1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* Copyright (c) 2021 Taehee Yoo <ap420073@gmail.com> */ 3 4 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 5 6 #include <linux/module.h> 7 #include <linux/skbuff.h> 8 #include <linux/udp.h> 9 #include <linux/jhash.h> 10 #include <linux/if_tunnel.h> 11 #include <linux/net.h> 12 #include <linux/igmp.h> 13 #include <linux/workqueue.h> 14 #include <net/flow.h> 15 #include <net/pkt_sched.h> 16 #include <net/net_namespace.h> 17 #include <net/ip.h> 18 #include <net/udp.h> 19 #include <net/udp_tunnel.h> 20 #include <net/icmp.h> 21 #include <net/mld.h> 22 #include <net/amt.h> 23 #include <uapi/linux/amt.h> 24 #include <linux/security.h> 25 #include <net/gro_cells.h> 26 #include <net/ipv6.h> 27 #include <net/if_inet6.h> 28 #include <net/ndisc.h> 29 #include <net/addrconf.h> 30 #include <net/ip6_route.h> 31 #include <net/inet_common.h> 32 #include <net/inet_dscp.h> 33 #include <net/ip6_checksum.h> 34 35 static struct workqueue_struct *amt_wq; 36 37 static HLIST_HEAD(source_gc_list); 38 /* Lock for source_gc_list */ 39 static spinlock_t source_gc_lock; 40 static struct delayed_work source_gc_wq; 41 static char *status_str[] = { 42 "AMT_STATUS_INIT", 43 "AMT_STATUS_SENT_DISCOVERY", 44 "AMT_STATUS_RECEIVED_DISCOVERY", 45 "AMT_STATUS_SENT_ADVERTISEMENT", 46 "AMT_STATUS_RECEIVED_ADVERTISEMENT", 47 "AMT_STATUS_SENT_REQUEST", 48 "AMT_STATUS_RECEIVED_REQUEST", 49 "AMT_STATUS_SENT_QUERY", 50 "AMT_STATUS_RECEIVED_QUERY", 51 "AMT_STATUS_SENT_UPDATE", 52 "AMT_STATUS_RECEIVED_UPDATE", 53 }; 54 55 static char *type_str[] = { 56 "", /* Type 0 is not defined */ 57 "AMT_MSG_DISCOVERY", 58 "AMT_MSG_ADVERTISEMENT", 59 "AMT_MSG_REQUEST", 60 "AMT_MSG_MEMBERSHIP_QUERY", 61 "AMT_MSG_MEMBERSHIP_UPDATE", 62 "AMT_MSG_MULTICAST_DATA", 63 "AMT_MSG_TEARDOWN", 64 }; 65 66 static char *action_str[] = { 67 "AMT_ACT_GMI", 68 "AMT_ACT_GMI_ZERO", 69 "AMT_ACT_GT", 70 "AMT_ACT_STATUS_FWD_NEW", 71 "AMT_ACT_STATUS_D_FWD_NEW", 72 "AMT_ACT_STATUS_NONE_NEW", 73 }; 74 75 static struct igmpv3_grec igmpv3_zero_grec; 76 77 #if IS_ENABLED(CONFIG_IPV6) 78 #define MLD2_ALL_NODE_INIT { { { 0xff, 0x02, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x01 } } } 79 static struct in6_addr mld2_all_node = MLD2_ALL_NODE_INIT; 80 static struct mld2_grec mldv2_zero_grec; 81 #endif 82 83 static struct amt_skb_cb *amt_skb_cb(struct sk_buff *skb) 84 { 85 BUILD_BUG_ON(sizeof(struct amt_skb_cb) + sizeof(struct tc_skb_cb) > 86 sizeof_field(struct sk_buff, cb)); 87 88 return (struct amt_skb_cb *)((void *)skb->cb + 89 sizeof(struct tc_skb_cb)); 90 } 91 92 static void __amt_source_gc_work(void) 93 { 94 struct amt_source_node *snode; 95 struct hlist_head gc_list; 96 struct hlist_node *t; 97 98 spin_lock_bh(&source_gc_lock); 99 hlist_move_list(&source_gc_list, &gc_list); 100 spin_unlock_bh(&source_gc_lock); 101 102 hlist_for_each_entry_safe(snode, t, &gc_list, node) { 103 hlist_del_rcu(&snode->node); 104 kfree_rcu(snode, rcu); 105 } 106 } 107 108 static void amt_source_gc_work(struct work_struct *work) 109 { 110 __amt_source_gc_work(); 111 112 spin_lock_bh(&source_gc_lock); 113 mod_delayed_work(amt_wq, &source_gc_wq, 114 msecs_to_jiffies(AMT_GC_INTERVAL)); 115 spin_unlock_bh(&source_gc_lock); 116 } 117 118 static bool amt_addr_equal(union amt_addr *a, union amt_addr *b) 119 { 120 return !memcmp(a, b, sizeof(union amt_addr)); 121 } 122 123 static u32 amt_source_hash(struct amt_tunnel_list *tunnel, union amt_addr *src) 124 { 125 u32 hash = jhash(src, sizeof(*src), tunnel->amt->hash_seed); 126 127 return reciprocal_scale(hash, tunnel->amt->hash_buckets); 128 } 129 130 static bool amt_status_filter(struct amt_source_node *snode, 131 enum amt_filter filter) 132 { 133 bool rc = false; 134 135 switch (filter) { 136 case AMT_FILTER_FWD: 137 if (snode->status == AMT_SOURCE_STATUS_FWD && 138 snode->flags == AMT_SOURCE_OLD) 139 rc = true; 140 break; 141 case AMT_FILTER_D_FWD: 142 if (snode->status == AMT_SOURCE_STATUS_D_FWD && 143 snode->flags == AMT_SOURCE_OLD) 144 rc = true; 145 break; 146 case AMT_FILTER_FWD_NEW: 147 if (snode->status == AMT_SOURCE_STATUS_FWD && 148 snode->flags == AMT_SOURCE_NEW) 149 rc = true; 150 break; 151 case AMT_FILTER_D_FWD_NEW: 152 if (snode->status == AMT_SOURCE_STATUS_D_FWD && 153 snode->flags == AMT_SOURCE_NEW) 154 rc = true; 155 break; 156 case AMT_FILTER_ALL: 157 rc = true; 158 break; 159 case AMT_FILTER_NONE_NEW: 160 if (snode->status == AMT_SOURCE_STATUS_NONE && 161 snode->flags == AMT_SOURCE_NEW) 162 rc = true; 163 break; 164 case AMT_FILTER_BOTH: 165 if ((snode->status == AMT_SOURCE_STATUS_D_FWD || 166 snode->status == AMT_SOURCE_STATUS_FWD) && 167 snode->flags == AMT_SOURCE_OLD) 168 rc = true; 169 break; 170 case AMT_FILTER_BOTH_NEW: 171 if ((snode->status == AMT_SOURCE_STATUS_D_FWD || 172 snode->status == AMT_SOURCE_STATUS_FWD) && 173 snode->flags == AMT_SOURCE_NEW) 174 rc = true; 175 break; 176 default: 177 WARN_ON_ONCE(1); 178 break; 179 } 180 181 return rc; 182 } 183 184 static struct amt_source_node *amt_lookup_src(struct amt_tunnel_list *tunnel, 185 struct amt_group_node *gnode, 186 enum amt_filter filter, 187 union amt_addr *src) 188 { 189 u32 hash = amt_source_hash(tunnel, src); 190 struct amt_source_node *snode; 191 192 hlist_for_each_entry_rcu(snode, &gnode->sources[hash], node) 193 if (amt_status_filter(snode, filter) && 194 amt_addr_equal(&snode->source_addr, src)) 195 return snode; 196 197 return NULL; 198 } 199 200 static u32 amt_group_hash(struct amt_tunnel_list *tunnel, union amt_addr *group) 201 { 202 u32 hash = jhash(group, sizeof(*group), tunnel->amt->hash_seed); 203 204 return reciprocal_scale(hash, tunnel->amt->hash_buckets); 205 } 206 207 static struct amt_group_node *amt_lookup_group(struct amt_tunnel_list *tunnel, 208 union amt_addr *group, 209 union amt_addr *host, 210 bool v6) 211 { 212 u32 hash = amt_group_hash(tunnel, group); 213 struct amt_group_node *gnode; 214 215 hlist_for_each_entry_rcu(gnode, &tunnel->groups[hash], node) { 216 if (amt_addr_equal(&gnode->group_addr, group) && 217 amt_addr_equal(&gnode->host_addr, host) && 218 gnode->v6 == v6) 219 return gnode; 220 } 221 222 return NULL; 223 } 224 225 static void amt_destroy_source(struct amt_source_node *snode) 226 { 227 struct amt_group_node *gnode = snode->gnode; 228 struct amt_tunnel_list *tunnel; 229 230 tunnel = gnode->tunnel_list; 231 232 if (!gnode->v6) { 233 netdev_dbg(snode->gnode->amt->dev, 234 "Delete source %pI4 from %pI4\n", 235 &snode->source_addr.ip4, 236 &gnode->group_addr.ip4); 237 #if IS_ENABLED(CONFIG_IPV6) 238 } else { 239 netdev_dbg(snode->gnode->amt->dev, 240 "Delete source %pI6 from %pI6\n", 241 &snode->source_addr.ip6, 242 &gnode->group_addr.ip6); 243 #endif 244 } 245 246 cancel_delayed_work(&snode->source_timer); 247 hlist_del_init_rcu(&snode->node); 248 tunnel->nr_sources--; 249 gnode->nr_sources--; 250 spin_lock_bh(&source_gc_lock); 251 hlist_add_head_rcu(&snode->node, &source_gc_list); 252 spin_unlock_bh(&source_gc_lock); 253 } 254 255 static void amt_del_group(struct amt_dev *amt, struct amt_group_node *gnode) 256 { 257 struct amt_source_node *snode; 258 struct hlist_node *t; 259 int i; 260 261 if (cancel_delayed_work(&gnode->group_timer)) 262 dev_put(amt->dev); 263 hlist_del_rcu(&gnode->node); 264 gnode->tunnel_list->nr_groups--; 265 266 if (!gnode->v6) 267 netdev_dbg(amt->dev, "Leave group %pI4\n", 268 &gnode->group_addr.ip4); 269 #if IS_ENABLED(CONFIG_IPV6) 270 else 271 netdev_dbg(amt->dev, "Leave group %pI6\n", 272 &gnode->group_addr.ip6); 273 #endif 274 for (i = 0; i < amt->hash_buckets; i++) 275 hlist_for_each_entry_safe(snode, t, &gnode->sources[i], node) 276 amt_destroy_source(snode); 277 278 /* tunnel->lock was acquired outside of amt_del_group() 279 * But rcu_read_lock() was acquired too so It's safe. 280 */ 281 kfree_rcu(gnode, rcu); 282 } 283 284 /* If a source timer expires with a router filter-mode for the group of 285 * INCLUDE, the router concludes that traffic from this particular 286 * source is no longer desired on the attached network, and deletes the 287 * associated source record. 288 */ 289 static void amt_source_work(struct work_struct *work) 290 { 291 struct amt_source_node *snode = container_of(to_delayed_work(work), 292 struct amt_source_node, 293 source_timer); 294 struct amt_group_node *gnode = snode->gnode; 295 struct amt_dev *amt = gnode->amt; 296 struct amt_tunnel_list *tunnel; 297 298 tunnel = gnode->tunnel_list; 299 spin_lock_bh(&tunnel->lock); 300 rcu_read_lock(); 301 if (gnode->filter_mode == MCAST_INCLUDE) { 302 amt_destroy_source(snode); 303 if (!gnode->nr_sources) 304 amt_del_group(amt, gnode); 305 } else { 306 /* When a router filter-mode for a group is EXCLUDE, 307 * source records are only deleted when the group timer expires 308 */ 309 snode->status = AMT_SOURCE_STATUS_D_FWD; 310 } 311 rcu_read_unlock(); 312 spin_unlock_bh(&tunnel->lock); 313 } 314 315 static void amt_act_src(struct amt_tunnel_list *tunnel, 316 struct amt_group_node *gnode, 317 struct amt_source_node *snode, 318 enum amt_act act) 319 { 320 struct amt_dev *amt = tunnel->amt; 321 322 switch (act) { 323 case AMT_ACT_GMI: 324 mod_delayed_work(amt_wq, &snode->source_timer, 325 msecs_to_jiffies(amt_gmi(amt))); 326 break; 327 case AMT_ACT_GMI_ZERO: 328 cancel_delayed_work(&snode->source_timer); 329 break; 330 case AMT_ACT_GT: 331 mod_delayed_work(amt_wq, &snode->source_timer, 332 gnode->group_timer.timer.expires); 333 break; 334 case AMT_ACT_STATUS_FWD_NEW: 335 snode->status = AMT_SOURCE_STATUS_FWD; 336 snode->flags = AMT_SOURCE_NEW; 337 break; 338 case AMT_ACT_STATUS_D_FWD_NEW: 339 snode->status = AMT_SOURCE_STATUS_D_FWD; 340 snode->flags = AMT_SOURCE_NEW; 341 break; 342 case AMT_ACT_STATUS_NONE_NEW: 343 cancel_delayed_work(&snode->source_timer); 344 snode->status = AMT_SOURCE_STATUS_NONE; 345 snode->flags = AMT_SOURCE_NEW; 346 break; 347 default: 348 WARN_ON_ONCE(1); 349 return; 350 } 351 352 if (!gnode->v6) 353 netdev_dbg(amt->dev, "Source %pI4 from %pI4 Acted %s\n", 354 &snode->source_addr.ip4, 355 &gnode->group_addr.ip4, 356 action_str[act]); 357 #if IS_ENABLED(CONFIG_IPV6) 358 else 359 netdev_dbg(amt->dev, "Source %pI6 from %pI6 Acted %s\n", 360 &snode->source_addr.ip6, 361 &gnode->group_addr.ip6, 362 action_str[act]); 363 #endif 364 } 365 366 static struct amt_source_node *amt_alloc_snode(struct amt_group_node *gnode, 367 union amt_addr *src) 368 { 369 struct amt_source_node *snode; 370 371 snode = kzalloc_obj(*snode, GFP_ATOMIC); 372 if (!snode) 373 return NULL; 374 375 memcpy(&snode->source_addr, src, sizeof(union amt_addr)); 376 snode->gnode = gnode; 377 snode->status = AMT_SOURCE_STATUS_NONE; 378 snode->flags = AMT_SOURCE_NEW; 379 INIT_HLIST_NODE(&snode->node); 380 INIT_DELAYED_WORK(&snode->source_timer, amt_source_work); 381 382 return snode; 383 } 384 385 /* RFC 3810 - 7.2.2. Definition of Filter Timers 386 * 387 * Router Mode Filter Timer Actions/Comments 388 * ----------- ----------------- ---------------- 389 * 390 * INCLUDE Not Used All listeners in 391 * INCLUDE mode. 392 * 393 * EXCLUDE Timer > 0 At least one listener 394 * in EXCLUDE mode. 395 * 396 * EXCLUDE Timer == 0 No more listeners in 397 * EXCLUDE mode for the 398 * multicast address. 399 * If the Requested List 400 * is empty, delete 401 * Multicast Address 402 * Record. If not, switch 403 * to INCLUDE filter mode; 404 * the sources in the 405 * Requested List are 406 * moved to the Include 407 * List, and the Exclude 408 * List is deleted. 409 */ 410 static void amt_group_work(struct work_struct *work) 411 { 412 struct amt_group_node *gnode = container_of(to_delayed_work(work), 413 struct amt_group_node, 414 group_timer); 415 struct amt_tunnel_list *tunnel = gnode->tunnel_list; 416 struct amt_dev *amt = gnode->amt; 417 struct amt_source_node *snode; 418 bool delete_group = true; 419 struct hlist_node *t; 420 int i, buckets; 421 422 buckets = amt->hash_buckets; 423 424 spin_lock_bh(&tunnel->lock); 425 if (gnode->filter_mode == MCAST_INCLUDE) { 426 /* Not Used */ 427 spin_unlock_bh(&tunnel->lock); 428 goto out; 429 } 430 431 rcu_read_lock(); 432 for (i = 0; i < buckets; i++) { 433 hlist_for_each_entry_safe(snode, t, 434 &gnode->sources[i], node) { 435 if (!delayed_work_pending(&snode->source_timer) || 436 snode->status == AMT_SOURCE_STATUS_D_FWD) { 437 amt_destroy_source(snode); 438 } else { 439 delete_group = false; 440 snode->status = AMT_SOURCE_STATUS_FWD; 441 } 442 } 443 } 444 if (delete_group) 445 amt_del_group(amt, gnode); 446 else 447 gnode->filter_mode = MCAST_INCLUDE; 448 rcu_read_unlock(); 449 spin_unlock_bh(&tunnel->lock); 450 out: 451 dev_put(amt->dev); 452 } 453 454 /* Non-existent group is created as INCLUDE {empty}: 455 * 456 * RFC 3376 - 5.1. Action on Change of Interface State 457 * 458 * If no interface state existed for that multicast address before 459 * the change (i.e., the change consisted of creating a new 460 * per-interface record), or if no state exists after the change 461 * (i.e., the change consisted of deleting a per-interface record), 462 * then the "non-existent" state is considered to have a filter mode 463 * of INCLUDE and an empty source list. 464 */ 465 static struct amt_group_node *amt_add_group(struct amt_dev *amt, 466 struct amt_tunnel_list *tunnel, 467 union amt_addr *group, 468 union amt_addr *host, 469 bool v6) 470 { 471 struct amt_group_node *gnode; 472 u32 hash; 473 int i; 474 475 if (tunnel->nr_groups >= amt->max_groups) 476 return ERR_PTR(-ENOSPC); 477 478 gnode = kzalloc(sizeof(*gnode) + 479 (sizeof(struct hlist_head) * amt->hash_buckets), 480 GFP_ATOMIC); 481 if (unlikely(!gnode)) 482 return ERR_PTR(-ENOMEM); 483 484 gnode->amt = amt; 485 gnode->group_addr = *group; 486 gnode->host_addr = *host; 487 gnode->v6 = v6; 488 gnode->tunnel_list = tunnel; 489 gnode->filter_mode = MCAST_INCLUDE; 490 INIT_HLIST_NODE(&gnode->node); 491 INIT_DELAYED_WORK(&gnode->group_timer, amt_group_work); 492 for (i = 0; i < amt->hash_buckets; i++) 493 INIT_HLIST_HEAD(&gnode->sources[i]); 494 495 hash = amt_group_hash(tunnel, group); 496 hlist_add_head_rcu(&gnode->node, &tunnel->groups[hash]); 497 tunnel->nr_groups++; 498 499 if (!gnode->v6) 500 netdev_dbg(amt->dev, "Join group %pI4\n", 501 &gnode->group_addr.ip4); 502 #if IS_ENABLED(CONFIG_IPV6) 503 else 504 netdev_dbg(amt->dev, "Join group %pI6\n", 505 &gnode->group_addr.ip6); 506 #endif 507 508 return gnode; 509 } 510 511 static struct sk_buff *amt_build_igmp_gq(struct amt_dev *amt) 512 { 513 u8 ra[AMT_IPHDR_OPTS] = { IPOPT_RA, 4, 0, 0 }; 514 int hlen = LL_RESERVED_SPACE(amt->dev); 515 int tlen = amt->dev->needed_tailroom; 516 struct igmpv3_query *ihv3; 517 void *csum_start = NULL; 518 __sum16 *csum = NULL; 519 struct sk_buff *skb; 520 struct ethhdr *eth; 521 struct iphdr *iph; 522 unsigned int len; 523 int offset; 524 525 len = hlen + tlen + sizeof(*iph) + AMT_IPHDR_OPTS + sizeof(*ihv3); 526 skb = netdev_alloc_skb_ip_align(amt->dev, len); 527 if (!skb) 528 return NULL; 529 530 skb_reserve(skb, hlen); 531 skb_push(skb, sizeof(*eth)); 532 skb->protocol = htons(ETH_P_IP); 533 skb_reset_mac_header(skb); 534 skb->priority = TC_PRIO_CONTROL; 535 skb_put(skb, sizeof(*iph)); 536 skb_put_data(skb, ra, sizeof(ra)); 537 skb_put(skb, sizeof(*ihv3)); 538 skb_pull(skb, sizeof(*eth)); 539 skb_reset_network_header(skb); 540 541 iph = ip_hdr(skb); 542 iph->version = 4; 543 iph->ihl = (sizeof(struct iphdr) + AMT_IPHDR_OPTS) >> 2; 544 iph->tos = AMT_TOS; 545 iph->tot_len = htons(sizeof(*iph) + AMT_IPHDR_OPTS + sizeof(*ihv3)); 546 iph->frag_off = htons(IP_DF); 547 iph->ttl = 1; 548 iph->id = 0; 549 iph->protocol = IPPROTO_IGMP; 550 iph->daddr = htonl(INADDR_ALLHOSTS_GROUP); 551 iph->saddr = htonl(INADDR_ANY); 552 ip_send_check(iph); 553 554 eth = eth_hdr(skb); 555 ether_addr_copy(eth->h_source, amt->dev->dev_addr); 556 ip_eth_mc_map(htonl(INADDR_ALLHOSTS_GROUP), eth->h_dest); 557 eth->h_proto = htons(ETH_P_IP); 558 559 ihv3 = skb_pull(skb, sizeof(*iph) + AMT_IPHDR_OPTS); 560 skb_reset_transport_header(skb); 561 ihv3->type = IGMP_HOST_MEMBERSHIP_QUERY; 562 ihv3->code = 1; 563 ihv3->group = 0; 564 ihv3->qqic = amt->qi; 565 ihv3->nsrcs = 0; 566 ihv3->resv = 0; 567 ihv3->suppress = false; 568 ihv3->qrv = READ_ONCE(amt->net->ipv4.sysctl_igmp_qrv); 569 ihv3->csum = 0; 570 csum = &ihv3->csum; 571 csum_start = (void *)ihv3; 572 *csum = ip_compute_csum(csum_start, sizeof(*ihv3)); 573 offset = skb_transport_offset(skb); 574 skb->csum = skb_checksum(skb, offset, skb->len - offset, 0); 575 skb->ip_summed = CHECKSUM_NONE; 576 577 skb_push(skb, sizeof(*eth) + sizeof(*iph) + AMT_IPHDR_OPTS); 578 579 return skb; 580 } 581 582 static void amt_update_gw_status(struct amt_dev *amt, enum amt_status status, 583 bool validate) 584 { 585 if (validate && amt->status >= status) 586 return; 587 netdev_dbg(amt->dev, "Update GW status %s -> %s", 588 status_str[amt->status], status_str[status]); 589 WRITE_ONCE(amt->status, status); 590 } 591 592 static void __amt_update_relay_status(struct amt_tunnel_list *tunnel, 593 enum amt_status status, 594 bool validate) 595 { 596 if (validate && tunnel->status >= status) 597 return; 598 netdev_dbg(tunnel->amt->dev, 599 "Update Tunnel(IP = %pI4, PORT = %u) status %s -> %s", 600 &tunnel->ip4, ntohs(tunnel->source_port), 601 status_str[tunnel->status], status_str[status]); 602 tunnel->status = status; 603 } 604 605 static void amt_update_relay_status(struct amt_tunnel_list *tunnel, 606 enum amt_status status, bool validate) 607 { 608 spin_lock_bh(&tunnel->lock); 609 __amt_update_relay_status(tunnel, status, validate); 610 spin_unlock_bh(&tunnel->lock); 611 } 612 613 static void amt_send_discovery(struct amt_dev *amt) 614 { 615 struct amt_header_discovery *amtd; 616 int hlen, tlen, offset; 617 struct udphdr *udph; 618 struct sk_buff *skb; 619 struct iphdr *iph; 620 struct rtable *rt; 621 struct flowi4 fl4; 622 struct sock *sk; 623 u32 len; 624 int err; 625 626 rcu_read_lock(); 627 sk = rcu_dereference(amt->sk); 628 if (!sk) 629 goto out; 630 631 if (!netif_running(amt->stream_dev) || !netif_running(amt->dev)) 632 goto out; 633 634 rt = ip_route_output_ports(amt->net, &fl4, sk, 635 amt->discovery_ip, amt->local_ip, 636 amt->gw_port, amt->relay_port, 637 IPPROTO_UDP, 0, 638 amt->stream_dev->ifindex); 639 if (IS_ERR(rt)) { 640 amt->dev->stats.tx_errors++; 641 goto out; 642 } 643 644 hlen = LL_RESERVED_SPACE(amt->dev); 645 tlen = amt->dev->needed_tailroom; 646 len = hlen + tlen + sizeof(*iph) + sizeof(*udph) + sizeof(*amtd); 647 skb = netdev_alloc_skb_ip_align(amt->dev, len); 648 if (!skb) { 649 ip_rt_put(rt); 650 amt->dev->stats.tx_errors++; 651 goto out; 652 } 653 654 skb->priority = TC_PRIO_CONTROL; 655 skb_dst_set(skb, &rt->dst); 656 657 len = sizeof(*iph) + sizeof(*udph) + sizeof(*amtd); 658 skb_reset_network_header(skb); 659 skb_put(skb, len); 660 amtd = skb_pull(skb, sizeof(*iph) + sizeof(*udph)); 661 amtd->version = 0; 662 amtd->type = AMT_MSG_DISCOVERY; 663 amtd->reserved = 0; 664 amtd->nonce = amt->nonce; 665 skb_push(skb, sizeof(*udph)); 666 skb_reset_transport_header(skb); 667 udph = udp_hdr(skb); 668 udph->source = amt->gw_port; 669 udph->dest = amt->relay_port; 670 udp_set_len_short(udph, sizeof(*udph) + sizeof(*amtd)); 671 udph->check = 0; 672 offset = skb_transport_offset(skb); 673 skb->csum = skb_checksum(skb, offset, skb->len - offset, 0); 674 udph->check = csum_tcpudp_magic(amt->local_ip, amt->discovery_ip, 675 sizeof(*udph) + sizeof(*amtd), 676 IPPROTO_UDP, skb->csum); 677 678 skb_push(skb, sizeof(*iph)); 679 iph = ip_hdr(skb); 680 iph->version = 4; 681 iph->ihl = (sizeof(struct iphdr)) >> 2; 682 iph->tos = AMT_TOS; 683 iph->frag_off = 0; 684 iph->ttl = ip4_dst_hoplimit(&rt->dst); 685 iph->daddr = amt->discovery_ip; 686 iph->saddr = amt->local_ip; 687 iph->protocol = IPPROTO_UDP; 688 iph->tot_len = htons(len); 689 690 skb->ip_summed = CHECKSUM_NONE; 691 ip_select_ident(amt->net, skb, NULL); 692 ip_send_check(iph); 693 err = ip_local_out(amt->net, sk, skb); 694 if (unlikely(net_xmit_eval(err))) 695 amt->dev->stats.tx_errors++; 696 697 amt_update_gw_status(amt, AMT_STATUS_SENT_DISCOVERY, true); 698 out: 699 rcu_read_unlock(); 700 } 701 702 static void amt_send_request(struct amt_dev *amt, bool v6) 703 { 704 struct amt_header_request *amtrh; 705 int hlen, tlen, offset; 706 struct udphdr *udph; 707 struct sk_buff *skb; 708 struct iphdr *iph; 709 struct rtable *rt; 710 struct flowi4 fl4; 711 __be32 remote_ip; 712 struct sock *sk; 713 u32 len; 714 int err; 715 716 rcu_read_lock(); 717 remote_ip = READ_ONCE(amt->remote_ip); 718 sk = rcu_dereference(amt->sk); 719 if (!sk) 720 goto out; 721 722 if (!netif_running(amt->stream_dev) || !netif_running(amt->dev)) 723 goto out; 724 725 rt = ip_route_output_ports(amt->net, &fl4, sk, 726 remote_ip, amt->local_ip, 727 amt->gw_port, amt->relay_port, 728 IPPROTO_UDP, 0, 729 amt->stream_dev->ifindex); 730 if (IS_ERR(rt)) { 731 amt->dev->stats.tx_errors++; 732 goto out; 733 } 734 735 hlen = LL_RESERVED_SPACE(amt->dev); 736 tlen = amt->dev->needed_tailroom; 737 len = hlen + tlen + sizeof(*iph) + sizeof(*udph) + sizeof(*amtrh); 738 skb = netdev_alloc_skb_ip_align(amt->dev, len); 739 if (!skb) { 740 ip_rt_put(rt); 741 amt->dev->stats.tx_errors++; 742 goto out; 743 } 744 745 skb->priority = TC_PRIO_CONTROL; 746 skb_dst_set(skb, &rt->dst); 747 748 len = sizeof(*iph) + sizeof(*udph) + sizeof(*amtrh); 749 skb_reset_network_header(skb); 750 skb_put(skb, len); 751 amtrh = skb_pull(skb, sizeof(*iph) + sizeof(*udph)); 752 amtrh->version = 0; 753 amtrh->type = AMT_MSG_REQUEST; 754 amtrh->reserved1 = 0; 755 amtrh->p = v6; 756 amtrh->reserved2 = 0; 757 amtrh->nonce = amt->nonce; 758 skb_push(skb, sizeof(*udph)); 759 skb_reset_transport_header(skb); 760 udph = udp_hdr(skb); 761 udph->source = amt->gw_port; 762 udph->dest = amt->relay_port; 763 udp_set_len_short(udph, sizeof(*amtrh) + sizeof(*udph)); 764 udph->check = 0; 765 offset = skb_transport_offset(skb); 766 skb->csum = skb_checksum(skb, offset, skb->len - offset, 0); 767 udph->check = csum_tcpudp_magic(amt->local_ip, remote_ip, 768 sizeof(*udph) + sizeof(*amtrh), 769 IPPROTO_UDP, skb->csum); 770 771 skb_push(skb, sizeof(*iph)); 772 iph = ip_hdr(skb); 773 iph->version = 4; 774 iph->ihl = (sizeof(struct iphdr)) >> 2; 775 iph->tos = AMT_TOS; 776 iph->frag_off = 0; 777 iph->ttl = ip4_dst_hoplimit(&rt->dst); 778 iph->daddr = remote_ip; 779 iph->saddr = amt->local_ip; 780 iph->protocol = IPPROTO_UDP; 781 iph->tot_len = htons(len); 782 783 skb->ip_summed = CHECKSUM_NONE; 784 ip_select_ident(amt->net, skb, NULL); 785 ip_send_check(iph); 786 err = ip_local_out(amt->net, sk, skb); 787 if (unlikely(net_xmit_eval(err))) 788 amt->dev->stats.tx_errors++; 789 790 out: 791 rcu_read_unlock(); 792 } 793 794 static void amt_send_igmp_gq(struct amt_dev *amt, 795 struct amt_tunnel_list *tunnel) 796 { 797 struct sk_buff *skb; 798 799 skb = amt_build_igmp_gq(amt); 800 if (!skb) 801 return; 802 803 amt_skb_cb(skb)->tunnel = tunnel; 804 dev_queue_xmit(skb); 805 } 806 807 #if IS_ENABLED(CONFIG_IPV6) 808 static struct sk_buff *amt_build_mld_gq(struct amt_dev *amt) 809 { 810 u8 ra[AMT_IP6HDR_OPTS] = { IPPROTO_ICMPV6, 0, IPV6_TLV_ROUTERALERT, 811 2, 0, 0, IPV6_TLV_PAD1, IPV6_TLV_PAD1 }; 812 int hlen = LL_RESERVED_SPACE(amt->dev); 813 int tlen = amt->dev->needed_tailroom; 814 struct mld2_query *mld2q; 815 void *csum_start = NULL; 816 struct ipv6hdr *ip6h; 817 struct sk_buff *skb; 818 struct ethhdr *eth; 819 u32 len; 820 821 len = hlen + tlen + sizeof(*ip6h) + sizeof(ra) + sizeof(*mld2q); 822 skb = netdev_alloc_skb_ip_align(amt->dev, len); 823 if (!skb) 824 return NULL; 825 826 skb_reserve(skb, hlen); 827 skb_push(skb, sizeof(*eth)); 828 skb_reset_mac_header(skb); 829 eth = eth_hdr(skb); 830 skb->priority = TC_PRIO_CONTROL; 831 skb->protocol = htons(ETH_P_IPV6); 832 skb_put_zero(skb, sizeof(*ip6h)); 833 skb_put_data(skb, ra, sizeof(ra)); 834 skb_put_zero(skb, sizeof(*mld2q)); 835 skb_pull(skb, sizeof(*eth)); 836 skb_reset_network_header(skb); 837 ip6h = ipv6_hdr(skb); 838 ip6h->payload_len = htons(sizeof(ra) + sizeof(*mld2q)); 839 ip6h->nexthdr = NEXTHDR_HOP; 840 ip6h->hop_limit = 1; 841 ip6h->daddr = mld2_all_node; 842 ip6_flow_hdr(ip6h, 0, 0); 843 844 if (ipv6_dev_get_saddr(amt->net, amt->dev, &ip6h->daddr, 0, 845 &ip6h->saddr)) { 846 amt->dev->stats.tx_errors++; 847 kfree_skb(skb); 848 return NULL; 849 } 850 851 eth->h_proto = htons(ETH_P_IPV6); 852 ether_addr_copy(eth->h_source, amt->dev->dev_addr); 853 ipv6_eth_mc_map(&mld2_all_node, eth->h_dest); 854 855 skb_pull(skb, sizeof(*ip6h) + sizeof(ra)); 856 skb_reset_transport_header(skb); 857 mld2q = (struct mld2_query *)icmp6_hdr(skb); 858 mld2q->mld2q_mrc = htons(1); 859 mld2q->mld2q_type = ICMPV6_MGM_QUERY; 860 mld2q->mld2q_code = 0; 861 mld2q->mld2q_cksum = 0; 862 mld2q->mld2q_resv1 = 0; 863 mld2q->mld2q_resv2 = 0; 864 mld2q->mld2q_suppress = 0; 865 mld2q->mld2q_qrv = amt->qrv; 866 mld2q->mld2q_nsrcs = 0; 867 mld2q->mld2q_qqic = amt->qi; 868 csum_start = (void *)mld2q; 869 mld2q->mld2q_cksum = csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, 870 sizeof(*mld2q), 871 IPPROTO_ICMPV6, 872 csum_partial(csum_start, 873 sizeof(*mld2q), 0)); 874 875 skb->ip_summed = CHECKSUM_NONE; 876 skb_push(skb, sizeof(*eth) + sizeof(*ip6h) + sizeof(ra)); 877 return skb; 878 } 879 880 static void amt_send_mld_gq(struct amt_dev *amt, struct amt_tunnel_list *tunnel) 881 { 882 struct sk_buff *skb; 883 884 skb = amt_build_mld_gq(amt); 885 if (!skb) 886 return; 887 888 amt_skb_cb(skb)->tunnel = tunnel; 889 dev_queue_xmit(skb); 890 } 891 #else 892 static void amt_send_mld_gq(struct amt_dev *amt, struct amt_tunnel_list *tunnel) 893 { 894 } 895 #endif 896 897 static bool amt_queue_event(struct amt_dev *amt, enum amt_event event, 898 struct sk_buff *skb) 899 { 900 int index; 901 902 spin_lock_bh(&amt->lock); 903 if (amt->nr_events >= AMT_MAX_EVENTS) { 904 spin_unlock_bh(&amt->lock); 905 return 1; 906 } 907 908 index = (amt->event_idx + amt->nr_events) % AMT_MAX_EVENTS; 909 amt->events[index].event = event; 910 amt->events[index].skb = skb; 911 amt->nr_events++; 912 amt->event_idx %= AMT_MAX_EVENTS; 913 queue_work(amt_wq, &amt->event_wq); 914 spin_unlock_bh(&amt->lock); 915 916 return 0; 917 } 918 919 static void amt_secret_work(struct work_struct *work) 920 { 921 struct amt_dev *amt = container_of(to_delayed_work(work), 922 struct amt_dev, 923 secret_wq); 924 925 spin_lock_bh(&amt->lock); 926 get_random_bytes(&amt->key, sizeof(siphash_key_t)); 927 spin_unlock_bh(&amt->lock); 928 mod_delayed_work(amt_wq, &amt->secret_wq, 929 msecs_to_jiffies(AMT_SECRET_TIMEOUT)); 930 } 931 932 static void amt_event_send_discovery(struct amt_dev *amt) 933 { 934 if (amt->status > AMT_STATUS_SENT_DISCOVERY) 935 goto out; 936 get_random_bytes(&amt->nonce, sizeof(__be32)); 937 938 amt_send_discovery(amt); 939 out: 940 mod_delayed_work(amt_wq, &amt->discovery_wq, 941 msecs_to_jiffies(AMT_DISCOVERY_TIMEOUT)); 942 } 943 944 static void amt_discovery_work(struct work_struct *work) 945 { 946 struct amt_dev *amt = container_of(to_delayed_work(work), 947 struct amt_dev, 948 discovery_wq); 949 950 if (amt_queue_event(amt, AMT_EVENT_SEND_DISCOVERY, NULL)) 951 mod_delayed_work(amt_wq, &amt->discovery_wq, 952 msecs_to_jiffies(AMT_DISCOVERY_TIMEOUT)); 953 } 954 955 static void amt_event_send_request(struct amt_dev *amt) 956 { 957 u32 exp; 958 959 if (amt->status < AMT_STATUS_RECEIVED_ADVERTISEMENT) 960 goto out; 961 962 if (amt->req_cnt > AMT_MAX_REQ_COUNT) { 963 netdev_dbg(amt->dev, "Gateway is not ready"); 964 amt->qi = AMT_INIT_REQ_TIMEOUT; 965 WRITE_ONCE(amt->ready4, false); 966 WRITE_ONCE(amt->ready6, false); 967 WRITE_ONCE(amt->remote_ip, 0); 968 amt_update_gw_status(amt, AMT_STATUS_INIT, false); 969 amt->req_cnt = 0; 970 amt->nonce = 0; 971 goto out; 972 } 973 974 if (!amt->req_cnt) { 975 WRITE_ONCE(amt->ready4, false); 976 WRITE_ONCE(amt->ready6, false); 977 get_random_bytes(&amt->nonce, sizeof(__be32)); 978 } 979 980 amt_send_request(amt, false); 981 amt_send_request(amt, true); 982 amt_update_gw_status(amt, AMT_STATUS_SENT_REQUEST, true); 983 amt->req_cnt++; 984 out: 985 exp = min_t(u32, (1 * (1 << amt->req_cnt)), AMT_MAX_REQ_TIMEOUT); 986 mod_delayed_work(amt_wq, &amt->req_wq, secs_to_jiffies(exp)); 987 } 988 989 static void amt_req_work(struct work_struct *work) 990 { 991 struct amt_dev *amt = container_of(to_delayed_work(work), 992 struct amt_dev, 993 req_wq); 994 995 if (amt_queue_event(amt, AMT_EVENT_SEND_REQUEST, NULL)) 996 mod_delayed_work(amt_wq, &amt->req_wq, 997 msecs_to_jiffies(100)); 998 } 999 1000 static bool amt_send_membership_update(struct amt_dev *amt, 1001 struct sk_buff *skb, 1002 bool v6) 1003 { 1004 __be32 remote_ip = READ_ONCE(amt->remote_ip); 1005 struct amt_header_membership_update *amtmu; 1006 struct iphdr *iph; 1007 struct flowi4 fl4; 1008 struct rtable *rt; 1009 struct sock *sk; 1010 int err; 1011 1012 sk = rcu_dereference_bh(amt->sk); 1013 if (!sk) 1014 return true; 1015 1016 err = skb_cow_head(skb, LL_RESERVED_SPACE(amt->dev) + sizeof(*amtmu) + 1017 sizeof(*iph) + sizeof(struct udphdr)); 1018 if (err) 1019 return true; 1020 1021 skb_reset_inner_headers(skb); 1022 memset(&fl4, 0, sizeof(struct flowi4)); 1023 fl4.flowi4_oif = amt->stream_dev->ifindex; 1024 fl4.daddr = remote_ip; 1025 fl4.saddr = amt->local_ip; 1026 fl4.flowi4_dscp = inet_dsfield_to_dscp(AMT_TOS); 1027 fl4.flowi4_proto = IPPROTO_UDP; 1028 rt = ip_route_output_key(amt->net, &fl4); 1029 if (IS_ERR(rt)) { 1030 netdev_dbg(amt->dev, "no route to %pI4\n", &remote_ip); 1031 return true; 1032 } 1033 1034 amtmu = skb_push(skb, sizeof(*amtmu)); 1035 amtmu->version = 0; 1036 amtmu->type = AMT_MSG_MEMBERSHIP_UPDATE; 1037 amtmu->reserved = 0; 1038 amtmu->nonce = amt->nonce; 1039 amtmu->response_mac = amt->mac; 1040 1041 if (!v6) 1042 skb_set_inner_protocol(skb, htons(ETH_P_IP)); 1043 else 1044 skb_set_inner_protocol(skb, htons(ETH_P_IPV6)); 1045 udp_tunnel_xmit_skb(rt, sk, skb, 1046 fl4.saddr, 1047 fl4.daddr, 1048 AMT_TOS, 1049 ip4_dst_hoplimit(&rt->dst), 1050 0, 1051 amt->gw_port, 1052 amt->relay_port, 1053 false, 1054 false, 1055 0); 1056 amt_update_gw_status(amt, AMT_STATUS_SENT_UPDATE, true); 1057 return false; 1058 } 1059 1060 static void amt_send_multicast_data(struct amt_dev *amt, 1061 const struct sk_buff *oskb, 1062 struct amt_tunnel_list *tunnel, 1063 bool v6) 1064 { 1065 struct amt_header_mcast_data *amtmd; 1066 struct sk_buff *skb; 1067 struct iphdr *iph; 1068 struct flowi4 fl4; 1069 struct rtable *rt; 1070 struct sock *sk; 1071 1072 sk = rcu_dereference_bh(amt->sk); 1073 if (!sk) 1074 return; 1075 1076 skb = skb_copy_expand(oskb, sizeof(*amtmd) + sizeof(*iph) + 1077 sizeof(struct udphdr), 0, GFP_ATOMIC); 1078 if (!skb) 1079 return; 1080 1081 skb_reset_inner_headers(skb); 1082 memset(&fl4, 0, sizeof(struct flowi4)); 1083 fl4.flowi4_oif = amt->stream_dev->ifindex; 1084 fl4.daddr = tunnel->ip4; 1085 fl4.saddr = amt->local_ip; 1086 fl4.flowi4_proto = IPPROTO_UDP; 1087 rt = ip_route_output_key(amt->net, &fl4); 1088 if (IS_ERR(rt)) { 1089 netdev_dbg(amt->dev, "no route to %pI4\n", &tunnel->ip4); 1090 kfree_skb(skb); 1091 return; 1092 } 1093 1094 amtmd = skb_push(skb, sizeof(*amtmd)); 1095 amtmd->version = 0; 1096 amtmd->reserved = 0; 1097 amtmd->type = AMT_MSG_MULTICAST_DATA; 1098 1099 if (!v6) 1100 skb_set_inner_protocol(skb, htons(ETH_P_IP)); 1101 else 1102 skb_set_inner_protocol(skb, htons(ETH_P_IPV6)); 1103 udp_tunnel_xmit_skb(rt, sk, skb, 1104 fl4.saddr, 1105 fl4.daddr, 1106 AMT_TOS, 1107 ip4_dst_hoplimit(&rt->dst), 1108 0, 1109 amt->relay_port, 1110 tunnel->source_port, 1111 false, 1112 false, 1113 0); 1114 } 1115 1116 static bool amt_send_membership_query(struct amt_dev *amt, 1117 struct sk_buff *skb, 1118 struct amt_tunnel_list *tunnel, 1119 bool v6) 1120 { 1121 struct amt_header_membership_query *amtmq; 1122 struct rtable *rt; 1123 struct flowi4 fl4; 1124 struct sock *sk; 1125 int err; 1126 1127 sk = rcu_dereference_bh(amt->sk); 1128 if (!sk) 1129 return true; 1130 1131 err = skb_cow_head(skb, LL_RESERVED_SPACE(amt->dev) + sizeof(*amtmq) + 1132 sizeof(struct iphdr) + sizeof(struct udphdr)); 1133 if (err) 1134 return true; 1135 1136 skb_reset_inner_headers(skb); 1137 memset(&fl4, 0, sizeof(struct flowi4)); 1138 fl4.flowi4_oif = amt->stream_dev->ifindex; 1139 fl4.daddr = tunnel->ip4; 1140 fl4.saddr = amt->local_ip; 1141 fl4.flowi4_dscp = inet_dsfield_to_dscp(AMT_TOS); 1142 fl4.flowi4_proto = IPPROTO_UDP; 1143 rt = ip_route_output_key(amt->net, &fl4); 1144 if (IS_ERR(rt)) { 1145 netdev_dbg(amt->dev, "no route to %pI4\n", &tunnel->ip4); 1146 return true; 1147 } 1148 1149 amtmq = skb_push(skb, sizeof(*amtmq)); 1150 amtmq->version = 0; 1151 amtmq->type = AMT_MSG_MEMBERSHIP_QUERY; 1152 amtmq->reserved = 0; 1153 amtmq->l = 0; 1154 amtmq->g = 0; 1155 amtmq->nonce = tunnel->nonce; 1156 amtmq->response_mac = tunnel->mac; 1157 1158 if (!v6) 1159 skb_set_inner_protocol(skb, htons(ETH_P_IP)); 1160 else 1161 skb_set_inner_protocol(skb, htons(ETH_P_IPV6)); 1162 udp_tunnel_xmit_skb(rt, sk, skb, 1163 fl4.saddr, 1164 fl4.daddr, 1165 AMT_TOS, 1166 ip4_dst_hoplimit(&rt->dst), 1167 0, 1168 amt->relay_port, 1169 tunnel->source_port, 1170 false, 1171 false, 1172 0); 1173 amt_update_relay_status(tunnel, AMT_STATUS_SENT_QUERY, true); 1174 return false; 1175 } 1176 1177 static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev) 1178 { 1179 struct amt_dev *amt = netdev_priv(dev); 1180 struct amt_tunnel_list *tunnel; 1181 struct amt_group_node *gnode; 1182 union amt_addr group = {0,}; 1183 #if IS_ENABLED(CONFIG_IPV6) 1184 struct ipv6hdr *ip6h; 1185 struct mld_msg *mld; 1186 #endif 1187 bool report = false; 1188 struct igmphdr *ih; 1189 bool query = false; 1190 struct iphdr *iph; 1191 bool data = false; 1192 bool v6 = false; 1193 u32 hash; 1194 1195 iph = ip_hdr(skb); 1196 if (iph->version == 4) { 1197 if (!ipv4_is_multicast(iph->daddr)) 1198 goto free; 1199 1200 if (!ip_mc_check_igmp(skb)) { 1201 ih = igmp_hdr(skb); 1202 switch (ih->type) { 1203 case IGMPV3_HOST_MEMBERSHIP_REPORT: 1204 case IGMP_HOST_MEMBERSHIP_REPORT: 1205 report = true; 1206 break; 1207 case IGMP_HOST_MEMBERSHIP_QUERY: 1208 query = true; 1209 break; 1210 default: 1211 goto free; 1212 } 1213 } else { 1214 data = true; 1215 } 1216 v6 = false; 1217 group.ip4 = ip_hdr(skb)->daddr; 1218 #if IS_ENABLED(CONFIG_IPV6) 1219 } else if (iph->version == 6) { 1220 ip6h = ipv6_hdr(skb); 1221 if (!ipv6_addr_is_multicast(&ip6h->daddr)) 1222 goto free; 1223 1224 if (!ipv6_mc_check_mld(skb)) { 1225 mld = (struct mld_msg *)skb_transport_header(skb); 1226 switch (mld->mld_type) { 1227 case ICMPV6_MGM_REPORT: 1228 case ICMPV6_MLD2_REPORT: 1229 report = true; 1230 break; 1231 case ICMPV6_MGM_QUERY: 1232 query = true; 1233 break; 1234 default: 1235 goto free; 1236 } 1237 } else { 1238 data = true; 1239 } 1240 v6 = true; 1241 group.ip6 = ipv6_hdr(skb)->daddr; 1242 #endif 1243 } else { 1244 dev->stats.tx_errors++; 1245 goto free; 1246 } 1247 1248 if (!pskb_may_pull(skb, sizeof(struct ethhdr))) 1249 goto free; 1250 1251 skb_pull(skb, sizeof(struct ethhdr)); 1252 1253 if (amt->mode == AMT_MODE_GATEWAY) { 1254 /* Gateway only passes IGMP/MLD packets */ 1255 if (!report) 1256 goto free; 1257 if ((!v6 && !READ_ONCE(amt->ready4)) || 1258 (v6 && !READ_ONCE(amt->ready6))) 1259 goto free; 1260 if (amt_send_membership_update(amt, skb, v6)) 1261 goto free; 1262 goto unlock; 1263 } else if (amt->mode == AMT_MODE_RELAY) { 1264 if (query) { 1265 tunnel = amt_skb_cb(skb)->tunnel; 1266 if (!tunnel) { 1267 WARN_ON(1); 1268 goto free; 1269 } 1270 1271 /* Do not forward unexpected query */ 1272 if (amt_send_membership_query(amt, skb, tunnel, v6)) 1273 goto free; 1274 goto unlock; 1275 } 1276 1277 if (!data) 1278 goto free; 1279 list_for_each_entry_rcu(tunnel, &amt->tunnel_list, list) { 1280 hash = amt_group_hash(tunnel, &group); 1281 hlist_for_each_entry_rcu(gnode, &tunnel->groups[hash], 1282 node) { 1283 if (!v6) { 1284 if (gnode->group_addr.ip4 == group.ip4) 1285 goto found; 1286 #if IS_ENABLED(CONFIG_IPV6) 1287 } else { 1288 if (ipv6_addr_equal(&gnode->group_addr.ip6, 1289 &group.ip6)) 1290 goto found; 1291 #endif 1292 } 1293 } 1294 continue; 1295 found: 1296 amt_send_multicast_data(amt, skb, tunnel, v6); 1297 } 1298 } 1299 1300 dev_kfree_skb(skb); 1301 return NETDEV_TX_OK; 1302 free: 1303 dev_kfree_skb(skb); 1304 unlock: 1305 dev->stats.tx_dropped++; 1306 return NETDEV_TX_OK; 1307 } 1308 1309 static int amt_parse_type(struct sk_buff *skb) 1310 { 1311 struct amt_header *amth; 1312 1313 /* skb->data is the UDP header on receive, but the quoted IP header 1314 * when amt_err_lookup() parses an ICMP error, so pull up to the 1315 * transport header rather than from skb->data. 1316 */ 1317 if (!pskb_may_pull(skb, skb_transport_offset(skb) + 1318 sizeof(struct udphdr) + sizeof(struct amt_header))) 1319 return -1; 1320 1321 amth = (struct amt_header *)(udp_hdr(skb) + 1); 1322 1323 if (amth->version != 0) 1324 return -1; 1325 1326 if (amth->type >= __AMT_MSG_MAX || !amth->type) 1327 return -1; 1328 return amth->type; 1329 } 1330 1331 static void amt_clear_groups(struct amt_tunnel_list *tunnel) 1332 { 1333 struct amt_dev *amt = tunnel->amt; 1334 struct amt_group_node *gnode; 1335 struct hlist_node *t; 1336 int i; 1337 1338 spin_lock_bh(&tunnel->lock); 1339 rcu_read_lock(); 1340 for (i = 0; i < amt->hash_buckets; i++) 1341 hlist_for_each_entry_safe(gnode, t, &tunnel->groups[i], node) 1342 amt_del_group(amt, gnode); 1343 rcu_read_unlock(); 1344 spin_unlock_bh(&tunnel->lock); 1345 } 1346 1347 static void amt_tunnel_expire(struct work_struct *work) 1348 { 1349 struct amt_tunnel_list *tunnel = container_of(to_delayed_work(work), 1350 struct amt_tunnel_list, 1351 gc_wq); 1352 struct amt_dev *amt = tunnel->amt; 1353 1354 spin_lock_bh(&amt->lock); 1355 rcu_read_lock(); 1356 list_del_rcu(&tunnel->list); 1357 amt->nr_tunnels--; 1358 amt_clear_groups(tunnel); 1359 rcu_read_unlock(); 1360 spin_unlock_bh(&amt->lock); 1361 kfree_rcu(tunnel, rcu); 1362 } 1363 1364 static void amt_cleanup_srcs(struct amt_dev *amt, 1365 struct amt_tunnel_list *tunnel, 1366 struct amt_group_node *gnode) 1367 { 1368 struct amt_source_node *snode; 1369 struct hlist_node *t; 1370 int i; 1371 1372 /* Delete old sources */ 1373 for (i = 0; i < amt->hash_buckets; i++) { 1374 hlist_for_each_entry_safe(snode, t, &gnode->sources[i], node) { 1375 if (snode->flags == AMT_SOURCE_OLD) 1376 amt_destroy_source(snode); 1377 } 1378 } 1379 1380 /* switch from new to old */ 1381 for (i = 0; i < amt->hash_buckets; i++) { 1382 hlist_for_each_entry_rcu(snode, &gnode->sources[i], node) { 1383 snode->flags = AMT_SOURCE_OLD; 1384 if (!gnode->v6) 1385 netdev_dbg(snode->gnode->amt->dev, 1386 "Add source as OLD %pI4 from %pI4\n", 1387 &snode->source_addr.ip4, 1388 &gnode->group_addr.ip4); 1389 #if IS_ENABLED(CONFIG_IPV6) 1390 else 1391 netdev_dbg(snode->gnode->amt->dev, 1392 "Add source as OLD %pI6 from %pI6\n", 1393 &snode->source_addr.ip6, 1394 &gnode->group_addr.ip6); 1395 #endif 1396 } 1397 } 1398 } 1399 1400 static void amt_add_srcs(struct amt_dev *amt, struct amt_tunnel_list *tunnel, 1401 struct amt_group_node *gnode, void *grec, 1402 bool v6) 1403 { 1404 struct igmpv3_grec *igmp_grec; 1405 struct amt_source_node *snode; 1406 #if IS_ENABLED(CONFIG_IPV6) 1407 struct mld2_grec *mld_grec; 1408 #endif 1409 union amt_addr src = {0,}; 1410 u16 nsrcs; 1411 u32 hash; 1412 int i; 1413 1414 if (!v6) { 1415 igmp_grec = grec; 1416 nsrcs = ntohs(igmp_grec->grec_nsrcs); 1417 } else { 1418 #if IS_ENABLED(CONFIG_IPV6) 1419 mld_grec = grec; 1420 nsrcs = ntohs(mld_grec->grec_nsrcs); 1421 #else 1422 return; 1423 #endif 1424 } 1425 for (i = 0; i < nsrcs; i++) { 1426 if (tunnel->nr_sources >= amt->max_sources) 1427 return; 1428 if (!v6) 1429 src.ip4 = igmp_grec->grec_src[i]; 1430 #if IS_ENABLED(CONFIG_IPV6) 1431 else 1432 memcpy(&src.ip6, &mld_grec->grec_src[i], 1433 sizeof(struct in6_addr)); 1434 #endif 1435 if (amt_lookup_src(tunnel, gnode, AMT_FILTER_ALL, &src)) 1436 continue; 1437 1438 snode = amt_alloc_snode(gnode, &src); 1439 if (snode) { 1440 hash = amt_source_hash(tunnel, &snode->source_addr); 1441 hlist_add_head_rcu(&snode->node, &gnode->sources[hash]); 1442 tunnel->nr_sources++; 1443 gnode->nr_sources++; 1444 1445 if (!gnode->v6) 1446 netdev_dbg(snode->gnode->amt->dev, 1447 "Add source as NEW %pI4 from %pI4\n", 1448 &snode->source_addr.ip4, 1449 &gnode->group_addr.ip4); 1450 #if IS_ENABLED(CONFIG_IPV6) 1451 else 1452 netdev_dbg(snode->gnode->amt->dev, 1453 "Add source as NEW %pI6 from %pI6\n", 1454 &snode->source_addr.ip6, 1455 &gnode->group_addr.ip6); 1456 #endif 1457 } 1458 } 1459 } 1460 1461 /* Router State Report Rec'd New Router State 1462 * ------------ ------------ ---------------- 1463 * EXCLUDE (X,Y) IS_IN (A) EXCLUDE (X+A,Y-A) 1464 * 1465 * -----------+-----------+-----------+ 1466 * | OLD | NEW | 1467 * -----------+-----------+-----------+ 1468 * FWD | X | X+A | 1469 * -----------+-----------+-----------+ 1470 * D_FWD | Y | Y-A | 1471 * -----------+-----------+-----------+ 1472 * NONE | | A | 1473 * -----------+-----------+-----------+ 1474 * 1475 * a) Received sources are NONE/NEW 1476 * b) All NONE will be deleted by amt_cleanup_srcs(). 1477 * c) All OLD will be deleted by amt_cleanup_srcs(). 1478 * d) After delete, NEW source will be switched to OLD. 1479 */ 1480 static void amt_lookup_act_srcs(struct amt_tunnel_list *tunnel, 1481 struct amt_group_node *gnode, 1482 void *grec, 1483 enum amt_ops ops, 1484 enum amt_filter filter, 1485 enum amt_act act, 1486 bool v6) 1487 { 1488 struct amt_dev *amt = tunnel->amt; 1489 struct amt_source_node *snode; 1490 struct igmpv3_grec *igmp_grec; 1491 #if IS_ENABLED(CONFIG_IPV6) 1492 struct mld2_grec *mld_grec; 1493 #endif 1494 union amt_addr src = {0,}; 1495 struct hlist_node *t; 1496 u16 nsrcs; 1497 int i, j; 1498 1499 if (!v6) { 1500 igmp_grec = grec; 1501 nsrcs = ntohs(igmp_grec->grec_nsrcs); 1502 } else { 1503 #if IS_ENABLED(CONFIG_IPV6) 1504 mld_grec = grec; 1505 nsrcs = ntohs(mld_grec->grec_nsrcs); 1506 #else 1507 return; 1508 #endif 1509 } 1510 1511 memset(&src, 0, sizeof(union amt_addr)); 1512 switch (ops) { 1513 case AMT_OPS_INT: 1514 /* A*B */ 1515 for (i = 0; i < nsrcs; i++) { 1516 if (!v6) 1517 src.ip4 = igmp_grec->grec_src[i]; 1518 #if IS_ENABLED(CONFIG_IPV6) 1519 else 1520 memcpy(&src.ip6, &mld_grec->grec_src[i], 1521 sizeof(struct in6_addr)); 1522 #endif 1523 snode = amt_lookup_src(tunnel, gnode, filter, &src); 1524 if (!snode) 1525 continue; 1526 amt_act_src(tunnel, gnode, snode, act); 1527 } 1528 break; 1529 case AMT_OPS_UNI: 1530 /* A+B */ 1531 for (i = 0; i < amt->hash_buckets; i++) { 1532 hlist_for_each_entry_safe(snode, t, &gnode->sources[i], 1533 node) { 1534 if (amt_status_filter(snode, filter)) 1535 amt_act_src(tunnel, gnode, snode, act); 1536 } 1537 } 1538 for (i = 0; i < nsrcs; i++) { 1539 if (!v6) 1540 src.ip4 = igmp_grec->grec_src[i]; 1541 #if IS_ENABLED(CONFIG_IPV6) 1542 else 1543 memcpy(&src.ip6, &mld_grec->grec_src[i], 1544 sizeof(struct in6_addr)); 1545 #endif 1546 snode = amt_lookup_src(tunnel, gnode, filter, &src); 1547 if (!snode) 1548 continue; 1549 amt_act_src(tunnel, gnode, snode, act); 1550 } 1551 break; 1552 case AMT_OPS_SUB: 1553 /* A-B */ 1554 for (i = 0; i < amt->hash_buckets; i++) { 1555 hlist_for_each_entry_safe(snode, t, &gnode->sources[i], 1556 node) { 1557 if (!amt_status_filter(snode, filter)) 1558 continue; 1559 for (j = 0; j < nsrcs; j++) { 1560 if (!v6) 1561 src.ip4 = igmp_grec->grec_src[j]; 1562 #if IS_ENABLED(CONFIG_IPV6) 1563 else 1564 memcpy(&src.ip6, 1565 &mld_grec->grec_src[j], 1566 sizeof(struct in6_addr)); 1567 #endif 1568 if (amt_addr_equal(&snode->source_addr, 1569 &src)) 1570 goto out_sub; 1571 } 1572 amt_act_src(tunnel, gnode, snode, act); 1573 continue; 1574 out_sub:; 1575 } 1576 } 1577 break; 1578 case AMT_OPS_SUB_REV: 1579 /* B-A */ 1580 for (i = 0; i < nsrcs; i++) { 1581 if (!v6) 1582 src.ip4 = igmp_grec->grec_src[i]; 1583 #if IS_ENABLED(CONFIG_IPV6) 1584 else 1585 memcpy(&src.ip6, &mld_grec->grec_src[i], 1586 sizeof(struct in6_addr)); 1587 #endif 1588 snode = amt_lookup_src(tunnel, gnode, AMT_FILTER_ALL, 1589 &src); 1590 if (!snode) { 1591 snode = amt_lookup_src(tunnel, gnode, 1592 filter, &src); 1593 if (snode) 1594 amt_act_src(tunnel, gnode, snode, act); 1595 } 1596 } 1597 break; 1598 default: 1599 netdev_dbg(amt->dev, "Invalid type\n"); 1600 return; 1601 } 1602 } 1603 1604 static void amt_mcast_is_in_handler(struct amt_dev *amt, 1605 struct amt_tunnel_list *tunnel, 1606 struct amt_group_node *gnode, 1607 void *grec, void *zero_grec, bool v6) 1608 { 1609 if (gnode->filter_mode == MCAST_INCLUDE) { 1610 /* Router State Report Rec'd New Router State Actions 1611 * ------------ ------------ ---------------- ------- 1612 * INCLUDE (A) IS_IN (B) INCLUDE (A+B) (B)=GMI 1613 */ 1614 /* Update IS_IN (B) as FWD/NEW */ 1615 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1616 AMT_FILTER_NONE_NEW, 1617 AMT_ACT_STATUS_FWD_NEW, 1618 v6); 1619 /* Update INCLUDE (A) as NEW */ 1620 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1621 AMT_FILTER_FWD, 1622 AMT_ACT_STATUS_FWD_NEW, 1623 v6); 1624 /* (B)=GMI */ 1625 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1626 AMT_FILTER_FWD_NEW, 1627 AMT_ACT_GMI, 1628 v6); 1629 } else { 1630 /* State Actions 1631 * ------------ ------------ ---------------- ------- 1632 * EXCLUDE (X,Y) IS_IN (A) EXCLUDE (X+A,Y-A) (A)=GMI 1633 */ 1634 /* Update (A) in (X, Y) as NONE/NEW */ 1635 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1636 AMT_FILTER_BOTH, 1637 AMT_ACT_STATUS_NONE_NEW, 1638 v6); 1639 /* Update FWD/OLD as FWD/NEW */ 1640 amt_lookup_act_srcs(tunnel, gnode, zero_grec, AMT_OPS_UNI, 1641 AMT_FILTER_FWD, 1642 AMT_ACT_STATUS_FWD_NEW, 1643 v6); 1644 /* Update IS_IN (A) as FWD/NEW */ 1645 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1646 AMT_FILTER_NONE_NEW, 1647 AMT_ACT_STATUS_FWD_NEW, 1648 v6); 1649 /* Update EXCLUDE (, Y-A) as D_FWD_NEW */ 1650 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB, 1651 AMT_FILTER_D_FWD, 1652 AMT_ACT_STATUS_D_FWD_NEW, 1653 v6); 1654 } 1655 } 1656 1657 static void amt_mcast_is_ex_handler(struct amt_dev *amt, 1658 struct amt_tunnel_list *tunnel, 1659 struct amt_group_node *gnode, 1660 void *grec, void *zero_grec, bool v6) 1661 { 1662 if (gnode->filter_mode == MCAST_INCLUDE) { 1663 /* Router State Report Rec'd New Router State Actions 1664 * ------------ ------------ ---------------- ------- 1665 * INCLUDE (A) IS_EX (B) EXCLUDE (A*B,B-A) (B-A)=0 1666 * Delete (A-B) 1667 * Group Timer=GMI 1668 */ 1669 /* EXCLUDE(A*B, ) */ 1670 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1671 AMT_FILTER_FWD, 1672 AMT_ACT_STATUS_FWD_NEW, 1673 v6); 1674 /* EXCLUDE(, B-A) */ 1675 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB_REV, 1676 AMT_FILTER_FWD, 1677 AMT_ACT_STATUS_D_FWD_NEW, 1678 v6); 1679 /* (B-A)=0 */ 1680 amt_lookup_act_srcs(tunnel, gnode, zero_grec, AMT_OPS_UNI, 1681 AMT_FILTER_D_FWD_NEW, 1682 AMT_ACT_GMI_ZERO, 1683 v6); 1684 /* Group Timer=GMI */ 1685 if (!mod_delayed_work(amt_wq, &gnode->group_timer, 1686 msecs_to_jiffies(amt_gmi(amt)))) 1687 dev_hold(amt->dev); 1688 gnode->filter_mode = MCAST_EXCLUDE; 1689 /* Delete (A-B) will be worked by amt_cleanup_srcs(). */ 1690 } else { 1691 /* Router State Report Rec'd New Router State Actions 1692 * ------------ ------------ ---------------- ------- 1693 * EXCLUDE (X,Y) IS_EX (A) EXCLUDE (A-Y,Y*A) (A-X-Y)=GMI 1694 * Delete (X-A) 1695 * Delete (Y-A) 1696 * Group Timer=GMI 1697 */ 1698 /* EXCLUDE (A-Y, ) */ 1699 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB_REV, 1700 AMT_FILTER_D_FWD, 1701 AMT_ACT_STATUS_FWD_NEW, 1702 v6); 1703 /* EXCLUDE (, Y*A ) */ 1704 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1705 AMT_FILTER_D_FWD, 1706 AMT_ACT_STATUS_D_FWD_NEW, 1707 v6); 1708 /* (A-X-Y)=GMI */ 1709 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB_REV, 1710 AMT_FILTER_BOTH_NEW, 1711 AMT_ACT_GMI, 1712 v6); 1713 /* Group Timer=GMI */ 1714 if (!mod_delayed_work(amt_wq, &gnode->group_timer, 1715 msecs_to_jiffies(amt_gmi(amt)))) 1716 dev_hold(amt->dev); 1717 /* Delete (X-A), (Y-A) will be worked by amt_cleanup_srcs(). */ 1718 } 1719 } 1720 1721 static void amt_mcast_to_in_handler(struct amt_dev *amt, 1722 struct amt_tunnel_list *tunnel, 1723 struct amt_group_node *gnode, 1724 void *grec, void *zero_grec, bool v6) 1725 { 1726 if (gnode->filter_mode == MCAST_INCLUDE) { 1727 /* Router State Report Rec'd New Router State Actions 1728 * ------------ ------------ ---------------- ------- 1729 * INCLUDE (A) TO_IN (B) INCLUDE (A+B) (B)=GMI 1730 * Send Q(G,A-B) 1731 */ 1732 /* Update TO_IN (B) sources as FWD/NEW */ 1733 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1734 AMT_FILTER_NONE_NEW, 1735 AMT_ACT_STATUS_FWD_NEW, 1736 v6); 1737 /* Update INCLUDE (A) sources as NEW */ 1738 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1739 AMT_FILTER_FWD, 1740 AMT_ACT_STATUS_FWD_NEW, 1741 v6); 1742 /* (B)=GMI */ 1743 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1744 AMT_FILTER_FWD_NEW, 1745 AMT_ACT_GMI, 1746 v6); 1747 } else { 1748 /* Router State Report Rec'd New Router State Actions 1749 * ------------ ------------ ---------------- ------- 1750 * EXCLUDE (X,Y) TO_IN (A) EXCLUDE (X+A,Y-A) (A)=GMI 1751 * Send Q(G,X-A) 1752 * Send Q(G) 1753 */ 1754 /* Update TO_IN (A) sources as FWD/NEW */ 1755 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1756 AMT_FILTER_NONE_NEW, 1757 AMT_ACT_STATUS_FWD_NEW, 1758 v6); 1759 /* Update EXCLUDE(X,) sources as FWD/NEW */ 1760 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1761 AMT_FILTER_FWD, 1762 AMT_ACT_STATUS_FWD_NEW, 1763 v6); 1764 /* EXCLUDE (, Y-A) 1765 * (A) are already switched to FWD_NEW. 1766 * So, D_FWD/OLD -> D_FWD/NEW is okay. 1767 */ 1768 amt_lookup_act_srcs(tunnel, gnode, zero_grec, AMT_OPS_UNI, 1769 AMT_FILTER_D_FWD, 1770 AMT_ACT_STATUS_D_FWD_NEW, 1771 v6); 1772 /* (A)=GMI 1773 * Only FWD_NEW will have (A) sources. 1774 */ 1775 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1776 AMT_FILTER_FWD_NEW, 1777 AMT_ACT_GMI, 1778 v6); 1779 } 1780 } 1781 1782 static void amt_mcast_to_ex_handler(struct amt_dev *amt, 1783 struct amt_tunnel_list *tunnel, 1784 struct amt_group_node *gnode, 1785 void *grec, void *zero_grec, bool v6) 1786 { 1787 if (gnode->filter_mode == MCAST_INCLUDE) { 1788 /* Router State Report Rec'd New Router State Actions 1789 * ------------ ------------ ---------------- ------- 1790 * INCLUDE (A) TO_EX (B) EXCLUDE (A*B,B-A) (B-A)=0 1791 * Delete (A-B) 1792 * Send Q(G,A*B) 1793 * Group Timer=GMI 1794 */ 1795 /* EXCLUDE (A*B, ) */ 1796 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1797 AMT_FILTER_FWD, 1798 AMT_ACT_STATUS_FWD_NEW, 1799 v6); 1800 /* EXCLUDE (, B-A) */ 1801 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB_REV, 1802 AMT_FILTER_FWD, 1803 AMT_ACT_STATUS_D_FWD_NEW, 1804 v6); 1805 /* (B-A)=0 */ 1806 amt_lookup_act_srcs(tunnel, gnode, zero_grec, AMT_OPS_UNI, 1807 AMT_FILTER_D_FWD_NEW, 1808 AMT_ACT_GMI_ZERO, 1809 v6); 1810 /* Group Timer=GMI */ 1811 if (!mod_delayed_work(amt_wq, &gnode->group_timer, 1812 msecs_to_jiffies(amt_gmi(amt)))) 1813 dev_hold(amt->dev); 1814 gnode->filter_mode = MCAST_EXCLUDE; 1815 /* Delete (A-B) will be worked by amt_cleanup_srcs(). */ 1816 } else { 1817 /* Router State Report Rec'd New Router State Actions 1818 * ------------ ------------ ---------------- ------- 1819 * EXCLUDE (X,Y) TO_EX (A) EXCLUDE (A-Y,Y*A) (A-X-Y)=Group Timer 1820 * Delete (X-A) 1821 * Delete (Y-A) 1822 * Send Q(G,A-Y) 1823 * Group Timer=GMI 1824 */ 1825 /* Update (A-X-Y) as NONE/OLD */ 1826 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB_REV, 1827 AMT_FILTER_BOTH, 1828 AMT_ACT_GT, 1829 v6); 1830 /* EXCLUDE (A-Y, ) */ 1831 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB_REV, 1832 AMT_FILTER_D_FWD, 1833 AMT_ACT_STATUS_FWD_NEW, 1834 v6); 1835 /* EXCLUDE (, Y*A) */ 1836 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1837 AMT_FILTER_D_FWD, 1838 AMT_ACT_STATUS_D_FWD_NEW, 1839 v6); 1840 /* Group Timer=GMI */ 1841 if (!mod_delayed_work(amt_wq, &gnode->group_timer, 1842 msecs_to_jiffies(amt_gmi(amt)))) 1843 dev_hold(amt->dev); 1844 /* Delete (X-A), (Y-A) will be worked by amt_cleanup_srcs(). */ 1845 } 1846 } 1847 1848 static void amt_mcast_allow_handler(struct amt_dev *amt, 1849 struct amt_tunnel_list *tunnel, 1850 struct amt_group_node *gnode, 1851 void *grec, void *zero_grec, bool v6) 1852 { 1853 if (gnode->filter_mode == MCAST_INCLUDE) { 1854 /* Router State Report Rec'd New Router State Actions 1855 * ------------ ------------ ---------------- ------- 1856 * INCLUDE (A) ALLOW (B) INCLUDE (A+B) (B)=GMI 1857 */ 1858 /* INCLUDE (A+B) */ 1859 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1860 AMT_FILTER_FWD, 1861 AMT_ACT_STATUS_FWD_NEW, 1862 v6); 1863 /* (B)=GMI */ 1864 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1865 AMT_FILTER_FWD_NEW, 1866 AMT_ACT_GMI, 1867 v6); 1868 } else { 1869 /* Router State Report Rec'd New Router State Actions 1870 * ------------ ------------ ---------------- ------- 1871 * EXCLUDE (X,Y) ALLOW (A) EXCLUDE (X+A,Y-A) (A)=GMI 1872 */ 1873 /* EXCLUDE (X+A, ) */ 1874 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1875 AMT_FILTER_FWD, 1876 AMT_ACT_STATUS_FWD_NEW, 1877 v6); 1878 /* EXCLUDE (, Y-A) */ 1879 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB, 1880 AMT_FILTER_D_FWD, 1881 AMT_ACT_STATUS_D_FWD_NEW, 1882 v6); 1883 /* (A)=GMI 1884 * All (A) source are now FWD/NEW status. 1885 */ 1886 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1887 AMT_FILTER_FWD_NEW, 1888 AMT_ACT_GMI, 1889 v6); 1890 } 1891 } 1892 1893 static void amt_mcast_block_handler(struct amt_dev *amt, 1894 struct amt_tunnel_list *tunnel, 1895 struct amt_group_node *gnode, 1896 void *grec, void *zero_grec, bool v6) 1897 { 1898 if (gnode->filter_mode == MCAST_INCLUDE) { 1899 /* Router State Report Rec'd New Router State Actions 1900 * ------------ ------------ ---------------- ------- 1901 * INCLUDE (A) BLOCK (B) INCLUDE (A) Send Q(G,A*B) 1902 */ 1903 /* INCLUDE (A) */ 1904 amt_lookup_act_srcs(tunnel, gnode, zero_grec, AMT_OPS_UNI, 1905 AMT_FILTER_FWD, 1906 AMT_ACT_STATUS_FWD_NEW, 1907 v6); 1908 } else { 1909 /* Router State Report Rec'd New Router State Actions 1910 * ------------ ------------ ---------------- ------- 1911 * EXCLUDE (X,Y) BLOCK (A) EXCLUDE (X+(A-Y),Y) (A-X-Y)=Group Timer 1912 * Send Q(G,A-Y) 1913 */ 1914 /* (A-X-Y)=Group Timer */ 1915 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB_REV, 1916 AMT_FILTER_BOTH, 1917 AMT_ACT_GT, 1918 v6); 1919 /* EXCLUDE (X, ) */ 1920 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1921 AMT_FILTER_FWD, 1922 AMT_ACT_STATUS_FWD_NEW, 1923 v6); 1924 /* EXCLUDE (X+(A-Y) */ 1925 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB_REV, 1926 AMT_FILTER_D_FWD, 1927 AMT_ACT_STATUS_FWD_NEW, 1928 v6); 1929 /* EXCLUDE (, Y) */ 1930 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1931 AMT_FILTER_D_FWD, 1932 AMT_ACT_STATUS_D_FWD_NEW, 1933 v6); 1934 } 1935 } 1936 1937 /* RFC 3376 1938 * 7.3.2. In the Presence of Older Version Group Members 1939 * 1940 * When Group Compatibility Mode is IGMPv2, a router internally 1941 * translates the following IGMPv2 messages for that group to their 1942 * IGMPv3 equivalents: 1943 * 1944 * IGMPv2 Message IGMPv3 Equivalent 1945 * -------------- ----------------- 1946 * Report IS_EX( {} ) 1947 * Leave TO_IN( {} ) 1948 */ 1949 static void amt_igmpv2_report_handler(struct amt_dev *amt, struct sk_buff *skb, 1950 struct amt_tunnel_list *tunnel) 1951 { 1952 struct igmphdr *ih = igmp_hdr(skb); 1953 struct iphdr *iph = ip_hdr(skb); 1954 struct amt_group_node *gnode; 1955 union amt_addr group, host; 1956 1957 memset(&group, 0, sizeof(union amt_addr)); 1958 group.ip4 = ih->group; 1959 memset(&host, 0, sizeof(union amt_addr)); 1960 host.ip4 = iph->saddr; 1961 1962 gnode = amt_lookup_group(tunnel, &group, &host, false); 1963 if (!gnode) { 1964 gnode = amt_add_group(amt, tunnel, &group, &host, false); 1965 if (!IS_ERR(gnode)) { 1966 gnode->filter_mode = MCAST_EXCLUDE; 1967 if (!mod_delayed_work(amt_wq, &gnode->group_timer, 1968 msecs_to_jiffies(amt_gmi(amt)))) 1969 dev_hold(amt->dev); 1970 } 1971 } 1972 } 1973 1974 /* RFC 3376 1975 * 7.3.2. In the Presence of Older Version Group Members 1976 * 1977 * When Group Compatibility Mode is IGMPv2, a router internally 1978 * translates the following IGMPv2 messages for that group to their 1979 * IGMPv3 equivalents: 1980 * 1981 * IGMPv2 Message IGMPv3 Equivalent 1982 * -------------- ----------------- 1983 * Report IS_EX( {} ) 1984 * Leave TO_IN( {} ) 1985 */ 1986 static void amt_igmpv2_leave_handler(struct amt_dev *amt, struct sk_buff *skb, 1987 struct amt_tunnel_list *tunnel) 1988 { 1989 struct igmphdr *ih = igmp_hdr(skb); 1990 struct iphdr *iph = ip_hdr(skb); 1991 struct amt_group_node *gnode; 1992 union amt_addr group, host; 1993 1994 memset(&group, 0, sizeof(union amt_addr)); 1995 group.ip4 = ih->group; 1996 memset(&host, 0, sizeof(union amt_addr)); 1997 host.ip4 = iph->saddr; 1998 1999 gnode = amt_lookup_group(tunnel, &group, &host, false); 2000 if (gnode) 2001 amt_del_group(amt, gnode); 2002 } 2003 2004 static void amt_igmpv3_report_handler(struct amt_dev *amt, struct sk_buff *skb, 2005 struct amt_tunnel_list *tunnel) 2006 { 2007 struct igmpv3_report *ihrv3 = igmpv3_report_hdr(skb); 2008 int len = skb_transport_offset(skb) + sizeof(*ihrv3); 2009 void *zero_grec = (void *)&igmpv3_zero_grec; 2010 struct amt_group_node *gnode; 2011 union amt_addr group, host; 2012 struct igmpv3_grec *grec; 2013 __be32 saddr; 2014 u16 nsrcs; 2015 u16 ngrec; 2016 int i; 2017 2018 saddr = ip_hdr(skb)->saddr; 2019 ngrec = ntohs(ihrv3->ngrec); 2020 2021 for (i = 0; i < ngrec; i++) { 2022 len += sizeof(*grec); 2023 if (!ip_mc_may_pull(skb, len)) 2024 break; 2025 2026 grec = (void *)(skb->data + len - sizeof(*grec)); 2027 nsrcs = ntohs(grec->grec_nsrcs); 2028 2029 len += nsrcs * sizeof(__be32); 2030 if (!ip_mc_may_pull(skb, len)) 2031 break; 2032 2033 grec = (void *)(skb->data + len - sizeof(*grec) - 2034 nsrcs * sizeof(__be32)); 2035 2036 memset(&group, 0, sizeof(union amt_addr)); 2037 group.ip4 = grec->grec_mca; 2038 memset(&host, 0, sizeof(union amt_addr)); 2039 host.ip4 = saddr; 2040 gnode = amt_lookup_group(tunnel, &group, &host, false); 2041 if (!gnode) { 2042 gnode = amt_add_group(amt, tunnel, &group, &host, 2043 false); 2044 if (IS_ERR(gnode)) 2045 continue; 2046 } 2047 2048 amt_add_srcs(amt, tunnel, gnode, grec, false); 2049 switch (grec->grec_type) { 2050 case IGMPV3_MODE_IS_INCLUDE: 2051 amt_mcast_is_in_handler(amt, tunnel, gnode, grec, 2052 zero_grec, false); 2053 break; 2054 case IGMPV3_MODE_IS_EXCLUDE: 2055 amt_mcast_is_ex_handler(amt, tunnel, gnode, grec, 2056 zero_grec, false); 2057 break; 2058 case IGMPV3_CHANGE_TO_INCLUDE: 2059 amt_mcast_to_in_handler(amt, tunnel, gnode, grec, 2060 zero_grec, false); 2061 break; 2062 case IGMPV3_CHANGE_TO_EXCLUDE: 2063 amt_mcast_to_ex_handler(amt, tunnel, gnode, grec, 2064 zero_grec, false); 2065 break; 2066 case IGMPV3_ALLOW_NEW_SOURCES: 2067 amt_mcast_allow_handler(amt, tunnel, gnode, grec, 2068 zero_grec, false); 2069 break; 2070 case IGMPV3_BLOCK_OLD_SOURCES: 2071 amt_mcast_block_handler(amt, tunnel, gnode, grec, 2072 zero_grec, false); 2073 break; 2074 default: 2075 break; 2076 } 2077 amt_cleanup_srcs(amt, tunnel, gnode); 2078 } 2079 } 2080 2081 /* caller held tunnel->lock */ 2082 static void amt_igmp_report_handler(struct amt_dev *amt, struct sk_buff *skb, 2083 struct amt_tunnel_list *tunnel) 2084 { 2085 struct igmphdr *ih = igmp_hdr(skb); 2086 2087 switch (ih->type) { 2088 case IGMPV3_HOST_MEMBERSHIP_REPORT: 2089 amt_igmpv3_report_handler(amt, skb, tunnel); 2090 break; 2091 case IGMPV2_HOST_MEMBERSHIP_REPORT: 2092 amt_igmpv2_report_handler(amt, skb, tunnel); 2093 break; 2094 case IGMP_HOST_LEAVE_MESSAGE: 2095 amt_igmpv2_leave_handler(amt, skb, tunnel); 2096 break; 2097 default: 2098 break; 2099 } 2100 } 2101 2102 #if IS_ENABLED(CONFIG_IPV6) 2103 /* RFC 3810 2104 * 8.3.2. In the Presence of MLDv1 Multicast Address Listeners 2105 * 2106 * When Multicast Address Compatibility Mode is MLDv2, a router acts 2107 * using the MLDv2 protocol for that multicast address. When Multicast 2108 * Address Compatibility Mode is MLDv1, a router internally translates 2109 * the following MLDv1 messages for that multicast address to their 2110 * MLDv2 equivalents: 2111 * 2112 * MLDv1 Message MLDv2 Equivalent 2113 * -------------- ----------------- 2114 * Report IS_EX( {} ) 2115 * Done TO_IN( {} ) 2116 */ 2117 static void amt_mldv1_report_handler(struct amt_dev *amt, struct sk_buff *skb, 2118 struct amt_tunnel_list *tunnel) 2119 { 2120 struct mld_msg *mld = (struct mld_msg *)icmp6_hdr(skb); 2121 struct ipv6hdr *ip6h = ipv6_hdr(skb); 2122 struct amt_group_node *gnode; 2123 union amt_addr group, host; 2124 2125 memcpy(&group.ip6, &mld->mld_mca, sizeof(struct in6_addr)); 2126 memcpy(&host.ip6, &ip6h->saddr, sizeof(struct in6_addr)); 2127 2128 gnode = amt_lookup_group(tunnel, &group, &host, true); 2129 if (!gnode) { 2130 gnode = amt_add_group(amt, tunnel, &group, &host, true); 2131 if (!IS_ERR(gnode)) { 2132 gnode->filter_mode = MCAST_EXCLUDE; 2133 if (!mod_delayed_work(amt_wq, &gnode->group_timer, 2134 msecs_to_jiffies(amt_gmi(amt)))) 2135 dev_hold(amt->dev); 2136 } 2137 } 2138 } 2139 2140 /* RFC 3810 2141 * 8.3.2. In the Presence of MLDv1 Multicast Address Listeners 2142 * 2143 * When Multicast Address Compatibility Mode is MLDv2, a router acts 2144 * using the MLDv2 protocol for that multicast address. When Multicast 2145 * Address Compatibility Mode is MLDv1, a router internally translates 2146 * the following MLDv1 messages for that multicast address to their 2147 * MLDv2 equivalents: 2148 * 2149 * MLDv1 Message MLDv2 Equivalent 2150 * -------------- ----------------- 2151 * Report IS_EX( {} ) 2152 * Done TO_IN( {} ) 2153 */ 2154 static void amt_mldv1_leave_handler(struct amt_dev *amt, struct sk_buff *skb, 2155 struct amt_tunnel_list *tunnel) 2156 { 2157 struct mld_msg *mld = (struct mld_msg *)icmp6_hdr(skb); 2158 struct iphdr *iph = ip_hdr(skb); 2159 struct amt_group_node *gnode; 2160 union amt_addr group, host; 2161 2162 memcpy(&group.ip6, &mld->mld_mca, sizeof(struct in6_addr)); 2163 memset(&host, 0, sizeof(union amt_addr)); 2164 host.ip4 = iph->saddr; 2165 2166 gnode = amt_lookup_group(tunnel, &group, &host, true); 2167 if (gnode) { 2168 amt_del_group(amt, gnode); 2169 return; 2170 } 2171 } 2172 2173 static void amt_mldv2_report_handler(struct amt_dev *amt, struct sk_buff *skb, 2174 struct amt_tunnel_list *tunnel) 2175 { 2176 struct mld2_report *mld2r = (struct mld2_report *)icmp6_hdr(skb); 2177 int len = skb_transport_offset(skb) + sizeof(*mld2r); 2178 void *zero_grec = (void *)&mldv2_zero_grec; 2179 struct amt_group_node *gnode; 2180 union amt_addr group, host; 2181 struct mld2_grec *grec; 2182 struct in6_addr saddr; 2183 u16 nsrcs; 2184 u16 ngrec; 2185 int i; 2186 2187 saddr = ipv6_hdr(skb)->saddr; 2188 ngrec = ntohs(mld2r->mld2r_ngrec); 2189 2190 for (i = 0; i < ngrec; i++) { 2191 len += sizeof(*grec); 2192 if (!ipv6_mc_may_pull(skb, len)) 2193 break; 2194 2195 grec = (void *)(skb->data + len - sizeof(*grec)); 2196 nsrcs = ntohs(grec->grec_nsrcs); 2197 2198 len += nsrcs * sizeof(struct in6_addr); 2199 if (!ipv6_mc_may_pull(skb, len)) 2200 break; 2201 2202 grec = (void *)(skb->data + len - sizeof(*grec) - 2203 nsrcs * sizeof(struct in6_addr)); 2204 2205 memset(&group, 0, sizeof(union amt_addr)); 2206 group.ip6 = grec->grec_mca; 2207 memset(&host, 0, sizeof(union amt_addr)); 2208 host.ip6 = saddr; 2209 gnode = amt_lookup_group(tunnel, &group, &host, true); 2210 if (!gnode) { 2211 gnode = amt_add_group(amt, tunnel, &group, &host, 2212 ETH_P_IPV6); 2213 if (IS_ERR(gnode)) 2214 continue; 2215 } 2216 2217 amt_add_srcs(amt, tunnel, gnode, grec, true); 2218 switch (grec->grec_type) { 2219 case MLD2_MODE_IS_INCLUDE: 2220 amt_mcast_is_in_handler(amt, tunnel, gnode, grec, 2221 zero_grec, true); 2222 break; 2223 case MLD2_MODE_IS_EXCLUDE: 2224 amt_mcast_is_ex_handler(amt, tunnel, gnode, grec, 2225 zero_grec, true); 2226 break; 2227 case MLD2_CHANGE_TO_INCLUDE: 2228 amt_mcast_to_in_handler(amt, tunnel, gnode, grec, 2229 zero_grec, true); 2230 break; 2231 case MLD2_CHANGE_TO_EXCLUDE: 2232 amt_mcast_to_ex_handler(amt, tunnel, gnode, grec, 2233 zero_grec, true); 2234 break; 2235 case MLD2_ALLOW_NEW_SOURCES: 2236 amt_mcast_allow_handler(amt, tunnel, gnode, grec, 2237 zero_grec, true); 2238 break; 2239 case MLD2_BLOCK_OLD_SOURCES: 2240 amt_mcast_block_handler(amt, tunnel, gnode, grec, 2241 zero_grec, true); 2242 break; 2243 default: 2244 break; 2245 } 2246 amt_cleanup_srcs(amt, tunnel, gnode); 2247 } 2248 } 2249 2250 /* caller held tunnel->lock */ 2251 static void amt_mld_report_handler(struct amt_dev *amt, struct sk_buff *skb, 2252 struct amt_tunnel_list *tunnel) 2253 { 2254 struct mld_msg *mld = (struct mld_msg *)icmp6_hdr(skb); 2255 2256 switch (mld->mld_type) { 2257 case ICMPV6_MGM_REPORT: 2258 amt_mldv1_report_handler(amt, skb, tunnel); 2259 break; 2260 case ICMPV6_MLD2_REPORT: 2261 amt_mldv2_report_handler(amt, skb, tunnel); 2262 break; 2263 case ICMPV6_MGM_REDUCTION: 2264 amt_mldv1_leave_handler(amt, skb, tunnel); 2265 break; 2266 default: 2267 break; 2268 } 2269 } 2270 #endif 2271 2272 static bool amt_advertisement_handler(struct amt_dev *amt, struct sk_buff *skb) 2273 { 2274 struct amt_header_advertisement *amta; 2275 int hdr_size; 2276 2277 hdr_size = sizeof(*amta) + sizeof(struct udphdr); 2278 if (!pskb_may_pull(skb, hdr_size)) 2279 return true; 2280 2281 amta = (struct amt_header_advertisement *)(udp_hdr(skb) + 1); 2282 if (!amta->ip4) 2283 return true; 2284 2285 if (amta->reserved || amta->version) 2286 return true; 2287 2288 if (ipv4_is_loopback(amta->ip4) || ipv4_is_multicast(amta->ip4) || 2289 ipv4_is_zeronet(amta->ip4)) 2290 return true; 2291 2292 if (amt->status != AMT_STATUS_SENT_DISCOVERY || 2293 amt->nonce != amta->nonce) 2294 return true; 2295 2296 WRITE_ONCE(amt->remote_ip, amta->ip4); 2297 netdev_dbg(amt->dev, "advertised remote ip = %pI4\n", &amta->ip4); 2298 mod_delayed_work(amt_wq, &amt->req_wq, 0); 2299 2300 amt_update_gw_status(amt, AMT_STATUS_RECEIVED_ADVERTISEMENT, true); 2301 return false; 2302 } 2303 2304 static bool amt_multicast_data_handler(struct amt_dev *amt, struct sk_buff *skb) 2305 { 2306 struct amt_header_mcast_data *amtmd; 2307 int hdr_size, len, err; 2308 struct ethhdr *eth; 2309 struct iphdr *iph; 2310 2311 if (READ_ONCE(amt->status) != AMT_STATUS_SENT_UPDATE) 2312 return true; 2313 2314 hdr_size = sizeof(*amtmd) + sizeof(struct udphdr); 2315 if (!pskb_may_pull(skb, hdr_size)) 2316 return true; 2317 2318 amtmd = (struct amt_header_mcast_data *)(udp_hdr(skb) + 1); 2319 if (amtmd->reserved || amtmd->version) 2320 return true; 2321 2322 if (iptunnel_pull_header(skb, hdr_size, htons(ETH_P_IP), false)) 2323 return true; 2324 2325 skb_reset_network_header(skb); 2326 skb_push(skb, sizeof(*eth)); 2327 skb_reset_mac_header(skb); 2328 skb_pull(skb, sizeof(*eth)); 2329 2330 if (skb_cow_head(skb, 0)) 2331 return true; 2332 2333 if (!pskb_may_pull(skb, sizeof(*iph))) 2334 return true; 2335 iph = ip_hdr(skb); 2336 2337 if (iph->version == 4) { 2338 if (!ipv4_is_multicast(iph->daddr)) 2339 return true; 2340 skb->protocol = htons(ETH_P_IP); 2341 eth = eth_hdr(skb); 2342 eth->h_proto = htons(ETH_P_IP); 2343 ip_eth_mc_map(iph->daddr, eth->h_dest); 2344 #if IS_ENABLED(CONFIG_IPV6) 2345 } else if (iph->version == 6) { 2346 struct ipv6hdr *ip6h; 2347 2348 if (!pskb_may_pull(skb, sizeof(*ip6h))) 2349 return true; 2350 2351 ip6h = ipv6_hdr(skb); 2352 if (!ipv6_addr_is_multicast(&ip6h->daddr)) 2353 return true; 2354 skb->protocol = htons(ETH_P_IPV6); 2355 eth = eth_hdr(skb); 2356 eth->h_proto = htons(ETH_P_IPV6); 2357 ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest); 2358 #endif 2359 } else { 2360 return true; 2361 } 2362 2363 skb->pkt_type = PACKET_MULTICAST; 2364 skb->ip_summed = CHECKSUM_NONE; 2365 len = skb->len; 2366 err = gro_cells_receive(&amt->gro_cells, skb); 2367 if (likely(err == NET_RX_SUCCESS)) 2368 dev_sw_netstats_rx_add(amt->dev, len); 2369 else 2370 amt->dev->stats.rx_dropped++; 2371 2372 return false; 2373 } 2374 2375 static bool amt_membership_query_handler(struct amt_dev *amt, 2376 struct sk_buff *skb) 2377 { 2378 struct amt_header_membership_query *amtmq; 2379 struct ethhdr *eth, *oeth; 2380 struct igmpv3_query *ihv3; 2381 u8 h_source[ETH_ALEN]; 2382 struct iphdr *iph; 2383 int hdr_size, len; 2384 u64 response_mac; 2385 2386 hdr_size = sizeof(*amtmq) + sizeof(struct udphdr); 2387 if (!pskb_may_pull(skb, hdr_size)) 2388 return true; 2389 2390 amtmq = (struct amt_header_membership_query *)(udp_hdr(skb) + 1); 2391 if (amtmq->reserved || amtmq->version) 2392 return true; 2393 2394 if (amtmq->nonce != amt->nonce) 2395 return true; 2396 2397 response_mac = amtmq->response_mac; 2398 2399 hdr_size -= sizeof(*eth); 2400 if (iptunnel_pull_header(skb, hdr_size, htons(ETH_P_TEB), false)) 2401 return true; 2402 2403 oeth = eth_hdr(skb); 2404 skb_reset_mac_header(skb); 2405 skb_pull(skb, sizeof(*eth)); 2406 skb_reset_network_header(skb); 2407 eth = eth_hdr(skb); 2408 ether_addr_copy(h_source, oeth->h_source); 2409 if (skb_cow_head(skb, 0)) 2410 return true; 2411 if (!pskb_may_pull(skb, sizeof(*iph))) 2412 return true; 2413 2414 iph = ip_hdr(skb); 2415 if (iph->version == 4) { 2416 if (READ_ONCE(amt->ready4)) 2417 return true; 2418 2419 if (!pskb_may_pull(skb, sizeof(*iph) + AMT_IPHDR_OPTS + 2420 sizeof(*ihv3))) 2421 return true; 2422 2423 iph = ip_hdr(skb); 2424 if (!ipv4_is_multicast(iph->daddr)) 2425 return true; 2426 2427 ihv3 = skb_pull(skb, sizeof(*iph) + AMT_IPHDR_OPTS); 2428 skb_reset_transport_header(skb); 2429 skb_push(skb, sizeof(*iph) + AMT_IPHDR_OPTS); 2430 WRITE_ONCE(amt->ready4, true); 2431 amt->mac = response_mac; 2432 amt->req_cnt = 0; 2433 amt->qi = ihv3->qqic; 2434 skb->protocol = htons(ETH_P_IP); 2435 eth = eth_hdr(skb); 2436 eth->h_proto = htons(ETH_P_IP); 2437 ip_eth_mc_map(iph->daddr, eth->h_dest); 2438 #if IS_ENABLED(CONFIG_IPV6) 2439 } else if (iph->version == 6) { 2440 struct mld2_query *mld2q; 2441 struct ipv6hdr *ip6h; 2442 2443 if (READ_ONCE(amt->ready6)) 2444 return true; 2445 2446 if (!pskb_may_pull(skb, sizeof(*ip6h) + AMT_IP6HDR_OPTS + 2447 sizeof(*mld2q))) 2448 return true; 2449 2450 ip6h = ipv6_hdr(skb); 2451 if (!ipv6_addr_is_multicast(&ip6h->daddr)) 2452 return true; 2453 2454 mld2q = skb_pull(skb, sizeof(*ip6h) + AMT_IP6HDR_OPTS); 2455 skb_reset_transport_header(skb); 2456 skb_push(skb, sizeof(*ip6h) + AMT_IP6HDR_OPTS); 2457 WRITE_ONCE(amt->ready6, true); 2458 amt->mac = response_mac; 2459 amt->req_cnt = 0; 2460 amt->qi = mld2q->mld2q_qqic; 2461 skb->protocol = htons(ETH_P_IPV6); 2462 eth = eth_hdr(skb); 2463 eth->h_proto = htons(ETH_P_IPV6); 2464 ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest); 2465 #endif 2466 } else { 2467 return true; 2468 } 2469 2470 ether_addr_copy(eth->h_source, h_source); 2471 skb->pkt_type = PACKET_MULTICAST; 2472 skb->ip_summed = CHECKSUM_NONE; 2473 len = skb->len; 2474 local_bh_disable(); 2475 if (__netif_rx(skb) == NET_RX_SUCCESS) { 2476 amt_update_gw_status(amt, AMT_STATUS_RECEIVED_QUERY, true); 2477 dev_sw_netstats_rx_add(amt->dev, len); 2478 } else { 2479 amt->dev->stats.rx_dropped++; 2480 } 2481 local_bh_enable(); 2482 2483 return false; 2484 } 2485 2486 static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb) 2487 { 2488 struct amt_header_membership_update *amtmu; 2489 struct amt_tunnel_list *tunnel; 2490 struct ethhdr *eth; 2491 struct iphdr *iph; 2492 int len, hdr_size; 2493 u64 response_mac; 2494 __be32 saddr; 2495 __be32 nonce; 2496 2497 saddr = ip_hdr(skb)->saddr; 2498 2499 hdr_size = sizeof(*amtmu) + sizeof(struct udphdr); 2500 if (!pskb_may_pull(skb, hdr_size)) 2501 return true; 2502 2503 amtmu = (struct amt_header_membership_update *)(udp_hdr(skb) + 1); 2504 if (amtmu->reserved || amtmu->version) 2505 return true; 2506 2507 nonce = amtmu->nonce; 2508 response_mac = amtmu->response_mac; 2509 2510 if (iptunnel_pull_header(skb, hdr_size, skb->protocol, false)) 2511 return true; 2512 2513 skb_reset_network_header(skb); 2514 2515 list_for_each_entry_rcu(tunnel, &amt->tunnel_list, list) { 2516 if (tunnel->ip4 == saddr) { 2517 if ((nonce == tunnel->nonce && 2518 response_mac == tunnel->mac)) { 2519 mod_delayed_work(amt_wq, &tunnel->gc_wq, 2520 msecs_to_jiffies(amt_gmi(amt)) 2521 * 3); 2522 goto report; 2523 } else { 2524 netdev_dbg(amt->dev, "Invalid MAC\n"); 2525 return true; 2526 } 2527 } 2528 } 2529 2530 return true; 2531 2532 report: 2533 if (!pskb_may_pull(skb, sizeof(*iph))) 2534 return true; 2535 2536 if (skb_cow_head(skb, 0)) 2537 return true; 2538 2539 iph = ip_hdr(skb); 2540 if (iph->version == 4) { 2541 if (ip_mc_check_igmp(skb)) { 2542 netdev_dbg(amt->dev, "Invalid IGMP\n"); 2543 return true; 2544 } 2545 2546 spin_lock_bh(&tunnel->lock); 2547 amt_igmp_report_handler(amt, skb, tunnel); 2548 spin_unlock_bh(&tunnel->lock); 2549 2550 skb_push(skb, sizeof(struct ethhdr)); 2551 skb_reset_mac_header(skb); 2552 eth = eth_hdr(skb); 2553 skb->protocol = htons(ETH_P_IP); 2554 eth->h_proto = htons(ETH_P_IP); 2555 iph = ip_hdr(skb); 2556 ip_eth_mc_map(iph->daddr, eth->h_dest); 2557 #if IS_ENABLED(CONFIG_IPV6) 2558 } else if (iph->version == 6) { 2559 struct ipv6hdr *ip6h = ipv6_hdr(skb); 2560 2561 if (ipv6_mc_check_mld(skb)) { 2562 netdev_dbg(amt->dev, "Invalid MLD\n"); 2563 return true; 2564 } 2565 2566 spin_lock_bh(&tunnel->lock); 2567 amt_mld_report_handler(amt, skb, tunnel); 2568 spin_unlock_bh(&tunnel->lock); 2569 2570 skb_push(skb, sizeof(struct ethhdr)); 2571 skb_reset_mac_header(skb); 2572 eth = eth_hdr(skb); 2573 skb->protocol = htons(ETH_P_IPV6); 2574 eth->h_proto = htons(ETH_P_IPV6); 2575 ip6h = ipv6_hdr(skb); 2576 ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest); 2577 #endif 2578 } else { 2579 netdev_dbg(amt->dev, "Unsupported Protocol\n"); 2580 return true; 2581 } 2582 2583 skb_pull(skb, sizeof(struct ethhdr)); 2584 skb->pkt_type = PACKET_MULTICAST; 2585 skb->ip_summed = CHECKSUM_NONE; 2586 len = skb->len; 2587 if (__netif_rx(skb) == NET_RX_SUCCESS) { 2588 amt_update_relay_status(tunnel, AMT_STATUS_RECEIVED_UPDATE, 2589 true); 2590 dev_sw_netstats_rx_add(amt->dev, len); 2591 } else { 2592 amt->dev->stats.rx_dropped++; 2593 } 2594 2595 return false; 2596 } 2597 2598 static void amt_send_advertisement(struct amt_dev *amt, __be32 nonce, 2599 __be32 daddr, __be16 dport) 2600 { 2601 struct amt_header_advertisement *amta; 2602 int hlen, tlen, offset; 2603 struct udphdr *udph; 2604 struct sk_buff *skb; 2605 struct iphdr *iph; 2606 struct rtable *rt; 2607 struct flowi4 fl4; 2608 struct sock *sk; 2609 u32 len; 2610 int err; 2611 2612 rcu_read_lock(); 2613 sk = rcu_dereference(amt->sk); 2614 if (!sk) 2615 goto out; 2616 2617 if (!netif_running(amt->stream_dev) || !netif_running(amt->dev)) 2618 goto out; 2619 2620 rt = ip_route_output_ports(amt->net, &fl4, sk, 2621 daddr, amt->local_ip, 2622 dport, amt->relay_port, 2623 IPPROTO_UDP, 0, 2624 amt->stream_dev->ifindex); 2625 if (IS_ERR(rt)) { 2626 amt->dev->stats.tx_errors++; 2627 goto out; 2628 } 2629 2630 hlen = LL_RESERVED_SPACE(amt->dev); 2631 tlen = amt->dev->needed_tailroom; 2632 len = hlen + tlen + sizeof(*iph) + sizeof(*udph) + sizeof(*amta); 2633 skb = netdev_alloc_skb_ip_align(amt->dev, len); 2634 if (!skb) { 2635 ip_rt_put(rt); 2636 amt->dev->stats.tx_errors++; 2637 goto out; 2638 } 2639 2640 skb->priority = TC_PRIO_CONTROL; 2641 skb_dst_set(skb, &rt->dst); 2642 2643 len = sizeof(*iph) + sizeof(*udph) + sizeof(*amta); 2644 skb_reset_network_header(skb); 2645 skb_put(skb, len); 2646 amta = skb_pull(skb, sizeof(*iph) + sizeof(*udph)); 2647 amta->version = 0; 2648 amta->type = AMT_MSG_ADVERTISEMENT; 2649 amta->reserved = 0; 2650 amta->nonce = nonce; 2651 amta->ip4 = amt->local_ip; 2652 skb_push(skb, sizeof(*udph)); 2653 skb_reset_transport_header(skb); 2654 udph = udp_hdr(skb); 2655 udph->source = amt->relay_port; 2656 udph->dest = dport; 2657 udp_set_len_short(udph, sizeof(*amta) + sizeof(*udph)); 2658 udph->check = 0; 2659 offset = skb_transport_offset(skb); 2660 skb->csum = skb_checksum(skb, offset, skb->len - offset, 0); 2661 udph->check = csum_tcpudp_magic(amt->local_ip, daddr, 2662 sizeof(*udph) + sizeof(*amta), 2663 IPPROTO_UDP, skb->csum); 2664 2665 skb_push(skb, sizeof(*iph)); 2666 iph = ip_hdr(skb); 2667 iph->version = 4; 2668 iph->ihl = (sizeof(struct iphdr)) >> 2; 2669 iph->tos = AMT_TOS; 2670 iph->frag_off = 0; 2671 iph->ttl = ip4_dst_hoplimit(&rt->dst); 2672 iph->daddr = daddr; 2673 iph->saddr = amt->local_ip; 2674 iph->protocol = IPPROTO_UDP; 2675 iph->tot_len = htons(len); 2676 2677 skb->ip_summed = CHECKSUM_NONE; 2678 ip_select_ident(amt->net, skb, NULL); 2679 ip_send_check(iph); 2680 err = ip_local_out(amt->net, sk, skb); 2681 if (unlikely(net_xmit_eval(err))) 2682 amt->dev->stats.tx_errors++; 2683 2684 out: 2685 rcu_read_unlock(); 2686 } 2687 2688 static bool amt_discovery_handler(struct amt_dev *amt, struct sk_buff *skb) 2689 { 2690 struct amt_header_discovery *amtd; 2691 struct udphdr *udph; 2692 struct iphdr *iph; 2693 2694 if (!pskb_may_pull(skb, sizeof(*udph) + sizeof(*amtd))) 2695 return true; 2696 2697 iph = ip_hdr(skb); 2698 udph = udp_hdr(skb); 2699 amtd = (struct amt_header_discovery *)(udp_hdr(skb) + 1); 2700 2701 if (amtd->reserved || amtd->version) 2702 return true; 2703 2704 amt_send_advertisement(amt, amtd->nonce, iph->saddr, udph->source); 2705 2706 return false; 2707 } 2708 2709 static bool amt_request_handler(struct amt_dev *amt, struct sk_buff *skb) 2710 { 2711 struct amt_header_request *amtrh; 2712 struct amt_tunnel_list *tunnel; 2713 unsigned long long key; 2714 struct udphdr *udph; 2715 struct iphdr *iph; 2716 u64 mac; 2717 int i; 2718 2719 if (!pskb_may_pull(skb, sizeof(*udph) + sizeof(*amtrh))) 2720 return true; 2721 2722 iph = ip_hdr(skb); 2723 udph = udp_hdr(skb); 2724 amtrh = (struct amt_header_request *)(udp_hdr(skb) + 1); 2725 2726 if (amtrh->reserved1 || amtrh->reserved2 || amtrh->version) 2727 return true; 2728 2729 list_for_each_entry_rcu(tunnel, &amt->tunnel_list, list) 2730 if (tunnel->ip4 == iph->saddr) 2731 goto send; 2732 2733 spin_lock_bh(&amt->lock); 2734 if (amt->nr_tunnels >= amt->max_tunnels) { 2735 spin_unlock_bh(&amt->lock); 2736 icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0); 2737 return true; 2738 } 2739 2740 tunnel = kzalloc(sizeof(*tunnel) + 2741 (sizeof(struct hlist_head) * amt->hash_buckets), 2742 GFP_ATOMIC); 2743 if (!tunnel) { 2744 spin_unlock_bh(&amt->lock); 2745 return true; 2746 } 2747 2748 tunnel->source_port = udph->source; 2749 tunnel->ip4 = iph->saddr; 2750 2751 memcpy(&key, &tunnel->key, sizeof(unsigned long long)); 2752 tunnel->amt = amt; 2753 spin_lock_init(&tunnel->lock); 2754 for (i = 0; i < amt->hash_buckets; i++) 2755 INIT_HLIST_HEAD(&tunnel->groups[i]); 2756 2757 INIT_DELAYED_WORK(&tunnel->gc_wq, amt_tunnel_expire); 2758 2759 list_add_tail_rcu(&tunnel->list, &amt->tunnel_list); 2760 tunnel->key = amt->key; 2761 __amt_update_relay_status(tunnel, AMT_STATUS_RECEIVED_REQUEST, true); 2762 amt->nr_tunnels++; 2763 mod_delayed_work(amt_wq, &tunnel->gc_wq, 2764 msecs_to_jiffies(amt_gmi(amt))); 2765 spin_unlock_bh(&amt->lock); 2766 2767 send: 2768 tunnel->nonce = amtrh->nonce; 2769 mac = siphash_3u32((__force u32)tunnel->ip4, 2770 (__force u32)tunnel->source_port, 2771 (__force u32)tunnel->nonce, 2772 &tunnel->key); 2773 tunnel->mac = mac >> 16; 2774 2775 if (!netif_running(amt->dev) || !netif_running(amt->stream_dev)) 2776 return true; 2777 2778 if (!amtrh->p) 2779 amt_send_igmp_gq(amt, tunnel); 2780 else 2781 amt_send_mld_gq(amt, tunnel); 2782 2783 return false; 2784 } 2785 2786 static void amt_gw_rcv(struct amt_dev *amt, struct sk_buff *skb) 2787 { 2788 int type = amt_parse_type(skb); 2789 int err = 1; 2790 2791 if (type == -1) 2792 goto drop; 2793 2794 if (amt->mode == AMT_MODE_GATEWAY) { 2795 switch (type) { 2796 case AMT_MSG_ADVERTISEMENT: 2797 err = amt_advertisement_handler(amt, skb); 2798 break; 2799 case AMT_MSG_MEMBERSHIP_QUERY: 2800 err = amt_membership_query_handler(amt, skb); 2801 if (!err) 2802 return; 2803 break; 2804 default: 2805 netdev_dbg(amt->dev, "Invalid type of Gateway\n"); 2806 break; 2807 } 2808 } 2809 drop: 2810 if (err) { 2811 amt->dev->stats.rx_dropped++; 2812 kfree_skb(skb); 2813 } else { 2814 consume_skb(skb); 2815 } 2816 } 2817 2818 static int amt_rcv(struct sock *sk, struct sk_buff *skb) 2819 { 2820 struct amt_dev *amt; 2821 __be32 remote_ip; 2822 __be32 saddr; 2823 int type; 2824 bool err; 2825 2826 rcu_read_lock_bh(); 2827 amt = rcu_dereference_sk_user_data(sk); 2828 if (!amt) { 2829 err = true; 2830 kfree_skb(skb); 2831 goto out; 2832 } 2833 remote_ip = READ_ONCE(amt->remote_ip); 2834 2835 skb->dev = amt->dev; 2836 saddr = ip_hdr(skb)->saddr; 2837 type = amt_parse_type(skb); 2838 if (type == -1) { 2839 err = true; 2840 goto drop; 2841 } 2842 2843 if (amt->mode == AMT_MODE_GATEWAY) { 2844 switch (type) { 2845 case AMT_MSG_ADVERTISEMENT: 2846 if (saddr != amt->discovery_ip) { 2847 netdev_dbg(amt->dev, "Invalid Relay IP\n"); 2848 err = true; 2849 goto drop; 2850 } 2851 if (amt_queue_event(amt, AMT_EVENT_RECEIVE, skb)) { 2852 netdev_dbg(amt->dev, "AMT Event queue full\n"); 2853 err = true; 2854 goto drop; 2855 } 2856 goto out; 2857 case AMT_MSG_MULTICAST_DATA: 2858 if (saddr != remote_ip) { 2859 netdev_dbg(amt->dev, "Invalid Relay IP\n"); 2860 err = true; 2861 goto drop; 2862 } 2863 err = amt_multicast_data_handler(amt, skb); 2864 if (err) 2865 goto drop; 2866 else 2867 goto out; 2868 case AMT_MSG_MEMBERSHIP_QUERY: 2869 if (saddr != remote_ip) { 2870 netdev_dbg(amt->dev, "Invalid Relay IP\n"); 2871 err = true; 2872 goto drop; 2873 } 2874 if (amt_queue_event(amt, AMT_EVENT_RECEIVE, skb)) { 2875 netdev_dbg(amt->dev, "AMT Event queue full\n"); 2876 err = true; 2877 goto drop; 2878 } 2879 goto out; 2880 default: 2881 err = true; 2882 netdev_dbg(amt->dev, "Invalid type of Gateway\n"); 2883 break; 2884 } 2885 } else { 2886 switch (type) { 2887 case AMT_MSG_DISCOVERY: 2888 err = amt_discovery_handler(amt, skb); 2889 break; 2890 case AMT_MSG_REQUEST: 2891 err = amt_request_handler(amt, skb); 2892 break; 2893 case AMT_MSG_MEMBERSHIP_UPDATE: 2894 err = amt_update_handler(amt, skb); 2895 if (err) 2896 goto drop; 2897 else 2898 goto out; 2899 default: 2900 err = true; 2901 netdev_dbg(amt->dev, "Invalid type of relay\n"); 2902 break; 2903 } 2904 } 2905 drop: 2906 if (err) { 2907 amt->dev->stats.rx_dropped++; 2908 kfree_skb(skb); 2909 } else { 2910 consume_skb(skb); 2911 } 2912 out: 2913 rcu_read_unlock_bh(); 2914 return 0; 2915 } 2916 2917 static void amt_event_work(struct work_struct *work) 2918 { 2919 struct amt_dev *amt = container_of(work, struct amt_dev, event_wq); 2920 struct sk_buff *skb; 2921 u8 event; 2922 int i; 2923 2924 for (i = 0; i < AMT_MAX_EVENTS; i++) { 2925 spin_lock_bh(&amt->lock); 2926 if (amt->nr_events == 0) { 2927 spin_unlock_bh(&amt->lock); 2928 return; 2929 } 2930 event = amt->events[amt->event_idx].event; 2931 skb = amt->events[amt->event_idx].skb; 2932 amt->events[amt->event_idx].event = AMT_EVENT_NONE; 2933 amt->events[amt->event_idx].skb = NULL; 2934 amt->nr_events--; 2935 amt->event_idx++; 2936 amt->event_idx %= AMT_MAX_EVENTS; 2937 spin_unlock_bh(&amt->lock); 2938 2939 switch (event) { 2940 case AMT_EVENT_RECEIVE: 2941 amt_gw_rcv(amt, skb); 2942 break; 2943 case AMT_EVENT_SEND_DISCOVERY: 2944 amt_event_send_discovery(amt); 2945 break; 2946 case AMT_EVENT_SEND_REQUEST: 2947 amt_event_send_request(amt); 2948 break; 2949 default: 2950 kfree_skb(skb); 2951 break; 2952 } 2953 } 2954 } 2955 2956 static int amt_err_lookup(struct sock *sk, struct sk_buff *skb) 2957 { 2958 struct amt_dev *amt; 2959 int type; 2960 2961 rcu_read_lock_bh(); 2962 amt = rcu_dereference_sk_user_data(sk); 2963 if (!amt) 2964 goto out; 2965 2966 if (amt->mode != AMT_MODE_GATEWAY) 2967 goto drop; 2968 2969 type = amt_parse_type(skb); 2970 if (type == -1) 2971 goto drop; 2972 2973 netdev_dbg(amt->dev, "Received IGMP Unreachable of %s\n", 2974 type_str[type]); 2975 switch (type) { 2976 case AMT_MSG_DISCOVERY: 2977 break; 2978 case AMT_MSG_REQUEST: 2979 case AMT_MSG_MEMBERSHIP_UPDATE: 2980 if (READ_ONCE(amt->status) >= AMT_STATUS_RECEIVED_ADVERTISEMENT) 2981 mod_delayed_work(amt_wq, &amt->req_wq, 0); 2982 break; 2983 default: 2984 goto drop; 2985 } 2986 out: 2987 rcu_read_unlock_bh(); 2988 return 0; 2989 drop: 2990 rcu_read_unlock_bh(); 2991 amt->dev->stats.rx_dropped++; 2992 return 0; 2993 } 2994 2995 static struct sock *amt_create_sock(struct net *net, __be16 port) 2996 { 2997 struct udp_port_cfg udp_conf; 2998 struct socket *sock; 2999 int err; 3000 3001 memset(&udp_conf, 0, sizeof(udp_conf)); 3002 udp_conf.family = AF_INET; 3003 udp_conf.local_ip.s_addr = htonl(INADDR_ANY); 3004 3005 udp_conf.local_udp_port = port; 3006 3007 err = udp_sock_create(net, &udp_conf, &sock); 3008 if (err < 0) 3009 return ERR_PTR(err); 3010 3011 return sock->sk; 3012 } 3013 3014 static int amt_socket_create(struct amt_dev *amt) 3015 { 3016 struct udp_tunnel_sock_cfg tunnel_cfg; 3017 struct sock *sk; 3018 3019 sk = amt_create_sock(amt->net, amt->relay_port); 3020 if (IS_ERR(sk)) 3021 return PTR_ERR(sk); 3022 3023 /* Mark socket as an encapsulation socket */ 3024 memset(&tunnel_cfg, 0, sizeof(tunnel_cfg)); 3025 tunnel_cfg.sk_user_data = amt; 3026 tunnel_cfg.encap_type = 1; 3027 tunnel_cfg.encap_rcv = amt_rcv; 3028 tunnel_cfg.encap_err_lookup = amt_err_lookup; 3029 tunnel_cfg.encap_destroy = NULL; 3030 setup_udp_tunnel_sock(amt->net, sk, &tunnel_cfg); 3031 3032 rcu_assign_pointer(amt->sk, sk); 3033 return 0; 3034 } 3035 3036 static int amt_dev_open(struct net_device *dev) 3037 { 3038 struct amt_dev *amt = netdev_priv(dev); 3039 int err; 3040 3041 amt->ready4 = false; 3042 amt->ready6 = false; 3043 amt->event_idx = 0; 3044 amt->nr_events = 0; 3045 3046 enable_delayed_work(&amt->discovery_wq); 3047 enable_delayed_work(&amt->req_wq); 3048 3049 err = amt_socket_create(amt); 3050 if (err) { 3051 disable_delayed_work(&amt->req_wq); 3052 disable_delayed_work(&amt->discovery_wq); 3053 return err; 3054 } 3055 3056 amt->req_cnt = 0; 3057 WRITE_ONCE(amt->remote_ip, 0); 3058 amt->nonce = 0; 3059 get_random_bytes(&amt->key, sizeof(siphash_key_t)); 3060 3061 amt->status = AMT_STATUS_INIT; 3062 if (amt->mode == AMT_MODE_GATEWAY) { 3063 mod_delayed_work(amt_wq, &amt->discovery_wq, 0); 3064 mod_delayed_work(amt_wq, &amt->req_wq, 0); 3065 } else if (amt->mode == AMT_MODE_RELAY) { 3066 mod_delayed_work(amt_wq, &amt->secret_wq, 3067 msecs_to_jiffies(AMT_SECRET_TIMEOUT)); 3068 } 3069 return err; 3070 } 3071 3072 static int amt_dev_stop(struct net_device *dev) 3073 { 3074 struct amt_dev *amt = netdev_priv(dev); 3075 struct amt_tunnel_list *tunnel, *tmp; 3076 struct sk_buff *skb; 3077 struct sock *sk; 3078 int i; 3079 3080 disable_delayed_work_sync(&amt->req_wq); 3081 disable_delayed_work_sync(&amt->discovery_wq); 3082 cancel_delayed_work_sync(&amt->secret_wq); 3083 3084 /* shutdown */ 3085 sk = rtnl_dereference(amt->sk); 3086 RCU_INIT_POINTER(amt->sk, NULL); 3087 synchronize_net(); 3088 if (sk) 3089 udp_tunnel_sock_release(sk); 3090 3091 cancel_work_sync(&amt->event_wq); 3092 for (i = 0; i < AMT_MAX_EVENTS; i++) { 3093 skb = amt->events[i].skb; 3094 kfree_skb(skb); 3095 amt->events[i].event = AMT_EVENT_NONE; 3096 amt->events[i].skb = NULL; 3097 } 3098 3099 amt->ready4 = false; 3100 amt->ready6 = false; 3101 amt->req_cnt = 0; 3102 WRITE_ONCE(amt->remote_ip, 0); 3103 3104 list_for_each_entry_safe(tunnel, tmp, &amt->tunnel_list, list) { 3105 list_del_rcu(&tunnel->list); 3106 amt->nr_tunnels--; 3107 cancel_delayed_work_sync(&tunnel->gc_wq); 3108 amt_clear_groups(tunnel); 3109 kfree_rcu(tunnel, rcu); 3110 } 3111 3112 return 0; 3113 } 3114 3115 static const struct device_type amt_type = { 3116 .name = "amt", 3117 }; 3118 3119 static int amt_dev_init(struct net_device *dev) 3120 { 3121 struct amt_dev *amt = netdev_priv(dev); 3122 int err; 3123 3124 amt->dev = dev; 3125 3126 err = gro_cells_init(&amt->gro_cells, dev); 3127 if (err) 3128 return err; 3129 3130 return 0; 3131 } 3132 3133 static void amt_dev_uninit(struct net_device *dev) 3134 { 3135 struct amt_dev *amt = netdev_priv(dev); 3136 3137 gro_cells_destroy(&amt->gro_cells); 3138 } 3139 3140 static const struct net_device_ops amt_netdev_ops = { 3141 .ndo_init = amt_dev_init, 3142 .ndo_uninit = amt_dev_uninit, 3143 .ndo_open = amt_dev_open, 3144 .ndo_stop = amt_dev_stop, 3145 .ndo_start_xmit = amt_dev_xmit, 3146 }; 3147 3148 static void amt_link_setup(struct net_device *dev) 3149 { 3150 dev->netdev_ops = &amt_netdev_ops; 3151 dev->needs_free_netdev = true; 3152 SET_NETDEV_DEVTYPE(dev, &amt_type); 3153 dev->min_mtu = ETH_MIN_MTU; 3154 dev->max_mtu = ETH_MAX_MTU; 3155 dev->type = ARPHRD_NONE; 3156 dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST; 3157 dev->hard_header_len = 0; 3158 dev->addr_len = 0; 3159 dev->priv_flags |= IFF_NO_QUEUE; 3160 dev->lltx = true; 3161 dev->netns_immutable = true; 3162 dev->features |= NETIF_F_GSO_SOFTWARE; 3163 dev->hw_features |= NETIF_F_SG | NETIF_F_HW_CSUM; 3164 dev->hw_features |= NETIF_F_FRAGLIST | NETIF_F_RXCSUM; 3165 dev->hw_features |= NETIF_F_GSO_SOFTWARE; 3166 dev->pcpu_stat_type = NETDEV_PCPU_STAT_TSTATS; 3167 eth_hw_addr_random(dev); 3168 eth_zero_addr(dev->broadcast); 3169 ether_setup(dev); 3170 } 3171 3172 static const struct nla_policy amt_policy[IFLA_AMT_MAX + 1] = { 3173 [IFLA_AMT_MODE] = { .type = NLA_U32 }, 3174 [IFLA_AMT_RELAY_PORT] = { .type = NLA_U16 }, 3175 [IFLA_AMT_GATEWAY_PORT] = { .type = NLA_U16 }, 3176 [IFLA_AMT_LINK] = { .type = NLA_U32 }, 3177 [IFLA_AMT_LOCAL_IP] = { .len = sizeof_field(struct iphdr, daddr) }, 3178 [IFLA_AMT_REMOTE_IP] = { .len = sizeof_field(struct iphdr, daddr) }, 3179 [IFLA_AMT_DISCOVERY_IP] = { .len = sizeof_field(struct iphdr, daddr) }, 3180 [IFLA_AMT_MAX_TUNNELS] = { .type = NLA_U32 }, 3181 }; 3182 3183 static int amt_validate(struct nlattr *tb[], struct nlattr *data[], 3184 struct netlink_ext_ack *extack) 3185 { 3186 if (!data) 3187 return -EINVAL; 3188 3189 if (!data[IFLA_AMT_LINK]) { 3190 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_AMT_LINK], 3191 "Link attribute is required"); 3192 return -EINVAL; 3193 } 3194 3195 if (!data[IFLA_AMT_MODE]) { 3196 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_AMT_MODE], 3197 "Mode attribute is required"); 3198 return -EINVAL; 3199 } 3200 3201 if (nla_get_u32(data[IFLA_AMT_MODE]) > AMT_MODE_MAX) { 3202 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_AMT_MODE], 3203 "Mode attribute is not valid"); 3204 return -EINVAL; 3205 } 3206 3207 if (!data[IFLA_AMT_LOCAL_IP]) { 3208 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_AMT_DISCOVERY_IP], 3209 "Local attribute is required"); 3210 return -EINVAL; 3211 } 3212 3213 if (!data[IFLA_AMT_DISCOVERY_IP] && 3214 nla_get_u32(data[IFLA_AMT_MODE]) == AMT_MODE_GATEWAY) { 3215 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_AMT_LOCAL_IP], 3216 "Discovery attribute is required"); 3217 return -EINVAL; 3218 } 3219 3220 return 0; 3221 } 3222 3223 static int amt_newlink(struct net_device *dev, 3224 struct rtnl_newlink_params *params, 3225 struct netlink_ext_ack *extack) 3226 { 3227 struct net *link_net = rtnl_newlink_link_net(params); 3228 struct amt_dev *amt = netdev_priv(dev); 3229 struct nlattr **data = params->data; 3230 struct nlattr **tb = params->tb; 3231 int err = -EINVAL; 3232 3233 if (!net_eq(link_net, dev_net(dev))) 3234 return err; 3235 3236 amt->net = link_net; 3237 amt->mode = nla_get_u32(data[IFLA_AMT_MODE]); 3238 3239 if (data[IFLA_AMT_MAX_TUNNELS] && 3240 nla_get_u32(data[IFLA_AMT_MAX_TUNNELS])) 3241 amt->max_tunnels = nla_get_u32(data[IFLA_AMT_MAX_TUNNELS]); 3242 else 3243 amt->max_tunnels = AMT_MAX_TUNNELS; 3244 3245 spin_lock_init(&amt->lock); 3246 amt->max_groups = AMT_MAX_GROUP; 3247 amt->max_sources = AMT_MAX_SOURCE; 3248 amt->hash_buckets = AMT_HSIZE; 3249 amt->nr_tunnels = 0; 3250 get_random_bytes(&amt->hash_seed, sizeof(amt->hash_seed)); 3251 amt->stream_dev = dev_get_by_index(link_net, 3252 nla_get_u32(data[IFLA_AMT_LINK])); 3253 if (!amt->stream_dev) { 3254 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_AMT_LINK], 3255 "Can't find stream device"); 3256 return -ENODEV; 3257 } 3258 3259 if (amt->stream_dev->type != ARPHRD_ETHER) { 3260 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_AMT_LINK], 3261 "Invalid stream device type"); 3262 goto err; 3263 } 3264 3265 amt->local_ip = nla_get_in_addr(data[IFLA_AMT_LOCAL_IP]); 3266 if (ipv4_is_loopback(amt->local_ip) || 3267 ipv4_is_zeronet(amt->local_ip) || 3268 ipv4_is_multicast(amt->local_ip)) { 3269 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_AMT_LOCAL_IP], 3270 "Invalid Local address"); 3271 goto err; 3272 } 3273 3274 amt->relay_port = nla_get_be16_default(data[IFLA_AMT_RELAY_PORT], 3275 htons(IANA_AMT_UDP_PORT)); 3276 3277 amt->gw_port = nla_get_be16_default(data[IFLA_AMT_GATEWAY_PORT], 3278 htons(IANA_AMT_UDP_PORT)); 3279 3280 if (!amt->relay_port) { 3281 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_AMT_DISCOVERY_IP], 3282 "relay port must not be 0"); 3283 goto err; 3284 } 3285 if (amt->mode == AMT_MODE_RELAY) { 3286 amt->qrv = READ_ONCE(amt->net->ipv4.sysctl_igmp_qrv); 3287 amt->qri = 10; 3288 dev->needed_headroom = amt->stream_dev->needed_headroom + 3289 AMT_RELAY_HLEN; 3290 dev->mtu = amt->stream_dev->mtu - AMT_RELAY_HLEN; 3291 dev->max_mtu = dev->mtu; 3292 dev->min_mtu = ETH_MIN_MTU + AMT_RELAY_HLEN; 3293 } else { 3294 if (!data[IFLA_AMT_DISCOVERY_IP]) { 3295 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_AMT_DISCOVERY_IP], 3296 "discovery must be set in gateway mode"); 3297 goto err; 3298 } 3299 if (!amt->gw_port) { 3300 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_AMT_DISCOVERY_IP], 3301 "gateway port must not be 0"); 3302 goto err; 3303 } 3304 WRITE_ONCE(amt->remote_ip, 0); 3305 amt->discovery_ip = nla_get_in_addr(data[IFLA_AMT_DISCOVERY_IP]); 3306 if (ipv4_is_loopback(amt->discovery_ip) || 3307 ipv4_is_zeronet(amt->discovery_ip) || 3308 ipv4_is_multicast(amt->discovery_ip)) { 3309 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_AMT_DISCOVERY_IP], 3310 "discovery must be unicast"); 3311 goto err; 3312 } 3313 3314 dev->needed_headroom = amt->stream_dev->needed_headroom + 3315 AMT_GW_HLEN; 3316 dev->mtu = amt->stream_dev->mtu - AMT_GW_HLEN; 3317 dev->max_mtu = dev->mtu; 3318 dev->min_mtu = ETH_MIN_MTU + AMT_GW_HLEN; 3319 } 3320 amt->qi = AMT_INIT_QUERY_INTERVAL; 3321 3322 err = register_netdevice(dev); 3323 if (err < 0) { 3324 netdev_dbg(dev, "failed to register new netdev %d\n", err); 3325 goto err; 3326 } 3327 3328 err = netdev_upper_dev_link(amt->stream_dev, dev, extack); 3329 if (err < 0) { 3330 unregister_netdevice(dev); 3331 goto err; 3332 } 3333 3334 INIT_DELAYED_WORK(&amt->discovery_wq, amt_discovery_work); 3335 INIT_DELAYED_WORK(&amt->req_wq, amt_req_work); 3336 INIT_DELAYED_WORK(&amt->secret_wq, amt_secret_work); 3337 INIT_WORK(&amt->event_wq, amt_event_work); 3338 disable_delayed_work(&amt->req_wq); 3339 disable_delayed_work(&amt->discovery_wq); 3340 INIT_LIST_HEAD(&amt->tunnel_list); 3341 return 0; 3342 err: 3343 dev_put(amt->stream_dev); 3344 return err; 3345 } 3346 3347 static void amt_dellink(struct net_device *dev, struct list_head *head) 3348 { 3349 struct amt_dev *amt = netdev_priv(dev); 3350 3351 unregister_netdevice_queue(dev, head); 3352 netdev_upper_dev_unlink(amt->stream_dev, dev); 3353 dev_put(amt->stream_dev); 3354 } 3355 3356 static size_t amt_get_size(const struct net_device *dev) 3357 { 3358 return nla_total_size(sizeof(__u32)) + /* IFLA_AMT_MODE */ 3359 nla_total_size(sizeof(__u16)) + /* IFLA_AMT_RELAY_PORT */ 3360 nla_total_size(sizeof(__u16)) + /* IFLA_AMT_GATEWAY_PORT */ 3361 nla_total_size(sizeof(__u32)) + /* IFLA_AMT_LINK */ 3362 nla_total_size(sizeof(__u32)) + /* IFLA_MAX_TUNNELS */ 3363 nla_total_size(sizeof(__be32)) + /* IFLA_AMT_DISCOVERY_IP */ 3364 nla_total_size(sizeof(__be32)) + /* IFLA_AMT_REMOTE_IP */ 3365 nla_total_size(sizeof(__be32)); /* IFLA_AMT_LOCAL_IP */ 3366 } 3367 3368 static int amt_fill_info(struct sk_buff *skb, const struct net_device *dev) 3369 { 3370 const struct amt_dev *amt = netdev_priv(dev); 3371 __be32 remote_ip; 3372 3373 rcu_read_lock(); 3374 if (nla_put_u32(skb, IFLA_AMT_MODE, amt->mode)) 3375 goto nla_put_failure; 3376 if (nla_put_be16(skb, IFLA_AMT_RELAY_PORT, amt->relay_port)) 3377 goto nla_put_failure; 3378 if (nla_put_be16(skb, IFLA_AMT_GATEWAY_PORT, amt->gw_port)) 3379 goto nla_put_failure; 3380 if (nla_put_u32(skb, IFLA_AMT_LINK, amt->stream_dev->ifindex)) 3381 goto nla_put_failure; 3382 if (nla_put_in_addr(skb, IFLA_AMT_LOCAL_IP, amt->local_ip)) 3383 goto nla_put_failure; 3384 if (nla_put_in_addr(skb, IFLA_AMT_DISCOVERY_IP, amt->discovery_ip)) 3385 goto nla_put_failure; 3386 3387 remote_ip = READ_ONCE(amt->remote_ip); 3388 if (remote_ip) 3389 if (nla_put_in_addr(skb, IFLA_AMT_REMOTE_IP, remote_ip)) 3390 goto nla_put_failure; 3391 if (nla_put_u32(skb, IFLA_AMT_MAX_TUNNELS, amt->max_tunnels)) 3392 goto nla_put_failure; 3393 3394 rcu_read_unlock(); 3395 return 0; 3396 3397 nla_put_failure: 3398 rcu_read_unlock(); 3399 return -EMSGSIZE; 3400 } 3401 3402 static struct rtnl_link_ops amt_link_ops __read_mostly = { 3403 .kind = "amt", 3404 .maxtype = IFLA_AMT_MAX, 3405 .policy = amt_policy, 3406 .priv_size = sizeof(struct amt_dev), 3407 .setup = amt_link_setup, 3408 .validate = amt_validate, 3409 .newlink = amt_newlink, 3410 .dellink = amt_dellink, 3411 .get_size = amt_get_size, 3412 .fill_info = amt_fill_info, 3413 }; 3414 3415 static struct net_device *amt_lookup_upper_dev(struct net_device *dev) 3416 { 3417 struct net_device *upper_dev; 3418 struct amt_dev *amt; 3419 3420 for_each_netdev(dev_net(dev), upper_dev) { 3421 if (netif_is_amt(upper_dev)) { 3422 amt = netdev_priv(upper_dev); 3423 if (amt->stream_dev == dev) 3424 return upper_dev; 3425 } 3426 } 3427 3428 return NULL; 3429 } 3430 3431 static int amt_device_event(struct notifier_block *unused, 3432 unsigned long event, void *ptr) 3433 { 3434 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 3435 struct net_device *upper_dev; 3436 struct amt_dev *amt; 3437 LIST_HEAD(list); 3438 int new_mtu; 3439 3440 upper_dev = amt_lookup_upper_dev(dev); 3441 if (!upper_dev) 3442 return NOTIFY_DONE; 3443 amt = netdev_priv(upper_dev); 3444 3445 switch (event) { 3446 case NETDEV_UNREGISTER: 3447 amt_dellink(amt->dev, &list); 3448 unregister_netdevice_many(&list); 3449 break; 3450 case NETDEV_CHANGEMTU: 3451 if (amt->mode == AMT_MODE_RELAY) 3452 new_mtu = dev->mtu - AMT_RELAY_HLEN; 3453 else 3454 new_mtu = dev->mtu - AMT_GW_HLEN; 3455 3456 dev_set_mtu(amt->dev, new_mtu); 3457 break; 3458 } 3459 3460 return NOTIFY_DONE; 3461 } 3462 3463 static struct notifier_block amt_notifier_block __read_mostly = { 3464 .notifier_call = amt_device_event, 3465 }; 3466 3467 static int __init amt_init(void) 3468 { 3469 int err; 3470 3471 err = register_netdevice_notifier(&amt_notifier_block); 3472 if (err < 0) 3473 goto err; 3474 3475 err = rtnl_link_register(&amt_link_ops); 3476 if (err < 0) 3477 goto unregister_notifier; 3478 3479 amt_wq = alloc_workqueue("amt", WQ_UNBOUND, 0); 3480 if (!amt_wq) { 3481 err = -ENOMEM; 3482 goto rtnl_unregister; 3483 } 3484 3485 spin_lock_init(&source_gc_lock); 3486 spin_lock_bh(&source_gc_lock); 3487 INIT_DELAYED_WORK(&source_gc_wq, amt_source_gc_work); 3488 mod_delayed_work(amt_wq, &source_gc_wq, 3489 msecs_to_jiffies(AMT_GC_INTERVAL)); 3490 spin_unlock_bh(&source_gc_lock); 3491 3492 return 0; 3493 3494 rtnl_unregister: 3495 rtnl_link_unregister(&amt_link_ops); 3496 unregister_notifier: 3497 unregister_netdevice_notifier(&amt_notifier_block); 3498 err: 3499 pr_err("error loading AMT module loaded\n"); 3500 return err; 3501 } 3502 late_initcall(amt_init); 3503 3504 static void __exit amt_fini(void) 3505 { 3506 rtnl_link_unregister(&amt_link_ops); 3507 unregister_netdevice_notifier(&amt_notifier_block); 3508 cancel_delayed_work_sync(&source_gc_wq); 3509 __amt_source_gc_work(); 3510 destroy_workqueue(amt_wq); 3511 } 3512 module_exit(amt_fini); 3513 3514 MODULE_LICENSE("GPL"); 3515 MODULE_DESCRIPTION("Driver for Automatic Multicast Tunneling (AMT)"); 3516 MODULE_AUTHOR("Taehee Yoo <ap420073@gmail.com>"); 3517 MODULE_ALIAS_RTNL_LINK("amt"); 3518