1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Linux IPv6 multicast routing support for BSD pim6sd 4 * Based on net/ipv4/ipmr.c. 5 * 6 * (c) 2004 Mickael Hoerdt, <hoerdt@clarinet.u-strasbg.fr> 7 * LSIIT Laboratory, Strasbourg, France 8 * (c) 2004 Jean-Philippe Andriot, <jean-philippe.andriot@6WIND.com> 9 * 6WIND, Paris, France 10 * Copyright (C)2007,2008 USAGI/WIDE Project 11 * YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> 12 */ 13 14 #include <linux/uaccess.h> 15 #include <linux/types.h> 16 #include <linux/sched.h> 17 #include <linux/errno.h> 18 #include <linux/mm.h> 19 #include <linux/kernel.h> 20 #include <linux/fcntl.h> 21 #include <linux/stat.h> 22 #include <linux/socket.h> 23 #include <linux/inet.h> 24 #include <linux/netdevice.h> 25 #include <linux/inetdevice.h> 26 #include <linux/proc_fs.h> 27 #include <linux/seq_file.h> 28 #include <linux/init.h> 29 #include <linux/compat.h> 30 #include <linux/rhashtable.h> 31 #include <net/protocol.h> 32 #include <linux/skbuff.h> 33 #include <net/raw.h> 34 #include <linux/notifier.h> 35 #include <linux/if_arp.h> 36 #include <net/checksum.h> 37 #include <net/netlink.h> 38 #include <net/fib_rules.h> 39 40 #include <net/ipv6.h> 41 #include <net/ip6_route.h> 42 #include <linux/mroute6.h> 43 #include <linux/pim.h> 44 #include <net/addrconf.h> 45 #include <linux/netfilter_ipv6.h> 46 #include <linux/export.h> 47 #include <net/ip6_checksum.h> 48 #include <linux/netconf.h> 49 #include <net/ip_tunnels.h> 50 51 #include <linux/nospec.h> 52 53 struct ip6mr_rule { 54 struct fib_rule common; 55 }; 56 57 struct ip6mr_result { 58 struct mr_table *mrt; 59 }; 60 61 /* Big lock, protecting vif table, mrt cache and mroute socket state. 62 Note that the changes are semaphored via rtnl_lock. 63 */ 64 65 static DEFINE_SPINLOCK(mrt_lock); 66 67 static struct net_device *vif_dev_read(const struct vif_device *vif) 68 { 69 return rcu_dereference(vif->dev); 70 } 71 72 /* Multicast router control variables */ 73 74 /* Special spinlock for queue of unresolved entries */ 75 static DEFINE_SPINLOCK(mfc_unres_lock); 76 77 /* We return to original Alan's scheme. Hash table of resolved 78 entries is changed only in process context and protected 79 with weak lock mrt_lock. Queue of unresolved entries is protected 80 with strong spinlock mfc_unres_lock. 81 82 In this case data path is free of exclusive locks at all. 83 */ 84 85 static struct kmem_cache *mrt_cachep __read_mostly; 86 87 static struct mr_table *ip6mr_new_table(struct net *net, u32 id); 88 static void ip6mr_free_table(struct mr_table *mrt, 89 struct list_head *dev_kill_list); 90 91 static void ip6_mr_forward(struct net *net, struct mr_table *mrt, 92 struct net_device *dev, struct sk_buff *skb, 93 struct mfc6_cache *cache); 94 static int ip6mr_cache_report(const struct mr_table *mrt, struct sk_buff *pkt, 95 mifi_t mifi, int assert); 96 static void mr6_netlink_event(struct mr_table *mrt, struct mfc6_cache *mfc, 97 int cmd); 98 static void mrt6msg_netlink_event(const struct mr_table *mrt, struct sk_buff *pkt); 99 static int ip6mr_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, 100 struct netlink_ext_ack *extack); 101 static int ip6mr_rtm_dumproute(struct sk_buff *skb, 102 struct netlink_callback *cb); 103 static void mroute_clean_tables(struct mr_table *mrt, int flags, 104 struct list_head *dev_kill_list); 105 static void ipmr_expire_process(struct timer_list *t); 106 107 #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES 108 #define ip6mr_for_each_table(mrt, net) \ 109 list_for_each_entry_rcu(mrt, &net->ipv6.mr6_tables, list, \ 110 lockdep_rtnl_is_held() || \ 111 list_empty(&net->ipv6.mr6_tables)) 112 113 static struct mr_table *ip6mr_mr_table_iter(struct net *net, 114 struct mr_table *mrt) 115 { 116 struct mr_table *ret; 117 118 if (!mrt) 119 ret = list_entry_rcu(net->ipv6.mr6_tables.next, 120 struct mr_table, list); 121 else 122 ret = list_entry_rcu(mrt->list.next, 123 struct mr_table, list); 124 125 if (&ret->list == &net->ipv6.mr6_tables) 126 return NULL; 127 return ret; 128 } 129 130 static struct mr_table *__ip6mr_get_table(struct net *net, u32 id) 131 { 132 struct mr_table *mrt; 133 134 ip6mr_for_each_table(mrt, net) { 135 if (mrt->id == id) 136 return mrt; 137 } 138 return NULL; 139 } 140 141 static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6, 142 struct mr_table **mrt) 143 { 144 int err; 145 struct ip6mr_result res; 146 struct fib_lookup_arg arg = { 147 .result = &res, 148 .flags = FIB_LOOKUP_NOREF, 149 }; 150 151 /* update flow if oif or iif point to device enslaved to l3mdev */ 152 l3mdev_update_flow(net, flowi6_to_flowi(flp6)); 153 154 err = fib_rules_lookup(net->ipv6.mr6_rules_ops, 155 flowi6_to_flowi(flp6), 0, &arg); 156 if (err < 0) 157 return err; 158 *mrt = res.mrt; 159 return 0; 160 } 161 162 static int ip6mr_rule_action(struct fib_rule *rule, struct flowi *flp, 163 int flags, struct fib_lookup_arg *arg) 164 { 165 struct ip6mr_result *res = arg->result; 166 struct mr_table *mrt; 167 168 switch (rule->action) { 169 case FR_ACT_TO_TBL: 170 break; 171 case FR_ACT_UNREACHABLE: 172 return -ENETUNREACH; 173 case FR_ACT_PROHIBIT: 174 return -EACCES; 175 case FR_ACT_BLACKHOLE: 176 default: 177 return -EINVAL; 178 } 179 180 arg->table = fib_rule_get_table(rule, arg); 181 182 mrt = __ip6mr_get_table(rule->fr_net, arg->table); 183 if (!mrt) 184 return -EAGAIN; 185 res->mrt = mrt; 186 return 0; 187 } 188 189 static int ip6mr_rule_match(struct fib_rule *rule, struct flowi *flp, int flags) 190 { 191 return 1; 192 } 193 194 static int ip6mr_rule_configure(struct fib_rule *rule, struct sk_buff *skb, 195 struct fib_rule_hdr *frh, struct nlattr **tb, 196 struct netlink_ext_ack *extack) 197 { 198 return 0; 199 } 200 201 static int ip6mr_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh, 202 struct nlattr **tb) 203 { 204 return 1; 205 } 206 207 static int ip6mr_rule_fill(struct fib_rule *rule, struct sk_buff *skb, 208 struct fib_rule_hdr *frh) 209 { 210 frh->dst_len = 0; 211 frh->src_len = 0; 212 frh->tos = 0; 213 return 0; 214 } 215 216 static const struct fib_rules_ops __net_initconst ip6mr_rules_ops_template = { 217 .family = RTNL_FAMILY_IP6MR, 218 .rule_size = sizeof(struct ip6mr_rule), 219 .addr_size = sizeof(struct in6_addr), 220 .action = ip6mr_rule_action, 221 .match = ip6mr_rule_match, 222 .configure = ip6mr_rule_configure, 223 .compare = ip6mr_rule_compare, 224 .fill = ip6mr_rule_fill, 225 .nlgroup = RTNLGRP_IPV6_RULE, 226 .owner = THIS_MODULE, 227 }; 228 229 static int __net_init ip6mr_rules_init(struct net *net) 230 { 231 struct fib_rules_ops *ops; 232 LIST_HEAD(dev_kill_list); 233 struct mr_table *mrt; 234 int err; 235 236 ops = fib_rules_register(&ip6mr_rules_ops_template, net); 237 if (IS_ERR(ops)) 238 return PTR_ERR(ops); 239 240 INIT_LIST_HEAD(&net->ipv6.mr6_tables); 241 242 mrt = ip6mr_new_table(net, RT6_TABLE_DFLT); 243 if (IS_ERR(mrt)) { 244 err = PTR_ERR(mrt); 245 goto err1; 246 } 247 248 err = fib_default_rule_add(ops, 0x7fff, RT6_TABLE_DFLT); 249 if (err < 0) 250 goto err2; 251 252 net->ipv6.mr6_rules_ops = ops; 253 return 0; 254 255 err2: 256 ip6mr_free_table(mrt, &dev_kill_list); 257 err1: 258 fib_rules_unregister(ops); 259 return err; 260 } 261 262 static void __net_exit ip6mr_rules_exit(struct net *net) 263 { 264 fib_rules_unregister(net->ipv6.mr6_rules_ops); 265 } 266 267 static void __net_exit ip6mr_rules_exit_rtnl(struct net *net, 268 struct list_head *dev_kill_list) 269 { 270 struct mr_table *mrt, *next; 271 272 list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) { 273 list_del_rcu(&mrt->list); 274 ip6mr_free_table(mrt, dev_kill_list); 275 } 276 } 277 278 static int ip6mr_rules_dump(struct net *net, struct notifier_block *nb, 279 struct netlink_ext_ack *extack) 280 { 281 return fib_rules_dump(net, nb, RTNL_FAMILY_IP6MR, extack); 282 } 283 284 static unsigned int ip6mr_rules_seq_read(const struct net *net) 285 { 286 return fib_rules_seq_read(net, RTNL_FAMILY_IP6MR); 287 } 288 289 bool ip6mr_rule_default(const struct fib_rule *rule) 290 { 291 return fib_rule_matchall(rule) && rule->action == FR_ACT_TO_TBL && 292 rule->table == RT6_TABLE_DFLT && !rule->l3mdev; 293 } 294 EXPORT_SYMBOL(ip6mr_rule_default); 295 #else 296 static struct mr_table *ip6mr_mr_table_iter(struct net *net, 297 struct mr_table *mrt) 298 { 299 if (!mrt) 300 return rcu_dereference(net->ipv6.mrt6); 301 return NULL; 302 } 303 304 static struct mr_table *__ip6mr_get_table(struct net *net, u32 id) 305 { 306 return rcu_dereference_check(net->ipv6.mrt6, 307 lockdep_rtnl_is_held() || 308 !rcu_access_pointer(net->ipv6.mrt6)); 309 } 310 311 #define ip6mr_for_each_table(mrt, net) \ 312 for (mrt = __ip6mr_get_table(net, 0); mrt; mrt = NULL) 313 314 static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6, 315 struct mr_table **mrt) 316 { 317 *mrt = rcu_dereference(net->ipv6.mrt6); 318 if (!*mrt) 319 return -EAGAIN; 320 return 0; 321 } 322 323 static int __net_init ip6mr_rules_init(struct net *net) 324 { 325 struct mr_table *mrt; 326 327 mrt = ip6mr_new_table(net, RT6_TABLE_DFLT); 328 if (IS_ERR(mrt)) 329 return PTR_ERR(mrt); 330 331 rcu_assign_pointer(net->ipv6.mrt6, mrt); 332 return 0; 333 } 334 335 static void __net_exit ip6mr_rules_exit(struct net *net) 336 { 337 } 338 339 static void __net_exit ip6mr_rules_exit_rtnl(struct net *net, 340 struct list_head *dev_kill_list) 341 { 342 struct mr_table *mrt = rcu_dereference_protected(net->ipv6.mrt6, 1); 343 344 RCU_INIT_POINTER(net->ipv6.mrt6, NULL); 345 ip6mr_free_table(mrt, dev_kill_list); 346 } 347 348 static int ip6mr_rules_dump(struct net *net, struct notifier_block *nb, 349 struct netlink_ext_ack *extack) 350 { 351 return 0; 352 } 353 354 static unsigned int ip6mr_rules_seq_read(const struct net *net) 355 { 356 return 0; 357 } 358 #endif 359 360 static struct mr_table *ip6mr_get_table(struct net *net, u32 id) 361 { 362 struct mr_table *mrt; 363 364 rcu_read_lock(); 365 mrt = __ip6mr_get_table(net, id); 366 rcu_read_unlock(); 367 368 return mrt; 369 } 370 371 static int ip6mr_hash_cmp(struct rhashtable_compare_arg *arg, 372 const void *ptr) 373 { 374 const struct mfc6_cache_cmp_arg *cmparg = arg->key; 375 struct mfc6_cache *c = (struct mfc6_cache *)ptr; 376 377 return !ipv6_addr_equal(&c->mf6c_mcastgrp, &cmparg->mf6c_mcastgrp) || 378 !ipv6_addr_equal(&c->mf6c_origin, &cmparg->mf6c_origin); 379 } 380 381 static const struct rhashtable_params ip6mr_rht_params = { 382 .head_offset = offsetof(struct mr_mfc, mnode), 383 .key_offset = offsetof(struct mfc6_cache, cmparg), 384 .key_len = sizeof(struct mfc6_cache_cmp_arg), 385 .nelem_hint = 3, 386 .obj_cmpfn = ip6mr_hash_cmp, 387 .automatic_shrinking = true, 388 }; 389 390 static void ip6mr_new_table_set(struct mr_table *mrt, 391 struct net *net) 392 { 393 #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES 394 list_add_tail_rcu(&mrt->list, &net->ipv6.mr6_tables); 395 #endif 396 } 397 398 static struct mfc6_cache_cmp_arg ip6mr_mr_table_ops_cmparg_any = { 399 .mf6c_origin = IN6ADDR_ANY_INIT, 400 .mf6c_mcastgrp = IN6ADDR_ANY_INIT, 401 }; 402 403 static struct mr_table_ops ip6mr_mr_table_ops = { 404 .rht_params = &ip6mr_rht_params, 405 .cmparg_any = &ip6mr_mr_table_ops_cmparg_any, 406 }; 407 408 static struct mr_table *ip6mr_new_table(struct net *net, u32 id) 409 { 410 struct mr_table *mrt; 411 412 mrt = __ip6mr_get_table(net, id); 413 if (mrt) 414 return mrt; 415 416 return mr_table_alloc(net, id, &ip6mr_mr_table_ops, 417 ipmr_expire_process, ip6mr_new_table_set); 418 } 419 420 static void ip6mr_free_table(struct mr_table *mrt, 421 struct list_head *dev_kill_list) 422 { 423 struct net *net = read_pnet(&mrt->net); 424 LIST_HEAD(ip6mr_dev_kill_list); 425 426 WARN_ON_ONCE(!mr_can_free_table(net)); 427 428 timer_shutdown_sync(&mrt->ipmr_expire_timer); 429 mroute_clean_tables(mrt, MRT6_FLUSH_MIFS | MRT6_FLUSH_MIFS_STATIC | 430 MRT6_FLUSH_MFC | MRT6_FLUSH_MFC_STATIC, 431 &ip6mr_dev_kill_list); 432 433 mr_table_free(mrt); 434 435 WARN_ON_ONCE(!net_initialized(net) && !list_empty(&ip6mr_dev_kill_list)); 436 list_splice(&ip6mr_dev_kill_list, dev_kill_list); 437 } 438 439 #ifdef CONFIG_PROC_FS 440 /* The /proc interfaces to multicast routing 441 * /proc/ip6_mr_cache /proc/ip6_mr_vif 442 */ 443 444 static void *ip6mr_vif_seq_start(struct seq_file *seq, loff_t *pos) 445 __acquires(RCU) 446 { 447 struct mr_vif_iter *iter = seq->private; 448 struct net *net = seq_file_net(seq); 449 struct mr_table *mrt; 450 451 rcu_read_lock(); 452 mrt = __ip6mr_get_table(net, RT6_TABLE_DFLT); 453 if (!mrt) { 454 rcu_read_unlock(); 455 return ERR_PTR(-ENOENT); 456 } 457 458 iter->mrt = mrt; 459 460 return mr_vif_seq_start(seq, pos); 461 } 462 463 static void ip6mr_vif_seq_stop(struct seq_file *seq, void *v) 464 __releases(RCU) 465 { 466 rcu_read_unlock(); 467 } 468 469 static int ip6mr_vif_seq_show(struct seq_file *seq, void *v) 470 { 471 struct mr_vif_iter *iter = seq->private; 472 struct mr_table *mrt = iter->mrt; 473 474 if (v == SEQ_START_TOKEN) { 475 seq_puts(seq, 476 "Interface BytesIn PktsIn BytesOut PktsOut Flags\n"); 477 } else { 478 const struct vif_device *vif = v; 479 const struct net_device *vif_dev; 480 const char *name; 481 482 vif_dev = vif_dev_read(vif); 483 name = vif_dev ? vif_dev->name : "none"; 484 485 seq_printf(seq, 486 "%2td %-10s %8ld %7ld %8ld %7ld %05X\n", 487 vif - mrt->vif_table, 488 name, 489 READ_ONCE(vif->bytes_in), READ_ONCE(vif->pkt_in), 490 READ_ONCE(vif->bytes_out), READ_ONCE(vif->pkt_out), 491 vif->flags); 492 } 493 return 0; 494 } 495 496 static const struct seq_operations ip6mr_vif_seq_ops = { 497 .start = ip6mr_vif_seq_start, 498 .next = mr_vif_seq_next, 499 .stop = ip6mr_vif_seq_stop, 500 .show = ip6mr_vif_seq_show, 501 }; 502 503 static void *ipmr_mfc_seq_start(struct seq_file *seq, loff_t *pos) 504 { 505 struct net *net = seq_file_net(seq); 506 struct mr_table *mrt; 507 508 mrt = ip6mr_get_table(net, RT6_TABLE_DFLT); 509 if (!mrt) 510 return ERR_PTR(-ENOENT); 511 512 return mr_mfc_seq_start(seq, pos, mrt, &mfc_unres_lock); 513 } 514 515 static int ipmr_mfc_seq_show(struct seq_file *seq, void *v) 516 { 517 int n; 518 519 if (v == SEQ_START_TOKEN) { 520 seq_puts(seq, 521 "Group " 522 "Origin " 523 "Iif Pkts Bytes Wrong Oifs\n"); 524 } else { 525 const struct mfc6_cache *mfc = v; 526 const struct mr_mfc_iter *it = seq->private; 527 struct mr_table *mrt = it->mrt; 528 529 seq_printf(seq, "%pI6 %pI6 %-3hd", 530 &mfc->mf6c_mcastgrp, &mfc->mf6c_origin, 531 mfc->_c.mfc_parent); 532 533 if (it->cache != &mrt->mfc_unres_queue) { 534 seq_printf(seq, " %8lu %8lu %8lu", 535 atomic_long_read(&mfc->_c.mfc_un.res.pkt), 536 atomic_long_read(&mfc->_c.mfc_un.res.bytes), 537 atomic_long_read(&mfc->_c.mfc_un.res.wrong_if)); 538 for (n = mfc->_c.mfc_un.res.minvif; 539 n < mfc->_c.mfc_un.res.maxvif; n++) { 540 if (VIF_EXISTS(mrt, n) && 541 mfc->_c.mfc_un.res.ttls[n] < 255) 542 seq_printf(seq, 543 " %2d:%-3d", n, 544 mfc->_c.mfc_un.res.ttls[n]); 545 } 546 } else { 547 /* unresolved mfc_caches don't contain 548 * pkt, bytes and wrong_if values 549 */ 550 seq_printf(seq, " %8lu %8lu %8lu", 0ul, 0ul, 0ul); 551 } 552 seq_putc(seq, '\n'); 553 } 554 return 0; 555 } 556 557 static const struct seq_operations ipmr_mfc_seq_ops = { 558 .start = ipmr_mfc_seq_start, 559 .next = mr_mfc_seq_next, 560 .stop = mr_mfc_seq_stop, 561 .show = ipmr_mfc_seq_show, 562 }; 563 #endif 564 565 #ifdef CONFIG_IPV6_PIMSM_V2 566 567 static int pim6_rcv(struct sk_buff *skb) 568 { 569 struct pimreghdr *pim; 570 struct ipv6hdr *encap; 571 struct net_device *reg_dev = NULL; 572 struct net *net = dev_net(skb->dev); 573 struct mr_table *mrt; 574 struct flowi6 fl6 = { 575 .flowi6_iif = skb->dev->ifindex, 576 .flowi6_mark = skb->mark, 577 }; 578 int reg_vif_num; 579 580 if (!pskb_may_pull(skb, sizeof(*pim) + sizeof(*encap))) 581 goto drop; 582 583 pim = (struct pimreghdr *)skb_transport_header(skb); 584 if (pim->type != ((PIM_VERSION << 4) | PIM_TYPE_REGISTER) || 585 (pim->flags & PIM_NULL_REGISTER) || 586 (csum_ipv6_magic(&ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr, 587 sizeof(*pim), IPPROTO_PIM, 588 csum_partial((void *)pim, sizeof(*pim), 0)) && 589 csum_fold(skb_checksum(skb, 0, skb->len, 0)))) 590 goto drop; 591 592 /* check if the inner packet is destined to mcast group */ 593 encap = (struct ipv6hdr *)(skb_transport_header(skb) + 594 sizeof(*pim)); 595 596 if (!ipv6_addr_is_multicast(&encap->daddr) || 597 encap->payload_len == 0 || 598 ntohs(encap->payload_len) + sizeof(*pim) > skb->len) 599 goto drop; 600 601 if (ip6mr_fib_lookup(net, &fl6, &mrt) < 0) 602 goto drop; 603 604 /* Pairs with WRITE_ONCE() in mif6_add()/mif6_delete() */ 605 reg_vif_num = READ_ONCE(mrt->mroute_reg_vif_num); 606 if (reg_vif_num >= 0) 607 reg_dev = vif_dev_read(&mrt->vif_table[reg_vif_num]); 608 609 if (!reg_dev) 610 goto drop; 611 612 skb->mac_header = skb->network_header; 613 skb_pull(skb, (u8 *)encap - skb->data); 614 skb_reset_network_header(skb); 615 skb->protocol = htons(ETH_P_IPV6); 616 skb->ip_summed = CHECKSUM_NONE; 617 618 skb_tunnel_rx(skb, reg_dev, dev_net(reg_dev)); 619 620 netif_rx(skb); 621 622 return 0; 623 drop: 624 kfree_skb(skb); 625 return 0; 626 } 627 628 static const struct inet6_protocol pim6_protocol = { 629 .handler = pim6_rcv, 630 }; 631 632 /* Service routines creating virtual interfaces: PIMREG */ 633 634 static netdev_tx_t reg_vif_xmit(struct sk_buff *skb, 635 struct net_device *dev) 636 { 637 struct net *net = dev_net(dev); 638 struct mr_table *mrt; 639 struct flowi6 fl6 = { 640 .flowi6_oif = dev->ifindex, 641 .flowi6_iif = skb->skb_iif ? : LOOPBACK_IFINDEX, 642 .flowi6_mark = skb->mark, 643 }; 644 645 if (!pskb_inet_may_pull(skb)) 646 goto tx_err; 647 648 rcu_read_lock(); 649 650 if (ip6mr_fib_lookup(net, &fl6, &mrt) < 0) 651 goto tx_lookup_err; 652 653 DEV_STATS_ADD(dev, tx_bytes, skb->len); 654 DEV_STATS_INC(dev, tx_packets); 655 656 ip6mr_cache_report(mrt, skb, READ_ONCE(mrt->mroute_reg_vif_num), 657 MRT6MSG_WHOLEPKT); 658 rcu_read_unlock(); 659 kfree_skb(skb); 660 return NETDEV_TX_OK; 661 662 tx_lookup_err: 663 rcu_read_unlock(); 664 tx_err: 665 DEV_STATS_INC(dev, tx_errors); 666 kfree_skb(skb); 667 return NETDEV_TX_OK; 668 } 669 670 static int reg_vif_get_iflink(const struct net_device *dev) 671 { 672 return 0; 673 } 674 675 static const struct net_device_ops reg_vif_netdev_ops = { 676 .ndo_start_xmit = reg_vif_xmit, 677 .ndo_get_iflink = reg_vif_get_iflink, 678 }; 679 680 static void reg_vif_setup(struct net_device *dev) 681 { 682 dev->type = ARPHRD_PIMREG; 683 dev->mtu = 1500 - sizeof(struct ipv6hdr) - 8; 684 dev->flags = IFF_NOARP; 685 dev->netdev_ops = ®_vif_netdev_ops; 686 dev->needs_free_netdev = true; 687 dev->netns_immutable = true; 688 } 689 690 static struct net_device *ip6mr_reg_vif(struct net *net, struct mr_table *mrt) 691 { 692 struct net_device *dev; 693 char name[IFNAMSIZ]; 694 695 if (mrt->id == RT6_TABLE_DFLT) 696 sprintf(name, "pim6reg"); 697 else 698 sprintf(name, "pim6reg%u", mrt->id); 699 700 dev = alloc_netdev(0, name, NET_NAME_UNKNOWN, reg_vif_setup); 701 if (!dev) 702 return NULL; 703 704 dev_net_set(dev, net); 705 706 if (register_netdevice(dev)) { 707 free_netdev(dev); 708 return NULL; 709 } 710 711 if (dev_open(dev, NULL)) 712 goto failure; 713 714 dev_hold(dev); 715 return dev; 716 717 failure: 718 unregister_netdevice(dev); 719 return NULL; 720 } 721 #endif 722 723 static int call_ip6mr_vif_entry_notifiers(struct net *net, 724 enum fib_event_type event_type, 725 struct vif_device *vif, 726 struct net_device *vif_dev, 727 mifi_t vif_index, u32 tb_id) 728 { 729 return mr_call_vif_notifiers(net, RTNL_FAMILY_IP6MR, event_type, 730 vif, vif_dev, vif_index, tb_id, 731 &net->ipv6.ipmr_seq); 732 } 733 734 static int call_ip6mr_mfc_entry_notifiers(struct net *net, 735 enum fib_event_type event_type, 736 struct mfc6_cache *mfc, u32 tb_id) 737 { 738 return mr_call_mfc_notifiers(net, RTNL_FAMILY_IP6MR, event_type, 739 &mfc->_c, tb_id, &net->ipv6.ipmr_seq); 740 } 741 742 /* Delete a VIF entry */ 743 static int mif6_delete(struct mr_table *mrt, int vifi, int notify, 744 struct list_head *head) 745 { 746 struct vif_device *v; 747 struct net_device *dev; 748 struct inet6_dev *in6_dev; 749 750 if (vifi < 0 || vifi >= mrt->maxvif) 751 return -EADDRNOTAVAIL; 752 753 v = &mrt->vif_table[vifi]; 754 755 dev = rtnl_dereference(v->dev); 756 if (!dev) 757 return -EADDRNOTAVAIL; 758 759 call_ip6mr_vif_entry_notifiers(read_pnet(&mrt->net), 760 FIB_EVENT_VIF_DEL, v, dev, 761 vifi, mrt->id); 762 spin_lock(&mrt_lock); 763 RCU_INIT_POINTER(v->dev, NULL); 764 765 #ifdef CONFIG_IPV6_PIMSM_V2 766 if (vifi == mrt->mroute_reg_vif_num) { 767 /* Pairs with READ_ONCE() in ip6mr_cache_report() and reg_vif_xmit() */ 768 WRITE_ONCE(mrt->mroute_reg_vif_num, -1); 769 } 770 #endif 771 772 if (vifi + 1 == mrt->maxvif) { 773 int tmp; 774 for (tmp = vifi - 1; tmp >= 0; tmp--) { 775 if (VIF_EXISTS(mrt, tmp)) 776 break; 777 } 778 WRITE_ONCE(mrt->maxvif, tmp + 1); 779 } 780 781 spin_unlock(&mrt_lock); 782 783 dev_set_allmulti(dev, -1); 784 785 in6_dev = __in6_dev_get(dev); 786 if (in6_dev) { 787 atomic_dec(&in6_dev->cnf.mc_forwarding); 788 inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF, 789 NETCONFA_MC_FORWARDING, 790 dev->ifindex, &in6_dev->cnf); 791 } 792 793 if ((v->flags & MIFF_REGISTER) && !notify) 794 unregister_netdevice_queue(dev, head); 795 796 netdev_put(dev, &v->dev_tracker); 797 return 0; 798 } 799 800 static inline void ip6mr_cache_free_rcu(struct rcu_head *head) 801 { 802 struct mr_mfc *c = container_of(head, struct mr_mfc, rcu); 803 804 kmem_cache_free(mrt_cachep, (struct mfc6_cache *)c); 805 } 806 807 static inline void ip6mr_cache_free(struct mfc6_cache *c) 808 { 809 call_rcu(&c->_c.rcu, ip6mr_cache_free_rcu); 810 } 811 812 /* Destroy an unresolved cache entry, killing queued skbs 813 and reporting error to netlink readers. 814 */ 815 816 static void ip6mr_destroy_unres(struct mr_table *mrt, struct mfc6_cache *c) 817 { 818 struct net *net = read_pnet(&mrt->net); 819 struct sk_buff *skb; 820 821 WRITE_ONCE(mrt->cache_resolve_queue_len, 822 mrt->cache_resolve_queue_len - 1); 823 824 while ((skb = skb_dequeue(&c->_c.mfc_un.unres.unresolved)) != NULL) { 825 if (ipv6_hdr(skb)->version == 0) { 826 struct nlmsghdr *nlh = skb_pull(skb, 827 sizeof(struct ipv6hdr)); 828 nlh->nlmsg_type = NLMSG_ERROR; 829 nlh->nlmsg_len = nlmsg_msg_size(sizeof(struct nlmsgerr)); 830 skb_trim(skb, nlh->nlmsg_len); 831 ((struct nlmsgerr *)nlmsg_data(nlh))->error = -ETIMEDOUT; 832 rtnl_unicast(skb, net, NETLINK_CB(skb).portid); 833 } else 834 kfree_skb(skb); 835 } 836 837 ip6mr_cache_free(c); 838 } 839 840 841 /* Timer process for all the unresolved queue. */ 842 843 static void ipmr_do_expire_process(struct mr_table *mrt) 844 { 845 unsigned long now = jiffies; 846 unsigned long expires = 10 * HZ; 847 struct mr_mfc *c, *next; 848 849 list_for_each_entry_safe(c, next, &mrt->mfc_unres_queue, list) { 850 if (time_after(c->mfc_un.unres.expires, now)) { 851 /* not yet... */ 852 unsigned long interval = c->mfc_un.unres.expires - now; 853 if (interval < expires) 854 expires = interval; 855 continue; 856 } 857 858 list_del(&c->list); 859 mr6_netlink_event(mrt, (struct mfc6_cache *)c, RTM_DELROUTE); 860 ip6mr_destroy_unres(mrt, (struct mfc6_cache *)c); 861 } 862 863 if (!list_empty(&mrt->mfc_unres_queue)) 864 mod_timer(&mrt->ipmr_expire_timer, jiffies + expires); 865 } 866 867 static void ipmr_expire_process(struct timer_list *t) 868 { 869 struct mr_table *mrt = timer_container_of(mrt, t, ipmr_expire_timer); 870 871 if (!spin_trylock(&mfc_unres_lock)) { 872 mod_timer(&mrt->ipmr_expire_timer, jiffies + 1); 873 return; 874 } 875 876 if (!list_empty(&mrt->mfc_unres_queue)) 877 ipmr_do_expire_process(mrt); 878 879 spin_unlock(&mfc_unres_lock); 880 } 881 882 /* Fill oifs list. It is called under locked mrt_lock. */ 883 884 static void ip6mr_update_thresholds(struct mr_table *mrt, 885 struct mr_mfc *cache, 886 unsigned char *ttls) 887 { 888 int vifi; 889 890 cache->mfc_un.res.minvif = MAXMIFS; 891 cache->mfc_un.res.maxvif = 0; 892 memset(cache->mfc_un.res.ttls, 255, MAXMIFS); 893 894 for (vifi = 0; vifi < mrt->maxvif; vifi++) { 895 if (VIF_EXISTS(mrt, vifi) && 896 ttls[vifi] && ttls[vifi] < 255) { 897 cache->mfc_un.res.ttls[vifi] = ttls[vifi]; 898 if (cache->mfc_un.res.minvif > vifi) 899 cache->mfc_un.res.minvif = vifi; 900 if (cache->mfc_un.res.maxvif <= vifi) 901 cache->mfc_un.res.maxvif = vifi + 1; 902 } 903 } 904 WRITE_ONCE(cache->mfc_un.res.lastuse, jiffies); 905 } 906 907 static int mif6_add(struct net *net, struct mr_table *mrt, 908 struct mif6ctl *vifc, int mrtsock) 909 { 910 int vifi = vifc->mif6c_mifi; 911 struct vif_device *v = &mrt->vif_table[vifi]; 912 struct net_device *dev; 913 struct inet6_dev *in6_dev; 914 int err; 915 916 /* Is vif busy ? */ 917 if (VIF_EXISTS(mrt, vifi)) 918 return -EADDRINUSE; 919 920 switch (vifc->mif6c_flags) { 921 #ifdef CONFIG_IPV6_PIMSM_V2 922 case MIFF_REGISTER: 923 /* 924 * Special Purpose VIF in PIM 925 * All the packets will be sent to the daemon 926 */ 927 if (mrt->mroute_reg_vif_num >= 0) 928 return -EADDRINUSE; 929 dev = ip6mr_reg_vif(net, mrt); 930 if (!dev) 931 return -ENOBUFS; 932 err = dev_set_allmulti(dev, 1); 933 if (err) { 934 unregister_netdevice(dev); 935 dev_put(dev); 936 return err; 937 } 938 break; 939 #endif 940 case 0: 941 dev = dev_get_by_index(net, vifc->mif6c_pifi); 942 if (!dev) 943 return -EADDRNOTAVAIL; 944 err = dev_set_allmulti(dev, 1); 945 if (err) { 946 dev_put(dev); 947 return err; 948 } 949 break; 950 default: 951 return -EINVAL; 952 } 953 954 in6_dev = __in6_dev_get(dev); 955 if (in6_dev) { 956 atomic_inc(&in6_dev->cnf.mc_forwarding); 957 inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF, 958 NETCONFA_MC_FORWARDING, 959 dev->ifindex, &in6_dev->cnf); 960 } 961 962 /* Fill in the VIF structures */ 963 vif_device_init(v, dev, vifc->vifc_rate_limit, vifc->vifc_threshold, 964 vifc->mif6c_flags | (!mrtsock ? VIFF_STATIC : 0), 965 MIFF_REGISTER); 966 967 /* And finish update writing critical data */ 968 spin_lock(&mrt_lock); 969 rcu_assign_pointer(v->dev, dev); 970 netdev_tracker_alloc(dev, &v->dev_tracker, GFP_ATOMIC); 971 #ifdef CONFIG_IPV6_PIMSM_V2 972 if (v->flags & MIFF_REGISTER) 973 WRITE_ONCE(mrt->mroute_reg_vif_num, vifi); 974 #endif 975 if (vifi + 1 > mrt->maxvif) 976 WRITE_ONCE(mrt->maxvif, vifi + 1); 977 spin_unlock(&mrt_lock); 978 call_ip6mr_vif_entry_notifiers(net, FIB_EVENT_VIF_ADD, 979 v, dev, vifi, mrt->id); 980 return 0; 981 } 982 983 static struct mfc6_cache *ip6mr_cache_find(struct mr_table *mrt, 984 const struct in6_addr *origin, 985 const struct in6_addr *mcastgrp) 986 { 987 struct mfc6_cache_cmp_arg arg = { 988 .mf6c_origin = *origin, 989 .mf6c_mcastgrp = *mcastgrp, 990 }; 991 992 return mr_mfc_find(mrt, &arg); 993 } 994 995 /* Look for a (*,G) entry */ 996 static struct mfc6_cache *ip6mr_cache_find_any(struct mr_table *mrt, 997 struct in6_addr *mcastgrp, 998 mifi_t mifi) 999 { 1000 struct mfc6_cache_cmp_arg arg = { 1001 .mf6c_origin = in6addr_any, 1002 .mf6c_mcastgrp = *mcastgrp, 1003 }; 1004 1005 if (ipv6_addr_any(mcastgrp)) 1006 return mr_mfc_find_any_parent(mrt, mifi); 1007 return mr_mfc_find_any(mrt, mifi, &arg); 1008 } 1009 1010 /* Look for a (S,G,iif) entry if parent != -1 */ 1011 static struct mfc6_cache * 1012 ip6mr_cache_find_parent(struct mr_table *mrt, 1013 const struct in6_addr *origin, 1014 const struct in6_addr *mcastgrp, 1015 int parent) 1016 { 1017 struct mfc6_cache_cmp_arg arg = { 1018 .mf6c_origin = *origin, 1019 .mf6c_mcastgrp = *mcastgrp, 1020 }; 1021 1022 return mr_mfc_find_parent(mrt, &arg, parent); 1023 } 1024 1025 /* Allocate a multicast cache entry */ 1026 static struct mfc6_cache *ip6mr_cache_alloc(void) 1027 { 1028 struct mfc6_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL); 1029 if (!c) 1030 return NULL; 1031 c->_c.mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1; 1032 c->_c.mfc_un.res.minvif = MAXMIFS; 1033 c->_c.free = ip6mr_cache_free_rcu; 1034 refcount_set(&c->_c.mfc_un.res.refcount, 1); 1035 return c; 1036 } 1037 1038 static struct mfc6_cache *ip6mr_cache_alloc_unres(void) 1039 { 1040 struct mfc6_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_ATOMIC); 1041 if (!c) 1042 return NULL; 1043 skb_queue_head_init(&c->_c.mfc_un.unres.unresolved); 1044 c->_c.mfc_un.unres.expires = jiffies + 10 * HZ; 1045 return c; 1046 } 1047 1048 /* 1049 * A cache entry has gone into a resolved state from queued 1050 */ 1051 1052 static void ip6mr_cache_resolve(struct net *net, struct mr_table *mrt, 1053 struct mfc6_cache *uc, struct mfc6_cache *c) 1054 { 1055 struct sk_buff *skb; 1056 1057 /* 1058 * Play the pending entries through our router 1059 */ 1060 1061 while ((skb = __skb_dequeue(&uc->_c.mfc_un.unres.unresolved))) { 1062 if (ipv6_hdr(skb)->version == 0) { 1063 struct nlmsghdr *nlh = skb_pull(skb, 1064 sizeof(struct ipv6hdr)); 1065 1066 if (mr_fill_mroute(mrt, skb, &c->_c, 1067 nlmsg_data(nlh)) > 0) { 1068 nlh->nlmsg_len = skb_tail_pointer(skb) - (u8 *)nlh; 1069 } else { 1070 nlh->nlmsg_type = NLMSG_ERROR; 1071 nlh->nlmsg_len = nlmsg_msg_size(sizeof(struct nlmsgerr)); 1072 skb_trim(skb, nlh->nlmsg_len); 1073 ((struct nlmsgerr *)nlmsg_data(nlh))->error = -EMSGSIZE; 1074 } 1075 rtnl_unicast(skb, net, NETLINK_CB(skb).portid); 1076 } else { 1077 rcu_read_lock(); 1078 ip6_mr_forward(net, mrt, skb->dev, skb, c); 1079 rcu_read_unlock(); 1080 } 1081 } 1082 } 1083 1084 /* 1085 * Bounce a cache query up to pim6sd and netlink. 1086 * 1087 * Called under rcu_read_lock() 1088 */ 1089 1090 static int ip6mr_cache_report(const struct mr_table *mrt, struct sk_buff *pkt, 1091 mifi_t mifi, int assert) 1092 { 1093 enum skb_drop_reason reason; 1094 struct sock *mroute6_sk; 1095 struct sk_buff *skb; 1096 struct mrt6msg *msg; 1097 1098 mroute6_sk = rcu_dereference(mrt->mroute_sk); 1099 if (!mroute6_sk) 1100 return -EINVAL; 1101 1102 #ifdef CONFIG_IPV6_PIMSM_V2 1103 if (assert == MRT6MSG_WHOLEPKT || assert == MRT6MSG_WRMIFWHOLE) 1104 skb = skb_realloc_headroom(pkt, -skb_network_offset(pkt) 1105 +sizeof(*msg)); 1106 else 1107 #endif 1108 skb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(*msg), GFP_ATOMIC); 1109 1110 if (!skb) 1111 return -ENOBUFS; 1112 1113 /* I suppose that internal messages 1114 * do not require checksums */ 1115 1116 skb->ip_summed = CHECKSUM_UNNECESSARY; 1117 1118 #ifdef CONFIG_IPV6_PIMSM_V2 1119 if (assert == MRT6MSG_WHOLEPKT || assert == MRT6MSG_WRMIFWHOLE) { 1120 /* Ugly, but we have no choice with this interface. 1121 Duplicate old header, fix length etc. 1122 And all this only to mangle msg->im6_msgtype and 1123 to set msg->im6_mbz to "mbz" :-) 1124 */ 1125 __skb_pull(skb, skb_network_offset(pkt)); 1126 1127 skb_push(skb, sizeof(*msg)); 1128 skb_reset_transport_header(skb); 1129 msg = (struct mrt6msg *)skb_transport_header(skb); 1130 msg->im6_mbz = 0; 1131 msg->im6_msgtype = assert; 1132 if (assert == MRT6MSG_WRMIFWHOLE) 1133 msg->im6_mif = mifi; 1134 else 1135 msg->im6_mif = READ_ONCE(mrt->mroute_reg_vif_num); 1136 msg->im6_pad = 0; 1137 msg->im6_src = ipv6_hdr(pkt)->saddr; 1138 msg->im6_dst = ipv6_hdr(pkt)->daddr; 1139 1140 skb->ip_summed = CHECKSUM_UNNECESSARY; 1141 } else 1142 #endif 1143 { 1144 /* 1145 * Copy the IP header 1146 */ 1147 1148 skb_put(skb, sizeof(struct ipv6hdr)); 1149 skb_reset_network_header(skb); 1150 skb_copy_to_linear_data(skb, ipv6_hdr(pkt), sizeof(struct ipv6hdr)); 1151 1152 /* 1153 * Add our header 1154 */ 1155 skb_put(skb, sizeof(*msg)); 1156 skb_reset_transport_header(skb); 1157 msg = (struct mrt6msg *)skb_transport_header(skb); 1158 1159 msg->im6_mbz = 0; 1160 msg->im6_msgtype = assert; 1161 msg->im6_mif = mifi; 1162 msg->im6_pad = 0; 1163 msg->im6_src = ipv6_hdr(pkt)->saddr; 1164 msg->im6_dst = ipv6_hdr(pkt)->daddr; 1165 1166 skb->ip_summed = CHECKSUM_UNNECESSARY; 1167 } 1168 1169 skb_dst_drop(skb); 1170 mrt6msg_netlink_event(mrt, skb); 1171 1172 /* Deliver to user space multicast routing algorithms */ 1173 reason = sock_queue_rcv_skb_reason(mroute6_sk, skb); 1174 1175 if (reason) { 1176 sk_skb_reason_drop(mroute6_sk, skb, reason); 1177 return -ENOMEM; 1178 } 1179 1180 return 0; 1181 } 1182 1183 /* Queue a packet for resolution. It gets locked cache entry! */ 1184 static int ip6mr_cache_unresolved(struct mr_table *mrt, mifi_t mifi, 1185 struct sk_buff *skb, struct net_device *dev) 1186 { 1187 struct net *net = read_pnet(&mrt->net); 1188 struct mfc6_cache *c = NULL; 1189 bool found = false; 1190 int err; 1191 1192 spin_lock_bh(&mfc_unres_lock); 1193 1194 if (!check_net(net)) { 1195 err = -EINVAL; 1196 goto err; 1197 } 1198 1199 list_for_each_entry(c, &mrt->mfc_unres_queue, _c.list) { 1200 if (ipv6_addr_equal(&c->mf6c_mcastgrp, &ipv6_hdr(skb)->daddr) && 1201 ipv6_addr_equal(&c->mf6c_origin, &ipv6_hdr(skb)->saddr)) { 1202 found = true; 1203 break; 1204 } 1205 } 1206 1207 if (!found) { 1208 /* 1209 * Create a new entry if allowable 1210 */ 1211 1212 c = ip6mr_cache_alloc_unres(); 1213 if (!c) { 1214 err = -ENOBUFS; 1215 goto err; 1216 } 1217 1218 /* Fill in the new cache entry */ 1219 c->_c.mfc_parent = -1; 1220 c->mf6c_origin = ipv6_hdr(skb)->saddr; 1221 c->mf6c_mcastgrp = ipv6_hdr(skb)->daddr; 1222 1223 /* 1224 * Reflect first query at pim6sd 1225 */ 1226 err = ip6mr_cache_report(mrt, skb, mifi, MRT6MSG_NOCACHE); 1227 if (err < 0) 1228 goto err; 1229 1230 WRITE_ONCE(mrt->cache_resolve_queue_len, 1231 mrt->cache_resolve_queue_len + 1); 1232 list_add(&c->_c.list, &mrt->mfc_unres_queue); 1233 mr6_netlink_event(mrt, c, RTM_NEWROUTE); 1234 1235 ipmr_do_expire_process(mrt); 1236 } 1237 1238 /* See if we can append the packet */ 1239 if (c->_c.mfc_un.unres.unresolved.qlen > 3) { 1240 c = NULL; 1241 err = -ENOBUFS; 1242 goto err; 1243 } 1244 1245 if (dev) { 1246 skb->dev = dev; 1247 skb->skb_iif = dev->ifindex; 1248 } 1249 1250 skb_dst_drop(skb); 1251 skb_queue_tail(&c->_c.mfc_un.unres.unresolved, skb); 1252 1253 spin_unlock_bh(&mfc_unres_lock); 1254 return 0; 1255 1256 err: 1257 spin_unlock_bh(&mfc_unres_lock); 1258 if (c) 1259 ip6mr_cache_free(c); 1260 kfree_skb(skb); 1261 return err; 1262 } 1263 1264 /* 1265 * MFC6 cache manipulation by user space 1266 */ 1267 1268 static int ip6mr_mfc_delete(struct mr_table *mrt, struct mf6cctl *mfc, 1269 int parent) 1270 { 1271 struct mfc6_cache *c; 1272 1273 rcu_read_lock(); 1274 c = ip6mr_cache_find_parent(mrt, &mfc->mf6cc_origin.sin6_addr, 1275 &mfc->mf6cc_mcastgrp.sin6_addr, parent); 1276 rcu_read_unlock(); 1277 if (!c) 1278 return -ENOENT; 1279 rhltable_remove(&mrt->mfc_hash, &c->_c.mnode, ip6mr_rht_params); 1280 list_del_rcu(&c->_c.list); 1281 1282 call_ip6mr_mfc_entry_notifiers(read_pnet(&mrt->net), 1283 FIB_EVENT_ENTRY_DEL, c, mrt->id); 1284 mr6_netlink_event(mrt, c, RTM_DELROUTE); 1285 mr_cache_put(&c->_c); 1286 return 0; 1287 } 1288 1289 static int ip6mr_device_event(struct notifier_block *this, 1290 unsigned long event, void *ptr) 1291 { 1292 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 1293 struct net *net = dev_net(dev); 1294 struct mr_table *mrt; 1295 struct vif_device *v; 1296 int ct; 1297 1298 if (event != NETDEV_UNREGISTER) 1299 return NOTIFY_DONE; 1300 1301 ip6mr_for_each_table(mrt, net) { 1302 v = &mrt->vif_table[0]; 1303 for (ct = 0; ct < mrt->maxvif; ct++, v++) { 1304 if (rcu_access_pointer(v->dev) == dev) 1305 mif6_delete(mrt, ct, 1, NULL); 1306 } 1307 } 1308 1309 return NOTIFY_DONE; 1310 } 1311 1312 static unsigned int ip6mr_seq_read(const struct net *net) 1313 { 1314 return atomic_read(&net->ipv6.ipmr_seq) + ip6mr_rules_seq_read(net); 1315 } 1316 1317 static int ip6mr_dump(struct net *net, struct notifier_block *nb, 1318 struct netlink_ext_ack *extack) 1319 { 1320 return mr_dump(net, nb, RTNL_FAMILY_IP6MR, ip6mr_rules_dump, 1321 ip6mr_mr_table_iter, extack); 1322 } 1323 1324 static struct notifier_block ip6_mr_notifier = { 1325 .notifier_call = ip6mr_device_event 1326 }; 1327 1328 static const struct fib_notifier_ops ip6mr_notifier_ops_template = { 1329 .family = RTNL_FAMILY_IP6MR, 1330 .fib_seq_read = ip6mr_seq_read, 1331 .fib_dump = ip6mr_dump, 1332 .owner = THIS_MODULE, 1333 }; 1334 1335 static int __net_init ip6mr_notifier_init(struct net *net) 1336 { 1337 struct fib_notifier_ops *ops; 1338 1339 atomic_set(&net->ipv6.ipmr_seq, 0); 1340 1341 ops = fib_notifier_ops_register(&ip6mr_notifier_ops_template, net); 1342 if (IS_ERR(ops)) 1343 return PTR_ERR(ops); 1344 1345 net->ipv6.ip6mr_notifier_ops = ops; 1346 1347 return 0; 1348 } 1349 1350 static void __net_exit ip6mr_notifier_exit(struct net *net) 1351 { 1352 fib_notifier_ops_unregister(net->ipv6.ip6mr_notifier_ops); 1353 net->ipv6.ip6mr_notifier_ops = NULL; 1354 } 1355 1356 /* Setup for IP multicast routing */ 1357 static int __net_init ip6mr_net_init(struct net *net) 1358 { 1359 #ifdef CONFIG_PROC_FS 1360 LIST_HEAD(dev_kill_list); 1361 #endif 1362 int err; 1363 1364 mutex_init(&net->ipv6.mfc_mutex); 1365 1366 err = ip6mr_notifier_init(net); 1367 if (err) 1368 return err; 1369 1370 err = ip6mr_rules_init(net); 1371 if (err < 0) 1372 goto ip6mr_rules_fail; 1373 1374 #ifdef CONFIG_PROC_FS 1375 err = -ENOMEM; 1376 if (!proc_create_net("ip6_mr_vif", 0, net->proc_net, &ip6mr_vif_seq_ops, 1377 sizeof(struct mr_vif_iter))) 1378 goto proc_vif_fail; 1379 if (!proc_create_net("ip6_mr_cache", 0, net->proc_net, &ipmr_mfc_seq_ops, 1380 sizeof(struct mr_mfc_iter))) 1381 goto proc_cache_fail; 1382 #endif 1383 1384 return 0; 1385 1386 #ifdef CONFIG_PROC_FS 1387 proc_cache_fail: 1388 remove_proc_entry("ip6_mr_vif", net->proc_net); 1389 proc_vif_fail: 1390 ip6mr_rules_exit_rtnl(net, &dev_kill_list); 1391 ip6mr_rules_exit(net); 1392 #endif 1393 ip6mr_rules_fail: 1394 ip6mr_notifier_exit(net); 1395 return err; 1396 } 1397 1398 static void __net_exit ip6mr_net_exit(struct net *net) 1399 { 1400 #ifdef CONFIG_PROC_FS 1401 remove_proc_entry("ip6_mr_cache", net->proc_net); 1402 remove_proc_entry("ip6_mr_vif", net->proc_net); 1403 #endif 1404 ip6mr_rules_exit(net); 1405 ip6mr_notifier_exit(net); 1406 } 1407 1408 static void __net_exit ip6mr_net_exit_rtnl(struct net *net, 1409 struct list_head *dev_kill_list) 1410 { 1411 ip6mr_rules_exit_rtnl(net, dev_kill_list); 1412 } 1413 1414 static struct pernet_operations ip6mr_net_ops = { 1415 .init = ip6mr_net_init, 1416 .exit = ip6mr_net_exit, 1417 .exit_rtnl = ip6mr_net_exit_rtnl, 1418 }; 1419 1420 static const struct rtnl_msg_handler ip6mr_rtnl_msg_handlers[] __initconst_or_module = { 1421 {.owner = THIS_MODULE, .protocol = RTNL_FAMILY_IP6MR, 1422 .msgtype = RTM_GETROUTE, 1423 .doit = ip6mr_rtm_getroute, .dumpit = ip6mr_rtm_dumproute, 1424 .flags = RTNL_FLAG_DOIT_UNLOCKED | RTNL_FLAG_DUMP_UNLOCKED}, 1425 }; 1426 1427 int __init ip6_mr_init(void) 1428 { 1429 int err; 1430 1431 mrt_cachep = KMEM_CACHE(mfc6_cache, SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT); 1432 if (!mrt_cachep) 1433 return -ENOMEM; 1434 1435 err = register_pernet_subsys(&ip6mr_net_ops); 1436 if (err) 1437 goto reg_pernet_fail; 1438 1439 err = register_netdevice_notifier(&ip6_mr_notifier); 1440 if (err) 1441 goto reg_notif_fail; 1442 #ifdef CONFIG_IPV6_PIMSM_V2 1443 if (inet6_add_protocol(&pim6_protocol, IPPROTO_PIM) < 0) { 1444 pr_err("%s: can't add PIM protocol\n", __func__); 1445 err = -EAGAIN; 1446 goto add_proto_fail; 1447 } 1448 #endif 1449 err = rtnl_register_many(ip6mr_rtnl_msg_handlers); 1450 if (!err) 1451 return 0; 1452 1453 #ifdef CONFIG_IPV6_PIMSM_V2 1454 inet6_del_protocol(&pim6_protocol, IPPROTO_PIM); 1455 add_proto_fail: 1456 unregister_netdevice_notifier(&ip6_mr_notifier); 1457 #endif 1458 reg_notif_fail: 1459 unregister_pernet_subsys(&ip6mr_net_ops); 1460 reg_pernet_fail: 1461 kmem_cache_destroy(mrt_cachep); 1462 return err; 1463 } 1464 1465 void __init ip6_mr_cleanup(void) 1466 { 1467 rtnl_unregister_many(ip6mr_rtnl_msg_handlers); 1468 #ifdef CONFIG_IPV6_PIMSM_V2 1469 inet6_del_protocol(&pim6_protocol, IPPROTO_PIM); 1470 #endif 1471 unregister_netdevice_notifier(&ip6_mr_notifier); 1472 unregister_pernet_subsys(&ip6mr_net_ops); 1473 kmem_cache_destroy(mrt_cachep); 1474 } 1475 1476 static int ip6mr_mfc_add(struct net *net, struct mr_table *mrt, 1477 struct mf6cctl *mfc, int mrtsock, int parent) 1478 { 1479 unsigned char ttls[MAXMIFS]; 1480 struct mfc6_cache *uc, *c; 1481 struct mr_mfc *_uc; 1482 bool found; 1483 int i, err; 1484 1485 if (mfc->mf6cc_parent >= MAXMIFS) 1486 return -ENFILE; 1487 1488 memset(ttls, 255, MAXMIFS); 1489 for (i = 0; i < MAXMIFS; i++) { 1490 if (IF_ISSET(i, &mfc->mf6cc_ifset)) 1491 ttls[i] = 1; 1492 } 1493 1494 rcu_read_lock(); 1495 c = ip6mr_cache_find_parent(mrt, &mfc->mf6cc_origin.sin6_addr, 1496 &mfc->mf6cc_mcastgrp.sin6_addr, parent); 1497 rcu_read_unlock(); 1498 if (c) { 1499 spin_lock(&mrt_lock); 1500 c->_c.mfc_parent = mfc->mf6cc_parent; 1501 ip6mr_update_thresholds(mrt, &c->_c, ttls); 1502 if (!mrtsock) 1503 c->_c.mfc_flags |= MFC_STATIC; 1504 spin_unlock(&mrt_lock); 1505 call_ip6mr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_REPLACE, 1506 c, mrt->id); 1507 mr6_netlink_event(mrt, c, RTM_NEWROUTE); 1508 return 0; 1509 } 1510 1511 if (!ipv6_addr_any(&mfc->mf6cc_mcastgrp.sin6_addr) && 1512 !ipv6_addr_is_multicast(&mfc->mf6cc_mcastgrp.sin6_addr)) 1513 return -EINVAL; 1514 1515 c = ip6mr_cache_alloc(); 1516 if (!c) 1517 return -ENOMEM; 1518 1519 c->mf6c_origin = mfc->mf6cc_origin.sin6_addr; 1520 c->mf6c_mcastgrp = mfc->mf6cc_mcastgrp.sin6_addr; 1521 c->_c.mfc_parent = mfc->mf6cc_parent; 1522 ip6mr_update_thresholds(mrt, &c->_c, ttls); 1523 if (!mrtsock) 1524 c->_c.mfc_flags |= MFC_STATIC; 1525 1526 err = rhltable_insert_key(&mrt->mfc_hash, &c->cmparg, &c->_c.mnode, 1527 ip6mr_rht_params); 1528 if (err) { 1529 pr_err("ip6mr: rhtable insert error %d\n", err); 1530 ip6mr_cache_free(c); 1531 return err; 1532 } 1533 list_add_tail_rcu(&c->_c.list, &mrt->mfc_cache_list); 1534 1535 /* Check to see if we resolved a queued list. If so we 1536 * need to send on the frames and tidy up. 1537 */ 1538 found = false; 1539 spin_lock_bh(&mfc_unres_lock); 1540 list_for_each_entry(_uc, &mrt->mfc_unres_queue, list) { 1541 uc = (struct mfc6_cache *)_uc; 1542 if (ipv6_addr_equal(&uc->mf6c_origin, &c->mf6c_origin) && 1543 ipv6_addr_equal(&uc->mf6c_mcastgrp, &c->mf6c_mcastgrp)) { 1544 list_del(&_uc->list); 1545 WRITE_ONCE(mrt->cache_resolve_queue_len, 1546 mrt->cache_resolve_queue_len - 1); 1547 found = true; 1548 break; 1549 } 1550 } 1551 if (list_empty(&mrt->mfc_unres_queue)) 1552 timer_delete(&mrt->ipmr_expire_timer); 1553 spin_unlock_bh(&mfc_unres_lock); 1554 1555 if (found) { 1556 ip6mr_cache_resolve(net, mrt, uc, c); 1557 ip6mr_cache_free(uc); 1558 } 1559 call_ip6mr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_ADD, 1560 c, mrt->id); 1561 mr6_netlink_event(mrt, c, RTM_NEWROUTE); 1562 return 0; 1563 } 1564 1565 /* 1566 * Close the multicast socket, and clear the vif tables etc 1567 */ 1568 1569 static void mroute_clean_tables(struct mr_table *mrt, int flags, 1570 struct list_head *dev_kill_list) 1571 { 1572 struct net *net = read_pnet(&mrt->net); 1573 struct mr_mfc *c, *tmp; 1574 int i; 1575 1576 /* Shut down all active vif entries */ 1577 if (flags & (MRT6_FLUSH_MIFS | MRT6_FLUSH_MIFS_STATIC)) { 1578 for (i = 0; i < mrt->maxvif; i++) { 1579 if (((mrt->vif_table[i].flags & VIFF_STATIC) && 1580 !(flags & MRT6_FLUSH_MIFS_STATIC)) || 1581 (!(mrt->vif_table[i].flags & VIFF_STATIC) && !(flags & MRT6_FLUSH_MIFS))) 1582 continue; 1583 mif6_delete(mrt, i, 0, dev_kill_list); 1584 } 1585 } 1586 1587 /* Wipe the cache */ 1588 if (flags & (MRT6_FLUSH_MFC | MRT6_FLUSH_MFC_STATIC)) { 1589 mutex_lock(&net->ipv6.mfc_mutex); 1590 1591 list_for_each_entry_safe(c, tmp, &mrt->mfc_cache_list, list) { 1592 if (((c->mfc_flags & MFC_STATIC) && !(flags & MRT6_FLUSH_MFC_STATIC)) || 1593 (!(c->mfc_flags & MFC_STATIC) && !(flags & MRT6_FLUSH_MFC))) 1594 continue; 1595 rhltable_remove(&mrt->mfc_hash, &c->mnode, ip6mr_rht_params); 1596 list_del_rcu(&c->list); 1597 call_ip6mr_mfc_entry_notifiers(net, FIB_EVENT_ENTRY_DEL, 1598 (struct mfc6_cache *)c, mrt->id); 1599 mr6_netlink_event(mrt, (struct mfc6_cache *)c, RTM_DELROUTE); 1600 mr_cache_put(c); 1601 } 1602 1603 mutex_unlock(&net->ipv6.mfc_mutex); 1604 } 1605 1606 if (flags & MRT6_FLUSH_MFC) { 1607 if (READ_ONCE(mrt->cache_resolve_queue_len) || !check_net(net)) { 1608 spin_lock_bh(&mfc_unres_lock); 1609 list_for_each_entry_safe(c, tmp, &mrt->mfc_unres_queue, list) { 1610 list_del(&c->list); 1611 mr6_netlink_event(mrt, (struct mfc6_cache *)c, 1612 RTM_DELROUTE); 1613 ip6mr_destroy_unres(mrt, (struct mfc6_cache *)c); 1614 } 1615 spin_unlock_bh(&mfc_unres_lock); 1616 } 1617 } 1618 } 1619 1620 static int ip6mr_sk_init(struct mr_table *mrt, struct sock *sk) 1621 { 1622 int err = 0; 1623 struct net *net = sock_net(sk); 1624 1625 rtnl_lock(); 1626 spin_lock(&mrt_lock); 1627 if (rtnl_dereference(mrt->mroute_sk)) { 1628 err = -EADDRINUSE; 1629 } else { 1630 rcu_assign_pointer(mrt->mroute_sk, sk); 1631 sock_set_flag(sk, SOCK_RCU_FREE); 1632 atomic_inc(&net->ipv6.devconf_all->mc_forwarding); 1633 } 1634 spin_unlock(&mrt_lock); 1635 1636 if (!err) 1637 inet6_netconf_notify_devconf(net, RTM_NEWNETCONF, 1638 NETCONFA_MC_FORWARDING, 1639 NETCONFA_IFINDEX_ALL, 1640 net->ipv6.devconf_all); 1641 rtnl_unlock(); 1642 1643 return err; 1644 } 1645 1646 int ip6mr_sk_done(struct sock *sk) 1647 { 1648 struct net *net = sock_net(sk); 1649 struct ipv6_devconf *devconf; 1650 LIST_HEAD(dev_kill_list); 1651 struct mr_table *mrt; 1652 int err = -EACCES; 1653 1654 if (sk->sk_type != SOCK_RAW || 1655 inet_sk(sk)->inet_num != IPPROTO_ICMPV6) 1656 return err; 1657 1658 devconf = net->ipv6.devconf_all; 1659 if (!devconf || !atomic_read(&devconf->mc_forwarding)) 1660 return err; 1661 1662 rtnl_lock(); 1663 ip6mr_for_each_table(mrt, net) { 1664 if (sk == rtnl_dereference(mrt->mroute_sk)) { 1665 spin_lock(&mrt_lock); 1666 RCU_INIT_POINTER(mrt->mroute_sk, NULL); 1667 /* Note that mroute_sk had SOCK_RCU_FREE set, 1668 * so the RCU grace period before sk freeing 1669 * is guaranteed by sk_destruct() 1670 */ 1671 atomic_dec(&devconf->mc_forwarding); 1672 spin_unlock(&mrt_lock); 1673 inet6_netconf_notify_devconf(net, RTM_NEWNETCONF, 1674 NETCONFA_MC_FORWARDING, 1675 NETCONFA_IFINDEX_ALL, 1676 net->ipv6.devconf_all); 1677 1678 mroute_clean_tables(mrt, MRT6_FLUSH_MIFS | MRT6_FLUSH_MFC, 1679 &dev_kill_list); 1680 err = 0; 1681 break; 1682 } 1683 } 1684 unregister_netdevice_many(&dev_kill_list); 1685 rtnl_unlock(); 1686 1687 return err; 1688 } 1689 1690 bool mroute6_is_socket(struct net *net, struct sk_buff *skb) 1691 { 1692 struct mr_table *mrt; 1693 struct flowi6 fl6 = { 1694 .flowi6_iif = skb->skb_iif ? : LOOPBACK_IFINDEX, 1695 .flowi6_oif = skb->dev->ifindex, 1696 .flowi6_mark = skb->mark, 1697 }; 1698 1699 if (ip6mr_fib_lookup(net, &fl6, &mrt) < 0) 1700 return NULL; 1701 1702 return rcu_access_pointer(mrt->mroute_sk); 1703 } 1704 EXPORT_SYMBOL(mroute6_is_socket); 1705 1706 /* 1707 * Socket options and virtual interface manipulation. The whole 1708 * virtual interface system is a complete heap, but unfortunately 1709 * that's how BSD mrouted happens to think. Maybe one day with a proper 1710 * MOSPF/PIM router set up we can clean this up. 1711 */ 1712 1713 int ip6_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval, 1714 unsigned int optlen) 1715 { 1716 int ret, parent = 0; 1717 struct mif6ctl vif; 1718 struct mf6cctl mfc; 1719 mifi_t mifi; 1720 struct net *net = sock_net(sk); 1721 struct mr_table *mrt; 1722 1723 if (sk->sk_type != SOCK_RAW || 1724 inet_sk(sk)->inet_num != IPPROTO_ICMPV6) 1725 return -EOPNOTSUPP; 1726 1727 mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT); 1728 if (!mrt) 1729 return -ENOENT; 1730 1731 if (optname != MRT6_INIT) { 1732 if (sk != rcu_access_pointer(mrt->mroute_sk) && 1733 !ns_capable(net->user_ns, CAP_NET_ADMIN)) 1734 return -EACCES; 1735 } 1736 1737 switch (optname) { 1738 case MRT6_INIT: 1739 if (optlen < sizeof(int)) 1740 return -EINVAL; 1741 1742 return ip6mr_sk_init(mrt, sk); 1743 1744 case MRT6_DONE: 1745 return ip6mr_sk_done(sk); 1746 1747 case MRT6_ADD_MIF: 1748 if (optlen < sizeof(vif)) 1749 return -EINVAL; 1750 if (copy_from_sockptr(&vif, optval, sizeof(vif))) 1751 return -EFAULT; 1752 if (vif.mif6c_mifi >= MAXMIFS) 1753 return -ENFILE; 1754 rtnl_lock(); 1755 ret = mif6_add(net, mrt, &vif, 1756 sk == rtnl_dereference(mrt->mroute_sk)); 1757 rtnl_unlock(); 1758 return ret; 1759 1760 case MRT6_DEL_MIF: 1761 if (optlen < sizeof(mifi_t)) 1762 return -EINVAL; 1763 if (copy_from_sockptr(&mifi, optval, sizeof(mifi_t))) 1764 return -EFAULT; 1765 rtnl_lock(); 1766 ret = mif6_delete(mrt, mifi, 0, NULL); 1767 rtnl_unlock(); 1768 return ret; 1769 1770 /* 1771 * Manipulate the forwarding caches. These live 1772 * in a sort of kernel/user symbiosis. 1773 */ 1774 case MRT6_ADD_MFC: 1775 case MRT6_DEL_MFC: 1776 parent = -1; 1777 fallthrough; 1778 case MRT6_ADD_MFC_PROXY: 1779 case MRT6_DEL_MFC_PROXY: 1780 if (optlen < sizeof(mfc)) 1781 return -EINVAL; 1782 if (copy_from_sockptr(&mfc, optval, sizeof(mfc))) 1783 return -EFAULT; 1784 if (parent == 0) 1785 parent = mfc.mf6cc_parent; 1786 1787 mutex_lock(&net->ipv6.mfc_mutex); 1788 1789 if (optname == MRT6_DEL_MFC || optname == MRT6_DEL_MFC_PROXY) 1790 ret = ip6mr_mfc_delete(mrt, &mfc, parent); 1791 else 1792 ret = ip6mr_mfc_add(net, mrt, &mfc, 1793 sk == 1794 rcu_access_pointer(mrt->mroute_sk), 1795 parent); 1796 1797 mutex_unlock(&net->ipv6.mfc_mutex); 1798 return ret; 1799 1800 case MRT6_FLUSH: 1801 { 1802 LIST_HEAD(dev_kill_list); 1803 int flags; 1804 1805 if (optlen != sizeof(flags)) 1806 return -EINVAL; 1807 if (copy_from_sockptr(&flags, optval, sizeof(flags))) 1808 return -EFAULT; 1809 1810 rtnl_lock(); 1811 mroute_clean_tables(mrt, flags, &dev_kill_list); 1812 unregister_netdevice_many(&dev_kill_list); 1813 rtnl_unlock(); 1814 return 0; 1815 } 1816 1817 /* 1818 * Control PIM assert (to activate pim will activate assert) 1819 */ 1820 case MRT6_ASSERT: 1821 { 1822 int v; 1823 1824 if (optlen != sizeof(v)) 1825 return -EINVAL; 1826 if (copy_from_sockptr(&v, optval, sizeof(v))) 1827 return -EFAULT; 1828 WRITE_ONCE(mrt->mroute_do_assert, v); 1829 return 0; 1830 } 1831 1832 #ifdef CONFIG_IPV6_PIMSM_V2 1833 case MRT6_PIM: 1834 { 1835 bool do_wrmifwhole; 1836 int v; 1837 1838 if (optlen != sizeof(v)) 1839 return -EINVAL; 1840 if (copy_from_sockptr(&v, optval, sizeof(v))) 1841 return -EFAULT; 1842 1843 do_wrmifwhole = (v == MRT6MSG_WRMIFWHOLE); 1844 v = !!v; 1845 rtnl_lock(); 1846 ret = 0; 1847 if (v != mrt->mroute_do_pim) { 1848 WRITE_ONCE(mrt->mroute_do_pim, v); 1849 WRITE_ONCE(mrt->mroute_do_assert, v); 1850 WRITE_ONCE(mrt->mroute_do_wrvifwhole, do_wrmifwhole); 1851 } 1852 rtnl_unlock(); 1853 return ret; 1854 } 1855 1856 #endif 1857 #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES 1858 case MRT6_TABLE: 1859 { 1860 u32 v; 1861 1862 if (optlen != sizeof(u32)) 1863 return -EINVAL; 1864 if (copy_from_sockptr(&v, optval, sizeof(v))) 1865 return -EFAULT; 1866 /* "pim6reg%u" should not exceed 16 bytes (IFNAMSIZ) */ 1867 if (v != RT_TABLE_DEFAULT && v >= 100000000) 1868 return -EINVAL; 1869 if (sk == rcu_access_pointer(mrt->mroute_sk)) 1870 return -EBUSY; 1871 1872 rtnl_lock(); 1873 ret = 0; 1874 mrt = ip6mr_new_table(net, v); 1875 if (IS_ERR(mrt)) 1876 ret = PTR_ERR(mrt); 1877 else 1878 raw6_sk(sk)->ip6mr_table = v; 1879 rtnl_unlock(); 1880 return ret; 1881 } 1882 #endif 1883 /* 1884 * Spurious command, or MRT6_VERSION which you cannot 1885 * set. 1886 */ 1887 default: 1888 return -ENOPROTOOPT; 1889 } 1890 } 1891 1892 /* 1893 * Getsock opt support for the multicast routing system. 1894 */ 1895 1896 int ip6_mroute_getsockopt(struct sock *sk, int optname, sockptr_t optval, 1897 sockptr_t optlen) 1898 { 1899 int olr; 1900 int val; 1901 struct net *net = sock_net(sk); 1902 struct mr_table *mrt; 1903 1904 if (sk->sk_type != SOCK_RAW || 1905 inet_sk(sk)->inet_num != IPPROTO_ICMPV6) 1906 return -EOPNOTSUPP; 1907 1908 mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT); 1909 if (!mrt) 1910 return -ENOENT; 1911 1912 switch (optname) { 1913 case MRT6_VERSION: 1914 val = 0x0305; 1915 break; 1916 #ifdef CONFIG_IPV6_PIMSM_V2 1917 case MRT6_PIM: 1918 val = READ_ONCE(mrt->mroute_do_pim); 1919 break; 1920 #endif 1921 case MRT6_ASSERT: 1922 val = READ_ONCE(mrt->mroute_do_assert); 1923 break; 1924 default: 1925 return -ENOPROTOOPT; 1926 } 1927 1928 if (copy_from_sockptr(&olr, optlen, sizeof(int))) 1929 return -EFAULT; 1930 1931 olr = min_t(int, olr, sizeof(int)); 1932 if (olr < 0) 1933 return -EINVAL; 1934 1935 if (copy_to_sockptr(optlen, &olr, sizeof(int))) 1936 return -EFAULT; 1937 if (copy_to_sockptr(optval, &val, olr)) 1938 return -EFAULT; 1939 return 0; 1940 } 1941 1942 /* 1943 * The IP multicast ioctl support routines. 1944 */ 1945 int ip6mr_ioctl(struct sock *sk, int cmd, void *arg) 1946 { 1947 struct sioc_sg_req6 *sr; 1948 struct sioc_mif_req6 *vr; 1949 struct vif_device *vif; 1950 struct mfc6_cache *c; 1951 struct net *net = sock_net(sk); 1952 struct mr_table *mrt; 1953 1954 mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT); 1955 if (!mrt) 1956 return -ENOENT; 1957 1958 switch (cmd) { 1959 case SIOCGETMIFCNT_IN6: 1960 vr = (struct sioc_mif_req6 *)arg; 1961 if (vr->mifi >= mrt->maxvif) 1962 return -EINVAL; 1963 vr->mifi = array_index_nospec(vr->mifi, mrt->maxvif); 1964 rcu_read_lock(); 1965 vif = &mrt->vif_table[vr->mifi]; 1966 if (VIF_EXISTS(mrt, vr->mifi)) { 1967 vr->icount = READ_ONCE(vif->pkt_in); 1968 vr->ocount = READ_ONCE(vif->pkt_out); 1969 vr->ibytes = READ_ONCE(vif->bytes_in); 1970 vr->obytes = READ_ONCE(vif->bytes_out); 1971 rcu_read_unlock(); 1972 return 0; 1973 } 1974 rcu_read_unlock(); 1975 return -EADDRNOTAVAIL; 1976 case SIOCGETSGCNT_IN6: 1977 sr = (struct sioc_sg_req6 *)arg; 1978 1979 rcu_read_lock(); 1980 c = ip6mr_cache_find(mrt, &sr->src.sin6_addr, 1981 &sr->grp.sin6_addr); 1982 if (c) { 1983 sr->pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt); 1984 sr->bytecnt = atomic_long_read(&c->_c.mfc_un.res.bytes); 1985 sr->wrong_if = atomic_long_read(&c->_c.mfc_un.res.wrong_if); 1986 rcu_read_unlock(); 1987 return 0; 1988 } 1989 rcu_read_unlock(); 1990 return -EADDRNOTAVAIL; 1991 default: 1992 return -ENOIOCTLCMD; 1993 } 1994 } 1995 1996 #ifdef CONFIG_COMPAT 1997 struct compat_sioc_sg_req6 { 1998 struct sockaddr_in6 src; 1999 struct sockaddr_in6 grp; 2000 compat_ulong_t pktcnt; 2001 compat_ulong_t bytecnt; 2002 compat_ulong_t wrong_if; 2003 }; 2004 2005 struct compat_sioc_mif_req6 { 2006 mifi_t mifi; 2007 compat_ulong_t icount; 2008 compat_ulong_t ocount; 2009 compat_ulong_t ibytes; 2010 compat_ulong_t obytes; 2011 }; 2012 2013 int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg) 2014 { 2015 struct compat_sioc_sg_req6 sr; 2016 struct compat_sioc_mif_req6 vr; 2017 struct vif_device *vif; 2018 struct mfc6_cache *c; 2019 struct net *net = sock_net(sk); 2020 struct mr_table *mrt; 2021 2022 mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT); 2023 if (!mrt) 2024 return -ENOENT; 2025 2026 switch (cmd) { 2027 case SIOCGETMIFCNT_IN6: 2028 if (copy_from_user(&vr, arg, sizeof(vr))) 2029 return -EFAULT; 2030 if (vr.mifi >= mrt->maxvif) 2031 return -EINVAL; 2032 vr.mifi = array_index_nospec(vr.mifi, mrt->maxvif); 2033 rcu_read_lock(); 2034 vif = &mrt->vif_table[vr.mifi]; 2035 if (VIF_EXISTS(mrt, vr.mifi)) { 2036 vr.icount = READ_ONCE(vif->pkt_in); 2037 vr.ocount = READ_ONCE(vif->pkt_out); 2038 vr.ibytes = READ_ONCE(vif->bytes_in); 2039 vr.obytes = READ_ONCE(vif->bytes_out); 2040 rcu_read_unlock(); 2041 2042 if (copy_to_user(arg, &vr, sizeof(vr))) 2043 return -EFAULT; 2044 return 0; 2045 } 2046 rcu_read_unlock(); 2047 return -EADDRNOTAVAIL; 2048 case SIOCGETSGCNT_IN6: 2049 if (copy_from_user(&sr, arg, sizeof(sr))) 2050 return -EFAULT; 2051 2052 rcu_read_lock(); 2053 c = ip6mr_cache_find(mrt, &sr.src.sin6_addr, &sr.grp.sin6_addr); 2054 if (c) { 2055 sr.pktcnt = atomic_long_read(&c->_c.mfc_un.res.pkt); 2056 sr.bytecnt = atomic_long_read(&c->_c.mfc_un.res.bytes); 2057 sr.wrong_if = atomic_long_read(&c->_c.mfc_un.res.wrong_if); 2058 rcu_read_unlock(); 2059 2060 if (copy_to_user(arg, &sr, sizeof(sr))) 2061 return -EFAULT; 2062 return 0; 2063 } 2064 rcu_read_unlock(); 2065 return -EADDRNOTAVAIL; 2066 default: 2067 return -ENOIOCTLCMD; 2068 } 2069 } 2070 #endif 2071 2072 static inline int ip6mr_forward2_finish(struct net *net, struct sock *sk, struct sk_buff *skb) 2073 { 2074 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), 2075 IPSTATS_MIB_OUTFORWDATAGRAMS); 2076 return dst_output(net, sk, skb); 2077 } 2078 2079 /* 2080 * Processing handlers for ip6mr_forward 2081 */ 2082 2083 static int ip6mr_prepare_xmit(struct net *net, struct mr_table *mrt, 2084 struct sk_buff *skb, int vifi) 2085 { 2086 struct vif_device *vif = &mrt->vif_table[vifi]; 2087 struct net_device *vif_dev; 2088 struct ipv6hdr *ipv6h; 2089 struct dst_entry *dst; 2090 struct flowi6 fl6; 2091 2092 vif_dev = vif_dev_read(vif); 2093 if (!vif_dev) 2094 return -1; 2095 2096 #ifdef CONFIG_IPV6_PIMSM_V2 2097 if (vif->flags & MIFF_REGISTER) { 2098 WRITE_ONCE(vif->pkt_out, vif->pkt_out + 1); 2099 WRITE_ONCE(vif->bytes_out, vif->bytes_out + skb->len); 2100 DEV_STATS_ADD(vif_dev, tx_bytes, skb->len); 2101 DEV_STATS_INC(vif_dev, tx_packets); 2102 ip6mr_cache_report(mrt, skb, vifi, MRT6MSG_WHOLEPKT); 2103 return -1; 2104 } 2105 #endif 2106 2107 ipv6h = ipv6_hdr(skb); 2108 2109 fl6 = (struct flowi6) { 2110 .flowi6_oif = vif->link, 2111 .daddr = ipv6h->daddr, 2112 }; 2113 2114 dst = ip6_route_output(net, NULL, &fl6); 2115 if (dst->error) { 2116 dst_release(dst); 2117 return -1; 2118 } 2119 2120 skb_dst_drop(skb); 2121 skb_dst_set(skb, dst); 2122 2123 /* 2124 * RFC1584 teaches, that DVMRP/PIM router must deliver packets locally 2125 * not only before forwarding, but after forwarding on all output 2126 * interfaces. It is clear, if mrouter runs a multicasting 2127 * program, it should receive packets not depending to what interface 2128 * program is joined. 2129 * If we will not make it, the program will have to join on all 2130 * interfaces. On the other hand, multihoming host (or router, but 2131 * not mrouter) cannot join to more than one interface - it will 2132 * result in receiving multiple packets. 2133 */ 2134 skb->dev = vif_dev; 2135 WRITE_ONCE(vif->pkt_out, vif->pkt_out + 1); 2136 WRITE_ONCE(vif->bytes_out, vif->bytes_out + skb->len); 2137 2138 /* We are about to write */ 2139 /* XXX: extension headers? */ 2140 if (skb_cow(skb, sizeof(*ipv6h) + LL_RESERVED_SPACE(vif_dev))) 2141 return -1; 2142 2143 ipv6h = ipv6_hdr(skb); 2144 ipv6h->hop_limit--; 2145 return 0; 2146 } 2147 2148 static void ip6mr_forward2(struct net *net, struct mr_table *mrt, 2149 struct sk_buff *skb, int vifi) 2150 { 2151 struct net_device *indev = skb->dev; 2152 2153 if (ip6mr_prepare_xmit(net, mrt, skb, vifi)) 2154 goto out_free; 2155 2156 IP6CB(skb)->flags |= IP6SKB_FORWARDED; 2157 2158 NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, 2159 net, NULL, skb, indev, skb->dev, 2160 ip6mr_forward2_finish); 2161 return; 2162 2163 out_free: 2164 kfree_skb(skb); 2165 } 2166 2167 static void ip6mr_output2(struct net *net, struct mr_table *mrt, 2168 struct sk_buff *skb, int vifi) 2169 { 2170 if (ip6mr_prepare_xmit(net, mrt, skb, vifi)) 2171 goto out_free; 2172 2173 ip6_output(net, NULL, skb); 2174 return; 2175 2176 out_free: 2177 kfree_skb(skb); 2178 } 2179 2180 /* Called with rcu_read_lock() */ 2181 static int ip6mr_find_vif(struct mr_table *mrt, struct net_device *dev) 2182 { 2183 int ct; 2184 2185 /* Pairs with WRITE_ONCE() in mif6_delete()/mif6_add() */ 2186 for (ct = READ_ONCE(mrt->maxvif) - 1; ct >= 0; ct--) { 2187 if (rcu_access_pointer(mrt->vif_table[ct].dev) == dev) 2188 break; 2189 } 2190 return ct; 2191 } 2192 2193 /* Called under rcu_read_lock() */ 2194 static void ip6_mr_forward(struct net *net, struct mr_table *mrt, 2195 struct net_device *dev, struct sk_buff *skb, 2196 struct mfc6_cache *c) 2197 { 2198 int psend = -1; 2199 int vif, ct; 2200 int true_vifi = ip6mr_find_vif(mrt, dev); 2201 2202 vif = c->_c.mfc_parent; 2203 atomic_long_inc(&c->_c.mfc_un.res.pkt); 2204 atomic_long_add(skb->len, &c->_c.mfc_un.res.bytes); 2205 WRITE_ONCE(c->_c.mfc_un.res.lastuse, jiffies); 2206 2207 if (ipv6_addr_any(&c->mf6c_origin) && true_vifi >= 0) { 2208 struct mfc6_cache *cache_proxy; 2209 2210 /* For an (*,G) entry, we only check that the incoming 2211 * interface is part of the static tree. 2212 */ 2213 cache_proxy = mr_mfc_find_any_parent(mrt, vif); 2214 if (cache_proxy && 2215 cache_proxy->_c.mfc_un.res.ttls[true_vifi] < 255) 2216 goto forward; 2217 } 2218 2219 /* 2220 * Wrong interface: drop packet and (maybe) send PIM assert. 2221 */ 2222 if (rcu_access_pointer(mrt->vif_table[vif].dev) != dev) { 2223 atomic_long_inc(&c->_c.mfc_un.res.wrong_if); 2224 2225 if (true_vifi >= 0 && READ_ONCE(mrt->mroute_do_assert) && 2226 /* pimsm uses asserts, when switching from RPT to SPT, 2227 so that we cannot check that packet arrived on an oif. 2228 It is bad, but otherwise we would need to move pretty 2229 large chunk of pimd to kernel. Ough... --ANK 2230 */ 2231 (READ_ONCE(mrt->mroute_do_pim) || 2232 c->_c.mfc_un.res.ttls[true_vifi] < 255) && 2233 time_after(jiffies, 2234 c->_c.mfc_un.res.last_assert + 2235 MFC_ASSERT_THRESH)) { 2236 c->_c.mfc_un.res.last_assert = jiffies; 2237 ip6mr_cache_report(mrt, skb, true_vifi, MRT6MSG_WRONGMIF); 2238 if (READ_ONCE(mrt->mroute_do_wrvifwhole)) 2239 ip6mr_cache_report(mrt, skb, true_vifi, 2240 MRT6MSG_WRMIFWHOLE); 2241 } 2242 goto dont_forward; 2243 } 2244 2245 forward: 2246 WRITE_ONCE(mrt->vif_table[vif].pkt_in, 2247 mrt->vif_table[vif].pkt_in + 1); 2248 WRITE_ONCE(mrt->vif_table[vif].bytes_in, 2249 mrt->vif_table[vif].bytes_in + skb->len); 2250 2251 /* 2252 * Forward the frame 2253 */ 2254 if (ipv6_addr_any(&c->mf6c_origin) && 2255 ipv6_addr_any(&c->mf6c_mcastgrp)) { 2256 if (true_vifi >= 0 && 2257 true_vifi != c->_c.mfc_parent && 2258 ipv6_hdr(skb)->hop_limit > 2259 c->_c.mfc_un.res.ttls[c->_c.mfc_parent]) { 2260 /* It's an (*,*) entry and the packet is not coming from 2261 * the upstream: forward the packet to the upstream 2262 * only. 2263 */ 2264 psend = c->_c.mfc_parent; 2265 goto last_forward; 2266 } 2267 goto dont_forward; 2268 } 2269 for (ct = c->_c.mfc_un.res.maxvif - 1; 2270 ct >= c->_c.mfc_un.res.minvif; ct--) { 2271 /* For (*,G) entry, don't forward to the incoming interface */ 2272 if ((!ipv6_addr_any(&c->mf6c_origin) || ct != true_vifi) && 2273 ipv6_hdr(skb)->hop_limit > c->_c.mfc_un.res.ttls[ct]) { 2274 if (psend != -1) { 2275 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC); 2276 if (skb2) 2277 ip6mr_forward2(net, mrt, skb2, psend); 2278 } 2279 psend = ct; 2280 } 2281 } 2282 last_forward: 2283 if (psend != -1) { 2284 ip6mr_forward2(net, mrt, skb, psend); 2285 return; 2286 } 2287 2288 dont_forward: 2289 kfree_skb(skb); 2290 } 2291 2292 /* Called under rcu_read_lock() */ 2293 static void ip6_mr_output_finish(struct net *net, struct mr_table *mrt, 2294 struct net_device *dev, struct sk_buff *skb, 2295 struct mfc6_cache *c) 2296 { 2297 int psend = -1; 2298 int ct; 2299 2300 WARN_ON_ONCE(!rcu_read_lock_held()); 2301 2302 atomic_long_inc(&c->_c.mfc_un.res.pkt); 2303 atomic_long_add(skb->len, &c->_c.mfc_un.res.bytes); 2304 WRITE_ONCE(c->_c.mfc_un.res.lastuse, jiffies); 2305 2306 /* Forward the frame */ 2307 if (ipv6_addr_any(&c->mf6c_origin) && 2308 ipv6_addr_any(&c->mf6c_mcastgrp)) { 2309 if (ipv6_hdr(skb)->hop_limit > 2310 c->_c.mfc_un.res.ttls[c->_c.mfc_parent]) { 2311 /* It's an (*,*) entry and the packet is not coming from 2312 * the upstream: forward the packet to the upstream 2313 * only. 2314 */ 2315 psend = c->_c.mfc_parent; 2316 goto last_forward; 2317 } 2318 goto dont_forward; 2319 } 2320 for (ct = c->_c.mfc_un.res.maxvif - 1; 2321 ct >= c->_c.mfc_un.res.minvif; ct--) { 2322 if (ipv6_hdr(skb)->hop_limit > c->_c.mfc_un.res.ttls[ct]) { 2323 if (psend != -1) { 2324 struct sk_buff *skb2; 2325 2326 skb2 = skb_clone(skb, GFP_ATOMIC); 2327 if (skb2) 2328 ip6mr_output2(net, mrt, skb2, psend); 2329 } 2330 psend = ct; 2331 } 2332 } 2333 last_forward: 2334 if (psend != -1) { 2335 ip6mr_output2(net, mrt, skb, psend); 2336 return; 2337 } 2338 2339 dont_forward: 2340 kfree_skb(skb); 2341 } 2342 2343 /* 2344 * Multicast packets for forwarding arrive here 2345 */ 2346 2347 int ip6_mr_input(struct sk_buff *skb) 2348 { 2349 struct net_device *dev = skb->dev; 2350 struct net *net = dev_net_rcu(dev); 2351 struct mfc6_cache *cache; 2352 struct mr_table *mrt; 2353 struct flowi6 fl6 = { 2354 .flowi6_iif = dev->ifindex, 2355 .flowi6_mark = skb->mark, 2356 }; 2357 int err; 2358 2359 /* skb->dev passed in is the master dev for vrfs. 2360 * Get the proper interface that does have a vif associated with it. 2361 */ 2362 if (netif_is_l3_master(dev)) { 2363 dev = dev_get_by_index_rcu(net, IPCB(skb)->iif); 2364 if (!dev) { 2365 kfree_skb(skb); 2366 return -ENODEV; 2367 } 2368 } 2369 2370 err = ip6mr_fib_lookup(net, &fl6, &mrt); 2371 if (err < 0) { 2372 kfree_skb(skb); 2373 return err; 2374 } 2375 2376 cache = ip6mr_cache_find(mrt, 2377 &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr); 2378 if (!cache) { 2379 int vif = ip6mr_find_vif(mrt, dev); 2380 2381 if (vif >= 0) 2382 cache = ip6mr_cache_find_any(mrt, 2383 &ipv6_hdr(skb)->daddr, 2384 vif); 2385 } 2386 2387 /* 2388 * No usable cache entry 2389 */ 2390 if (!cache) { 2391 int vif; 2392 2393 vif = ip6mr_find_vif(mrt, dev); 2394 if (vif >= 0) { 2395 int err = ip6mr_cache_unresolved(mrt, vif, skb, dev); 2396 2397 return err; 2398 } 2399 kfree_skb(skb); 2400 return -ENODEV; 2401 } 2402 2403 ip6_mr_forward(net, mrt, dev, skb, cache); 2404 2405 return 0; 2406 } 2407 2408 int ip6_mr_output(struct net *net, struct sock *sk, struct sk_buff *skb) 2409 { 2410 struct net_device *dev = skb_dst(skb)->dev; 2411 struct flowi6 fl6 = (struct flowi6) { 2412 .flowi6_iif = LOOPBACK_IFINDEX, 2413 .flowi6_mark = skb->mark, 2414 }; 2415 struct mfc6_cache *cache; 2416 struct mr_table *mrt; 2417 int err; 2418 int vif; 2419 2420 guard(rcu)(); 2421 2422 if (IP6CB(skb)->flags & IP6SKB_FORWARDED) 2423 goto ip6_output; 2424 if (!(IP6CB(skb)->flags & IP6SKB_MCROUTE)) 2425 goto ip6_output; 2426 2427 err = ip6mr_fib_lookup(net, &fl6, &mrt); 2428 if (err < 0) { 2429 kfree_skb(skb); 2430 return err; 2431 } 2432 2433 cache = ip6mr_cache_find(mrt, 2434 &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr); 2435 if (!cache) { 2436 vif = ip6mr_find_vif(mrt, dev); 2437 if (vif >= 0) 2438 cache = ip6mr_cache_find_any(mrt, 2439 &ipv6_hdr(skb)->daddr, 2440 vif); 2441 } 2442 2443 /* No usable cache entry */ 2444 if (!cache) { 2445 vif = ip6mr_find_vif(mrt, dev); 2446 if (vif >= 0) 2447 return ip6mr_cache_unresolved(mrt, vif, skb, dev); 2448 goto ip6_output; 2449 } 2450 2451 /* Wrong interface */ 2452 vif = cache->_c.mfc_parent; 2453 if (rcu_access_pointer(mrt->vif_table[vif].dev) != dev) 2454 goto ip6_output; 2455 2456 ip6_mr_output_finish(net, mrt, dev, skb, cache); 2457 return 0; 2458 2459 ip6_output: 2460 return ip6_output(net, sk, skb); 2461 } 2462 2463 int ip6mr_get_route(struct net *net, struct sk_buff *skb, struct rtmsg *rtm, 2464 u32 portid) 2465 { 2466 int err; 2467 struct mr_table *mrt; 2468 struct mfc6_cache *cache; 2469 struct rt6_info *rt = dst_rt6_info(skb_dst(skb)); 2470 2471 rcu_read_lock(); 2472 mrt = __ip6mr_get_table(net, RT6_TABLE_DFLT); 2473 if (!mrt) { 2474 rcu_read_unlock(); 2475 return -ENOENT; 2476 } 2477 2478 cache = ip6mr_cache_find(mrt, &rt->rt6i_src.addr, &rt->rt6i_dst.addr); 2479 if (!cache && skb->dev) { 2480 int vif = ip6mr_find_vif(mrt, skb->dev); 2481 2482 if (vif >= 0) 2483 cache = ip6mr_cache_find_any(mrt, &rt->rt6i_dst.addr, 2484 vif); 2485 } 2486 2487 if (!cache) { 2488 struct sk_buff *skb2; 2489 struct ipv6hdr *iph; 2490 struct net_device *dev; 2491 int vif; 2492 2493 dev = skb->dev; 2494 if (!dev || (vif = ip6mr_find_vif(mrt, dev)) < 0) { 2495 rcu_read_unlock(); 2496 return -ENODEV; 2497 } 2498 2499 /* really correct? */ 2500 skb2 = alloc_skb(sizeof(struct ipv6hdr), GFP_ATOMIC); 2501 if (!skb2) { 2502 rcu_read_unlock(); 2503 return -ENOMEM; 2504 } 2505 2506 NETLINK_CB(skb2).portid = portid; 2507 skb_reset_transport_header(skb2); 2508 2509 skb_put(skb2, sizeof(struct ipv6hdr)); 2510 skb_reset_network_header(skb2); 2511 2512 iph = ipv6_hdr(skb2); 2513 iph->version = 0; 2514 iph->priority = 0; 2515 iph->flow_lbl[0] = 0; 2516 iph->flow_lbl[1] = 0; 2517 iph->flow_lbl[2] = 0; 2518 iph->payload_len = 0; 2519 iph->nexthdr = IPPROTO_NONE; 2520 iph->hop_limit = 0; 2521 iph->saddr = rt->rt6i_src.addr; 2522 iph->daddr = rt->rt6i_dst.addr; 2523 2524 err = ip6mr_cache_unresolved(mrt, vif, skb2, dev); 2525 rcu_read_unlock(); 2526 2527 return err; 2528 } 2529 2530 err = mr_fill_mroute(mrt, skb, &cache->_c, rtm); 2531 rcu_read_unlock(); 2532 return err; 2533 } 2534 2535 static int ip6mr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb, 2536 u32 portid, u32 seq, struct mfc6_cache *c, int cmd, 2537 int flags) 2538 { 2539 struct nlmsghdr *nlh; 2540 struct rtmsg *rtm; 2541 int err; 2542 2543 nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), flags); 2544 if (!nlh) 2545 return -EMSGSIZE; 2546 2547 rtm = nlmsg_data(nlh); 2548 rtm->rtm_family = RTNL_FAMILY_IP6MR; 2549 rtm->rtm_dst_len = 128; 2550 rtm->rtm_src_len = 128; 2551 rtm->rtm_tos = 0; 2552 rtm->rtm_table = mrt->id; 2553 if (nla_put_u32(skb, RTA_TABLE, mrt->id)) 2554 goto nla_put_failure; 2555 rtm->rtm_type = RTN_MULTICAST; 2556 rtm->rtm_scope = RT_SCOPE_UNIVERSE; 2557 if (c->_c.mfc_flags & MFC_STATIC) 2558 rtm->rtm_protocol = RTPROT_STATIC; 2559 else 2560 rtm->rtm_protocol = RTPROT_MROUTED; 2561 rtm->rtm_flags = 0; 2562 2563 if (nla_put_in6_addr(skb, RTA_SRC, &c->mf6c_origin) || 2564 nla_put_in6_addr(skb, RTA_DST, &c->mf6c_mcastgrp)) 2565 goto nla_put_failure; 2566 err = mr_fill_mroute(mrt, skb, &c->_c, rtm); 2567 /* do not break the dump if cache is unresolved */ 2568 if (err < 0 && err != -ENOENT) 2569 goto nla_put_failure; 2570 2571 nlmsg_end(skb, nlh); 2572 return 0; 2573 2574 nla_put_failure: 2575 nlmsg_cancel(skb, nlh); 2576 return -EMSGSIZE; 2577 } 2578 2579 static int _ip6mr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb, 2580 u32 portid, u32 seq, struct mr_mfc *c, 2581 int cmd, int flags) 2582 { 2583 return ip6mr_fill_mroute(mrt, skb, portid, seq, (struct mfc6_cache *)c, 2584 cmd, flags); 2585 } 2586 2587 static int mr6_msgsize(bool unresolved) 2588 { 2589 size_t len = 2590 NLMSG_ALIGN(sizeof(struct rtmsg)) 2591 + nla_total_size(4) /* RTA_TABLE */ 2592 + nla_total_size(sizeof(struct in6_addr)) /* RTA_SRC */ 2593 + nla_total_size(sizeof(struct in6_addr)) /* RTA_DST */ 2594 ; 2595 2596 if (!unresolved) 2597 len = len 2598 + nla_total_size(4) /* RTA_IIF */ 2599 + nla_total_size(0) /* RTA_MULTIPATH */ 2600 + MAXMIFS * NLA_ALIGN(sizeof(struct rtnexthop)) 2601 /* RTA_MFC_STATS */ 2602 + nla_total_size_64bit(sizeof(struct rta_mfc_stats)) 2603 ; 2604 2605 return len; 2606 } 2607 2608 static void mr6_netlink_event(struct mr_table *mrt, struct mfc6_cache *mfc, 2609 int cmd) 2610 { 2611 struct net *net = read_pnet(&mrt->net); 2612 struct sk_buff *skb; 2613 int err = -ENOBUFS; 2614 2615 skb = nlmsg_new(mr6_msgsize(mfc->_c.mfc_parent >= MAXMIFS), GFP_ATOMIC); 2616 if (!skb) 2617 goto errout; 2618 2619 err = ip6mr_fill_mroute(mrt, skb, 0, 0, mfc, cmd, 0); 2620 if (err < 0) 2621 goto errout; 2622 2623 rtnl_notify(skb, net, 0, RTNLGRP_IPV6_MROUTE, NULL, GFP_ATOMIC); 2624 return; 2625 2626 errout: 2627 kfree_skb(skb); 2628 rtnl_set_sk_err(net, RTNLGRP_IPV6_MROUTE, err); 2629 } 2630 2631 static size_t mrt6msg_netlink_msgsize(size_t payloadlen) 2632 { 2633 size_t len = 2634 NLMSG_ALIGN(sizeof(struct rtgenmsg)) 2635 + nla_total_size(1) /* IP6MRA_CREPORT_MSGTYPE */ 2636 + nla_total_size(4) /* IP6MRA_CREPORT_MIF_ID */ 2637 /* IP6MRA_CREPORT_SRC_ADDR */ 2638 + nla_total_size(sizeof(struct in6_addr)) 2639 /* IP6MRA_CREPORT_DST_ADDR */ 2640 + nla_total_size(sizeof(struct in6_addr)) 2641 /* IP6MRA_CREPORT_PKT */ 2642 + nla_total_size(payloadlen) 2643 ; 2644 2645 return len; 2646 } 2647 2648 static void mrt6msg_netlink_event(const struct mr_table *mrt, struct sk_buff *pkt) 2649 { 2650 struct net *net = read_pnet(&mrt->net); 2651 struct nlmsghdr *nlh; 2652 struct rtgenmsg *rtgenm; 2653 struct mrt6msg *msg; 2654 struct sk_buff *skb; 2655 struct nlattr *nla; 2656 int payloadlen; 2657 2658 payloadlen = pkt->len - sizeof(struct mrt6msg); 2659 msg = (struct mrt6msg *)skb_transport_header(pkt); 2660 2661 skb = nlmsg_new(mrt6msg_netlink_msgsize(payloadlen), GFP_ATOMIC); 2662 if (!skb) 2663 goto errout; 2664 2665 nlh = nlmsg_put(skb, 0, 0, RTM_NEWCACHEREPORT, 2666 sizeof(struct rtgenmsg), 0); 2667 if (!nlh) 2668 goto errout; 2669 rtgenm = nlmsg_data(nlh); 2670 rtgenm->rtgen_family = RTNL_FAMILY_IP6MR; 2671 if (nla_put_u8(skb, IP6MRA_CREPORT_MSGTYPE, msg->im6_msgtype) || 2672 nla_put_u32(skb, IP6MRA_CREPORT_MIF_ID, msg->im6_mif) || 2673 nla_put_in6_addr(skb, IP6MRA_CREPORT_SRC_ADDR, 2674 &msg->im6_src) || 2675 nla_put_in6_addr(skb, IP6MRA_CREPORT_DST_ADDR, 2676 &msg->im6_dst)) 2677 goto nla_put_failure; 2678 2679 nla = nla_reserve(skb, IP6MRA_CREPORT_PKT, payloadlen); 2680 if (!nla || skb_copy_bits(pkt, sizeof(struct mrt6msg), 2681 nla_data(nla), payloadlen)) 2682 goto nla_put_failure; 2683 2684 nlmsg_end(skb, nlh); 2685 2686 rtnl_notify(skb, net, 0, RTNLGRP_IPV6_MROUTE_R, NULL, GFP_ATOMIC); 2687 return; 2688 2689 nla_put_failure: 2690 nlmsg_cancel(skb, nlh); 2691 errout: 2692 kfree_skb(skb); 2693 rtnl_set_sk_err(net, RTNLGRP_IPV6_MROUTE_R, -ENOBUFS); 2694 } 2695 2696 static const struct nla_policy ip6mr_getroute_policy[RTA_MAX + 1] = { 2697 [RTA_SRC] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)), 2698 [RTA_DST] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)), 2699 [RTA_TABLE] = { .type = NLA_U32 }, 2700 }; 2701 2702 static int ip6mr_rtm_valid_getroute_req(struct sk_buff *skb, 2703 const struct nlmsghdr *nlh, 2704 struct nlattr **tb, 2705 struct netlink_ext_ack *extack) 2706 { 2707 struct rtmsg *rtm; 2708 int err; 2709 2710 err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, ip6mr_getroute_policy, 2711 extack); 2712 if (err) 2713 return err; 2714 2715 rtm = nlmsg_data(nlh); 2716 if ((rtm->rtm_src_len && rtm->rtm_src_len != 128) || 2717 (rtm->rtm_dst_len && rtm->rtm_dst_len != 128) || 2718 rtm->rtm_tos || rtm->rtm_table || rtm->rtm_protocol || 2719 rtm->rtm_scope || rtm->rtm_type || rtm->rtm_flags) { 2720 NL_SET_ERR_MSG_MOD(extack, 2721 "Invalid values in header for multicast route get request"); 2722 return -EINVAL; 2723 } 2724 2725 if ((tb[RTA_SRC] && !rtm->rtm_src_len) || 2726 (tb[RTA_DST] && !rtm->rtm_dst_len)) { 2727 NL_SET_ERR_MSG_MOD(extack, "rtm_src_len and rtm_dst_len must be 128 for IPv6"); 2728 return -EINVAL; 2729 } 2730 2731 return 0; 2732 } 2733 2734 static int ip6mr_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, 2735 struct netlink_ext_ack *extack) 2736 { 2737 struct net *net = sock_net(in_skb->sk); 2738 struct in6_addr src = {}, grp = {}; 2739 struct nlattr *tb[RTA_MAX + 1]; 2740 struct mfc6_cache *cache; 2741 struct mr_table *mrt; 2742 struct sk_buff *skb; 2743 u32 tableid; 2744 int err; 2745 2746 err = ip6mr_rtm_valid_getroute_req(in_skb, nlh, tb, extack); 2747 if (err < 0) 2748 return err; 2749 2750 skb = nlmsg_new(mr6_msgsize(false), GFP_KERNEL); 2751 if (!skb) 2752 return -ENOBUFS; 2753 2754 if (tb[RTA_SRC]) 2755 src = nla_get_in6_addr(tb[RTA_SRC]); 2756 if (tb[RTA_DST]) 2757 grp = nla_get_in6_addr(tb[RTA_DST]); 2758 tableid = nla_get_u32_default(tb[RTA_TABLE], 0); 2759 2760 rcu_read_lock(); 2761 2762 mrt = __ip6mr_get_table(net, tableid ?: RT_TABLE_DEFAULT); 2763 if (!mrt) { 2764 NL_SET_ERR_MSG_MOD(extack, "MR table does not exist"); 2765 err = -ENOENT; 2766 goto err; 2767 } 2768 2769 cache = ip6mr_cache_find(mrt, &src, &grp); 2770 if (!cache) { 2771 NL_SET_ERR_MSG_MOD(extack, "MR cache entry not found"); 2772 err = -ENOENT; 2773 goto err; 2774 } 2775 2776 err = ip6mr_fill_mroute(mrt, skb, NETLINK_CB(in_skb).portid, 2777 nlh->nlmsg_seq, cache, RTM_NEWROUTE, 0); 2778 if (err < 0) 2779 goto err; 2780 2781 rcu_read_unlock(); 2782 2783 return rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid); 2784 2785 err: 2786 rcu_read_unlock(); 2787 kfree_skb(skb); 2788 return err; 2789 } 2790 2791 static int ip6mr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb) 2792 { 2793 const struct nlmsghdr *nlh = cb->nlh; 2794 struct fib_dump_filter filter = {}; 2795 int err; 2796 2797 rcu_read_lock(); 2798 2799 if (cb->strict_check) { 2800 err = ip_valid_fib_dump_req(sock_net(skb->sk), nlh, 2801 &filter, cb); 2802 if (err < 0) 2803 goto unlock; 2804 } 2805 2806 if (filter.table_id) { 2807 struct mr_table *mrt; 2808 2809 mrt = __ip6mr_get_table(sock_net(skb->sk), filter.table_id); 2810 if (!mrt) { 2811 if (rtnl_msg_family(cb->nlh) != RTNL_FAMILY_IP6MR) { 2812 err = skb->len; 2813 goto unlock; 2814 } 2815 2816 NL_SET_ERR_MSG_MOD(cb->extack, "MR table does not exist"); 2817 err = -ENOENT; 2818 goto unlock; 2819 } 2820 2821 err = mr_table_dump(mrt, skb, cb, _ip6mr_fill_mroute, 2822 &mfc_unres_lock, &filter); 2823 err = skb->len ? : err; 2824 goto unlock; 2825 } 2826 2827 err = mr_rtm_dumproute(skb, cb, ip6mr_mr_table_iter, 2828 _ip6mr_fill_mroute, &mfc_unres_lock, &filter); 2829 unlock: 2830 rcu_read_unlock(); 2831 2832 return err; 2833 } 2834