1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* Copyright (c) 2021 Taehee Yoo <ap420073@gmail.com> */ 3 4 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 5 6 #include <linux/module.h> 7 #include <linux/skbuff.h> 8 #include <linux/udp.h> 9 #include <linux/jhash.h> 10 #include <linux/if_tunnel.h> 11 #include <linux/net.h> 12 #include <linux/igmp.h> 13 #include <linux/workqueue.h> 14 #include <net/flow.h> 15 #include <net/pkt_sched.h> 16 #include <net/net_namespace.h> 17 #include <net/ip.h> 18 #include <net/udp.h> 19 #include <net/udp_tunnel.h> 20 #include <net/icmp.h> 21 #include <net/mld.h> 22 #include <net/amt.h> 23 #include <uapi/linux/amt.h> 24 #include <linux/security.h> 25 #include <net/gro_cells.h> 26 #include <net/ipv6.h> 27 #include <net/if_inet6.h> 28 #include <net/ndisc.h> 29 #include <net/addrconf.h> 30 #include <net/ip6_route.h> 31 #include <net/inet_common.h> 32 #include <net/inet_dscp.h> 33 #include <net/ip6_checksum.h> 34 35 static struct workqueue_struct *amt_wq; 36 37 static HLIST_HEAD(source_gc_list); 38 /* Lock for source_gc_list */ 39 static spinlock_t source_gc_lock; 40 static struct delayed_work source_gc_wq; 41 static char *status_str[] = { 42 "AMT_STATUS_INIT", 43 "AMT_STATUS_SENT_DISCOVERY", 44 "AMT_STATUS_RECEIVED_DISCOVERY", 45 "AMT_STATUS_SENT_ADVERTISEMENT", 46 "AMT_STATUS_RECEIVED_ADVERTISEMENT", 47 "AMT_STATUS_SENT_REQUEST", 48 "AMT_STATUS_RECEIVED_REQUEST", 49 "AMT_STATUS_SENT_QUERY", 50 "AMT_STATUS_RECEIVED_QUERY", 51 "AMT_STATUS_SENT_UPDATE", 52 "AMT_STATUS_RECEIVED_UPDATE", 53 }; 54 55 static char *type_str[] = { 56 "", /* Type 0 is not defined */ 57 "AMT_MSG_DISCOVERY", 58 "AMT_MSG_ADVERTISEMENT", 59 "AMT_MSG_REQUEST", 60 "AMT_MSG_MEMBERSHIP_QUERY", 61 "AMT_MSG_MEMBERSHIP_UPDATE", 62 "AMT_MSG_MULTICAST_DATA", 63 "AMT_MSG_TEARDOWN", 64 }; 65 66 static char *action_str[] = { 67 "AMT_ACT_GMI", 68 "AMT_ACT_GMI_ZERO", 69 "AMT_ACT_GT", 70 "AMT_ACT_STATUS_FWD_NEW", 71 "AMT_ACT_STATUS_D_FWD_NEW", 72 "AMT_ACT_STATUS_NONE_NEW", 73 }; 74 75 static struct igmpv3_grec igmpv3_zero_grec; 76 77 #if IS_ENABLED(CONFIG_IPV6) 78 #define MLD2_ALL_NODE_INIT { { { 0xff, 0x02, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x01 } } } 79 static struct in6_addr mld2_all_node = MLD2_ALL_NODE_INIT; 80 static struct mld2_grec mldv2_zero_grec; 81 #endif 82 83 static void __amt_source_gc_work(void) 84 { 85 struct amt_source_node *snode; 86 struct hlist_head gc_list; 87 struct hlist_node *t; 88 89 spin_lock_bh(&source_gc_lock); 90 hlist_move_list(&source_gc_list, &gc_list); 91 spin_unlock_bh(&source_gc_lock); 92 93 hlist_for_each_entry_safe(snode, t, &gc_list, node) { 94 hlist_del_rcu(&snode->node); 95 kfree_rcu(snode, rcu); 96 } 97 } 98 99 static void amt_source_gc_work(struct work_struct *work) 100 { 101 __amt_source_gc_work(); 102 103 spin_lock_bh(&source_gc_lock); 104 mod_delayed_work(amt_wq, &source_gc_wq, 105 msecs_to_jiffies(AMT_GC_INTERVAL)); 106 spin_unlock_bh(&source_gc_lock); 107 } 108 109 static bool amt_addr_equal(union amt_addr *a, union amt_addr *b) 110 { 111 return !memcmp(a, b, sizeof(union amt_addr)); 112 } 113 114 static u32 amt_source_hash(struct amt_tunnel_list *tunnel, union amt_addr *src) 115 { 116 u32 hash = jhash(src, sizeof(*src), tunnel->amt->hash_seed); 117 118 return reciprocal_scale(hash, tunnel->amt->hash_buckets); 119 } 120 121 static bool amt_status_filter(struct amt_source_node *snode, 122 enum amt_filter filter) 123 { 124 bool rc = false; 125 126 switch (filter) { 127 case AMT_FILTER_FWD: 128 if (snode->status == AMT_SOURCE_STATUS_FWD && 129 snode->flags == AMT_SOURCE_OLD) 130 rc = true; 131 break; 132 case AMT_FILTER_D_FWD: 133 if (snode->status == AMT_SOURCE_STATUS_D_FWD && 134 snode->flags == AMT_SOURCE_OLD) 135 rc = true; 136 break; 137 case AMT_FILTER_FWD_NEW: 138 if (snode->status == AMT_SOURCE_STATUS_FWD && 139 snode->flags == AMT_SOURCE_NEW) 140 rc = true; 141 break; 142 case AMT_FILTER_D_FWD_NEW: 143 if (snode->status == AMT_SOURCE_STATUS_D_FWD && 144 snode->flags == AMT_SOURCE_NEW) 145 rc = true; 146 break; 147 case AMT_FILTER_ALL: 148 rc = true; 149 break; 150 case AMT_FILTER_NONE_NEW: 151 if (snode->status == AMT_SOURCE_STATUS_NONE && 152 snode->flags == AMT_SOURCE_NEW) 153 rc = true; 154 break; 155 case AMT_FILTER_BOTH: 156 if ((snode->status == AMT_SOURCE_STATUS_D_FWD || 157 snode->status == AMT_SOURCE_STATUS_FWD) && 158 snode->flags == AMT_SOURCE_OLD) 159 rc = true; 160 break; 161 case AMT_FILTER_BOTH_NEW: 162 if ((snode->status == AMT_SOURCE_STATUS_D_FWD || 163 snode->status == AMT_SOURCE_STATUS_FWD) && 164 snode->flags == AMT_SOURCE_NEW) 165 rc = true; 166 break; 167 default: 168 WARN_ON_ONCE(1); 169 break; 170 } 171 172 return rc; 173 } 174 175 static struct amt_source_node *amt_lookup_src(struct amt_tunnel_list *tunnel, 176 struct amt_group_node *gnode, 177 enum amt_filter filter, 178 union amt_addr *src) 179 { 180 u32 hash = amt_source_hash(tunnel, src); 181 struct amt_source_node *snode; 182 183 hlist_for_each_entry_rcu(snode, &gnode->sources[hash], node) 184 if (amt_status_filter(snode, filter) && 185 amt_addr_equal(&snode->source_addr, src)) 186 return snode; 187 188 return NULL; 189 } 190 191 static u32 amt_group_hash(struct amt_tunnel_list *tunnel, union amt_addr *group) 192 { 193 u32 hash = jhash(group, sizeof(*group), tunnel->amt->hash_seed); 194 195 return reciprocal_scale(hash, tunnel->amt->hash_buckets); 196 } 197 198 static struct amt_group_node *amt_lookup_group(struct amt_tunnel_list *tunnel, 199 union amt_addr *group, 200 union amt_addr *host, 201 bool v6) 202 { 203 u32 hash = amt_group_hash(tunnel, group); 204 struct amt_group_node *gnode; 205 206 hlist_for_each_entry_rcu(gnode, &tunnel->groups[hash], node) { 207 if (amt_addr_equal(&gnode->group_addr, group) && 208 amt_addr_equal(&gnode->host_addr, host) && 209 gnode->v6 == v6) 210 return gnode; 211 } 212 213 return NULL; 214 } 215 216 static void amt_destroy_source(struct amt_source_node *snode) 217 { 218 struct amt_group_node *gnode = snode->gnode; 219 struct amt_tunnel_list *tunnel; 220 221 tunnel = gnode->tunnel_list; 222 223 if (!gnode->v6) { 224 netdev_dbg(snode->gnode->amt->dev, 225 "Delete source %pI4 from %pI4\n", 226 &snode->source_addr.ip4, 227 &gnode->group_addr.ip4); 228 #if IS_ENABLED(CONFIG_IPV6) 229 } else { 230 netdev_dbg(snode->gnode->amt->dev, 231 "Delete source %pI6 from %pI6\n", 232 &snode->source_addr.ip6, 233 &gnode->group_addr.ip6); 234 #endif 235 } 236 237 cancel_delayed_work(&snode->source_timer); 238 hlist_del_init_rcu(&snode->node); 239 tunnel->nr_sources--; 240 gnode->nr_sources--; 241 spin_lock_bh(&source_gc_lock); 242 hlist_add_head_rcu(&snode->node, &source_gc_list); 243 spin_unlock_bh(&source_gc_lock); 244 } 245 246 static void amt_del_group(struct amt_dev *amt, struct amt_group_node *gnode) 247 { 248 struct amt_source_node *snode; 249 struct hlist_node *t; 250 int i; 251 252 if (cancel_delayed_work(&gnode->group_timer)) 253 dev_put(amt->dev); 254 hlist_del_rcu(&gnode->node); 255 gnode->tunnel_list->nr_groups--; 256 257 if (!gnode->v6) 258 netdev_dbg(amt->dev, "Leave group %pI4\n", 259 &gnode->group_addr.ip4); 260 #if IS_ENABLED(CONFIG_IPV6) 261 else 262 netdev_dbg(amt->dev, "Leave group %pI6\n", 263 &gnode->group_addr.ip6); 264 #endif 265 for (i = 0; i < amt->hash_buckets; i++) 266 hlist_for_each_entry_safe(snode, t, &gnode->sources[i], node) 267 amt_destroy_source(snode); 268 269 /* tunnel->lock was acquired outside of amt_del_group() 270 * But rcu_read_lock() was acquired too so It's safe. 271 */ 272 kfree_rcu(gnode, rcu); 273 } 274 275 /* If a source timer expires with a router filter-mode for the group of 276 * INCLUDE, the router concludes that traffic from this particular 277 * source is no longer desired on the attached network, and deletes the 278 * associated source record. 279 */ 280 static void amt_source_work(struct work_struct *work) 281 { 282 struct amt_source_node *snode = container_of(to_delayed_work(work), 283 struct amt_source_node, 284 source_timer); 285 struct amt_group_node *gnode = snode->gnode; 286 struct amt_dev *amt = gnode->amt; 287 struct amt_tunnel_list *tunnel; 288 289 tunnel = gnode->tunnel_list; 290 spin_lock_bh(&tunnel->lock); 291 rcu_read_lock(); 292 if (gnode->filter_mode == MCAST_INCLUDE) { 293 amt_destroy_source(snode); 294 if (!gnode->nr_sources) 295 amt_del_group(amt, gnode); 296 } else { 297 /* When a router filter-mode for a group is EXCLUDE, 298 * source records are only deleted when the group timer expires 299 */ 300 snode->status = AMT_SOURCE_STATUS_D_FWD; 301 } 302 rcu_read_unlock(); 303 spin_unlock_bh(&tunnel->lock); 304 } 305 306 static void amt_act_src(struct amt_tunnel_list *tunnel, 307 struct amt_group_node *gnode, 308 struct amt_source_node *snode, 309 enum amt_act act) 310 { 311 struct amt_dev *amt = tunnel->amt; 312 313 switch (act) { 314 case AMT_ACT_GMI: 315 mod_delayed_work(amt_wq, &snode->source_timer, 316 msecs_to_jiffies(amt_gmi(amt))); 317 break; 318 case AMT_ACT_GMI_ZERO: 319 cancel_delayed_work(&snode->source_timer); 320 break; 321 case AMT_ACT_GT: 322 mod_delayed_work(amt_wq, &snode->source_timer, 323 gnode->group_timer.timer.expires); 324 break; 325 case AMT_ACT_STATUS_FWD_NEW: 326 snode->status = AMT_SOURCE_STATUS_FWD; 327 snode->flags = AMT_SOURCE_NEW; 328 break; 329 case AMT_ACT_STATUS_D_FWD_NEW: 330 snode->status = AMT_SOURCE_STATUS_D_FWD; 331 snode->flags = AMT_SOURCE_NEW; 332 break; 333 case AMT_ACT_STATUS_NONE_NEW: 334 cancel_delayed_work(&snode->source_timer); 335 snode->status = AMT_SOURCE_STATUS_NONE; 336 snode->flags = AMT_SOURCE_NEW; 337 break; 338 default: 339 WARN_ON_ONCE(1); 340 return; 341 } 342 343 if (!gnode->v6) 344 netdev_dbg(amt->dev, "Source %pI4 from %pI4 Acted %s\n", 345 &snode->source_addr.ip4, 346 &gnode->group_addr.ip4, 347 action_str[act]); 348 #if IS_ENABLED(CONFIG_IPV6) 349 else 350 netdev_dbg(amt->dev, "Source %pI6 from %pI6 Acted %s\n", 351 &snode->source_addr.ip6, 352 &gnode->group_addr.ip6, 353 action_str[act]); 354 #endif 355 } 356 357 static struct amt_source_node *amt_alloc_snode(struct amt_group_node *gnode, 358 union amt_addr *src) 359 { 360 struct amt_source_node *snode; 361 362 snode = kzalloc_obj(*snode, GFP_ATOMIC); 363 if (!snode) 364 return NULL; 365 366 memcpy(&snode->source_addr, src, sizeof(union amt_addr)); 367 snode->gnode = gnode; 368 snode->status = AMT_SOURCE_STATUS_NONE; 369 snode->flags = AMT_SOURCE_NEW; 370 INIT_HLIST_NODE(&snode->node); 371 INIT_DELAYED_WORK(&snode->source_timer, amt_source_work); 372 373 return snode; 374 } 375 376 /* RFC 3810 - 7.2.2. Definition of Filter Timers 377 * 378 * Router Mode Filter Timer Actions/Comments 379 * ----------- ----------------- ---------------- 380 * 381 * INCLUDE Not Used All listeners in 382 * INCLUDE mode. 383 * 384 * EXCLUDE Timer > 0 At least one listener 385 * in EXCLUDE mode. 386 * 387 * EXCLUDE Timer == 0 No more listeners in 388 * EXCLUDE mode for the 389 * multicast address. 390 * If the Requested List 391 * is empty, delete 392 * Multicast Address 393 * Record. If not, switch 394 * to INCLUDE filter mode; 395 * the sources in the 396 * Requested List are 397 * moved to the Include 398 * List, and the Exclude 399 * List is deleted. 400 */ 401 static void amt_group_work(struct work_struct *work) 402 { 403 struct amt_group_node *gnode = container_of(to_delayed_work(work), 404 struct amt_group_node, 405 group_timer); 406 struct amt_tunnel_list *tunnel = gnode->tunnel_list; 407 struct amt_dev *amt = gnode->amt; 408 struct amt_source_node *snode; 409 bool delete_group = true; 410 struct hlist_node *t; 411 int i, buckets; 412 413 buckets = amt->hash_buckets; 414 415 spin_lock_bh(&tunnel->lock); 416 if (gnode->filter_mode == MCAST_INCLUDE) { 417 /* Not Used */ 418 spin_unlock_bh(&tunnel->lock); 419 goto out; 420 } 421 422 rcu_read_lock(); 423 for (i = 0; i < buckets; i++) { 424 hlist_for_each_entry_safe(snode, t, 425 &gnode->sources[i], node) { 426 if (!delayed_work_pending(&snode->source_timer) || 427 snode->status == AMT_SOURCE_STATUS_D_FWD) { 428 amt_destroy_source(snode); 429 } else { 430 delete_group = false; 431 snode->status = AMT_SOURCE_STATUS_FWD; 432 } 433 } 434 } 435 if (delete_group) 436 amt_del_group(amt, gnode); 437 else 438 gnode->filter_mode = MCAST_INCLUDE; 439 rcu_read_unlock(); 440 spin_unlock_bh(&tunnel->lock); 441 out: 442 dev_put(amt->dev); 443 } 444 445 /* Non-existent group is created as INCLUDE {empty}: 446 * 447 * RFC 3376 - 5.1. Action on Change of Interface State 448 * 449 * If no interface state existed for that multicast address before 450 * the change (i.e., the change consisted of creating a new 451 * per-interface record), or if no state exists after the change 452 * (i.e., the change consisted of deleting a per-interface record), 453 * then the "non-existent" state is considered to have a filter mode 454 * of INCLUDE and an empty source list. 455 */ 456 static struct amt_group_node *amt_add_group(struct amt_dev *amt, 457 struct amt_tunnel_list *tunnel, 458 union amt_addr *group, 459 union amt_addr *host, 460 bool v6) 461 { 462 struct amt_group_node *gnode; 463 u32 hash; 464 int i; 465 466 if (tunnel->nr_groups >= amt->max_groups) 467 return ERR_PTR(-ENOSPC); 468 469 gnode = kzalloc(sizeof(*gnode) + 470 (sizeof(struct hlist_head) * amt->hash_buckets), 471 GFP_ATOMIC); 472 if (unlikely(!gnode)) 473 return ERR_PTR(-ENOMEM); 474 475 gnode->amt = amt; 476 gnode->group_addr = *group; 477 gnode->host_addr = *host; 478 gnode->v6 = v6; 479 gnode->tunnel_list = tunnel; 480 gnode->filter_mode = MCAST_INCLUDE; 481 INIT_HLIST_NODE(&gnode->node); 482 INIT_DELAYED_WORK(&gnode->group_timer, amt_group_work); 483 for (i = 0; i < amt->hash_buckets; i++) 484 INIT_HLIST_HEAD(&gnode->sources[i]); 485 486 hash = amt_group_hash(tunnel, group); 487 hlist_add_head_rcu(&gnode->node, &tunnel->groups[hash]); 488 tunnel->nr_groups++; 489 490 if (!gnode->v6) 491 netdev_dbg(amt->dev, "Join group %pI4\n", 492 &gnode->group_addr.ip4); 493 #if IS_ENABLED(CONFIG_IPV6) 494 else 495 netdev_dbg(amt->dev, "Join group %pI6\n", 496 &gnode->group_addr.ip6); 497 #endif 498 499 return gnode; 500 } 501 502 static struct sk_buff *amt_build_igmp_gq(struct amt_dev *amt) 503 { 504 u8 ra[AMT_IPHDR_OPTS] = { IPOPT_RA, 4, 0, 0 }; 505 int hlen = LL_RESERVED_SPACE(amt->dev); 506 int tlen = amt->dev->needed_tailroom; 507 struct igmpv3_query *ihv3; 508 void *csum_start = NULL; 509 __sum16 *csum = NULL; 510 struct sk_buff *skb; 511 struct ethhdr *eth; 512 struct iphdr *iph; 513 unsigned int len; 514 int offset; 515 516 len = hlen + tlen + sizeof(*iph) + AMT_IPHDR_OPTS + sizeof(*ihv3); 517 skb = netdev_alloc_skb_ip_align(amt->dev, len); 518 if (!skb) 519 return NULL; 520 521 skb_reserve(skb, hlen); 522 skb_push(skb, sizeof(*eth)); 523 skb->protocol = htons(ETH_P_IP); 524 skb_reset_mac_header(skb); 525 skb->priority = TC_PRIO_CONTROL; 526 skb_put(skb, sizeof(*iph)); 527 skb_put_data(skb, ra, sizeof(ra)); 528 skb_put(skb, sizeof(*ihv3)); 529 skb_pull(skb, sizeof(*eth)); 530 skb_reset_network_header(skb); 531 532 iph = ip_hdr(skb); 533 iph->version = 4; 534 iph->ihl = (sizeof(struct iphdr) + AMT_IPHDR_OPTS) >> 2; 535 iph->tos = AMT_TOS; 536 iph->tot_len = htons(sizeof(*iph) + AMT_IPHDR_OPTS + sizeof(*ihv3)); 537 iph->frag_off = htons(IP_DF); 538 iph->ttl = 1; 539 iph->id = 0; 540 iph->protocol = IPPROTO_IGMP; 541 iph->daddr = htonl(INADDR_ALLHOSTS_GROUP); 542 iph->saddr = htonl(INADDR_ANY); 543 ip_send_check(iph); 544 545 eth = eth_hdr(skb); 546 ether_addr_copy(eth->h_source, amt->dev->dev_addr); 547 ip_eth_mc_map(htonl(INADDR_ALLHOSTS_GROUP), eth->h_dest); 548 eth->h_proto = htons(ETH_P_IP); 549 550 ihv3 = skb_pull(skb, sizeof(*iph) + AMT_IPHDR_OPTS); 551 skb_reset_transport_header(skb); 552 ihv3->type = IGMP_HOST_MEMBERSHIP_QUERY; 553 ihv3->code = 1; 554 ihv3->group = 0; 555 ihv3->qqic = amt->qi; 556 ihv3->nsrcs = 0; 557 ihv3->resv = 0; 558 ihv3->suppress = false; 559 ihv3->qrv = READ_ONCE(amt->net->ipv4.sysctl_igmp_qrv); 560 ihv3->csum = 0; 561 csum = &ihv3->csum; 562 csum_start = (void *)ihv3; 563 *csum = ip_compute_csum(csum_start, sizeof(*ihv3)); 564 offset = skb_transport_offset(skb); 565 skb->csum = skb_checksum(skb, offset, skb->len - offset, 0); 566 skb->ip_summed = CHECKSUM_NONE; 567 568 skb_push(skb, sizeof(*eth) + sizeof(*iph) + AMT_IPHDR_OPTS); 569 570 return skb; 571 } 572 573 static void amt_update_gw_status(struct amt_dev *amt, enum amt_status status, 574 bool validate) 575 { 576 if (validate && amt->status >= status) 577 return; 578 netdev_dbg(amt->dev, "Update GW status %s -> %s", 579 status_str[amt->status], status_str[status]); 580 WRITE_ONCE(amt->status, status); 581 } 582 583 static void __amt_update_relay_status(struct amt_tunnel_list *tunnel, 584 enum amt_status status, 585 bool validate) 586 { 587 if (validate && tunnel->status >= status) 588 return; 589 netdev_dbg(tunnel->amt->dev, 590 "Update Tunnel(IP = %pI4, PORT = %u) status %s -> %s", 591 &tunnel->ip4, ntohs(tunnel->source_port), 592 status_str[tunnel->status], status_str[status]); 593 tunnel->status = status; 594 } 595 596 static void amt_update_relay_status(struct amt_tunnel_list *tunnel, 597 enum amt_status status, bool validate) 598 { 599 spin_lock_bh(&tunnel->lock); 600 __amt_update_relay_status(tunnel, status, validate); 601 spin_unlock_bh(&tunnel->lock); 602 } 603 604 static void amt_send_discovery(struct amt_dev *amt) 605 { 606 struct amt_header_discovery *amtd; 607 int hlen, tlen, offset; 608 struct udphdr *udph; 609 struct sk_buff *skb; 610 struct iphdr *iph; 611 struct rtable *rt; 612 struct flowi4 fl4; 613 struct sock *sk; 614 u32 len; 615 int err; 616 617 rcu_read_lock(); 618 sk = rcu_dereference(amt->sk); 619 if (!sk) 620 goto out; 621 622 if (!netif_running(amt->stream_dev) || !netif_running(amt->dev)) 623 goto out; 624 625 rt = ip_route_output_ports(amt->net, &fl4, sk, 626 amt->discovery_ip, amt->local_ip, 627 amt->gw_port, amt->relay_port, 628 IPPROTO_UDP, 0, 629 amt->stream_dev->ifindex); 630 if (IS_ERR(rt)) { 631 amt->dev->stats.tx_errors++; 632 goto out; 633 } 634 635 hlen = LL_RESERVED_SPACE(amt->dev); 636 tlen = amt->dev->needed_tailroom; 637 len = hlen + tlen + sizeof(*iph) + sizeof(*udph) + sizeof(*amtd); 638 skb = netdev_alloc_skb_ip_align(amt->dev, len); 639 if (!skb) { 640 ip_rt_put(rt); 641 amt->dev->stats.tx_errors++; 642 goto out; 643 } 644 645 skb->priority = TC_PRIO_CONTROL; 646 skb_dst_set(skb, &rt->dst); 647 648 len = sizeof(*iph) + sizeof(*udph) + sizeof(*amtd); 649 skb_reset_network_header(skb); 650 skb_put(skb, len); 651 amtd = skb_pull(skb, sizeof(*iph) + sizeof(*udph)); 652 amtd->version = 0; 653 amtd->type = AMT_MSG_DISCOVERY; 654 amtd->reserved = 0; 655 amtd->nonce = amt->nonce; 656 skb_push(skb, sizeof(*udph)); 657 skb_reset_transport_header(skb); 658 udph = udp_hdr(skb); 659 udph->source = amt->gw_port; 660 udph->dest = amt->relay_port; 661 udp_set_len_short(udph, sizeof(*udph) + sizeof(*amtd)); 662 udph->check = 0; 663 offset = skb_transport_offset(skb); 664 skb->csum = skb_checksum(skb, offset, skb->len - offset, 0); 665 udph->check = csum_tcpudp_magic(amt->local_ip, amt->discovery_ip, 666 sizeof(*udph) + sizeof(*amtd), 667 IPPROTO_UDP, skb->csum); 668 669 skb_push(skb, sizeof(*iph)); 670 iph = ip_hdr(skb); 671 iph->version = 4; 672 iph->ihl = (sizeof(struct iphdr)) >> 2; 673 iph->tos = AMT_TOS; 674 iph->frag_off = 0; 675 iph->ttl = ip4_dst_hoplimit(&rt->dst); 676 iph->daddr = amt->discovery_ip; 677 iph->saddr = amt->local_ip; 678 iph->protocol = IPPROTO_UDP; 679 iph->tot_len = htons(len); 680 681 skb->ip_summed = CHECKSUM_NONE; 682 ip_select_ident(amt->net, skb, NULL); 683 ip_send_check(iph); 684 err = ip_local_out(amt->net, sk, skb); 685 if (unlikely(net_xmit_eval(err))) 686 amt->dev->stats.tx_errors++; 687 688 amt_update_gw_status(amt, AMT_STATUS_SENT_DISCOVERY, true); 689 out: 690 rcu_read_unlock(); 691 } 692 693 static void amt_send_request(struct amt_dev *amt, bool v6) 694 { 695 struct amt_header_request *amtrh; 696 int hlen, tlen, offset; 697 struct udphdr *udph; 698 struct sk_buff *skb; 699 struct iphdr *iph; 700 struct rtable *rt; 701 struct flowi4 fl4; 702 __be32 remote_ip; 703 struct sock *sk; 704 u32 len; 705 int err; 706 707 rcu_read_lock(); 708 remote_ip = READ_ONCE(amt->remote_ip); 709 sk = rcu_dereference(amt->sk); 710 if (!sk) 711 goto out; 712 713 if (!netif_running(amt->stream_dev) || !netif_running(amt->dev)) 714 goto out; 715 716 rt = ip_route_output_ports(amt->net, &fl4, sk, 717 remote_ip, amt->local_ip, 718 amt->gw_port, amt->relay_port, 719 IPPROTO_UDP, 0, 720 amt->stream_dev->ifindex); 721 if (IS_ERR(rt)) { 722 amt->dev->stats.tx_errors++; 723 goto out; 724 } 725 726 hlen = LL_RESERVED_SPACE(amt->dev); 727 tlen = amt->dev->needed_tailroom; 728 len = hlen + tlen + sizeof(*iph) + sizeof(*udph) + sizeof(*amtrh); 729 skb = netdev_alloc_skb_ip_align(amt->dev, len); 730 if (!skb) { 731 ip_rt_put(rt); 732 amt->dev->stats.tx_errors++; 733 goto out; 734 } 735 736 skb->priority = TC_PRIO_CONTROL; 737 skb_dst_set(skb, &rt->dst); 738 739 len = sizeof(*iph) + sizeof(*udph) + sizeof(*amtrh); 740 skb_reset_network_header(skb); 741 skb_put(skb, len); 742 amtrh = skb_pull(skb, sizeof(*iph) + sizeof(*udph)); 743 amtrh->version = 0; 744 amtrh->type = AMT_MSG_REQUEST; 745 amtrh->reserved1 = 0; 746 amtrh->p = v6; 747 amtrh->reserved2 = 0; 748 amtrh->nonce = amt->nonce; 749 skb_push(skb, sizeof(*udph)); 750 skb_reset_transport_header(skb); 751 udph = udp_hdr(skb); 752 udph->source = amt->gw_port; 753 udph->dest = amt->relay_port; 754 udp_set_len_short(udph, sizeof(*amtrh) + sizeof(*udph)); 755 udph->check = 0; 756 offset = skb_transport_offset(skb); 757 skb->csum = skb_checksum(skb, offset, skb->len - offset, 0); 758 udph->check = csum_tcpudp_magic(amt->local_ip, remote_ip, 759 sizeof(*udph) + sizeof(*amtrh), 760 IPPROTO_UDP, skb->csum); 761 762 skb_push(skb, sizeof(*iph)); 763 iph = ip_hdr(skb); 764 iph->version = 4; 765 iph->ihl = (sizeof(struct iphdr)) >> 2; 766 iph->tos = AMT_TOS; 767 iph->frag_off = 0; 768 iph->ttl = ip4_dst_hoplimit(&rt->dst); 769 iph->daddr = remote_ip; 770 iph->saddr = amt->local_ip; 771 iph->protocol = IPPROTO_UDP; 772 iph->tot_len = htons(len); 773 774 skb->ip_summed = CHECKSUM_NONE; 775 ip_select_ident(amt->net, skb, NULL); 776 ip_send_check(iph); 777 err = ip_local_out(amt->net, sk, skb); 778 if (unlikely(net_xmit_eval(err))) 779 amt->dev->stats.tx_errors++; 780 781 out: 782 rcu_read_unlock(); 783 } 784 785 static bool amt_send_membership_query(struct amt_dev *amt, 786 struct sk_buff *skb, 787 struct amt_tunnel_list *tunnel, 788 bool v6); 789 790 static void amt_send_igmp_gq(struct amt_dev *amt, 791 struct amt_tunnel_list *tunnel) 792 { 793 struct sk_buff *skb; 794 795 skb = amt_build_igmp_gq(amt); 796 if (!skb) 797 return; 798 799 skb_pull(skb, sizeof(struct ethhdr)); 800 if (amt_send_membership_query(amt, skb, tunnel, false)) { 801 amt->dev->stats.tx_dropped++; 802 kfree_skb(skb); 803 } 804 } 805 806 #if IS_ENABLED(CONFIG_IPV6) 807 static struct sk_buff *amt_build_mld_gq(struct amt_dev *amt) 808 { 809 u8 ra[AMT_IP6HDR_OPTS] = { IPPROTO_ICMPV6, 0, IPV6_TLV_ROUTERALERT, 810 2, 0, 0, IPV6_TLV_PAD1, IPV6_TLV_PAD1 }; 811 int hlen = LL_RESERVED_SPACE(amt->dev); 812 int tlen = amt->dev->needed_tailroom; 813 struct mld2_query *mld2q; 814 void *csum_start = NULL; 815 struct ipv6hdr *ip6h; 816 struct sk_buff *skb; 817 struct ethhdr *eth; 818 u32 len; 819 820 len = hlen + tlen + sizeof(*ip6h) + sizeof(ra) + sizeof(*mld2q); 821 skb = netdev_alloc_skb_ip_align(amt->dev, len); 822 if (!skb) 823 return NULL; 824 825 skb_reserve(skb, hlen); 826 skb_push(skb, sizeof(*eth)); 827 skb_reset_mac_header(skb); 828 eth = eth_hdr(skb); 829 skb->priority = TC_PRIO_CONTROL; 830 skb->protocol = htons(ETH_P_IPV6); 831 skb_put_zero(skb, sizeof(*ip6h)); 832 skb_put_data(skb, ra, sizeof(ra)); 833 skb_put_zero(skb, sizeof(*mld2q)); 834 skb_pull(skb, sizeof(*eth)); 835 skb_reset_network_header(skb); 836 ip6h = ipv6_hdr(skb); 837 ip6h->payload_len = htons(sizeof(ra) + sizeof(*mld2q)); 838 ip6h->nexthdr = NEXTHDR_HOP; 839 ip6h->hop_limit = 1; 840 ip6h->daddr = mld2_all_node; 841 ip6_flow_hdr(ip6h, 0, 0); 842 843 if (ipv6_dev_get_saddr(amt->net, amt->dev, &ip6h->daddr, 0, 844 &ip6h->saddr)) { 845 amt->dev->stats.tx_errors++; 846 kfree_skb(skb); 847 return NULL; 848 } 849 850 eth->h_proto = htons(ETH_P_IPV6); 851 ether_addr_copy(eth->h_source, amt->dev->dev_addr); 852 ipv6_eth_mc_map(&mld2_all_node, eth->h_dest); 853 854 skb_pull(skb, sizeof(*ip6h) + sizeof(ra)); 855 skb_reset_transport_header(skb); 856 mld2q = (struct mld2_query *)icmp6_hdr(skb); 857 mld2q->mld2q_mrc = htons(1); 858 mld2q->mld2q_type = ICMPV6_MGM_QUERY; 859 mld2q->mld2q_code = 0; 860 mld2q->mld2q_cksum = 0; 861 mld2q->mld2q_resv1 = 0; 862 mld2q->mld2q_resv2 = 0; 863 mld2q->mld2q_suppress = 0; 864 mld2q->mld2q_qrv = amt->qrv; 865 mld2q->mld2q_nsrcs = 0; 866 mld2q->mld2q_qqic = amt->qi; 867 csum_start = (void *)mld2q; 868 mld2q->mld2q_cksum = csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr, 869 sizeof(*mld2q), 870 IPPROTO_ICMPV6, 871 csum_partial(csum_start, 872 sizeof(*mld2q), 0)); 873 874 skb->ip_summed = CHECKSUM_NONE; 875 skb_push(skb, sizeof(*eth) + sizeof(*ip6h) + sizeof(ra)); 876 return skb; 877 } 878 879 static void amt_send_mld_gq(struct amt_dev *amt, struct amt_tunnel_list *tunnel) 880 { 881 struct sk_buff *skb; 882 883 skb = amt_build_mld_gq(amt); 884 if (!skb) 885 return; 886 887 skb_pull(skb, sizeof(struct ethhdr)); 888 if (amt_send_membership_query(amt, skb, tunnel, true)) { 889 amt->dev->stats.tx_dropped++; 890 kfree_skb(skb); 891 } 892 } 893 #else 894 static void amt_send_mld_gq(struct amt_dev *amt, struct amt_tunnel_list *tunnel) 895 { 896 } 897 #endif 898 899 static bool amt_queue_event(struct amt_dev *amt, enum amt_event event, 900 struct sk_buff *skb) 901 { 902 int index; 903 904 spin_lock_bh(&amt->lock); 905 if (amt->nr_events >= AMT_MAX_EVENTS) { 906 spin_unlock_bh(&amt->lock); 907 return 1; 908 } 909 910 index = (amt->event_idx + amt->nr_events) % AMT_MAX_EVENTS; 911 amt->events[index].event = event; 912 amt->events[index].skb = skb; 913 amt->nr_events++; 914 amt->event_idx %= AMT_MAX_EVENTS; 915 queue_work(amt_wq, &amt->event_wq); 916 spin_unlock_bh(&amt->lock); 917 918 return 0; 919 } 920 921 static void amt_secret_work(struct work_struct *work) 922 { 923 struct amt_dev *amt = container_of(to_delayed_work(work), 924 struct amt_dev, 925 secret_wq); 926 927 spin_lock_bh(&amt->lock); 928 get_random_bytes(&amt->key, sizeof(siphash_key_t)); 929 spin_unlock_bh(&amt->lock); 930 mod_delayed_work(amt_wq, &amt->secret_wq, 931 msecs_to_jiffies(AMT_SECRET_TIMEOUT)); 932 } 933 934 static void amt_event_send_discovery(struct amt_dev *amt) 935 { 936 if (amt->status > AMT_STATUS_SENT_DISCOVERY) 937 goto out; 938 get_random_bytes(&amt->nonce, sizeof(__be32)); 939 940 amt_send_discovery(amt); 941 out: 942 mod_delayed_work(amt_wq, &amt->discovery_wq, 943 msecs_to_jiffies(AMT_DISCOVERY_TIMEOUT)); 944 } 945 946 static void amt_discovery_work(struct work_struct *work) 947 { 948 struct amt_dev *amt = container_of(to_delayed_work(work), 949 struct amt_dev, 950 discovery_wq); 951 952 if (amt_queue_event(amt, AMT_EVENT_SEND_DISCOVERY, NULL)) 953 mod_delayed_work(amt_wq, &amt->discovery_wq, 954 msecs_to_jiffies(AMT_DISCOVERY_TIMEOUT)); 955 } 956 957 static void amt_event_send_request(struct amt_dev *amt) 958 { 959 u32 exp; 960 961 if (amt->status < AMT_STATUS_RECEIVED_ADVERTISEMENT) 962 goto out; 963 964 if (amt->req_cnt > AMT_MAX_REQ_COUNT) { 965 netdev_dbg(amt->dev, "Gateway is not ready"); 966 amt->qi = AMT_INIT_REQ_TIMEOUT; 967 WRITE_ONCE(amt->ready4, false); 968 WRITE_ONCE(amt->ready6, false); 969 WRITE_ONCE(amt->remote_ip, 0); 970 amt_update_gw_status(amt, AMT_STATUS_INIT, false); 971 amt->req_cnt = 0; 972 amt->nonce = 0; 973 goto out; 974 } 975 976 if (!amt->req_cnt) { 977 WRITE_ONCE(amt->ready4, false); 978 WRITE_ONCE(amt->ready6, false); 979 get_random_bytes(&amt->nonce, sizeof(__be32)); 980 } 981 982 amt_send_request(amt, false); 983 amt_send_request(amt, true); 984 amt_update_gw_status(amt, AMT_STATUS_SENT_REQUEST, true); 985 amt->req_cnt++; 986 out: 987 exp = min_t(u32, (1 * (1 << amt->req_cnt)), AMT_MAX_REQ_TIMEOUT); 988 mod_delayed_work(amt_wq, &amt->req_wq, secs_to_jiffies(exp)); 989 } 990 991 static void amt_req_work(struct work_struct *work) 992 { 993 struct amt_dev *amt = container_of(to_delayed_work(work), 994 struct amt_dev, 995 req_wq); 996 997 if (amt_queue_event(amt, AMT_EVENT_SEND_REQUEST, NULL)) 998 mod_delayed_work(amt_wq, &amt->req_wq, 999 msecs_to_jiffies(100)); 1000 } 1001 1002 static bool amt_send_membership_update(struct amt_dev *amt, 1003 struct sk_buff *skb, 1004 bool v6) 1005 { 1006 __be32 remote_ip = READ_ONCE(amt->remote_ip); 1007 struct amt_header_membership_update *amtmu; 1008 struct iphdr *iph; 1009 struct flowi4 fl4; 1010 struct rtable *rt; 1011 struct sock *sk; 1012 int err; 1013 1014 sk = rcu_dereference_bh(amt->sk); 1015 if (!sk) 1016 return true; 1017 1018 err = skb_cow_head(skb, LL_RESERVED_SPACE(amt->dev) + sizeof(*amtmu) + 1019 sizeof(*iph) + sizeof(struct udphdr)); 1020 if (err) 1021 return true; 1022 1023 skb_reset_inner_headers(skb); 1024 memset(&fl4, 0, sizeof(struct flowi4)); 1025 fl4.flowi4_oif = amt->stream_dev->ifindex; 1026 fl4.daddr = remote_ip; 1027 fl4.saddr = amt->local_ip; 1028 fl4.flowi4_dscp = inet_dsfield_to_dscp(AMT_TOS); 1029 fl4.flowi4_proto = IPPROTO_UDP; 1030 rt = ip_route_output_key(amt->net, &fl4); 1031 if (IS_ERR(rt)) { 1032 netdev_dbg(amt->dev, "no route to %pI4\n", &remote_ip); 1033 return true; 1034 } 1035 1036 amtmu = skb_push(skb, sizeof(*amtmu)); 1037 amtmu->version = 0; 1038 amtmu->type = AMT_MSG_MEMBERSHIP_UPDATE; 1039 amtmu->reserved = 0; 1040 amtmu->nonce = amt->nonce; 1041 amtmu->response_mac = amt->mac; 1042 1043 if (!v6) 1044 skb_set_inner_protocol(skb, htons(ETH_P_IP)); 1045 else 1046 skb_set_inner_protocol(skb, htons(ETH_P_IPV6)); 1047 udp_tunnel_xmit_skb(rt, sk, skb, 1048 fl4.saddr, 1049 fl4.daddr, 1050 AMT_TOS, 1051 ip4_dst_hoplimit(&rt->dst), 1052 0, 1053 amt->gw_port, 1054 amt->relay_port, 1055 false, 1056 false, 1057 0); 1058 amt_update_gw_status(amt, AMT_STATUS_SENT_UPDATE, true); 1059 return false; 1060 } 1061 1062 static void amt_send_multicast_data(struct amt_dev *amt, 1063 const struct sk_buff *oskb, 1064 struct amt_tunnel_list *tunnel, 1065 bool v6) 1066 { 1067 struct amt_header_mcast_data *amtmd; 1068 struct sk_buff *skb; 1069 struct iphdr *iph; 1070 struct flowi4 fl4; 1071 struct rtable *rt; 1072 struct sock *sk; 1073 1074 sk = rcu_dereference_bh(amt->sk); 1075 if (!sk) 1076 return; 1077 1078 skb = skb_copy_expand(oskb, sizeof(*amtmd) + sizeof(*iph) + 1079 sizeof(struct udphdr), 0, GFP_ATOMIC); 1080 if (!skb) 1081 return; 1082 1083 /* amt_dev_xmit() pulled the Ethernet header without moving the mac 1084 * header. The tunnelled payload has no link-layer header, so the 1085 * inner mac header must coincide with the inner IP header. 1086 */ 1087 skb_reset_mac_header(skb); 1088 skb_reset_inner_headers(skb); 1089 if (udp_tunnel_handle_offloads(skb, true)) { 1090 kfree_skb(skb); 1091 return; 1092 } 1093 1094 memset(&fl4, 0, sizeof(struct flowi4)); 1095 fl4.flowi4_oif = amt->stream_dev->ifindex; 1096 fl4.daddr = tunnel->ip4; 1097 fl4.saddr = amt->local_ip; 1098 fl4.flowi4_proto = IPPROTO_UDP; 1099 rt = ip_route_output_key(amt->net, &fl4); 1100 if (IS_ERR(rt)) { 1101 netdev_dbg(amt->dev, "no route to %pI4\n", &tunnel->ip4); 1102 kfree_skb(skb); 1103 return; 1104 } 1105 1106 amtmd = skb_push(skb, sizeof(*amtmd)); 1107 amtmd->version = 0; 1108 amtmd->reserved = 0; 1109 amtmd->type = AMT_MSG_MULTICAST_DATA; 1110 1111 if (!v6) 1112 skb_set_inner_protocol(skb, htons(ETH_P_IP)); 1113 else 1114 skb_set_inner_protocol(skb, htons(ETH_P_IPV6)); 1115 udp_tunnel_xmit_skb(rt, sk, skb, 1116 fl4.saddr, 1117 fl4.daddr, 1118 AMT_TOS, 1119 ip4_dst_hoplimit(&rt->dst), 1120 0, 1121 amt->relay_port, 1122 tunnel->source_port, 1123 false, 1124 false, 1125 0); 1126 } 1127 1128 static bool amt_send_membership_query(struct amt_dev *amt, 1129 struct sk_buff *skb, 1130 struct amt_tunnel_list *tunnel, 1131 bool v6) 1132 { 1133 struct amt_header_membership_query *amtmq; 1134 struct rtable *rt; 1135 struct flowi4 fl4; 1136 struct sock *sk; 1137 int err; 1138 1139 sk = rcu_dereference_bh(amt->sk); 1140 if (!sk) 1141 return true; 1142 1143 err = skb_cow_head(skb, LL_RESERVED_SPACE(amt->dev) + sizeof(*amtmq) + 1144 sizeof(struct iphdr) + sizeof(struct udphdr)); 1145 if (err) 1146 return true; 1147 1148 skb_reset_inner_headers(skb); 1149 memset(&fl4, 0, sizeof(struct flowi4)); 1150 fl4.flowi4_oif = amt->stream_dev->ifindex; 1151 fl4.daddr = tunnel->ip4; 1152 fl4.saddr = amt->local_ip; 1153 fl4.flowi4_dscp = inet_dsfield_to_dscp(AMT_TOS); 1154 fl4.flowi4_proto = IPPROTO_UDP; 1155 rt = ip_route_output_key(amt->net, &fl4); 1156 if (IS_ERR(rt)) { 1157 netdev_dbg(amt->dev, "no route to %pI4\n", &tunnel->ip4); 1158 return true; 1159 } 1160 1161 amtmq = skb_push(skb, sizeof(*amtmq)); 1162 amtmq->version = 0; 1163 amtmq->type = AMT_MSG_MEMBERSHIP_QUERY; 1164 amtmq->reserved = 0; 1165 amtmq->l = 0; 1166 amtmq->g = 0; 1167 amtmq->nonce = tunnel->nonce; 1168 amtmq->response_mac = tunnel->mac; 1169 1170 if (!v6) 1171 skb_set_inner_protocol(skb, htons(ETH_P_IP)); 1172 else 1173 skb_set_inner_protocol(skb, htons(ETH_P_IPV6)); 1174 udp_tunnel_xmit_skb(rt, sk, skb, 1175 fl4.saddr, 1176 fl4.daddr, 1177 AMT_TOS, 1178 ip4_dst_hoplimit(&rt->dst), 1179 0, 1180 amt->relay_port, 1181 tunnel->source_port, 1182 false, 1183 false, 1184 0); 1185 amt_update_relay_status(tunnel, AMT_STATUS_SENT_QUERY, true); 1186 return false; 1187 } 1188 1189 static netdev_tx_t amt_dev_xmit(struct sk_buff *skb, struct net_device *dev) 1190 { 1191 struct amt_dev *amt = netdev_priv(dev); 1192 struct amt_tunnel_list *tunnel; 1193 struct amt_group_node *gnode; 1194 union amt_addr group = {0,}; 1195 #if IS_ENABLED(CONFIG_IPV6) 1196 struct ipv6hdr *ip6h; 1197 struct mld_msg *mld; 1198 #endif 1199 bool report = false; 1200 struct igmphdr *ih; 1201 struct iphdr *iph; 1202 bool data = false; 1203 bool v6 = false; 1204 u32 hash; 1205 1206 iph = ip_hdr(skb); 1207 if (iph->version == 4) { 1208 if (!ipv4_is_multicast(iph->daddr)) 1209 goto free; 1210 1211 if (!ip_mc_check_igmp(skb)) { 1212 ih = igmp_hdr(skb); 1213 switch (ih->type) { 1214 case IGMPV3_HOST_MEMBERSHIP_REPORT: 1215 case IGMP_HOST_MEMBERSHIP_REPORT: 1216 report = true; 1217 break; 1218 default: 1219 goto free; 1220 } 1221 } else { 1222 data = true; 1223 } 1224 v6 = false; 1225 group.ip4 = ip_hdr(skb)->daddr; 1226 #if IS_ENABLED(CONFIG_IPV6) 1227 } else if (iph->version == 6) { 1228 ip6h = ipv6_hdr(skb); 1229 if (!ipv6_addr_is_multicast(&ip6h->daddr)) 1230 goto free; 1231 1232 if (!ipv6_mc_check_mld(skb)) { 1233 mld = (struct mld_msg *)skb_transport_header(skb); 1234 switch (mld->mld_type) { 1235 case ICMPV6_MGM_REPORT: 1236 case ICMPV6_MLD2_REPORT: 1237 report = true; 1238 break; 1239 default: 1240 goto free; 1241 } 1242 } else { 1243 data = true; 1244 } 1245 v6 = true; 1246 group.ip6 = ipv6_hdr(skb)->daddr; 1247 #endif 1248 } else { 1249 dev->stats.tx_errors++; 1250 goto free; 1251 } 1252 1253 if (!pskb_may_pull(skb, sizeof(struct ethhdr))) 1254 goto free; 1255 1256 skb_pull(skb, sizeof(struct ethhdr)); 1257 1258 if (amt->mode == AMT_MODE_GATEWAY) { 1259 /* Gateway only passes IGMP/MLD packets */ 1260 if (!report) 1261 goto free; 1262 if ((!v6 && !READ_ONCE(amt->ready4)) || 1263 (v6 && !READ_ONCE(amt->ready6))) 1264 goto free; 1265 if (amt_send_membership_update(amt, skb, v6)) 1266 goto free; 1267 goto unlock; 1268 } else if (amt->mode == AMT_MODE_RELAY) { 1269 if (!data) 1270 goto free; 1271 list_for_each_entry_rcu(tunnel, &amt->tunnel_list, list) { 1272 hash = amt_group_hash(tunnel, &group); 1273 hlist_for_each_entry_rcu(gnode, &tunnel->groups[hash], 1274 node) { 1275 if (!v6) { 1276 if (gnode->group_addr.ip4 == group.ip4) 1277 goto found; 1278 #if IS_ENABLED(CONFIG_IPV6) 1279 } else { 1280 if (ipv6_addr_equal(&gnode->group_addr.ip6, 1281 &group.ip6)) 1282 goto found; 1283 #endif 1284 } 1285 } 1286 continue; 1287 found: 1288 amt_send_multicast_data(amt, skb, tunnel, v6); 1289 } 1290 } 1291 1292 dev_kfree_skb(skb); 1293 return NETDEV_TX_OK; 1294 free: 1295 dev_kfree_skb(skb); 1296 unlock: 1297 dev->stats.tx_dropped++; 1298 return NETDEV_TX_OK; 1299 } 1300 1301 static int amt_parse_type(struct sk_buff *skb) 1302 { 1303 struct amt_header *amth; 1304 1305 /* skb->data is the UDP header on receive, but the quoted IP header 1306 * when amt_err_lookup() parses an ICMP error, so pull up to the 1307 * transport header rather than from skb->data. 1308 */ 1309 if (!pskb_may_pull(skb, skb_transport_offset(skb) + 1310 sizeof(struct udphdr) + sizeof(struct amt_header))) 1311 return -1; 1312 1313 amth = (struct amt_header *)(udp_hdr(skb) + 1); 1314 1315 if (amth->version != 0) 1316 return -1; 1317 1318 if (amth->type >= __AMT_MSG_MAX || !amth->type) 1319 return -1; 1320 return amth->type; 1321 } 1322 1323 static void amt_clear_groups(struct amt_tunnel_list *tunnel) 1324 { 1325 struct amt_dev *amt = tunnel->amt; 1326 struct amt_group_node *gnode; 1327 struct hlist_node *t; 1328 int i; 1329 1330 spin_lock_bh(&tunnel->lock); 1331 rcu_read_lock(); 1332 for (i = 0; i < amt->hash_buckets; i++) 1333 hlist_for_each_entry_safe(gnode, t, &tunnel->groups[i], node) 1334 amt_del_group(amt, gnode); 1335 rcu_read_unlock(); 1336 spin_unlock_bh(&tunnel->lock); 1337 } 1338 1339 static void amt_tunnel_expire(struct work_struct *work) 1340 { 1341 struct amt_tunnel_list *tunnel = container_of(to_delayed_work(work), 1342 struct amt_tunnel_list, 1343 gc_wq); 1344 struct amt_dev *amt = tunnel->amt; 1345 1346 spin_lock_bh(&amt->lock); 1347 rcu_read_lock(); 1348 list_del_rcu(&tunnel->list); 1349 amt->nr_tunnels--; 1350 amt_clear_groups(tunnel); 1351 rcu_read_unlock(); 1352 spin_unlock_bh(&amt->lock); 1353 kfree_rcu(tunnel, rcu); 1354 } 1355 1356 static void amt_cleanup_srcs(struct amt_dev *amt, 1357 struct amt_tunnel_list *tunnel, 1358 struct amt_group_node *gnode) 1359 { 1360 struct amt_source_node *snode; 1361 struct hlist_node *t; 1362 int i; 1363 1364 /* Delete old sources */ 1365 for (i = 0; i < amt->hash_buckets; i++) { 1366 hlist_for_each_entry_safe(snode, t, &gnode->sources[i], node) { 1367 if (snode->flags == AMT_SOURCE_OLD) 1368 amt_destroy_source(snode); 1369 } 1370 } 1371 1372 /* switch from new to old */ 1373 for (i = 0; i < amt->hash_buckets; i++) { 1374 hlist_for_each_entry_rcu(snode, &gnode->sources[i], node) { 1375 snode->flags = AMT_SOURCE_OLD; 1376 if (!gnode->v6) 1377 netdev_dbg(snode->gnode->amt->dev, 1378 "Add source as OLD %pI4 from %pI4\n", 1379 &snode->source_addr.ip4, 1380 &gnode->group_addr.ip4); 1381 #if IS_ENABLED(CONFIG_IPV6) 1382 else 1383 netdev_dbg(snode->gnode->amt->dev, 1384 "Add source as OLD %pI6 from %pI6\n", 1385 &snode->source_addr.ip6, 1386 &gnode->group_addr.ip6); 1387 #endif 1388 } 1389 } 1390 } 1391 1392 static void amt_add_srcs(struct amt_dev *amt, struct amt_tunnel_list *tunnel, 1393 struct amt_group_node *gnode, void *grec, 1394 bool v6) 1395 { 1396 struct igmpv3_grec *igmp_grec; 1397 struct amt_source_node *snode; 1398 #if IS_ENABLED(CONFIG_IPV6) 1399 struct mld2_grec *mld_grec; 1400 #endif 1401 union amt_addr src = {0,}; 1402 u16 nsrcs; 1403 u32 hash; 1404 int i; 1405 1406 if (!v6) { 1407 igmp_grec = grec; 1408 nsrcs = ntohs(igmp_grec->grec_nsrcs); 1409 } else { 1410 #if IS_ENABLED(CONFIG_IPV6) 1411 mld_grec = grec; 1412 nsrcs = ntohs(mld_grec->grec_nsrcs); 1413 #else 1414 return; 1415 #endif 1416 } 1417 for (i = 0; i < nsrcs; i++) { 1418 if (tunnel->nr_sources >= amt->max_sources) 1419 return; 1420 if (!v6) 1421 src.ip4 = igmp_grec->grec_src[i]; 1422 #if IS_ENABLED(CONFIG_IPV6) 1423 else 1424 memcpy(&src.ip6, &mld_grec->grec_src[i], 1425 sizeof(struct in6_addr)); 1426 #endif 1427 if (amt_lookup_src(tunnel, gnode, AMT_FILTER_ALL, &src)) 1428 continue; 1429 1430 snode = amt_alloc_snode(gnode, &src); 1431 if (snode) { 1432 hash = amt_source_hash(tunnel, &snode->source_addr); 1433 hlist_add_head_rcu(&snode->node, &gnode->sources[hash]); 1434 tunnel->nr_sources++; 1435 gnode->nr_sources++; 1436 1437 if (!gnode->v6) 1438 netdev_dbg(snode->gnode->amt->dev, 1439 "Add source as NEW %pI4 from %pI4\n", 1440 &snode->source_addr.ip4, 1441 &gnode->group_addr.ip4); 1442 #if IS_ENABLED(CONFIG_IPV6) 1443 else 1444 netdev_dbg(snode->gnode->amt->dev, 1445 "Add source as NEW %pI6 from %pI6\n", 1446 &snode->source_addr.ip6, 1447 &gnode->group_addr.ip6); 1448 #endif 1449 } 1450 } 1451 } 1452 1453 /* Router State Report Rec'd New Router State 1454 * ------------ ------------ ---------------- 1455 * EXCLUDE (X,Y) IS_IN (A) EXCLUDE (X+A,Y-A) 1456 * 1457 * -----------+-----------+-----------+ 1458 * | OLD | NEW | 1459 * -----------+-----------+-----------+ 1460 * FWD | X | X+A | 1461 * -----------+-----------+-----------+ 1462 * D_FWD | Y | Y-A | 1463 * -----------+-----------+-----------+ 1464 * NONE | | A | 1465 * -----------+-----------+-----------+ 1466 * 1467 * a) Received sources are NONE/NEW 1468 * b) All NONE will be deleted by amt_cleanup_srcs(). 1469 * c) All OLD will be deleted by amt_cleanup_srcs(). 1470 * d) After delete, NEW source will be switched to OLD. 1471 */ 1472 static void amt_lookup_act_srcs(struct amt_tunnel_list *tunnel, 1473 struct amt_group_node *gnode, 1474 void *grec, 1475 enum amt_ops ops, 1476 enum amt_filter filter, 1477 enum amt_act act, 1478 bool v6) 1479 { 1480 struct amt_dev *amt = tunnel->amt; 1481 struct amt_source_node *snode; 1482 struct igmpv3_grec *igmp_grec; 1483 #if IS_ENABLED(CONFIG_IPV6) 1484 struct mld2_grec *mld_grec; 1485 #endif 1486 union amt_addr src = {0,}; 1487 struct hlist_node *t; 1488 u16 nsrcs; 1489 int i, j; 1490 1491 if (!v6) { 1492 igmp_grec = grec; 1493 nsrcs = ntohs(igmp_grec->grec_nsrcs); 1494 } else { 1495 #if IS_ENABLED(CONFIG_IPV6) 1496 mld_grec = grec; 1497 nsrcs = ntohs(mld_grec->grec_nsrcs); 1498 #else 1499 return; 1500 #endif 1501 } 1502 1503 memset(&src, 0, sizeof(union amt_addr)); 1504 switch (ops) { 1505 case AMT_OPS_INT: 1506 /* A*B */ 1507 for (i = 0; i < nsrcs; i++) { 1508 if (!v6) 1509 src.ip4 = igmp_grec->grec_src[i]; 1510 #if IS_ENABLED(CONFIG_IPV6) 1511 else 1512 memcpy(&src.ip6, &mld_grec->grec_src[i], 1513 sizeof(struct in6_addr)); 1514 #endif 1515 snode = amt_lookup_src(tunnel, gnode, filter, &src); 1516 if (!snode) 1517 continue; 1518 amt_act_src(tunnel, gnode, snode, act); 1519 } 1520 break; 1521 case AMT_OPS_UNI: 1522 /* A+B */ 1523 for (i = 0; i < amt->hash_buckets; i++) { 1524 hlist_for_each_entry_safe(snode, t, &gnode->sources[i], 1525 node) { 1526 if (amt_status_filter(snode, filter)) 1527 amt_act_src(tunnel, gnode, snode, act); 1528 } 1529 } 1530 for (i = 0; i < nsrcs; i++) { 1531 if (!v6) 1532 src.ip4 = igmp_grec->grec_src[i]; 1533 #if IS_ENABLED(CONFIG_IPV6) 1534 else 1535 memcpy(&src.ip6, &mld_grec->grec_src[i], 1536 sizeof(struct in6_addr)); 1537 #endif 1538 snode = amt_lookup_src(tunnel, gnode, filter, &src); 1539 if (!snode) 1540 continue; 1541 amt_act_src(tunnel, gnode, snode, act); 1542 } 1543 break; 1544 case AMT_OPS_SUB: 1545 /* A-B */ 1546 for (i = 0; i < amt->hash_buckets; i++) { 1547 hlist_for_each_entry_safe(snode, t, &gnode->sources[i], 1548 node) { 1549 if (!amt_status_filter(snode, filter)) 1550 continue; 1551 for (j = 0; j < nsrcs; j++) { 1552 if (!v6) 1553 src.ip4 = igmp_grec->grec_src[j]; 1554 #if IS_ENABLED(CONFIG_IPV6) 1555 else 1556 memcpy(&src.ip6, 1557 &mld_grec->grec_src[j], 1558 sizeof(struct in6_addr)); 1559 #endif 1560 if (amt_addr_equal(&snode->source_addr, 1561 &src)) 1562 goto out_sub; 1563 } 1564 amt_act_src(tunnel, gnode, snode, act); 1565 continue; 1566 out_sub:; 1567 } 1568 } 1569 break; 1570 case AMT_OPS_SUB_REV: 1571 /* B-A */ 1572 for (i = 0; i < nsrcs; i++) { 1573 if (!v6) 1574 src.ip4 = igmp_grec->grec_src[i]; 1575 #if IS_ENABLED(CONFIG_IPV6) 1576 else 1577 memcpy(&src.ip6, &mld_grec->grec_src[i], 1578 sizeof(struct in6_addr)); 1579 #endif 1580 snode = amt_lookup_src(tunnel, gnode, AMT_FILTER_ALL, 1581 &src); 1582 if (!snode) { 1583 snode = amt_lookup_src(tunnel, gnode, 1584 filter, &src); 1585 if (snode) 1586 amt_act_src(tunnel, gnode, snode, act); 1587 } 1588 } 1589 break; 1590 default: 1591 netdev_dbg(amt->dev, "Invalid type\n"); 1592 return; 1593 } 1594 } 1595 1596 static void amt_mcast_is_in_handler(struct amt_dev *amt, 1597 struct amt_tunnel_list *tunnel, 1598 struct amt_group_node *gnode, 1599 void *grec, void *zero_grec, bool v6) 1600 { 1601 if (gnode->filter_mode == MCAST_INCLUDE) { 1602 /* Router State Report Rec'd New Router State Actions 1603 * ------------ ------------ ---------------- ------- 1604 * INCLUDE (A) IS_IN (B) INCLUDE (A+B) (B)=GMI 1605 */ 1606 /* Update IS_IN (B) as FWD/NEW */ 1607 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1608 AMT_FILTER_NONE_NEW, 1609 AMT_ACT_STATUS_FWD_NEW, 1610 v6); 1611 /* Update INCLUDE (A) as NEW */ 1612 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1613 AMT_FILTER_FWD, 1614 AMT_ACT_STATUS_FWD_NEW, 1615 v6); 1616 /* (B)=GMI */ 1617 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1618 AMT_FILTER_FWD_NEW, 1619 AMT_ACT_GMI, 1620 v6); 1621 } else { 1622 /* State Actions 1623 * ------------ ------------ ---------------- ------- 1624 * EXCLUDE (X,Y) IS_IN (A) EXCLUDE (X+A,Y-A) (A)=GMI 1625 */ 1626 /* Update (A) in (X, Y) as NONE/NEW */ 1627 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1628 AMT_FILTER_BOTH, 1629 AMT_ACT_STATUS_NONE_NEW, 1630 v6); 1631 /* Update FWD/OLD as FWD/NEW */ 1632 amt_lookup_act_srcs(tunnel, gnode, zero_grec, AMT_OPS_UNI, 1633 AMT_FILTER_FWD, 1634 AMT_ACT_STATUS_FWD_NEW, 1635 v6); 1636 /* Update IS_IN (A) as FWD/NEW */ 1637 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1638 AMT_FILTER_NONE_NEW, 1639 AMT_ACT_STATUS_FWD_NEW, 1640 v6); 1641 /* Update EXCLUDE (, Y-A) as D_FWD_NEW */ 1642 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB, 1643 AMT_FILTER_D_FWD, 1644 AMT_ACT_STATUS_D_FWD_NEW, 1645 v6); 1646 } 1647 } 1648 1649 static void amt_mcast_is_ex_handler(struct amt_dev *amt, 1650 struct amt_tunnel_list *tunnel, 1651 struct amt_group_node *gnode, 1652 void *grec, void *zero_grec, bool v6) 1653 { 1654 if (gnode->filter_mode == MCAST_INCLUDE) { 1655 /* Router State Report Rec'd New Router State Actions 1656 * ------------ ------------ ---------------- ------- 1657 * INCLUDE (A) IS_EX (B) EXCLUDE (A*B,B-A) (B-A)=0 1658 * Delete (A-B) 1659 * Group Timer=GMI 1660 */ 1661 /* EXCLUDE(A*B, ) */ 1662 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1663 AMT_FILTER_FWD, 1664 AMT_ACT_STATUS_FWD_NEW, 1665 v6); 1666 /* EXCLUDE(, B-A) */ 1667 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB_REV, 1668 AMT_FILTER_FWD, 1669 AMT_ACT_STATUS_D_FWD_NEW, 1670 v6); 1671 /* (B-A)=0 */ 1672 amt_lookup_act_srcs(tunnel, gnode, zero_grec, AMT_OPS_UNI, 1673 AMT_FILTER_D_FWD_NEW, 1674 AMT_ACT_GMI_ZERO, 1675 v6); 1676 /* Group Timer=GMI */ 1677 if (!mod_delayed_work(amt_wq, &gnode->group_timer, 1678 msecs_to_jiffies(amt_gmi(amt)))) 1679 dev_hold(amt->dev); 1680 gnode->filter_mode = MCAST_EXCLUDE; 1681 /* Delete (A-B) will be worked by amt_cleanup_srcs(). */ 1682 } else { 1683 /* Router State Report Rec'd New Router State Actions 1684 * ------------ ------------ ---------------- ------- 1685 * EXCLUDE (X,Y) IS_EX (A) EXCLUDE (A-Y,Y*A) (A-X-Y)=GMI 1686 * Delete (X-A) 1687 * Delete (Y-A) 1688 * Group Timer=GMI 1689 */ 1690 /* EXCLUDE (A-Y, ) */ 1691 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB_REV, 1692 AMT_FILTER_D_FWD, 1693 AMT_ACT_STATUS_FWD_NEW, 1694 v6); 1695 /* EXCLUDE (, Y*A ) */ 1696 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1697 AMT_FILTER_D_FWD, 1698 AMT_ACT_STATUS_D_FWD_NEW, 1699 v6); 1700 /* (A-X-Y)=GMI */ 1701 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB_REV, 1702 AMT_FILTER_BOTH_NEW, 1703 AMT_ACT_GMI, 1704 v6); 1705 /* Group Timer=GMI */ 1706 if (!mod_delayed_work(amt_wq, &gnode->group_timer, 1707 msecs_to_jiffies(amt_gmi(amt)))) 1708 dev_hold(amt->dev); 1709 /* Delete (X-A), (Y-A) will be worked by amt_cleanup_srcs(). */ 1710 } 1711 } 1712 1713 static void amt_mcast_to_in_handler(struct amt_dev *amt, 1714 struct amt_tunnel_list *tunnel, 1715 struct amt_group_node *gnode, 1716 void *grec, void *zero_grec, bool v6) 1717 { 1718 if (gnode->filter_mode == MCAST_INCLUDE) { 1719 /* Router State Report Rec'd New Router State Actions 1720 * ------------ ------------ ---------------- ------- 1721 * INCLUDE (A) TO_IN (B) INCLUDE (A+B) (B)=GMI 1722 * Send Q(G,A-B) 1723 */ 1724 /* Update TO_IN (B) sources as FWD/NEW */ 1725 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1726 AMT_FILTER_NONE_NEW, 1727 AMT_ACT_STATUS_FWD_NEW, 1728 v6); 1729 /* Update INCLUDE (A) sources as NEW */ 1730 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1731 AMT_FILTER_FWD, 1732 AMT_ACT_STATUS_FWD_NEW, 1733 v6); 1734 /* (B)=GMI */ 1735 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1736 AMT_FILTER_FWD_NEW, 1737 AMT_ACT_GMI, 1738 v6); 1739 } else { 1740 /* Router State Report Rec'd New Router State Actions 1741 * ------------ ------------ ---------------- ------- 1742 * EXCLUDE (X,Y) TO_IN (A) EXCLUDE (X+A,Y-A) (A)=GMI 1743 * Send Q(G,X-A) 1744 * Send Q(G) 1745 */ 1746 /* Update TO_IN (A) sources as FWD/NEW */ 1747 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1748 AMT_FILTER_NONE_NEW, 1749 AMT_ACT_STATUS_FWD_NEW, 1750 v6); 1751 /* Update EXCLUDE(X,) sources as FWD/NEW */ 1752 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1753 AMT_FILTER_FWD, 1754 AMT_ACT_STATUS_FWD_NEW, 1755 v6); 1756 /* EXCLUDE (, Y-A) 1757 * (A) are already switched to FWD_NEW. 1758 * So, D_FWD/OLD -> D_FWD/NEW is okay. 1759 */ 1760 amt_lookup_act_srcs(tunnel, gnode, zero_grec, AMT_OPS_UNI, 1761 AMT_FILTER_D_FWD, 1762 AMT_ACT_STATUS_D_FWD_NEW, 1763 v6); 1764 /* (A)=GMI 1765 * Only FWD_NEW will have (A) sources. 1766 */ 1767 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1768 AMT_FILTER_FWD_NEW, 1769 AMT_ACT_GMI, 1770 v6); 1771 } 1772 } 1773 1774 static void amt_mcast_to_ex_handler(struct amt_dev *amt, 1775 struct amt_tunnel_list *tunnel, 1776 struct amt_group_node *gnode, 1777 void *grec, void *zero_grec, bool v6) 1778 { 1779 if (gnode->filter_mode == MCAST_INCLUDE) { 1780 /* Router State Report Rec'd New Router State Actions 1781 * ------------ ------------ ---------------- ------- 1782 * INCLUDE (A) TO_EX (B) EXCLUDE (A*B,B-A) (B-A)=0 1783 * Delete (A-B) 1784 * Send Q(G,A*B) 1785 * Group Timer=GMI 1786 */ 1787 /* EXCLUDE (A*B, ) */ 1788 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1789 AMT_FILTER_FWD, 1790 AMT_ACT_STATUS_FWD_NEW, 1791 v6); 1792 /* EXCLUDE (, B-A) */ 1793 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB_REV, 1794 AMT_FILTER_FWD, 1795 AMT_ACT_STATUS_D_FWD_NEW, 1796 v6); 1797 /* (B-A)=0 */ 1798 amt_lookup_act_srcs(tunnel, gnode, zero_grec, AMT_OPS_UNI, 1799 AMT_FILTER_D_FWD_NEW, 1800 AMT_ACT_GMI_ZERO, 1801 v6); 1802 /* Group Timer=GMI */ 1803 if (!mod_delayed_work(amt_wq, &gnode->group_timer, 1804 msecs_to_jiffies(amt_gmi(amt)))) 1805 dev_hold(amt->dev); 1806 gnode->filter_mode = MCAST_EXCLUDE; 1807 /* Delete (A-B) will be worked by amt_cleanup_srcs(). */ 1808 } else { 1809 /* Router State Report Rec'd New Router State Actions 1810 * ------------ ------------ ---------------- ------- 1811 * EXCLUDE (X,Y) TO_EX (A) EXCLUDE (A-Y,Y*A) (A-X-Y)=Group Timer 1812 * Delete (X-A) 1813 * Delete (Y-A) 1814 * Send Q(G,A-Y) 1815 * Group Timer=GMI 1816 */ 1817 /* Update (A-X-Y) as NONE/OLD */ 1818 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB_REV, 1819 AMT_FILTER_BOTH, 1820 AMT_ACT_GT, 1821 v6); 1822 /* EXCLUDE (A-Y, ) */ 1823 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB_REV, 1824 AMT_FILTER_D_FWD, 1825 AMT_ACT_STATUS_FWD_NEW, 1826 v6); 1827 /* EXCLUDE (, Y*A) */ 1828 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1829 AMT_FILTER_D_FWD, 1830 AMT_ACT_STATUS_D_FWD_NEW, 1831 v6); 1832 /* Group Timer=GMI */ 1833 if (!mod_delayed_work(amt_wq, &gnode->group_timer, 1834 msecs_to_jiffies(amt_gmi(amt)))) 1835 dev_hold(amt->dev); 1836 /* Delete (X-A), (Y-A) will be worked by amt_cleanup_srcs(). */ 1837 } 1838 } 1839 1840 static void amt_mcast_allow_handler(struct amt_dev *amt, 1841 struct amt_tunnel_list *tunnel, 1842 struct amt_group_node *gnode, 1843 void *grec, void *zero_grec, bool v6) 1844 { 1845 if (gnode->filter_mode == MCAST_INCLUDE) { 1846 /* Router State Report Rec'd New Router State Actions 1847 * ------------ ------------ ---------------- ------- 1848 * INCLUDE (A) ALLOW (B) INCLUDE (A+B) (B)=GMI 1849 */ 1850 /* INCLUDE (A+B) */ 1851 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1852 AMT_FILTER_FWD, 1853 AMT_ACT_STATUS_FWD_NEW, 1854 v6); 1855 /* (B)=GMI */ 1856 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1857 AMT_FILTER_FWD_NEW, 1858 AMT_ACT_GMI, 1859 v6); 1860 } else { 1861 /* Router State Report Rec'd New Router State Actions 1862 * ------------ ------------ ---------------- ------- 1863 * EXCLUDE (X,Y) ALLOW (A) EXCLUDE (X+A,Y-A) (A)=GMI 1864 */ 1865 /* EXCLUDE (X+A, ) */ 1866 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1867 AMT_FILTER_FWD, 1868 AMT_ACT_STATUS_FWD_NEW, 1869 v6); 1870 /* EXCLUDE (, Y-A) */ 1871 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB, 1872 AMT_FILTER_D_FWD, 1873 AMT_ACT_STATUS_D_FWD_NEW, 1874 v6); 1875 /* (A)=GMI 1876 * All (A) source are now FWD/NEW status. 1877 */ 1878 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_INT, 1879 AMT_FILTER_FWD_NEW, 1880 AMT_ACT_GMI, 1881 v6); 1882 } 1883 } 1884 1885 static void amt_mcast_block_handler(struct amt_dev *amt, 1886 struct amt_tunnel_list *tunnel, 1887 struct amt_group_node *gnode, 1888 void *grec, void *zero_grec, bool v6) 1889 { 1890 if (gnode->filter_mode == MCAST_INCLUDE) { 1891 /* Router State Report Rec'd New Router State Actions 1892 * ------------ ------------ ---------------- ------- 1893 * INCLUDE (A) BLOCK (B) INCLUDE (A) Send Q(G,A*B) 1894 */ 1895 /* INCLUDE (A) */ 1896 amt_lookup_act_srcs(tunnel, gnode, zero_grec, AMT_OPS_UNI, 1897 AMT_FILTER_FWD, 1898 AMT_ACT_STATUS_FWD_NEW, 1899 v6); 1900 } else { 1901 /* Router State Report Rec'd New Router State Actions 1902 * ------------ ------------ ---------------- ------- 1903 * EXCLUDE (X,Y) BLOCK (A) EXCLUDE (X+(A-Y),Y) (A-X-Y)=Group Timer 1904 * Send Q(G,A-Y) 1905 */ 1906 /* (A-X-Y)=Group Timer */ 1907 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB_REV, 1908 AMT_FILTER_BOTH, 1909 AMT_ACT_GT, 1910 v6); 1911 /* EXCLUDE (X, ) */ 1912 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1913 AMT_FILTER_FWD, 1914 AMT_ACT_STATUS_FWD_NEW, 1915 v6); 1916 /* EXCLUDE (X+(A-Y) */ 1917 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_SUB_REV, 1918 AMT_FILTER_D_FWD, 1919 AMT_ACT_STATUS_FWD_NEW, 1920 v6); 1921 /* EXCLUDE (, Y) */ 1922 amt_lookup_act_srcs(tunnel, gnode, grec, AMT_OPS_UNI, 1923 AMT_FILTER_D_FWD, 1924 AMT_ACT_STATUS_D_FWD_NEW, 1925 v6); 1926 } 1927 } 1928 1929 /* RFC 3376 1930 * 7.3.2. In the Presence of Older Version Group Members 1931 * 1932 * When Group Compatibility Mode is IGMPv2, a router internally 1933 * translates the following IGMPv2 messages for that group to their 1934 * IGMPv3 equivalents: 1935 * 1936 * IGMPv2 Message IGMPv3 Equivalent 1937 * -------------- ----------------- 1938 * Report IS_EX( {} ) 1939 * Leave TO_IN( {} ) 1940 */ 1941 static void amt_igmpv2_report_handler(struct amt_dev *amt, struct sk_buff *skb, 1942 struct amt_tunnel_list *tunnel) 1943 { 1944 struct igmphdr *ih = igmp_hdr(skb); 1945 struct iphdr *iph = ip_hdr(skb); 1946 struct amt_group_node *gnode; 1947 union amt_addr group, host; 1948 1949 memset(&group, 0, sizeof(union amt_addr)); 1950 group.ip4 = ih->group; 1951 memset(&host, 0, sizeof(union amt_addr)); 1952 host.ip4 = iph->saddr; 1953 1954 gnode = amt_lookup_group(tunnel, &group, &host, false); 1955 if (!gnode) { 1956 gnode = amt_add_group(amt, tunnel, &group, &host, false); 1957 if (!IS_ERR(gnode)) { 1958 gnode->filter_mode = MCAST_EXCLUDE; 1959 if (!mod_delayed_work(amt_wq, &gnode->group_timer, 1960 msecs_to_jiffies(amt_gmi(amt)))) 1961 dev_hold(amt->dev); 1962 } 1963 } 1964 } 1965 1966 /* RFC 3376 1967 * 7.3.2. In the Presence of Older Version Group Members 1968 * 1969 * When Group Compatibility Mode is IGMPv2, a router internally 1970 * translates the following IGMPv2 messages for that group to their 1971 * IGMPv3 equivalents: 1972 * 1973 * IGMPv2 Message IGMPv3 Equivalent 1974 * -------------- ----------------- 1975 * Report IS_EX( {} ) 1976 * Leave TO_IN( {} ) 1977 */ 1978 static void amt_igmpv2_leave_handler(struct amt_dev *amt, struct sk_buff *skb, 1979 struct amt_tunnel_list *tunnel) 1980 { 1981 struct igmphdr *ih = igmp_hdr(skb); 1982 struct iphdr *iph = ip_hdr(skb); 1983 struct amt_group_node *gnode; 1984 union amt_addr group, host; 1985 1986 memset(&group, 0, sizeof(union amt_addr)); 1987 group.ip4 = ih->group; 1988 memset(&host, 0, sizeof(union amt_addr)); 1989 host.ip4 = iph->saddr; 1990 1991 gnode = amt_lookup_group(tunnel, &group, &host, false); 1992 if (gnode) 1993 amt_del_group(amt, gnode); 1994 } 1995 1996 static void amt_igmpv3_report_handler(struct amt_dev *amt, struct sk_buff *skb, 1997 struct amt_tunnel_list *tunnel) 1998 { 1999 struct igmpv3_report *ihrv3 = igmpv3_report_hdr(skb); 2000 int len = skb_transport_offset(skb) + sizeof(*ihrv3); 2001 void *zero_grec = (void *)&igmpv3_zero_grec; 2002 struct amt_group_node *gnode; 2003 union amt_addr group, host; 2004 struct igmpv3_grec *grec; 2005 __be32 saddr; 2006 u16 nsrcs; 2007 u16 ngrec; 2008 int i; 2009 2010 saddr = ip_hdr(skb)->saddr; 2011 ngrec = ntohs(ihrv3->ngrec); 2012 2013 for (i = 0; i < ngrec; i++) { 2014 len += sizeof(*grec); 2015 if (!ip_mc_may_pull(skb, len)) 2016 break; 2017 2018 grec = (void *)(skb->data + len - sizeof(*grec)); 2019 nsrcs = ntohs(grec->grec_nsrcs); 2020 2021 len += nsrcs * sizeof(__be32); 2022 if (!ip_mc_may_pull(skb, len)) 2023 break; 2024 2025 grec = (void *)(skb->data + len - sizeof(*grec) - 2026 nsrcs * sizeof(__be32)); 2027 2028 memset(&group, 0, sizeof(union amt_addr)); 2029 group.ip4 = grec->grec_mca; 2030 memset(&host, 0, sizeof(union amt_addr)); 2031 host.ip4 = saddr; 2032 gnode = amt_lookup_group(tunnel, &group, &host, false); 2033 if (!gnode) { 2034 gnode = amt_add_group(amt, tunnel, &group, &host, 2035 false); 2036 if (IS_ERR(gnode)) 2037 continue; 2038 } 2039 2040 amt_add_srcs(amt, tunnel, gnode, grec, false); 2041 switch (grec->grec_type) { 2042 case IGMPV3_MODE_IS_INCLUDE: 2043 amt_mcast_is_in_handler(amt, tunnel, gnode, grec, 2044 zero_grec, false); 2045 break; 2046 case IGMPV3_MODE_IS_EXCLUDE: 2047 amt_mcast_is_ex_handler(amt, tunnel, gnode, grec, 2048 zero_grec, false); 2049 break; 2050 case IGMPV3_CHANGE_TO_INCLUDE: 2051 amt_mcast_to_in_handler(amt, tunnel, gnode, grec, 2052 zero_grec, false); 2053 break; 2054 case IGMPV3_CHANGE_TO_EXCLUDE: 2055 amt_mcast_to_ex_handler(amt, tunnel, gnode, grec, 2056 zero_grec, false); 2057 break; 2058 case IGMPV3_ALLOW_NEW_SOURCES: 2059 amt_mcast_allow_handler(amt, tunnel, gnode, grec, 2060 zero_grec, false); 2061 break; 2062 case IGMPV3_BLOCK_OLD_SOURCES: 2063 amt_mcast_block_handler(amt, tunnel, gnode, grec, 2064 zero_grec, false); 2065 break; 2066 default: 2067 break; 2068 } 2069 amt_cleanup_srcs(amt, tunnel, gnode); 2070 } 2071 } 2072 2073 /* caller held tunnel->lock */ 2074 static void amt_igmp_report_handler(struct amt_dev *amt, struct sk_buff *skb, 2075 struct amt_tunnel_list *tunnel) 2076 { 2077 struct igmphdr *ih = igmp_hdr(skb); 2078 2079 switch (ih->type) { 2080 case IGMPV3_HOST_MEMBERSHIP_REPORT: 2081 amt_igmpv3_report_handler(amt, skb, tunnel); 2082 break; 2083 case IGMPV2_HOST_MEMBERSHIP_REPORT: 2084 amt_igmpv2_report_handler(amt, skb, tunnel); 2085 break; 2086 case IGMP_HOST_LEAVE_MESSAGE: 2087 amt_igmpv2_leave_handler(amt, skb, tunnel); 2088 break; 2089 default: 2090 break; 2091 } 2092 } 2093 2094 #if IS_ENABLED(CONFIG_IPV6) 2095 /* RFC 3810 2096 * 8.3.2. In the Presence of MLDv1 Multicast Address Listeners 2097 * 2098 * When Multicast Address Compatibility Mode is MLDv2, a router acts 2099 * using the MLDv2 protocol for that multicast address. When Multicast 2100 * Address Compatibility Mode is MLDv1, a router internally translates 2101 * the following MLDv1 messages for that multicast address to their 2102 * MLDv2 equivalents: 2103 * 2104 * MLDv1 Message MLDv2 Equivalent 2105 * -------------- ----------------- 2106 * Report IS_EX( {} ) 2107 * Done TO_IN( {} ) 2108 */ 2109 static void amt_mldv1_report_handler(struct amt_dev *amt, struct sk_buff *skb, 2110 struct amt_tunnel_list *tunnel) 2111 { 2112 struct mld_msg *mld = (struct mld_msg *)icmp6_hdr(skb); 2113 struct ipv6hdr *ip6h = ipv6_hdr(skb); 2114 struct amt_group_node *gnode; 2115 union amt_addr group, host; 2116 2117 memcpy(&group.ip6, &mld->mld_mca, sizeof(struct in6_addr)); 2118 memcpy(&host.ip6, &ip6h->saddr, sizeof(struct in6_addr)); 2119 2120 gnode = amt_lookup_group(tunnel, &group, &host, true); 2121 if (!gnode) { 2122 gnode = amt_add_group(amt, tunnel, &group, &host, true); 2123 if (!IS_ERR(gnode)) { 2124 gnode->filter_mode = MCAST_EXCLUDE; 2125 if (!mod_delayed_work(amt_wq, &gnode->group_timer, 2126 msecs_to_jiffies(amt_gmi(amt)))) 2127 dev_hold(amt->dev); 2128 } 2129 } 2130 } 2131 2132 /* RFC 3810 2133 * 8.3.2. In the Presence of MLDv1 Multicast Address Listeners 2134 * 2135 * When Multicast Address Compatibility Mode is MLDv2, a router acts 2136 * using the MLDv2 protocol for that multicast address. When Multicast 2137 * Address Compatibility Mode is MLDv1, a router internally translates 2138 * the following MLDv1 messages for that multicast address to their 2139 * MLDv2 equivalents: 2140 * 2141 * MLDv1 Message MLDv2 Equivalent 2142 * -------------- ----------------- 2143 * Report IS_EX( {} ) 2144 * Done TO_IN( {} ) 2145 */ 2146 static void amt_mldv1_leave_handler(struct amt_dev *amt, struct sk_buff *skb, 2147 struct amt_tunnel_list *tunnel) 2148 { 2149 struct mld_msg *mld = (struct mld_msg *)icmp6_hdr(skb); 2150 struct iphdr *iph = ip_hdr(skb); 2151 struct amt_group_node *gnode; 2152 union amt_addr group, host; 2153 2154 memcpy(&group.ip6, &mld->mld_mca, sizeof(struct in6_addr)); 2155 memset(&host, 0, sizeof(union amt_addr)); 2156 host.ip4 = iph->saddr; 2157 2158 gnode = amt_lookup_group(tunnel, &group, &host, true); 2159 if (gnode) { 2160 amt_del_group(amt, gnode); 2161 return; 2162 } 2163 } 2164 2165 static void amt_mldv2_report_handler(struct amt_dev *amt, struct sk_buff *skb, 2166 struct amt_tunnel_list *tunnel) 2167 { 2168 struct mld2_report *mld2r = (struct mld2_report *)icmp6_hdr(skb); 2169 int len = skb_transport_offset(skb) + sizeof(*mld2r); 2170 void *zero_grec = (void *)&mldv2_zero_grec; 2171 struct amt_group_node *gnode; 2172 union amt_addr group, host; 2173 struct mld2_grec *grec; 2174 struct in6_addr saddr; 2175 u16 nsrcs; 2176 u16 ngrec; 2177 int i; 2178 2179 saddr = ipv6_hdr(skb)->saddr; 2180 ngrec = ntohs(mld2r->mld2r_ngrec); 2181 2182 for (i = 0; i < ngrec; i++) { 2183 len += sizeof(*grec); 2184 if (!ipv6_mc_may_pull(skb, len)) 2185 break; 2186 2187 grec = (void *)(skb->data + len - sizeof(*grec)); 2188 nsrcs = ntohs(grec->grec_nsrcs); 2189 2190 len += nsrcs * sizeof(struct in6_addr); 2191 if (!ipv6_mc_may_pull(skb, len)) 2192 break; 2193 2194 grec = (void *)(skb->data + len - sizeof(*grec) - 2195 nsrcs * sizeof(struct in6_addr)); 2196 2197 memset(&group, 0, sizeof(union amt_addr)); 2198 group.ip6 = grec->grec_mca; 2199 memset(&host, 0, sizeof(union amt_addr)); 2200 host.ip6 = saddr; 2201 gnode = amt_lookup_group(tunnel, &group, &host, true); 2202 if (!gnode) { 2203 gnode = amt_add_group(amt, tunnel, &group, &host, 2204 ETH_P_IPV6); 2205 if (IS_ERR(gnode)) 2206 continue; 2207 } 2208 2209 amt_add_srcs(amt, tunnel, gnode, grec, true); 2210 switch (grec->grec_type) { 2211 case MLD2_MODE_IS_INCLUDE: 2212 amt_mcast_is_in_handler(amt, tunnel, gnode, grec, 2213 zero_grec, true); 2214 break; 2215 case MLD2_MODE_IS_EXCLUDE: 2216 amt_mcast_is_ex_handler(amt, tunnel, gnode, grec, 2217 zero_grec, true); 2218 break; 2219 case MLD2_CHANGE_TO_INCLUDE: 2220 amt_mcast_to_in_handler(amt, tunnel, gnode, grec, 2221 zero_grec, true); 2222 break; 2223 case MLD2_CHANGE_TO_EXCLUDE: 2224 amt_mcast_to_ex_handler(amt, tunnel, gnode, grec, 2225 zero_grec, true); 2226 break; 2227 case MLD2_ALLOW_NEW_SOURCES: 2228 amt_mcast_allow_handler(amt, tunnel, gnode, grec, 2229 zero_grec, true); 2230 break; 2231 case MLD2_BLOCK_OLD_SOURCES: 2232 amt_mcast_block_handler(amt, tunnel, gnode, grec, 2233 zero_grec, true); 2234 break; 2235 default: 2236 break; 2237 } 2238 amt_cleanup_srcs(amt, tunnel, gnode); 2239 } 2240 } 2241 2242 /* caller held tunnel->lock */ 2243 static void amt_mld_report_handler(struct amt_dev *amt, struct sk_buff *skb, 2244 struct amt_tunnel_list *tunnel) 2245 { 2246 struct mld_msg *mld = (struct mld_msg *)icmp6_hdr(skb); 2247 2248 switch (mld->mld_type) { 2249 case ICMPV6_MGM_REPORT: 2250 amt_mldv1_report_handler(amt, skb, tunnel); 2251 break; 2252 case ICMPV6_MLD2_REPORT: 2253 amt_mldv2_report_handler(amt, skb, tunnel); 2254 break; 2255 case ICMPV6_MGM_REDUCTION: 2256 amt_mldv1_leave_handler(amt, skb, tunnel); 2257 break; 2258 default: 2259 break; 2260 } 2261 } 2262 #endif 2263 2264 static bool amt_advertisement_handler(struct amt_dev *amt, struct sk_buff *skb) 2265 { 2266 struct amt_header_advertisement *amta; 2267 int hdr_size; 2268 2269 hdr_size = sizeof(*amta) + sizeof(struct udphdr); 2270 if (!pskb_may_pull(skb, hdr_size)) 2271 return true; 2272 2273 amta = (struct amt_header_advertisement *)(udp_hdr(skb) + 1); 2274 if (!amta->ip4) 2275 return true; 2276 2277 if (amta->reserved || amta->version) 2278 return true; 2279 2280 if (ipv4_is_loopback(amta->ip4) || ipv4_is_multicast(amta->ip4) || 2281 ipv4_is_zeronet(amta->ip4)) 2282 return true; 2283 2284 if (amt->status != AMT_STATUS_SENT_DISCOVERY || 2285 amt->nonce != amta->nonce) 2286 return true; 2287 2288 WRITE_ONCE(amt->remote_ip, amta->ip4); 2289 netdev_dbg(amt->dev, "advertised remote ip = %pI4\n", &amta->ip4); 2290 mod_delayed_work(amt_wq, &amt->req_wq, 0); 2291 2292 amt_update_gw_status(amt, AMT_STATUS_RECEIVED_ADVERTISEMENT, true); 2293 return false; 2294 } 2295 2296 static bool amt_multicast_data_handler(struct amt_dev *amt, struct sk_buff *skb) 2297 { 2298 struct amt_header_mcast_data *amtmd; 2299 int hdr_size, len, err; 2300 struct ethhdr *eth; 2301 struct iphdr *iph; 2302 2303 if (READ_ONCE(amt->status) != AMT_STATUS_SENT_UPDATE) 2304 return true; 2305 2306 hdr_size = sizeof(*amtmd) + sizeof(struct udphdr); 2307 if (!pskb_may_pull(skb, hdr_size)) 2308 return true; 2309 2310 amtmd = (struct amt_header_mcast_data *)(udp_hdr(skb) + 1); 2311 if (amtmd->reserved || amtmd->version) 2312 return true; 2313 2314 if (iptunnel_pull_header(skb, hdr_size, htons(ETH_P_IP), false)) 2315 return true; 2316 2317 skb_reset_network_header(skb); 2318 skb_push(skb, sizeof(*eth)); 2319 skb_reset_mac_header(skb); 2320 skb_pull(skb, sizeof(*eth)); 2321 2322 if (skb_cow_head(skb, 0)) 2323 return true; 2324 2325 if (!pskb_may_pull(skb, sizeof(*iph))) 2326 return true; 2327 iph = ip_hdr(skb); 2328 2329 if (iph->version == 4) { 2330 if (!ipv4_is_multicast(iph->daddr)) 2331 return true; 2332 skb->protocol = htons(ETH_P_IP); 2333 eth = eth_hdr(skb); 2334 eth->h_proto = htons(ETH_P_IP); 2335 ip_eth_mc_map(iph->daddr, eth->h_dest); 2336 #if IS_ENABLED(CONFIG_IPV6) 2337 } else if (iph->version == 6) { 2338 struct ipv6hdr *ip6h; 2339 2340 if (!pskb_may_pull(skb, sizeof(*ip6h))) 2341 return true; 2342 2343 ip6h = ipv6_hdr(skb); 2344 if (!ipv6_addr_is_multicast(&ip6h->daddr)) 2345 return true; 2346 skb->protocol = htons(ETH_P_IPV6); 2347 eth = eth_hdr(skb); 2348 eth->h_proto = htons(ETH_P_IPV6); 2349 ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest); 2350 #endif 2351 } else { 2352 return true; 2353 } 2354 2355 skb->pkt_type = PACKET_MULTICAST; 2356 skb->ip_summed = CHECKSUM_NONE; 2357 len = skb->len; 2358 err = gro_cells_receive(&amt->gro_cells, skb); 2359 if (likely(err == NET_RX_SUCCESS)) 2360 dev_sw_netstats_rx_add(amt->dev, len); 2361 else 2362 amt->dev->stats.rx_dropped++; 2363 2364 return false; 2365 } 2366 2367 static bool amt_membership_query_handler(struct amt_dev *amt, 2368 struct sk_buff *skb) 2369 { 2370 struct amt_header_membership_query *amtmq; 2371 struct ethhdr *eth, *oeth; 2372 struct igmpv3_query *ihv3; 2373 u8 h_source[ETH_ALEN]; 2374 struct iphdr *iph; 2375 int hdr_size, len; 2376 u64 response_mac; 2377 2378 hdr_size = sizeof(*amtmq) + sizeof(struct udphdr); 2379 if (!pskb_may_pull(skb, hdr_size)) 2380 return true; 2381 2382 amtmq = (struct amt_header_membership_query *)(udp_hdr(skb) + 1); 2383 if (amtmq->reserved || amtmq->version) 2384 return true; 2385 2386 if (amtmq->nonce != amt->nonce) 2387 return true; 2388 2389 response_mac = amtmq->response_mac; 2390 2391 hdr_size -= sizeof(*eth); 2392 if (iptunnel_pull_header(skb, hdr_size, htons(ETH_P_TEB), false)) 2393 return true; 2394 2395 oeth = eth_hdr(skb); 2396 skb_reset_mac_header(skb); 2397 skb_pull(skb, sizeof(*eth)); 2398 skb_reset_network_header(skb); 2399 eth = eth_hdr(skb); 2400 ether_addr_copy(h_source, oeth->h_source); 2401 if (skb_cow_head(skb, 0)) 2402 return true; 2403 if (!pskb_may_pull(skb, sizeof(*iph))) 2404 return true; 2405 2406 iph = ip_hdr(skb); 2407 if (iph->version == 4) { 2408 if (READ_ONCE(amt->ready4)) 2409 return true; 2410 2411 if (!pskb_may_pull(skb, sizeof(*iph) + AMT_IPHDR_OPTS + 2412 sizeof(*ihv3))) 2413 return true; 2414 2415 iph = ip_hdr(skb); 2416 if (!ipv4_is_multicast(iph->daddr)) 2417 return true; 2418 2419 ihv3 = skb_pull(skb, sizeof(*iph) + AMT_IPHDR_OPTS); 2420 skb_reset_transport_header(skb); 2421 skb_push(skb, sizeof(*iph) + AMT_IPHDR_OPTS); 2422 WRITE_ONCE(amt->ready4, true); 2423 amt->mac = response_mac; 2424 amt->req_cnt = 0; 2425 amt->qi = ihv3->qqic; 2426 skb->protocol = htons(ETH_P_IP); 2427 eth = eth_hdr(skb); 2428 eth->h_proto = htons(ETH_P_IP); 2429 ip_eth_mc_map(iph->daddr, eth->h_dest); 2430 #if IS_ENABLED(CONFIG_IPV6) 2431 } else if (iph->version == 6) { 2432 struct mld2_query *mld2q; 2433 struct ipv6hdr *ip6h; 2434 2435 if (READ_ONCE(amt->ready6)) 2436 return true; 2437 2438 if (!pskb_may_pull(skb, sizeof(*ip6h) + AMT_IP6HDR_OPTS + 2439 sizeof(*mld2q))) 2440 return true; 2441 2442 ip6h = ipv6_hdr(skb); 2443 if (!ipv6_addr_is_multicast(&ip6h->daddr)) 2444 return true; 2445 2446 mld2q = skb_pull(skb, sizeof(*ip6h) + AMT_IP6HDR_OPTS); 2447 skb_reset_transport_header(skb); 2448 skb_push(skb, sizeof(*ip6h) + AMT_IP6HDR_OPTS); 2449 WRITE_ONCE(amt->ready6, true); 2450 amt->mac = response_mac; 2451 amt->req_cnt = 0; 2452 amt->qi = mld2q->mld2q_qqic; 2453 skb->protocol = htons(ETH_P_IPV6); 2454 eth = eth_hdr(skb); 2455 eth->h_proto = htons(ETH_P_IPV6); 2456 ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest); 2457 #endif 2458 } else { 2459 return true; 2460 } 2461 2462 ether_addr_copy(eth->h_source, h_source); 2463 skb->pkt_type = PACKET_MULTICAST; 2464 skb->ip_summed = CHECKSUM_NONE; 2465 len = skb->len; 2466 local_bh_disable(); 2467 if (__netif_rx(skb) == NET_RX_SUCCESS) { 2468 amt_update_gw_status(amt, AMT_STATUS_RECEIVED_QUERY, true); 2469 dev_sw_netstats_rx_add(amt->dev, len); 2470 } else { 2471 amt->dev->stats.rx_dropped++; 2472 } 2473 local_bh_enable(); 2474 2475 return false; 2476 } 2477 2478 static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb) 2479 { 2480 struct amt_header_membership_update *amtmu; 2481 struct amt_tunnel_list *tunnel; 2482 struct ethhdr *eth; 2483 struct iphdr *iph; 2484 int len, hdr_size; 2485 u64 response_mac; 2486 __be32 saddr; 2487 __be32 nonce; 2488 2489 saddr = ip_hdr(skb)->saddr; 2490 2491 hdr_size = sizeof(*amtmu) + sizeof(struct udphdr); 2492 if (!pskb_may_pull(skb, hdr_size)) 2493 return true; 2494 2495 amtmu = (struct amt_header_membership_update *)(udp_hdr(skb) + 1); 2496 if (amtmu->reserved || amtmu->version) 2497 return true; 2498 2499 nonce = amtmu->nonce; 2500 response_mac = amtmu->response_mac; 2501 2502 if (iptunnel_pull_header(skb, hdr_size, skb->protocol, false)) 2503 return true; 2504 2505 skb_reset_network_header(skb); 2506 2507 list_for_each_entry_rcu(tunnel, &amt->tunnel_list, list) { 2508 if (tunnel->ip4 == saddr) { 2509 if ((nonce == tunnel->nonce && 2510 response_mac == tunnel->mac)) { 2511 mod_delayed_work(amt_wq, &tunnel->gc_wq, 2512 msecs_to_jiffies(amt_gmi(amt)) 2513 * 3); 2514 goto report; 2515 } else { 2516 netdev_dbg(amt->dev, "Invalid MAC\n"); 2517 return true; 2518 } 2519 } 2520 } 2521 2522 return true; 2523 2524 report: 2525 if (!pskb_may_pull(skb, sizeof(*iph))) 2526 return true; 2527 2528 if (skb_cow_head(skb, 0)) 2529 return true; 2530 2531 iph = ip_hdr(skb); 2532 if (iph->version == 4) { 2533 if (ip_mc_check_igmp(skb)) { 2534 netdev_dbg(amt->dev, "Invalid IGMP\n"); 2535 return true; 2536 } 2537 2538 spin_lock_bh(&tunnel->lock); 2539 amt_igmp_report_handler(amt, skb, tunnel); 2540 spin_unlock_bh(&tunnel->lock); 2541 2542 skb_push(skb, sizeof(struct ethhdr)); 2543 skb_reset_mac_header(skb); 2544 eth = eth_hdr(skb); 2545 skb->protocol = htons(ETH_P_IP); 2546 eth->h_proto = htons(ETH_P_IP); 2547 iph = ip_hdr(skb); 2548 ip_eth_mc_map(iph->daddr, eth->h_dest); 2549 #if IS_ENABLED(CONFIG_IPV6) 2550 } else if (iph->version == 6) { 2551 struct ipv6hdr *ip6h = ipv6_hdr(skb); 2552 2553 if (ipv6_mc_check_mld(skb)) { 2554 netdev_dbg(amt->dev, "Invalid MLD\n"); 2555 return true; 2556 } 2557 2558 spin_lock_bh(&tunnel->lock); 2559 amt_mld_report_handler(amt, skb, tunnel); 2560 spin_unlock_bh(&tunnel->lock); 2561 2562 skb_push(skb, sizeof(struct ethhdr)); 2563 skb_reset_mac_header(skb); 2564 eth = eth_hdr(skb); 2565 skb->protocol = htons(ETH_P_IPV6); 2566 eth->h_proto = htons(ETH_P_IPV6); 2567 ip6h = ipv6_hdr(skb); 2568 ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest); 2569 #endif 2570 } else { 2571 netdev_dbg(amt->dev, "Unsupported Protocol\n"); 2572 return true; 2573 } 2574 2575 skb_pull(skb, sizeof(struct ethhdr)); 2576 skb->pkt_type = PACKET_MULTICAST; 2577 skb->ip_summed = CHECKSUM_NONE; 2578 len = skb->len; 2579 if (__netif_rx(skb) == NET_RX_SUCCESS) { 2580 amt_update_relay_status(tunnel, AMT_STATUS_RECEIVED_UPDATE, 2581 true); 2582 dev_sw_netstats_rx_add(amt->dev, len); 2583 } else { 2584 amt->dev->stats.rx_dropped++; 2585 } 2586 2587 return false; 2588 } 2589 2590 static void amt_send_advertisement(struct amt_dev *amt, __be32 nonce, 2591 __be32 daddr, __be16 dport) 2592 { 2593 struct amt_header_advertisement *amta; 2594 int hlen, tlen, offset; 2595 struct udphdr *udph; 2596 struct sk_buff *skb; 2597 struct iphdr *iph; 2598 struct rtable *rt; 2599 struct flowi4 fl4; 2600 struct sock *sk; 2601 u32 len; 2602 int err; 2603 2604 rcu_read_lock(); 2605 sk = rcu_dereference(amt->sk); 2606 if (!sk) 2607 goto out; 2608 2609 if (!netif_running(amt->stream_dev) || !netif_running(amt->dev)) 2610 goto out; 2611 2612 rt = ip_route_output_ports(amt->net, &fl4, sk, 2613 daddr, amt->local_ip, 2614 dport, amt->relay_port, 2615 IPPROTO_UDP, 0, 2616 amt->stream_dev->ifindex); 2617 if (IS_ERR(rt)) { 2618 amt->dev->stats.tx_errors++; 2619 goto out; 2620 } 2621 2622 hlen = LL_RESERVED_SPACE(amt->dev); 2623 tlen = amt->dev->needed_tailroom; 2624 len = hlen + tlen + sizeof(*iph) + sizeof(*udph) + sizeof(*amta); 2625 skb = netdev_alloc_skb_ip_align(amt->dev, len); 2626 if (!skb) { 2627 ip_rt_put(rt); 2628 amt->dev->stats.tx_errors++; 2629 goto out; 2630 } 2631 2632 skb->priority = TC_PRIO_CONTROL; 2633 skb_dst_set(skb, &rt->dst); 2634 2635 len = sizeof(*iph) + sizeof(*udph) + sizeof(*amta); 2636 skb_reset_network_header(skb); 2637 skb_put(skb, len); 2638 amta = skb_pull(skb, sizeof(*iph) + sizeof(*udph)); 2639 amta->version = 0; 2640 amta->type = AMT_MSG_ADVERTISEMENT; 2641 amta->reserved = 0; 2642 amta->nonce = nonce; 2643 amta->ip4 = amt->local_ip; 2644 skb_push(skb, sizeof(*udph)); 2645 skb_reset_transport_header(skb); 2646 udph = udp_hdr(skb); 2647 udph->source = amt->relay_port; 2648 udph->dest = dport; 2649 udp_set_len_short(udph, sizeof(*amta) + sizeof(*udph)); 2650 udph->check = 0; 2651 offset = skb_transport_offset(skb); 2652 skb->csum = skb_checksum(skb, offset, skb->len - offset, 0); 2653 udph->check = csum_tcpudp_magic(amt->local_ip, daddr, 2654 sizeof(*udph) + sizeof(*amta), 2655 IPPROTO_UDP, skb->csum); 2656 2657 skb_push(skb, sizeof(*iph)); 2658 iph = ip_hdr(skb); 2659 iph->version = 4; 2660 iph->ihl = (sizeof(struct iphdr)) >> 2; 2661 iph->tos = AMT_TOS; 2662 iph->frag_off = 0; 2663 iph->ttl = ip4_dst_hoplimit(&rt->dst); 2664 iph->daddr = daddr; 2665 iph->saddr = amt->local_ip; 2666 iph->protocol = IPPROTO_UDP; 2667 iph->tot_len = htons(len); 2668 2669 skb->ip_summed = CHECKSUM_NONE; 2670 ip_select_ident(amt->net, skb, NULL); 2671 ip_send_check(iph); 2672 err = ip_local_out(amt->net, sk, skb); 2673 if (unlikely(net_xmit_eval(err))) 2674 amt->dev->stats.tx_errors++; 2675 2676 out: 2677 rcu_read_unlock(); 2678 } 2679 2680 static bool amt_discovery_handler(struct amt_dev *amt, struct sk_buff *skb) 2681 { 2682 struct amt_header_discovery *amtd; 2683 struct udphdr *udph; 2684 struct iphdr *iph; 2685 2686 if (!pskb_may_pull(skb, sizeof(*udph) + sizeof(*amtd))) 2687 return true; 2688 2689 iph = ip_hdr(skb); 2690 udph = udp_hdr(skb); 2691 amtd = (struct amt_header_discovery *)(udp_hdr(skb) + 1); 2692 2693 if (amtd->reserved || amtd->version) 2694 return true; 2695 2696 amt_send_advertisement(amt, amtd->nonce, iph->saddr, udph->source); 2697 2698 return false; 2699 } 2700 2701 static bool amt_request_handler(struct amt_dev *amt, struct sk_buff *skb) 2702 { 2703 struct amt_header_request *amtrh; 2704 struct amt_tunnel_list *tunnel; 2705 unsigned long long key; 2706 struct udphdr *udph; 2707 struct iphdr *iph; 2708 u64 mac; 2709 int i; 2710 2711 if (!pskb_may_pull(skb, sizeof(*udph) + sizeof(*amtrh))) 2712 return true; 2713 2714 iph = ip_hdr(skb); 2715 udph = udp_hdr(skb); 2716 amtrh = (struct amt_header_request *)(udp_hdr(skb) + 1); 2717 2718 if (amtrh->reserved1 || amtrh->reserved2 || amtrh->version) 2719 return true; 2720 2721 list_for_each_entry_rcu(tunnel, &amt->tunnel_list, list) 2722 if (tunnel->ip4 == iph->saddr) 2723 goto send; 2724 2725 spin_lock_bh(&amt->lock); 2726 if (amt->nr_tunnels >= amt->max_tunnels) { 2727 spin_unlock_bh(&amt->lock); 2728 icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0); 2729 return true; 2730 } 2731 2732 tunnel = kzalloc(sizeof(*tunnel) + 2733 (sizeof(struct hlist_head) * amt->hash_buckets), 2734 GFP_ATOMIC); 2735 if (!tunnel) { 2736 spin_unlock_bh(&amt->lock); 2737 return true; 2738 } 2739 2740 tunnel->source_port = udph->source; 2741 tunnel->ip4 = iph->saddr; 2742 2743 memcpy(&key, &tunnel->key, sizeof(unsigned long long)); 2744 tunnel->amt = amt; 2745 spin_lock_init(&tunnel->lock); 2746 for (i = 0; i < amt->hash_buckets; i++) 2747 INIT_HLIST_HEAD(&tunnel->groups[i]); 2748 2749 INIT_DELAYED_WORK(&tunnel->gc_wq, amt_tunnel_expire); 2750 2751 list_add_tail_rcu(&tunnel->list, &amt->tunnel_list); 2752 tunnel->key = amt->key; 2753 __amt_update_relay_status(tunnel, AMT_STATUS_RECEIVED_REQUEST, true); 2754 amt->nr_tunnels++; 2755 mod_delayed_work(amt_wq, &tunnel->gc_wq, 2756 msecs_to_jiffies(amt_gmi(amt))); 2757 spin_unlock_bh(&amt->lock); 2758 2759 send: 2760 tunnel->nonce = amtrh->nonce; 2761 mac = siphash_3u32((__force u32)tunnel->ip4, 2762 (__force u32)tunnel->source_port, 2763 (__force u32)tunnel->nonce, 2764 &tunnel->key); 2765 tunnel->mac = mac >> 16; 2766 2767 if (!netif_running(amt->dev) || !netif_running(amt->stream_dev)) 2768 return true; 2769 2770 if (!amtrh->p) 2771 amt_send_igmp_gq(amt, tunnel); 2772 else 2773 amt_send_mld_gq(amt, tunnel); 2774 2775 return false; 2776 } 2777 2778 static void amt_gw_rcv(struct amt_dev *amt, struct sk_buff *skb) 2779 { 2780 int type = amt_parse_type(skb); 2781 int err = 1; 2782 2783 if (type == -1) 2784 goto drop; 2785 2786 if (amt->mode == AMT_MODE_GATEWAY) { 2787 switch (type) { 2788 case AMT_MSG_ADVERTISEMENT: 2789 err = amt_advertisement_handler(amt, skb); 2790 break; 2791 case AMT_MSG_MEMBERSHIP_QUERY: 2792 err = amt_membership_query_handler(amt, skb); 2793 if (!err) 2794 return; 2795 break; 2796 default: 2797 netdev_dbg(amt->dev, "Invalid type of Gateway\n"); 2798 break; 2799 } 2800 } 2801 drop: 2802 if (err) { 2803 amt->dev->stats.rx_dropped++; 2804 kfree_skb(skb); 2805 } else { 2806 consume_skb(skb); 2807 } 2808 } 2809 2810 static int amt_rcv(struct sock *sk, struct sk_buff *skb) 2811 { 2812 struct amt_dev *amt; 2813 __be32 remote_ip; 2814 __be32 saddr; 2815 int type; 2816 bool err; 2817 2818 rcu_read_lock_bh(); 2819 amt = rcu_dereference_sk_user_data(sk); 2820 if (!amt) { 2821 err = true; 2822 kfree_skb(skb); 2823 goto out; 2824 } 2825 remote_ip = READ_ONCE(amt->remote_ip); 2826 2827 skb->dev = amt->dev; 2828 saddr = ip_hdr(skb)->saddr; 2829 type = amt_parse_type(skb); 2830 if (type == -1) { 2831 err = true; 2832 goto drop; 2833 } 2834 2835 if (amt->mode == AMT_MODE_GATEWAY) { 2836 switch (type) { 2837 case AMT_MSG_ADVERTISEMENT: 2838 if (saddr != amt->discovery_ip) { 2839 netdev_dbg(amt->dev, "Invalid Relay IP\n"); 2840 err = true; 2841 goto drop; 2842 } 2843 if (amt_queue_event(amt, AMT_EVENT_RECEIVE, skb)) { 2844 netdev_dbg(amt->dev, "AMT Event queue full\n"); 2845 err = true; 2846 goto drop; 2847 } 2848 goto out; 2849 case AMT_MSG_MULTICAST_DATA: 2850 if (saddr != remote_ip) { 2851 netdev_dbg(amt->dev, "Invalid Relay IP\n"); 2852 err = true; 2853 goto drop; 2854 } 2855 err = amt_multicast_data_handler(amt, skb); 2856 if (err) 2857 goto drop; 2858 else 2859 goto out; 2860 case AMT_MSG_MEMBERSHIP_QUERY: 2861 if (saddr != remote_ip) { 2862 netdev_dbg(amt->dev, "Invalid Relay IP\n"); 2863 err = true; 2864 goto drop; 2865 } 2866 if (amt_queue_event(amt, AMT_EVENT_RECEIVE, skb)) { 2867 netdev_dbg(amt->dev, "AMT Event queue full\n"); 2868 err = true; 2869 goto drop; 2870 } 2871 goto out; 2872 default: 2873 err = true; 2874 netdev_dbg(amt->dev, "Invalid type of Gateway\n"); 2875 break; 2876 } 2877 } else { 2878 switch (type) { 2879 case AMT_MSG_DISCOVERY: 2880 err = amt_discovery_handler(amt, skb); 2881 break; 2882 case AMT_MSG_REQUEST: 2883 err = amt_request_handler(amt, skb); 2884 break; 2885 case AMT_MSG_MEMBERSHIP_UPDATE: 2886 err = amt_update_handler(amt, skb); 2887 if (err) 2888 goto drop; 2889 else 2890 goto out; 2891 default: 2892 err = true; 2893 netdev_dbg(amt->dev, "Invalid type of relay\n"); 2894 break; 2895 } 2896 } 2897 drop: 2898 if (err) { 2899 amt->dev->stats.rx_dropped++; 2900 kfree_skb(skb); 2901 } else { 2902 consume_skb(skb); 2903 } 2904 out: 2905 rcu_read_unlock_bh(); 2906 return 0; 2907 } 2908 2909 static void amt_event_work(struct work_struct *work) 2910 { 2911 struct amt_dev *amt = container_of(work, struct amt_dev, event_wq); 2912 struct sk_buff *skb; 2913 u8 event; 2914 int i; 2915 2916 for (i = 0; i < AMT_MAX_EVENTS; i++) { 2917 spin_lock_bh(&amt->lock); 2918 if (amt->nr_events == 0) { 2919 spin_unlock_bh(&amt->lock); 2920 return; 2921 } 2922 event = amt->events[amt->event_idx].event; 2923 skb = amt->events[amt->event_idx].skb; 2924 amt->events[amt->event_idx].event = AMT_EVENT_NONE; 2925 amt->events[amt->event_idx].skb = NULL; 2926 amt->nr_events--; 2927 amt->event_idx++; 2928 amt->event_idx %= AMT_MAX_EVENTS; 2929 spin_unlock_bh(&amt->lock); 2930 2931 switch (event) { 2932 case AMT_EVENT_RECEIVE: 2933 amt_gw_rcv(amt, skb); 2934 break; 2935 case AMT_EVENT_SEND_DISCOVERY: 2936 amt_event_send_discovery(amt); 2937 break; 2938 case AMT_EVENT_SEND_REQUEST: 2939 amt_event_send_request(amt); 2940 break; 2941 default: 2942 kfree_skb(skb); 2943 break; 2944 } 2945 } 2946 } 2947 2948 static int amt_err_lookup(struct sock *sk, struct sk_buff *skb) 2949 { 2950 struct amt_dev *amt; 2951 int type; 2952 2953 rcu_read_lock_bh(); 2954 amt = rcu_dereference_sk_user_data(sk); 2955 if (!amt) 2956 goto out; 2957 2958 if (amt->mode != AMT_MODE_GATEWAY) 2959 goto drop; 2960 2961 type = amt_parse_type(skb); 2962 if (type == -1) 2963 goto drop; 2964 2965 netdev_dbg(amt->dev, "Received IGMP Unreachable of %s\n", 2966 type_str[type]); 2967 switch (type) { 2968 case AMT_MSG_DISCOVERY: 2969 break; 2970 case AMT_MSG_REQUEST: 2971 case AMT_MSG_MEMBERSHIP_UPDATE: 2972 if (READ_ONCE(amt->status) >= AMT_STATUS_RECEIVED_ADVERTISEMENT) 2973 mod_delayed_work(amt_wq, &amt->req_wq, 0); 2974 break; 2975 default: 2976 goto drop; 2977 } 2978 out: 2979 rcu_read_unlock_bh(); 2980 return 0; 2981 drop: 2982 rcu_read_unlock_bh(); 2983 amt->dev->stats.rx_dropped++; 2984 return 0; 2985 } 2986 2987 static struct sock *amt_create_sock(struct net *net, __be16 port) 2988 { 2989 struct udp_port_cfg udp_conf; 2990 struct socket *sock; 2991 int err; 2992 2993 memset(&udp_conf, 0, sizeof(udp_conf)); 2994 udp_conf.family = AF_INET; 2995 udp_conf.local_ip.s_addr = htonl(INADDR_ANY); 2996 2997 udp_conf.local_udp_port = port; 2998 2999 err = udp_sock_create(net, &udp_conf, &sock); 3000 if (err < 0) 3001 return ERR_PTR(err); 3002 3003 return sock->sk; 3004 } 3005 3006 static int amt_socket_create(struct amt_dev *amt) 3007 { 3008 struct udp_tunnel_sock_cfg tunnel_cfg; 3009 struct sock *sk; 3010 3011 sk = amt_create_sock(amt->net, amt->relay_port); 3012 if (IS_ERR(sk)) 3013 return PTR_ERR(sk); 3014 3015 /* Mark socket as an encapsulation socket */ 3016 memset(&tunnel_cfg, 0, sizeof(tunnel_cfg)); 3017 tunnel_cfg.sk_user_data = amt; 3018 tunnel_cfg.encap_type = 1; 3019 tunnel_cfg.encap_rcv = amt_rcv; 3020 tunnel_cfg.encap_err_lookup = amt_err_lookup; 3021 tunnel_cfg.encap_destroy = NULL; 3022 setup_udp_tunnel_sock(amt->net, sk, &tunnel_cfg); 3023 3024 rcu_assign_pointer(amt->sk, sk); 3025 return 0; 3026 } 3027 3028 static int amt_dev_open(struct net_device *dev) 3029 { 3030 struct amt_dev *amt = netdev_priv(dev); 3031 int err; 3032 3033 amt->ready4 = false; 3034 amt->ready6 = false; 3035 amt->event_idx = 0; 3036 amt->nr_events = 0; 3037 3038 enable_delayed_work(&amt->discovery_wq); 3039 enable_delayed_work(&amt->req_wq); 3040 3041 err = amt_socket_create(amt); 3042 if (err) { 3043 disable_delayed_work(&amt->req_wq); 3044 disable_delayed_work(&amt->discovery_wq); 3045 return err; 3046 } 3047 3048 amt->req_cnt = 0; 3049 WRITE_ONCE(amt->remote_ip, 0); 3050 amt->nonce = 0; 3051 get_random_bytes(&amt->key, sizeof(siphash_key_t)); 3052 3053 amt->status = AMT_STATUS_INIT; 3054 if (amt->mode == AMT_MODE_GATEWAY) { 3055 mod_delayed_work(amt_wq, &amt->discovery_wq, 0); 3056 mod_delayed_work(amt_wq, &amt->req_wq, 0); 3057 } else if (amt->mode == AMT_MODE_RELAY) { 3058 mod_delayed_work(amt_wq, &amt->secret_wq, 3059 msecs_to_jiffies(AMT_SECRET_TIMEOUT)); 3060 } 3061 return err; 3062 } 3063 3064 static int amt_dev_stop(struct net_device *dev) 3065 { 3066 struct amt_dev *amt = netdev_priv(dev); 3067 struct amt_tunnel_list *tunnel, *tmp; 3068 struct sk_buff *skb; 3069 struct sock *sk; 3070 int i; 3071 3072 disable_delayed_work_sync(&amt->req_wq); 3073 disable_delayed_work_sync(&amt->discovery_wq); 3074 cancel_delayed_work_sync(&amt->secret_wq); 3075 3076 /* shutdown */ 3077 sk = rtnl_dereference(amt->sk); 3078 RCU_INIT_POINTER(amt->sk, NULL); 3079 synchronize_net(); 3080 if (sk) 3081 udp_tunnel_sock_release(sk); 3082 3083 cancel_work_sync(&amt->event_wq); 3084 for (i = 0; i < AMT_MAX_EVENTS; i++) { 3085 skb = amt->events[i].skb; 3086 kfree_skb(skb); 3087 amt->events[i].event = AMT_EVENT_NONE; 3088 amt->events[i].skb = NULL; 3089 } 3090 3091 amt->ready4 = false; 3092 amt->ready6 = false; 3093 amt->req_cnt = 0; 3094 WRITE_ONCE(amt->remote_ip, 0); 3095 3096 list_for_each_entry_safe(tunnel, tmp, &amt->tunnel_list, list) { 3097 list_del_rcu(&tunnel->list); 3098 amt->nr_tunnels--; 3099 cancel_delayed_work_sync(&tunnel->gc_wq); 3100 amt_clear_groups(tunnel); 3101 kfree_rcu(tunnel, rcu); 3102 } 3103 3104 return 0; 3105 } 3106 3107 static const struct device_type amt_type = { 3108 .name = "amt", 3109 }; 3110 3111 static int amt_dev_init(struct net_device *dev) 3112 { 3113 struct amt_dev *amt = netdev_priv(dev); 3114 int err; 3115 3116 amt->dev = dev; 3117 3118 err = gro_cells_init(&amt->gro_cells, dev); 3119 if (err) 3120 return err; 3121 3122 return 0; 3123 } 3124 3125 static void amt_dev_uninit(struct net_device *dev) 3126 { 3127 struct amt_dev *amt = netdev_priv(dev); 3128 3129 gro_cells_destroy(&amt->gro_cells); 3130 } 3131 3132 static const struct net_device_ops amt_netdev_ops = { 3133 .ndo_init = amt_dev_init, 3134 .ndo_uninit = amt_dev_uninit, 3135 .ndo_open = amt_dev_open, 3136 .ndo_stop = amt_dev_stop, 3137 .ndo_start_xmit = amt_dev_xmit, 3138 }; 3139 3140 static void amt_link_setup(struct net_device *dev) 3141 { 3142 dev->netdev_ops = &amt_netdev_ops; 3143 dev->needs_free_netdev = true; 3144 SET_NETDEV_DEVTYPE(dev, &amt_type); 3145 dev->min_mtu = ETH_MIN_MTU; 3146 dev->max_mtu = ETH_MAX_MTU; 3147 dev->type = ARPHRD_NONE; 3148 dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST; 3149 dev->hard_header_len = 0; 3150 dev->addr_len = 0; 3151 dev->priv_flags |= IFF_NO_QUEUE; 3152 dev->lltx = true; 3153 dev->netns_immutable = true; 3154 dev->features |= NETIF_F_GSO_SOFTWARE; 3155 dev->hw_features |= NETIF_F_SG | NETIF_F_HW_CSUM; 3156 dev->hw_features |= NETIF_F_FRAGLIST | NETIF_F_RXCSUM; 3157 dev->hw_features |= NETIF_F_GSO_SOFTWARE; 3158 dev->pcpu_stat_type = NETDEV_PCPU_STAT_TSTATS; 3159 eth_hw_addr_random(dev); 3160 eth_zero_addr(dev->broadcast); 3161 ether_setup(dev); 3162 } 3163 3164 static const struct nla_policy amt_policy[IFLA_AMT_MAX + 1] = { 3165 [IFLA_AMT_MODE] = { .type = NLA_U32 }, 3166 [IFLA_AMT_RELAY_PORT] = { .type = NLA_U16 }, 3167 [IFLA_AMT_GATEWAY_PORT] = { .type = NLA_U16 }, 3168 [IFLA_AMT_LINK] = { .type = NLA_U32 }, 3169 [IFLA_AMT_LOCAL_IP] = { .len = sizeof_field(struct iphdr, daddr) }, 3170 [IFLA_AMT_REMOTE_IP] = { .len = sizeof_field(struct iphdr, daddr) }, 3171 [IFLA_AMT_DISCOVERY_IP] = { .len = sizeof_field(struct iphdr, daddr) }, 3172 [IFLA_AMT_MAX_TUNNELS] = { .type = NLA_U32 }, 3173 }; 3174 3175 static int amt_validate(struct nlattr *tb[], struct nlattr *data[], 3176 struct netlink_ext_ack *extack) 3177 { 3178 if (!data) 3179 return -EINVAL; 3180 3181 if (!data[IFLA_AMT_LINK]) { 3182 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_AMT_LINK], 3183 "Link attribute is required"); 3184 return -EINVAL; 3185 } 3186 3187 if (!data[IFLA_AMT_MODE]) { 3188 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_AMT_MODE], 3189 "Mode attribute is required"); 3190 return -EINVAL; 3191 } 3192 3193 if (nla_get_u32(data[IFLA_AMT_MODE]) > AMT_MODE_MAX) { 3194 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_AMT_MODE], 3195 "Mode attribute is not valid"); 3196 return -EINVAL; 3197 } 3198 3199 if (!data[IFLA_AMT_LOCAL_IP]) { 3200 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_AMT_DISCOVERY_IP], 3201 "Local attribute is required"); 3202 return -EINVAL; 3203 } 3204 3205 if (!data[IFLA_AMT_DISCOVERY_IP] && 3206 nla_get_u32(data[IFLA_AMT_MODE]) == AMT_MODE_GATEWAY) { 3207 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_AMT_LOCAL_IP], 3208 "Discovery attribute is required"); 3209 return -EINVAL; 3210 } 3211 3212 return 0; 3213 } 3214 3215 static int amt_newlink(struct net_device *dev, 3216 struct rtnl_newlink_params *params, 3217 struct netlink_ext_ack *extack) 3218 { 3219 struct net *link_net = rtnl_newlink_link_net(params); 3220 struct amt_dev *amt = netdev_priv(dev); 3221 struct nlattr **data = params->data; 3222 struct nlattr **tb = params->tb; 3223 int err = -EINVAL; 3224 3225 if (!net_eq(link_net, dev_net(dev))) 3226 return err; 3227 3228 amt->net = link_net; 3229 amt->mode = nla_get_u32(data[IFLA_AMT_MODE]); 3230 3231 if (data[IFLA_AMT_MAX_TUNNELS] && 3232 nla_get_u32(data[IFLA_AMT_MAX_TUNNELS])) 3233 amt->max_tunnels = nla_get_u32(data[IFLA_AMT_MAX_TUNNELS]); 3234 else 3235 amt->max_tunnels = AMT_MAX_TUNNELS; 3236 3237 spin_lock_init(&amt->lock); 3238 amt->max_groups = AMT_MAX_GROUP; 3239 amt->max_sources = AMT_MAX_SOURCE; 3240 amt->hash_buckets = AMT_HSIZE; 3241 amt->nr_tunnels = 0; 3242 get_random_bytes(&amt->hash_seed, sizeof(amt->hash_seed)); 3243 amt->stream_dev = dev_get_by_index(link_net, 3244 nla_get_u32(data[IFLA_AMT_LINK])); 3245 if (!amt->stream_dev) { 3246 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_AMT_LINK], 3247 "Can't find stream device"); 3248 return -ENODEV; 3249 } 3250 3251 if (amt->stream_dev->type != ARPHRD_ETHER) { 3252 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_AMT_LINK], 3253 "Invalid stream device type"); 3254 goto err; 3255 } 3256 3257 amt->local_ip = nla_get_in_addr(data[IFLA_AMT_LOCAL_IP]); 3258 if (ipv4_is_loopback(amt->local_ip) || 3259 ipv4_is_zeronet(amt->local_ip) || 3260 ipv4_is_multicast(amt->local_ip)) { 3261 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_AMT_LOCAL_IP], 3262 "Invalid Local address"); 3263 goto err; 3264 } 3265 3266 amt->relay_port = nla_get_be16_default(data[IFLA_AMT_RELAY_PORT], 3267 htons(IANA_AMT_UDP_PORT)); 3268 3269 amt->gw_port = nla_get_be16_default(data[IFLA_AMT_GATEWAY_PORT], 3270 htons(IANA_AMT_UDP_PORT)); 3271 3272 if (!amt->relay_port) { 3273 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_AMT_DISCOVERY_IP], 3274 "relay port must not be 0"); 3275 goto err; 3276 } 3277 if (amt->mode == AMT_MODE_RELAY) { 3278 amt->qrv = READ_ONCE(amt->net->ipv4.sysctl_igmp_qrv); 3279 amt->qri = 10; 3280 dev->needed_headroom = amt->stream_dev->needed_headroom + 3281 AMT_RELAY_HLEN; 3282 dev->mtu = amt->stream_dev->mtu - AMT_RELAY_HLEN; 3283 dev->max_mtu = dev->mtu; 3284 dev->min_mtu = ETH_MIN_MTU + AMT_RELAY_HLEN; 3285 } else { 3286 if (!data[IFLA_AMT_DISCOVERY_IP]) { 3287 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_AMT_DISCOVERY_IP], 3288 "discovery must be set in gateway mode"); 3289 goto err; 3290 } 3291 if (!amt->gw_port) { 3292 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_AMT_DISCOVERY_IP], 3293 "gateway port must not be 0"); 3294 goto err; 3295 } 3296 WRITE_ONCE(amt->remote_ip, 0); 3297 amt->discovery_ip = nla_get_in_addr(data[IFLA_AMT_DISCOVERY_IP]); 3298 if (ipv4_is_loopback(amt->discovery_ip) || 3299 ipv4_is_zeronet(amt->discovery_ip) || 3300 ipv4_is_multicast(amt->discovery_ip)) { 3301 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_AMT_DISCOVERY_IP], 3302 "discovery must be unicast"); 3303 goto err; 3304 } 3305 3306 dev->needed_headroom = amt->stream_dev->needed_headroom + 3307 AMT_GW_HLEN; 3308 dev->mtu = amt->stream_dev->mtu - AMT_GW_HLEN; 3309 dev->max_mtu = dev->mtu; 3310 dev->min_mtu = ETH_MIN_MTU + AMT_GW_HLEN; 3311 } 3312 amt->qi = AMT_INIT_QUERY_INTERVAL; 3313 3314 err = register_netdevice(dev); 3315 if (err < 0) { 3316 netdev_dbg(dev, "failed to register new netdev %d\n", err); 3317 goto err; 3318 } 3319 3320 err = netdev_upper_dev_link(amt->stream_dev, dev, extack); 3321 if (err < 0) { 3322 unregister_netdevice(dev); 3323 goto err; 3324 } 3325 3326 INIT_DELAYED_WORK(&amt->discovery_wq, amt_discovery_work); 3327 INIT_DELAYED_WORK(&amt->req_wq, amt_req_work); 3328 INIT_DELAYED_WORK(&amt->secret_wq, amt_secret_work); 3329 INIT_WORK(&amt->event_wq, amt_event_work); 3330 disable_delayed_work(&amt->req_wq); 3331 disable_delayed_work(&amt->discovery_wq); 3332 INIT_LIST_HEAD(&amt->tunnel_list); 3333 return 0; 3334 err: 3335 dev_put(amt->stream_dev); 3336 return err; 3337 } 3338 3339 static void amt_dellink(struct net_device *dev, struct list_head *head) 3340 { 3341 struct amt_dev *amt = netdev_priv(dev); 3342 3343 unregister_netdevice_queue(dev, head); 3344 netdev_upper_dev_unlink(amt->stream_dev, dev); 3345 dev_put(amt->stream_dev); 3346 } 3347 3348 static size_t amt_get_size(const struct net_device *dev) 3349 { 3350 return nla_total_size(sizeof(__u32)) + /* IFLA_AMT_MODE */ 3351 nla_total_size(sizeof(__u16)) + /* IFLA_AMT_RELAY_PORT */ 3352 nla_total_size(sizeof(__u16)) + /* IFLA_AMT_GATEWAY_PORT */ 3353 nla_total_size(sizeof(__u32)) + /* IFLA_AMT_LINK */ 3354 nla_total_size(sizeof(__u32)) + /* IFLA_MAX_TUNNELS */ 3355 nla_total_size(sizeof(__be32)) + /* IFLA_AMT_DISCOVERY_IP */ 3356 nla_total_size(sizeof(__be32)) + /* IFLA_AMT_REMOTE_IP */ 3357 nla_total_size(sizeof(__be32)); /* IFLA_AMT_LOCAL_IP */ 3358 } 3359 3360 static int amt_fill_info(struct sk_buff *skb, const struct net_device *dev) 3361 { 3362 const struct amt_dev *amt = netdev_priv(dev); 3363 __be32 remote_ip; 3364 3365 rcu_read_lock(); 3366 if (nla_put_u32(skb, IFLA_AMT_MODE, amt->mode)) 3367 goto nla_put_failure; 3368 if (nla_put_be16(skb, IFLA_AMT_RELAY_PORT, amt->relay_port)) 3369 goto nla_put_failure; 3370 if (nla_put_be16(skb, IFLA_AMT_GATEWAY_PORT, amt->gw_port)) 3371 goto nla_put_failure; 3372 if (nla_put_u32(skb, IFLA_AMT_LINK, amt->stream_dev->ifindex)) 3373 goto nla_put_failure; 3374 if (nla_put_in_addr(skb, IFLA_AMT_LOCAL_IP, amt->local_ip)) 3375 goto nla_put_failure; 3376 if (nla_put_in_addr(skb, IFLA_AMT_DISCOVERY_IP, amt->discovery_ip)) 3377 goto nla_put_failure; 3378 3379 remote_ip = READ_ONCE(amt->remote_ip); 3380 if (remote_ip) 3381 if (nla_put_in_addr(skb, IFLA_AMT_REMOTE_IP, remote_ip)) 3382 goto nla_put_failure; 3383 if (nla_put_u32(skb, IFLA_AMT_MAX_TUNNELS, amt->max_tunnels)) 3384 goto nla_put_failure; 3385 3386 rcu_read_unlock(); 3387 return 0; 3388 3389 nla_put_failure: 3390 rcu_read_unlock(); 3391 return -EMSGSIZE; 3392 } 3393 3394 static struct rtnl_link_ops amt_link_ops __read_mostly = { 3395 .kind = "amt", 3396 .maxtype = IFLA_AMT_MAX, 3397 .policy = amt_policy, 3398 .priv_size = sizeof(struct amt_dev), 3399 .setup = amt_link_setup, 3400 .validate = amt_validate, 3401 .newlink = amt_newlink, 3402 .dellink = amt_dellink, 3403 .get_size = amt_get_size, 3404 .fill_info = amt_fill_info, 3405 }; 3406 3407 static struct net_device *amt_lookup_upper_dev(struct net_device *dev) 3408 { 3409 struct net_device *upper_dev; 3410 struct amt_dev *amt; 3411 3412 for_each_netdev(dev_net(dev), upper_dev) { 3413 if (netif_is_amt(upper_dev)) { 3414 amt = netdev_priv(upper_dev); 3415 if (amt->stream_dev == dev) 3416 return upper_dev; 3417 } 3418 } 3419 3420 return NULL; 3421 } 3422 3423 static int amt_device_event(struct notifier_block *unused, 3424 unsigned long event, void *ptr) 3425 { 3426 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 3427 struct net_device *upper_dev; 3428 struct amt_dev *amt; 3429 LIST_HEAD(list); 3430 int new_mtu; 3431 3432 upper_dev = amt_lookup_upper_dev(dev); 3433 if (!upper_dev) 3434 return NOTIFY_DONE; 3435 amt = netdev_priv(upper_dev); 3436 3437 switch (event) { 3438 case NETDEV_UNREGISTER: 3439 amt_dellink(amt->dev, &list); 3440 unregister_netdevice_many(&list); 3441 break; 3442 case NETDEV_CHANGEMTU: 3443 if (amt->mode == AMT_MODE_RELAY) 3444 new_mtu = dev->mtu - AMT_RELAY_HLEN; 3445 else 3446 new_mtu = dev->mtu - AMT_GW_HLEN; 3447 3448 dev_set_mtu(amt->dev, new_mtu); 3449 break; 3450 } 3451 3452 return NOTIFY_DONE; 3453 } 3454 3455 static struct notifier_block amt_notifier_block __read_mostly = { 3456 .notifier_call = amt_device_event, 3457 }; 3458 3459 static int __init amt_init(void) 3460 { 3461 int err; 3462 3463 err = register_netdevice_notifier(&amt_notifier_block); 3464 if (err < 0) 3465 goto err; 3466 3467 err = rtnl_link_register(&amt_link_ops); 3468 if (err < 0) 3469 goto unregister_notifier; 3470 3471 amt_wq = alloc_workqueue("amt", WQ_UNBOUND, 0); 3472 if (!amt_wq) { 3473 err = -ENOMEM; 3474 goto rtnl_unregister; 3475 } 3476 3477 spin_lock_init(&source_gc_lock); 3478 spin_lock_bh(&source_gc_lock); 3479 INIT_DELAYED_WORK(&source_gc_wq, amt_source_gc_work); 3480 mod_delayed_work(amt_wq, &source_gc_wq, 3481 msecs_to_jiffies(AMT_GC_INTERVAL)); 3482 spin_unlock_bh(&source_gc_lock); 3483 3484 return 0; 3485 3486 rtnl_unregister: 3487 rtnl_link_unregister(&amt_link_ops); 3488 unregister_notifier: 3489 unregister_netdevice_notifier(&amt_notifier_block); 3490 err: 3491 pr_err("error loading AMT module loaded\n"); 3492 return err; 3493 } 3494 late_initcall(amt_init); 3495 3496 static void __exit amt_fini(void) 3497 { 3498 rtnl_link_unregister(&amt_link_ops); 3499 unregister_netdevice_notifier(&amt_notifier_block); 3500 cancel_delayed_work_sync(&source_gc_wq); 3501 __amt_source_gc_work(); 3502 destroy_workqueue(amt_wq); 3503 } 3504 module_exit(amt_fini); 3505 3506 MODULE_LICENSE("GPL"); 3507 MODULE_DESCRIPTION("Driver for Automatic Multicast Tunneling (AMT)"); 3508 MODULE_AUTHOR("Taehee Yoo <ap420073@gmail.com>"); 3509 MODULE_ALIAS_RTNL_LINK("amt"); 3510