1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Linux IPv6 multicast routing support for BSD pim6sd 4 * Based on net/ipv4/ipmr.c. 5 * 6 * (c) 2004 Mickael Hoerdt, <hoerdt@clarinet.u-strasbg.fr> 7 * LSIIT Laboratory, Strasbourg, France 8 * (c) 2004 Jean-Philippe Andriot, <jean-philippe.andriot@6WIND.com> 9 * 6WIND, Paris, France 10 * Copyright (C)2007,2008 USAGI/WIDE Project 11 * YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> 12 */ 13 14 #include <linux/uaccess.h> 15 #include <linux/types.h> 16 #include <linux/sched.h> 17 #include <linux/errno.h> 18 #include <linux/mm.h> 19 #include <linux/kernel.h> 20 #include <linux/fcntl.h> 21 #include <linux/stat.h> 22 #include <linux/socket.h> 23 #include <linux/inet.h> 24 #include <linux/netdevice.h> 25 #include <linux/inetdevice.h> 26 #include <linux/proc_fs.h> 27 #include <linux/seq_file.h> 28 #include <linux/init.h> 29 #include <linux/compat.h> 30 #include <linux/rhashtable.h> 31 #include <net/protocol.h> 32 #include <linux/skbuff.h> 33 #include <net/raw.h> 34 #include <linux/notifier.h> 35 #include <linux/if_arp.h> 36 #include <net/checksum.h> 37 #include <net/netlink.h> 38 #include <net/fib_rules.h> 39 40 #include <net/ipv6.h> 41 #include <net/ip6_route.h> 42 #include <linux/mroute6.h> 43 #include <linux/pim.h> 44 #include <net/addrconf.h> 45 #include <linux/netfilter_ipv6.h> 46 #include <linux/export.h> 47 #include <net/ip6_checksum.h> 48 #include <linux/netconf.h> 49 #include <net/ip_tunnels.h> 50 51 #include <linux/nospec.h> 52 53 struct ip6mr_rule { 54 struct fib_rule common; 55 }; 56 57 struct ip6mr_result { 58 struct mr_table *mrt; 59 }; 60 61 /* Big lock, protecting vif table, mrt cache and mroute socket state. 62 Note that the changes are semaphored via rtnl_lock. 63 */ 64 65 static DEFINE_SPINLOCK(mrt_lock); 66 67 static struct net_device *vif_dev_read(const struct vif_device *vif) 68 { 69 return rcu_dereference(vif->dev); 70 } 71 72 /* Multicast router control variables */ 73 74 /* Special spinlock for queue of unresolved entries */ 75 static DEFINE_SPINLOCK(mfc_unres_lock); 76 77 /* We return to original Alan's scheme. Hash table of resolved 78 entries is changed only in process context and protected 79 with weak lock mrt_lock. Queue of unresolved entries is protected 80 with strong spinlock mfc_unres_lock. 81 82 In this case data path is free of exclusive locks at all. 83 */ 84 85 static struct kmem_cache *mrt_cachep __read_mostly; 86 87 static struct mr_table *ip6mr_new_table(struct net *net, u32 id); 88 static void ip6mr_free_table(struct mr_table *mrt, 89 struct list_head *dev_kill_list); 90 91 static void ip6_mr_forward(struct net *net, struct mr_table *mrt, 92 struct net_device *dev, struct sk_buff *skb, 93 struct mfc6_cache *cache); 94 static int ip6mr_cache_report(const struct mr_table *mrt, struct sk_buff *pkt, 95 mifi_t mifi, int assert); 96 static void mr6_netlink_event(struct mr_table *mrt, struct mfc6_cache *mfc, 97 int cmd); 98 static void mrt6msg_netlink_event(const struct mr_table *mrt, struct sk_buff *pkt); 99 static int ip6mr_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, 100 struct netlink_ext_ack *extack); 101 static int ip6mr_rtm_dumproute(struct sk_buff *skb, 102 struct netlink_callback *cb); 103 static void mroute_clean_tables(struct mr_table *mrt, int flags, 104 struct list_head *dev_kill_list); 105 static void ipmr_expire_process(struct timer_list *t); 106 107 #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES 108 #define ip6mr_for_each_table(mrt, net) \ 109 list_for_each_entry_rcu(mrt, &net->ipv6.mr6_tables, list, \ 110 lockdep_rtnl_is_held() || \ 111 list_empty(&net->ipv6.mr6_tables)) 112 113 static struct mr_table *ip6mr_mr_table_iter(struct net *net, 114 struct mr_table *mrt) 115 { 116 struct mr_table *ret; 117 118 if (!mrt) 119 ret = list_entry_rcu(net->ipv6.mr6_tables.next, 120 struct mr_table, list); 121 else 122 ret = list_entry_rcu(mrt->list.next, 123 struct mr_table, list); 124 125 if (&ret->list == &net->ipv6.mr6_tables) 126 return NULL; 127 return ret; 128 } 129 130 static struct mr_table *__ip6mr_get_table(struct net *net, u32 id) 131 { 132 struct mr_table *mrt; 133 134 ip6mr_for_each_table(mrt, net) { 135 if (mrt->id == id) 136 return mrt; 137 } 138 return NULL; 139 } 140 141 static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6, 142 struct mr_table **mrt) 143 { 144 int err; 145 struct ip6mr_result res; 146 struct fib_lookup_arg arg = { 147 .result = &res, 148 .flags = FIB_LOOKUP_NOREF, 149 }; 150 151 /* update flow if oif or iif point to device enslaved to l3mdev */ 152 l3mdev_update_flow(net, flowi6_to_flowi(flp6)); 153 154 err = fib_rules_lookup(net->ipv6.mr6_rules_ops, 155 flowi6_to_flowi(flp6), 0, &arg); 156 if (err < 0) 157 return err; 158 *mrt = res.mrt; 159 return 0; 160 } 161 162 static int ip6mr_rule_action(struct fib_rule *rule, struct flowi *flp, 163 int flags, struct fib_lookup_arg *arg) 164 { 165 struct ip6mr_result *res = arg->result; 166 struct mr_table *mrt; 167 168 switch (rule->action) { 169 case FR_ACT_TO_TBL: 170 break; 171 case FR_ACT_UNREACHABLE: 172 return -ENETUNREACH; 173 case FR_ACT_PROHIBIT: 174 return -EACCES; 175 case FR_ACT_BLACKHOLE: 176 default: 177 return -EINVAL; 178 } 179 180 arg->table = fib_rule_get_table(rule, arg); 181 182 mrt = __ip6mr_get_table(rule->fr_net, arg->table); 183 if (!mrt) 184 return -EAGAIN; 185 res->mrt = mrt; 186 return 0; 187 } 188 189 static int ip6mr_rule_match(struct fib_rule *rule, struct flowi *flp, int flags) 190 { 191 return 1; 192 } 193 194 static int ip6mr_rule_configure(struct fib_rule *rule, struct sk_buff *skb, 195 struct fib_rule_hdr *frh, struct nlattr **tb, 196 struct netlink_ext_ack *extack) 197 { 198 return 0; 199 } 200 201 static int ip6mr_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh, 202 struct nlattr **tb) 203 { 204 return 1; 205 } 206 207 static int ip6mr_rule_fill(struct fib_rule *rule, struct sk_buff *skb, 208 struct fib_rule_hdr *frh) 209 { 210 frh->dst_len = 0; 211 frh->src_len = 0; 212 frh->tos = 0; 213 return 0; 214 } 215 216 static const struct fib_rules_ops __net_initconst ip6mr_rules_ops_template = { 217 .family = RTNL_FAMILY_IP6MR, 218 .rule_size = sizeof(struct ip6mr_rule), 219 .addr_size = sizeof(struct in6_addr), 220 .action = ip6mr_rule_action, 221 .match = ip6mr_rule_match, 222 .configure = ip6mr_rule_configure, 223 .compare = ip6mr_rule_compare, 224 .fill = ip6mr_rule_fill, 225 .nlgroup = RTNLGRP_IPV6_RULE, 226 .owner = THIS_MODULE, 227 }; 228 229 static int __net_init ip6mr_rules_init(struct net *net) 230 { 231 struct fib_rules_ops *ops; 232 LIST_HEAD(dev_kill_list); 233 struct mr_table *mrt; 234 int err; 235 236 ops = fib_rules_register(&ip6mr_rules_ops_template, net); 237 if (IS_ERR(ops)) 238 return PTR_ERR(ops); 239 240 INIT_LIST_HEAD(&net->ipv6.mr6_tables); 241 242 mrt = ip6mr_new_table(net, RT6_TABLE_DFLT); 243 if (IS_ERR(mrt)) { 244 err = PTR_ERR(mrt); 245 goto err1; 246 } 247 248 err = fib_default_rule_add(ops, 0x7fff, RT6_TABLE_DFLT); 249 if (err < 0) 250 goto err2; 251 252 net->ipv6.mr6_rules_ops = ops; 253 return 0; 254 255 err2: 256 ip6mr_free_table(mrt, &dev_kill_list); 257 err1: 258 fib_rules_unregister(ops); 259 return err; 260 } 261 262 static void __net_exit ip6mr_rules_exit(struct net *net) 263 { 264 fib_rules_unregister(net->ipv6.mr6_rules_ops); 265 } 266 267 static void __net_exit ip6mr_rules_exit_rtnl(struct net *net, 268 struct list_head *dev_kill_list) 269 { 270 struct mr_table *mrt, *next; 271 272 list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) { 273 list_del_rcu(&mrt->list); 274 ip6mr_free_table(mrt, dev_kill_list); 275 } 276 } 277 278 static int ip6mr_rules_dump(struct net *net, struct notifier_block *nb, 279 struct netlink_ext_ack *extack) 280 { 281 return fib_rules_dump(net, nb, RTNL_FAMILY_IP6MR, extack); 282 } 283 284 static unsigned int ip6mr_rules_seq_read(const struct net *net) 285 { 286 return fib_rules_seq_read(net, RTNL_FAMILY_IP6MR); 287 } 288 289 bool ip6mr_rule_default(const struct fib_rule *rule) 290 { 291 return fib_rule_matchall(rule) && rule->action == FR_ACT_TO_TBL && 292 rule->table == RT6_TABLE_DFLT && !rule->l3mdev; 293 } 294 EXPORT_SYMBOL(ip6mr_rule_default); 295 #else 296 static struct mr_table *ip6mr_mr_table_iter(struct net *net, 297 struct mr_table *mrt) 298 { 299 if (!mrt) 300 return rcu_dereference(net->ipv6.mrt6); 301 return NULL; 302 } 303 304 static struct mr_table *__ip6mr_get_table(struct net *net, u32 id) 305 { 306 return rcu_dereference_check(net->ipv6.mrt6, 307 lockdep_rtnl_is_held() || 308 !rcu_access_pointer(net->ipv6.mrt6)); 309 } 310 311 #define ip6mr_for_each_table(mrt, net) \ 312 for (mrt = __ip6mr_get_table(net, 0); mrt; mrt = NULL) 313 314 static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6, 315 struct mr_table **mrt) 316 { 317 *mrt = rcu_dereference(net->ipv6.mrt6); 318 if (!*mrt) 319 return -EAGAIN; 320 return 0; 321 } 322 323 static int __net_init ip6mr_rules_init(struct net *net) 324 { 325 struct mr_table *mrt; 326 327 mrt = ip6mr_new_table(net, RT6_TABLE_DFLT); 328 if (IS_ERR(mrt)) 329 return PTR_ERR(mrt); 330 331 rcu_assign_pointer(net->ipv6.mrt6, mrt); 332 return 0; 333 } 334 335 static void __net_exit ip6mr_rules_exit(struct net *net) 336 { 337 } 338 339 static void __net_exit ip6mr_rules_exit_rtnl(struct net *net, 340 struct list_head *dev_kill_list) 341 { 342 struct mr_table *mrt = rcu_dereference_protected(net->ipv6.mrt6, 1); 343 344 RCU_INIT_POINTER(net->ipv6.mrt6, NULL); 345 ip6mr_free_table(mrt, dev_kill_list); 346 } 347 348 static int ip6mr_rules_dump(struct net *net, struct notifier_block *nb, 349 struct netlink_ext_ack *extack) 350 { 351 return 0; 352 } 353 354 static unsigned int ip6mr_rules_seq_read(const struct net *net) 355 { 356 return 0; 357 } 358 #endif 359 360 static struct mr_table *ip6mr_get_table(struct net *net, u32 id) 361 { 362 struct mr_table *mrt; 363 364 rcu_read_lock(); 365 mrt = __ip6mr_get_table(net, id); 366 rcu_read_unlock(); 367 368 return mrt; 369 } 370 371 static int ip6mr_hash_cmp(struct rhashtable_compare_arg *arg, 372 const void *ptr) 373 { 374 const struct mfc6_cache_cmp_arg *cmparg = arg->key; 375 struct mfc6_cache *c = (struct mfc6_cache *)ptr; 376 377 return !ipv6_addr_equal(&c->mf6c_mcastgrp, &cmparg->mf6c_mcastgrp) || 378 !ipv6_addr_equal(&c->mf6c_origin, &cmparg->mf6c_origin); 379 } 380 381 static const struct rhashtable_params ip6mr_rht_params = { 382 .head_offset = offsetof(struct mr_mfc, mnode), 383 .key_offset = offsetof(struct mfc6_cache, cmparg), 384 .key_len = sizeof(struct mfc6_cache_cmp_arg), 385 .nelem_hint = 3, 386 .obj_cmpfn = ip6mr_hash_cmp, 387 .automatic_shrinking = true, 388 }; 389 390 static void ip6mr_new_table_set(struct mr_table *mrt, 391 struct net *net) 392 { 393 #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES 394 list_add_tail_rcu(&mrt->list, &net->ipv6.mr6_tables); 395 #endif 396 } 397 398 static struct mfc6_cache_cmp_arg ip6mr_mr_table_ops_cmparg_any = { 399 .mf6c_origin = IN6ADDR_ANY_INIT, 400 .mf6c_mcastgrp = IN6ADDR_ANY_INIT, 401 }; 402 403 static struct mr_table_ops ip6mr_mr_table_ops = { 404 .rht_params = &ip6mr_rht_params, 405 .cmparg_any = &ip6mr_mr_table_ops_cmparg_any, 406 }; 407 408 static struct mr_table *ip6mr_new_table(struct net *net, u32 id) 409 { 410 struct mr_table *mrt; 411 412 mrt = __ip6mr_get_table(net, id); 413 if (mrt) 414 return mrt; 415 416 return mr_table_alloc(net, id, &ip6mr_mr_table_ops, 417 ipmr_expire_process, ip6mr_new_table_set); 418 } 419 420 static void ip6mr_free_table(struct mr_table *mrt, 421 struct list_head *dev_kill_list) 422 { 423 struct net *net = read_pnet(&mrt->net); 424 LIST_HEAD(ip6mr_dev_kill_list); 425 426 WARN_ON_ONCE(!mr_can_free_table(net)); 427 428 timer_shutdown_sync(&mrt->ipmr_expire_timer); 429 mroute_clean_tables(mrt, MRT6_FLUSH_MIFS | MRT6_FLUSH_MIFS_STATIC | 430 MRT6_FLUSH_MFC | MRT6_FLUSH_MFC_STATIC, 431 &ip6mr_dev_kill_list); 432 433 mr_table_free(mrt); 434 435 WARN_ON_ONCE(!net_initialized(net) && !list_empty(&ip6mr_dev_kill_list)); 436 list_splice(&ip6mr_dev_kill_list, dev_kill_list); 437 } 438 439 #ifdef CONFIG_PROC_FS 440 /* The /proc interfaces to multicast routing 441 * /proc/ip6_mr_cache /proc/ip6_mr_vif 442 */ 443 444 static void *ip6mr_vif_seq_start(struct seq_file *seq, loff_t *pos) 445 __acquires(RCU) 446 { 447 struct mr_vif_iter *iter = seq->private; 448 struct net *net = seq_file_net(seq); 449 struct mr_table *mrt; 450 451 rcu_read_lock(); 452 mrt = __ip6mr_get_table(net, RT6_TABLE_DFLT); 453 if (!mrt) { 454 rcu_read_unlock(); 455 return ERR_PTR(-ENOENT); 456 } 457 458 iter->mrt = mrt; 459 460 return mr_vif_seq_start(seq, pos); 461 } 462 463 static void ip6mr_vif_seq_stop(struct seq_file *seq, void *v) 464 __releases(RCU) 465 { 466 rcu_read_unlock(); 467 } 468 469 static int ip6mr_vif_seq_show(struct seq_file *seq, void *v) 470 { 471 struct mr_vif_iter *iter = seq->private; 472 struct mr_table *mrt = iter->mrt; 473 474 if (v == SEQ_START_TOKEN) { 475 seq_puts(seq, 476 "Interface BytesIn PktsIn BytesOut PktsOut Flags\n"); 477 } else { 478 const struct vif_device *vif = v; 479 const struct net_device *vif_dev; 480 const char *name; 481 482 vif_dev = vif_dev_read(vif); 483 name = vif_dev ? vif_dev->name : "none"; 484 485 seq_printf(seq, 486 "%2td %-10s %8ld %7ld %8ld %7ld %05X\n", 487 vif - mrt->vif_table, 488 name, vif->bytes_in, vif->pkt_in, 489 vif->bytes_out, vif->pkt_out, 490 vif->flags); 491 } 492 return 0; 493 } 494 495 static const struct seq_operations ip6mr_vif_seq_ops = { 496 .start = ip6mr_vif_seq_start, 497 .next = mr_vif_seq_next, 498 .stop = ip6mr_vif_seq_stop, 499 .show = ip6mr_vif_seq_show, 500 }; 501 502 static void *ipmr_mfc_seq_start(struct seq_file *seq, loff_t *pos) 503 { 504 struct net *net = seq_file_net(seq); 505 struct mr_table *mrt; 506 507 mrt = ip6mr_get_table(net, RT6_TABLE_DFLT); 508 if (!mrt) 509 return ERR_PTR(-ENOENT); 510 511 return mr_mfc_seq_start(seq, pos, mrt, &mfc_unres_lock); 512 } 513 514 static int ipmr_mfc_seq_show(struct seq_file *seq, void *v) 515 { 516 int n; 517 518 if (v == SEQ_START_TOKEN) { 519 seq_puts(seq, 520 "Group " 521 "Origin " 522 "Iif Pkts Bytes Wrong Oifs\n"); 523 } else { 524 const struct mfc6_cache *mfc = v; 525 const struct mr_mfc_iter *it = seq->private; 526 struct mr_table *mrt = it->mrt; 527 528 seq_printf(seq, "%pI6 %pI6 %-3hd", 529 &mfc->mf6c_mcastgrp, &mfc->mf6c_origin, 530 mfc->_c.mfc_parent); 531 532 if (it->cache != &mrt->mfc_unres_queue) { 533 seq_printf(seq, " %8lu %8lu %8lu", 534 atomic_long_read(&mfc->_c.mfc_un.res.pkt), 535 atomic_long_read(&mfc->_c.mfc_un.res.bytes), 536 atomic_long_read(&mfc->_c.mfc_un.res.wrong_if)); 537 for (n = mfc->_c.mfc_un.res.minvif; 538 n < mfc->_c.mfc_un.res.maxvif; n++) { 539 if (VIF_EXISTS(mrt, n) && 540 mfc->_c.mfc_un.res.ttls[n] < 255) 541 seq_printf(seq, 542 " %2d:%-3d", n, 543 mfc->_c.mfc_un.res.ttls[n]); 544 } 545 } else { 546 /* unresolved mfc_caches don't contain 547 * pkt, bytes and wrong_if values 548 */ 549 seq_printf(seq, " %8lu %8lu %8lu", 0ul, 0ul, 0ul); 550 } 551 seq_putc(seq, '\n'); 552 } 553 return 0; 554 } 555 556 static const struct seq_operations ipmr_mfc_seq_ops = { 557 .start = ipmr_mfc_seq_start, 558 .next = mr_mfc_seq_next, 559 .stop = mr_mfc_seq_stop, 560 .show = ipmr_mfc_seq_show, 561 }; 562 #endif 563 564 #ifdef CONFIG_IPV6_PIMSM_V2 565 566 static int pim6_rcv(struct sk_buff *skb) 567 { 568 struct pimreghdr *pim; 569 struct ipv6hdr *encap; 570 struct net_device *reg_dev = NULL; 571 struct net *net = dev_net(skb->dev); 572 struct mr_table *mrt; 573 struct flowi6 fl6 = { 574 .flowi6_iif = skb->dev->ifindex, 575 .flowi6_mark = skb->mark, 576 }; 577 int reg_vif_num; 578 579 if (!pskb_may_pull(skb, sizeof(*pim) + sizeof(*encap))) 580 goto drop; 581 582 pim = (struct pimreghdr *)skb_transport_header(skb); 583 if (pim->type != ((PIM_VERSION << 4) | PIM_TYPE_REGISTER) || 584 (pim->flags & PIM_NULL_REGISTER) || 585 (csum_ipv6_magic(&ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr, 586 sizeof(*pim), IPPROTO_PIM, 587 csum_partial((void *)pim, sizeof(*pim), 0)) && 588 csum_fold(skb_checksum(skb, 0, skb->len, 0)))) 589 goto drop; 590 591 /* check if the inner packet is destined to mcast group */ 592 encap = (struct ipv6hdr *)(skb_transport_header(skb) + 593 sizeof(*pim)); 594 595 if (!ipv6_addr_is_multicast(&encap->daddr) || 596 encap->payload_len == 0 || 597 ntohs(encap->payload_len) + sizeof(*pim) > skb->len) 598 goto drop; 599 600 if (ip6mr_fib_lookup(net, &fl6, &mrt) < 0) 601 goto drop; 602 603 /* Pairs with WRITE_ONCE() in mif6_add()/mif6_delete() */ 604 reg_vif_num = READ_ONCE(mrt->mroute_reg_vif_num); 605 if (reg_vif_num >= 0) 606 reg_dev = vif_dev_read(&mrt->vif_table[reg_vif_num]); 607 608 if (!reg_dev) 609 goto drop; 610 611 skb->mac_header = skb->network_header; 612 skb_pull(skb, (u8 *)encap - skb->data); 613 skb_reset_network_header(skb); 614 skb->protocol = htons(ETH_P_IPV6); 615 skb->ip_summed = CHECKSUM_NONE; 616 617 skb_tunnel_rx(skb, reg_dev, dev_net(reg_dev)); 618 619 netif_rx(skb); 620 621 return 0; 622 drop: 623 kfree_skb(skb); 624 return 0; 625 } 626 627 static const struct inet6_protocol pim6_protocol = { 628 .handler = pim6_rcv, 629 }; 630 631 /* Service routines creating virtual interfaces: PIMREG */ 632 633 static netdev_tx_t reg_vif_xmit(struct sk_buff *skb, 634 struct net_device *dev) 635 { 636 struct net *net = dev_net(dev); 637 struct mr_table *mrt; 638 struct flowi6 fl6 = { 639 .flowi6_oif = dev->ifindex, 640 .flowi6_iif = skb->skb_iif ? : LOOPBACK_IFINDEX, 641 .flowi6_mark = skb->mark, 642 }; 643 644 if (!pskb_inet_may_pull(skb)) 645 goto tx_err; 646 647 rcu_read_lock(); 648 649 if (ip6mr_fib_lookup(net, &fl6, &mrt) < 0) 650 goto tx_lookup_err; 651 652 DEV_STATS_ADD(dev, tx_bytes, skb->len); 653 DEV_STATS_INC(dev, tx_packets); 654 655 ip6mr_cache_report(mrt, skb, READ_ONCE(mrt->mroute_reg_vif_num), 656 MRT6MSG_WHOLEPKT); 657 rcu_read_unlock(); 658 kfree_skb(skb); 659 return NETDEV_TX_OK; 660 661 tx_lookup_err: 662 rcu_read_unlock(); 663 tx_err: 664 DEV_STATS_INC(dev, tx_errors); 665 kfree_skb(skb); 666 return NETDEV_TX_OK; 667 } 668 669 static int reg_vif_get_iflink(const struct net_device *dev) 670 { 671 return 0; 672 } 673 674 static const struct net_device_ops reg_vif_netdev_ops = { 675 .ndo_start_xmit = reg_vif_xmit, 676 .ndo_get_iflink = reg_vif_get_iflink, 677 }; 678 679 static void reg_vif_setup(struct net_device *dev) 680 { 681 dev->type = ARPHRD_PIMREG; 682 dev->mtu = 1500 - sizeof(struct ipv6hdr) - 8; 683 dev->flags = IFF_NOARP; 684 dev->netdev_ops = ®_vif_netdev_ops; 685 dev->needs_free_netdev = true; 686 dev->netns_immutable = true; 687 } 688 689 static struct net_device *ip6mr_reg_vif(struct net *net, struct mr_table *mrt) 690 { 691 struct net_device *dev; 692 char name[IFNAMSIZ]; 693 694 if (mrt->id == RT6_TABLE_DFLT) 695 sprintf(name, "pim6reg"); 696 else 697 sprintf(name, "pim6reg%u", mrt->id); 698 699 dev = alloc_netdev(0, name, NET_NAME_UNKNOWN, reg_vif_setup); 700 if (!dev) 701 return NULL; 702 703 dev_net_set(dev, net); 704 705 if (register_netdevice(dev)) { 706 free_netdev(dev); 707 return NULL; 708 } 709 710 if (dev_open(dev, NULL)) 711 goto failure; 712 713 dev_hold(dev); 714 return dev; 715 716 failure: 717 unregister_netdevice(dev); 718 return NULL; 719 } 720 #endif 721 722 static int call_ip6mr_vif_entry_notifiers(struct net *net, 723 enum fib_event_type event_type, 724 struct vif_device *vif, 725 struct net_device *vif_dev, 726 mifi_t vif_index, u32 tb_id) 727 { 728 return mr_call_vif_notifiers(net, RTNL_FAMILY_IP6MR, event_type, 729 vif, vif_dev, vif_index, tb_id, 730 &net->ipv6.ipmr_seq); 731 } 732 733 static int call_ip6mr_mfc_entry_notifiers(struct net *net, 734 enum fib_event_type event_type, 735 struct mfc6_cache *mfc, u32 tb_id) 736 { 737 return mr_call_mfc_notifiers(net, RTNL_FAMILY_IP6MR, event_type, 738 &mfc->_c, tb_id, &net->ipv6.ipmr_seq); 739 } 740 741 /* Delete a VIF entry */ 742 static int mif6_delete(struct mr_table *mrt, int vifi, int notify, 743 struct list_head *head) 744 { 745 struct vif_device *v; 746 struct net_device *dev; 747 struct inet6_dev *in6_dev; 748 749 if (vifi < 0 || vifi >= mrt->maxvif) 750 return -EADDRNOTAVAIL; 751 752 v = &mrt->vif_table[vifi]; 753 754 dev = rtnl_dereference(v->dev); 755 if (!dev) 756 return -EADDRNOTAVAIL; 757 758 call_ip6mr_vif_entry_notifiers(read_pnet(&mrt->net), 759 FIB_EVENT_VIF_DEL, v, dev, 760 vifi, mrt->id); 761 spin_lock(&mrt_lock); 762 RCU_INIT_POINTER(v->dev, NULL); 763 764 #ifdef CONFIG_IPV6_PIMSM_V2 765 if (vifi == mrt->mroute_reg_vif_num) { 766 /* Pairs with READ_ONCE() in ip6mr_cache_report() and reg_vif_xmit() */ 767 WRITE_ONCE(mrt->mroute_reg_vif_num, -1); 768 } 769 #endif 770 771 if (vifi + 1 == mrt->maxvif) { 772 int tmp; 773 for (tmp = vifi - 1; tmp >= 0; tmp--) { 774 if (VIF_EXISTS(mrt, tmp)) 775 break; 776 } 777 WRITE_ONCE(mrt->maxvif, tmp + 1); 778 } 779 780 spin_unlock(&mrt_lock); 781 782 dev_set_allmulti(dev, -1); 783 784 in6_dev = __in6_dev_get(dev); 785 if (in6_dev) { 786 atomic_dec(&in6_dev->cnf.mc_forwarding); 787 inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF, 788 NETCONFA_MC_FORWARDING, 789 dev->ifindex, &in6_dev->cnf); 790 } 791 792 if ((v->flags & MIFF_REGISTER) && !notify) 793 unregister_netdevice_queue(dev, head); 794 795 netdev_put(dev, &v->dev_tracker); 796 return 0; 797 } 798 799 static inline void ip6mr_cache_free_rcu(struct rcu_head *head) 800 { 801 struct mr_mfc *c = container_of(head, struct mr_mfc, rcu); 802 803 kmem_cache_free(mrt_cachep, (struct mfc6_cache *)c); 804 } 805 806 static inline void ip6mr_cache_free(struct mfc6_cache *c) 807 { 808 call_rcu(&c->_c.rcu, ip6mr_cache_free_rcu); 809 } 810 811 /* Destroy an unresolved cache entry, killing queued skbs 812 and reporting error to netlink readers. 813 */ 814 815 static void ip6mr_destroy_unres(struct mr_table *mrt, struct mfc6_cache *c) 816 { 817 struct net *net = read_pnet(&mrt->net); 818 struct sk_buff *skb; 819 820 WRITE_ONCE(mrt->cache_resolve_queue_len, 821 mrt->cache_resolve_queue_len - 1); 822 823 while ((skb = skb_dequeue(&c->_c.mfc_un.unres.unresolved)) != NULL) { 824 if (ipv6_hdr(skb)->version == 0) { 825 struct nlmsghdr *nlh = skb_pull(skb, 826 sizeof(struct ipv6hdr)); 827 nlh->nlmsg_type = NLMSG_ERROR; 828 nlh->nlmsg_len = nlmsg_msg_size(sizeof(struct nlmsgerr)); 829 skb_trim(skb, nlh->nlmsg_len); 830 ((struct nlmsgerr *)nlmsg_data(nlh))->error = -ETIMEDOUT; 831 rtnl_unicast(skb, net, NETLINK_CB(skb).portid); 832 } else 833 kfree_skb(skb); 834 } 835 836 ip6mr_cache_free(c); 837 } 838 839 840 /* Timer process for all the unresolved queue. */ 841 842 static void ipmr_do_expire_process(struct mr_table *mrt) 843 { 844 unsigned long now = jiffies; 845 unsigned long expires = 10 * HZ; 846 struct mr_mfc *c, *next; 847 848 list_for_each_entry_safe(c, next, &mrt->mfc_unres_queue, list) { 849 if (time_after(c->mfc_un.unres.expires, now)) { 850 /* not yet... */ 851 unsigned long interval = c->mfc_un.unres.expires - now; 852 if (interval < expires) 853 expires = interval; 854 continue; 855 } 856 857 list_del(&c->list); 858 mr6_netlink_event(mrt, (struct mfc6_cache *)c, RTM_DELROUTE); 859 ip6mr_destroy_unres(mrt, (struct mfc6_cache *)c); 860 } 861 862 if (!list_empty(&mrt->mfc_unres_queue)) 863 mod_timer(&mrt->ipmr_expire_timer, jiffies + expires); 864 } 865 866 static void ipmr_expire_process(struct timer_list *t) 867 { 868 struct mr_table *mrt = timer_container_of(mrt, t, ipmr_expire_timer); 869 870 if (!spin_trylock(&mfc_unres_lock)) { 871 mod_timer(&mrt->ipmr_expire_timer, jiffies + 1); 872 return; 873 } 874 875 if (!list_empty(&mrt->mfc_unres_queue)) 876 ipmr_do_expire_process(mrt); 877 878 spin_unlock(&mfc_unres_lock); 879 } 880 881 /* Fill oifs list. It is called under locked mrt_lock. */ 882 883 static void ip6mr_update_thresholds(struct mr_table *mrt, 884 struct mr_mfc *cache, 885 unsigned char *ttls) 886 { 887 int vifi; 888 889 cache->mfc_un.res.minvif = MAXMIFS; 890 cache->mfc_un.res.maxvif = 0; 891 memset(cache->mfc_un.res.ttls, 255, MAXMIFS); 892 893 for (vifi = 0; vifi < mrt->maxvif; vifi++) { 894 if (VIF_EXISTS(mrt, vifi) && 895 ttls[vifi] && ttls[vifi] < 255) { 896 cache->mfc_un.res.ttls[vifi] = ttls[vifi]; 897 if (cache->mfc_un.res.minvif > vifi) 898 cache->mfc_un.res.minvif = vifi; 899 if (cache->mfc_un.res.maxvif <= vifi) 900 cache->mfc_un.res.maxvif = vifi + 1; 901 } 902 } 903 WRITE_ONCE(cache->mfc_un.res.lastuse, jiffies); 904 } 905 906 static int mif6_add(struct net *net, struct mr_table *mrt, 907 struct mif6ctl *vifc, int mrtsock) 908 { 909 int vifi = vifc->mif6c_mifi; 910 struct vif_device *v = &mrt->vif_table[vifi]; 911 struct net_device *dev; 912 struct inet6_dev *in6_dev; 913 int err; 914 915 /* Is vif busy ? */ 916 if (VIF_EXISTS(mrt, vifi)) 917 return -EADDRINUSE; 918 919 switch (vifc->mif6c_flags) { 920 #ifdef CONFIG_IPV6_PIMSM_V2 921 case MIFF_REGISTER: 922 /* 923 * Special Purpose VIF in PIM 924 * All the packets will be sent to the daemon 925 */ 926 if (mrt->mroute_reg_vif_num >= 0) 927 return -EADDRINUSE; 928 dev = ip6mr_reg_vif(net, mrt); 929 if (!dev) 930 return -ENOBUFS; 931 err = dev_set_allmulti(dev, 1); 932 if (err) { 933 unregister_netdevice(dev); 934 dev_put(dev); 935 return err; 936 } 937 break; 938 #endif 939 case 0: 940 dev = dev_get_by_index(net, vifc->mif6c_pifi); 941 if (!dev) 942 return -EADDRNOTAVAIL; 943 err = dev_set_allmulti(dev, 1); 944 if (err) { 945 dev_put(dev); 946 return err; 947 } 948 break; 949 default: 950 return -EINVAL; 951 } 952 953 in6_dev = __in6_dev_get(dev); 954 if (in6_dev) { 955 atomic_inc(&in6_dev->cnf.mc_forwarding); 956 inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF, 957 NETCONFA_MC_FORWARDING, 958 dev->ifindex, &in6_dev->cnf); 959 } 960 961 /* Fill in the VIF structures */ 962 vif_device_init(v, dev, vifc->vifc_rate_limit, vifc->vifc_threshold, 963 vifc->mif6c_flags | (!mrtsock ? VIFF_STATIC : 0), 964 MIFF_REGISTER); 965 966 /* And finish update writing critical data */ 967 spin_lock(&mrt_lock); 968 rcu_assign_pointer(v->dev, dev); 969 netdev_tracker_alloc(dev, &v->dev_tracker, GFP_ATOMIC); 970 #ifdef CONFIG_IPV6_PIMSM_V2 971 if (v->flags & MIFF_REGISTER) 972 WRITE_ONCE(mrt->mroute_reg_vif_num, vifi); 973 #endif 974 if (vifi + 1 > mrt->maxvif) 975 WRITE_ONCE(mrt->maxvif, vifi + 1); 976 spin_unlock(&mrt_lock); 977 call_ip6mr_vif_entry_notifiers(net, FIB_EVENT_VIF_ADD, 978 v, dev, vifi, mrt->id); 979 return 0; 980 } 981 982 static struct mfc6_cache *ip6mr_cache_find(struct mr_table *mrt, 983 const struct in6_addr *origin, 984 const struct in6_addr *mcastgrp) 985 { 986 struct mfc6_cache_cmp_arg arg = { 987 .mf6c_origin = *origin, 988 .mf6c_mcastgrp = *mcastgrp, 989 }; 990 991 return mr_mfc_find(mrt, &arg); 992 } 993 994 /* Look for a (*,G) entry */ 995 static struct mfc6_cache *ip6mr_cache_find_any(struct mr_table *mrt, 996 struct in6_addr *mcastgrp, 997 mifi_t mifi) 998 { 999 struct mfc6_cache_cmp_arg arg = { 1000 .mf6c_origin = in6addr_any, 1001 .mf6c_mcastgrp = *mcastgrp, 1002 }; 1003 1004 if (ipv6_addr_any(mcastgrp)) 1005 return mr_mfc_find_any_parent(mrt, mifi); 1006 return mr_mfc_find_any(mrt, mifi, &arg); 1007 } 1008 1009 /* Look for a (S,G,iif) entry if parent != -1 */ 1010 static struct mfc6_cache * 1011 ip6mr_cache_find_parent(struct mr_table *mrt, 1012 const struct in6_addr *origin, 1013 const struct in6_addr *mcastgrp, 1014 int parent) 1015 { 1016 struct mfc6_cache_cmp_arg arg = { 1017 .mf6c_origin = *origin, 1018 .mf6c_mcastgrp = *mcastgrp, 1019 }; 1020 1021 return mr_mfc_find_parent(mrt, &arg, parent); 1022 } 1023 1024 /* Allocate a multicast cache entry */ 1025 static struct mfc6_cache *ip6mr_cache_alloc(void) 1026 { 1027 struct mfc6_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL); 1028 if (!c) 1029 return NULL; 1030 c->_c.mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1; 1031 c->_c.mfc_un.res.minvif = MAXMIFS; 1032 c->_c.free = ip6mr_cache_free_rcu; 1033 refcount_set(&c->_c.mfc_un.res.refcount, 1); 1034 return c; 1035 } 1036 1037 static struct mfc6_cache *ip6mr_cache_alloc_unres(void) 1038 { 1039 struct mfc6_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_ATOMIC); 1040 if (!c) 1041 return NULL; 1042 skb_queue_head_init(&c->_c.mfc_un.unres.unresolved); 1043 c->_c.mfc_un.unres.expires = jiffies + 10 * HZ; 1044 return c; 1045 } 1046 1047 /* 1048 * A cache entry has gone into a resolved state from queued 1049 */ 1050 1051 static void ip6mr_cache_resolve(struct net *net, struct mr_table *mrt, 1052 struct mfc6_cache *uc, struct mfc6_cache *c) 1053 { 1054 struct sk_buff *skb; 1055 1056 /* 1057 * Play the pending entries through our router 1058 */ 1059 1060 while ((skb = __skb_dequeue(&uc->_c.mfc_un.unres.unresolved))) { 1061 if (ipv6_hdr(skb)->version == 0) { 1062 struct nlmsghdr *nlh = skb_pull(skb, 1063 sizeof(struct ipv6hdr)); 1064 1065 if (mr_fill_mroute(mrt, skb, &c->_c, 1066 nlmsg_data(nlh)) > 0) { 1067 nlh->nlmsg_len = skb_tail_pointer(skb) - (u8 *)nlh; 1068 } else { 1069 nlh->nlmsg_type = NLMSG_ERROR; 1070 nlh->nlmsg_len = nlmsg_msg_size(sizeof(struct nlmsgerr)); 1071 skb_trim(skb, nlh->nlmsg_len); 1072 ((struct nlmsgerr *)nlmsg_data(nlh))->error = -EMSGSIZE; 1073 } 1074 rtnl_unicast(skb, net, NETLINK_CB(skb).portid); 1075 } else { 1076 rcu_read_lock(); 1077 ip6_mr_forward(net, mrt, skb->dev, skb, c); 1078 rcu_read_unlock(); 1079 } 1080 } 1081 } 1082 1083 /* 1084 * Bounce a cache query up to pim6sd and netlink. 1085 * 1086 * Called under rcu_read_lock() 1087 */ 1088 1089 static int ip6mr_cache_report(const struct mr_table *mrt, struct sk_buff *pkt, 1090 mifi_t mifi, int assert) 1091 { 1092 enum skb_drop_reason reason; 1093 struct sock *mroute6_sk; 1094 struct sk_buff *skb; 1095 struct mrt6msg *msg; 1096 1097 mroute6_sk = rcu_dereference(mrt->mroute_sk); 1098 if (!mroute6_sk) 1099 return -EINVAL; 1100 1101 #ifdef CONFIG_IPV6_PIMSM_V2 1102 if (assert == MRT6MSG_WHOLEPKT || assert == MRT6MSG_WRMIFWHOLE) 1103 skb = skb_realloc_headroom(pkt, -skb_network_offset(pkt) 1104 +sizeof(*msg)); 1105 else 1106 #endif 1107 skb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(*msg), GFP_ATOMIC); 1108 1109 if (!skb) 1110 return -ENOBUFS; 1111 1112 /* I suppose that internal messages 1113 * do not require checksums */ 1114 1115 skb->ip_summed = CHECKSUM_UNNECESSARY; 1116 1117 #ifdef CONFIG_IPV6_PIMSM_V2 1118 if (assert == MRT6MSG_WHOLEPKT || assert == MRT6MSG_WRMIFWHOLE) { 1119 /* Ugly, but we have no choice with this interface. 1120 Duplicate old header, fix length etc. 1121 And all this only to mangle msg->im6_msgtype and 1122 to set msg->im6_mbz to "mbz" :-) 1123 */ 1124 __skb_pull(skb, skb_network_offset(pkt)); 1125 1126 skb_push(skb, sizeof(*msg)); 1127 skb_reset_transport_header(skb); 1128 msg = (struct mrt6msg *)skb_transport_header(skb); 1129 msg->im6_mbz = 0; 1130 msg->im6_msgtype = assert; 1131 if (assert == MRT6MSG_WRMIFWHOLE) 1132 msg->im6_mif = mifi; 1133 else 1134 msg->im6_mif = READ_ONCE(mrt->mroute_reg_vif_num); 1135 msg->im6_pad = 0; 1136 msg->im6_src = ipv6_hdr(pkt)->saddr; 1137 msg->im6_dst = ipv6_hdr(pkt)->daddr; 1138 1139 skb->ip_summed = CHECKSUM_UNNECESSARY; 1140 } else 1141 #endif 1142 { 1143 /* 1144 * Copy the IP header 1145 */ 1146 1147 skb_put(skb, sizeof(struct ipv6hdr)); 1148 skb_reset_network_header(skb); 1149 skb_copy_to_linear_data(skb, ipv6_hdr(pkt), sizeof(struct ipv6hdr)); 1150 1151 /* 1152 * Add our header 1153 */ 1154 skb_put(skb, sizeof(*msg)); 1155 skb_reset_transport_header(skb); 1156 msg = (struct mrt6msg *)skb_transport_header(skb); 1157 1158 msg->im6_mbz = 0; 1159 msg->im6_msgtype = assert; 1160 msg->im6_mif = mifi; 1161 msg->im6_pad = 0; 1162 msg->im6_src = ipv6_hdr(pkt)->saddr; 1163 msg->im6_dst = ipv6_hdr(pkt)->daddr; 1164 1165 skb->ip_summed = CHECKSUM_UNNECESSARY; 1166 } 1167 1168 skb_dst_drop(skb); 1169 mrt6msg_netlink_event(mrt, skb); 1170 1171 /* Deliver to user space multicast routing algorithms */ 1172 reason = sock_queue_rcv_skb_reason(mroute6_sk, skb); 1173 1174 if (reason) { 1175 sk_skb_reason_drop(mroute6_sk, skb, reason); 1176 return -ENOMEM; 1177 } 1178 1179 return 0; 1180 } 1181 1182 /* Queue a packet for resolution. It gets locked cache entry! */ 1183 static int ip6mr_cache_unresolved(struct mr_table *mrt, mifi_t mifi, 1184 struct sk_buff *skb, struct net_device *dev) 1185 { 1186 struct net *net = read_pnet(&mrt->net); 1187 struct mfc6_cache *c = NULL; 1188 bool found = false; 1189 int err; 1190 1191 spin_lock_bh(&mfc_unres_lock); 1192 1193 if (!check_net(net)) { 1194 err = -EINVAL; 1195 goto err; 1196 } 1197 1198 list_for_each_entry(c, &mrt->mfc_unres_queue, _c.list) { 1199 if (ipv6_addr_equal(&c->mf6c_mcastgrp, &ipv6_hdr(skb)->daddr) && 1200 ipv6_addr_equal(&c->mf6c_origin, &ipv6_hdr(skb)->saddr)) { 1201 found = true; 1202 break; 1203 } 1204 } 1205 1206 if (!found) { 1207 /* 1208 * Create a new entry if allowable 1209 */ 1210 1211 c = ip6mr_cache_alloc_unres(); 1212 if (!c) { 1213 err = -ENOBUFS; 1214 goto err; 1215 } 1216 1217 /* Fill in the new cache entry */ 1218 c->_c.mfc_parent = -1; 1219 c->mf6c_origin = ipv6_hdr(skb)->saddr; 1220 c->mf6c_mcastgrp = ipv6_hdr(skb)->daddr; 1221 1222 /* 1223 * Reflect first query at pim6sd 1224 */ 1225 err = ip6mr_cache_report(mrt, skb, mifi, MRT6MSG_NOCACHE); 1226 if (err < 0) 1227 goto err; 1228 1229 WRITE_ONCE(mrt->cache_resolve_queue_len, 1230 mrt->cache_resolve_queue_len + 1); 1231 list_add(&c->_c.list, &mrt->mfc_unres_queue); 1232 mr6_netlink_event(mrt, c, RTM_NEWROUTE); 1233 1234 ipmr_do_expire_process(mrt); 1235 } 1236 1237 /* See if we can append the packet */ 1238 if (c->_c.mfc_un.unres.unresolved.qlen > 3) { 1239 c = NULL; 1240 err = -ENOBUFS; 1241 goto err; 1242 } 1243 1244 if (dev) { 1245 skb->dev = dev; 1246 skb->skb_iif = dev->ifindex; 1247 } 1248 1249 skb_dst_drop(skb); 1250 skb_queue_tail(&c->_c.mfc_un.unres.unresolved, skb); 1251 1252 spin_unlock_bh(&mfc_unres_lock); 1253 return 0; 1254 1255 err: 1256 spin_unlock_bh(&mfc_unres_lock); 1257 if (c) 1258 ip6mr_cache_free(c); 1259 kfree_skb(skb); 1260 return err; 1261 } 1262 1263 /* 1264 * MFC6 cache manipulation by user space 1265 */ 1266 1267 static int ip6mr_mfc_delete(struct mr_table *mrt, struct mf6cctl *mfc, 1268 int parent) 1269 { 1270 struct mfc6_cache *c; 1271 1272 rcu_read_lock(); 1273 c = ip6mr_cache_find_parent(mrt, &mfc->mf6cc_origin.sin6_addr, 1274 &mfc->mf6cc_mcastgrp.sin6_addr, parent); 1275 rcu_read_unlock(); 1276 if (!c) 1277 return -ENOENT; 1278 rhltable_remove(&mrt->mfc_hash, &c->_c.mnode, ip6mr_rht_params); 1279 list_del_rcu(&c->_c.list); 1280 1281 call_ip6mr_mfc_entry_notifiers(read_pnet(&mrt->net), 1282 FIB_EVENT_ENTRY_DEL, c, mrt->id); 1283 mr6_netlink_event(mrt, c, RTM_DELROUTE); 1284 mr_cache_put(&c->_c); 1285 return 0; 1286 } 1287 1288 static int ip6mr_device_event(struct notifier_block *this, 1289 unsigned long event, void *ptr) 1290 { 1291 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 1292 struct net *net = dev_net(dev); 1293 struct mr_table *mrt; 1294 struct vif_device *v; 1295 int ct; 1296 1297 if (event != NETDEV_UNREGISTER) 1298 return NOTIFY_DONE; 1299 1300 ip6mr_for_each_table(mrt, net) { 1301 v = &mrt->vif_table[0]; 1302 for (ct = 0; ct < mrt->maxvif; ct++, v++) { 1303 if (rcu_access_pointer(v->dev) == dev) 1304 mif6_delete(mrt, ct, 1, NULL); 1305 } 1306 } 1307 1308 return NOTIFY_DONE; 1309 } 1310 1311 static unsigned int ip6mr_seq_read(const struct net *net) 1312 { 1313 return atomic_read(&net->ipv6.ipmr_seq) + ip6mr_rules_seq_read(net); 1314 } 1315 1316 static int ip6mr_dump(struct net *net, struct notifier_block *nb, 1317 struct netlink_ext_ack *extack) 1318 { 1319 return mr_dump(net, nb, RTNL_FAMILY_IP6MR, ip6mr_rules_dump, 1320 ip6mr_mr_table_iter, extack); 1321 } 1322 1323 static struct notifier_block ip6_mr_notifier = { 1324 .notifier_call = ip6mr_device_event 1325 }; 1326 1327 static const struct fib_notifier_ops ip6mr_notifier_ops_template = { 1328 .family = RTNL_FAMILY_IP6MR, 1329 .fib_seq_read = ip6mr_seq_read, 1330 .fib_dump = ip6mr_dump, 1331 .owner = THIS_MODULE, 1332 }; 1333 1334 static int __net_init ip6mr_notifier_init(struct net *net) 1335 { 1336 struct fib_notifier_ops *ops; 1337 1338 atomic_set(&net->ipv6.ipmr_seq, 0); 1339 1340 ops = fib_notifier_ops_register(&ip6mr_notifier_ops_template, net); 1341 if (IS_ERR(ops)) 1342 return PTR_ERR(ops); 1343 1344 net->ipv6.ip6mr_notifier_ops = ops; 1345 1346 return 0; 1347 } 1348 1349 static void __net_exit ip6mr_notifier_exit(struct net *net) 1350 { 1351 fib_notifier_ops_unregister(net->ipv6.ip6mr_notifier_ops); 1352 net->ipv6.ip6mr_notifier_ops = NULL; 1353 } 1354 1355 /* Setup for IP multicast routing */ 1356 static int __net_init ip6mr_net_init(struct net *net) 1357 { 1358 #ifdef CONFIG_PROC_FS 1359 LIST_HEAD(dev_kill_list); 1360 #endif 1361 int err; 1362 1363 mutex_init(&net->ipv6.mfc_mutex); 1364 1365 err = ip6mr_notifier_init(net); 1366 if (err) 1367 return err; 1368 1369 err = ip6mr_rules_init(net); 1370 if (err < 0) 1371 goto ip6mr_rules_fail; 1372 1373 #ifdef CONFIG_PROC_FS 1374 err = -ENOMEM; 1375 if (!proc_create_net("ip6_mr_vif", 0, net->proc_net, &ip6mr_vif_seq_ops, 1376 sizeof(struct mr_vif_iter))) 1377 goto proc_vif_fail; 1378 if (!proc_create_net("ip6_mr_cache", 0, net->proc_net, &ipmr_mfc_seq_ops, 1379 sizeof(struct mr_mfc_iter))) 1380 goto proc_cache_fail; 1381 #endif 1382 1383 return 0; 1384 1385 #ifdef CONFIG_PROC_FS 1386 proc_cache_fail: 1387 remove_proc_entry("ip6_mr_vif", net->proc_net); 1388 proc_vif_fail: 1389 ip6mr_rules_exit_rtnl(net, &dev_kill_list); 1390 ip6mr_rules_exit(net); 1391 #endif 1392 ip6mr_rules_fail: 1393 ip6mr_notifier_exit(net); 1394 return err; 1395 } 1396 1397 static void __net_exit ip6mr_net_exit(struct net *net) 1398 { 1399 #ifdef CONFIG_PROC_FS 1400 remove_proc_entry("ip6_mr_cache", net->proc_net); 1401 remove_proc_entry("ip6_mr_vif", net->proc_net); 1402 #endif 1403 ip6mr_rules_exit(net); 1404 ip6mr_notifier_exit(net); 1405 } 1406 1407 static void __net_exit ip6mr_net_exit_rtnl(struct net *net, 1408 struct list_head *dev_kill_list) 1409 { 1410 ip6mr_rules_exit_rtnl(net, dev_kill_list); 1411 } 1412 1413 static struct pernet_operations ip6mr_net_ops = { 1414 .init = ip6mr_net_init, 1415 .exit = ip6mr_net_exit, 1416 .exit_rtnl = ip6mr_net_exit_rtnl, 1417 }; 1418 1419 static const struct rtnl_msg_handler ip6mr_rtnl_msg_handlers[] __initconst_or_module = { 1420 {.owner = THIS_MODULE, .protocol = RTNL_FAMILY_IP6MR, 1421 .msgtype = RTM_GETROUTE, 1422 .doit = ip6mr_rtm_getroute, .dumpit = ip6mr_rtm_dumproute, 1423 .flags = RTNL_FLAG_DOIT_UNLOCKED | RTNL_FLAG_DUMP_UNLOCKED}, 1424 }; 1425 1426 int __init ip6_mr_init(void) 1427 { 1428 int err; 1429 1430 mrt_cachep = KMEM_CACHE(mfc6_cache, SLAB_HWCACHE_ALIGN); 1431 if (!mrt_cachep) 1432 return -ENOMEM; 1433 1434 err = register_pernet_subsys(&ip6mr_net_ops); 1435 if (err) 1436 goto reg_pernet_fail; 1437 1438 err = register_netdevice_notifier(&ip6_mr_notifier); 1439 if (err) 1440 goto reg_notif_fail; 1441 #ifdef CONFIG_IPV6_PIMSM_V2 1442 if (inet6_add_protocol(&pim6_protocol, IPPROTO_PIM) < 0) { 1443 pr_err("%s: can't add PIM protocol\n", __func__); 1444 err = -EAGAIN; 1445 goto add_proto_fail; 1446 } 1447 #endif 1448 err = rtnl_register_many(ip6mr_rtnl_msg_handlers); 1449 if (!err) 1450 return 0; 1451 1452 #ifdef CONFIG_IPV6_PIMSM_V2 1453 inet6_del_protocol(&pim6_protocol, IPPROTO_PIM); 1454 add_proto_fail: 1455 unregister_netdevice_notifier(&ip6_mr_notifier); 1456 #endif 1457 reg_notif_fail: 1458 unregister_pernet_subsys(&ip6mr_net_ops); 1459 reg_pernet_fail: 1460 kmem_cache_destroy(mrt_cachep); 1461 return err; 1462 } 1463 1464 void __init ip6_mr_cleanup(void) 1465 { 1466 rtnl_unregister_many(ip6mr_rtnl_msg_handlers); 1467 #ifdef CONFIG_IPV6_PIMSM_V2 1468 inet6_del_protocol(&pim6_protocol, IPPROTO_PIM); 1469 #endif 1470 unregister_netdevice_notifier(&ip6_mr_notifier); 1471 unregister_pernet_subsys(&ip6mr_net_ops); 1472 kmem_cache_destroy(mrt_cachep); 1473 } 1474 1475 static int ip6mr_mfc_add(struct net *net, struct mr_table *mrt, 1476 struct mf6cctl *mfc, int mrtsock, int parent) 1477 { 1478 unsigned char ttls[MAXMIFS]; 1479 struct mfc6_cache *uc, *c; 1480 struct mr_mfc *_uc; 1481 bool found; 1482 int i, err; 1483 1484 if (mfc->mf6cc_parent >= MAXMIFS) 1485 return -ENFILE; 1486 1487 memset(ttls, 255, MAXMIFS); 1488 for (i = 0; i < MAXMIFS; i++) { 1489 if (IF_ISSET(i, &mfc->mf6cc_ifset)) 1490 ttls[i] = 1; 1491 } 1492 1493 rcu_read_lock(); 1494 c = ip6mr_cache_find_parent(mrt, &mfc->mf6cc_origin.sin6_addr, 1495 &mfc->mf6cc_mcastgrp.sin6_addr, parent); 1496 rcu_read_unlock(); 1497 if (c) { 1498 spin_lock(&mrt_lock); 1499 c->_c.mfc_parent = mfc->mf6cc_parent; 1500 ip6mr_update_thresholds(mrt, &c->_c, ttls); 1501 if (!mrtsock) 1502 c->_c.mfc_flags |= MFC_STATIC; 1503 spin_unlock(&mrt_lock); 1504 call_ip6mr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_REPLACE, 1505 c, mrt->id); 1506 mr6_netlink_event(mrt, c, RTM_NEWROUTE); 1507 return 0; 1508 } 1509 1510 if (!ipv6_addr_any(&mfc->mf6cc_mcastgrp.sin6_addr) && 1511 !ipv6_addr_is_multicast(&mfc->mf6cc_mcastgrp.sin6_addr)) 1512 return -EINVAL; 1513 1514 c = ip6mr_cache_alloc(); 1515 if (!c) 1516 return -ENOMEM; 1517 1518 c->mf6c_origin = mfc->mf6cc_origin.sin6_addr; 1519 c->mf6c_mcastgrp = mfc->mf6cc_mcastgrp.sin6_addr; 1520 c->_c.mfc_parent = mfc->mf6cc_parent; 1521 ip6mr_update_thresholds(mrt, &c->_c, ttls); 1522 if (!mrtsock) 1523 c->_c.mfc_flags |= MFC_STATIC; 1524 1525 err = rhltable_insert_key(&mrt->mfc_hash, &c->cmparg, &c->_c.mnode, 1526 ip6mr_rht_params); 1527 if (err) { 1528 pr_err("ip6mr: rhtable insert error %d\n", err); 1529 ip6mr_cache_free(c); 1530 return err; 1531 } 1532 list_add_tail_rcu(&c->_c.list, &mrt->mfc_cache_list); 1533 1534 /* Check to see if we resolved a queued list. If so we 1535 * need to send on the frames and tidy up. 1536 */ 1537 found = false; 1538 spin_lock_bh(&mfc_unres_lock); 1539 list_for_each_entry(_uc, &mrt->mfc_unres_queue, list) { 1540 uc = (struct mfc6_cache *)_uc; 1541 if (ipv6_addr_equal(&uc->mf6c_origin, &c->mf6c_origin) && 1542 ipv6_addr_equal(&uc->mf6c_mcastgrp, &c->mf6c_mcastgrp)) { 1543 list_del(&_uc->list); 1544 WRITE_ONCE(mrt->cache_resolve_queue_len, 1545 mrt->cache_resolve_queue_len - 1); 1546 found = true; 1547 break; 1548 } 1549 } 1550 if (list_empty(&mrt->mfc_unres_queue)) 1551 timer_delete(&mrt->ipmr_expire_timer); 1552 spin_unlock_bh(&mfc_unres_lock); 1553 1554 if (found) { 1555 ip6mr_cache_resolve(net, mrt, uc, c); 1556 ip6mr_cache_free(uc); 1557 } 1558 call_ip6mr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_ADD, 1559 c, mrt->id); 1560 mr6_netlink_event(mrt, c, RTM_NEWROUTE); 1561 return 0; 1562 } 1563 1564 /* 1565 * Close the multicast socket, and clear the vif tables etc 1566 */ 1567 1568 static void mroute_clean_tables(struct mr_table *mrt, int flags, 1569 struct list_head *dev_kill_list) 1570 { 1571 struct net *net = read_pnet(&mrt->net); 1572 struct mr_mfc *c, *tmp; 1573 int i; 1574 1575 /* Shut down all active vif entries */ 1576 if (flags & (MRT6_FLUSH_MIFS | MRT6_FLUSH_MIFS_STATIC)) { 1577 for (i = 0; i < mrt->maxvif; i++) { 1578 if (((mrt->vif_table[i].flags & VIFF_STATIC) && 1579 !(flags & MRT6_FLUSH_MIFS_STATIC)) || 1580 (!(mrt->vif_table[i].flags & VIFF_STATIC) && !(flags & MRT6_FLUSH_MIFS))) 1581 continue; 1582 mif6_delete(mrt, i, 0, dev_kill_list); 1583 } 1584 } 1585 1586 /* Wipe the cache */ 1587 if (flags & (MRT6_FLUSH_MFC | MRT6_FLUSH_MFC_STATIC)) { 1588 mutex_lock(&net->ipv6.mfc_mutex); 1589 1590 list_for_each_entry_safe(c, tmp, &mrt->mfc_cache_list, list) { 1591 if (((c->mfc_flags & MFC_STATIC) && !(flags & MRT6_FLUSH_MFC_STATIC)) || 1592 (!(c->mfc_flags & MFC_STATIC) && !(flags & MRT6_FLUSH_MFC))) 1593 continue; 1594 rhltable_remove(&mrt->mfc_hash, &c->mnode, ip6mr_rht_params); 1595 list_del_rcu(&c->list); 1596 call_ip6mr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_DEL, 1597 (struct mfc6_cache *)c, mrt->id); 1598 mr6_netlink_event(mrt, (struct mfc6_cache *)c, RTM_DELROUTE); 1599 mr_cache_put(c); 1600 } 1601 1602 mutex_unlock(&net->ipv6.mfc_mutex); 1603 } 1604 1605 if (flags & MRT6_FLUSH_MFC) { 1606 if (READ_ONCE(mrt->cache_resolve_queue_len) || !check_net(net)) { 1607 spin_lock_bh(&mfc_unres_lock); 1608 list_for_each_entry_safe(c, tmp, &mrt->mfc_unres_queue, list) { 1609 list_del(&c->list); 1610 mr6_netlink_event(mrt, (struct mfc6_cache *)c, 1611 RTM_DELROUTE); 1612 ip6mr_destroy_unres(mrt, (struct mfc6_cache *)c); 1613 } 1614 spin_unlock_bh(&mfc_unres_lock); 1615 } 1616 } 1617 } 1618 1619 static int ip6mr_sk_init(struct mr_table *mrt, struct sock *sk) 1620 { 1621 int err = 0; 1622 struct net *net = sock_net(sk); 1623 1624 rtnl_lock(); 1625 spin_lock(&mrt_lock); 1626 if (rtnl_dereference(mrt->mroute_sk)) { 1627 err = -EADDRINUSE; 1628 } else { 1629 rcu_assign_pointer(mrt->mroute_sk, sk); 1630 sock_set_flag(sk, SOCK_RCU_FREE); 1631 atomic_inc(&net->ipv6.devconf_all->mc_forwarding); 1632 } 1633 spin_unlock(&mrt_lock); 1634 1635 if (!err) 1636 inet6_netconf_notify_devconf(net, RTM_NEWNETCONF, 1637 NETCONFA_MC_FORWARDING, 1638 NETCONFA_IFINDEX_ALL, 1639 net->ipv6.devconf_all); 1640 rtnl_unlock(); 1641 1642 return err; 1643 } 1644 1645 int ip6mr_sk_done(struct sock *sk) 1646 { 1647 struct net *net = sock_net(sk); 1648 struct ipv6_devconf *devconf; 1649 LIST_HEAD(dev_kill_list); 1650 struct mr_table *mrt; 1651 int err = -EACCES; 1652 1653 if (sk->sk_type != SOCK_RAW || 1654 inet_sk(sk)->inet_num != IPPROTO_ICMPV6) 1655 return err; 1656 1657 devconf = net->ipv6.devconf_all; 1658 if (!devconf || !atomic_read(&devconf->mc_forwarding)) 1659 return err; 1660 1661 rtnl_lock(); 1662 ip6mr_for_each_table(mrt, net) { 1663 if (sk == rtnl_dereference(mrt->mroute_sk)) { 1664 spin_lock(&mrt_lock); 1665 RCU_INIT_POINTER(mrt->mroute_sk, NULL); 1666 /* Note that mroute_sk had SOCK_RCU_FREE set, 1667 * so the RCU grace period before sk freeing 1668 * is guaranteed by sk_destruct() 1669 */ 1670 atomic_dec(&devconf->mc_forwarding); 1671 spin_unlock(&mrt_lock); 1672 inet6_netconf_notify_devconf(net, RTM_NEWNETCONF, 1673 NETCONFA_MC_FORWARDING, 1674 NETCONFA_IFINDEX_ALL, 1675 net->ipv6.devconf_all); 1676 1677 mroute_clean_tables(mrt, MRT6_FLUSH_MIFS | MRT6_FLUSH_MFC, 1678 &dev_kill_list); 1679 err = 0; 1680 break; 1681 } 1682 } 1683 unregister_netdevice_many(&dev_kill_list); 1684 rtnl_unlock(); 1685 1686 return err; 1687 } 1688 1689 bool mroute6_is_socket(struct net *net, struct sk_buff *skb) 1690 { 1691 struct mr_table *mrt; 1692 struct flowi6 fl6 = { 1693 .flowi6_iif = skb->skb_iif ? : LOOPBACK_IFINDEX, 1694 .flowi6_oif = skb->dev->ifindex, 1695 .flowi6_mark = skb->mark, 1696 }; 1697 1698 if (ip6mr_fib_lookup(net, &fl6, &mrt) < 0) 1699 return NULL; 1700 1701 return rcu_access_pointer(mrt->mroute_sk); 1702 } 1703 EXPORT_SYMBOL(mroute6_is_socket); 1704 1705 /* 1706 * Socket options and virtual interface manipulation. The whole 1707 * virtual interface system is a complete heap, but unfortunately 1708 * that's how BSD mrouted happens to think. Maybe one day with a proper 1709 * MOSPF/PIM router set up we can clean this up. 1710 */ 1711 1712 int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval, 1713 unsigned int optlen) 1714 { 1715 int ret, parent = 0; 1716 struct mif6ctl vif; 1717 struct mf6cctl mfc; 1718 mifi_t mifi; 1719 struct net *net = sock_net(sk); 1720 struct mr_table *mrt; 1721 1722 if (sk->sk_type != SOCK_RAW || 1723 inet_sk(sk)->inet_num != IPPROTO_ICMPV6) 1724 return -EOPNOTSUPP; 1725 1726 mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT); 1727 if (!mrt) 1728 return -ENOENT; 1729 1730 if (optname != MRT6_INIT) { 1731 if (sk != rcu_access_pointer(mrt->mroute_sk) && 1732 !ns_capable(net->user_ns, CAP_NET_ADMIN)) 1733 return -EACCES; 1734 } 1735 1736 switch (optname) { 1737 case MRT6_INIT: 1738 if (optlen < sizeof(int)) 1739 return -EINVAL; 1740 1741 return ip6mr_sk_init(mrt, sk); 1742 1743 case MRT6_DONE: 1744 return ip6mr_sk_done(sk); 1745 1746 case MRT6_ADD_MIF: 1747 if (optlen < sizeof(vif)) 1748 return -EINVAL; 1749 if (copy_from_sockptr(&vif, optval, sizeof(vif))) 1750 return -EFAULT; 1751 if (vif.mif6c_mifi >= MAXMIFS) 1752 return -ENFILE; 1753 rtnl_lock(); 1754 ret = mif6_add(net, mrt, &vif, 1755 sk == rtnl_dereference(mrt->mroute_sk)); 1756 rtnl_unlock(); 1757 return ret; 1758 1759 case MRT6_DEL_MIF: 1760 if (optlen < sizeof(mifi_t)) 1761 return -EINVAL; 1762 if (copy_from_sockptr(&mifi, optval, sizeof(mifi_t))) 1763 return -EFAULT; 1764 rtnl_lock(); 1765 ret = mif6_delete(mrt, mifi, 0, NULL); 1766 rtnl_unlock(); 1767 return ret; 1768 1769 /* 1770 * Manipulate the forwarding caches. These live 1771 * in a sort of kernel/user symbiosis. 1772 */ 1773 case MRT6_ADD_MFC: 1774 case MRT6_DEL_MFC: 1775 parent = -1; 1776 fallthrough; 1777 case MRT6_ADD_MFC_PROXY: 1778 case MRT6_DEL_MFC_PROXY: 1779 if (optlen < sizeof(mfc)) 1780 return -EINVAL; 1781 if (copy_from_sockptr(&mfc, optval, sizeof(mfc))) 1782 return -EFAULT; 1783 if (parent == 0) 1784 parent = mfc.mf6cc_parent; 1785 1786 mutex_lock(&net->ipv6.mfc_mutex); 1787 1788 if (optname == MRT6_DEL_MFC || optname == MRT6_DEL_MFC_PROXY) 1789 ret = ip6mr_mfc_delete(mrt, &mfc, parent); 1790 else 1791 ret = ip6mr_mfc_add(net, mrt, &mfc, 1792 sk == 1793 rcu_access_pointer(mrt->mroute_sk), 1794 parent); 1795 1796 mutex_unlock(&net->ipv6.mfc_mutex); 1797 return ret; 1798 1799 case MRT6_FLUSH: 1800 { 1801 LIST_HEAD(dev_kill_list); 1802 int flags; 1803 1804 if (optlen != sizeof(flags)) 1805 return -EINVAL; 1806 if (copy_from_sockptr(&flags, optval, sizeof(flags))) 1807 return -EFAULT; 1808 1809 rtnl_lock(); 1810 mroute_clean_tables(mrt, flags, &dev_kill_list); 1811 unregister_netdevice_many(&dev_kill_list); 1812 rtnl_unlock(); 1813 return 0; 1814 } 1815 1816 /* 1817 * Control PIM assert (to activate pim will activate assert) 1818 */ 1819 case MRT6_ASSERT: 1820 { 1821 int v; 1822 1823 if (optlen != sizeof(v)) 1824 return -EINVAL; 1825 if (copy_from_sockptr(&v, optval, sizeof(v))) 1826 return -EFAULT; 1827 WRITE_ONCE(mrt->mroute_do_assert, v); 1828 return 0; 1829 } 1830 1831 #ifdef CONFIG_IPV6_PIMSM_V2 1832 case MRT6_PIM: 1833 { 1834 bool do_wrmifwhole; 1835 int v; 1836 1837 if (optlen != sizeof(v)) 1838 return -EINVAL; 1839 if (copy_from_sockptr(&v, optval, sizeof(v))) 1840 return -EFAULT; 1841 1842 do_wrmifwhole = (v == MRT6MSG_WRMIFWHOLE); 1843 v = !!v; 1844 rtnl_lock(); 1845 ret = 0; 1846 if (v != mrt->mroute_do_pim) { 1847 WRITE_ONCE(mrt->mroute_do_pim, v); 1848 WRITE_ONCE(mrt->mroute_do_assert, v); 1849 WRITE_ONCE(mrt->mroute_do_wrvifwhole, do_wrmifwhole); 1850 } 1851 rtnl_unlock(); 1852 return ret; 1853 } 1854 1855 #endif 1856 #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES 1857 case MRT6_TABLE: 1858 { 1859 u32 v; 1860 1861 if (optlen != sizeof(u32)) 1862 return -EINVAL; 1863 if (copy_from_sockptr(&v, optval, sizeof(v))) 1864 return -EFAULT; 1865 /* "pim6reg%u" should not exceed 16 bytes (IFNAMSIZ) */ 1866 if (v != RT_TABLE_DEFAULT && v >= 100000000) 1867 return -EINVAL; 1868 if (sk == rcu_access_pointer(mrt->mroute_sk)) 1869 return -EBUSY; 1870 1871 rtnl_lock(); 1872 ret = 0; 1873 mrt = ip6mr_new_table(net, v); 1874 if (IS_ERR(mrt)) 1875 ret = PTR_ERR(mrt); 1876 else 1877 raw6_sk(sk)->ip6mr_table = v; 1878 rtnl_unlock(); 1879 return ret; 1880 } 1881 #endif 1882 /* 1883 * Spurious command, or MRT6_VERSION which you cannot 1884 * set. 1885 */ 1886 default: 1887 return -ENOPROTOOPT; 1888 } 1889 } 1890 1891 /* 1892 * Getsock opt support for the multicast routing system. 1893 */ 1894 1895 int ip6_mroute_getsockopt(struct sock *sk, int optname, sockptr_t optval, 1896 sockptr_t optlen) 1897 { 1898 int olr; 1899 int val; 1900 struct net *net = sock_net(sk); 1901 struct mr_table *mrt; 1902 1903 if (sk->sk_type != SOCK_RAW || 1904 inet_sk(sk)->inet_num != IPPROTO_ICMPV6) 1905 return -EOPNOTSUPP; 1906 1907 mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT); 1908 if (!mrt) 1909 return -ENOENT; 1910 1911 switch (optname) { 1912 case MRT6_VERSION: 1913 val = 0x0305; 1914 break; 1915 #ifdef CONFIG_IPV6_PIMSM_V2 1916 case MRT6_PIM: 1917 val = READ_ONCE(mrt->mroute_do_pim); 1918 break; 1919 #endif 1920 case MRT6_ASSERT: 1921 val = READ_ONCE(mrt->mroute_do_assert); 1922 break; 1923 default: 1924 return -ENOPROTOOPT; 1925 } 1926 1927 if (copy_from_sockptr(&olr, optlen, sizeof(int))) 1928 return -EFAULT; 1929 1930 olr = min_t(int, olr, sizeof(int)); 1931 if (olr < 0) 1932 return -EINVAL; 1933 1934 if (copy_to_sockptr(optlen, &olr, sizeof(int))) 1935 return -EFAULT; 1936 if (copy_to_sockptr(optval, &val, olr)) 1937 return -EFAULT; 1938 return 0; 1939 } 1940 1941 /* 1942 * The IP multicast ioctl support routines. 1943 */ 1944 int ip6mr_ioctl(struct sock *sk, int cmd, void *arg) 1945 { 1946 struct sioc_sg_req6 *sr; 1947 struct sioc_mif_req6 *vr; 1948 struct vif_device *vif; 1949 struct mfc6_cache *c; 1950 struct net *net = sock_net(sk); 1951 struct mr_table *mrt; 1952 1953 mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT); 1954 if (!mrt) 1955 return -ENOENT; 1956 1957 switch (cmd) { 1958 case SIOCGETMIFCNT_IN6: 1959 vr = (struct sioc_mif_req6 *)arg; 1960 if (vr->mifi >= mrt->maxvif) 1961 return -EINVAL; 1962 vr->mifi = array_index_nospec(vr->mifi, mrt->maxvif); 1963 rcu_read_lock(); 1964 vif = &mrt->vif_table[vr->mifi]; 1965 if (VIF_EXISTS(mrt, vr->mifi)) { 1966 vr->icount = READ_ONCE(vif->pkt_in); 1967 vr->ocount = READ_ONCE(vif->pkt_out); 1968 vr->ibytes = READ_ONCE(vif->bytes_in); 1969 vr->obytes = READ_ONCE(vif->bytes_out); 1970 rcu_read_unlock(); 1971 return 0; 1972 } 1973 rcu_read_unlock(); 1974 return -EADDRNOTAVAIL; 1975 case SIOCGETSGCNT_IN6: 1976 sr = (struct sioc_sg_req6 *)arg; 1977 1978 rcu_read_lock(); 1979 c = ip6mr_cache_find(mrt, &sr->src.sin6_addr, 1980 &sr->grp.sin6_addr); 1981 if (c) { 1982 sr->pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt); 1983 sr->bytecnt = atomic_long_read(&c->_c.mfc_un.res.bytes); 1984 sr->wrong_if = atomic_long_read(&c->_c.mfc_un.res.wrong_if); 1985 rcu_read_unlock(); 1986 return 0; 1987 } 1988 rcu_read_unlock(); 1989 return -EADDRNOTAVAIL; 1990 default: 1991 return -ENOIOCTLCMD; 1992 } 1993 } 1994 1995 #ifdef CONFIG_COMPAT 1996 struct compat_sioc_sg_req6 { 1997 struct sockaddr_in6 src; 1998 struct sockaddr_in6 grp; 1999 compat_ulong_t pktcnt; 2000 compat_ulong_t bytecnt; 2001 compat_ulong_t wrong_if; 2002 }; 2003 2004 struct compat_sioc_mif_req6 { 2005 mifi_t mifi; 2006 compat_ulong_t icount; 2007 compat_ulong_t ocount; 2008 compat_ulong_t ibytes; 2009 compat_ulong_t obytes; 2010 }; 2011 2012 int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg) 2013 { 2014 struct compat_sioc_sg_req6 sr; 2015 struct compat_sioc_mif_req6 vr; 2016 struct vif_device *vif; 2017 struct mfc6_cache *c; 2018 struct net *net = sock_net(sk); 2019 struct mr_table *mrt; 2020 2021 mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT); 2022 if (!mrt) 2023 return -ENOENT; 2024 2025 switch (cmd) { 2026 case SIOCGETMIFCNT_IN6: 2027 if (copy_from_user(&vr, arg, sizeof(vr))) 2028 return -EFAULT; 2029 if (vr.mifi >= mrt->maxvif) 2030 return -EINVAL; 2031 vr.mifi = array_index_nospec(vr.mifi, mrt->maxvif); 2032 rcu_read_lock(); 2033 vif = &mrt->vif_table[vr.mifi]; 2034 if (VIF_EXISTS(mrt, vr.mifi)) { 2035 vr.icount = READ_ONCE(vif->pkt_in); 2036 vr.ocount = READ_ONCE(vif->pkt_out); 2037 vr.ibytes = READ_ONCE(vif->bytes_in); 2038 vr.obytes = READ_ONCE(vif->bytes_out); 2039 rcu_read_unlock(); 2040 2041 if (copy_to_user(arg, &vr, sizeof(vr))) 2042 return -EFAULT; 2043 return 0; 2044 } 2045 rcu_read_unlock(); 2046 return -EADDRNOTAVAIL; 2047 case SIOCGETSGCNT_IN6: 2048 if (copy_from_user(&sr, arg, sizeof(sr))) 2049 return -EFAULT; 2050 2051 rcu_read_lock(); 2052 c = ip6mr_cache_find(mrt, &sr.src.sin6_addr, &sr.grp.sin6_addr); 2053 if (c) { 2054 sr.pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt); 2055 sr.bytecnt = atomic_long_read(&c->_c.mfc_un.res.bytes); 2056 sr.wrong_if = atomic_long_read(&c->_c.mfc_un.res.wrong_if); 2057 rcu_read_unlock(); 2058 2059 if (copy_to_user(arg, &sr, sizeof(sr))) 2060 return -EFAULT; 2061 return 0; 2062 } 2063 rcu_read_unlock(); 2064 return -EADDRNOTAVAIL; 2065 default: 2066 return -ENOIOCTLCMD; 2067 } 2068 } 2069 #endif 2070 2071 static inline int ip6mr_forward2_finish(struct net *net, struct sock *sk, struct sk_buff *skb) 2072 { 2073 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), 2074 IPSTATS_MIB_OUTFORWDATAGRAMS); 2075 return dst_output(net, sk, skb); 2076 } 2077 2078 /* 2079 * Processing handlers for ip6mr_forward 2080 */ 2081 2082 static int ip6mr_prepare_xmit(struct net *net, struct mr_table *mrt, 2083 struct sk_buff *skb, int vifi) 2084 { 2085 struct vif_device *vif = &mrt->vif_table[vifi]; 2086 struct net_device *vif_dev; 2087 struct ipv6hdr *ipv6h; 2088 struct dst_entry *dst; 2089 struct flowi6 fl6; 2090 2091 vif_dev = vif_dev_read(vif); 2092 if (!vif_dev) 2093 return -1; 2094 2095 #ifdef CONFIG_IPV6_PIMSM_V2 2096 if (vif->flags & MIFF_REGISTER) { 2097 WRITE_ONCE(vif->pkt_out, vif->pkt_out + 1); 2098 WRITE_ONCE(vif->bytes_out, vif->bytes_out + skb->len); 2099 DEV_STATS_ADD(vif_dev, tx_bytes, skb->len); 2100 DEV_STATS_INC(vif_dev, tx_packets); 2101 ip6mr_cache_report(mrt, skb, vifi, MRT6MSG_WHOLEPKT); 2102 return -1; 2103 } 2104 #endif 2105 2106 ipv6h = ipv6_hdr(skb); 2107 2108 fl6 = (struct flowi6) { 2109 .flowi6_oif = vif->link, 2110 .daddr = ipv6h->daddr, 2111 }; 2112 2113 dst = ip6_route_output(net, NULL, &fl6); 2114 if (dst->error) { 2115 dst_release(dst); 2116 return -1; 2117 } 2118 2119 skb_dst_drop(skb); 2120 skb_dst_set(skb, dst); 2121 2122 /* 2123 * RFC1584 teaches, that DVMRP/PIM router must deliver packets locally 2124 * not only before forwarding, but after forwarding on all output 2125 * interfaces. It is clear, if mrouter runs a multicasting 2126 * program, it should receive packets not depending to what interface 2127 * program is joined. 2128 * If we will not make it, the program will have to join on all 2129 * interfaces. On the other hand, multihoming host (or router, but 2130 * not mrouter) cannot join to more than one interface - it will 2131 * result in receiving multiple packets. 2132 */ 2133 skb->dev = vif_dev; 2134 WRITE_ONCE(vif->pkt_out, vif->pkt_out + 1); 2135 WRITE_ONCE(vif->bytes_out, vif->bytes_out + skb->len); 2136 2137 /* We are about to write */ 2138 /* XXX: extension headers? */ 2139 if (skb_cow(skb, sizeof(*ipv6h) + LL_RESERVED_SPACE(vif_dev))) 2140 return -1; 2141 2142 ipv6h = ipv6_hdr(skb); 2143 ipv6h->hop_limit--; 2144 return 0; 2145 } 2146 2147 static void ip6mr_forward2(struct net *net, struct mr_table *mrt, 2148 struct sk_buff *skb, int vifi) 2149 { 2150 struct net_device *indev = skb->dev; 2151 2152 if (ip6mr_prepare_xmit(net, mrt, skb, vifi)) 2153 goto out_free; 2154 2155 IP6CB(skb)->flags |= IP6SKB_FORWARDED; 2156 2157 NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, 2158 net, NULL, skb, indev, skb->dev, 2159 ip6mr_forward2_finish); 2160 return; 2161 2162 out_free: 2163 kfree_skb(skb); 2164 } 2165 2166 static void ip6mr_output2(struct net *net, struct mr_table *mrt, 2167 struct sk_buff *skb, int vifi) 2168 { 2169 if (ip6mr_prepare_xmit(net, mrt, skb, vifi)) 2170 goto out_free; 2171 2172 ip6_output(net, NULL, skb); 2173 return; 2174 2175 out_free: 2176 kfree_skb(skb); 2177 } 2178 2179 /* Called with rcu_read_lock() */ 2180 static int ip6mr_find_vif(struct mr_table *mrt, struct net_device *dev) 2181 { 2182 int ct; 2183 2184 /* Pairs with WRITE_ONCE() in mif6_delete()/mif6_add() */ 2185 for (ct = READ_ONCE(mrt->maxvif) - 1; ct >= 0; ct--) { 2186 if (rcu_access_pointer(mrt->vif_table[ct].dev) == dev) 2187 break; 2188 } 2189 return ct; 2190 } 2191 2192 /* Called under rcu_read_lock() */ 2193 static void ip6_mr_forward(struct net *net, struct mr_table *mrt, 2194 struct net_device *dev, struct sk_buff *skb, 2195 struct mfc6_cache *c) 2196 { 2197 int psend = -1; 2198 int vif, ct; 2199 int true_vifi = ip6mr_find_vif(mrt, dev); 2200 2201 vif = c->_c.mfc_parent; 2202 atomic_long_inc(&c->_c.mfc_un.res.pkt); 2203 atomic_long_add(skb->len, &c->_c.mfc_un.res.bytes); 2204 WRITE_ONCE(c->_c.mfc_un.res.lastuse, jiffies); 2205 2206 if (ipv6_addr_any(&c->mf6c_origin) && true_vifi >= 0) { 2207 struct mfc6_cache *cache_proxy; 2208 2209 /* For an (*,G) entry, we only check that the incoming 2210 * interface is part of the static tree. 2211 */ 2212 cache_proxy = mr_mfc_find_any_parent(mrt, vif); 2213 if (cache_proxy && 2214 cache_proxy->_c.mfc_un.res.ttls[true_vifi] < 255) 2215 goto forward; 2216 } 2217 2218 /* 2219 * Wrong interface: drop packet and (maybe) send PIM assert. 2220 */ 2221 if (rcu_access_pointer(mrt->vif_table[vif].dev) != dev) { 2222 atomic_long_inc(&c->_c.mfc_un.res.wrong_if); 2223 2224 if (true_vifi >= 0 && READ_ONCE(mrt->mroute_do_assert) && 2225 /* pimsm uses asserts, when switching from RPT to SPT, 2226 so that we cannot check that packet arrived on an oif. 2227 It is bad, but otherwise we would need to move pretty 2228 large chunk of pimd to kernel. Ough... --ANK 2229 */ 2230 (READ_ONCE(mrt->mroute_do_pim) || 2231 c->_c.mfc_un.res.ttls[true_vifi] < 255) && 2232 time_after(jiffies, 2233 c->_c.mfc_un.res.last_assert + 2234 MFC_ASSERT_THRESH)) { 2235 c->_c.mfc_un.res.last_assert = jiffies; 2236 ip6mr_cache_report(mrt, skb, true_vifi, MRT6MSG_WRONGMIF); 2237 if (READ_ONCE(mrt->mroute_do_wrvifwhole)) 2238 ip6mr_cache_report(mrt, skb, true_vifi, 2239 MRT6MSG_WRMIFWHOLE); 2240 } 2241 goto dont_forward; 2242 } 2243 2244 forward: 2245 WRITE_ONCE(mrt->vif_table[vif].pkt_in, 2246 mrt->vif_table[vif].pkt_in + 1); 2247 WRITE_ONCE(mrt->vif_table[vif].bytes_in, 2248 mrt->vif_table[vif].bytes_in + skb->len); 2249 2250 /* 2251 * Forward the frame 2252 */ 2253 if (ipv6_addr_any(&c->mf6c_origin) && 2254 ipv6_addr_any(&c->mf6c_mcastgrp)) { 2255 if (true_vifi >= 0 && 2256 true_vifi != c->_c.mfc_parent && 2257 ipv6_hdr(skb)->hop_limit > 2258 c->_c.mfc_un.res.ttls[c->_c.mfc_parent]) { 2259 /* It's an (*,*) entry and the packet is not coming from 2260 * the upstream: forward the packet to the upstream 2261 * only. 2262 */ 2263 psend = c->_c.mfc_parent; 2264 goto last_forward; 2265 } 2266 goto dont_forward; 2267 } 2268 for (ct = c->_c.mfc_un.res.maxvif - 1; 2269 ct >= c->_c.mfc_un.res.minvif; ct--) { 2270 /* For (*,G) entry, don't forward to the incoming interface */ 2271 if ((!ipv6_addr_any(&c->mf6c_origin) || ct != true_vifi) && 2272 ipv6_hdr(skb)->hop_limit > c->_c.mfc_un.res.ttls[ct]) { 2273 if (psend != -1) { 2274 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC); 2275 if (skb2) 2276 ip6mr_forward2(net, mrt, skb2, psend); 2277 } 2278 psend = ct; 2279 } 2280 } 2281 last_forward: 2282 if (psend != -1) { 2283 ip6mr_forward2(net, mrt, skb, psend); 2284 return; 2285 } 2286 2287 dont_forward: 2288 kfree_skb(skb); 2289 } 2290 2291 /* Called under rcu_read_lock() */ 2292 static void ip6_mr_output_finish(struct net *net, struct mr_table *mrt, 2293 struct net_device *dev, struct sk_buff *skb, 2294 struct mfc6_cache *c) 2295 { 2296 int psend = -1; 2297 int ct; 2298 2299 WARN_ON_ONCE(!rcu_read_lock_held()); 2300 2301 atomic_long_inc(&c->_c.mfc_un.res.pkt); 2302 atomic_long_add(skb->len, &c->_c.mfc_un.res.bytes); 2303 WRITE_ONCE(c->_c.mfc_un.res.lastuse, jiffies); 2304 2305 /* Forward the frame */ 2306 if (ipv6_addr_any(&c->mf6c_origin) && 2307 ipv6_addr_any(&c->mf6c_mcastgrp)) { 2308 if (ipv6_hdr(skb)->hop_limit > 2309 c->_c.mfc_un.res.ttls[c->_c.mfc_parent]) { 2310 /* It's an (*,*) entry and the packet is not coming from 2311 * the upstream: forward the packet to the upstream 2312 * only. 2313 */ 2314 psend = c->_c.mfc_parent; 2315 goto last_forward; 2316 } 2317 goto dont_forward; 2318 } 2319 for (ct = c->_c.mfc_un.res.maxvif - 1; 2320 ct >= c->_c.mfc_un.res.minvif; ct--) { 2321 if (ipv6_hdr(skb)->hop_limit > c->_c.mfc_un.res.ttls[ct]) { 2322 if (psend != -1) { 2323 struct sk_buff *skb2; 2324 2325 skb2 = skb_clone(skb, GFP_ATOMIC); 2326 if (skb2) 2327 ip6mr_output2(net, mrt, skb2, psend); 2328 } 2329 psend = ct; 2330 } 2331 } 2332 last_forward: 2333 if (psend != -1) { 2334 ip6mr_output2(net, mrt, skb, psend); 2335 return; 2336 } 2337 2338 dont_forward: 2339 kfree_skb(skb); 2340 } 2341 2342 /* 2343 * Multicast packets for forwarding arrive here 2344 */ 2345 2346 int ip6_mr_input(struct sk_buff *skb) 2347 { 2348 struct net_device *dev = skb->dev; 2349 struct net *net = dev_net_rcu(dev); 2350 struct mfc6_cache *cache; 2351 struct mr_table *mrt; 2352 struct flowi6 fl6 = { 2353 .flowi6_iif = dev->ifindex, 2354 .flowi6_mark = skb->mark, 2355 }; 2356 int err; 2357 2358 /* skb->dev passed in is the master dev for vrfs. 2359 * Get the proper interface that does have a vif associated with it. 2360 */ 2361 if (netif_is_l3_master(dev)) { 2362 dev = dev_get_by_index_rcu(net, IPCB(skb)->iif); 2363 if (!dev) { 2364 kfree_skb(skb); 2365 return -ENODEV; 2366 } 2367 } 2368 2369 err = ip6mr_fib_lookup(net, &fl6, &mrt); 2370 if (err < 0) { 2371 kfree_skb(skb); 2372 return err; 2373 } 2374 2375 cache = ip6mr_cache_find(mrt, 2376 &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr); 2377 if (!cache) { 2378 int vif = ip6mr_find_vif(mrt, dev); 2379 2380 if (vif >= 0) 2381 cache = ip6mr_cache_find_any(mrt, 2382 &ipv6_hdr(skb)->daddr, 2383 vif); 2384 } 2385 2386 /* 2387 * No usable cache entry 2388 */ 2389 if (!cache) { 2390 int vif; 2391 2392 vif = ip6mr_find_vif(mrt, dev); 2393 if (vif >= 0) { 2394 int err = ip6mr_cache_unresolved(mrt, vif, skb, dev); 2395 2396 return err; 2397 } 2398 kfree_skb(skb); 2399 return -ENODEV; 2400 } 2401 2402 ip6_mr_forward(net, mrt, dev, skb, cache); 2403 2404 return 0; 2405 } 2406 2407 int ip6_mr_output(struct net *net, struct sock *sk, struct sk_buff *skb) 2408 { 2409 struct net_device *dev = skb_dst(skb)->dev; 2410 struct flowi6 fl6 = (struct flowi6) { 2411 .flowi6_iif = LOOPBACK_IFINDEX, 2412 .flowi6_mark = skb->mark, 2413 }; 2414 struct mfc6_cache *cache; 2415 struct mr_table *mrt; 2416 int err; 2417 int vif; 2418 2419 guard(rcu)(); 2420 2421 if (IP6CB(skb)->flags & IP6SKB_FORWARDED) 2422 goto ip6_output; 2423 if (!(IP6CB(skb)->flags & IP6SKB_MCROUTE)) 2424 goto ip6_output; 2425 2426 err = ip6mr_fib_lookup(net, &fl6, &mrt); 2427 if (err < 0) { 2428 kfree_skb(skb); 2429 return err; 2430 } 2431 2432 cache = ip6mr_cache_find(mrt, 2433 &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr); 2434 if (!cache) { 2435 vif = ip6mr_find_vif(mrt, dev); 2436 if (vif >= 0) 2437 cache = ip6mr_cache_find_any(mrt, 2438 &ipv6_hdr(skb)->daddr, 2439 vif); 2440 } 2441 2442 /* No usable cache entry */ 2443 if (!cache) { 2444 vif = ip6mr_find_vif(mrt, dev); 2445 if (vif >= 0) 2446 return ip6mr_cache_unresolved(mrt, vif, skb, dev); 2447 goto ip6_output; 2448 } 2449 2450 /* Wrong interface */ 2451 vif = cache->_c.mfc_parent; 2452 if (rcu_access_pointer(mrt->vif_table[vif].dev) != dev) 2453 goto ip6_output; 2454 2455 ip6_mr_output_finish(net, mrt, dev, skb, cache); 2456 return 0; 2457 2458 ip6_output: 2459 return ip6_output(net, sk, skb); 2460 } 2461 2462 int ip6mr_get_route(struct net *net, struct sk_buff *skb, struct rtmsg *rtm, 2463 u32 portid) 2464 { 2465 int err; 2466 struct mr_table *mrt; 2467 struct mfc6_cache *cache; 2468 struct rt6_info *rt = dst_rt6_info(skb_dst(skb)); 2469 2470 rcu_read_lock(); 2471 mrt = __ip6mr_get_table(net, RT6_TABLE_DFLT); 2472 if (!mrt) { 2473 rcu_read_unlock(); 2474 return -ENOENT; 2475 } 2476 2477 cache = ip6mr_cache_find(mrt, &rt->rt6i_src.addr, &rt->rt6i_dst.addr); 2478 if (!cache && skb->dev) { 2479 int vif = ip6mr_find_vif(mrt, skb->dev); 2480 2481 if (vif >= 0) 2482 cache = ip6mr_cache_find_any(mrt, &rt->rt6i_dst.addr, 2483 vif); 2484 } 2485 2486 if (!cache) { 2487 struct sk_buff *skb2; 2488 struct ipv6hdr *iph; 2489 struct net_device *dev; 2490 int vif; 2491 2492 dev = skb->dev; 2493 if (!dev || (vif = ip6mr_find_vif(mrt, dev)) < 0) { 2494 rcu_read_unlock(); 2495 return -ENODEV; 2496 } 2497 2498 /* really correct? */ 2499 skb2 = alloc_skb(sizeof(struct ipv6hdr), GFP_ATOMIC); 2500 if (!skb2) { 2501 rcu_read_unlock(); 2502 return -ENOMEM; 2503 } 2504 2505 NETLINK_CB(skb2).portid = portid; 2506 skb_reset_transport_header(skb2); 2507 2508 skb_put(skb2, sizeof(struct ipv6hdr)); 2509 skb_reset_network_header(skb2); 2510 2511 iph = ipv6_hdr(skb2); 2512 iph->version = 0; 2513 iph->priority = 0; 2514 iph->flow_lbl[0] = 0; 2515 iph->flow_lbl[1] = 0; 2516 iph->flow_lbl[2] = 0; 2517 iph->payload_len = 0; 2518 iph->nexthdr = IPPROTO_NONE; 2519 iph->hop_limit = 0; 2520 iph->saddr = rt->rt6i_src.addr; 2521 iph->daddr = rt->rt6i_dst.addr; 2522 2523 err = ip6mr_cache_unresolved(mrt, vif, skb2, dev); 2524 rcu_read_unlock(); 2525 2526 return err; 2527 } 2528 2529 err = mr_fill_mroute(mrt, skb, &cache->_c, rtm); 2530 rcu_read_unlock(); 2531 return err; 2532 } 2533 2534 static int ip6mr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb, 2535 u32 portid, u32 seq, struct mfc6_cache *c, int cmd, 2536 int flags) 2537 { 2538 struct nlmsghdr *nlh; 2539 struct rtmsg *rtm; 2540 int err; 2541 2542 nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), flags); 2543 if (!nlh) 2544 return -EMSGSIZE; 2545 2546 rtm = nlmsg_data(nlh); 2547 rtm->rtm_family = RTNL_FAMILY_IP6MR; 2548 rtm->rtm_dst_len = 128; 2549 rtm->rtm_src_len = 128; 2550 rtm->rtm_tos = 0; 2551 rtm->rtm_table = mrt->id; 2552 if (nla_put_u32(skb, RTA_TABLE, mrt->id)) 2553 goto nla_put_failure; 2554 rtm->rtm_type = RTN_MULTICAST; 2555 rtm->rtm_scope = RT_SCOPE_UNIVERSE; 2556 if (c->_c.mfc_flags & MFC_STATIC) 2557 rtm->rtm_protocol = RTPROT_STATIC; 2558 else 2559 rtm->rtm_protocol = RTPROT_MROUTED; 2560 rtm->rtm_flags = 0; 2561 2562 if (nla_put_in6_addr(skb, RTA_SRC, &c->mf6c_origin) || 2563 nla_put_in6_addr(skb, RTA_DST, &c->mf6c_mcastgrp)) 2564 goto nla_put_failure; 2565 err = mr_fill_mroute(mrt, skb, &c->_c, rtm); 2566 /* do not break the dump if cache is unresolved */ 2567 if (err < 0 && err != -ENOENT) 2568 goto nla_put_failure; 2569 2570 nlmsg_end(skb, nlh); 2571 return 0; 2572 2573 nla_put_failure: 2574 nlmsg_cancel(skb, nlh); 2575 return -EMSGSIZE; 2576 } 2577 2578 static int _ip6mr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb, 2579 u32 portid, u32 seq, struct mr_mfc *c, 2580 int cmd, int flags) 2581 { 2582 return ip6mr_fill_mroute(mrt, skb, portid, seq, (struct mfc6_cache *)c, 2583 cmd, flags); 2584 } 2585 2586 static int mr6_msgsize(bool unresolved) 2587 { 2588 size_t len = 2589 NLMSG_ALIGN(sizeof(struct rtmsg)) 2590 + nla_total_size(4) /* RTA_TABLE */ 2591 + nla_total_size(sizeof(struct in6_addr)) /* RTA_SRC */ 2592 + nla_total_size(sizeof(struct in6_addr)) /* RTA_DST */ 2593 ; 2594 2595 if (!unresolved) 2596 len = len 2597 + nla_total_size(4) /* RTA_IIF */ 2598 + nla_total_size(0) /* RTA_MULTIPATH */ 2599 + MAXMIFS * NLA_ALIGN(sizeof(struct rtnexthop)) 2600 /* RTA_MFC_STATS */ 2601 + nla_total_size_64bit(sizeof(struct rta_mfc_stats)) 2602 ; 2603 2604 return len; 2605 } 2606 2607 static void mr6_netlink_event(struct mr_table *mrt, struct mfc6_cache *mfc, 2608 int cmd) 2609 { 2610 struct net *net = read_pnet(&mrt->net); 2611 struct sk_buff *skb; 2612 int err = -ENOBUFS; 2613 2614 skb = nlmsg_new(mr6_msgsize(mfc->_c.mfc_parent >= MAXMIFS), GFP_ATOMIC); 2615 if (!skb) 2616 goto errout; 2617 2618 err = ip6mr_fill_mroute(mrt, skb, 0, 0, mfc, cmd, 0); 2619 if (err < 0) 2620 goto errout; 2621 2622 rtnl_notify(skb, net, 0, RTNLGRP_IPV6_MROUTE, NULL, GFP_ATOMIC); 2623 return; 2624 2625 errout: 2626 kfree_skb(skb); 2627 rtnl_set_sk_err(net, RTNLGRP_IPV6_MROUTE, err); 2628 } 2629 2630 static size_t mrt6msg_netlink_msgsize(size_t payloadlen) 2631 { 2632 size_t len = 2633 NLMSG_ALIGN(sizeof(struct rtgenmsg)) 2634 + nla_total_size(1) /* IP6MRA_CREPORT_MSGTYPE */ 2635 + nla_total_size(4) /* IP6MRA_CREPORT_MIF_ID */ 2636 /* IP6MRA_CREPORT_SRC_ADDR */ 2637 + nla_total_size(sizeof(struct in6_addr)) 2638 /* IP6MRA_CREPORT_DST_ADDR */ 2639 + nla_total_size(sizeof(struct in6_addr)) 2640 /* IP6MRA_CREPORT_PKT */ 2641 + nla_total_size(payloadlen) 2642 ; 2643 2644 return len; 2645 } 2646 2647 static void mrt6msg_netlink_event(const struct mr_table *mrt, struct sk_buff *pkt) 2648 { 2649 struct net *net = read_pnet(&mrt->net); 2650 struct nlmsghdr *nlh; 2651 struct rtgenmsg *rtgenm; 2652 struct mrt6msg *msg; 2653 struct sk_buff *skb; 2654 struct nlattr *nla; 2655 int payloadlen; 2656 2657 payloadlen = pkt->len - sizeof(struct mrt6msg); 2658 msg = (struct mrt6msg *)skb_transport_header(pkt); 2659 2660 skb = nlmsg_new(mrt6msg_netlink_msgsize(payloadlen), GFP_ATOMIC); 2661 if (!skb) 2662 goto errout; 2663 2664 nlh = nlmsg_put(skb, 0, 0, RTM_NEWCACHEREPORT, 2665 sizeof(struct rtgenmsg), 0); 2666 if (!nlh) 2667 goto errout; 2668 rtgenm = nlmsg_data(nlh); 2669 rtgenm->rtgen_family = RTNL_FAMILY_IP6MR; 2670 if (nla_put_u8(skb, IP6MRA_CREPORT_MSGTYPE, msg->im6_msgtype) || 2671 nla_put_u32(skb, IP6MRA_CREPORT_MIF_ID, msg->im6_mif) || 2672 nla_put_in6_addr(skb, IP6MRA_CREPORT_SRC_ADDR, 2673 &msg->im6_src) || 2674 nla_put_in6_addr(skb, IP6MRA_CREPORT_DST_ADDR, 2675 &msg->im6_dst)) 2676 goto nla_put_failure; 2677 2678 nla = nla_reserve(skb, IP6MRA_CREPORT_PKT, payloadlen); 2679 if (!nla || skb_copy_bits(pkt, sizeof(struct mrt6msg), 2680 nla_data(nla), payloadlen)) 2681 goto nla_put_failure; 2682 2683 nlmsg_end(skb, nlh); 2684 2685 rtnl_notify(skb, net, 0, RTNLGRP_IPV6_MROUTE_R, NULL, GFP_ATOMIC); 2686 return; 2687 2688 nla_put_failure: 2689 nlmsg_cancel(skb, nlh); 2690 errout: 2691 kfree_skb(skb); 2692 rtnl_set_sk_err(net, RTNLGRP_IPV6_MROUTE_R, -ENOBUFS); 2693 } 2694 2695 static const struct nla_policy ip6mr_getroute_policy[RTA_MAX + 1] = { 2696 [RTA_SRC] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)), 2697 [RTA_DST] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)), 2698 [RTA_TABLE] = { .type = NLA_U32 }, 2699 }; 2700 2701 static int ip6mr_rtm_valid_getroute_req(struct sk_buff *skb, 2702 const struct nlmsghdr *nlh, 2703 struct nlattr **tb, 2704 struct netlink_ext_ack *extack) 2705 { 2706 struct rtmsg *rtm; 2707 int err; 2708 2709 err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, ip6mr_getroute_policy, 2710 extack); 2711 if (err) 2712 return err; 2713 2714 rtm = nlmsg_data(nlh); 2715 if ((rtm->rtm_src_len && rtm->rtm_src_len != 128) || 2716 (rtm->rtm_dst_len && rtm->rtm_dst_len != 128) || 2717 rtm->rtm_tos || rtm->rtm_table || rtm->rtm_protocol || 2718 rtm->rtm_scope || rtm->rtm_type || rtm->rtm_flags) { 2719 NL_SET_ERR_MSG_MOD(extack, 2720 "Invalid values in header for multicast route get request"); 2721 return -EINVAL; 2722 } 2723 2724 if ((tb[RTA_SRC] && !rtm->rtm_src_len) || 2725 (tb[RTA_DST] && !rtm->rtm_dst_len)) { 2726 NL_SET_ERR_MSG_MOD(extack, "rtm_src_len and rtm_dst_len must be 128 for IPv6"); 2727 return -EINVAL; 2728 } 2729 2730 return 0; 2731 } 2732 2733 static int ip6mr_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, 2734 struct netlink_ext_ack *extack) 2735 { 2736 struct net *net = sock_net(in_skb->sk); 2737 struct in6_addr src = {}, grp = {}; 2738 struct nlattr *tb[RTA_MAX + 1]; 2739 struct mfc6_cache *cache; 2740 struct mr_table *mrt; 2741 struct sk_buff *skb; 2742 u32 tableid; 2743 int err; 2744 2745 err = ip6mr_rtm_valid_getroute_req(in_skb, nlh, tb, extack); 2746 if (err < 0) 2747 return err; 2748 2749 skb = nlmsg_new(mr6_msgsize(false), GFP_KERNEL); 2750 if (!skb) 2751 return -ENOBUFS; 2752 2753 if (tb[RTA_SRC]) 2754 src = nla_get_in6_addr(tb[RTA_SRC]); 2755 if (tb[RTA_DST]) 2756 grp = nla_get_in6_addr(tb[RTA_DST]); 2757 tableid = nla_get_u32_default(tb[RTA_TABLE], 0); 2758 2759 rcu_read_lock(); 2760 2761 mrt = __ip6mr_get_table(net, tableid ?: RT_TABLE_DEFAULT); 2762 if (!mrt) { 2763 NL_SET_ERR_MSG_MOD(extack, "MR table does not exist"); 2764 err = -ENOENT; 2765 goto err; 2766 } 2767 2768 cache = ip6mr_cache_find(mrt, &src, &grp); 2769 if (!cache) { 2770 NL_SET_ERR_MSG_MOD(extack, "MR cache entry not found"); 2771 err = -ENOENT; 2772 goto err; 2773 } 2774 2775 err = ip6mr_fill_mroute(mrt, skb, NETLINK_CB(in_skb).portid, 2776 nlh->nlmsg_seq, cache, RTM_NEWROUTE, 0); 2777 if (err < 0) 2778 goto err; 2779 2780 rcu_read_unlock(); 2781 2782 return rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid); 2783 2784 err: 2785 rcu_read_unlock(); 2786 kfree_skb(skb); 2787 return err; 2788 } 2789 2790 static int ip6mr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb) 2791 { 2792 const struct nlmsghdr *nlh = cb->nlh; 2793 struct fib_dump_filter filter = {}; 2794 int err; 2795 2796 rcu_read_lock(); 2797 2798 if (cb->strict_check) { 2799 err = ip_valid_fib_dump_req(sock_net(skb->sk), nlh, 2800 &filter, cb); 2801 if (err < 0) 2802 goto unlock; 2803 } 2804 2805 if (filter.table_id) { 2806 struct mr_table *mrt; 2807 2808 mrt = __ip6mr_get_table(sock_net(skb->sk), filter.table_id); 2809 if (!mrt) { 2810 if (rtnl_msg_family(cb->nlh) != RTNL_FAMILY_IP6MR) { 2811 err = skb->len; 2812 goto unlock; 2813 } 2814 2815 NL_SET_ERR_MSG_MOD(cb->extack, "MR table does not exist"); 2816 err = -ENOENT; 2817 goto unlock; 2818 } 2819 2820 err = mr_table_dump(mrt, skb, cb, _ip6mr_fill_mroute, 2821 &mfc_unres_lock, &filter); 2822 err = skb->len ? : err; 2823 goto unlock; 2824 } 2825 2826 err = mr_rtm_dumproute(skb, cb, ip6mr_mr_table_iter, 2827 _ip6mr_fill_mroute, &mfc_unres_lock, &filter); 2828 unlock: 2829 rcu_read_unlock(); 2830 2831 return err; 2832 } 2833