source address of the message is a valid link-local
1448 * address, if the Hop Limit is set to 1, and if the Router Alert
1449 * option is present in the Hop-By-Hop Options header of the IPv6
1450 * packet. If any of these checks fails, the packet is dropped.
1451 */
1452 if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL) ||
1453 ipv6_hdr(skb)->hop_limit != 1 ||
1454 !(IP6CB(skb)->flags & IP6SKB_ROUTERALERT) ||
1455 IP6CB(skb)->ra != htons(IPV6_OPT_ROUTERALERT_MLD))
1456 goto kfree_skb;
1457
1458 idev = in6_dev_get(skb->dev);
1459 if (!idev)
1460 goto kfree_skb;
1461
1462 mld = (struct mld_msg *)icmp6_hdr(skb);
1463 group = mld->mld_mca;
1464 group_type = ipv6_addr_type(&group);
1465
1466 if (group_type != IPV6_ADDR_ANY &&
1467 !(group_type&IPV6_ADDR_MULTICAST))
1468 goto out;
1469
1470 if (len < MLD_V1_QUERY_LEN) {
1471 goto out;
1472 } else if (len == MLD_V1_QUERY_LEN || mld_in_v1_mode(idev)) {
1473 err = mld_process_v1(idev, mld, &max_delay,
1474 len == MLD_V1_QUERY_LEN);
1475 if (err < 0)
1476 goto out;
1477 } else if (len >= MLD_V2_QUERY_LEN_MIN) {
1478 int srcs_offset = sizeof(struct mld2_query) -
1479 sizeof(struct icmp6hdr);
1480
1481 if (!pskb_may_pull(skb, srcs_offset))
1482 goto out;
1483
1484 mlh2 = (struct mld2_query *)skb_transport_header(skb);
1485
1486 mld_process_v2(idev, mlh2, &max_delay);
1487
1488 if (group_type == IPV6_ADDR_ANY) { /* general query */
1489 if (mlh2->mld2q_nsrcs)
1490 goto out; /* no sources allowed */
1491
1492 mld_gq_start_work(idev);
1493 goto out;
1494 }
1495 /* mark sources to include, if group & source-specific */
1496 if (mlh2->mld2q_nsrcs != 0) {
1497 if (!pskb_may_pull(skb, srcs_offset +
1498 ntohs(mlh2->mld2q_nsrcs) * sizeof(struct in6_addr)))
1499 goto out;
1500
1501 mlh2 = (struct mld2_query *)skb_transport_header(skb);
1502 mark = 1;
1503 }
1504 } else {
1505 goto out;
1506 }
1507
1508 if (group_type == IPV6_ADDR_ANY) {
1509 for_each_mc_mclock(idev, ma) {
1510 igmp6_group_queried(ma, max_delay);
1511 }
1512 } else {
1513 for_each_mc_mclock(idev, ma) {
1514 unsigned int flags;
1515
1516 if (!ipv6_addr_equal(&group, &ma->mca_addr))
1517 continue;
1518 flags = ma->mca_flags;
1519
1520 if (flags & MAF_TIMER_RUNNING) {
1521 /* gsquery <- gsquery && mark */
1522 if (!mark)
1523 WRITE_ONCE(ma->mca_flags,
1524 flags & ~MAF_GSQUERY);
1525 } else {
1526 /* gsquery <- mark */
1527 if (mark)
1528 WRITE_ONCE(ma->mca_flags,
1529 flags | MAF_GSQUERY);
1530 else
1531 WRITE_ONCE(ma->mca_flags,
1532 flags & ~MAF_GSQUERY);
1533 }
1534 if (!(ma->mca_flags & MAF_GSQUERY) ||
1535 mld_marksources(ma, ntohs(mlh2->mld2q_nsrcs), mlh2->mld2q_srcs))
1536 igmp6_group_queried(ma, max_delay);
1537 break;
1538 }
1539 }
1540
1541 out:
1542 in6_dev_put(idev);
1543 kfree_skb:
1544 consume_skb(skb);
1545 }
1546
mld_query_work(struct work_struct * work)1547 static void mld_query_work(struct work_struct *work)
1548 {
1549 struct inet6_dev *idev = container_of(to_delayed_work(work),
1550 struct inet6_dev,
1551 mc_query_work);
1552 struct sk_buff_head q;
1553 struct sk_buff *skb;
1554 bool rework = false;
1555 int cnt = 0;
1556
1557 skb_queue_head_init(&q);
1558
1559 spin_lock_bh(&idev->mc_query_lock);
1560 while ((skb = __skb_dequeue(&idev->mc_query_queue))) {
1561 __skb_queue_tail(&q, skb);
1562
1563 if (++cnt >= MLD_MAX_QUEUE) {
1564 rework = true;
1565 break;
1566 }
1567 }
1568 spin_unlock_bh(&idev->mc_query_lock);
1569
1570 mutex_lock(&idev->mc_lock);
1571 while ((skb = __skb_dequeue(&q)))
1572 __mld_query_work(skb);
1573 mutex_unlock(&idev->mc_lock);
1574
1575 if (rework && queue_delayed_work(mld_wq, &idev->mc_query_work, 0))
1576 return;
1577
1578 in6_dev_put(idev);
1579 }
1580
1581 /* called with rcu_read_lock() */
igmp6_event_report(struct sk_buff * skb)1582 void igmp6_event_report(struct sk_buff *skb)
1583 {
1584 struct inet6_dev *idev = __in6_dev_get(skb->dev);
1585 bool put = false;
1586
1587 if (!idev || idev->dead)
1588 goto out;
1589
1590 spin_lock_bh(&idev->mc_report_lock);
1591 if (skb_queue_len(&idev->mc_report_queue) < MLD_MAX_SKBS &&
1592 in6_dev_hold_safe(idev)) {
1593 __skb_queue_tail(&idev->mc_report_queue, skb);
1594 if (mod_delayed_work(mld_wq, &idev->mc_report_work, 0))
1595 put = true;
1596 skb = NULL;
1597 }
1598 spin_unlock_bh(&idev->mc_report_lock);
1599
1600 if (put)
1601 in6_dev_put(idev);
1602 out:
1603 kfree_skb(skb);
1604 }
1605
__mld_report_work(struct sk_buff * skb)1606 static void __mld_report_work(struct sk_buff *skb)
1607 {
1608 struct inet6_dev *idev;
1609 struct ifmcaddr6 *ma;
1610 struct mld_msg *mld;
1611 int addr_type;
1612
1613 /* Our own report looped back. Ignore it. */
1614 if (skb->pkt_type == PACKET_LOOPBACK)
1615 goto kfree_skb;
1616
1617 /* send our report if the MC router may not have heard this report */
1618 if (skb->pkt_type != PACKET_MULTICAST &&
1619 skb->pkt_type != PACKET_BROADCAST)
1620 goto kfree_skb;
1621
1622 if (!pskb_may_pull(skb, sizeof(*mld) - sizeof(struct icmp6hdr)))
1623 goto kfree_skb;
1624
1625 mld = (struct mld_msg *)icmp6_hdr(skb);
1626
1627 /* Drop reports with not link local source */
1628 addr_type = ipv6_addr_type(&ipv6_hdr(skb)->saddr);
1629 if (addr_type != IPV6_ADDR_ANY &&
1630 !(addr_type&IPV6_ADDR_LINKLOCAL))
1631 goto kfree_skb;
1632
1633 idev = in6_dev_get(skb->dev);
1634 if (!idev)
1635 goto kfree_skb;
1636
1637 /*
1638 * Cancel the work for this group
1639 */
1640
1641 for_each_mc_mclock(idev, ma) {
1642 if (ipv6_addr_equal(&ma->mca_addr, &mld->mld_mca)) {
1643 if (cancel_delayed_work(&ma->mca_work))
1644 refcount_dec(&ma->mca_refcnt);
1645 WRITE_ONCE(ma->mca_flags,
1646 ma->mca_flags & ~(MAF_LAST_REPORTER |
1647 MAF_TIMER_RUNNING));
1648 break;
1649 }
1650 }
1651
1652 in6_dev_put(idev);
1653 kfree_skb:
1654 consume_skb(skb);
1655 }
1656
mld_report_work(struct work_struct * work)1657 static void mld_report_work(struct work_struct *work)
1658 {
1659 struct inet6_dev *idev = container_of(to_delayed_work(work),
1660 struct inet6_dev,
1661 mc_report_work);
1662 struct sk_buff_head q;
1663 struct sk_buff *skb;
1664 bool rework = false;
1665 int cnt = 0;
1666
1667 skb_queue_head_init(&q);
1668 spin_lock_bh(&idev->mc_report_lock);
1669 while ((skb = __skb_dequeue(&idev->mc_report_queue))) {
1670 __skb_queue_tail(&q, skb);
1671
1672 if (++cnt >= MLD_MAX_QUEUE) {
1673 rework = true;
1674 break;
1675 }
1676 }
1677 spin_unlock_bh(&idev->mc_report_lock);
1678
1679 mutex_lock(&idev->mc_lock);
1680 while ((skb = __skb_dequeue(&q)))
1681 __mld_report_work(skb);
1682 mutex_unlock(&idev->mc_lock);
1683
1684 if (rework && queue_delayed_work(mld_wq, &idev->mc_report_work, 0))
1685 return;
1686
1687 in6_dev_put(idev);
1688 }
1689
is_in(struct ifmcaddr6 * pmc,struct ip6_sf_list * psf,int type,int gdeleted,int sdeleted)1690 static bool is_in(struct ifmcaddr6 *pmc, struct ip6_sf_list *psf, int type,
1691 int gdeleted, int sdeleted)
1692 {
1693 switch (type) {
1694 case MLD2_MODE_IS_INCLUDE:
1695 case MLD2_MODE_IS_EXCLUDE:
1696 if (gdeleted || sdeleted)
1697 return false;
1698 if (!((pmc->mca_flags & MAF_GSQUERY) && !psf->sf_gsresp)) {
1699 if (pmc->mca_sfmode == MCAST_INCLUDE)
1700 return true;
1701 /* don't include if this source is excluded
1702 * in all filters
1703 */
1704 if (psf->sf_count[MCAST_INCLUDE])
1705 return type == MLD2_MODE_IS_INCLUDE;
1706 return pmc->mca_sfcount[MCAST_EXCLUDE] ==
1707 psf->sf_count[MCAST_EXCLUDE];
1708 }
1709 return false;
1710 case MLD2_CHANGE_TO_INCLUDE:
1711 if (gdeleted || sdeleted)
1712 return false;
1713 return psf->sf_count[MCAST_INCLUDE] != 0;
1714 case MLD2_CHANGE_TO_EXCLUDE:
1715 if (gdeleted || sdeleted)
1716 return false;
1717 if (pmc->mca_sfcount[MCAST_EXCLUDE] == 0 ||
1718 psf->sf_count[MCAST_INCLUDE])
1719 return false;
1720 return pmc->mca_sfcount[MCAST_EXCLUDE] ==
1721 psf->sf_count[MCAST_EXCLUDE];
1722 case MLD2_ALLOW_NEW_SOURCES:
1723 if (gdeleted || !psf->sf_crcount)
1724 return false;
1725 return (pmc->mca_sfmode == MCAST_INCLUDE) ^ sdeleted;
1726 case MLD2_BLOCK_OLD_SOURCES:
1727 if (pmc->mca_sfmode == MCAST_INCLUDE)
1728 return gdeleted || (psf->sf_crcount && sdeleted);
1729 return psf->sf_crcount && !gdeleted && !sdeleted;
1730 }
1731 return false;
1732 }
1733
1734 static int
mld_scount(struct ifmcaddr6 * pmc,int type,int gdeleted,int sdeleted)1735 mld_scount(struct ifmcaddr6 *pmc, int type, int gdeleted, int sdeleted)
1736 {
1737 struct ip6_sf_list *psf;
1738 int scount = 0;
1739
1740 for_each_psf_mclock(pmc, psf) {
1741 if (!is_in(pmc, psf, type, gdeleted, sdeleted))
1742 continue;
1743 scount++;
1744 }
1745 return scount;
1746 }
1747
ip6_mc_hdr(const struct sock * sk,struct sk_buff * skb,struct net_device * dev,const struct in6_addr * saddr,const struct in6_addr * daddr,int proto,int len)1748 static void ip6_mc_hdr(const struct sock *sk, struct sk_buff *skb,
1749 struct net_device *dev, const struct in6_addr *saddr,
1750 const struct in6_addr *daddr, int proto, int len)
1751 {
1752 struct ipv6hdr *hdr;
1753
1754 skb->protocol = htons(ETH_P_IPV6);
1755 skb->dev = dev;
1756
1757 skb_reset_network_header(skb);
1758 skb_put(skb, sizeof(struct ipv6hdr));
1759 hdr = ipv6_hdr(skb);
1760
1761 ip6_flow_hdr(hdr, 0, 0);
1762
1763 hdr->payload_len = htons(len);
1764 hdr->nexthdr = proto;
1765 hdr->hop_limit = READ_ONCE(inet6_sk(sk)->hop_limit);
1766
1767 hdr->saddr = *saddr;
1768 hdr->daddr = *daddr;
1769 }
1770
mld_newpack(struct inet6_dev * idev,unsigned int mtu)1771 static struct sk_buff *mld_newpack(struct inet6_dev *idev, unsigned int mtu)
1772 {
1773 u8 ra[8] = { IPPROTO_ICMPV6, 0, IPV6_TLV_ROUTERALERT,
1774 2, 0, 0, IPV6_TLV_PADN, 0 };
1775 struct net_device *dev = idev->dev;
1776 int hlen = LL_RESERVED_SPACE(dev);
1777 int tlen = dev->needed_tailroom;
1778 const struct in6_addr *saddr;
1779 struct in6_addr addr_buf;
1780 struct mld2_report *pmr;
1781 struct sk_buff *skb;
1782 unsigned int size;
1783 struct sock *sk;
1784 struct net *net;
1785
1786 /* we assume size > sizeof(ra) here
1787 * Also try to not allocate high-order pages for big MTU
1788 */
1789 size = min_t(int, mtu, PAGE_SIZE / 2) + hlen + tlen;
1790 skb = alloc_skb(size, GFP_KERNEL);
1791 if (!skb)
1792 return NULL;
1793
1794 skb->priority = TC_PRIO_CONTROL;
1795 skb_reserve(skb, hlen);
1796 skb_tailroom_reserve(skb, mtu, tlen);
1797
1798 rcu_read_lock();
1799
1800 net = dev_net_rcu(dev);
1801 sk = net->ipv6.igmp_sk;
1802 skb_set_owner_w(skb, sk);
1803
1804 if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
1805 /* <draft-ietf-magma-mld-source-05.txt>:
1806 * use unspecified address as the source address
1807 * when a valid link-local address is not available.
1808 */
1809 saddr = &in6addr_any;
1810 } else
1811 saddr = &addr_buf;
1812
1813 ip6_mc_hdr(sk, skb, dev, saddr, &mld2_all_mcr, NEXTHDR_HOP, 0);
1814
1815 rcu_read_unlock();
1816
1817 skb_put_data(skb, ra, sizeof(ra));
1818
1819 skb_set_transport_header(skb, skb_tail_pointer(skb) - skb->data);
1820 skb_put(skb, sizeof(*pmr));
1821 pmr = (struct mld2_report *)skb_transport_header(skb);
1822 pmr->mld2r_type = ICMPV6_MLD2_REPORT;
1823 pmr->mld2r_resv1 = 0;
1824 pmr->mld2r_cksum = 0;
1825 pmr->mld2r_resv2 = 0;
1826 pmr->mld2r_ngrec = 0;
1827 return skb;
1828 }
1829
mld_sendpack(struct sk_buff * skb)1830 static void mld_sendpack(struct sk_buff *skb)
1831 {
1832 struct ipv6hdr *pip6 = ipv6_hdr(skb);
1833 struct mld2_report *pmr =
1834 (struct mld2_report *)skb_transport_header(skb);
1835 int payload_len, mldlen;
1836 struct inet6_dev *idev;
1837 struct net *net = dev_net(skb->dev);
1838 int err;
1839 struct flowi6 fl6;
1840 struct dst_entry *dst;
1841
1842 rcu_read_lock();
1843 idev = __in6_dev_get(skb->dev);
1844 IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
1845
1846 payload_len = (skb_tail_pointer(skb) - skb_network_header(skb)) -
1847 sizeof(*pip6);
1848 mldlen = skb_tail_pointer(skb) - skb_transport_header(skb);
1849 pip6->payload_len = htons(payload_len);
1850
1851 pmr->mld2r_cksum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
1852 IPPROTO_ICMPV6,
1853 csum_partial(skb_transport_header(skb),
1854 mldlen, 0));
1855
1856 icmpv6_flow_init(net->ipv6.igmp_sk, &fl6, ICMPV6_MLD2_REPORT,
1857 &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
1858 skb->dev->ifindex);
1859 dst = icmp6_dst_alloc(skb->dev, &fl6);
1860
1861 err = 0;
1862 if (IS_ERR(dst)) {
1863 err = PTR_ERR(dst);
1864 dst = NULL;
1865 }
1866 skb_dst_set(skb, dst);
1867 if (err)
1868 goto err_out;
1869
1870 err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
1871 net, net->ipv6.igmp_sk, skb, NULL, skb->dev,
1872 dst_output);
1873 out:
1874 if (!err) {
1875 ICMP6MSGOUT_INC_STATS(net, idev, ICMPV6_MLD2_REPORT);
1876 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
1877 } else {
1878 IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
1879 }
1880
1881 rcu_read_unlock();
1882 return;
1883
1884 err_out:
1885 kfree_skb(skb);
1886 goto out;
1887 }
1888
grec_size(struct ifmcaddr6 * pmc,int type,int gdel,int sdel)1889 static int grec_size(struct ifmcaddr6 *pmc, int type, int gdel, int sdel)
1890 {
1891 return sizeof(struct mld2_grec) + 16 * mld_scount(pmc,type,gdel,sdel);
1892 }
1893
add_grhead(struct sk_buff * skb,struct ifmcaddr6 * pmc,int type,struct mld2_grec ** ppgr,unsigned int mtu)1894 static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
1895 int type, struct mld2_grec **ppgr, unsigned int mtu)
1896 {
1897 struct mld2_report *pmr;
1898 struct mld2_grec *pgr;
1899
1900 if (!skb) {
1901 skb = mld_newpack(pmc->idev, mtu);
1902 if (!skb)
1903 return NULL;
1904 }
1905 pgr = skb_put(skb, sizeof(struct mld2_grec));
1906 pgr->grec_type = type;
1907 pgr->grec_auxwords = 0;
1908 pgr->grec_nsrcs = 0;
1909 pgr->grec_mca = pmc->mca_addr; /* structure copy */
1910 pmr = (struct mld2_report *)skb_transport_header(skb);
1911 pmr->mld2r_ngrec = htons(ntohs(pmr->mld2r_ngrec)+1);
1912 *ppgr = pgr;
1913 return skb;
1914 }
1915
1916 #define AVAILABLE(skb) ((skb) ? skb_availroom(skb) : 0)
1917
add_grec(struct sk_buff * skb,struct ifmcaddr6 * pmc,int type,int gdeleted,int sdeleted,int crsend)1918 static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
1919 int type, int gdeleted, int sdeleted,
1920 int crsend)
1921 {
1922 struct ip6_sf_list *psf, *psf_prev, *psf_next;
1923 int scount, stotal, first, isquery, truncate;
1924 struct ip6_sf_list __rcu **psf_list;
1925 struct inet6_dev *idev = pmc->idev;
1926 struct net_device *dev = idev->dev;
1927 struct mld2_grec *pgr = NULL;
1928 struct mld2_report *pmr;
1929 unsigned int mtu;
1930
1931 mc_assert_locked(idev);
1932
1933 if (pmc->mca_flags & MAF_NOREPORT)
1934 return skb;
1935
1936 mtu = READ_ONCE(dev->mtu);
1937 if (mtu < IPV6_MIN_MTU)
1938 return skb;
1939
1940 isquery = type == MLD2_MODE_IS_INCLUDE ||
1941 type == MLD2_MODE_IS_EXCLUDE;
1942 truncate = type == MLD2_MODE_IS_EXCLUDE ||
1943 type == MLD2_CHANGE_TO_EXCLUDE;
1944
1945 stotal = scount = 0;
1946
1947 psf_list = sdeleted ? &pmc->mca_tomb : &pmc->mca_sources;
1948
1949 if (!rcu_access_pointer(*psf_list))
1950 goto empty_source;
1951
1952 pmr = skb ? (struct mld2_report *)skb_transport_header(skb) : NULL;
1953
1954 /* EX and TO_EX get a fresh packet, if needed */
1955 if (truncate) {
1956 if (pmr && pmr->mld2r_ngrec &&
1957 AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
1958 if (skb)
1959 mld_sendpack(skb);
1960 skb = mld_newpack(idev, mtu);
1961 }
1962 }
1963 first = 1;
1964 psf_prev = NULL;
1965 for (psf = mc_dereference(*psf_list, idev);
1966 psf;
1967 psf = psf_next) {
1968 struct in6_addr *psrc;
1969
1970 psf_next = mc_dereference(psf->sf_next, idev);
1971
1972 if (!is_in(pmc, psf, type, gdeleted, sdeleted) && !crsend) {
1973 psf_prev = psf;
1974 continue;
1975 }
1976
1977 /* Based on RFC3810 6.1. Should not send source-list change
1978 * records when there is a filter mode change.
1979 */
1980 if (((gdeleted && pmc->mca_sfmode == MCAST_EXCLUDE) ||
1981 (!gdeleted && pmc->mca_crcount)) &&
1982 (type == MLD2_ALLOW_NEW_SOURCES ||
1983 type == MLD2_BLOCK_OLD_SOURCES) && psf->sf_crcount)
1984 goto decrease_sf_crcount;
1985
1986 /* clear marks on query responses */
1987 if (isquery)
1988 psf->sf_gsresp = 0;
1989
1990 if (AVAILABLE(skb) < sizeof(*psrc) +
1991 first*sizeof(struct mld2_grec)) {
1992 if (truncate && !first)
1993 break; /* truncate these */
1994 if (pgr)
1995 pgr->grec_nsrcs = htons(scount);
1996 if (skb)
1997 mld_sendpack(skb);
1998 skb = mld_newpack(idev, mtu);
1999 first = 1;
2000 scount = 0;
2001 }
2002 if (first) {
2003 skb = add_grhead(skb, pmc, type, &pgr, mtu);
2004 first = 0;
2005 }
2006 if (!skb)
2007 return NULL;
2008 psrc = skb_put(skb, sizeof(*psrc));
2009 *psrc = psf->sf_addr;
2010 scount++; stotal++;
2011 if ((type == MLD2_ALLOW_NEW_SOURCES ||
2012 type == MLD2_BLOCK_OLD_SOURCES) && psf->sf_crcount) {
2013 decrease_sf_crcount:
2014 psf->sf_crcount--;
2015 if ((sdeleted || gdeleted) && psf->sf_crcount == 0) {
2016 if (psf_prev)
2017 rcu_assign_pointer(psf_prev->sf_next,
2018 mc_dereference(psf->sf_next, idev));
2019 else
2020 rcu_assign_pointer(*psf_list,
2021 mc_dereference(psf->sf_next, idev));
2022 kfree_rcu(psf, rcu);
2023 continue;
2024 }
2025 }
2026 psf_prev = psf;
2027 }
2028
2029 empty_source:
2030 if (!stotal) {
2031 if (type == MLD2_ALLOW_NEW_SOURCES ||
2032 type == MLD2_BLOCK_OLD_SOURCES)
2033 return skb;
2034 if (pmc->mca_crcount || isquery || crsend) {
2035 /* make sure we have room for group header */
2036 if (skb && AVAILABLE(skb) < sizeof(struct mld2_grec)) {
2037 mld_sendpack(skb);
2038 skb = NULL; /* add_grhead will get a new one */
2039 }
2040 skb = add_grhead(skb, pmc, type, &pgr, mtu);
2041 }
2042 }
2043 if (pgr)
2044 pgr->grec_nsrcs = htons(scount);
2045
2046 if (isquery) {
2047 /* clear query state */
2048 WRITE_ONCE(pmc->mca_flags, pmc->mca_flags & ~MAF_GSQUERY);
2049 }
2050 return skb;
2051 }
2052
mld_send_report(struct inet6_dev * idev,struct ifmcaddr6 * pmc)2053 static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
2054 {
2055 struct sk_buff *skb = NULL;
2056 int type;
2057
2058 mc_assert_locked(idev);
2059
2060 if (!pmc) {
2061 for_each_mc_mclock(idev, pmc) {
2062 if (pmc->mca_flags & MAF_NOREPORT)
2063 continue;
2064 if (pmc->mca_sfcount[MCAST_EXCLUDE])
2065 type = MLD2_MODE_IS_EXCLUDE;
2066 else
2067 type = MLD2_MODE_IS_INCLUDE;
2068 skb = add_grec(skb, pmc, type, 0, 0, 0);
2069 }
2070 } else {
2071 if (pmc->mca_sfcount[MCAST_EXCLUDE])
2072 type = MLD2_MODE_IS_EXCLUDE;
2073 else
2074 type = MLD2_MODE_IS_INCLUDE;
2075 skb = add_grec(skb, pmc, type, 0, 0, 0);
2076 }
2077 if (skb)
2078 mld_sendpack(skb);
2079 }
2080
2081 /* remove zero-count source records from a source filter list */
mld_clear_zeros(struct ip6_sf_list __rcu ** ppsf,struct inet6_dev * idev)2082 static void mld_clear_zeros(struct ip6_sf_list __rcu **ppsf, struct inet6_dev *idev)
2083 {
2084 struct ip6_sf_list *psf_prev, *psf_next, *psf;
2085
2086 psf_prev = NULL;
2087 for (psf = mc_dereference(*ppsf, idev);
2088 psf;
2089 psf = psf_next) {
2090 psf_next = mc_dereference(psf->sf_next, idev);
2091 if (psf->sf_crcount == 0) {
2092 if (psf_prev)
2093 rcu_assign_pointer(psf_prev->sf_next,
2094 mc_dereference(psf->sf_next, idev));
2095 else
2096 rcu_assign_pointer(*ppsf,
2097 mc_dereference(psf->sf_next, idev));
2098 kfree_rcu(psf, rcu);
2099 } else {
2100 psf_prev = psf;
2101 }
2102 }
2103 }
2104
mld_send_cr(struct inet6_dev * idev)2105 static void mld_send_cr(struct inet6_dev *idev)
2106 {
2107 struct ifmcaddr6 *pmc, *pmc_prev, *pmc_next;
2108 struct sk_buff *skb = NULL;
2109 int type, dtype;
2110
2111 /* deleted MCA's */
2112 pmc_prev = NULL;
2113 for (pmc = mc_dereference(idev->mc_tomb, idev);
2114 pmc;
2115 pmc = pmc_next) {
2116 pmc_next = mc_dereference(pmc->next, idev);
2117 if (pmc->mca_sfmode == MCAST_INCLUDE) {
2118 type = MLD2_BLOCK_OLD_SOURCES;
2119 dtype = MLD2_BLOCK_OLD_SOURCES;
2120 skb = add_grec(skb, pmc, type, 1, 0, 0);
2121 skb = add_grec(skb, pmc, dtype, 1, 1, 0);
2122 }
2123 if (pmc->mca_crcount) {
2124 if (pmc->mca_sfmode == MCAST_EXCLUDE) {
2125 type = MLD2_CHANGE_TO_INCLUDE;
2126 skb = add_grec(skb, pmc, type, 1, 0, 0);
2127 }
2128 pmc->mca_crcount--;
2129 if (pmc->mca_crcount == 0) {
2130 mld_clear_zeros(&pmc->mca_tomb, idev);
2131 mld_clear_zeros(&pmc->mca_sources, idev);
2132 }
2133 }
2134 if (pmc->mca_crcount == 0 &&
2135 !rcu_access_pointer(pmc->mca_tomb) &&
2136 !rcu_access_pointer(pmc->mca_sources)) {
2137 if (pmc_prev)
2138 rcu_assign_pointer(pmc_prev->next, pmc_next);
2139 else
2140 rcu_assign_pointer(idev->mc_tomb, pmc_next);
2141 in6_dev_put(pmc->idev);
2142 kfree_rcu(pmc, rcu);
2143 } else
2144 pmc_prev = pmc;
2145 }
2146
2147 /* change recs */
2148 for_each_mc_mclock(idev, pmc) {
2149 if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
2150 type = MLD2_BLOCK_OLD_SOURCES;
2151 dtype = MLD2_ALLOW_NEW_SOURCES;
2152 } else {
2153 type = MLD2_ALLOW_NEW_SOURCES;
2154 dtype = MLD2_BLOCK_OLD_SOURCES;
2155 }
2156 skb = add_grec(skb, pmc, type, 0, 0, 0);
2157 skb = add_grec(skb, pmc, dtype, 0, 1, 0); /* deleted sources */
2158
2159 /* filter mode changes */
2160 if (pmc->mca_crcount) {
2161 if (pmc->mca_sfmode == MCAST_EXCLUDE)
2162 type = MLD2_CHANGE_TO_EXCLUDE;
2163 else
2164 type = MLD2_CHANGE_TO_INCLUDE;
2165 skb = add_grec(skb, pmc, type, 0, 0, 0);
2166 pmc->mca_crcount--;
2167 }
2168 }
2169 if (!skb)
2170 return;
2171 (void) mld_sendpack(skb);
2172 }
2173
igmp6_send(struct in6_addr * addr,struct net_device * dev,int type)2174 static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
2175 {
2176 const struct in6_addr *snd_addr, *saddr;
2177 int err, len, payload_len, full_len;
2178 struct in6_addr addr_buf;
2179 struct inet6_dev *idev;
2180 struct sk_buff *skb;
2181 struct mld_msg *hdr;
2182 int hlen = LL_RESERVED_SPACE(dev);
2183 int tlen = dev->needed_tailroom;
2184 u8 ra[8] = { IPPROTO_ICMPV6, 0,
2185 IPV6_TLV_ROUTERALERT, 2, 0, 0,
2186 IPV6_TLV_PADN, 0 };
2187 struct dst_entry *dst;
2188 struct flowi6 fl6;
2189 struct net *net;
2190 struct sock *sk;
2191
2192 if (type == ICMPV6_MGM_REDUCTION)
2193 snd_addr = &in6addr_linklocal_allrouters;
2194 else
2195 snd_addr = addr;
2196
2197 len = sizeof(struct icmp6hdr) + sizeof(struct in6_addr);
2198 payload_len = len + sizeof(ra);
2199 full_len = sizeof(struct ipv6hdr) + payload_len;
2200
2201 skb = alloc_skb(hlen + tlen + full_len, GFP_KERNEL);
2202
2203 rcu_read_lock();
2204
2205 net = dev_net_rcu(dev);
2206 idev = __in6_dev_get(dev);
2207 IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
2208 if (!skb) {
2209 IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
2210 rcu_read_unlock();
2211 return;
2212 }
2213 sk = net->ipv6.igmp_sk;
2214 skb_set_owner_w(skb, sk);
2215
2216 skb->priority = TC_PRIO_CONTROL;
2217 skb_reserve(skb, hlen);
2218
2219 if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
2220 /* <draft-ietf-magma-mld-source-05.txt>:
2221 * use unspecified address as the source address
2222 * when a valid link-local address is not available.
2223 */
2224 saddr = &in6addr_any;
2225 } else
2226 saddr = &addr_buf;
2227
2228 ip6_mc_hdr(sk, skb, dev, saddr, snd_addr, NEXTHDR_HOP, payload_len);
2229
2230 skb_put_data(skb, ra, sizeof(ra));
2231
2232 hdr = skb_put_zero(skb, sizeof(struct mld_msg));
2233 hdr->mld_type = type;
2234 hdr->mld_mca = *addr;
2235
2236 hdr->mld_cksum = csum_ipv6_magic(saddr, snd_addr, len,
2237 IPPROTO_ICMPV6,
2238 csum_partial(hdr, len, 0));
2239
2240 icmpv6_flow_init(sk, &fl6, type,
2241 &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
2242 skb->dev->ifindex);
2243 dst = icmp6_dst_alloc(skb->dev, &fl6);
2244 if (IS_ERR(dst)) {
2245 err = PTR_ERR(dst);
2246 goto err_out;
2247 }
2248
2249 skb_dst_set(skb, dst);
2250 err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
2251 net, sk, skb, NULL, skb->dev,
2252 dst_output);
2253 out:
2254 if (!err) {
2255 ICMP6MSGOUT_INC_STATS(net, idev, type);
2256 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
2257 } else
2258 IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
2259
2260 rcu_read_unlock();
2261 return;
2262
2263 err_out:
2264 kfree_skb(skb);
2265 goto out;
2266 }
2267
mld_send_initial_cr(struct inet6_dev * idev)2268 static void mld_send_initial_cr(struct inet6_dev *idev)
2269 {
2270 struct ifmcaddr6 *pmc;
2271 struct sk_buff *skb;
2272 int type;
2273
2274 mc_assert_locked(idev);
2275
2276 if (mld_in_v1_mode(idev))
2277 return;
2278
2279 skb = NULL;
2280 for_each_mc_mclock(idev, pmc) {
2281 if (pmc->mca_sfcount[MCAST_EXCLUDE])
2282 type = MLD2_CHANGE_TO_EXCLUDE;
2283 else
2284 type = MLD2_ALLOW_NEW_SOURCES;
2285 skb = add_grec(skb, pmc, type, 0, 0, 1);
2286 }
2287 if (skb)
2288 mld_sendpack(skb);
2289 }
2290
ipv6_mc_dad_complete(struct inet6_dev * idev)2291 void ipv6_mc_dad_complete(struct inet6_dev *idev)
2292 {
2293 mutex_lock(&idev->mc_lock);
2294 idev->mc_dad_count = idev->mc_qrv;
2295 if (idev->mc_dad_count) {
2296 mld_send_initial_cr(idev);
2297 idev->mc_dad_count--;
2298 if (idev->mc_dad_count)
2299 mld_dad_start_work(idev,
2300 unsolicited_report_interval(idev));
2301 }
2302 mutex_unlock(&idev->mc_lock);
2303 }
2304
mld_dad_work(struct work_struct * work)2305 static void mld_dad_work(struct work_struct *work)
2306 {
2307 struct inet6_dev *idev = container_of(to_delayed_work(work),
2308 struct inet6_dev,
2309 mc_dad_work);
2310 mutex_lock(&idev->mc_lock);
2311 mld_send_initial_cr(idev);
2312 if (idev->mc_dad_count) {
2313 idev->mc_dad_count--;
2314 if (idev->mc_dad_count)
2315 mld_dad_start_work(idev,
2316 unsolicited_report_interval(idev));
2317 }
2318 mutex_unlock(&idev->mc_lock);
2319 in6_dev_put(idev);
2320 }
2321
ip6_mc_del1_src(struct ifmcaddr6 * pmc,int sfmode,const struct in6_addr * psfsrc)2322 static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
2323 const struct in6_addr *psfsrc)
2324 {
2325 struct ip6_sf_list *psf, *psf_prev;
2326 int rv = 0;
2327
2328 mc_assert_locked(pmc->idev);
2329
2330 psf_prev = NULL;
2331 for_each_psf_mclock(pmc, psf) {
2332 if (ipv6_addr_equal(&psf->sf_addr, psfsrc))
2333 break;
2334 psf_prev = psf;
2335 }
2336 if (!psf || psf->sf_count[sfmode] == 0) {
2337 /* source filter not found, or count wrong => bug */
2338 return -ESRCH;
2339 }
2340 WRITE_ONCE(psf->sf_count[sfmode], psf->sf_count[sfmode] - 1);
2341 if (!psf->sf_count[MCAST_INCLUDE] && !psf->sf_count[MCAST_EXCLUDE]) {
2342 struct inet6_dev *idev = pmc->idev;
2343
2344 /* no more filters for this source */
2345 if (psf_prev)
2346 rcu_assign_pointer(psf_prev->sf_next,
2347 mc_dereference(psf->sf_next, idev));
2348 else
2349 rcu_assign_pointer(pmc->mca_sources,
2350 mc_dereference(psf->sf_next, idev));
2351
2352 if (psf->sf_oldin && !(pmc->mca_flags & MAF_NOREPORT) &&
2353 !mld_in_v1_mode(idev)) {
2354 psf->sf_crcount = idev->mc_qrv;
2355 rcu_assign_pointer(psf->sf_next,
2356 mc_dereference(pmc->mca_tomb, idev));
2357 rcu_assign_pointer(pmc->mca_tomb, psf);
2358 rv = 1;
2359 } else {
2360 kfree_rcu(psf, rcu);
2361 }
2362 }
2363 return rv;
2364 }
2365
ip6_mc_del_src(struct inet6_dev * idev,const struct in6_addr * pmca,int sfmode,int sfcount,const struct in6_addr * psfsrc,int delta)2366 static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
2367 int sfmode, int sfcount, const struct in6_addr *psfsrc,
2368 int delta)
2369 {
2370 struct ifmcaddr6 *pmc;
2371 int changerec = 0;
2372 int i, err;
2373
2374 if (!idev)
2375 return -ENODEV;
2376
2377 mc_assert_locked(idev);
2378
2379 for_each_mc_mclock(idev, pmc) {
2380 if (ipv6_addr_equal(pmca, &pmc->mca_addr))
2381 break;
2382 }
2383 if (!pmc)
2384 return -ESRCH;
2385
2386 sf_markstate(pmc);
2387 if (!delta) {
2388 if (!pmc->mca_sfcount[sfmode])
2389 return -EINVAL;
2390
2391 pmc->mca_sfcount[sfmode]--;
2392 }
2393 err = 0;
2394 for (i = 0; i < sfcount; i++) {
2395 int rv = ip6_mc_del1_src(pmc, sfmode, &psfsrc[i]);
2396
2397 changerec |= rv > 0;
2398 if (!err && rv < 0)
2399 err = rv;
2400 }
2401 if (pmc->mca_sfmode == MCAST_EXCLUDE &&
2402 pmc->mca_sfcount[MCAST_EXCLUDE] == 0 &&
2403 pmc->mca_sfcount[MCAST_INCLUDE]) {
2404 struct ip6_sf_list *psf;
2405
2406 /* filter mode change */
2407 pmc->mca_sfmode = MCAST_INCLUDE;
2408 pmc->mca_crcount = idev->mc_qrv;
2409 idev->mc_ifc_count = pmc->mca_crcount;
2410 for_each_psf_mclock(pmc, psf)
2411 psf->sf_crcount = 0;
2412 mld_ifc_event(pmc->idev);
2413 } else if (sf_setstate(pmc) || changerec) {
2414 mld_ifc_event(pmc->idev);
2415 }
2416
2417 return err;
2418 }
2419
2420 /* Add multicast single-source filter to the interface list */
ip6_mc_add1_src(struct ifmcaddr6 * pmc,int sfmode,const struct in6_addr * psfsrc)2421 static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
2422 const struct in6_addr *psfsrc)
2423 {
2424 struct ip6_sf_list *psf, *psf_prev;
2425
2426 mc_assert_locked(pmc->idev);
2427
2428 psf_prev = NULL;
2429 for_each_psf_mclock(pmc, psf) {
2430 if (ipv6_addr_equal(&psf->sf_addr, psfsrc))
2431 break;
2432 psf_prev = psf;
2433 }
2434 if (!psf) {
2435 psf = kzalloc_obj(*psf);
2436 if (!psf)
2437 return -ENOBUFS;
2438
2439 psf->sf_addr = *psfsrc;
2440 if (psf_prev) {
2441 rcu_assign_pointer(psf_prev->sf_next, psf);
2442 } else {
2443 rcu_assign_pointer(pmc->mca_sources, psf);
2444 }
2445 }
2446 WRITE_ONCE(psf->sf_count[sfmode], psf->sf_count[sfmode] + 1);
2447 return 0;
2448 }
2449
sf_markstate(struct ifmcaddr6 * pmc)2450 static void sf_markstate(struct ifmcaddr6 *pmc)
2451 {
2452 int mca_xcount = pmc->mca_sfcount[MCAST_EXCLUDE];
2453 struct ip6_sf_list *psf;
2454
2455 mc_assert_locked(pmc->idev);
2456
2457 for_each_psf_mclock(pmc, psf) {
2458 if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
2459 psf->sf_oldin = mca_xcount ==
2460 psf->sf_count[MCAST_EXCLUDE] &&
2461 !psf->sf_count[MCAST_INCLUDE];
2462 } else {
2463 psf->sf_oldin = psf->sf_count[MCAST_INCLUDE] != 0;
2464 }
2465 }
2466 }
2467
sf_setstate(struct ifmcaddr6 * pmc)2468 static int sf_setstate(struct ifmcaddr6 *pmc)
2469 {
2470 int mca_xcount = pmc->mca_sfcount[MCAST_EXCLUDE];
2471 struct ip6_sf_list *psf, *dpsf;
2472 int qrv = pmc->idev->mc_qrv;
2473 int new_in, rv;
2474
2475 mc_assert_locked(pmc->idev);
2476
2477 rv = 0;
2478 for_each_psf_mclock(pmc, psf) {
2479 if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
2480 new_in = mca_xcount == psf->sf_count[MCAST_EXCLUDE] &&
2481 !psf->sf_count[MCAST_INCLUDE];
2482 } else
2483 new_in = psf->sf_count[MCAST_INCLUDE] != 0;
2484 if (new_in) {
2485 if (!psf->sf_oldin) {
2486 struct ip6_sf_list *prev = NULL;
2487
2488 for_each_psf_tomb(pmc, dpsf) {
2489 if (ipv6_addr_equal(&dpsf->sf_addr,
2490 &psf->sf_addr))
2491 break;
2492 prev = dpsf;
2493 }
2494 if (dpsf) {
2495 if (prev)
2496 rcu_assign_pointer(prev->sf_next,
2497 mc_dereference(dpsf->sf_next,
2498 pmc->idev));
2499 else
2500 rcu_assign_pointer(pmc->mca_tomb,
2501 mc_dereference(dpsf->sf_next,
2502 pmc->idev));
2503 kfree_rcu(dpsf, rcu);
2504 }
2505 psf->sf_crcount = qrv;
2506 rv++;
2507 }
2508 } else if (psf->sf_oldin) {
2509 psf->sf_crcount = 0;
2510 /*
2511 * add or update "delete" records if an active filter
2512 * is now inactive
2513 */
2514
2515 for_each_psf_tomb(pmc, dpsf)
2516 if (ipv6_addr_equal(&dpsf->sf_addr,
2517 &psf->sf_addr))
2518 break;
2519 if (!dpsf) {
2520 dpsf = kmalloc_obj(*dpsf);
2521 if (!dpsf)
2522 continue;
2523 *dpsf = *psf;
2524 rcu_assign_pointer(dpsf->sf_next,
2525 mc_dereference(pmc->mca_tomb, pmc->idev));
2526 rcu_assign_pointer(pmc->mca_tomb, dpsf);
2527 }
2528 dpsf->sf_crcount = qrv;
2529 rv++;
2530 }
2531 }
2532 return rv;
2533 }
2534
2535 /* Add multicast source filter list to the interface list */
ip6_mc_add_src(struct inet6_dev * idev,const struct in6_addr * pmca,int sfmode,int sfcount,const struct in6_addr * psfsrc,int delta)2536 static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
2537 int sfmode, int sfcount, const struct in6_addr *psfsrc,
2538 int delta)
2539 {
2540 struct ifmcaddr6 *pmc;
2541 int isexclude;
2542 int i, err;
2543
2544 if (!idev)
2545 return -ENODEV;
2546
2547 mc_assert_locked(idev);
2548
2549 for_each_mc_mclock(idev, pmc) {
2550 if (ipv6_addr_equal(pmca, &pmc->mca_addr))
2551 break;
2552 }
2553 if (!pmc)
2554 return -ESRCH;
2555
2556 sf_markstate(pmc);
2557 isexclude = pmc->mca_sfmode == MCAST_EXCLUDE;
2558 if (!delta)
2559 WRITE_ONCE(pmc->mca_sfcount[sfmode],
2560 pmc->mca_sfcount[sfmode] + 1);
2561 err = 0;
2562 for (i = 0; i < sfcount; i++) {
2563 err = ip6_mc_add1_src(pmc, sfmode, &psfsrc[i]);
2564 if (err)
2565 break;
2566 }
2567 if (err) {
2568 int j;
2569
2570 if (!delta)
2571 WRITE_ONCE(pmc->mca_sfcount[sfmode],
2572 pmc->mca_sfcount[sfmode] - 1);
2573 for (j = 0; j < i; j++)
2574 ip6_mc_del1_src(pmc, sfmode, &psfsrc[j]);
2575 } else if (isexclude != (pmc->mca_sfcount[MCAST_EXCLUDE] != 0)) {
2576 struct ip6_sf_list *psf;
2577
2578 /* filter mode change */
2579 if (pmc->mca_sfcount[MCAST_EXCLUDE])
2580 pmc->mca_sfmode = MCAST_EXCLUDE;
2581 else if (pmc->mca_sfcount[MCAST_INCLUDE])
2582 pmc->mca_sfmode = MCAST_INCLUDE;
2583 /* else no filters; keep old mode for reports */
2584
2585 pmc->mca_crcount = idev->mc_qrv;
2586 idev->mc_ifc_count = pmc->mca_crcount;
2587 for_each_psf_mclock(pmc, psf)
2588 psf->sf_crcount = 0;
2589 mld_ifc_event(idev);
2590 } else if (sf_setstate(pmc)) {
2591 mld_ifc_event(idev);
2592 }
2593 return err;
2594 }
2595
ip6_mc_clear_src(struct ifmcaddr6 * pmc)2596 static void ip6_mc_clear_src(struct ifmcaddr6 *pmc)
2597 {
2598 struct ip6_sf_list *psf, *nextpsf;
2599
2600 mc_assert_locked(pmc->idev);
2601
2602 for (psf = mc_dereference(pmc->mca_tomb, pmc->idev);
2603 psf;
2604 psf = nextpsf) {
2605 nextpsf = mc_dereference(psf->sf_next, pmc->idev);
2606 kfree_rcu(psf, rcu);
2607 }
2608 RCU_INIT_POINTER(pmc->mca_tomb, NULL);
2609 for (psf = mc_dereference(pmc->mca_sources, pmc->idev);
2610 psf;
2611 psf = nextpsf) {
2612 nextpsf = mc_dereference(psf->sf_next, pmc->idev);
2613 kfree_rcu(psf, rcu);
2614 }
2615 RCU_INIT_POINTER(pmc->mca_sources, NULL);
2616 pmc->mca_sfmode = MCAST_EXCLUDE;
2617 pmc->mca_sfcount[MCAST_INCLUDE] = 0;
2618 /* Paired with the READ_ONCE() from ipv6_chk_mcast_addr() */
2619 WRITE_ONCE(pmc->mca_sfcount[MCAST_EXCLUDE], 1);
2620 }
2621
igmp6_join_group(struct ifmcaddr6 * ma)2622 static void igmp6_join_group(struct ifmcaddr6 *ma)
2623 {
2624 unsigned long delay;
2625
2626 mc_assert_locked(ma->idev);
2627
2628 if (ma->mca_flags & MAF_NOREPORT)
2629 return;
2630
2631 igmp6_send(&ma->mca_addr, ma->idev->dev, ICMPV6_MGM_REPORT);
2632
2633 delay = get_random_u32_below(unsolicited_report_interval(ma->idev));
2634
2635 if (cancel_delayed_work(&ma->mca_work)) {
2636 refcount_dec(&ma->mca_refcnt);
2637 delay = ma->mca_work.timer.expires - jiffies;
2638 }
2639
2640 if (!mod_delayed_work(mld_wq, &ma->mca_work, delay))
2641 refcount_inc(&ma->mca_refcnt);
2642 WRITE_ONCE(ma->mca_flags, ma->mca_flags |
2643 MAF_TIMER_RUNNING | MAF_LAST_REPORTER);
2644 }
2645
ip6_mc_leave_src(struct sock * sk,struct ipv6_mc_socklist * iml,struct inet6_dev * idev)2646 static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
2647 struct inet6_dev *idev)
2648 {
2649 struct ip6_sf_socklist *psl;
2650 int err;
2651
2652 psl = sock_dereference(iml->sflist, sk);
2653
2654 if (idev)
2655 mutex_lock(&idev->mc_lock);
2656
2657 if (!psl) {
2658 /* any-source empty exclude case */
2659 err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 0, NULL, 0);
2660 } else {
2661 err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode,
2662 psl->sl_count, psl->sl_addr, 0);
2663 RCU_INIT_POINTER(iml->sflist, NULL);
2664 atomic_sub(struct_size(psl, sl_addr, psl->sl_max),
2665 &sk->sk_omem_alloc);
2666 kfree_rcu(psl, rcu);
2667 }
2668
2669 if (idev)
2670 mutex_unlock(&idev->mc_lock);
2671
2672 return err;
2673 }
2674
igmp6_leave_group(struct ifmcaddr6 * ma)2675 static void igmp6_leave_group(struct ifmcaddr6 *ma)
2676 {
2677 mc_assert_locked(ma->idev);
2678
2679 if (mld_in_v1_mode(ma->idev)) {
2680 if (ma->mca_flags & MAF_LAST_REPORTER) {
2681 igmp6_send(&ma->mca_addr, ma->idev->dev,
2682 ICMPV6_MGM_REDUCTION);
2683 }
2684 } else {
2685 mld_add_delrec(ma->idev, ma);
2686 mld_ifc_event(ma->idev);
2687 }
2688 }
2689
mld_gq_work(struct work_struct * work)2690 static void mld_gq_work(struct work_struct *work)
2691 {
2692 struct inet6_dev *idev = container_of(to_delayed_work(work),
2693 struct inet6_dev,
2694 mc_gq_work);
2695
2696 mutex_lock(&idev->mc_lock);
2697 mld_send_report(idev, NULL);
2698 idev->mc_gq_running = 0;
2699 mutex_unlock(&idev->mc_lock);
2700
2701 in6_dev_put(idev);
2702 }
2703
mld_ifc_work(struct work_struct * work)2704 static void mld_ifc_work(struct work_struct *work)
2705 {
2706 struct inet6_dev *idev = container_of(to_delayed_work(work),
2707 struct inet6_dev,
2708 mc_ifc_work);
2709
2710 mutex_lock(&idev->mc_lock);
2711 mld_send_cr(idev);
2712
2713 if (idev->mc_ifc_count) {
2714 idev->mc_ifc_count--;
2715 if (idev->mc_ifc_count)
2716 mld_ifc_start_work(idev,
2717 unsolicited_report_interval(idev));
2718 }
2719 mutex_unlock(&idev->mc_lock);
2720 in6_dev_put(idev);
2721 }
2722
mld_ifc_event(struct inet6_dev * idev)2723 static void mld_ifc_event(struct inet6_dev *idev)
2724 {
2725 mc_assert_locked(idev);
2726
2727 if (mld_in_v1_mode(idev))
2728 return;
2729
2730 idev->mc_ifc_count = idev->mc_qrv;
2731 mld_ifc_start_work(idev, 1);
2732 }
2733
mld_mca_work(struct work_struct * work)2734 static void mld_mca_work(struct work_struct *work)
2735 {
2736 struct ifmcaddr6 *ma = container_of(to_delayed_work(work),
2737 struct ifmcaddr6, mca_work);
2738
2739 mutex_lock(&ma->idev->mc_lock);
2740 if (mld_in_v1_mode(ma->idev))
2741 igmp6_send(&ma->mca_addr, ma->idev->dev, ICMPV6_MGM_REPORT);
2742 else
2743 mld_send_report(ma->idev, ma);
2744 WRITE_ONCE(ma->mca_flags, (ma->mca_flags | MAF_LAST_REPORTER) &
2745 ~MAF_TIMER_RUNNING);
2746 mutex_unlock(&ma->idev->mc_lock);
2747
2748 ma_put(ma);
2749 }
2750
2751 /* Device changing type */
2752
ipv6_mc_unmap(struct inet6_dev * idev)2753 void ipv6_mc_unmap(struct inet6_dev *idev)
2754 {
2755 struct ifmcaddr6 *i;
2756
2757 /* Install multicast list, except for all-nodes (already installed) */
2758
2759 mutex_lock(&idev->mc_lock);
2760 for_each_mc_mclock(idev, i)
2761 igmp6_group_dropped(i);
2762 mutex_unlock(&idev->mc_lock);
2763 }
2764
ipv6_mc_remap(struct inet6_dev * idev)2765 void ipv6_mc_remap(struct inet6_dev *idev)
2766 {
2767 ipv6_mc_up(idev);
2768 }
2769
2770 /* Device going down */
ipv6_mc_down(struct inet6_dev * idev)2771 void ipv6_mc_down(struct inet6_dev *idev)
2772 {
2773 struct ifmcaddr6 *i;
2774
2775 mutex_lock(&idev->mc_lock);
2776 /* Withdraw multicast list */
2777 for_each_mc_mclock(idev, i)
2778 igmp6_group_dropped(i);
2779 mutex_unlock(&idev->mc_lock);
2780
2781 /* Should stop work after group drop. or we will
2782 * start work again in mld_ifc_event()
2783 */
2784 mld_query_stop_work(idev);
2785 mld_report_stop_work(idev);
2786
2787 mutex_lock(&idev->mc_lock);
2788 mld_ifc_stop_work(idev);
2789 mld_gq_stop_work(idev);
2790 mutex_unlock(&idev->mc_lock);
2791
2792 mld_dad_stop_work(idev);
2793 }
2794
ipv6_mc_reset(struct inet6_dev * idev)2795 static void ipv6_mc_reset(struct inet6_dev *idev)
2796 {
2797 idev->mc_qrv = sysctl_mld_qrv;
2798 idev->mc_qi = MLD_QI_DEFAULT;
2799 idev->mc_qri = MLD_QRI_DEFAULT;
2800 idev->mc_v1_seen = 0;
2801 idev->mc_maxdelay = unsolicited_report_interval(idev);
2802 }
2803
2804 /* Device going up */
2805
ipv6_mc_up(struct inet6_dev * idev)2806 void ipv6_mc_up(struct inet6_dev *idev)
2807 {
2808 struct ifmcaddr6 *i;
2809
2810 /* Install multicast list, except for all-nodes (already installed) */
2811
2812 ipv6_mc_reset(idev);
2813 mutex_lock(&idev->mc_lock);
2814 for_each_mc_mclock(idev, i) {
2815 mld_del_delrec(idev, i);
2816 igmp6_group_added(i);
2817 }
2818 mutex_unlock(&idev->mc_lock);
2819 }
2820
2821 /* IPv6 device initialization. */
2822
ipv6_mc_init_dev(struct inet6_dev * idev)2823 void ipv6_mc_init_dev(struct inet6_dev *idev)
2824 {
2825 idev->mc_gq_running = 0;
2826 INIT_DELAYED_WORK(&idev->mc_gq_work, mld_gq_work);
2827 RCU_INIT_POINTER(idev->mc_tomb, NULL);
2828 idev->mc_ifc_count = 0;
2829 INIT_DELAYED_WORK(&idev->mc_ifc_work, mld_ifc_work);
2830 INIT_DELAYED_WORK(&idev->mc_dad_work, mld_dad_work);
2831 INIT_DELAYED_WORK(&idev->mc_query_work, mld_query_work);
2832 INIT_DELAYED_WORK(&idev->mc_report_work, mld_report_work);
2833 skb_queue_head_init(&idev->mc_query_queue);
2834 skb_queue_head_init(&idev->mc_report_queue);
2835 spin_lock_init(&idev->mc_query_lock);
2836 spin_lock_init(&idev->mc_report_lock);
2837 mutex_init(&idev->mc_lock);
2838 ipv6_mc_reset(idev);
2839 }
2840
2841 /*
2842 * Device is about to be destroyed: clean up.
2843 */
2844
ipv6_mc_destroy_dev(struct inet6_dev * idev)2845 void ipv6_mc_destroy_dev(struct inet6_dev *idev)
2846 {
2847 struct ifmcaddr6 *i;
2848
2849 /* Deactivate works */
2850 ipv6_mc_down(idev);
2851 mutex_lock(&idev->mc_lock);
2852 mld_clear_delrec(idev);
2853 mutex_unlock(&idev->mc_lock);
2854 mld_clear_query(idev);
2855 mld_clear_report(idev);
2856
2857 /* Delete all-nodes address. */
2858 /* We cannot call ipv6_dev_mc_dec() directly, our caller in
2859 * addrconf.c has NULL'd out dev->ip6_ptr so in6_dev_get() will
2860 * fail.
2861 */
2862 __ipv6_dev_mc_dec(idev, &in6addr_linklocal_allnodes);
2863
2864 if (idev->cnf.forwarding)
2865 __ipv6_dev_mc_dec(idev, &in6addr_linklocal_allrouters);
2866
2867 mutex_lock(&idev->mc_lock);
2868 while ((i = mc_dereference(idev->mc_list, idev))) {
2869 rcu_assign_pointer(idev->mc_list, mc_dereference(i->next, idev));
2870
2871 ip6_mc_clear_src(i);
2872 ma_put(i);
2873 }
2874 mutex_unlock(&idev->mc_lock);
2875 }
2876
ipv6_mc_rejoin_groups(struct inet6_dev * idev)2877 static void ipv6_mc_rejoin_groups(struct inet6_dev *idev)
2878 {
2879 struct ifmcaddr6 *pmc;
2880
2881 mutex_lock(&idev->mc_lock);
2882 if (mld_in_v1_mode(idev)) {
2883 for_each_mc_mclock(idev, pmc)
2884 igmp6_join_group(pmc);
2885 } else {
2886 mld_send_report(idev, NULL);
2887 }
2888 mutex_unlock(&idev->mc_lock);
2889 }
2890
ipv6_mc_netdev_event(struct notifier_block * this,unsigned long event,void * ptr)2891 static int ipv6_mc_netdev_event(struct notifier_block *this,
2892 unsigned long event,
2893 void *ptr)
2894 {
2895 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
2896 struct inet6_dev *idev = __in6_dev_get(dev);
2897
2898 switch (event) {
2899 case NETDEV_RESEND_IGMP:
2900 if (idev)
2901 ipv6_mc_rejoin_groups(idev);
2902 break;
2903 default:
2904 break;
2905 }
2906
2907 return NOTIFY_DONE;
2908 }
2909
2910 static struct notifier_block igmp6_netdev_notifier = {
2911 .notifier_call = ipv6_mc_netdev_event,
2912 };
2913
2914 #ifdef CONFIG_PROC_FS
2915 struct igmp6_mc_iter_state {
2916 struct seq_net_private p;
2917 struct net_device *dev;
2918 struct inet6_dev *idev;
2919 };
2920
2921 #define igmp6_mc_seq_private(seq) ((struct igmp6_mc_iter_state *)(seq)->private)
2922
igmp6_mc_get_first(struct seq_file * seq)2923 static inline struct ifmcaddr6 *igmp6_mc_get_first(struct seq_file *seq)
2924 {
2925 struct ifmcaddr6 *im = NULL;
2926 struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
2927 struct net *net = seq_file_net(seq);
2928
2929 state->idev = NULL;
2930 for_each_netdev_rcu(net, state->dev) {
2931 struct inet6_dev *idev;
2932 idev = __in6_dev_get(state->dev);
2933 if (!idev)
2934 continue;
2935
2936 im = rcu_dereference(idev->mc_list);
2937 if (im) {
2938 state->idev = idev;
2939 break;
2940 }
2941 }
2942 return im;
2943 }
2944
igmp6_mc_get_next(struct seq_file * seq,struct ifmcaddr6 * im)2945 static struct ifmcaddr6 *igmp6_mc_get_next(struct seq_file *seq, struct ifmcaddr6 *im)
2946 {
2947 struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
2948
2949 im = rcu_dereference(im->next);
2950 while (!im) {
2951 state->dev = next_net_device_rcu(state->dev);
2952 if (!state->dev) {
2953 state->idev = NULL;
2954 break;
2955 }
2956 state->idev = __in6_dev_get(state->dev);
2957 if (!state->idev)
2958 continue;
2959 im = rcu_dereference(state->idev->mc_list);
2960 }
2961 return im;
2962 }
2963
igmp6_mc_get_idx(struct seq_file * seq,loff_t pos)2964 static struct ifmcaddr6 *igmp6_mc_get_idx(struct seq_file *seq, loff_t pos)
2965 {
2966 struct ifmcaddr6 *im = igmp6_mc_get_first(seq);
2967 if (im)
2968 while (pos && (im = igmp6_mc_get_next(seq, im)) != NULL)
2969 --pos;
2970 return pos ? NULL : im;
2971 }
2972
igmp6_mc_seq_start(struct seq_file * seq,loff_t * pos)2973 static void *igmp6_mc_seq_start(struct seq_file *seq, loff_t *pos)
2974 __acquires(RCU)
2975 {
2976 rcu_read_lock();
2977 return igmp6_mc_get_idx(seq, *pos);
2978 }
2979
igmp6_mc_seq_next(struct seq_file * seq,void * v,loff_t * pos)2980 static void *igmp6_mc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2981 {
2982 struct ifmcaddr6 *im = igmp6_mc_get_next(seq, v);
2983
2984 ++*pos;
2985 return im;
2986 }
2987
igmp6_mc_seq_stop(struct seq_file * seq,void * v)2988 static void igmp6_mc_seq_stop(struct seq_file *seq, void *v)
2989 __releases(RCU)
2990 {
2991 struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
2992
2993 if (likely(state->idev))
2994 state->idev = NULL;
2995 state->dev = NULL;
2996 rcu_read_unlock();
2997 }
2998
igmp6_mc_seq_show(struct seq_file * seq,void * v)2999 static int igmp6_mc_seq_show(struct seq_file *seq, void *v)
3000 {
3001 struct ifmcaddr6 *im = (struct ifmcaddr6 *)v;
3002 struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
3003 unsigned int mca_flags = READ_ONCE(im->mca_flags);
3004 unsigned long expires = READ_ONCE(im->mca_work.timer.expires);
3005
3006 seq_printf(seq,
3007 "%-4d %-15s %pi6 %5d %08X %ld\n",
3008 state->dev->ifindex, state->dev->name,
3009 &im->mca_addr,
3010 READ_ONCE(im->mca_users), mca_flags,
3011 (mca_flags & MAF_TIMER_RUNNING) ?
3012 jiffies_to_clock_t(expires - jiffies) : 0);
3013 return 0;
3014 }
3015
3016 static const struct seq_operations igmp6_mc_seq_ops = {
3017 .start = igmp6_mc_seq_start,
3018 .next = igmp6_mc_seq_next,
3019 .stop = igmp6_mc_seq_stop,
3020 .show = igmp6_mc_seq_show,
3021 };
3022
3023 struct igmp6_mcf_iter_state {
3024 struct seq_net_private p;
3025 struct net_device *dev;
3026 struct inet6_dev *idev;
3027 struct ifmcaddr6 *im;
3028 };
3029
3030 #define igmp6_mcf_seq_private(seq) ((struct igmp6_mcf_iter_state *)(seq)->private)
3031
igmp6_mcf_get_first(struct seq_file * seq)3032 static inline struct ip6_sf_list *igmp6_mcf_get_first(struct seq_file *seq)
3033 {
3034 struct ip6_sf_list *psf = NULL;
3035 struct ifmcaddr6 *im = NULL;
3036 struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
3037 struct net *net = seq_file_net(seq);
3038
3039 state->idev = NULL;
3040 state->im = NULL;
3041 for_each_netdev_rcu(net, state->dev) {
3042 struct inet6_dev *idev;
3043 idev = __in6_dev_get(state->dev);
3044 if (unlikely(idev == NULL))
3045 continue;
3046
3047 im = rcu_dereference(idev->mc_list);
3048 if (likely(im)) {
3049 psf = rcu_dereference(im->mca_sources);
3050 if (likely(psf)) {
3051 state->im = im;
3052 state->idev = idev;
3053 break;
3054 }
3055 }
3056 }
3057 return psf;
3058 }
3059
igmp6_mcf_get_next(struct seq_file * seq,struct ip6_sf_list * psf)3060 static struct ip6_sf_list *igmp6_mcf_get_next(struct seq_file *seq, struct ip6_sf_list *psf)
3061 {
3062 struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
3063
3064 psf = rcu_dereference(psf->sf_next);
3065 while (!psf) {
3066 state->im = rcu_dereference(state->im->next);
3067 while (!state->im) {
3068 state->dev = next_net_device_rcu(state->dev);
3069 if (!state->dev) {
3070 state->idev = NULL;
3071 goto out;
3072 }
3073 state->idev = __in6_dev_get(state->dev);
3074 if (!state->idev)
3075 continue;
3076 state->im = rcu_dereference(state->idev->mc_list);
3077 }
3078 psf = rcu_dereference(state->im->mca_sources);
3079 }
3080 out:
3081 return psf;
3082 }
3083
igmp6_mcf_get_idx(struct seq_file * seq,loff_t pos)3084 static struct ip6_sf_list *igmp6_mcf_get_idx(struct seq_file *seq, loff_t pos)
3085 {
3086 struct ip6_sf_list *psf = igmp6_mcf_get_first(seq);
3087 if (psf)
3088 while (pos && (psf = igmp6_mcf_get_next(seq, psf)) != NULL)
3089 --pos;
3090 return pos ? NULL : psf;
3091 }
3092
igmp6_mcf_seq_start(struct seq_file * seq,loff_t * pos)3093 static void *igmp6_mcf_seq_start(struct seq_file *seq, loff_t *pos)
3094 __acquires(RCU)
3095 {
3096 rcu_read_lock();
3097 return *pos ? igmp6_mcf_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
3098 }
3099
igmp6_mcf_seq_next(struct seq_file * seq,void * v,loff_t * pos)3100 static void *igmp6_mcf_seq_next(struct seq_file *seq, void *v, loff_t *pos)
3101 {
3102 struct ip6_sf_list *psf;
3103 if (v == SEQ_START_TOKEN)
3104 psf = igmp6_mcf_get_first(seq);
3105 else
3106 psf = igmp6_mcf_get_next(seq, v);
3107 ++*pos;
3108 return psf;
3109 }
3110
igmp6_mcf_seq_stop(struct seq_file * seq,void * v)3111 static void igmp6_mcf_seq_stop(struct seq_file *seq, void *v)
3112 __releases(RCU)
3113 {
3114 struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
3115
3116 if (likely(state->im))
3117 state->im = NULL;
3118 if (likely(state->idev))
3119 state->idev = NULL;
3120
3121 state->dev = NULL;
3122 rcu_read_unlock();
3123 }
3124
igmp6_mcf_seq_show(struct seq_file * seq,void * v)3125 static int igmp6_mcf_seq_show(struct seq_file *seq, void *v)
3126 {
3127 struct ip6_sf_list *psf = (struct ip6_sf_list *)v;
3128 struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
3129
3130 if (v == SEQ_START_TOKEN) {
3131 seq_puts(seq, "Idx Device Multicast Address Source Address INC EXC\n");
3132 } else {
3133 seq_printf(seq,
3134 "%3d %6.6s %pi6 %pi6 %6lu %6lu\n",
3135 state->dev->ifindex, state->dev->name,
3136 &state->im->mca_addr,
3137 &psf->sf_addr,
3138 READ_ONCE(psf->sf_count[MCAST_INCLUDE]),
3139 READ_ONCE(psf->sf_count[MCAST_EXCLUDE]));
3140 }
3141 return 0;
3142 }
3143
3144 static const struct seq_operations igmp6_mcf_seq_ops = {
3145 .start = igmp6_mcf_seq_start,
3146 .next = igmp6_mcf_seq_next,
3147 .stop = igmp6_mcf_seq_stop,
3148 .show = igmp6_mcf_seq_show,
3149 };
3150
igmp6_proc_init(struct net * net)3151 static int __net_init igmp6_proc_init(struct net *net)
3152 {
3153 int err;
3154
3155 err = -ENOMEM;
3156 if (!proc_create_net("igmp6", 0444, net->proc_net, &igmp6_mc_seq_ops,
3157 sizeof(struct igmp6_mc_iter_state)))
3158 goto out;
3159 if (!proc_create_net("mcfilter6", 0444, net->proc_net,
3160 &igmp6_mcf_seq_ops,
3161 sizeof(struct igmp6_mcf_iter_state)))
3162 goto out_proc_net_igmp6;
3163
3164 err = 0;
3165 out:
3166 return err;
3167
3168 out_proc_net_igmp6:
3169 remove_proc_entry("igmp6", net->proc_net);
3170 goto out;
3171 }
3172
igmp6_proc_exit(struct net * net)3173 static void __net_exit igmp6_proc_exit(struct net *net)
3174 {
3175 remove_proc_entry("mcfilter6", net->proc_net);
3176 remove_proc_entry("igmp6", net->proc_net);
3177 }
3178 #else
igmp6_proc_init(struct net * net)3179 static inline int igmp6_proc_init(struct net *net)
3180 {
3181 return 0;
3182 }
igmp6_proc_exit(struct net * net)3183 static inline void igmp6_proc_exit(struct net *net)
3184 {
3185 }
3186 #endif
3187
igmp6_net_init(struct net * net)3188 static int __net_init igmp6_net_init(struct net *net)
3189 {
3190 int err;
3191
3192 err = inet_ctl_sock_create(&net->ipv6.igmp_sk, PF_INET6,
3193 SOCK_RAW, IPPROTO_ICMPV6, net);
3194 if (err < 0) {
3195 pr_err("Failed to initialize the IGMP6 control socket (err %d)\n",
3196 err);
3197 goto out;
3198 }
3199
3200 inet6_sk(net->ipv6.igmp_sk)->hop_limit = 1;
3201 net->ipv6.igmp_sk->sk_allocation = GFP_KERNEL;
3202
3203 err = inet_ctl_sock_create(&net->ipv6.mc_autojoin_sk, PF_INET6,
3204 SOCK_RAW, IPPROTO_ICMPV6, net);
3205 if (err < 0) {
3206 pr_err("Failed to initialize the IGMP6 autojoin socket (err %d)\n",
3207 err);
3208 goto out_sock_create;
3209 }
3210
3211 err = igmp6_proc_init(net);
3212 if (err)
3213 goto out_sock_create_autojoin;
3214
3215 return 0;
3216
3217 out_sock_create_autojoin:
3218 inet_ctl_sock_destroy(net->ipv6.mc_autojoin_sk);
3219 out_sock_create:
3220 inet_ctl_sock_destroy(net->ipv6.igmp_sk);
3221 out:
3222 return err;
3223 }
3224
igmp6_net_exit(struct net * net)3225 static void __net_exit igmp6_net_exit(struct net *net)
3226 {
3227 inet_ctl_sock_destroy(net->ipv6.igmp_sk);
3228 inet_ctl_sock_destroy(net->ipv6.mc_autojoin_sk);
3229 igmp6_proc_exit(net);
3230 }
3231
3232 static struct pernet_operations igmp6_net_ops = {
3233 .init = igmp6_net_init,
3234 .exit = igmp6_net_exit,
3235 };
3236
igmp6_init(void)3237 int __init igmp6_init(void)
3238 {
3239 int err;
3240
3241 err = register_pernet_subsys(&igmp6_net_ops);
3242 if (err)
3243 return err;
3244
3245 mld_wq = create_workqueue("mld");
3246 if (!mld_wq) {
3247 unregister_pernet_subsys(&igmp6_net_ops);
3248 return -ENOMEM;
3249 }
3250
3251 return err;
3252 }
3253
igmp6_late_init(void)3254 int __init igmp6_late_init(void)
3255 {
3256 return register_netdevice_notifier(&igmp6_netdev_notifier);
3257 }
3258
igmp6_cleanup(void)3259 void igmp6_cleanup(void)
3260 {
3261 unregister_pernet_subsys(&igmp6_net_ops);
3262 destroy_workqueue(mld_wq);
3263 }
3264
igmp6_late_cleanup(void)3265 void igmp6_late_cleanup(void)
3266 {
3267 unregister_netdevice_notifier(&igmp6_netdev_notifier);
3268 }
3269